Plugin Directory: Sharpen the findings list in security scan alerts

[obenland]

Follow-up to #779 and #781. The restyled alert works, but the findings section still blurs together — wrapped titles and file lines run into each other with nothing binding the list, 6 error and 6.5 error misalign, and two display defects slipped through the earlier passes. This tightens the mrkdwn (no emoji):

• Blockquote rail — the findings list is wrapped in a > blockquote, giving the middle section a left rail that binds it into one visual unit and sets it off from the headline and footer.
• Aligned scores — risk scores are padded to one decimal (6.0 error, not 6 error) so the bold badges line up across findings.
• Investigation result restored — Plugin Directory: Restyle the Gandalf Slack alert for scannability #781 unintentionally dropped the (investigation: reproduced) marker from Plugin Directory: Include findings in security scan alerts #779. A completed investigation with a reproduced or conditional result — the strongest "this is real" signal in the payload — now renders in the finding's bold badge: *9.8 error · reproduced*.
• Overflow line links to the report — …and 12 more in the full report. is now italic and links to the Gandalf report, since that line is the affordance for seeing the rest.
• Double-encoding fix — post titles are stored entity-encoded, so htmlspecialchars() re-encoded the ampersand and Slack displayed literal & (visible today as Jetpack - WP Security, Backup, Speed, & Growth). Titles are now html_entity_decode()d before the Slack escaping, so named and numeric entities render as their characters while <!channel>-style control sequences stay neutralized.

Rendered with the example callback payload:

Security scan found *3 findings* in *Accordion And Accordion Slider* 1.4.4
3,000+ active installs

> *9.8 error*: Remote analytics response controls a PHP callable and both of its arguments, reachable through an unauthenticated REST route
> ↳ wpos-analytics/includes/class-anylc-admin.php:688
> *9.0 error*: Jetpack Scan matched php_malware_fake_essential_analytics_001
> ↳ accordion-and-accordion-slider-1.4.4/wpos-analytics/includes/class-anylc-admin.php:599
> *5.2 error*: Unauthenticated REST route forces outbound transmission of site and administrator data, bypassing the plugin's own opt-in consent gate
> ↳ wpos-analytics/includes/class-anylc-admin.php:600

wp-admin · Gandalf report

(where the > lines render as one quoted block and the plugin name, path:line references, overflow line, and footer are links)

Notes:

• Verified in a rendering harness against the example payload, an entity-encoded Jetpack-style title, a 17-finding overflow case with a reproduced investigation, and hostile strings (<!channel>/<!here> in titles, | and </> in file paths and the report URL) — escaping and link syntax hold in all cases.
• phpcs-changed against trunk reports no new violations; the full-file violations are pre-existing.
• Still text-only through slack_dm() — attachments/Block Kit (severity color bars, buttons) remain a possible follow-up requiring a transport change in the private repository.

🤖 Generated with Claude Code

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props obenland.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[Copilot]

Pull request overview

This PR improves the readability of the Plugin Directory’s Gandalf security-scan Slack alert by adding severity-driven visual cues and tightening up Slack mrkdwn formatting, while fixing double-encoded plugin titles in the message.

Changes:

• Decode entity-encoded plugin post titles before Slack escaping to prevent &-style double-encoding.
• Add CVSS-band severity “dot” indicators and normalized 1-decimal risk-score badges (including restored investigation result markers).
• Wrap findings in a Slack blockquote and make the overflow line an italicized link to the full report, reusing a safely-escaped report URL.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.