feat: add discord run reporting

Signed-off-by: zebbern <185730623+zebbern@users.noreply.github.com>

Author: zebbern

backend/.env.example

@@ -5,6 +5,8 @@ DATABASE_URL="postgresql://sentris:sentris@localhost:5433/sentris_instance_0"
 
 # HTTP server configuration
 PORT="3211"
+# Public frontend base URL used in Slack/Discord lifecycle notification links
+SENTRIS_FRONTEND_BASE_URL="http://localhost:5173"
 
 # Temporal connection details
 TEMPORAL_ADDRESS="localhost:7233"

backend/scripts/seed-templates/security-scan-discord-report.json

@@ -0,0 +1,187 @@
+{
+  "_metadata": {
+    "name": "Security Scan Discord Report",
+    "description": "Scan a container image with Trivy, build a prioritized CVE summary, post results to Discord, and save a JSON report artifact.",
+    "category": "container-security",
+    "tags": ["container", "cve", "trivy", "discord", "notification"],
+    "author": "sentris-team",
+    "version": "1.0.0"
+  },
+  "manifest": {
+    "name": "Security Scan Discord Report",
+    "description": "Trivy image scan with Discord webhook notification and artifact report.",
+    "version": "1.0.0",
+    "author": "sentris-team",
+    "category": "container-security",
+    "tags": ["container", "cve", "trivy", "discord", "notification"],
+    "entryPoint": "trigger_1",
+    "nodeCount": 5,
+    "edgeCount": 7
+  },
+  "graph": {
+    "name": "Security Scan Discord Report",
+    "description": "Authorized container image scan with Discord notification for triage teams.",
+    "nodes": [
+      {
+        "id": "trigger_1",
+        "type": "core.workflow.entrypoint",
+        "position": { "x": 100, "y": 260 },
+        "data": {
+          "label": "Scan Input",
+          "config": {
+            "params": {
+              "runtimeInputs": [
+                {
+                  "id": "imageRef",
+                  "label": "Container image reference",
+                  "type": "text",
+                  "required": true,
+                  "description": "Public or locally available container image reference, for example nginx:1.25 or node:18-alpine."
+                }
+              ]
+            },
+            "inputOverrides": {}
+          }
+        }
+      },
+      {
+        "id": "trivy_image_scan",
+        "type": "sentris.trivy.run",
+        "position": { "x": 420, "y": 260 },
+        "data": {
+          "label": "Scan Image CVEs",
+          "config": {
+            "params": {
+              "scanType": "image",
+              "severity": ["CRITICAL", "HIGH", "MEDIUM"],
+              "format": "json"
+            },
+            "inputOverrides": {}
+          }
+        }
+      },
+      {
+        "id": "assemble_report",
+        "type": "core.logic.script",
+        "position": { "x": 760, "y": 260 },
+        "data": {
+          "label": "Build Scan Report",
+          "config": {
+            "params": {
+              "variables": [
+                { "name": "imageRef", "type": "string" },
+                { "name": "vulnerabilities", "type": "list-json" },
+                { "name": "vulnerabilityCount", "type": "number" }
+              ],
+              "returns": [
+                { "name": "summaryText", "type": "string" },
+                { "name": "report", "type": "json" },
+                { "name": "attachmentContent", "type": "string" }
+              ],
+              "code": "export function script(input) {\n  const vulnerabilities = Array.isArray(input.vulnerabilities) ? input.vulnerabilities : [];\n  const severityRank = { critical: 4, high: 3, medium: 2, low: 1, info: 0, unknown: 0 };\n  const normalizeSeverity = (value) => String(value || 'unknown').toLowerCase();\n  const rankFor = (value) => severityRank[normalizeSeverity(value)] ?? 