Enforce a Container Image Size Budget

id: container-image-size-budget
namespace: company.team
description: |
  Pull an image, measure its size, and alert Slack when it exceeds the budget -
  bloat is a regression you only see after a slow deploy.

triggers:
  - id: post_build_webhook
    type: io.kestra.plugin.core.trigger.Webhook
    description: Call from the build pipeline right after push; the budget check
      lands before the image ships.
    key: image-size

inputs:
  - id: image
    type: STRING
    defaults: "nginx:latest"
    description: Image reference to measure.
  - id: max_size_mb
    type: INT
    defaults: 500
    description: Size budget in megabytes.

tasks:
  - id: measure_size
    type: io.kestra.plugin.scripts.shell.Commands
    description: Inspect the image size with docker, convert to MB, and emit it via
      the stdout outputs protocol. Pull failure reports worst case.
    containerImage: docker:27-cli
    taskRunner:
      type: io.kestra.plugin.scripts.runner.docker.Docker
    commands:
      - |
        set -u
        docker pull --quiet "{{ inputs.image }}" >/dev/null 2>&1
        SIZE_BYTES=$(docker inspect -f '{{range .RootFS.DiffIDs}}{{end}}{{.Size}}' "{{ inputs.image }}" 2>/dev/null || echo 0)
        SIZE=$(docker image inspect "{{ inputs.image }}" --format '{{.Size}}' 2>/dev/null || echo 0)
        MB=$(( ${SIZE:-0} / 1048576 ))
        if [ -z "$SIZE" ] || [ "$SIZE" = "0" ]; then MB=999999; fi
        echo "{{ inputs.image }} is ${MB} MB"
        echo "::{\"outputs\": {\"size_mb\": $MB}}::"

  - id: over_budget
    type: io.kestra.plugin.core.flow.If
    description: One branch for the budget - breach alerts Slack with the real number.
    condition: "{{ outputs.measure_size.vars.size_mb > inputs.max_size_mb }}"
    then:
      - id: alert_oversize
        type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
        description: State the real size and the budget so the win is clear.
        url: "{{ secret('SLACK_WEBHOOK_URL') }}"
        payload: |
          {
            "text": ":whale: Image size budget breach: {{ inputs.image }} is {{ outputs.measure_size.vars.size_mb }} MB (budget {{ inputs.max_size_mb }} MB). Slim the Dockerfile before rollout. Execution {{ execution.id }}."
          }
    else:
      - id: log_ok
        type: io.kestra.plugin.core.log.Log
        description: Record the passing size so the trend is visible.
        message: "{{ inputs.image }} is {{ outputs.measure_size.vars.size_mb }} MB,
          within the {{ inputs.max_size_mb }} MB budget."

errors:
  - id: alert_measure_failure
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    description: Alert when the measurement fails - a missing inspect must not read
      as "image is tiny".
    url: "{{ secret('SLACK_WEBHOOK_URL') }}"
    payload: |
      {
        "text": "Image size check FAILED in flow {{ flow.id }} (execution {{ execution.id }}) for {{ inputs.image }}. Check the image reference and registry access."
      }

outputs:
  - id: image_size_mb
    type: INT
    description: 'Image size in MB, e.g. 187.'
    value: "{{ outputs.measure_size.vars.size_mb }}"