fix(alerting): dead-man heartbeat never pushed — secret unavailable in runtime templates

HA runtime template contexts (shell_command {{ }} rendering) cannot read secrets.yaml; kuma_push_url rendered undefined every fire and the Kuma push dead-man never sent a beat. Move the full curl command into the secret (kuma_heartbeat_cmd) and reference it with !secret, which is substituted at config parse where secrets work. On-box fix applied + verified under GLPI CR 21; this commit makes the git copy match the deployed state. Ticket: https://projects.knownelement.com/issues/811 CR: https://cmdb.knownelement.com/front/change.form.php?id=21
Merge pull request 'release PR template: CR deep-link field (CR-gating ruling)' (#5 ) from ic-builder/cr-gate-template into dev
2026-09-06 11:38:23 -05:00 · 2026-09-06 15:26:56 +00:00 · 2026-09-06 10:26:03 -05:00
2 changed files with 6 additions and 1 deletions
@@ -3,8 +3,13 @@
 Merging this deploys to production (pfv-bms restarts if packages/** or
 configuration.yaml changed).
 ### Change management (ruling 2026-09-06 — mandatory)
 - GLPI CR deep link (required): https://cmdb.knownelement.com/front/change.form.php?id=N
  - Dev-only PRs: state `no-CR (dev-only)` explicitly.
 ### Gate checklist (branch protection enforces the mechanical parts)
 - [ ] CI green on the head commit (yamllint + secret scan + SDLC suite)
 - [ ] CR filed in GLPI and referenced above (production changes)
 - [ ] Adversarial pass done: what breaks if this is wrong? what watches for it?
 - [ ] post-deploy validation (#778) will run on restart — expected entity changes noted below
@@ -25,4 +25,4 @@ rest:
 # pushing — crash, wedge, power loss, network partition — Kuma pages
 # the founder's phone directly. No HA in the alert loop.
 shell_command:
-  kuma_ha_heartbeat: 'curl -sS -m 15 "{{ kuma_push_url }}"'
+  kuma_ha_heartbeat: !secret kuma_heartbeat_cmd  # CR21 2026-09-06: runtime template contexts cannot read secrets; the old {{ }} form rendered undefined and the dead-man never pushed