Cobol AS/400 Job Submission Compliance Gate

id: cobol-as400-job-submission-compliance-gate
namespace: company.team
description: |
  Submit an IBM i (AS/400) batch job on a schedule, inspect the
  returned system messages for any severity at or above a threshold,
  classify the result as HEALTHY, CRITICAL, or UNREACHABLE, log clean
  submissions, and alert Slack the moment a high-severity message is
  returned or the system cannot be reached.

inputs:
  - id: as400_library
    type: STRING
    defaults: "BATCHLIB"
    displayName: "IBM i Library"
    description: "Library containing the program to submit, e.g. BATCHLIB."
  - id: as400_program
    type: STRING
    defaults: "EODPROC"
    displayName: "IBM i Program"
    description: "Name of the program to submit as a batch job, e.g. EODPROC."
  - id: as400_job_queue
    type: STRING
    defaults: "QBATCH"
    displayName: "IBM i Job Queue"
    description: "Job queue to submit the job to, e.g. QBATCH."
  - id: message_severity_threshold
    type: INT
    defaults: 30
    displayName: "Message Severity Threshold"
    description: "IBM i message severity (0-99) at or above which a returned system
      message is classified CRITICAL. 30 and above is conventionally an escape
      or error-level message."

triggers:
  - id: as400_compliance_gate_schedule
    type: io.kestra.plugin.core.trigger.Schedule
    description: "Submit and check the batch job every 6 hours."
    cron: "0 */6 * * *"
    disabled: true
    inputs:
      as400_library: "BATCHLIB"
      as400_program: "EODPROC"
      as400_job_queue: "QBATCH"
      message_severity_threshold: 30

tasks:
  - id: submit_batch_job
    type: io.kestra.plugin.cobol.SubmitJob
    description: "Submit the COBOL batch job to the IBM i system via SBMJOB and
      capture any system messages returned during submission."
    host: "{{ secret('IBM_I_HOST') }}"
    user: "{{ secret('IBM_I_USER') }}"
    password: "{{ secret('IBM_I_PASSWORD') }}"
    library: "{{ inputs.as400_library }}"
    program: "{{ inputs.as400_program }}"
    jobQueue: "{{ inputs.as400_job_queue }}"
    allowFailure: true

  - id: classify_submission_health
    type: io.kestra.plugin.core.debug.Return
    description: "Classify UNREACHABLE when no messages were returned, CRITICAL when
      at least one returned message has severity at or above
      message_severity_threshold, otherwise HEALTHY."
    format: "{{ outputs.submit_batch_job.messages is defined ?
      ((outputs.submit_batch_job.messages | jq('[.[] | select(.severity >= ' ~
      inputs.message_severity_threshold ~ ')] | length') | first | default(0)) >
      0 ? 'CRITICAL' : 'HEALTHY') : 'UNREACHABLE' }}"

  - id: route_by_submission_health
    type: io.kestra.plugin.core.flow.Switch
    description: "Log a quiet confirmation when the submission is clean, page Slack
      when a high-severity message is returned, or page Slack when the system
      could not be reached."
    value: "{{ outputs.classify_submission_health.value }}"
    cases:
      "HEALTHY":
        - id: log_healthy
          type: io.kestra.plugin.core.log.Log
          message: "Job {{ outputs.submit_batch_job.jobName }}/{{
            outputs.submit_batch_job.jobNumber }} submitted to {{
            inputs.as400_library }}/{{ inputs.as400_program }} with no message
            at or above severity {{ inputs.message_severity_threshold }}."
      "CRITICAL":
        - id: alert_critical
          type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
          url: "{{ secret('SLACK_WEBHOOK_URL') }}"
          payload: |
            {
              "text": "AS/400 sentinel CRITICAL: submitting {{ inputs.as400_library }}/{{ inputs.as400_program }} to {{ inputs.as400_job_queue }} returned at least one system message at or above severity {{ inputs.message_severity_threshold }}. Job {{ outputs.submit_batch_job.jobName }}/{{ outputs.submit_batch_job.jobNumber }}. Execution {{ execution.id }}."
            }
      "UNREACHABLE":
        - id: alert_unreachable
          type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
          url: "{{ secret('SLACK_WEBHOOK_URL') }}"
          payload: |
            {
              "text": "AS/400 sentinel UNREACHABLE: no messages were returned for the submission of {{ inputs.as400_library }}/{{ inputs.as400_program }} (connection failure, authentication failure, or SBMJOB itself failed before returning messages). Execution {{ execution.id }}."
            }
    defaults:
      - id: log_unclassified
        type: io.kestra.plugin.core.log.Log
        message: "Completed AS/400 job submission compliance check with status: {{
          outputs.classify_submission_health.value }}"

  - id: log_audit_status
    type: io.kestra.plugin.core.log.Log
    description: "Post-audit status line recorded on every run regardless of branch,
      for a continuous submission-health trend in the execution history."
    message: "AS/400 compliance audit: library={{ inputs.as400_library }},
      program={{ inputs.as400_program }}, jobQueue={{ inputs.as400_job_queue }},
      status={{ outputs.classify_submission_health.value }}, execution={{
      execution.id }}."

errors:
  - id: alert_flow_failure
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    description: "Alert Slack when the compliance gate flow itself fails, so a
      broken check never silently stops monitoring batch job submissions."
    url: "{{ secret('SLACK_WEBHOOK_URL') }}"
    payload: |
      {
        "text": "AS/400 job submission compliance gate flow {{ flow.id }} FAILED (execution {{ execution.id }}). Submission health for {{ inputs.as400_library }}/{{ inputs.as400_program }} is now unknown; check the task logs and the IBM i system manually."
      }

outputs:
  - id: status
    type: STRING
    value: "{{ outputs.classify_submission_health.value }}"