Security (OSS-CLI) #136

Job	Run time
Semgrep (SAST)	22s
Trivy (filesystem + container scan)	15s
OSV-Scanner (SCA)	21s
SBOM (SPDX + CycloneDX)	24s
jscpd (duplication < 3% on touched code)	10s
Gitleaks (secret scan)	9s
	1m 41s

Provide feedback