fix(ops): fail closed before manual VM reset (#97)

Co-authored-by: Codex <noreply@openai.com>

Author: Pigbibi

.github/workflows/main.yml

@@ -28,6 +28,11 @@ on:
         options:
           - keepalive
           - full
+      allow_vm_reset:
+        description: permit automatic VM reset after SSH/SCP/deploy failure
+        required: false
+        default: false
+        type: boolean
       sync_github_secrets_to_secret_manager:
         description: write current GitHub secrets into Secret Manager before deploy
         required: false
@@ -223,6 +228,7 @@ jobs:
       VNC_SERVER_PASSWORD_SECRET_NAME: ${{ matrix.target.vnc_server_password_secret_name }}
       WORKFLOW_DISPATCH_MODE: ${{ github.event.inputs.deploy_mode }}
       WORKFLOW_DISPATCH_TARGET: ${{ github.event.inputs.target }}
+      WORKFLOW_DISPATCH_ALLOW_VM_RESET: ${{ github.event.inputs.allow_vm_reset }}
     steps:
       - name: Checkout code
         uses: actions/checkout@v6
@@ -511,6 +517,12 @@ jobs:
           )
 
           reset_instance_and_wait_for_ssh() {
+            if [ "${DEPLOY_EVENT_NAME}" = "workflow_dispatch" ] \
+              && [ "${WORKFLOW_DISPATCH_ALLOW_VM_RESET:-false}" != "true" ]; then
+              echo "Manual workflow VM reset is disabled; failing closed." >&2
+              return 1
+            fi
+
             log_step "Resetting ${GCE_INSTANCE_NAME} after SSH/SCP failure"
             gcloud compute instances reset "${GCE_INSTANCE_NAME}" \
               --project "${GCP_PROJECT_ID}" \

tests/test_workflow_shared_config.sh

@@ -21,6 +21,7 @@ grep -Fq 'workload_identity_provider: ${{ env.GCP_WORKLOAD_IDENTITY_PROVIDER }}'
 grep -Fq 'service_account: ${{ env.GCP_WORKLOAD_IDENTITY_SERVICE_ACCOUNT }}' "$workflow_file"
 grep -Fq "DEPLOY_EVENT_NAME: \${{ github.event_name }}" "$workflow_file"
 grep -Fq "WORKFLOW_DISPATCH_MODE: \${{ github.event.inputs.deploy_mode }}" "$workflow_file"
+grep -Fq "WORKFLOW_DISPATCH_ALLOW_VM_RESET: \${{ github.event.inputs.allow_vm_reset }}" "$workflow_file"
 grep -Fq 'vars.IB_GATEWAY_INSTANCE_NAME' "$workflow_file"
 grep -Fq 'vars.IB_GATEWAY_ZONE' "$workflow_file"
 grep -Fq 'vars.IB_GATEWAY_MODE' "$workflow_file"
@@ -64,6 +65,7 @@ grep -Fq 'elif [ "${DEPLOY_EVENT_NAME}" = "workflow_dispatch" ]; then' "$workflo
 grep -Fq 'DEPLOY_MODE="${WORKFLOW_DISPATCH_MODE:-keepalive}"' "$workflow_file"
 grep -Fq 'Scheduled keepalive mode: skip docker build' "$workflow_file"
 grep -Fq 'reset_instance_and_wait_for_ssh()' "$workflow_file"
+grep -Fq 'Manual workflow VM reset is disabled; failing closed.' "$workflow_file"
 grep -Fq 'run_remote_ssh()' "$workflow_file"
 grep -Fq 'copy_remote_file()' "$workflow_file"
 grep -Fq 'git archive --format=tar.gz' "$workflow_file"