aggregate by cve

tests/test_scan.py

@@ -399,6 +399,31 @@ class ReportTests(unittest.TestCase):
         self.assertIn("Image: nginx:1.27", body)
         self.assertIn("Containers: web, web-worker", body)
 
+    def test_build_aggregated_body_groups_by_cve(self) -> None:
+        aggregated = scan.AggregatedReport()
+        vuln1 = {
+            "Severity": "CRITICAL",
+            "VulnerabilityID": "CVE-1",
+            "PkgName": "libc",
+            "InstalledVersion": "1.0",
+            "FixedVersion": "1.1",
+        }
+        vuln2 = {
+            "Severity": "HIGH",
+            "VulnerabilityID": "CVE-1",
+            "PkgName": "libc",
+            "InstalledVersion": "1.0",
+            "FixedVersion": "1.1",
+        }
+        aggregated.add_vulnerability(vuln1, "nginx:1.27", ["web"])
+        aggregated.add_vulnerability(vuln2, "redis:7", ["cache"])
+        body = scan.build_aggregated_body(aggregated, 15)
+        self.assertIn("CVE-1", body)
+        self.assertIn("containers: web", body)
+        self.assertIn("image: nginx:1.27", body)
+        self.assertIn("containers: cache", body)
+        self.assertIn("image: redis:7", body)
+
 
 class TrivyCommandTests(unittest.TestCase):
     def test_run_trivy_passes_vex_sources_in_order(self) -> None:
@@ -528,8 +553,9 @@ printf '%s\\n' "$*" >> "$APPRISE_LOG"
 
         self.assertEqual(code, 1)
         notification = Path(self.apprise_log).read_text()
-        self.assertIn("[container: testphp]", notification)
-        self.assertIn("Container: testphp", notification)
+        self.assertIn("CVE-2026-0001", notification)
+        self.assertIn("containers: testphp", notification)
+        self.assertIn("image: testphp-php", notification)
 
     def test_scan_failure_notification_includes_container(self) -> None:
         containers = [container("a" * 64, "testphp-php", name="testphp")]
@@ -540,6 +566,7 @@ printf '%s\\n' "$*" >> "$APPRISE_LOG"
         notification = Path(self.apprise_log).read_text()
         self.assertIn("Scan failed: testphp-php [container: testphp]", notification)
         self.assertIn("Container: testphp", notification)
+        self.assertIn("Trivy could not complete the scan", notification)
 
     def test_exit_code_zero_when_policy_does_not_fail(self) -> None:
         with FakeDocker([container("a" * 64, "testphp-php")]) as docker: