Skip to content

[AlertZero] Expose action input schemas in the action catalog - #291094

Open
patrykkopycinski wants to merge 3 commits into
elastic:mainfrom
patrykkopycinski:fix/alertzero-action-catalog-input-schema
Open

[AlertZero] Expose action input schemas in the action catalog#291094
patrykkopycinski wants to merge 3 commits into
elastic:mainfrom
patrykkopycinski:fix/alertzero-action-catalog-input-schema

Conversation

@patrykkopycinski

@patrykkopycinski patrykkopycinski commented Sep 15, 2026

Copy link
Copy Markdown
Contributor

Summary

Follow-up to #290705 ([AlertZero] Action catalog), addressing Sergi's feedback: the agent needs to know the inputs schema of each action, so catalog entries now also carry inputSchema.

  • ActionCatalogEntry gains an optional inputSchema: JsonSchema field (type re-exported from @kbn/workflows).
  • ActionsService.toEntry reads the JSON Schema the workflow declares on its manual trigger (triggers[type=manual].inputs) — the jsonSchema defined in the manual trigger of the workflow action — and projects it verbatim onto the catalog entry.
    • Definitions are already validated and normalized by the workflow schema (legacy array-format inputs are normalized at parse time); the service still guards structurally, so a non-schema-shaped inputs value (e.g. a raw legacy array reaching the service un-normalized) yields no inputSchema rather than a malformed entry.
    • Entries without a manual-trigger inputs schema are still returned, with inputSchema absent.
  • The security.alertzero.actions.list Agent Builder tool description now documents inputSchema so the agent fills the action's inputs when proposing it.

The API (GET /internal/alertzero/actions) returns the new field automatically — its response type is ListActionsResponse, whose entries are ActionCatalogEntry.

Test plan

  • node scripts/jest x-pack/solutions/security/plugins/alertzero/server/services/actions/actions_service.test.ts — new tests: inputSchema projected verbatim from the manual trigger inputs; inputSchema omitted for definitions with no triggers / manual trigger without inputs / non-manual triggers carrying inputs; inputSchema omitted for legacy array-format inputs.
  • node scripts/jest x-pack/solutions/security/plugins/alertzero/server/agent_builder_tools/list_actions_tool.test.ts — asserts inputSchema flows through to the tool result.
  • node scripts/type_check --project x-pack/solutions/security/plugins/alertzero/tsconfig.json --cleanup
  • node scripts/type_check --project x-pack/solutions/security/packages/kbn-alertzero-common/tsconfig.json --cleanup

@patrykkopycinski
[AlertZero] Expose action input schemas in the action catalog
3b2ad77 
Follow-up to elastic#290705: catalog entries now also carry inputSchema, the
JSON Schema the workflow declares on its manual trigger
(triggers[type=manual].inputs), so an agent knows the inputs each
action accepts without reading the workflow YAML.

Requested in Slack by Sergi (feedback on the merged catalog PR).
@patrykkopycinski
patrykkopycinski requested a review from a team as a code owner September 15, 2026 11:36
@infra-vault-gh-plugin-prod

infra-vault-gh-plugin-prod Bot commented Sep 15, 2026

Copy link
Copy Markdown
🤖 Jobs for this PR can be triggered through checkboxes. 🚧

ℹ️ To trigger the CI, please tick the checkbox below 👇

  • Click to trigger kibana-pull-request for this PR!
  • Click to trigger kibana-deploy-project-from-pr for this PR!
  • Click to trigger kibana-deploy-cloud-from-pr for this PR!
  • Click to trigger kibana-entity-store-performance-from-pr for this PR!
  • Click to trigger kibana-storybooks-from-pr for this PR!

@kibanamachine kibanamachine added the reviewer:libra PR review with Libra. This disables Claude and Scout reviewers label Sep 15, 2026
@kibanamachine

kibanamachine commented Sep 15, 2026

Copy link
Copy Markdown
Contributor

Selected for Libra review

This PR was selected for Libra review as part of the temporary 50% trial.

To opt out permanently, remove the reviewer:libra label. It will not be added again to this PR.

