Ashby Stale Open Job Posting Sentinel

id: ashby-stale-open-job-posting-sentinel
namespace: company.team

description: |
  List every Ashby job posting, flag the publicly listed ones published more than stale_days ago,
  alert Slack when any are found, and log a governance audit trail either way. Read-only: this
  flow never writes to Ashby.

inputs:
  - id: stale_days
    type: INT
    displayName: Stale threshold in days
    description: A publicly listed job posting with a publishedDate older than this
      many days is reported stale.
    defaults: 60

  - id: max_stale_count
    type: INT
    displayName: Max stale count
    description: Alert when this many or more matching job postings are found.
    defaults: 1

tasks:
  - id: list_job_postings
    type: io.kestra.plugin.ashby.jobpostings.List
    description: Read-only. Fetches every job posting, listed and unlisted,
      regardless of status.
    allowFailure: true
    apiKey: "{{ secret('ASHBY_API_KEY') }}"
    fetchType: FETCH

  - id: evaluate
    type: io.kestra.plugin.core.output.OutputValues
    description: Flags postings that are isListed true with a publishedDate older
      than stale_days. isListed and publishedDate are used instead of status,
      since Ashby's status taxonomy is not guaranteed stable across accounts,
      while isListed and publishedDate are documented, fixed fields.
    values:
      stale_count: "{{ outputs.list_job_postings is not defined or
        outputs.list_job_postings.rows is not defined ? -1 : (({'rows':
        outputs.list_job_postings.rows, 'cutoff': (now() |
        dateAdd(-inputs.stale_days, 'DAYS') | date('yyyy-MM-dd'))} | jq('.cutoff
        as $c | [(.rows // [])[] | select(.isListed == true and (.publishedDate
        != null) and (.publishedDate != \"\") and ((.publishedDate[0:10]) <
        $c))] | length')) | first) }}"
      stale_titles: >-
        {{ outputs.list_job_postings is not defined or
        outputs.list_job_postings.rows is not defined ? '' : (({'rows':
        outputs.list_job_postings.rows, 'cutoff': (now() |
        dateAdd(-inputs.stale_days, 'DAYS') | date('yyyy-MM-dd'))} | jq('.cutoff
        as $c | [(.rows // [])[] | select(.isListed == true and (.publishedDate
        != null) and (.publishedDate != \"\") and ((.publishedDate[0:10]) < $c))
        | .title] | join(\"; \")')) | first) }}
      severity: "{{ outputs.list_job_postings is not defined or
        outputs.list_job_postings.rows is not defined ? 'CRITICAL' :
        (((({'rows': outputs.list_job_postings.rows, 'cutoff': (now() |
        dateAdd(-inputs.stale_days, 'DAYS') | date('yyyy-MM-dd'))} | jq('.cutoff
        as $c | [(.rows // [])[] | select(.isListed == true and (.publishedDate
        != null) and (.publishedDate != \"\") and ((.publishedDate[0:10]) <
        $c))] | length')) | first)) >= inputs.max_stale_count ?
        'STALE_POSTINGS_FOUND' : 'OK') }}"

  - id: route
    type: io.kestra.plugin.core.flow.If
    condition: "{{ outputs.evaluate.values.severity != 'OK' }}"
    then:
      - id: alert
        type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
        url: "{{ secret('SLACK_WEBHOOK_URL') }}"
        payload: |
          {{ {'text': outputs.evaluate.values.severity == 'CRITICAL'
            ? 'Ashby stale open job posting sentinel CRITICAL: Failed to retrieve job postings from Ashby API (execution ' ~ execution.id ~ '). Check credentials and endpoint connectivity.'
            : 'Ashby stale open job posting sentinel (' ~ outputs.evaluate.values.severity ~ '): ' ~ outputs.evaluate.values.stale_count ~ ' job posting(s) have been publicly listed for more than ' ~ inputs.stale_days ~ ' day(s): ' ~ outputs.evaluate.values.stale_titles ~ '.'} | toJson }}
    else:
      - id: compliant
        type: io.kestra.plugin.core.log.Log
        message: "No publicly listed Ashby job posting has been open for more than {{
          inputs.stale_days }} day(s)."

  - id: summary
    type: io.kestra.plugin.core.log.Log
    message: "Ashby stale job posting sentinel complete: {{
      outputs.evaluate.values.stale_count }} flagged posting(s), severity {{
      outputs.evaluate.values.severity }}."

errors:
  - id: alert_flow_failure
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    url: "{{ secret('SLACK_WEBHOOK_URL') }}"
    payload: |
      {{ {'text': 'Ashby stale open job posting sentinel failed (execution ' ~ execution.id ~ '). Check the logs.'} | toJson }}

triggers:
  - id: weekly
    type: io.kestra.plugin.core.trigger.Schedule
    description: Shipped disabled. Enable once ASHBY_API_KEY and SLACK_WEBHOOK_URL are set.
    cron: "0 8 * * 1"
    disabled: true
    inputs:
      stale_days: 60
      max_stale_count: 1