Incident triage from any alert

trigger:
  kind: webhook
steps:
  - key: normalize
    name: Normalize alert
    kind: javascript
    inputs: { body: "{{ trigger.body }}" }
    outputs: { title: string, service: string, details: string }
    code: |
      function main({ body }) {
        const alert = body.alert || body
        return {
          title: alert.title || alert.name || "Untitled alert",
          service: alert.service || (alert.tags || {}).service || "unknown",
          details: JSON.stringify(alert).slice(0, 4000)
        }
      }
  - key: classify
    name: Classify severity
    kind: llm
    model: fast
    prompt: "Classify this production alert as SEV1, SEV2 or SEV3 and summarize it in two sentences: {{ steps.normalize.output }}"
    schema:
      type: object
      properties:
        severity: { type: string, enum: [SEV1, SEV2, SEV3] }
        summary: { type: string }
      required: [severity, summary]
  - key: issue
    name: Open tracking issue
    kind: tool
    tool: github.create_issue
    args:
      repo: northwind/ops
      title: "[{{ steps.classify.output.data.severity }}] {{ steps.normalize.output.title }}"
      body: "{{ steps.classify.output.data.summary }}\n\nService: {{ steps.normalize.output.service }}"
      labels: [incident]
  - key: page
    name: "Page #incidents"
    kind: tool
    if: { path: steps.classify.output.data.severity, equals: SEV1 }
    tool: slack.post_message
    args:
      channel: C05INCIDENT
      text: ":fire: SEV1 on {{ steps.normalize.output.service }}: {{ steps.normalize.output.title }} — {{ steps.issue.output.html_url }}"