Description

When using the Keep provider to create alerts in a foreach loop, all generated alerts may end up sharing the same (often last) data, especially if the alert template contains nested structures (such as dictionaries or lists).

Root Cause

In keep/providers/keep_provider/keep_provider.py, the following line is used to copy the alert template for each iteration:

alert_data = copy.copy(alert or {})

However, copy.copy() only performs a shallow copy. This means that any nested objects (e.g., dictionaries, lists) inside the alert template are still shared between all iterations. As a result, modifications in one iteration can affect others, leading to all alerts having the same (last) data or other unexpected behavior.

How to Reproduce

1. Create a workflow with a foreach loop that generates multiple alerts using the Keep provider.
2. Use an alert template with nested fields (e.g., labels, annotations).
3. Observe that all generated alerts have the same data, typically matching the last item in the loop.

Expected Behavior

Each alert generated in the loop should have its own independent data, corresponding to the current item in the iteration.

Actual Behavior

All alerts share the same nested data, leading to incorrect or duplicated alert content.

Proposed Fix

Replace the shallow copy with a deep copy:

import copy
alert_data = copy.deepcopy(alert or {})

This ensures that each alert in the loop gets a fully independent copy of the template, including all nested structures.

Relevant Code

File: keep/providers/keep_provider/keep_provider.py https://github.com/keephq/keep/blob/main/keep/providers/keep_provider/keep_provider.py#L550

# Current (buggy) line:
alert_data = copy.copy(alert or {})

# Should be:
alert_data = copy.deepcopy(alert or {})