Add heartbeat to FIPS collector build for lightweight synthetics

[mcapell]

What does this PR do?

Register the heartbeat sub-command in the requirefips build of the
elastic-otel-collector binary so that FIPS-capable Elastic Agent images
can run lightweight synthetics monitors.

This adds heartbeat to AddCommands() in the FIPS variant, mirroring the
non-FIPS cmd.go. heartbeat is already FIPS-compilable upstream after
elastic/beats#51326 removed SHA1 from requirefips builds.

Why is it important?

Registers heartbeat to elastic-agent FIPS image.

Checklist

• I have read and understood the pull request guidelines of this project.
• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in ./changelog/fragments using the changelog tool
• I have added an integration test or an E2E test

Disruptive User Impact

How to test this PR locally

After building the image, we can now see the heartbeat binary:

$ docker run --rm --entrypoint sh docker.elastic.co/elastic-agent/elastic-agent-fips:9.6.0-SNAPSHOT -c "/usr/share/elastic-agent/data/elastic-agent-*/components/elastic-otel-collector heartbeat version"
heartbeat version 9.6.0 (arm64), libbeat 9.6.0 [704a13dc743fe599e707ae39308d0b5b5be8d497 built 2026-07-21 11:50:27 +0000 UTC] (FIPS-distribution: true)

Related issues

Questions to ask yourself

• How are we going to support this in production?
• How are we going to measure its adoption?
• How are we going to debug this?
• What are the metrics I should take care of?
• ...

[mergify]

This pull request does not have a backport label. Could you fix it @mcapell? 🙏
To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• backport-./d./d is the label that automatically backports to the 8./d branch. /d is the digit
• backport-active-all is the label that automatically backports to all active branches.
• backport-active-8 is the label that automatically backports to all active minor branches for the 8 major.
• backport-active-9 is the label that automatically backports to all active minor branches for the 9 major.

[swiatekm]

If we're doing this for agentbeat, we should also do it for the heartbeat otel receiver. Moving it from https://github.com/elastic/elastic-agent/blob/main/internal/edot/otelcol/components/components_nofips.go to https://github.com/elastic/elastic-agent/blob/main/internal/edot/otelcol/components/default.go will do it.

[github-actions]

TL;DR

check-ci is failing because the PR adds the heartbeat FIPS command import, which changes the FIPS dependency graph, but the generated NOTICE-fips.txt is not included in the PR. This is a deterministic generated-file drift failure, not a flaky test or infrastructure issue.

Remediation

• Run mage notice (or make notice) after applying the heartbeat FIPS change and commit the resulting NOTICE-fips.txt update. The log shows the new github.com/teambition/rrule-go v1.8.2 license block is required in the FIPS notice.
• Re-run make check-ci; its final check-no-changes step should pass once the generated notice is committed.

Investigation details

Root Cause

The PR adds github.com/elastic/beats/v7/x-pack/heartbeat/cmd to internal/edot/beats/cmd_fips.go (the import and prepareCommand(heartbeat.RootCmd) registration). check-ci regenerates both notices via make check-ci → make notice; including heartbeat under the requirefips build tag brings github.com/teambition/rrule-go into the FIPS dependency set. The generated file is absent from the PR, so check-no-changes detects the regeneration.

Evidence

• Build: https://buildkite.com/elastic/elastic-agent/builds/43797
• Job/step: check-ci
• Key log excerpt: Dependency : github.com/teambition/rrule-go followed by NOTICE-fips.txt: needs update, then Makefile:78: check-no-changes and exit status 2.
• Repository evidence: Makefile lines 41-51 regenerate notices before check-no-changes; dev-tools/mage/target/common/notice.go lines 33-40 generates NOTICE-fips.txt with the requirefips tag.

Verification

No PR changes were made and no local PR build was run; diagnosis is based on the failed Buildkite log and PR diff. No matching flaky-test issue was found.

---

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[infra-vault-gh-plugin-prod]

Pinging @elastic/elastic-agent-control-plane (Team:Elastic-Agent-Control-Plane)

[kruskall]

Assuming we want to apply the same level of review/requirements we used for other beats, heartbeat is not ready for fips mode

(feel free to dismiss the review if not relevant)

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: b5e5806

History

• 💔 Build #43797 failed fb8f541

cc @mcapell

[pierrehilbert]

@kruskall I took care of it here: elastic/beats#52273