Sentry Bad Release Automated Rollback Gate

id: sentry-bad-release-automated-rollback-gate
namespace: company.deployments

inputs:
  - id: release_version
    type: STRING
    defaults: "v2.4.0"
    description: Target release version tag to evaluate in Sentry.

  - id: previous_stable_version
    type: STRING
    defaults: "v2.3.9"
    description: Known stable release version to roll back to if health checks fail.

  - id: max_tolerated_new_issues
    type: INT
    defaults: 5
    description: Maximum tolerated newly introduced unresolved issues before
      triggering a rollback.

tasks:
  - id: fetch_release_details
    type: io.kestra.plugin.fs.http.Request
    uri: "https://sentry.io/api/0/projects/{{ secret('SENTRY_ORG_SLUG') }}/{{
      secret('SENTRY_PROJECT_SLUG') }}/releases/{{ inputs.release_version }}/"
    method: GET
    headers:
      Authorization: "Bearer {{ secret('SENTRY_AUTH_TOKEN') }}"
      Content-Type: "application/json"

  - id: fetch_release_issues
    type: io.kestra.plugin.fs.http.Request
    uri: "https://sentry.io/api/0/projects/{{ secret('SENTRY_ORG_SLUG') }}/{{
      secret('SENTRY_PROJECT_SLUG') }}/issues/?query=firstRelease:{{
      inputs.release_version }}+is:unresolved&limit=25"
    method: GET
    headers:
      Authorization: "Bearer {{ secret('SENTRY_AUTH_TOKEN') }}"
      Content-Type: "application/json"

  - id: evaluate_release_health
    type: io.kestra.plugin.scripts.python.Script
    containerImage: python:3.12-slim
    script: |
      import json
      import sys
      from kestra import Kestra

      # Parse release details and issue listing directly without synthetic fallbacks
      release_raw = {{ outputs.fetch_release_details.body }}
      issues_raw = {{ outputs.fetch_release_issues.body }}

      if not isinstance(release_raw, dict):
          raise ValueError(f"Sentry release endpoint returned invalid payload. Expected JSON object, got {type(release_raw)}.")

      if not isinstance(issues_raw, list):
          raise ValueError(f"Sentry issues endpoint returned invalid payload. Expected JSON list, got {type(issues_raw)}.")

      new_issues_count = len(issues_raw)
      total_event_count = sum(int(issue.get("count", 0)) for issue in issues_raw)
      max_tolerated = int("{{ inputs.max_tolerated_new_issues }}")

      # Determine if the release has breached the failure threshold
      rollback_needed = new_issues_count >= max_tolerated or total_event_count >= 100

      print(f"Sentry Release Evaluation for {{ inputs.release_version }}:")
      print(f"  New Unresolved Issues: {new_issues_count} (Threshold: {max_tolerated})")
      print(f"  Total Error Events: {total_event_count}")
      print(f"  Rollback Required: {rollback_needed}")

      top_culprits = [
          {"id": i.get("id"), "title": i.get("title"), "count": i.get("count")}
          for i in issues_raw[:3]
      ]

      Kestra.outputs({
          "new_issues_count": new_issues_count,
          "total_event_count": total_event_count,
          "rollback_required": rollback_needed,
          "top_culprits": top_culprits
      })

  - id: rollback_decision_gate
    type: io.kestra.plugin.core.flow.If
    condition: "{{ outputs.evaluate_release_health.vars.rollback_required }}"
    then:
      - id: trigger_automated_rollback
        type: io.kestra.plugin.fs.http.Request
        uri: "https://api.github.com/repos/{{ secret('GITHUB_REPOSITORY') }}/dispatches"
        method: POST
        headers:
          Authorization: "Bearer {{ secret('GITHUB_TOKEN') }}"
          Accept: "application/vnd.github.v3+json"
          Content-Type: "application/json"
        body: |
          {
            "event_type": "rollback_deployment",
            "client_payload": {
              "failed_release": "{{ inputs.release_version }}",
              "target_rollback_version": "{{ inputs.previous_stable_version }}",
              "trigger_reason": "Sentry release error threshold breached: {{ outputs.evaluate_release_health.vars.new_issues_count }} new unresolved issues detected."
            }
          }

      - id: notify_slack_rollback_executed
        type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
        url: "{{ secret('SLACK_WEBHOOK_URL') }}"
        payload: |
          {
            "text": ":rotating_light: *Automated Deployment Rollback Triggered*\nProject: `{{ secret('SENTRY_PROJECT_SLUG') }}`\nFailed Release: `{{ inputs.release_version }}`\nRollback Target: `{{ inputs.previous_stable_version }}`\nNew Issues: `{{ outputs.evaluate_release_health.vars.new_issues_count }}`\nTotal Crashes: `{{ outputs.evaluate_release_health.vars.total_event_count }}`\nStatus: Rollback dispatch event sent to GitHub Actions."
          }

  - id: log_verification_result
    type: io.kestra.plugin.core.log.Log
    message: "Release health gate completed for {{ inputs.release_version }}.
      Rollback triggered: {{
      outputs.evaluate_release_health.vars.rollback_required }}"

triggers:
  - id: deployment_window_audit
    type: io.kestra.plugin.core.trigger.Schedule
    cron: "*/10 * * * *"