Daily Docker Hub security digest for your Slack channel

Every morning at 8am, review my Docker Hub audit log and alert my team in Slack about anything security-sensitive. Run this on a daily cron schedule, and only speak up when something noteworthy actually happened.

Pull recent activity with Docker Hub's List Audit Log Events for my namespace or organization. Look only at events from the last 24 hours by filtering on each event's timestamp, so we do not re-report older activity from previous runs.

Use judgement to separate high-signal actions from routine noise. Always flag: a new personal access token being created, a member being added or removed, a repository being deleted, and a repository being switched from private to public. Leave out everyday activity such as ordinary image pushes and pulls unless something looks clearly unusual.

For each flagged event, capture what happened, who did it (the actor), and when it happened. Group related events together and keep the write-up short and scannable.

If there is at least one noteworthy event, post a digest to a Slack channel such as #security using Send a Message, sending it as the workspace bot so the alert is not tied to one person's account. Use Slack mrkdwn formatting with a clear headline and one line per event covering the action, the actor, and the time. If nothing noteworthy happened, do not post anything at all, so any message in the channel always means something worth looking at.