Update Security-Notification.yml

Fix Slack Payload

Author: antoniomorello-DB

.github/workflows/Security-Notification.yml

@@ -53,42 +53,26 @@ jobs:
           STATE=$(echo "$ALERTS" | jq -r '.[0] | .state')
 
           # 5. Send Slack Notification
-          curl -X POST -H 'Content-type: application/json' --data "{
-            \"channel\": \"#docs-devdocs-notifications\",
-            \"username\": \"Dependabot Watchdog\",
-            \"icon_emoji\": \":rotating_light:\",
-            \"attachments\": [
-              {
-                \"color\": \"#D00000\",
-                \"blocks\": [
-                  {
-                    \"type\": \"section\",
-                    \"text\": {
-                      \"type\": \"mrkdwn\",
-                      \"text\": \":rotating_light: *New Dependabot Alert Detected*\"
-                    }
-                  },
-                  {
-                    \"type\": \"section\",
-                    \"fields\": [
-                      {
-                        \"type\": \"mrkdwn\",
-                        \"text\": \"*Package:*\n$PACKAGE\"
-                      },
-                      {
-                        \"type\": \"mrkdwn\",
-                        \"text\": \"*Severity:*\n$SEVERITY\"
-                      }
-                    ]
-                  },
-                  {
-                    \"type\": \"section\",
-                    \"text\": {
-                      \"type\": \"mrkdwn\",
-                      \"text\": \"<$URL|View Alert on GitHub>\"
-                    }
-                  }
-                ]
-              }
-            ]
-          }" "$SLACK_WEBHOOK_URL"
+            # Build message text using jq to safely handle user input
+          MESSAGE_TEXT=$(jq -n \
+            --arg repo "$REPO_NAME" \
+            --arg title "$ISSUE_TITLE" \
+            --arg user "$ISSUE_USER" \
+            --arg url "$ISSUE_URL" \
+            '*📢 New Dependabot Alert \($repo) 📢*\n\n*Issue Title:* \($title)\n*Opened By:* \($user)\n\n*View Issue:* \($url)')
+
+          # Build Slack payload
+          SLACK_PAYLOAD=$(jq -n \
+            --arg text "$MESSAGE_TEXT" \
+            '{
+              "channel": "#docs-devdocs-notifications",
+              "username": "Security Vulnerability Slack Notification",
+              "icon_emoji": ":rotating_light:",
+              "text": $text
+            }')
+
+          # Send to Slack
+          curl -X POST \
+               -H 'Content-type: application/json' \
+               --data "$SLACK_PAYLOAD" \
+               "$SLACK_WEBHOOK"