[jth-nw]

Adds --scan-env to notify-slack.mjs. Any @login with an entry in github-slack-users.json, and any @org/team in team-slack-map.json, found in an issue body, PR description or comment is @-mentioned in Slack alongside the CODEOWNERS teams. Wired into the issue-created (labeler Step 5), issue comment, and PR opened/comment posts. Not applied on review requests, so a re-request doesn't re-ping the description's tags. Handles in code spans and emails are ignored.

Test plan: node --test scripts/test-notify-slack.mjs; after merge, comment @dcwills on test issue #1791 and confirm the post mentions Dean.

🤖 Generated with Claude Code

[github-actions]

Code Review

No blocking issues. Workflow wiring looks right: the body and comment text pass through env:, not ${{ }} in run:, so there's no shell injection. pull_request_target still checks out only the base SHA. The main() guard keeps the script runnable in CI and importable in tests. A few correctness nits in scripts/notify-slack.mjs:

1. A team handle at the end of a sentence doesn't match. In HANDLE_RE, the team part (?:\/[\w.-]+)? is greedy and includes .. So cc @netwrix/auditor-docs. captures netwrix/auditor-docs., which isn't in team-slack-map.json, and the team isn't mentioned. Logins don't have this problem, because . isn't in the login character class. One fix is to strip trailing . from the captured handle before the lookup, or to change the team segment to [\w-]+(?:\.[\w-]+)*. It's worth adding a test case for this.

2. Code-span skipping only covers a backtick directly before the @. The (?<![\w@`]) lookbehind skips `@dcwills`. It doesn't skip `cc @dcwills` or a handle inside a fenced code block (for example, pasted logs or CODEOWNERS snippets), and those still ping. The PR description says "Handles in code spans … are ignored". Either remove inline code and fenced blocks before scanning, or make that claim narrower.

3. Minor: the labeler scans the original issue body. Step 5 reads github.event.issue.body from the event payload. If Step 2 (CoC check) has already sanitized the body, handles in the removed text still trigger Slack mentions. This is low impact, but you could fetch the current body with gh issue view --json body to be consistent.

4. FYI, outside contributors can now trigger Slack mentions. On this public repo, anyone who opens an issue or comments can now @-mention any mapped team or user in Slack by tagging them on GitHub. Bot comments are already filtered out. That's probably acceptable, since GitHub notifies the same people anyway, but it's a new path for Slack noise.