workflow:
  id: alert-auto-resolver
  name: Alert Auto-Resolver
  description: Automatically resolves stale alerts that haven't been updated in over an hour to maintain alert hygiene.
  triggers:
    - type: manual
    - type: interval
      value: 60
  steps:
    # get the alerts from keep
    - name: get-alerts
      provider:
        type: keep
        with:
          version: 2
          filter: "status == 'firing'"
  actions:
    - name: resolve-alerts
      foreach: " {{ steps.get-alerts.results }} "
      if: "keep.to_timestamp('{{ foreach.value.lastReceived }}') < keep.utcnowtimestamp() - 3600"
      provider:
        type: mock
        with:
          enrich_alert:
            - key: status
              value: resolved
              disposable: true
