Gate Releases on New Licence Risk with an Aikido SBOM Diff Instead of a Full Backlog Scan

id: aikido-sbom-license-drift-gate
namespace: company.security

inputs:
  - id: repository_id
    type: STRING
    defaults: "101"
    description: Aikido code repository whose SBOM is exported and compared against
      the last approved baseline.

  - id: release_tag
    type: STRING
    defaults: 2026.09.1
    description: Release being gated. Recorded in the baseline so you can tell which
      release last moved the licence set.

  - id: blocked_licenses
    type: ARRAY
    itemType: STRING
    defaults: [ "AGPL-3.0", "AGPL-1.0", "SSPL-1.0", "GPL-3.0", "BUSL-1.1" ]
    description: Licences that must never appear in a shipped artifact without an
      explicit exception.

tasks:
  - id: export_sbom
    type: io.kestra.plugin.aikido.repositories.ExportSbom
    description: Pull the CycloneDX SBOM for the repository, excluding dev
      dependencies so the gate reflects what actually ships.
    clientId: "{{ secret('AIKIDO_CLIENT_ID') }}"
    clientSecret: "{{ secret('AIKIDO_CLIENT_SECRET') }}"
    repositoryId: "{{ inputs.repository_id }}"
    format: SBOM
    scope: EXCLUDE_DEV_DEPS
    includeRiskReason: true
    includeVex: true

  - id: supply_chain_issues
    type: io.kestra.plugin.aikido.issues.Export
    description: Pull the malware and licence findings Aikido already raised, so the
      gate sees more than the raw licence strings.
    clientId: "{{ secret('AIKIDO_CLIENT_ID') }}"
    clientSecret: "{{ secret('AIKIDO_CLIENT_SECRET') }}"
    filterCodeRepoId: "{{ inputs.repository_id }}"
    filterStatus: open
    format: JSON
    fetchType: FETCH

  - id: read_baseline
    type: io.kestra.plugin.core.kv.Get
    description: Read the last approved component set for this repository. A first
      run has no baseline and everything counts as pre-existing.
    key: "sbom_baseline_{{ inputs.repository_id }}"
    errorOnMissing: false

  - id: assess
    type: io.kestra.plugin.scripts.python.Script
    description: Diff the SBOM against the baseline and separate newly introduced
      licence risk from what was already accepted.
    containerImage: python:3.12-slim
    inputFiles:
      sbom.json: "{{ outputs.export_sbom.uri }}"
      baseline.json: "{{ outputs.read_baseline.value ?? '{}' }}"
      blocked.json: "{{ inputs.blocked_licenses | toJson }}"
    script: |
      import json

      with open("sbom.json") as fh:
          sbom = json.load(fh)
      with open("baseline.json") as fh:
          raw = fh.read().strip()
          baseline = json.loads(raw) if raw else {}
      with open("blocked.json") as fh:
          blocked = {b.upper() for b in json.load(fh)}

      known = set(baseline.get("components", []))
      first_run = not known

      current = {}
      for component in sbom.get("components", []):
          name = component.get("name")
          version = component.get("version", "")
          if not name:
              continue
          licenses = []
          for entry in component.get("licenses", []) or []:
              lic = entry.get("license") or {}
              ident = lic.get("id") or lic.get("name")
              if ident:
                  licenses.append(ident)
          current[f"{name}@{version}"] = licenses

      new_components = [] if first_run else sorted(set(current) - known)

      violations = []
      for key in new_components:
          for lic in current[key]:
              if lic.upper() in blocked:
                  violations.append({"component": key, "license": lic})

      pre_existing = []
      for key, licenses in current.items():
          if key in new_components:
              continue
          for lic in licenses:
              if lic.upper() in blocked:
                  pre_existing.append({"component": key, "license": lic})

      def summarize(items):
          if not items:
              return "none"
          return "; ".join(f"{i['component']} ({i['license']})" for i in items).replace('"', "'")

      verdict = {
          "total_components": len(current),
          "component_keys": sorted(current),
          "new_components": new_components,
          "new_violations": violations,
          "pre_existing_violations": pre_existing,
          "new_violations_text": summarize(violations),
          "pre_existing_text": summarize(pre_existing),
          "first_run": first_run,
          "blocked": len(violations) > 0,
      }

      print("::" + json.dumps({"outputs": verdict}) + "::")
      print(f"first_run={first_run} components={len(current)} new={len(new_components)} new_violations={len(violations)} pre_existing={len(pre_existing)}")

