Get a Linear issue before an SSL certificate expires

import socket, ssl
from datetime import datetime, timezone
from google.oauth2.credentials import Credentials
from googleapiclient.discovery import build
from clickruntime import on_trigger, credentials, http, state, notify

SHEET_ID = "your-spreadsheet-id"
TEAM_ID = "your-linear-team-id"
MUTATION = "mutation($i: IssueCreateInput!) { issueCreate(input: $i) { issue { url } } }"

def expiry(domain):
    with socket.create_connection((domain, 443), timeout=10) as s:
        with ssl.create_default_context().wrap_socket(s, server_hostname=domain) as t:
            return datetime.fromtimestamp(ssl.cert_time_to_seconds(t.getpeercert()["notAfter"]), timezone.utc)

@on_trigger
def run(event):
    sheets = build("sheets", "v4", credentials=Credentials(credentials.connection("google", "work")), cache_discovery=False)
    rows = sheets.spreadsheets().values().get(spreadsheetId=SHEET_ID, range="Domains!A2:A").execute().get("values", [])
    domains = [r[0].strip() for r in rows if r]
    reported, created = state.get("reported") or {}, []
    for d in domains:
        try:
            exp = expiry(d)
        except Exception:
            continue
        days, key = (exp - datetime.now(timezone.utc)).days, f"{d}|{exp.date()}"
        if days <= 30 and key not in reported:
            http.post("https://api.linear.app/graphql", headers={"Authorization": credentials.secret("LINEAR_API_KEY")},
                      json={"query": MUTATION, "variables": {"i": {"teamId": TEAM_ID, "title": f"Renew SSL for {d} (expires {exp.date()})"}}})
            reported[key] = True
            created.append(f"{d} in {days} days")
    state.set("reported", reported)
    if created:
        notify.slack("SSL renewals due: " + ", ".join(created), channel="#ops")
    return {"checked": len(domains), "new_issues": len(created)}