@patrykkopycinski patrykkopycinski added release_note:skip Skip the PR/issue when compiling release notes backport:skip This PR does not require backporting Team:One Workflow Team label for One Workflow (Workflow automation) v9.6.0 buildkite-ci labels Sep 15, 2026
kibanamachine
kibanamachine reviewed Sep 15, 2026
View reviewed changes

@kibanamachine kibanamachine left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Libra found 1 issue.

Generated by Libra

Comment thread x-pack/solutions/security/plugins/alertzero/server/services/actions/actions_service.ts
@patrykkopycinski
fix(alertzero): parse manual trigger with workflow schema before publ…
b09f36c 
…ishing inputSchema

Address review feedback on elastic#291094: key-presence ('properties' in inputs)
does not ensure inputs is a JSON Schema — { properties: [] } or
{ properties: null } would still be published. Parse the trigger with the
workflow's own ManualTriggerSchema and return the original value only when
it parses and is not the legacy array format; otherwise omit inputSchema.
@patrykkopycinski

patrykkopycinski commented Sep 15, 2026

Copy link
Copy Markdown
Contributor Author

Addressed in b09f36c: readInputSchema now parses the trigger with the workflow's own ManualTriggerSchema and publishes inputSchema only when the parse succeeds and inputs is not the legacy array format; the parsed (stripped) copy is never published — the original value is returned verbatim. Added the flagged cases ({ properties: [] }, { properties: null }) to the omission test, and a verbatim test with an x- annotation key that zod would strip, proving the original object is what gets published. Mutation-tested: reverting the service turns the new tests red.

kibanamachine
kibanamachine reviewed Sep 15, 2026
View reviewed changes

@kibanamachine kibanamachine left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Libra found 1 issue.

Generated by Libra

Comment thread x-pack/solutions/security/packages/kbn-alertzero-common/action_catalog_types.ts
@patrykkopycinski
fix(alertzero): re-export JsonSchema from @kbn/alertzero-common
e4bd1a6 
Address second review comment on elastic#291094: the contract type was imported
only for the interface. Re-export it from action_catalog_types.ts and the
package root so consumers can import it alongside ActionCatalogEntry.
@patrykkopycinski

patrykkopycinski commented Sep 15, 2026

Copy link
Copy Markdown
Contributor Author

Addressed in e4bd1a6: JsonSchema is now re-exported from action_catalog_types.ts and added to the package root's type allow-list in kbn-alertzero-common/index.ts, so consumers can import it alongside ActionCatalogEntry from @kbn/alertzero-common.

@patrykkopycinski

patrykkopycinski commented Sep 15, 2026

Copy link
Copy Markdown
Contributor Author

The red kibana-ci run (build 501962) failed on a single job: FTR Configs #54 — Serverless Security Functional Tests, Common Group 6, test discover field visualize button › 'before all' hook (x_pack/platform/test/serverless/functional/test_suites/discover/x_pack_visualize_field/visualize_field.ts) — a TimeoutError: Request timed out on an ES bulk call in test setup. The CI failed-test reporter itself flags it: 'Test has failed 25 times on tracked branches' → tracked in #290942 (labeled failure:test-environment, Team:Discover). This diff touches only the AlertZero action catalog (server service + types), no Discover or serverless FTR paths. Rebuild triggered: build 502042.

@kibanamachine

kibanamachine commented Sep 15, 2026

Copy link
Copy Markdown
Contributor

💛 Build succeeded, but was flaky

Failed CI Steps

Metrics [docs]

✅ unchanged

Test Failures

  • [job] [logs] FTR Configs #35 / lens app - group 1 lens chart style settings should allow creation of a multi-axis chart and switching multiple times
  • [job] [logs] FTR Configs #35 / lens app - group 1 lens chart style settings should override axis title

History

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kibanamachine kibanamachine kibanamachine left review comments
@semd semd Awaiting requested review from semd

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

backport:skip This PR does not require backporting buildkite-ci release_note:skip Skip the PR/issue when compiling release notes reviewer:libra PR review with Libra. This disables Claude and Scout reviewers Team:One Workflow Team label for One Workflow (Workflow automation) v9.6.0

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@patrykkopycinski @kibanamachine