Container image size regression guard

id: docker-image-size-regression-guard
namespace: company.team

description: >
  Compare a container image against an approved repository baseline and block
  promotion when size growth crosses the configured budget.

concurrency:
  limit: 1

triggers:
  - id: build_webhook
    type: io.kestra.plugin.core.trigger.Webhook
    description: called by ci after image push.
    key: "{{ secret('WEBHOOK_KEY') }}"

inputs:
  - id: image
    type: STRING
    displayName: Docker image
    description: artifact to check; webhook body image takes precedence.
    defaults: ghcr.io/my-org/my-app:latest

  - id: repository
    type: STRING
    displayName: Image repository
    description: Repo name stored in the baseline metadata(without tag).
    defaults: ghcr.io/my-org/my-app

  - id: baseline_key
    type: STRING
    displayName: Baseline key
    description: KV key for the approved baseline (one key per repo).
    defaults: docker-image-size-ghcr.io/my-org/my-app

  - id: pull_image
    type: BOOL
    displayName: Pull image before check
    defaults: true

  - id: max_increase_percent
    type: FLOAT
    displayName: maximum allowed increase (%)
    defaults: 10.0

  - id: max_increase_mb
    type: FLOAT
    displayName: maximum allowed increase (MB)
    defaults: 50.0

  - id: reset_baseline
    type: BOOL
    displayName: Reset baseline
    description: approve the current size as the new baseline.
    defaults: false

tasks:
  - id: ensure_image
    type: io.kestra.plugin.core.flow.If
    condition: "{{ inputs.pull_image }}"
    then:
      - id: pull
        type: io.kestra.plugin.docker.cli.Pull
        image: "{{ trigger.body.image ?? inputs.image }}"

  - id: inspect_image
    type: io.kestra.plugin.docker.cli.ImageLs
    imageNameFilter: "{{ trigger.body.image ?? inputs.image }}"
    showAll: false

  - id: assert_image_exists
    type: io.kestra.plugin.core.execution.Assert
    errorMessage: "Docker image '{{ trigger.body.image ?? inputs.image }}' not found."
    conditions:
      - "{{ outputs.inspect_image.count == 1 }}"

  - id: read_baseline
    type: io.kestra.plugin.core.kv.Get
    key: "{{ inputs.baseline_key }}"
    errorOnMissing: false

  - id: approve_or_check
    type: io.kestra.plugin.core.flow.If
    condition: "{{ trigger.body.reset_baseline ?? inputs.reset_baseline }}"
    then:
      - id: save_baseline
        type: io.kestra.plugin.core.kv.Set
        key: "{{ inputs.baseline_key }}"
        kvType: JSON
        overwrite: true
        value: |
          {
            "image": "{{ inputs.repository }}",
            "size_bytes": {{ outputs.inspect_image.images[0].size }},
            "approved_at": "{{ execution.startDate }}",
            "approved_artifact": "{{ trigger.body.image ?? inputs.image }}"
          }

      - id: baseline_approved
        type: io.kestra.plugin.core.log.Log
        message: >
          Baseline approved for {{ inputs.repository }}: {{
          (outputs.inspect_image.images[0].size / 1024 / 1024) | round(2) }} MB
          ({{ trigger.body.image ?? inputs.image }}).

    else:
      - id: assess
        type: io.kestra.plugin.scripts.python.Script
        taskRunner:
          type: io.kestra.plugin.core.runner.Process
        env:
          ARTIFACT: "{{ trigger.body.image ?? inputs.image }}"
          CURRENT_SIZE: "{{ outputs.inspect_image.images[0].size }}"
          BASELINE_JSON: "{{ (outputs.read_baseline.value ?? {}) | toJson }}"
          MAX_PERCENT: "{{ inputs.max_increase_percent }}"
          MAX_MB: "{{ inputs.max_increase_mb }}"
        script: |
          import json
          import os

          def mb(bytes_value):
              return round(bytes_value / 1024 / 1024, 2)

          artifact = os.environ["ARTIFACT"]
          current = int(os.environ["CURRENT_SIZE"])
          max_pct = float(os.environ["MAX_PERCENT"])
          max_mb = float(os.environ["MAX_MB"])
          max_bytes = int(max_mb * 1024 * 1024)

          raw = os.environ.get("BASELINE_JSON", "{}")
          if raw in ("", "null", "None", "{}"):
              baseline = {}
          else:
              baseline = json.loads(raw) if isinstance(raw, str) else raw
              if isinstance(baseline, (int, float)):
                  baseline = {"size_bytes": int(baseline), "image": "unknown"}
              elif isinstance(baseline, str):
                  baseline = json.loads(baseline)

          if not baseline or baseline.get("size_bytes") is None:
              report = (
                  "Container Image Regression\n\n"
                  f"Image: {artifact}\n\n"
                  "No approved baseline found.\n"
                  "Run with reset_baseline=true to approve a reference size.\n\n"
                  "Status: FAILED"
              )
              print("::" + json.dumps({"outputs": {"passed": False, "report": report}}) + "::")
              raise SystemExit(0)

          base_size = int(baseline["size_bytes"])
          increase_bytes = current - base_size
          increase_pct = round((increase_bytes / base_size) * 100, 1) if base_size else 0.0

          if increase_bytes <= 0:
              passed = True
          else:
              passed = increase_pct <= max_pct and increase_bytes <= max_bytes

          status = "PASSED" if passed else "FAILED"
          sign = "+" if increase_bytes >= 0 else ""

          report = (
              "Container Image Regression\n\n"
              f"Image: {artifact}\n\n"
              f"Baseline: {mb(base_size)} MB\n"
              f"Current: {mb(current)} MB\n\n"
              f"Increase: {sign}{mb(increase_bytes)} MB\n"
              f"Increase: {sign}{increase_pct}%\n\n"
              f"Allowed: +{max_pct}%\n"
              f"Allowed: +{max_mb} MB\n\n"
              f"Status: {status}"
          )

          print("::" + json.dumps({"outputs": {"passed": passed, "report": report}}) + "::")

      - id: verdict
        type: io.kestra.plugin.core.flow.If
        condition: "{{ outputs.assess.vars.passed }}"
        then:
          - id: regression_passed
            type: io.kestra.plugin.core.log.Log
            message: "{{ outputs.assess.vars.report }}"
        else:
          - id: regression_failed
            type: io.kestra.plugin.core.execution.Fail
            errorMessage: "{{ outputs.assess.vars.report }}"

errors:
  - id: alert_failure
    type: io.kestra.plugin.discord.DiscordIncomingWebhook
    url: "{{ secret('DISCORD_WEBHOOK_URL') }}"
    payload: |
      {
        "content": {{ (outputs.assess.vars.report ?? ('Container image size guard failed. Execution ' ~ execution.id)) | json }}
      }

outputs:
  - id: passed
    type: BOOL
    value: "{{ outputs.assess.vars.passed ?? (trigger.body.reset_baseline ??
      inputs.reset_baseline) }}"
  - id: report
    type: STRING
    value: "{{ outputs.assess.vars.report ?? '' }}"