DigitalOcean Stale Snapshot Cost Sentinel

id: digitalocean-stale-snapshot-cost-sentinel
namespace: company.team

description: |
  List every droplet and volume snapshot on a DigitalOcean account, classify it HEALTHY,
  WARNING, CRITICAL or PROBE_FAILED from the real count of snapshots older than a retention
  threshold, and alert Slack naming the exact snapshots and their real billable size, never
  an invented value.

inputs:
  - id: stale_age_days_threshold
    type: INT
    displayName: Stale age threshold (days)
    description: A snapshot's created_at age in days at or above which it is counted
      as stale.
    defaults: 90

  - id: stale_count_warning_threshold
    type: INT
    displayName: Stale snapshot warning threshold
    description: Number of stale snapshots at or above which the account is
      classified WARNING instead of HEALTHY.
    defaults: 1

  - id: stale_count_critical_threshold
    type: INT
    displayName: Stale snapshot critical threshold
    description: Number of stale snapshots at or above which the account is
      classified CRITICAL.
    defaults: 5

tasks:
  - id: probe_snapshots
    type: io.kestra.plugin.digitalocean.snapshot.List
    description: Lists every droplet and volume snapshot on the account, including
      its real creation timestamp and billable size in GB.
    allowFailure: true
    apiToken: "{{ secret('DIGITALOCEAN_TOKEN') }}"
    fetchType: FETCH

  - id: classify_snapshot_status
    type: io.kestra.plugin.core.debug.Return
    description: PROBE_FAILED when the probe did not return at all, CRITICAL or
      WARNING from the real count of snapshots older than
      stale_age_days_threshold, HEALTHY otherwise.
    format: "{{ (outputs.probe_snapshots.rows is not defined or
      outputs.probe_snapshots.rows is null) ? 'PROBE_FAILED' : (
      ((outputs.probe_snapshots.rows | jq('[.[] | select(((now - (.created_at |
      fromdateiso8601)) / 86400) > ' ~ inputs.stale_age_days_threshold ~ ')] |
      length') | first) >= inputs.stale_count_critical_threshold) ? 'CRITICAL' :
      ( ((outputs.probe_snapshots.rows | jq('[.[] | select(((now - (.created_at
      | fromdateiso8601)) / 86400) > ' ~ inputs.stale_age_days_threshold ~ ')] |
      length') | first) >= inputs.stale_count_warning_threshold) ? 'WARNING' :
      'HEALTHY' ) ) }}"

  - id: route_by_snapshot_status
    type: io.kestra.plugin.core.flow.Switch
    description: Branch A logs an account with no stale snapshots. Branch B alerts
      Slack naming the real stale snapshots and their real billable size, never
      an invented list.
    value: "{{ outputs.classify_snapshot_status.value }}"
    cases:
      "HEALTHY":
        - id: log_healthy
          type: io.kestra.plugin.core.log.Log
          message: "DigitalOcean account healthy, no snapshot is older than {{
            inputs.stale_age_days_threshold }} days. Total snapshots: {{
            outputs.probe_snapshots.total }}."
      "WARNING":
        - id: alert_warning
          type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
          url: "{{ secret('SLACK_WEBHOOK') }}"
          payload: |
            {{ {"text": "DigitalOcean stale snapshot WARNING. Snapshots older than " ~ inputs.stale_age_days_threshold ~ " days: " ~ (outputs.probe_snapshots.rows | jq('[.[] | select(((now - (.created_at | fromdateiso8601)) / 86400) > ' ~ inputs.stale_age_days_threshold ~ ') | (.name + " (" + (.size_gigabytes | tostring) + "GB)")] | join(", ")') | first) ~ "."} | toJson }}
      "CRITICAL":
        - id: alert_critical
          type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
          url: "{{ secret('SLACK_WEBHOOK') }}"
          payload: |
            {{ {"text": "DigitalOcean stale snapshot CRITICAL. Snapshots older than " ~ inputs.stale_age_days_threshold ~ " days: " ~ (outputs.probe_snapshots.rows | jq('[.[] | select(((now - (.created_at | fromdateiso8601)) / 86400) > ' ~ inputs.stale_age_days_threshold ~ ') | (.name + " (" + (.size_gigabytes | tostring) + "GB)")] | join(", ")') | first) ~ ", at or above the " ~ inputs.stale_count_critical_threshold ~ " threshold."} | toJson }}
      "PROBE_FAILED":
        - id: alert_probe_failed
          type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
          url: "{{ secret('SLACK_WEBHOOK') }}"
          payload: |
            {{ {"text": "DigitalOcean snapshot probe did not return a result. Check the DIGITALOCEAN_TOKEN secret."} | toJson }}
    defaults:
      - id: log_unexpected_status
        type: io.kestra.plugin.core.log.Log
        message: "Unexpected classify_snapshot_status value: {{
          outputs.classify_snapshot_status.value }}"

  - id: log_audit_summary
    type: io.kestra.plugin.core.log.Log
    description: Final audit log confirming the gate ran, regardless of the branch
      taken above.
    message: "DigitalOcean stale snapshot cost sentinel completed. status={{
      outputs.classify_snapshot_status.value }} total_snapshots={{
      outputs.probe_snapshots.total ?? 'N/A' }}"

errors:
  - id: alert_flow_failure
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    url: "{{ secret('SLACK_WEBHOOK') }}"
    payload: |
      {{ {"text": "DigitalOcean stale snapshot cost sentinel flow failed (execution " ~ execution.id ~ "). Check the execution logs."} | toJson }}

triggers:
  - id: every_monday
    type: io.kestra.plugin.core.trigger.Schedule
    description: Shipped disabled.
    cron: "0 8 * * 1"
    disabled: true
    inputs:
      stale_age_days_threshold: 90
      stale_count_warning_threshold: 1
      stale_count_critical_threshold: 5