ci: missing Slack webhook failure handling + fix notification format (#131)

* ci: make a missing Slack webhook a clear failure, not a cryptic one

The weekly release failed on Aug 28 and the alert never reached Slack. The
notify job failed with:

    Missing input! Either a method or webhook is required to take action.

COSY_WEBHOOK_URL resolves to an empty string, so GitHub omits the `webhook`
input entirely and the action rejects the call. The secret exists but was
created 2026-08-12 and never updated -- one day before the weekly release
workflow landed in #108 -- and the notify path was not exercised until the
Aug 28 failure, so this alert has never worked.

Check the webhook in a preflight step that names the missing secret, and set
errors: true so Slack-side delivery failures fail the step instead of
reporting green.

Neither change can populate the secret; that still needs setting in repo
settings. They make the next failure say so in one line.

* ci: send the Slack payload as JSON with a literal-newline message

slack-github-action v4 ships js-yaml v5, which enforces stricter multiline
indentation. MESSAGE was a double-quoted YAML scalar, so its \n\n became real
newlines that were interpolated into the YAML payload at column 0 and broke
the document:

    Invalid input! Failed to parse contents of the provided payload
    SyntaxError: Expected property name or '}' in JSON at position 1

Single-quote MESSAGE so \n stays a two-character escape, and send the payload
as JSON, where an interpolated message cannot break the structure and \n is
exactly the newline Slack mrkdwn renders.

Verified end to end on a throwaway branch: the notify job was forced to run
under dryRun and delivered to Slack with errors: true, so a rejected delivery
would have failed the step.

* ci: drop explanatory comments from the notify job

Author: carole-lavillonniere

.github/workflows/weekly-release.yml

@@ -82,16 +82,30 @@ jobs:
       - version
       - release
     steps:
+      - name: Verify the Slack webhook is configured
+        env:
+          WEBHOOK: ${{ secrets.COSY_WEBHOOK_URL }}
+        run: |
+          if [ -z "${WEBHOOK}" ]; then
+            echo "::error::COSY_WEBHOOK_URL is unset or empty, so no Slack alert can be sent for this broken release. Set it under Settings > Secrets and variables > Actions."
+            exit 1
+          fi
+          echo "Webhook is configured."
+
       - name: "Send Message"
         uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
         env:
-          MESSAGE: "_*Weekly RIE release failed*_ :turtle-headache::broken_heart:\n\nNo new pre-release was published, so CVE remediation is stalled until this is fixed. Investigate the failed workflow run <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|here> :mag_right:"
+          MESSAGE: '_*Weekly RIE release failed*_ :turtle-headache::broken_heart:\n\nNo new pre-release was published, so CVE remediation is stalled until this is fixed. Investigate the failed workflow run <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|here> :mag_right:'
         with:
           webhook: ${{ secrets.COSY_WEBHOOK_URL }}
           webhook-type: incoming-webhook
+          errors: true
           payload: |
-            blocks:
-              - type: "section"
-                text:
-                  type: "mrkdwn"
-                  text: "${{ env.MESSAGE }}"
+            {
+              "blocks": [
+                {
+                  "type": "section",
+                  "text": { "type": "mrkdwn", "text": "${{ env.MESSAGE }}" }
+                }
+              ]
+            }