Aikido Domain Scan Staleness Compliance Gate

id: aikido-domain-scan-staleness-compliance-gate
namespace: company.team
description: |
  List every domain Aikido's surface/DAST monitoring tracks on a
  schedule, classify scan coverage as HEALTHY, AT_RISK, CRITICAL, or
  UNREACHABLE based on how long ago each domain was last scanned, log
  clean audits, and alert Slack the moment a domain has never been
  scanned or has gone stale beyond a threshold.

inputs:
  - id: staleness_threshold_days
    type: INT
    defaults: 14
    displayName: "Scan Staleness Threshold (Days)"
    description: "A domain scanned longer ago than this many days is classified
      AT_RISK. A domain never scanned at all is always CRITICAL regardless of
      this threshold."

triggers:
  - id: domain_scan_coverage_schedule
    type: io.kestra.plugin.core.trigger.Schedule
    description: "Audit domain scan coverage once a day."
    cron: "0 6 * * *"
    disabled: true
    inputs:
      staleness_threshold_days: 14

tasks:
  - id: list_monitored_domains
    type: io.kestra.plugin.aikido.domains.List
    description: "List every domain connected to Aikido's surface/DAST monitoring,
      with each domain's last-scanned timestamp."
    clientId: "{{ secret('AIKIDO_CLIENT_ID') }}"
    clientSecret: "{{ secret('AIKIDO_CLIENT_SECRET') }}"
    fetchType: FETCH
    allowFailure: true

  - id: classify_scan_coverage
    type: io.kestra.plugin.core.debug.Return
    description: "Classify UNREACHABLE when no domains were returned, CRITICAL when
      at least one domain has never been scanned (lastScannedAt == -1), AT_RISK
      when at least one scanned domain is older than staleness_threshold_days,
      otherwise HEALTHY."
    format: "{{ outputs.list_monitored_domains.rows is defined ?
      ((outputs.list_monitored_domains.rows | jq('[.[] | select(.lastScannedAt
      == -1)] | length') | first | default(0)) > 0 ? 'CRITICAL' :
      ((outputs.list_monitored_domains.rows | jq('[.[] | select(.lastScannedAt
      != -1 and (now - .lastScannedAt) > (' ~ inputs.staleness_threshold_days ~
      ' * 86400))] | length') | first | default(0)) > 0 ? 'AT_RISK' :
      'HEALTHY')) : 'UNREACHABLE' }}"

  - id: route_by_coverage
    type: io.kestra.plugin.core.flow.Switch
    description: "Log a quiet confirmation when every domain is fresh, page Slack
      when a domain has never been scanned or has gone stale, or page Slack when
      Aikido could not be reached."
    value: "{{ outputs.classify_scan_coverage.value }}"
    cases:
      "HEALTHY":
        - id: log_healthy
          type: io.kestra.plugin.core.log.Log
          message: "All {{ outputs.list_monitored_domains.size }} Aikido-monitored
            domain(s) were scanned within {{ inputs.staleness_threshold_days }}
            day(s)."
      "AT_RISK":
        - id: alert_at_risk
          type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
          url: "{{ secret('SLACK_WEBHOOK_URL') }}"
          payload: |
            {
              "text": "Aikido sentinel AT_RISK: domain(s) scanned longer than {{ inputs.staleness_threshold_days }} day(s) ago out of {{ outputs.list_monitored_domains.size }} monitored: {{ outputs.list_monitored_domains.rows | jq('[.[] | select(.lastScannedAt != -1 and (now - .lastScannedAt) > (' ~ inputs.staleness_threshold_days ~ ' * 86400)) | .domain] | join(\", \")') | first }}. Execution {{ execution.id }}."
            }
      "CRITICAL":
        - id: alert_critical
          type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
          url: "{{ secret('SLACK_WEBHOOK_URL') }}"
          payload: |
            {
              "text": "Aikido sentinel CRITICAL: domain(s) never scanned at all out of {{ outputs.list_monitored_domains.size }} monitored: {{ outputs.list_monitored_domains.rows | jq('[.[] | select(.lastScannedAt == -1) | .domain] | join(\", \")') | first }}. Execution {{ execution.id }}."
            }
      "UNREACHABLE":
        - id: alert_unreachable
          type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
          url: "{{ secret('SLACK_WEBHOOK_URL') }}"
          payload: |
            {
              "text": "Aikido sentinel UNREACHABLE: no domains were returned (invalid client credentials, missing domains:read scope, or an Aikido API outage). Execution {{ execution.id }}."
            }
    defaults:
      - id: log_unclassified
        type: io.kestra.plugin.core.log.Log
        message: "Completed Aikido domain scan coverage check with status: {{
          outputs.classify_scan_coverage.value }}"

  - id: log_audit_status
    type: io.kestra.plugin.core.log.Log
    description: "Post-audit status line recorded on every run regardless of branch,
      for a continuous scan-coverage trend in the execution history."
    message: "Aikido domain scan coverage audit: threshold={{
      inputs.staleness_threshold_days }}d, status={{
      outputs.classify_scan_coverage.value }}, execution={{ execution.id }}."

errors:
  - id: alert_flow_failure
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    description: "Alert Slack when the compliance gate flow itself fails, so a
      broken check never silently stops monitoring scan coverage."
    url: "{{ secret('SLACK_WEBHOOK_URL') }}"
    payload: |
      {
        "text": "Aikido domain scan staleness compliance gate flow {{ flow.id }} FAILED (execution {{ execution.id }}). Scan coverage status is now unknown; check the task logs and the Aikido dashboard manually."
      }

outputs:
  - id: status
    type: STRING
    value: "{{ outputs.classify_scan_coverage.value }}"