Terraform Module for Slack Notifications on Stale GitLab Merge Requests

Terraform module which creates AWS Lambda function which notifies a Slack workspace about GitLab merge requests that haven't been updated within a certain amount of days. Messages the merge request author individually and posts a summary to the fallback channel. Posts to the fallback channel when the author of the merge request cannot be found.

The Lambda function uses values from the Parameter Store for API tokens. The value of these tokens needs to be updated manually, as this module will create them with the value placeholder.

Install

You must have python3 and pip installed to generate .zip files for Lambda Function and layer. Note: If you have Python version 3.4 or later, pip is included by default.

Usage

Notify Slack users with 'example.com' email domain

module "gitlab-stale-merge-requests-slack-app" {
  source  = "alanjonesit/gitlab-stale-merge-requests-slack-app/aws"

  gitlab_base_url       = "https://gitlab.example.com"
  stale_days_threshold  = 7
  fallback_channel_id   = "#fallback-channel"
  internal_email_domains = ["example.com"]
  lambda_schedule       = "cron(0 1 ? * MON *)" # Monday 11am AEST
}

GitLab and Slack permissions

GitLab Token

The GitLab token will require the following permissions:

• api

Slack App

Your Slack app will require the following permissions:

• chat:write
• im:write
• users:read
• users:read.email

The Slack app will also need to be added to the fallback channel.

Slack message showcase

Fallback channel message

Total of 23 open merge requests not updated in the last 7 days, in non-archived projects.
Note: If the numbers below do not match the merge requests in GitLab, you may not have permission to view them.
- @User1 has a count of 4 # The number is a hyperlink to show the merge requests in GitLab
- @User2 has a count of 3

Direct message

You have open merge requests that haven't been updated in the last 7 days. Please review and take appropriate action.

Merge Request: feat: use components
Project: group-name/project-name
Last Updated: 15-03-2024 (37 days ago)
Status: :magnifying_glass_right: Approval is required before merge.
---

Requirements

Name	Version
terraform	>= 1.0
archive	>= 2.4
aws	>= 5.0
null	>= 3.2

Providers

Name	Version
archive	>= 2.4
aws	>= 5.0
null	>= 3.2

Modules

No modules.

Resources

Name	Type
aws_cloudwatch_event_rule.this	resource
aws_cloudwatch_event_target.this	resource
aws_cloudwatch_log_group.lambda	resource
aws_iam_role.this	resource
aws_lambda_function.this	resource
aws_lambda_layer_version.this	resource
aws_lambda_permission.this	resource
aws_ssm_parameter.gitlab_token	resource
aws_ssm_parameter.slack_token	resource
null_resource.this	resource
archive_file.code	data source
archive_file.layer	data source
aws_iam_policy_document.this	data source

Inputs

Name	Description	Type	Default	Required
cloudwatch_event_rule_description	Description of CloudWatch event rule to use for Lambda Function.	string	null	no
cloudwatch_event_rule_name	Name of CloudWatch event rule to use for Lambda Function.	string	null	no
cloudwatch_logs_kms_key_id	The ARN of the KMS Key to use when encrypting log data.	string	null	no
cloudwatch_logs_retention_in_days	Specifies the number of days you want to retain log events in the specified log group. Possible values are: 1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, and 3653.	number	365	no
cloudwatch_logs_tags	A map of tags to assign to the resource.	map(string)	{}	no
compatible_architectures	A list of Architectures Lambda layer is compatible with. Currently x86_64 and arm64 can be specified.	list(string)	null	no
enable_scheduling	Enable scheduling so that Lambda automatically triggers based on cron expression.	bool	true	no
exclude_groups	Define keywords to filter out GitLab Groups from the function. Example 'group1, group2'.	string	""	no
fallback_channel_id	ID of the fallback channel for notifications. Can use the format '#channel-name'.	string	n/a	yes
function_description	Description of the Lambda Function	string	null	no
function_name	A unique name for the Lambda Function	string	"gitlab-stale-merge-requests-slack-app"	no
gitlab_base_url	Base URL for the GitLab API including 'https://'.	string	"https://gitlab.com"	no
internal_email_domains	List of internal email domains for GitLab users. Used to message only internal users. Example 'domain1.com, domain2.com'.	string	null	no
lambda_schedule	When to trigger Lambda function. Set value in cron format.	string	null	no
layer_description	Description of Lambda layer to use for Lambda Function.	string	null	no
layer_name	Name of Lambda layer to use for Lambda Function.	string	null	no
publish	Whether to publish creation/change as new Lambda Function Version.	bool	false	no
reserved_concurrent_executions	The amount of reserved concurrent executions for the Lambda Function. A value of 0 disables Lambda Function from being triggered and -1 removes any concurrency limitations.	number	1	no
role_description	Description of IAM role to use for Lambda Function.	string	null	no
role_name	Name of IAM role to use for Lambda Function.	string	null	no
runtime	Lambda Function runtime	string	"python3.12"	no
ssm_parameter_gitlab_token_description	Description of SSM parameter for GitLab token.	string	null	no
ssm_parameter_gitlab_token_name	Name of SSM parameter for GitLab token.	string	null	no
ssm_parameter_slack_token_description	Description of SSM parameter for Slack token.	string	null	no
ssm_parameter_slack_token_name	Name of SSM parameter for Slack token.	string	null	no
stale_days_threshold	Threshold in days for considering a merge request as stale.	number	7	no
timeout	The amount of time the Lambda Function has to run in seconds.	number	120	no
tracing_mode	Tracing mode of the Lambda Function. Valid value can be either PassThrough or Active.	string	null	no

Outputs

Name	Description
cloudwatch_event_rule_name	The name of the CloudWatch Event Rule. Returns 'Scheduling not enabled' if scheduling is disabled.
cloudwatch_log_group_name	The name of the CloudWatch Log Group associated with the Lambda function.
code_zip_path	The path to the zipped code for the Lambda function.
iam_role_arn	The ARN of the IAM role used by the Lambda function.
lambda_function_arn	The ARN of the Lambda function.
lambda_function_name	The name of the Lambda function.
lambda_layer_version_arn	The ARN of the Lambda layer version.
layer_zip_path	The path to the zipped Lambda layer package.
ssm_parameter_gitlab_token_name	The name of the SSM parameter that stores the GitLab token.
ssm_parameter_slack_token_name	The name of the SSM parameter that stores the Slack token.

Authors

• Alan Jones

Contributing

All contributions are welcome.

Licence

GPL-3.0 licensed. See license in LICENSE.