  - id: gate
    type: io.kestra.plugin.core.flow.If
    description: A newly introduced blocked licence stops the release. Pre-existing
      ones are reported but do not block, so the gate is adoptable on day one.
    condition: "{{ outputs.assess.vars.blocked }}"
    then:
      - id: announce_block
        type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
        url: "{{ secret('SLACK_WEBHOOK') }}"
        payload: |
          {
            "text": "Release {{ inputs.release_tag }} blocked by a new licence violation",
            "blocks": [
              {"type": "header", "text": {"type": "plain_text", "text": "Release blocked: new licence risk"}},
              {"type": "section", "text": {"type": "mrkdwn", "text": "*Release* {{ inputs.release_tag }}\n*Repository id* {{ inputs.repository_id }}\n*New components* {{ outputs.assess.vars.new_components | length }} of {{ outputs.assess.vars.total_components }} total"}},
              {"type": "section", "text": {"type": "mrkdwn", "text": "*Newly introduced violations*\n{{ outputs.assess.vars.new_violations_text }}"}},
              {"type": "section", "text": {"type": "mrkdwn", "text": "*Pre-existing, not blocking*\n{{ outputs.assess.vars.pre_existing_text }}"}},
              {"type": "section", "text": {"type": "mrkdwn", "text": "Execution {{ execution.id }}. The baseline was not advanced, so the next run compares against the same approved set."}}
            ]
          }

      - id: fail_release
        type: io.kestra.plugin.core.execution.Fail
        description: Fail the execution so an upstream release pipeline waiting on this
          flow stops too.
        errorMessage: "Release {{ inputs.release_tag }} introduces a blocked licence.
          See the Slack notice and the verdict output."

    else:
      - id: advance_baseline
        type: io.kestra.plugin.core.kv.Set
        description: Only a clean run advances the baseline, so a blocked release cannot
          quietly become the new normal.
        key: "sbom_baseline_{{ inputs.repository_id }}"
        kvType: JSON
        overwrite: true
        value: |
          {
            "release_tag": "{{ inputs.release_tag }}",
            "recorded_at": "{{ now() }}",
            "components": {{ outputs.assess.vars.component_keys | toJson }}
          }

      - id: report_clean
        type: io.kestra.plugin.core.log.Log
        message: "GATE passed for release {{ inputs.release_tag }}: {{
          outputs.assess.vars.total_components }} components, {{
          outputs.assess.vars.new_components | length }} new, {{
          outputs.assess.vars.pre_existing_violations | length }} pre-existing
          violations carried forward."

  - id: supply_chain_summary
    type: io.kestra.plugin.core.log.Log
    message: "Aikido reports {{ outputs.supply_chain_issues.size }} open issues for
      repository {{ inputs.repository_id }} alongside the SBOM check."

errors:
  - id: gate_failed
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    url: "{{ secret('SLACK_WEBHOOK') }}"
    payload: |
      {
        "text": ":warning: SBOM licence gate could not complete for repository {{ inputs.repository_id }}, release {{ inputs.release_tag }}. Treat the release as ungated until this is resolved. Execution {{ execution.id }}."
      }

outputs:
  - id: blocked
    type: BOOL
    value: "{{ outputs.assess.vars.blocked }}"

  - id: new_violations
    type: JSON
    value: "{{ outputs.assess.vars.new_violations }}"