ci: Remove Slack notification from Trivy container scan (#32649)

Co-authored-by: n8n-cat-bot[bot] <n8n-cat-bot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

.github/WORKFLOWS.md

@@ -554,7 +554,7 @@ Supply chain security ensures artifacts haven't been tampered with. We provide t
 
 - **Runs on:** stable/nightly/rc Docker builds
 - **Scans:** n8n image, runners image
-- **Output:** Slack `#notify-security-scan-outputs` (all), `#mission-security` (critical)
+- **Output:** GitHub Actions step summary (`$GITHUB_STEP_SUMMARY`) and run logs
 
 ### SBOM
 

.github/workflows/security-trivy-scan-callable.yml

@@ -13,17 +13,10 @@ on:
         type: string
         description: 'Full image reference to scan e.g. ghcr.io/n8n-io/n8n:latest'
         required: true
-    secrets:
-      QBOT_SLACK_TOKEN:
-        required: true
 
 permissions:
   contents: read
 
-env:
-  QBOT_SLACK_TOKEN: ${{ secrets.QBOT_SLACK_TOKEN }}
-  SLACK_CHANNEL_ID: C0AHNJU9XFA #updates-security
-
 jobs:
   security_scan:
     name: Security - Scan Docker Image With Trivy
@@ -166,98 +159,3 @@ jobs:
             } >> "$GITHUB_STEP_SUMMARY"
           fi
 
-      - name: Generate Slack Blocks JSON
-        if: steps.process_results.outputs.vulnerabilities_found == 'true'
-        id: generate_blocks
-        env:
-          IMAGE_REF: ${{ inputs.image_ref }}
-        run: |
-          BLOCKS_JSON=$(jq -c --arg image_ref "$IMAGE_REF" \
-          --arg repo_url "${{ github.server_url }}/${{ github.repository }}" \
-          --arg repo_name "${{ github.repository }}" \
-          --arg run_url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
-          --arg critical_count "${{ steps.process_results.outputs.critical_count }}" \
-          --arg high_count "${{ steps.process_results.outputs.high_count }}" \
-          --arg medium_count "${{ steps.process_results.outputs.medium_count }}" \
-          --arg low_count "${{ steps.process_results.outputs.low_count }}" \
-          --arg unique_cves "${{ steps.process_results.outputs.unique_cves }}" \
-          '
-          # Function to create a vulnerability block with emoji indicators
-          def vuln_block: {
-              "type": "section",
-              "text": {
-                "type": "mrkdwn",
-                "text": "\(if .Severity == "CRITICAL" then ":red_circle:" elif .Severity == "HIGH" then ":large_orange_circle:" elif .Severity == "MEDIUM" then ":large_yellow_circle:" else ":large_green_circle:" end) *<https://nvd.nist.gov/vuln/detail/\(.VulnerabilityID)|\(.VulnerabilityID)>* (CVSS: `\(.CVSS.nvd.V3Score // "N/A")`)\n*Package:* `\(.PkgName)@\(.InstalledVersion)` → `\(.FixedVersion // "No fix available")`"
-              }
-            };
-
-          # Main structure
-          [
-            {
-              "type": "header",
-              "text": { "type": "plain_text", "text": ":warning: Trivy Scan: Vulnerabilities Detected" }
-            },
-            {
-              "type": "section",
-              "fields": [
-                { "type": "mrkdwn", "text": "*Repository:*\n<\($repo_url)|\($repo_name)>" },
-                { "type": "mrkdwn", "text": "*Image:*\n`\($image_ref)`" },
-                { "type": "mrkdwn", "text": "*Critical:*\n:red_circle: \($critical_count)" },
-                { "type": "mrkdwn", "text": "*High:*\n:large_orange_circle: \($high_count)" },
-                { "type": "mrkdwn", "text": "*Medium:*\n:large_yellow_circle: \($medium_count)" },
-                { "type": "mrkdwn", "text": "*Low:*\n:large_green_circle: \($low_count)" }
-              ]
-            },
-            {
-              "type": "context",
-              "elements": [
-                { "type": "mrkdwn", "text": ":shield: \($unique_cves) unique CVEs affecting packages" }
-              ]
-            },
-            { "type": "divider" }
-          ] +
-          (
-            # Group vulnerabilities by CVE to avoid duplicates in notification
-            [.Results[] | select(.Vulnerabilities != null) | .Vulnerabilities[]] |
-            group_by(.VulnerabilityID) |
-            map(.[0]) |
-            sort_by(
-              (if .Severity == "CRITICAL" then 0
-               elif .Severity == "HIGH" then 1
-               elif .Severity == "MEDIUM" then 2
-               elif .Severity == "LOW" then 3
-               else 4 end),
-              -((.CVSS.nvd.V3Score // 0) | tonumber? // 0)
-            ) |
-            .[:8] |
-            map(. | vuln_block)
-          ) +
-          [
-            { "type": "divider" },
-            {
-              "type": "actions",
-              "elements": [
-                {
-                  "type": "button",
-                  "text": { "type": "plain_text", "text": ":github: View Full Report" },
-                  "style": "primary",
-                  "url": $run_url
-                }
-              ]
-            }
-          ]
-          ' trivy-results.json)
-
-          echo "slack_blocks=$BLOCKS_JSON" >> "$GITHUB_OUTPUT"
-
-      - name: Send Slack Notification
-        if: steps.process_results.outputs.vulnerabilities_found == 'true'
-        uses: slackapi/slack-github-action@91efab103c0de0a537f72a35f6b8cda0ee76bf0a # v2.1.1
-        with:
-          method: chat.postMessage
-          token: ${{ secrets.QBOT_SLACK_TOKEN }}
-          payload: |
-            channel: ${{ env.SLACK_CHANNEL_ID }}
-            text: "🚨 Trivy Scan: ${{ steps.process_results.outputs.critical_count }} Critical, ${{ steps.process_results.outputs.high_count }} High, ${{ steps.process_results.outputs.medium_count }} Medium, ${{ steps.process_results.outputs.low_count }} Low vulnerabilities found in ${{ inputs.image_ref }}"
-            blocks: ${{ steps.generate_blocks.outputs.slack_blocks }}
-