fix: address CodeRabbit nitpicks

- Rename "Security" column to "Sec-Sev" for clarity
- Increase message truncation from 80 to 120 characters
- Remove ineffective trivy:ignore:DS029 before FROM statements
- Add explanatory comments to remaining DS029 ignores
- Clean up apt cache in builder stage

Author: david-waltermire

.github/workflows/build.yml

@@ -171,15 +171,15 @@ jobs:
                 echo "<details>" >> $GITHUB_STEP_SUMMARY
                 echo "<summary>View $RESULTS finding(s)</summary>" >> $GITHUB_STEP_SUMMARY
                 echo "" >> $GITHUB_STEP_SUMMARY
-                echo "| Level | Security | Rule | Location | Message |" >> $GITHUB_STEP_SUMMARY
-                echo "|-------|----------|------|----------|---------|" >> $GITHUB_STEP_SUMMARY
+                echo "| Level | Sec-Sev | Rule | Location | Message |" >> $GITHUB_STEP_SUMMARY
+                echo "|-------|---------|------|----------|---------|" >> $GITHUB_STEP_SUMMARY
                 # Join results with rules to get security-severity (which is on rule definitions, not results)
                 jq -r '
                   (.runs[0].tool.driver.rules // []) as $driver_rules |
                   ([.runs[0].tool.extensions[]?.rules // []] | add // []) as $ext_rules |
                   ($driver_rules + $ext_rules | map({(.id): (.properties["security-severity"] // null)}) | add // {}) as $severities |
                   .runs[0].results[] |
-                  "| \(.level // "warning") | \($severities[.ruleId] // "N/A") | \(.ruleId // "unknown") | `\(.locations[0].physicalLocation.artifactLocation.uri // "unknown"):\(.locations[0].physicalLocation.region.startLine // "?")` | \(.message.text | gsub("\n"; " ") | gsub("\\|"; "\\\\|") | .[0:80]) |"
+                  "| \(.level // "warning") | \($severities[.ruleId] // "N/A") | \(.ruleId // "unknown") | `\(.locations[0].physicalLocation.artifactLocation.uri // "unknown"):\(.locations[0].physicalLocation.region.startLine // "?")` | \(.message.text | gsub("\n"; " ") | gsub("\\|"; "\\\\|") | .[0:120]) |"
                 ' "$sarif" >> $GITHUB_STEP_SUMMARY
                 echo "" >> $GITHUB_STEP_SUMMARY
                 echo "</details>" >> $GITHUB_STEP_SUMMARY

Dockerfile.ci

@@ -4,10 +4,9 @@ ARG BUILDER_IMAGE=maven:3.9.9-eclipse-temurin-17
 ARG RUNNER_IMAGE=eclipse-temurin:17
 
 # Builder stage runs as root; runner stage uses non-root user
-# trivy:ignore:DS029
 FROM ${BUILDER_IMAGE} AS builder
-# trivy:ignore:DS029
-RUN apt-get update && apt-get install -y unzip
+# trivy:ignore:DS029 - Builder stage requires root for system package installation
+RUN apt-get update && apt-get install -y unzip && rm -rf /var/lib/apt/lists/*
 COPY ./target/*oscal-cli.zip /tmp/oscal-cli.zip
 WORKDIR /tmp
 RUN unzip /tmp/oscal-cli.zip -d /opt/oscal-cli

Dockerfile.local

@@ -4,15 +4,14 @@ ARG BUILDER_IMAGE=maven:3.9.9-eclipse-temurin-17
 ARG RUNNER_IMAGE=eclipse-temurin:17
 
 # Builder stage runs as root; runner stage uses non-root user
-# trivy:ignore:DS029
 FROM ${BUILDER_IMAGE} AS builder
 ARG BUILDER_JDK_VENDOR=temurin
 ARG BUILDER_JDK_MAJOR_VERSION=17
 ARG BUILDER_JDK_HOME_PATH=/opt/java/openjdk
 COPY . /usr/local/src
 WORKDIR /usr/local/src
-# trivy:ignore:DS029
-RUN apt-get update && apt-get install -y unzip
+# trivy:ignore:DS029 - Builder stage requires root for system package installation
+RUN apt-get update && apt-get install -y unzip && rm -rf /var/lib/apt/lists/*
 RUN <<EOF
 mkdir -p /root/.m2
 cat > /root/.m2/toolchains.xml << XMLEOF