Jenkins Build-to-Deploy Approval Gate with Teams Notification

id: jenkins-approval-build-to-deploy
namespace: company.team
description: |
  Put a human gate between a Jenkins build and its deploy job. Run the build,
  poll Jenkins's lastBuild endpoint until it finishes, post the result to
  Microsoft Teams as an Adaptive Card, pause for a named reviewer, then fire
  the deploy. Reviewer identity and approval timestamp are stored in
  execution history automatically.

inputs:
  - id: build_job
    type: STRING
    description: Jenkins job name for the build stage.
  - id: deploy_job
    type: STRING
    description: Jenkins job name for the deploy stage.
  - id: jenkins_url
    type: STRING
    defaults: https://jenkins.example.com
    description: Base URL of the Jenkins instance.
  - id: approval_timeout
    type: DURATION
    defaults: PT4H
    description: How long to wait for human approval before timing out.

tasks:
  - id: run_build
    type: io.kestra.plugin.jenkins.JobBuild
    description: Enqueue the build job in Jenkins.
    serverUrl: "{{ inputs.jenkins_url }}"
    jobName: "{{ inputs.build_job }}"
    username: "{{ secret('JENKINS_USERNAME') }}"
    apiToken: "{{ secret('JENKINS_API_TOKEN') }}"

  - id: wait_for_build
    type: io.kestra.plugin.core.flow.Sequential
    description: Poll Jenkins lastBuild until the build has a terminal result before
      asking for approval.
    retry:
      type: constant
      interval: PT15S
      maxAttempt: 80
    tasks:
      - id: build_status
        type: io.kestra.plugin.core.http.Request
        uri: "{{ inputs.jenkins_url }}/job/{{ inputs.build_job }}/lastBuild/api/json"
        method: GET
        options:
          auth:
            type: BASIC
            username: "{{ secret('JENKINS_USERNAME') }}"
            password: "{{ secret('JENKINS_API_TOKEN') }}"
      - id: assert_build_done
        type: io.kestra.plugin.core.execution.Assert
        description: Re-runs the polling block until the build has a terminal result.
        conditions:
          - "{{ (outputs.build_status.body.result ?? '') != '' }}"

  - id: notify_approval
    type: io.kestra.plugin.microsoft365.teams.TeamsIncomingWebhook
    description: Tell the team a deploy is waiting for approval after the build completed.
    url: "{{ secret('TEAMS_WEBHOOK_URL') }}"
    payload: |
      {
        "type": "message",
        "attachments": [
          {
            "contentType": "application/vnd.microsoft.card.adaptive",
            "content": {
              "$schema": "http://adaptivecards.io/schemas/adaptive-card.json",
              "type": "AdaptiveCard",
              "version": "1.4",
              "body": [
                {
                  "type": "TextBlock",
                  "size": "Large",
                  "weight": "Bolder",
                  "text": "Jenkins deploy awaiting approval"
                },
                {
                  "type": "TextBlock",
                  "text": "Build {{ inputs.build_job }} complete. Review and approve the deploy to {{ inputs.deploy_job }} (execution {{ execution.id }}).",
                  "wrap": true
                }
              ]
            }
          }
        ]
      }

  - id: await_approval
    type: io.kestra.plugin.core.flow.Pause
    description: Wait for a human to approve the deploy in the Kestra UI.
    pauseDuration: "{{ inputs.approval_timeout }}"

  - id: run_deploy
    type: io.kestra.plugin.jenkins.JobBuild
    description: Enqueue the deploy job after the reviewer approves.
    serverUrl: "{{ inputs.jenkins_url }}"
    jobName: "{{ inputs.deploy_job }}"
    username: "{{ secret('JENKINS_USERNAME') }}"
    apiToken: "{{ secret('JENKINS_API_TOKEN') }}"

  - id: notify_complete
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    description: Confirm the deploy job was triggered after approval.
    url: "{{ secret('SLACK_WEBHOOK_URL') }}"
    payload: |
      {
        "text": "Jenkins deploy {{ inputs.deploy_job }} triggered after approval (execution {{ execution.id }})."
      }