Weekly npm Outdated Major-Bump Digest

id: npm-outdated-major-bumps-digest
namespace: company.team
description: |
  Run `npm outdated` in a container and post a digest of dependencies that have
  a new major version waiting — the ones that actually carry breaking-change risk.

triggers:
  - id: weekly_digest
    type: io.kestra.plugin.core.trigger.Schedule
    description: Weekly dependency freshness digest; shipped disabled until secrets
      and repo path are set.
    cron: "30 9 * * 3"
    disabled: true
  - id: pr_webhook
    type: io.kestra.plugin.core.trigger.Webhook
    description: Call after merging a dependency PR to confirm nothing else is
      silently stale.
    key: npm-outdated-check

inputs:
  - id: repo_url
    type: STRING
    defaults: https://github.com/kestra-io/kestra.git
    description: Git URL cloned before running npm outdated.
  - id: subdirectory
    type: STRING
    defaults: ui
    description: Subdirectory containing package.json (the JS app root). Use "." for
      repo root.

tasks:
  - id: npm_outdated
    type: io.kestra.plugin.scripts.shell.Commands
    description: Clone the repo, install nothing (npm outdated only needs the
      registry), and emit parsed outdated-dependency JSON via the stdout outputs
      protocol.
    containerImage: node:20-bookworm
    taskRunner:
      type: io.kestra.plugin.scripts.runner.docker.Docker
    commands:
      - |
        set -eu
        git clone --depth 1 "{{ inputs.repo_url }}" repo 2>/dev/null
        cd "repo/{{ inputs.subdirectory }}"
        npm outdated --json > outdated.json || true
        node -e '
          const fs = require("fs");
          let data = {};
          try { data = JSON.parse(fs.readFileSync("outdated.json", "utf8")); } catch (e) { data = {}; }
          const entries = Object.entries(data).map(([name, v]) => ({
            name, current: v.current, wanted: v.wanted, latest: v.latest,
            major: String(v.current).split(".")[0] !== String(v.latest).split(".")[0],
          }));
          const majors = entries.filter(e => e.major);
          console.log("outdated: " + entries.length + ", major bumps: " + majors.length);
          console.log("::" + JSON.stringify({ outputs: { total: entries.length, majors: majors.length, details: majors.slice(0, 10) } }) + "::");
        '

  - id: check_majors
    type: io.kestra.plugin.core.flow.If
    description: Only interrupt the team when at least one major bump is pending —
      patch/minor drift gets logged.
    condition: "{{ outputs.npm_outdated.vars.majors > 0 }}"
    then:
      - id: post_digest
        type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
        description: List the major bumps so the digest says which packages carry
          breaking-change risk.
        url: "{{ secret('SLACK_WEBHOOK_URL') }}"
        payload: |
          {
            "text": ":package: npm outdated digest for {{ inputs.repo_url }} ({{ inputs.subdirectory }}): {{ outputs.npm_outdated.vars.majors }} major bump(s) out of {{ outputs.npm_outdated.vars.total }} outdated packages. Review {{ inputs.subdirectory }}/package.json. Execution {{ execution.id }}."
          }
    else:
      - id: log_fresh
        type: io.kestra.plugin.core.log.Log
        description: Record the green week so stale weeks stand out in the execution
          history.
        message: "No major npm bumps pending for {{ inputs.repo_url }} ({{
          inputs.subdirectory }}); {{ outputs.npm_outdated.vars.total }}
          outdated total."

errors:
  - id: alert_failure
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    description: Alert when the check itself fails — a broken audit must not look
      like a fresh dependency tree.
    url: "{{ secret('SLACK_WEBHOOK_URL') }}"
    payload: |
      {
        "text": "npm outdated check FAILED in flow {{ flow.id }} (execution {{ execution.id }}) for {{ inputs.repo_url }}. Verify the repo URL and subdirectory input."
      }

outputs:
  - id: dependency_summary
    type: JSON
    description: 'Total outdated packages and major-bump count, e.g. {"total": 12,
      "majors": 3}.'
    value: "{{ outputs.npm_outdated.vars | toJson }}"