Plugin Directory: Restyle the Gandalf Slack alert for scannability

[obenland]

Follow-up to #779. The findings alert is functional but reads as a wall of label: value lines. This restyles it with Slack mrkdwn — structure, weight, and links rather than more text (and no emoji):

• Headline — Security scan found *2 findings* in *Create* 2.6.2, with the plugin name as a named link to its directory page. The release ref is only appended (as `code`) when it differs from the version, dropping the redundant 2.6.2 (2.6.2).
• Install count — on its own line, bold at ≥10k instead of the :bangbang: wall. The previous Findings:, Severity:, and Max risk score: lines are gone entirely: the finding count moved into the headline, and each severity and score is visible in the list itself.
• Findings — each led by a bold *6.5 warning*: badge, with the file reference moved to a ↳ continuation line and linked straight to the plugins Trac browser at the scanned ref and line — https://plugins.trac.wordpress.org/browser/{slug}/tags/{ref}/{path}#L{line}, using the same trunk/tags/ split as Plugin_Scan. An …and N more in the full report. line appears when the callback carries more findings than the five shown.
• Footer — wp-admin · Gandalf report as named links, replacing three raw URLs. The plugin page link now lives on the headline title.

Rendered with the same data as the current alert:

Security scan found *2 findings* in *Create* 2.6.2
6,000+ active installs

*6.5 warning*: Create Studio can remotely download the site's full WordPress debug log without per-request local approval.
↳ lib/settings/class-webhook-handler.php:428
*6.3 warning*: Legacy webhook signatures omit freshness and site audience, allowing captured events to be replayed against other installations.
↳ lib/settings/class-webhook-handler.php:108

wp-admin · Gandalf report

(where Create, the path:line references, and the footer are links)

Notes:

• Everything still flows through slack_dm(), which is text-only — the message renders as mrkdwn (the current alert already relies on that for *bold*). Slack text messages offer no font-size or color control; attachments/Block Kit (severity color bars, fields, buttons) would require a webhook-based transport change in the private repository, so that's left as a possible follow-up.
• handle_callback() still passes severity_counts and max_risk_score into the notify record even though they're no longer rendered — kept as plumbing for the risk-score suspension follow-up (Plugin Directory: Block a release when a security scan reports a high risk score #777).
• Untrusted scanner/plugin strings keep the htmlspecialchars( …, ENT_NOQUOTES ) escaping from Plugin Directory: Include findings in security scan alerts #779, including link labels; the untrusted file path segments are additionally rawurlencode()d in the Trac URL, which also keeps | and > from breaking Slack's link syntax, and | is percent-encoded in the callback-supplied report URL for the same reason (verified in a rendering harness with hostile titles and paths).
• Severity labels render as the scanner reports them (escaped), so a new severity key never breaks or suppresses an alert.

🤖 Generated with Claude Code

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props obenland.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[Copilot]

Pull request overview

This PR refactors the Plugin Directory’s Gandalf security-scan Slack DM to be more scannable by switching from a “label: value” block to structured Slack mrkdwn (headline with plugin link, install-count emphasis, per-finding badges, and a compact footer with named links).

Changes:

• Reworked the Slack message header to include a finding-count headline with a named link to the plugin directory page and a cleaner version/release-ref display.
• Reformatted findings into a readable list with severity/risk badges, optional investigation outcomes, and per-finding Trac file links.
• Replaced the raw URL footer lines with named links to wp-admin and the Gandalf report.

Suppressed comments (1)

wordpress.org/public_html/wp-content/plugins/plugin-directory/jobs/class-plugin-scan-gandalf.php:369

• In file_link(), the plugin slug is inserted into the Trac browser URL without URL-encoding. While plugin slugs are usually safe, encoding it as a path segment avoids malformed URLs and prevents characters like | from breaking Slack's <url|label> formatting.

		$url = sprintf(
			'https://plugins.trac.wordpress.org/browser/%s/%s/%s',
			$plugin->post_name,
			'trunk' === $release_ref ? 'trunk' : 'tags/' . rawurlencode( $release_ref ),
			implode( '/', array_map( 'rawurlencode', explode( '/', $file_path ) ) )

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Suppressed comments (1)

wordpress.org/public_html/wp-content/plugins/plugin-directory/jobs/class-plugin-scan-gandalf.php:361

• file_link() appends a Trac line fragment for any non-zero $line, including negative numbers (e.g. -1), which would produce an invalid #L-1 URL fragment and misleading label text. Treat line numbers as positive-only and omit the fragment otherwise.

	/**
	 * Return the highest-risk findings first, bounded for display.
	 *
	 * The callback orders findings by ID, not by severity.
	 *