[ankrsinha]

Fixes #2029

Changes

The Slack interceptor only checked that X-Slack-Signature was non-empty - it
never verified it. Any request carrying that header was treated as authentic, so
anyone able to reach the EventListener could forge a Slack slash command and
trigger pipelines.

This verifies the signature using Slack's v0 HMAC-SHA256 scheme
against a signing secret supplied via secretRef, rejects timestamps outside a
five minute window to block replays, and fails closed when secretRef is
missing - matching the GitHub, GitLab, and Bitbucket interceptors.

Slack signs the original URL-encoded request body, while the sink converts
Body to JSON. This adds RawBody to preserve the original bytes for
signature verification.

Configure the Slack interceptor with:

params:
  - name: secretRef
    value:
      secretName: slack-secret
      secretKey: signingSecret
  - name: requestedFields
    value:
      - text

Documentation and the Slack example have been updated. Tests cover valid,
invalid, stale, and malformed requests.

Validation

• make test-unit
• Manual Kind-cluster verification of valid, forged, and stale Slack requests
• Full E2E suite run; only the unrelated TestOTelMetrics metric-count
  assertions failed

Submitter Checklist

As the author of this PR, please check off the items in this checklist:

• Has Docs if any changes are user facing, including updates to minimum requirements e.g. Kubernetes version bumps
• Has Tests included if any functionality added or changed
• Follows the commit message standard
• Meets the Tekton contributor standards (including functionality, content, code)
• Has a kind label. You can add one by adding a comment on this PR that contains /kind <type>. Valid types are bug, cleanup, design, documentation, feature, flake, misc, question, tep
• Release notes block below has been updated with any user facing changes (API changes, bug fixes, changes requiring upgrade notices or deprecation warnings). See some examples of good release notes.
• Release notes contains the string "action required" if the change requires additional action from users switching to the new release

Release Notes

action required: The Slack interceptor now verifies `X-Slack-Signature` and
requires a `secretRef` naming a Secret that holds your Slack app signing
secret. Slack interceptors without one will reject all requests after
upgrading, and requests must carry an `X-Slack-Request-Timestamp` within five
minutes. A `raw_body` field was added to the v1beta1 InterceptorRequest.

[tekton-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please assign savitaashture after the PR has been reviewed.
You can assign the PR to them by writing /assign @savitaashture in a comment when ready.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.25%. Comparing base (33bad14) to head (bc89ec6).
⚠️ Report is 4 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2190      +/-   ##
==========================================
+ Coverage   80.08%   80.25%   +0.17%     
==========================================
  Files          96       96              
  Lines        4645     4680      +35     
==========================================
+ Hits         3720     3756      +36     
+ Misses        667      666       -1     
  Partials      258      258              

Flag	Coverage Δ
unit-tests	80.25% <ø> (+0.17%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[ankrsinha]

/kind feature