GHA-219 Fix notify-slack failing on runners without system Python

[nils-werner-sonarsource]

Summary

• Adds a Set up Python step (pinned actions/setup-python@v5.6.0) to notify-slack/action.yml
• Creates a venv in the action directory and installs dependencies into it
• Uses the venv's python and pip executables throughout

Context

GHA-219 PR #125 replaced the Docker-based Slack notifier with a Python script. However, the action relied on the system python binary (not present on newer GitHub runners) and bare pip install (blocked by PEP 668 on Debian-based runners that enforce the externally-managed-environment restriction).

Using setup-python + a venv makes the action fully self-contained and runner-agnostic.

Fixes: https://sonarsource.atlassian.net/browse/GHA-219

🤖 Generated with Claude Code

[sonar-review-alpha]

Summary

Fixes the notify-slack action to work on modern GitHub runners by adding an explicit setup-python step and installing dependencies into a local venv. This replaces reliance on unavailable system Python and works around PEP 668 restrictions that prevent bare pip install on runner images.

What reviewers should know

Review focus: verify the venv setup is complete (check that both pip install and python execution use the venv binaries). The solution is straightforward — the pinned setup-python version is good for reproducibility, and the .venv/bin/ paths are consistent throughout. Worth confirming that .venv is appropriately ignored in git or .gitignore (though it's recreated each workflow run). The Python 3.10 version choice is reasonable; check if it aligns with any stated minimum version requirement for the notify_slack.py script.

---

• Generate Walkthrough
• Generate Diagram

🗣️ Give feedback

[hashicorp-vault-sonar-prod]

GHA-219

[sonarqubecloud]

SonarQube reviewer guide

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonar-review-alpha]

Conclusion: Clean, minimal fix — the venv is created and consumed consistently, the SHA pin follows repo convention, and the change is fully self-contained.

🗣️ Give feedback