Plugin Directory: Email committers the outcome of a security scan

[obenland]

Summary

Adds the author-facing half of the security scan pipeline: a completed scan callback now emails the plugin's committers its findings, alongside the existing reviewer surfaces (Slack alert, internal note).

Builds on #777 — its commit is included here until it lands; only the latest commit is new.

What it does

• A new Email\Security_Scan_Findings (Markdown, multipart HTML + plain text) tells committers what was found: per finding the risk score, title, the file path linked to the plugins.trac.wordpress.org browser, the reported code snippet as a code block, and the finding's explanation. Findings render highest-risk first under a Findings subheader, bounded to ten; snippets and explanations reach the email unstripped since only the stored meta row needs bounding. The internal report URL is deliberately not shared.
• The email reflects what happened. Blocked: the security review found issues severe enough to withhold the version from the update API, sites keep receiving the previous version, and the fix is in the author's hands — address the findings and release a new version, which escapes the block (Plugin Directory: Add an API to block a release from being served #785's per-release scoping). Advisory: please review the findings and address them in an upcoming release.
• Whether to notify is adjustable by risk score: Plugin_Scan_Gandalf::NOTIFY_RISK_SCORE (default 8.0, the block threshold) via the wporg_plugins_security_scan_notify_risk_score filter — lower it to start advising authors below the block bar, raise it above 10 to disable the emails entirely.
• Recipients are the plugin's committers minus bot and no-login accounts, matching the release-confirmation email in cli/class-import.php. Dedup mirrors the Slack alert: release blocks always email, advisory results deduplicate per verdict hash (month window), so a blocked outcome can never be silenced by an earlier advisory email of the same verdict.
• Finding strings are treated as untrusted scanner output: angle brackets are entity-encoded rather than stripped (so text like <slug> or <?php survives as text while markup can't go live; the plain-text variant decodes them back), length is bounded, Markdown link/image syntax is neutralized so a hostile title can't smuggle a masquerading anchor into an email from plugins@wordpress.org, backticks become apostrophes to keep line-leading pairs out of Markdown::code_trick(), and snippets use indented code blocks, which Markdown escapes and which have no fence to break out of. Trac URLs are built from per-segment rawurlencode()d paths.

Testing

tests/Security_Scan_Notification_Test.php (10 tests) covers the blocked and advisory email content, the inclusive threshold and both filter directions (lowering and disabling), advisory dedup across scans vs. blocks always emailing, bot-account exclusion (against a real account, so only the filter excludes it), hostile-string neutralization (escaped markup in titles and snippets, Markdown links), and a finding carrying only the contractually required risk_score. Full plugin-directory suite passes (229 tests); both new files lint clean.

🤖 Generated with Claude Code