Trivy Scan Step reports "invalid blocks" when reporting to slack

[dmaljovec]

There may be an issue with the Trivy Scan step. We attempted to use it and received an invalid_blocks message at the point when it attempt to send a message to slack. We are attempting to run the linked entrypoint.sh script locally now to see if we can identify where the slack message body is malformed.

[dmaljovec]

It appears to be related to message length. It would be great if the step was smart enough to automatically split really long messages, or perhaps even to sort items by criticality and post each level in its own message. The latter might mitigate the problem, but could still stumble if the vulnerability list is really long.