Triage Dependabot pull requests and alert Slack only on risky updates

id: dependabot-pr-triage-slack
namespace: company.team
description: |
  Triage Dependabot pull requests as they open. Read Dependabot's own commit
  metadata to find semver-major updates, check whether the PR touches GitHub
  Actions workflow files, and alert Slack only when a human should look.

inputs:
  - id: post_pr_comment
    type: BOOL
    displayName: Post a triage comment on the PR
    description: When true, flagged PRs also get one self-updating triage comment.
      Keep false until the token has write access.
    defaults: false

  - id: flag_workflow_changes
    type: BOOL
    displayName: Flag workflow file changes
    description: When true, any change under .github/workflows/ (github-actions
      ecosystem) needs review, even for minor bumps.
    defaults: true

variables:
  pr_author: "{{ trigger.body.pull_request.user.login ?? 'none' }}"
  pr_action: "{{ trigger.body.action ?? 'none' }}"

triggers:
  - id: github_pull_request
    type: io.kestra.plugin.core.trigger.Webhook
    description: >
      GitHub webhook (content type application/json, event "Pull requests")
      pointed at
      /api/v1/main/executions/webhook/company.team/dependabot-pr-triage-slack/<key>.
      Replace the key with a long random value before use.
    key: replace-with-a-long-random-key

tasks:
  - id: log_event
    type: io.kestra.plugin.core.log.Log
    description: Record which event arrived. Pings and non-PR events log `none`
      instead of failing.
    message: >
      action={{ render(vars.pr_action) }} author={{ render(vars.pr_author) }}
      repo={{ trigger.body.repository.full_name ?? 'none' }} pr=#{{
      trigger.body.pull_request.number ?? 'none' }} {{
      trigger.body.pull_request.title ?? '' }}

  - id: is_dependabot_pr
    type: io.kestra.plugin.core.flow.If
    description: Only Dependabot PRs that were opened, reopened or got a new push
      (rebase or recreate) are triaged.
    condition: "{{ render(vars.pr_author) == 'dependabot[bot]' and (['opened',
      'reopened', 'synchronize'] contains render(vars.pr_action)) }}"
    then:
      - id: list_commits
        type: io.kestra.plugin.core.http.Request
        description: >
          Dependabot writes an `updated-dependencies` YAML block into every
          commit message, with `update-type:
          version-update:semver-major|minor|patch` per dependency. This is the
          same metadata dependabot/fetch-metadata reads.
        uri: "{{ trigger.body.pull_request.url }}/commits?per_page=100"
        method: GET
        headers:
          Accept: application/vnd.github+json
          X-GitHub-Api-Version: "2022-11-28"
          User-Agent: kestra-dependabot-triage
          Authorization: "Bearer {{ secret('GITHUB_TOKEN') }}"

      - id: list_files
        type: io.kestra.plugin.core.http.Request
        description: List the files the PR changes (first 100), to spot GitHub Actions
          workflow edits.
        uri: "{{ trigger.body.pull_request.url }}/files?per_page=100"
        method: GET
        headers:
          Accept: application/vnd.github+json
          X-GitHub-Api-Version: "2022-11-28"
          User-Agent: kestra-dependabot-triage
          Authorization: "Bearer {{ secret('GITHUB_TOKEN') }}"

      - id: classify
        type: io.kestra.plugin.core.output.OutputValues
        description: Turn the two API responses into a verdict with jq. No script
          container needed.
        values:
          dependencies: >-
            {{ outputs.list_commits.body | jq('[.[].commit.message | split("\n")
            | .[] | select(startswith("- dependency-name: ")) | ltrimstr("-
            dependency-name: ")] | unique | join(", ")') | first }}
          major: >-
            {{ outputs.list_commits.body | jq('[.[].commit.message |
            contains("update-type: version-update:semver-major")] | any') |
            first }}
          workflow_files: >-
            {{ outputs.list_files.body | jq('[.[].filename |
            select(startswith(".github/workflows/"))] | join(", ")') | first }}
          files_changed: >-
            {{ outputs.list_files.body | jq('length') | first }}
          needs_review: >-
            {{ (outputs.list_commits.body | jq('[.[].commit.message |
            contains("update-type: version-update:semver-major")] | any') |
            first) or (inputs.flag_workflow_changes and (outputs.list_files.body
            | jq('[.[].filename | select(startswith(".github/workflows/"))] |
            length') | first) > 0) }}

      - id: needs_review
        type: io.kestra.plugin.core.flow.If
        description: Alert only for semver-major updates or workflow file changes.
          Everything else stays quiet.
        condition: "{{ outputs.classify.values.needs_review }}"
        then:
          - id: notify_slack
            type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
            description: One Slack message per flagged PR with the reasons and a link.
            url: "{{ secret('SLACK_WEBHOOK_URL') }}"
            messageText: |
              :rotating_light: *Dependabot PR needs review* in `{{ trigger.body.repository.full_name }}`
              <{{ trigger.body.pull_request.html_url }}|#{{ trigger.body.pull_request.number }} {{ trigger.body.pull_request.title }}>
              *Dependencies:* {{ outputs.classify.values.dependencies is empty ? 'n/a' : outputs.classify.values.dependencies }}
              *Semver-major:* {{ outputs.classify.values.major }}
              *Workflow files:* {{ outputs.classify.values.workflow_files is empty ? 'none' : outputs.classify.values.workflow_files }}
              *Files changed:* {{ outputs.classify.values.files_changed }}

          - id: maybe_comment
            type: io.kestra.plugin.core.flow.If
            description: Posting on the PR is opt-in through the `post_pr_comment` input.
            condition: "{{ inputs.post_pr_comment }}"
            then:
              - id: comment_on_pr
                type: io.kestra.plugin.github.issues.Comment
                description: The update tag keeps one triage comment per PR, edited in place
                  when Dependabot rebases.
                oauthToken: "{{ secret('GITHUB_TOKEN') }}"
                repository: "{{ trigger.body.repository.full_name }}"
                issueNumber: "{{ trigger.body.pull_request.number }}"
                updateTag: kestra-dependabot-triage
                body: |
                  ### Dependabot triage: needs a human review
                  | Check | Result |
                  |---|---|
                  | Dependencies | {{ outputs.classify.values.dependencies is empty ? 'n/a' : outputs.classify.values.dependencies }} |
                  | Semver-major update | {{ outputs.classify.values.major ? ':warning: yes' : 'no' }} |
                  | Workflow files changed | {{ outputs.classify.values.workflow_files is empty ? 'none' : outputs.classify.values.workflow_files }} |
                  | Files changed | {{ outputs.classify.values.files_changed }} |

                  Check the changelog for breaking changes before merging.

                  <sub>Kestra flow `{{ flow.namespace }}.{{ flow.id }}`, execution {{ execution.id }}.</sub>
        else:
          - id: log_routine_update
            type: io.kestra.plugin.core.log.Log
            description: Minor and patch updates are only logged, so Slack stays quiet.
            message: "Routine update ({{ outputs.classify.values.dependencies }}), {{
              outputs.classify.values.files_changed }} file(s). No alert."
    else:
      - id: log_ignored
        type: io.kestra.plugin.core.log.Log
        description: Human PRs, closed or labeled events, and webhook pings end here.
        message: "Not a Dependabot PR event (author={{ render(vars.pr_author) }},
          action={{ render(vars.pr_action) }}). Skipped."