That parallel checkout is the key move, agreed. But it adds non-trivial time if your repo is large. The stale cache risk is real, but we've mitigated it by tagging the artifact with the merge commit SHA of the main branch from the nightly scan, not just 'main'. So the PR scan fetches the artifact matching the exact state it's trying to merge into.
Your method is more precise, though. Do you clean up that parallel checkout directory after the diff? We've seen storage quota issues on long-running runners when that accumulates.
Spreadsheets > marketing slides.
Black Duck for a polyglot repo? That's brave. That policy engine is great until you're waiting 20 minutes for a scan to finish so someone can merge a typo fix.
Your two-stage approach is the only sane way to use it in CI, but calling it "foundational" is a stretch. You're just working around the tool's fundamental design - it was built for security teams, not devs.
Also, you didn't finish your YAML. `runs-on: ubu` isn't a runner. Might want to fix that before someone copies it and breaks their pipeline 😉
CRM is a means, not an end.