Plugin Directory: Rebuild the Plugin Check Slack alert with Block Kit

[obenland]

Companion to #782. The Plugin Check (PCP) alert in the review channel still used the original text format: raw labeled URLs, the :bangbang: install wall, and a fixed 80-column table. This rebuilds it in the same Block Kit design language as the Gandalf alert while keeping the two feeds visually distinguishable:

• Sender — displays as Plugin Check (Gandalf alerts show as Gandalf), so the channel tells the feeds apart by name.
• Header block — plugin name and scanned ref (Flex Fields trunk), entity-decoded, capped at Slack's 150-char header limit.
• Summary section — *9 errors* · 10+ active installs (installs bold at ≥10,000). No button on this feed.
• Context links — wp-admin · Source · Plugin page, replacing the three raw labeled URLs.
• Error table — a divider, then the error-code table in a code block, with the code column sized to the longest name instead of a fixed 80 characters (typically half as wide), rows sorted by error count, capped at 10 with an …and N more error types. trailer — staying well inside the 3,000-char section limit. Codes are escaped; the scanned tag is URL-encoded in the Source link.
• Pure blocks, no attachments — PCP errors carry no risk score, so nothing needs a color bar; this also avoids Slack's "Added by" attribution label entirely.
• Accurate count — the headline derives from the displayed summary instead of totals.errors, which could disagree with the table (the current alert can say "Found 1 errors" above a table listing 9).
• Fallback text — Plugin Check found 9 errors in Flex Fields trunk, escaped, for notifications; the cron log echo keeps the same content in plain text.

Verified in a rendering harness against the current alert's real-world example (Flex Fields), an entity-encoded title with 18 error codes (row cap + bold installs + tag-based Source URL), hostile strings (<!channel> in titles and codes, </>/| in the tag), and the closed-plugin no-op. phpcs-changed against trunk reports no new violations on changed lines.

Deploy-order dependency: same as #782 — requires the notify_slack() array-message support in the private dotorg repository first; an un-upgraded slack_dm() would JSON-encode the array into text and Slack would reject the payload.

🤖 Generated with Claude Code

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props obenland.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[Copilot]

Pull request overview

Rebuilds the Plugin Check (PCP) Slack alert in the Plugin Directory scanner to use Slack Block Kit (matching the newer Gandalf alert style) instead of the legacy text/table format, improving readability and consistency in the review channel.

Changes:

• Replace the legacy text + fixed-width table Slack payload with a Block Kit message (header, summary, context links, error list).
• Compute the headline error total from the displayed per-code summary (avoiding mismatches with $results['totals']['errors']).
• Add fallback notification text and set Slack sender username to “Plugin Check”.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Suppressed comments (2)

wordpress.org/public_html/wp-content/plugins/plugin-directory/jobs/class-plugin-scan.php:363

• The cron log output uses $fallback and $table, which are Slack-escaped via htmlspecialchars(). This means the CLI log can show entity sequences like &, <, etc., which contradicts the intent of keeping the cron echo in plain text and makes logs harder to read when titles/tags include &, <, or >.

		}

		if ( defined( 'PLUGIN_REVIEW_ALERT_SLACK_CHANNEL' ) && function_exists( 'slack_dm' ) ) {
			slack_dm(
				[

wordpress.org/public_html/wp-content/plugins/plugin-directory/jobs/class-plugin-scan.php:268

• The usort() comparator only sorts by errors. When multiple codes have the same error count, the resulting order is not deterministic (PHP's sort is not stable), which can make the Slack table (and cron logs) reorder between runs even when the underlying data is unchanged. Adding a tiebreaker (e.g., by files, then code) keeps the output stable and easier to scan.

		usort(
			$codes,
			static function ( $a, $b ) {
				return $b['errors'] <=> $a['errors'];
			}