Draft Better Stack incident postmortems in Google Docs

Trigger: an outgoing webhook from Better Stack that fires when an incident is marked as resolved. The webhook payload carries the incident id.

First check: only run if the incident lasted longer than five minutes. Compute duration from the incident's started_at and resolved_at timestamps. If it is five minutes or shorter, exit silently so quick flaps do not create postmortem docs.

Gather everything about the incident from Better Stack. Use Get Incident to fetch the resolved incident (summary, cause, started_at, resolved_at, acknowledged_by, affected monitor id, url). Use List Incident Timeline to pull every timeline event. Use List Incident Comments to pull every comment. Use Get Monitor on the affected monitor to grab its name, url, monitor type, and configuration. Use Get Monitor Response Times over the outage window (from started_at to resolved_at) so the postmortem can describe how latency behaved during the incident.

Create the postmortem in Google Docs. Call Create Document with a title of the form "Postmortem: <incident summary> — <resolution date>". Then call Batch Update Document to insert the body in this order: (1) Summary — two or three sentences of what happened. (2) Impact — total duration, which monitor was affected, and a customer-facing severity call. (3) Timeline — translate the raw Better Stack timeline events and comments into plain-English bullets in chronological order. (4) Hypothesized root cause — draw on the incident cause field, the timeline, comments, and the response-time trend during the window. (5) What went well. (6) What did not go well. (7) Proposed action items as a checkbox or bulleted list. Insert requests from the highest index to the lowest so offsets do not shift.

Announce the doc in Slack. Identify the on-call engineer who owned the incident from the acknowledged_by field on the incident (or from the timeline if that is where the owner appears). Use Slack Bot's Look Up User by Email to resolve that engineer's Slack user id. Then Send a Message to the incidents Slack channel with the Google Doc link and a Slack mention of that engineer so they know the draft is theirs to finish. If the engineer's email cannot be found in Slack, still post the message with the doc link — just drop the personal tag rather than fail the run.

Guardrails: always create a brand-new Google Doc per incident so no prior postmortem is overwritten. Never mark the doc as finalized — this is a first draft only. Do not post to Slack if creating the Google Doc failed.