Is "secret detection" just an example of a "scan" pipeline step, or is it its own type of step?

[amfred]

See the conversation here: https://github.com/cdfoundation/sig-interoperability/pull/81#discussion_r787756022

[bendory]

I think this is a specific instance of the more generic static artifact analysis -- no different from code linters, formatters, scanners, etc. Or perhaps I'm misunderstanding your example or missing something?