Automate Incident Response, Create Jira Tickets, Alert Slack, and Log to Database

id: incident-response-jira-slack
namespace: company.team

inputs:
  - id: service
    type: STRING
    displayName: Affected service
    description: Name of the service or system experiencing the incident
    defaults: "payment-api"
  - id: severity
    type: SELECT
    displayName: Severity
    description: Incident severity level
    values:
      - P1 - Critical
      - P2 - High
      - P3 - Medium
      - P4 - Low
    defaults: "P2 - High"
  - id: description
    type: STRING
    displayName: Incident description
    description: Brief description of the incident and its impact
    defaults: "Service returning 500 errors with elevated error rate above 10%"
  - id: jira_project_key
    type: STRING
    displayName: Jira project key
    description: The Jira project key to create the incident ticket under
    defaults: "OPS"
  - id: slack_channel
    type: STRING
    displayName: Slack channel
    description: Slack channel ID or name to notify the on-call team
    defaults: "#oncall"

tasks:
  - id: create_jira_ticket
    type: io.kestra.plugin.jira.issues.Create
    baseUrl: "https://{{ secret('JIRA_DOMAIN') }}.atlassian.net"
    username: "{{ secret('JIRA_USERNAME') }}"
    password: "{{ secret('JIRA_API_TOKEN') }}"
    projectKey: "{{ inputs.jira_project_key }}"
    summary: "[{{ inputs.severity }}] Incident: {{ inputs.service }}"
    description: |
      *Incident Report*

      *Service:* {{ inputs.service }}
      *Severity:* {{ inputs.severity }}
      *Reported at:* {{ now() | date('yyyy-MM-dd HH:mm:ss') }} UTC

      *Description:*
      {{ inputs.description }}

      ---
      _Created automatically by Kestra Incident Response workflow._
    issueTypeId: "10001"
    labels:
      - incident
      - "{{ inputs.severity | lower | replace(' ', '-') | replace(':', '') }}"

  - id: alert_slack
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    url: "{{ secret('SLACK_WEBHOOK_URL') }}"
    payload: |
      {
        "text": ":rotating_light: *Incident Alert, {{ inputs.severity }}*",
        "blocks": [
          {
            "type": "header",
            "text": {
              "type": "plain_text",
              "text": ":rotating_light: Incident Alert, {{ inputs.severity }}"
            }
          },
          {
            "type": "section",
            "fields": [
              {"type": "mrkdwn", "text": "*Service:*\n{{ inputs.service }}"},
              {"type": "mrkdwn", "text": "*Severity:*\n{{ inputs.severity }}"},
              {"type": "mrkdwn", "text": "*Jira Ticket:*\n{{ outputs.create_jira_ticket.key }}"},
              {"type": "mrkdwn", "text": "*Reported:*\n{{ now() | date('yyyy-MM-dd HH:mm') }} UTC"}
            ]
          },
          {
            "type": "section",
            "text": {
              "type": "mrkdwn",
              "text": "*Description:*\n{{ inputs.description }}"
            }
          }
        ]
      }

  - id: generate_timeline_report
    type: io.kestra.plugin.scripts.python.Script
    script: |
      import json
      from datetime import datetime
      from kestra import Kestra

      now = datetime.utcnow().strftime("%Y-%m-%d %H:%M:%S UTC")
      jira_key = "{{ outputs.create_jira_ticket.key }}"
      service = "{{ inputs.service }}"
      severity = "{{ inputs.severity }}"
      description = """{{ inputs.description }}"""

      report = f"""INCIDENT TIMELINE REPORT
      ========================
      Generated: {now}
      Jira Ticket: {jira_key}

      SERVICE: {service}
      SEVERITY: {severity}

      DESCRIPTION:
      {description}

      TIMELINE:
      {now} - Incident detected and reported
      {now} - Jira ticket {jira_key} created
      {now} - On-call team notified via Slack

      POSTMORTEM PLACEHOLDERS:
      Root Cause:      [TO BE FILLED]
      Impact:          [TO BE FILLED]
      Resolution:      [TO BE FILLED]
      Resolved At:     [TO BE FILLED]
      Action Items:    [TO BE FILLED]
      """

      Kestra.outputs({"report_content": report})

  - id: log_incident_to_postgres
    type: io.kestra.plugin.jdbc.postgresql.Queries
    fetchType: NONE
    sql: |
      INSERT INTO incident_log (jira_key, service, severity, description, created_at)
      VALUES (
        '{{ outputs.create_jira_ticket.key }}',
        '{{ inputs.service }}',
        '{{ inputs.severity }}',
        '{{ inputs.description | replace("'", "''") }}',
        NOW()
      )
      ON CONFLICT (jira_key) DO NOTHING;

pluginDefaults:
  - type: io.kestra.plugin.jdbc.postgresql.Queries
    values:
      url: "{{ secret('POSTGRES_URL') }}"
      username: "{{ secret('POSTGRES_USER') }}"
      password: "{{ secret('POSTGRES_PASSWORD') }}"