AI-Powered Incident Response Automation

id: ai-incident-response-automation
namespace: company.devops

description: |
  Automates incident triage when a GitHub issue is opened.
  Uses OpenAI to classify severity, notifies Slack, and optionally 
  creates Jira tickets for critical incidents.

inputs:
  - id: issue_title
    type: STRING
    description: GitHub issue title
  - id: issue_body
    type: STRING
    description: GitHub issue body content

triggers:
  - id: github_webhook
    type: io.kestra.plugin.core.trigger.Webhook
    key: "{{ secret('GITHUB_WEBHOOK_KEY') }}"
    inputs:
      issue_title: "{{ trigger.body.issue.title }}"
      issue_body: "{{ trigger.body.issue.body ?? '' }}"

tasks:
  - id: parallel_initial_response
    type: io.kestra.plugin.core.flow.Parallel
    tasks:
      - id: ai_triage
        type: io.kestra.plugin.openai.ChatCompletion
        apiKey: "{{ secret('OPENAI_API_KEY') }}"
        model: gpt-4o-mini
        messages:
          - role: user
            content: |
              Classify this GitHub issue severity as 'critical', 'high', 'medium', or 'low'.
              Title: {{ trigger.body.issue.title ?? inputs.issue_title }}
              Body: {{ trigger.body.issue.body ?? inputs.issue_body }}
              Respond with ONLY the severity level.

      - id: notify_slack
        type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
        url: "{{ secret('SLACK_WEBHOOK_URL') }}"
        payload: |
          {"text": "[New Issue] {{ trigger.body.issue.title ?? inputs.issue_title }}\nAI triage in progress..."}

  - id: check_severity
    type: io.kestra.plugin.core.flow.If
    condition: "{{ outputs.ai_triage.choices[0].message.content == 'critical' }}"
    then:
      - id: create_jira_ticket
        type: io.kestra.plugin.jira.issues.Create
        baseUrl: "https://{{ secret('JIRA_DOMAIN') }}.atlassian.net"
        username: "{{ secret('JIRA_USERNAME') }}"
        password: "{{ secret('JIRA_API_TOKEN') }}"
        projectKey: OPS
        summary: "[CRITICAL] {{ trigger.body.issue.title ?? inputs.issue_title }}"
        labels:
          - incident
          - critical

      - id: alert_oncall
        type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
        url: "{{ secret('SLACK_ONCALL_WEBHOOK') }}"
        payload: |
          {"text": "[CRITICAL] Issue detected: {{ trigger.body.issue.title ?? inputs.issue_title }}"}

errors:
  - id: handle_error
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    url: "{{ secret('SLACK_WEBHOOK_URL') }}"
    payload: |
      {"text": "[ERROR] Incident automation failed for: {{ trigger.body.issue.title ?? inputs.issue_title }}\nError: {{ errorLogs() }}"}