feat: expose signed platform health status

internal/app/app.go

@@ -124,6 +124,12 @@ func Run(ctx context.Context, serviceName string) error {
 	var alertService *alerts.Service
 	var diagnosticService *diagnostics.Service
 	var opsAccessService *opsaccess.Service
+	if serviceName == "api" || serviceName == "callbacks" {
+		diagnosticService, err = diagnostics.NewService(databasePool, idempotency.NewExecutor(databasePool), audit.NewRepository())
+		if err != nil {
+			return fmt.Errorf("create diagnostic service: %w", err)
+		}
+	}
 	if serviceName == "api" {
 		webEventService = webevents.NewService(databasePool)
 		cursorCodec, cursorErr := pagination.NewCodec([]byte(cfg.CursorSigningSecret))
@@ -143,10 +149,6 @@ func Run(ctx context.Context, serviceName string) error {
 		if err != nil {
 			return fmt.Errorf("create alert operations service: %w", err)
 		}
-		diagnosticService, err = diagnostics.NewService(databasePool, idempotency.NewExecutor(databasePool), audit.NewRepository())
-		if err != nil {
-			return fmt.Errorf("create diagnostic service: %w", err)
-		}
 		opsAccessService, err = opsaccess.NewService(databasePool, idempotency.NewExecutor(databasePool), audit.NewRepository(), exportStore, 5*time.Minute)
 		if err != nil {
 			return fmt.Errorf("create temporary sensitive access service: %w", err)
@@ -435,6 +437,9 @@ func Run(ctx context.Context, serviceName string) error {
 		ProviderCallbackSecret:          []byte(cfg.ProviderCallbackSecret),
 		ProviderCallbackSkew:            cfg.ProviderCallbackSkew,
 		ProviderCallbackProcessor:       providerEventProcessor,
+		PlatformHealthCallbackSecret:    []byte(cfg.PlatformHealthSecret),
+		PlatformHealthCallbackSkew:      cfg.PlatformHealthSkew,
+		PlatformHealthProcessor:         diagnosticService,
 	})
 	server := &http.Server{
 		Addr:              cfg.HTTPAddr,