Post a Slack scan summary from the demo workflow

Add an optional step (7) to nightvision.yml that posts a one-line summary of
the DAST scan to a Slack Incoming Webhook: on success, the finding counts
(total, critical, high) parsed from results.sarif plus links to the GitHub
code-scanning tab and the run; on failure, the job status and run link.

- Gated on a SLACK_WEBHOOK_URL secret (mapped to env) so the step is skipped,
  and the scan still passes, when Slack is not configured.
- Uses curl against the webhook with a jq-built (escaped) JSON payload; no
  third-party action and no token-based importer to maintain.
- Runs with always() so a failed scan still notifies.

Author: blackoutjack

.github/workflows/nightvision.yml

@@ -34,6 +34,9 @@ env:
   NIGHTVISION_TOKEN: ${{ secrets.NIGHTVISION_TOKEN }}
   NIGHTVISION_TARGET: javaspringvulny
   NIGHTVISION_AUTH: javaspringvulny
+  # Optional: a Slack Incoming Webhook URL. When set, step (7) posts a scan
+  # summary; when unset, that step is skipped and the scan still runs and uploads.
+  SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
 
 jobs:
   test:
@@ -89,3 +92,26 @@ jobs:
         if: success()
         with:
           sarif_file: results.sarif
+
+      # Post a one-line scan summary to a Slack Incoming Webhook. Runs on both success
+      # and failure (always()), skipped when SLACK_WEBHOOK_URL is not set. Best-effort:
+      # a webhook POST failure prints a warning but does not fail the run (the scan and
+      # SARIF upload have already succeeded). jq builds the JSON payload so the message
+      # text is escaped safely.
+      - name: (7) Post scan summary to Slack
+        if: ${{ always() && env.SLACK_WEBHOOK_URL != '' }}
+        run: |
+          run_url="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+          if [ "${{ job.status }}" = "success" ] && [ -f results.sarif ]; then
+            total=$(jq '[.runs[].results[]] | length' results.sarif)
+            crit=$(jq '[.runs[].results[] | select(.properties["nightvision-risk"] == "CRITICAL")] | length' results.sarif)
+            high=$(jq '[.runs[].results[] | select(.properties["nightvision-risk"] == "HIGH")] | length' results.sarif)
+            findings_url="${{ github.server_url }}/${{ github.repository }}/security/code-scanning"
+            text="NightVision scan of ${NIGHTVISION_TARGET} in ${{ github.repository }} succeeded: ${total} findings (${crit} critical, ${high} high). <${findings_url}|Findings> | <${run_url}|Run>"
+          else
+            text="NightVision scan of ${NIGHTVISION_TARGET} in ${{ github.repository }} did not complete (status ${{ job.status }}). <${run_url}|Run>"
+          fi
+          curl -sSf -X POST -H 'Content-type: application/json' \
+            --data "$(jq -n --arg t "$text" '{text: $t, unfurl_links: false, unfurl_media: false}')" \
+            "$SLACK_WEBHOOK_URL" \
+            || echo "::warning::Slack notification failed; continuing (scan result unaffected)."