Plugin Directory: Rebuild the security scan alert with Block Kit

[obenland]

Follow-up to #779 and #781, superseding the earlier text-mrkdwn restyle on this branch. The alert becomes a structured Block Kit message, designed iteratively against rendered mockups of real callback payloads:

• Header block — plugin name and version as Slack's large heading (Accordion and Accordion Slider 1.4.4), with (closed) appended for closed plugins. Header blocks are plain text, so entity-encoded titles are decoded (fixes the literal & visible in current alerts) and control sequences like <!channel> are inert without escaping.
• Summary section — *3 findings* · 3,000+ active installs (installs bold at ≥10,000), with a primary View report link button as the section accessory. The button URL is esc_url_raw()-sanitized and omitted entirely if the callback carries no report URL, so the block set stays valid.
• Context links — small wp-admin · Plugin page line; the scanned ref is appended (escaped) only when it differs from the version, e.g. · trunk.
• One color-barred attachment per finding (top 5 by risk score): the bar encodes the risk band — red ≥9, orange ≥6, yellow ≥4, gray below. Each card is a section with *9.8* — <title> (score padded to one decimal, title excerpted to 150 chars) plus a small File: context line linking to the plugins Trac browser at the scanned ref and line.
• Sender — displays as Gandalf via the new username override, instead of the dispatching web host (web2.dca.wordpress.org).
• Fallback text — Security scan found 3 findings in <plugin> <version> (max risk 9.8), escaped, keeping push notifications and non-block surfaces informative.

Verified in a rendering harness against the example callback payload, an entity-encoded Jetpack-style title with 17 findings, and hostile strings (<!channel>/<!here> in titles, | and </> in file paths and the report URL) — mrkdwn escaping, link syntax, and block validity hold in all cases. phpcs-changed against trunk reports no new violations.

Deploy-order dependency: this requires the notify_slack()/slack_dm() array-message support (text/blocks/attachments/username keys) in the private dotorg repository to land first. Against an un-upgraded slack_dm(), the array would be JSON-encoded into the webhook text field and Slack would reject the payload, silently dropping the alert.

🤖 Generated with Claude Code

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props obenland.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[Copilot]

Pull request overview

This PR improves the readability of the Plugin Directory’s Gandalf security-scan Slack alert by adding severity-driven visual cues and tightening up Slack mrkdwn formatting, while fixing double-encoded plugin titles in the message.

Changes:

• Decode entity-encoded plugin post titles before Slack escaping to prevent &-style double-encoding.
• Add CVSS-band severity “dot” indicators and normalized 1-decimal risk-score badges (including restored investigation result markers).
• Wrap findings in a Slack blockquote and make the overflow line an italicized link to the full report, reusing a safely-escaped report URL.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.