Generates lock files for npm/Java builds and auto-downloads Trivy for vulnerability scanning

Manages cosign binary lifecycle and provides tasks for container image signing and attestation

Wraps OWASP dep-scan for vulnerability scanning with reachability analysis