Security (OSS-CLI) #240

Job	Run time
Gitleaks (secret scan)	14s
Semgrep (SAST)	22s
Trivy (filesystem + container scan)	26s
jscpd (duplication < 3% on touched code)	16s
OSV-Scanner (SCA)	56s
SBOM (SPDX + CycloneDX)	16s
	2m 30s

Provide feedback