0;\n  const priorityFindings = vulnerabilities\n    .map((finding) => ({\n      vulnerabilityId: finding?.vulnerabilityId,\n      pkgName: finding?.pkgName,\n      severity: normalizeSeverity(finding?.severity),\n      title: finding?.title,\n      fixedVersion: finding?.fixedVersion || null\n    }))\n    .filter((finding) => finding.vulnerabilityId && rankFor(finding.severity) >= 2)\n    .sort((a, b) => rankFor(b.severity) - rankFor(a.severity))\n    .slice(0, 25);\n  const countsBySeverity = priorityFindings.reduce((acc, finding) => {\n    acc[finding.severity] = (acc[finding.severity] || 0) + 1;\n    return acc;\n  }, {});\n  const highestSeverity = priorityFindings[0]?.severity || 'none';\n  const imageRef = input.imageRef || 'unknown image';\n  const summaryText = `${imageRef}: ${priorityFindings.length} actionable CVEs (highest: ${highestSeverity})`;\n  const report = {\n    summary: {\n      imageRef,\n      vulnerabilityCount: Number(input.vulnerabilityCount || vulnerabilities.length),\n      actionableFindings: priorityFindings.length,\n      highestSeverity,\n      countsBySeverity\n    },\n    priorityFindings\n  };\n  return {\n    summaryText,\n    report,\n    attachmentContent: JSON.stringify(report, null, 2)\n  };\n}"
+            },
+            "inputOverrides": {}
+          }
+        }
+      },
+      {
+        "id": "discord_notify",
+        "type": "core.notification.discord",
+        "position": { "x": 1100, "y": 200 },
+        "data": {
+          "label": "Post to Discord",
+          "config": {
+            "params": {
+              "attachmentFileName": "scan-report.json",
+              "attachmentContentFormat": "text",
+              "attachmentMimeType": "application/json",
+              "variables": [{ "name": "summaryText", "type": "string" }]
+            },
+            "inputOverrides": {
+              "webhookUrl": "{{SECRET_PLACEHOLDER}}",
+              "content": "**Container scan complete** — {{summaryText}}",
+              "embeds": "[{\"title\":\"CVE Scan Summary\",\"description\":\"{{summaryText}}\",\"color\":5814783}]"
+            }
+          }
+        }
+      },
+      {
+        "id": "artifact_report",
+        "type": "core.artifact.writer",
+        "position": { "x": 1100, "y": 340 },
+        "data": {
+          "label": "Save Scan Report",
+          "config": {
+            "params": {
+              "fileExtension": ".json",
+              "mimeType": "application/json",
+              "saveToRunArtifacts": true,
+              "publishToArtifactLibrary": false
+            },
+            "inputOverrides": {
+              "artifactName": "security-scan-discord-report-{{date}}"
+            }
+          }
+        }
+      }
+    ],
+    "edges": [
+      {
+        "id": "trigger_1-trivy_image_scan-imageRef",
+        "source": "trigger_1",
+        "target": "trivy_image_scan",
+        "sourceHandle": "imageRef",
+        "targetHandle": "target"
+      },
+      {
+        "id": "trigger_1-assemble_report-imageRef",
+        "source": "trigger_1",
+        "target": "assemble_report",
+        "sourceHandle": "imageRef",
+        "targetHandle": "imageRef"
+      },
+      {
+        "id": "trivy_image_scan-assemble_report-vulnerabilities",
+        "source": "trivy_image_scan",
+        "target": "assemble_report",
+        "sourceHandle": "vulnerabilities",
+        "targetHandle": "vulnerabilities"
+      },
+      {
+        "id": "trivy_image_scan-assemble_report-vulnerabilityCount",
+        "source": "trivy_image_scan",
+        "target": "assemble_report",
+        "sourceHandle": "vulnerabilityCount",
+        "targetHandle": "vulnerabilityCount"
+      },
+      {
+        "id": "assemble_report-discord_notify-summaryText",
+        "source": "assemble_report",
+        "target": "discord_notify",
+        "sourceHandle": "summaryText",
+        "targetHandle": "summaryText"
+      },
+      {
+        "id": "assemble_report-discord_notify-attachmentContent",
+        "source": "assemble_report",
+        "target": "discord_notify",
+        "sourceHandle": "attachmentContent",
+        "targetHandle": "attachmentContent"
+      },
+      {
+        "id": "assemble_report-artifact_report-report",
+        "source": "assemble_report",
+        "target": "artifact_report",
+        "sourceHandle": "report",
+        "targetHandle": "content"
+      }
+    ]
+  },
+  "requiredSecrets": [
+    {
+      "name": "DISCORD_WEBHOOK_URL",
+      "type": "string",
+      "description": "Discord Incoming Webhook URL for scan notifications"
+    }
+  ]
+}

