fix(signoz): bind alert rules export shape

scripts/ops/deploy-signoz-metadata-toolchain.sh

@@ -17,6 +17,8 @@ SCP_TIMEOUT_SECONDS="${SIGNOZ_METADATA_SCP_TIMEOUT_SECONDS:-120}"
 REMOTE_TIMEOUT_SECONDS="${SIGNOZ_METADATA_REMOTE_TIMEOUT_SECONDS:-60}"
 KILL_AFTER_SECONDS="${SIGNOZ_METADATA_KILL_AFTER_SECONDS:-10}"
 LOCAL_PYTHON_BIN="${SIGNOZ_METADATA_LOCAL_PYTHON_BIN:-python3.11}"
+SSH_IDENTITY_FILE="${SIGNOZ_METADATA_SSH_IDENTITY_FILE:-}"
+SSH_KNOWN_HOSTS_FILE="${SIGNOZ_METADATA_KNOWN_HOSTS_FILE:-}"
 
 LABELS=(
   metadata-export-policy.json
@@ -35,11 +37,27 @@ LOCAL_SOURCES=(
 MODES=(0644 0644 0755 0755 0755)
 SSH_OPTIONS=(
   -o BatchMode=yes
+  -o IdentitiesOnly=yes
+  -o StrictHostKeyChecking=yes
   -o ConnectTimeout=8
   -o ConnectionAttempts=1
   -o ServerAliveInterval=5
   -o ServerAliveCountMax=2
 )
+if [ -n "${SSH_IDENTITY_FILE}" ]; then
+  [ -f "${SSH_IDENTITY_FILE}" ] && [ ! -L "${SSH_IDENTITY_FILE}" ] || {
+    echo "invalid SSH identity file" >&2
+    exit 64
+  }
+  SSH_OPTIONS+=( -i "${SSH_IDENTITY_FILE}" )
+fi
+if [ -n "${SSH_KNOWN_HOSTS_FILE}" ]; then
+  [ -f "${SSH_KNOWN_HOSTS_FILE}" ] && [ ! -L "${SSH_KNOWN_HOSTS_FILE}" ] || {
+    echo "invalid SSH known_hosts file" >&2
+    exit 64
+  }
+  SSH_OPTIONS+=( -o "UserKnownHostsFile=${SSH_KNOWN_HOSTS_FILE}" )
+fi
 
 usage() {
   cat <<'USAGE'
@@ -50,6 +68,10 @@ Required environment:
   RUN_ID         Unique path-safe execution identifier
   WORK_ITEM_ID   Must be P0-OBS-002
 
+Optional fixed transport paths:
+  SIGNOZ_METADATA_SSH_IDENTITY_FILE
+  SIGNOZ_METADATA_KNOWN_HOSTS_FILE
+
 --check validates the five local sources and performs a no-write host110 diff.
 --apply creates one immutable exact-hash directory. It does not create or
 change an active pointer and does not run an authenticated metadata export.

scripts/ops/tests/test_agent99_signoz_metadata_executor_runtime_entrypoint.py

@@ -31,7 +31,7 @@ def test_entrypoint_is_fixed_to_windows99_host110_and_p0_obs_002() -> None:
     assert "$result.entrypointHashMatched" in source
     assert '$CredentialFile = "/etc/awoooi/secrets/signoz-metadata-api-key"' in source
     assert (
-        '$BundleId = "bb6d78b67f506072b2e45e92bc1d415364e25852282a9b068900665c578df011"'
+        '$BundleId = "337b5f86921d9b0af1a49e3bfe3e16c6a359f8fdfa1521c9dcbf230582ec286e"'
         in source
     )
     assert '$BaseUrl = "http://127.0.0.1:8080"' in source

scripts/ops/tests/test_signoz_metadata_toolchain_deploy.py

@@ -86,11 +86,18 @@ printf 'scp %s\n' "$*" >> "${TEST_EVENT_LOG:?}"
 
 
 def run_deployer(
-    tmp_path: Path, *, mode: str, apply: bool
+    tmp_path: Path,
+    *,
+    mode: str,
+    apply: bool,
+    env_overrides: dict[str, str] | None = None,
 ) -> subprocess.CompletedProcess[str]:
+    env = fake_environment(tmp_path, mode=mode)
+    if env_overrides:
+        env.update(env_overrides)
     return subprocess.run(
         ["bash", str(DEPLOYER), "--apply" if apply else "--check"],
-        env=fake_environment(tmp_path, mode=mode),
+        env=env,
         text=True,
         stdout=subprocess.PIPE,
         stderr=subprocess.PIPE,
@@ -165,6 +172,65 @@ def test_deployer_has_no_active_pointer_or_destructive_fallback() -> None:
     assert "ln -s" not in source
 
 
+def test_transport_propagates_strict_fixed_paths_with_spaces(tmp_path: Path) -> None:
+    transport_dir = tmp_path / "transport paths"
+    transport_dir.mkdir()
+    identity = transport_dir / "agent99 identity"
+    known_hosts = transport_dir / "known hosts"
+    identity.write_text("test-only-identity\n", encoding="utf-8")
+    known_hosts.write_text("test-only-known-host\n", encoding="utf-8")
+
+    result = run_deployer(
+        tmp_path,
+        mode="check_absent",
+        apply=False,
+        env_overrides={
+            "SIGNOZ_METADATA_SSH_IDENTITY_FILE": str(identity),
+            "SIGNOZ_METADATA_KNOWN_HOSTS_FILE": str(known_hosts),
+        },
+    )
+
+    assert result.returncode == 0, result.stderr
+    event = (tmp_path / "events.log").read_text(encoding="utf-8")
+    assert "IdentitiesOnly=yes" in event
+    assert "StrictHostKeyChecking=yes" in event
+    assert str(identity) in event
+    assert f"UserKnownHostsFile={known_hosts}" in event
+
+
+def test_transport_rejects_missing_fixed_path_before_remote_use(tmp_path: Path) -> None:
+    result = run_deployer(
+        tmp_path,
+        mode="check_absent",
+        apply=False,
+        env_overrides={
+            "SIGNOZ_METADATA_SSH_IDENTITY_FILE": str(tmp_path / "missing identity")
+        },
+    )
+
+    assert result.returncode == 64
+    assert "invalid SSH identity file" in result.stderr
+    assert not (tmp_path / "events.log").read_text(encoding="utf-8")
+
+
+def test_transport_rejects_symlink_fixed_path_before_remote_use(tmp_path: Path) -> None:
+    target = tmp_path / "known-hosts-target"
+    target.write_text("test-only-known-host\n", encoding="utf-8")
+    symlink = tmp_path / "known hosts link"
+    symlink.symlink_to(target)
+
+    result = run_deployer(
+        tmp_path,
+        mode="check_absent",
+        apply=False,
+        env_overrides={"SIGNOZ_METADATA_KNOWN_HOSTS_FILE": str(symlink)},
+    )
+
+    assert result.returncode == 64
+    assert "invalid SSH known_hosts file" in result.stderr
+    assert not (tmp_path / "events.log").read_text(encoding="utf-8")
+
+
 def test_shared_operation_lock_is_existing_read_only_and_fail_closed() -> None:
     source = DEPLOYER.read_text(encoding="utf-8")
     assert "OPERATION_LOCK=/tmp/awoooi-signoz-backup-operation.lock" in source