feat(health): add NVUE REST reboot and leakage collection

[jayzhudev]

Added NVUE REST collection for:

• /nvue_v1/system/reboot/reason
• /nvue_v1/platform/environment/leakage

Behavior:

• Emits reboot_reason_info metadata with reason, gentime, and user.
• Emits leakage StateSet metrics for each leakage sensor.
• Sends switch health reports for leakage data:
  • ok sensors become successes.
  • leak sensors become leak alerts.
  • unknown, missing, or per-sensor null states become sensor-failure alerts.
  • top-level leakage null becomes a sensor-failure alert because of unavailable data.
• Adds per-path config flags for reboot reason and leakage collection.

Related issues

Closes #3123

Type of Change

• Add - New feature or capability
• Change - Changes in existing functionality
• Fix - Bug fixes
• Remove - Removed features or deprecated functionality
• Internal - Internal changes (refactoring, tests, docs, etc.)

Breaking Changes

• This PR contains breaking changes

Testing

• Unit tests added/updated
• Integration tests added/updated
• Manual testing performed
• No testing required (docs, internal refactor, etc.)

[coderabbitai]

Walkthrough

This PR adds NVUE REST collection for system reboot reason and platform environment leakage. It introduces nullable response handling, new REST client methods and payload types, collector emission and report logic, config toggles, sink event variants, and updated validation coverage.

Changes

NVUE reboot reason and leakage collection

Layer / File(s)	Summary
Config toggles for new NVUE endpoints crates/health/src/config.rs, crates/health/example/config.example.toml	Adds system_reboot_reason_enabled and platform_environment_leakage_enabled fields to NvueRestPaths, updates defaults, docs, example config, and unit tests.
Sink event variants for NVUE leakage crates/health/src/sink/events.rs	Adds NvueLeakage variants to ReportSource and Probe with string mappings and test coverage.
REST client endpoints and response types crates/health/src/collectors/nvue/rest/client.rs	Adds OptionalNvueResponse<T>, new path constants, new endpoint methods, nullable GET handling, response structs, a test constructor, and parsing tests.
Collector reporting for reboot reason and leakage crates/health/src/collectors/nvue/rest/collector.rs	Extends run_iteration, adds leakage state mapping and report helpers, and expands unit and HTTP-driven tests for reboot reason and leakage responses.

Estimated code review effort: 4 (Complex) | ~60 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Collector
  participant RestClient
  participant NvueDevice
  participant Sink

  Collector->>RestClient: get_platform_environment_leakage()
  RestClient->>RestClient: check platform_environment_leakage_enabled
  alt disabled
    RestClient-->>Collector: Disabled
  else enabled
    RestClient->>NvueDevice: GET /nvue_v1/platform/environment/leakage
    NvueDevice-->>RestClient: JSON payload or null
    RestClient-->>Collector: Present(sensors) or Null
  end
  alt Present(sensors)
    Collector->>Collector: build_leakage_report(sensors)
    Collector->>Sink: emit StateSet metrics + switch health report
  else Null
    Collector->>Sink: emit leakage-unavailable alert report
  end

Loading

Related Issues: #3123

Suggested labels: enhancement, health

Suggested reviewers: none identified

As a rabbit probes the wires with care,
Reboot reasons and leakage laid bare,
Null or Present or gated away,
Each sensor state has its say,
Switch reports blossom—health everywhere. 🐇✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The PR implements the requested NVUE REST support for the reboot reason and leakage endpoints.
Out of Scope Changes check	✅ Passed	The additional config, event, and test updates all support the NVUE collection feature and appear in scope.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Title check	✅ Passed	The title accurately summarizes the main change: adding NVUE REST reboot reason and leakage collection.
Description check	✅ Passed	The description matches the changeset and clearly describes the new NVUE endpoints, metrics, config flags, and report behavior.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@crates/health/src/collectors/nvue/rest/collector.rs`:
- Around line 548-573: The emit_reboot_reason_data method is attaching unbounded
free-text fields as labels on reboot_reason_info, which can explode cardinality
and leak operator data. Update emit_reboot_reason_data in the nvue REST
collector to keep only bounded labels (or none) and move reason, user, and
gentime to structured logging or another non-metric event path. Ensure the
Prometheus labels emitted by emit_metric stay stable and low-cardinality.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 7aa4abb2-7191-442e-b939-2f86d508b653

📥 Commits

Reviewing files that changed from the base of the PR and between 7308bce and cde9434.

📒 Files selected for processing (5)

• crates/health/example/config.example.toml
• crates/health/src/collectors/nvue/rest/client.rs
• crates/health/src/collectors/nvue/rest/collector.rs
• crates/health/src/config.rs
• crates/health/src/sink/events.rs

[github-actions]

🔍 Container Scan Summary

Service	Total	Critical	High	Medium	Low	Other
boot-artifacts-aarch64	3	0	0	3	0	0
boot-artifacts-x86_64	3	0	0	3	0	0
forge-admin-cli-x86_64	270	5	25	89	7	144
machine-validation-runner	771	25	207	278	40	221
machine_validation	771	25	207	278	40	221
machine_validation-aarch64	771	25	207	278	40	221
nvmetal-carbide	771	25	207	278	40	221
TOTAL	3360	105	853	1207	167	1028

Per-CVE detail lives in the per-service grype-* artifacts (JSON + SARIF). Severity counts only — no CVE IDs published here.