backend/src/database/schema/notification-channels.ts

@@ -16,7 +16,7 @@ export const notificationChannelsTable = pgTable(
     id: uuid('id').primaryKey().defaultRandom(),
     organizationId: varchar('organization_id', { length: 191 }).notNull(),
     name: text('name').notNull(),
-    type: text('type').notNull().$type<'slack' | 'email' | 'pagerduty'>(),
+    type: text('type').notNull().$type<'slack' | 'discord' | 'email' | 'pagerduty'>(),
     config: jsonb('config').notNull().$type<Record<string, unknown>>(),
     status: text('status').notNull().default('active').$type<'active' | 'inactive'>(),
     events: jsonb('events').notNull().$type<string[]>(),

backend/src/notifications/__tests__/discord.adapter.spec.ts

@@ -0,0 +1,115 @@
+import { beforeEach, describe, expect, it, mock, afterEach } from 'bun:test';
+import type { NotificationChannelRecord } from '../../database/schema';
+import type { RunLifecycleEvent } from '@sentris/shared';
+
+let mockResolve4Result: string[] = ['104.16.132.229'];
+let mockResolve6Result: string[] | null = null;
+let mockResolve4Error: Error | null = null;
+
+mock.module('node:dns', () => ({
+  promises: {
+    resolve4: async (_hostname: string) => {
+      if (mockResolve4Error) throw mockResolve4Error;
+      return mockResolve4Result;
+    },
+    resolve6: async (_hostname: string) => {
+      if (mockResolve6Result === null) throw new Error('no AAAA record');
+      return mockResolve6Result;
+    },
+  },
+}));
+
+import { DiscordNotificationAdapter } from '../adapters/discord.adapter';
+
+function makeChannel(
+  overrides: Partial<NotificationChannelRecord> = {},
+): NotificationChannelRecord {
+  const now = new Date();
+  return {
+    id: overrides.id ?? 'ch-discord-1',
+    organizationId: overrides.organizationId ?? 'org-1',
+    name: overrides.name ?? 'Discord Alerts',
+    type: overrides.type ?? 'discord',
+    config: overrides.config ?? {
+      webhookUrl: 'https://discord.com/api/webhooks/1234567890/abcdefghijklmnop',
+    },
+    status: overrides.status ?? 'active',
+    events: overrides.events ?? ['run.completed'],
+    createdBy: overrides.createdBy ?? 'user-1',
+    createdAt: overrides.createdAt ?? now,
+    updatedAt: overrides.updatedAt ?? now,
+  };
+}
+
+const testPayload: RunLifecycleEvent = {
+  runId: 'run-abc',
+  workflowId: 'wf-1',
+  organizationId: 'org-1',
+  status: 'COMPLETED',
+  completedAt: '2026-01-15T12:00:00Z',
+};
+
+describe('DiscordNotificationAdapter', () => {
+  let adapter: DiscordNotificationAdapter;
+  let originalFetch: typeof globalThis.fetch;
+
+  beforeEach(() => {
+    adapter = new DiscordNotificationAdapter();
+    originalFetch = globalThis.fetch;
+    mockResolve4Result = ['104.16.132.229'];
+    mockResolve6Result = null;
+    mockResolve4Error = null;
+    delete process.env.SENTRIS_FRONTEND_BASE_URL;
+  });
+
+  afterEach(() => {
+    globalThis.fetch = originalFetch;
+  });
+
+  it('POSTs embed payload to Discord webhook URL', async () => {
+    let capturedUrl = '';
+    let capturedBody = '';
+
+    globalThis.fetch = (async (input: string | URL | Request, init?: RequestInit) => {
+      capturedUrl = String(input);
+      capturedBody = init?.body as string;
+      return new Response('', { status: 204 });
+    }) as unknown as typeof fetch;
+
+    const result = await adapter.send(makeChannel(), testPayload);
+
+    expect(result.success).toBe(true);
+    expect(capturedUrl).toBe('https://discord.com/api/webhooks/1234567890/abcdefghijklmnop');
+    const body = JSON.parse(capturedBody);
+    expect(body.embeds).toBeDefined();
+    expect(body.embeds[0].title).toContain('COMPLETED');
+  });
+
+  it('includes run link when SENTRIS_FRONTEND_BASE_URL is set', async () => {
+    process.env.SENTRIS_FRONTEND_BASE_URL = 'http://localhost:5173';
+    let capturedBody = '';
+
+    globalThis.fetch = (async (_: string | URL | Request, init?: RequestInit) => {
+      capturedBody = init?.body as string;
+      return new Response('', { status: 204 });
+    }) as unknown as typeof fetch;
+
+    await adapter.send(makeChannel(), testPayload);
+
+    const body = JSON.parse(capturedBody);
+    const runField = body.embeds[0].fields.find(
+      (field: { name: string }) => field.name === 'Open in Sentris',
+    );
+    expect(runField.value).toBe('http://localhost:5173/workflows/wf-1/runs/run-abc');
+  });
+
+  it('rejects invalid webhook URL format', async () => {
+    const channel = makeChannel({
+      config: { webhookUrl: 'https://example.com/hook' },
+    });
+
+    const result = await adapter.send(channel, testPayload);
+    expect(result.success).toBe(false);
+    expect(result.error).toContain('Invalid Discord webhook URL');
+  });
+});

backend/src/notifications/__tests__/notification-dispatcher-response.spec.ts

@@ -4,6 +4,7 @@ import type { NotificationChannelRecord, NotificationDeliveryRecord } from '../.
 import type { NotificationChannelRepository } from '../repository/notification-channel.repository';
 import type { NotificationDeliveryRepository } from '../repository/notification-delivery.repository';
 import type { SlackNotificationAdapter } from '../adapters/slack.adapter';
+import type { DiscordNotificationAdapter } from '../adapters/discord.adapter';
 import { NotificationDispatcherService } from '../notification-dispatcher.service';
 
 // ---------------------------------------------------------------------------
@@ -83,7 +84,17 @@ function createMocks() {
     ),
   } as unknown as SlackNotificationAdapter;
 
-  return { channelRepo, deliveryRepo, slackAdapter, deliveryUpdates };
+  const discordAdapter = {
+    send: mock(() =>
+      Promise.resolve({
+        success: true,
+        responseStatus: 204,
+        responseBody: '',
+      }),
+    ),
+  } as unknown as DiscordNotificationAdapter;
+
+  return { channelRepo, deliveryRepo, slackAdapter, discordAdapter, deliveryUpdates };
 }
 
 // ---------------------------------------------------------------------------
@@ -112,6 +123,7 @@ describe('NotificationDispatcherService — response capture', () => {
       mocks.channelRepo,
       mocks.deliveryRepo,
       mocks.slackAdapter,
+      mocks.discordAdapter,
     );
   });