more changes

README.md

@@ -26,11 +26,12 @@ host only needs Docker. JSON reports are kept on disk for auditing.
    - `FAIL_ON` (default `HIGH`) – when the script should exit with code `1`
      (useful for CI).
 3. Notifications are sent. When `IMPORTANT_CONTAINERS` is set, each named
-   container gets its own complete CVE list plus a fenced monospaced table of
-   image/container severity counts (`C`, `H`, `M`, `L`), even if there are no
-   CVEs at or above `NOTIFY_MIN_SEVERITY`. Missing important containers are
-   reported, every other container is summarised in chunks using the same
-   table, and one final notification lists the important packages plus the
+   container with findings at or above `NOTIFY_MIN_SEVERITY` gets its own
+   complete CVE list plus a fenced monospaced table of image/container
+   severity counts (`C`, `H`, `M`, `L`); clean containers appear only in the
+   final summary. Missing important containers are reported, every other
+   container is summarised in chunks using the same table (one row per
+   image), and one final notification lists the important packages plus the
    overall totals. Columns below `NOTIFY_MIN_SEVERITY` are omitted. Without
    `IMPORTANT_CONTAINERS`, a single aggregated notification lists each CVE with
    the affected packages, containers, and images.
@@ -262,20 +263,24 @@ When the list is set, notifications are split into four groups:
    `Vulnerability scan: <container> (<image>)`. It lists every CVE at or above
    `NOTIFY_MIN_SEVERITY`, with the image/container and severity counts shown in
    a padded fenced monospaced table (`Image`, `Container`, `C`, `H`, `M`, `L`).
-   A notification is still sent if there are none, showing totals at 0/0.
+   Containers with no CVEs at or above the threshold get no individual
+   notification; they still appear with 0/0 totals in the final summary.
 2. **One notification for important containers that are missing** – either not
    running, or running an image that was not part of the scan.
 3. **One summary notification for every other container**, split every ~12
-   containers, showing the same fenced table of image/container and
+   images, showing the same fenced table of image/container and
    `fixable/total` severity counts.
 4. **One final summary notification** listing the important containers in the
    same table, their packages, followed by the overall severity counts and
-   `fixable/total in N container(s)`.
+   `fixable/total in N image(s)`.
 
 Severity columns below `NOTIFY_MIN_SEVERITY` are omitted from the tables (for
 example, only `C` and `H` are shown when it is `HIGH`). Image digests are
 shortened to their first six characters in notification text; report filenames
-keep the full reference.
+keep the full reference. Table rows are sorted alphabetically by container,
+then by image, and there is one row per image: containers that share an image
+are merged into a single row listing all of them, so their counts are not
+repeated.
 
 A container can appear in only the important list or the summary, never both.
 If an important container shares its image with other containers, the others