harness: measure a runner's MLLP ingress rate instead of pass/failing one point #422

Job	Run time
pip-audit (dependency vulnerabilities)	1m 19s
semgrep (project SAST rules)	33s
forbidden-content (customer/PHI leak guard)	30s
crypto-inventory (ASVS 11.1.3 discovery gate)	8s
gitleaks (secret scan)	14s
bandit (Python SAST)	26s
npm-audit (ide dependency vulnerabilities)	9s
SBOMs (CycloneDX, multi-ecosystem)	-1s
trivy (container image vulnerabilities)	-1s
	3m 17s

Navigation Menu