fix(ops): support clean targeted Gateway rebuilds (#98)

* chore(ops): inspect remote gateway source file

Co-Authored-By: Codex <noreply@openai.com>

* fix(ops): allow clean targeted gateway rebuild

Co-Authored-By: Codex <noreply@openai.com>

* fix(ops): expand clean rebuild flag explicitly

Co-Authored-By: Codex <noreply@openai.com>

---------

Co-authored-by: Codex <noreply@openai.com>

Author: Pigbibi

.github/workflows/diagnose.yml

@@ -231,6 +231,25 @@ jobs:
 
           section "runtime executable metadata"
           printf 'host_arch=%s\n' "$(uname -m)"
+          if [ -f container_overrides/run.sh ]; then
+            stat -c 'source_run_mode=%a source_run_size=%s' container_overrides/run.sh 2>/dev/null \
+              || echo "source_run_stat_unavailable"
+            if command -v od >/dev/null 2>&1; then
+              printf 'source_run_first_bytes='
+              od -An -tx1 -N16 container_overrides/run.sh 2>/dev/null | tr -d ' \n' || true
+              printf '\n'
+            else
+              echo "source_run_first_bytes_unavailable"
+            fi
+            if command -v sha256sum >/dev/null 2>&1; then
+              sha256sum container_overrides/run.sh 2>/dev/null \
+                | awk '{print "source_run_sha256=" $1}' || true
+            else
+              echo "source_run_sha256_unavailable"
+            fi
+          else
+            echo "source_run_file_unavailable"
+          fi
           if sudo docker inspect "$CONTAINER_NAME" >/dev/null 2>&1; then
             sudo docker inspect --format \
               'container_state={{.State.Status}} exit_code={{.State.ExitCode}} oom_killed={{.State.OOMKilled}} restart_count={{.RestartCount}}' \

.github/workflows/main.yml

@@ -33,6 +33,11 @@ on:
         required: false
         default: false
         type: boolean
+      rebuild_without_cache:
+        description: force a clean image rebuild during full manual deploy
+        required: false
+        default: false
+        type: boolean
       sync_github_secrets_to_secret_manager:
         description: write current GitHub secrets into Secret Manager before deploy
         required: false
@@ -229,6 +234,7 @@ jobs:
       WORKFLOW_DISPATCH_MODE: ${{ github.event.inputs.deploy_mode }}
       WORKFLOW_DISPATCH_TARGET: ${{ github.event.inputs.target }}
       WORKFLOW_DISPATCH_ALLOW_VM_RESET: ${{ github.event.inputs.allow_vm_reset }}
+      WORKFLOW_DISPATCH_REBUILD_WITHOUT_CACHE: ${{ github.event.inputs.rebuild_without_cache }}
     steps:
       - name: Checkout code
         uses: actions/checkout@v6
@@ -683,7 +689,12 @@ jobs:
           sudo systemctl stop "\${IBKR_GATEWAY_HEALTHCHECK_TIMER}" "\${IBKR_GATEWAY_HEALTHCHECK_SERVICE}" 2>/dev/null || true
           sudo systemctl stop "\${IBKR_GATEWAY_DAILY_RESTART_TIMER}" "\${IBKR_GATEWAY_DAILY_RESTART_SERVICE}" 2>/dev/null || true
           sudo bash ./scripts/ensure_host_swap.sh
-          sudo docker compose build "\${compose_service_name}"
+          if [ "${WORKFLOW_DISPATCH_REBUILD_WITHOUT_CACHE:-false}" = 'true' ]; then
+            echo "[\$(date -u +%FT%TZ)] Building without cache"
+            sudo docker compose build --no-cache "\${compose_service_name}"
+          else
+            sudo docker compose build "\${compose_service_name}"
+          fi
           sudo docker compose down
           sudo docker compose up -d "\${compose_service_name}"
 

tests/test_workflow_shared_config.sh

@@ -22,6 +22,7 @@ grep -Fq 'service_account: ${{ env.GCP_WORKLOAD_IDENTITY_SERVICE_ACCOUNT }}' "$w
 grep -Fq "DEPLOY_EVENT_NAME: \${{ github.event_name }}" "$workflow_file"
 grep -Fq "WORKFLOW_DISPATCH_MODE: \${{ github.event.inputs.deploy_mode }}" "$workflow_file"
 grep -Fq "WORKFLOW_DISPATCH_ALLOW_VM_RESET: \${{ github.event.inputs.allow_vm_reset }}" "$workflow_file"
+grep -Fq "WORKFLOW_DISPATCH_REBUILD_WITHOUT_CACHE: \${{ github.event.inputs.rebuild_without_cache }}" "$workflow_file"
 grep -Fq 'vars.IB_GATEWAY_INSTANCE_NAME' "$workflow_file"
 grep -Fq 'vars.IB_GATEWAY_ZONE' "$workflow_file"
 grep -Fq 'vars.IB_GATEWAY_MODE' "$workflow_file"
@@ -66,6 +67,8 @@ grep -Fq 'DEPLOY_MODE="${WORKFLOW_DISPATCH_MODE:-keepalive}"' "$workflow_file"
 grep -Fq 'Scheduled keepalive mode: skip docker build' "$workflow_file"
 grep -Fq 'reset_instance_and_wait_for_ssh()' "$workflow_file"
 grep -Fq 'Manual workflow VM reset is disabled; failing closed.' "$workflow_file"
+grep -Fq 'sudo docker compose build --no-cache "\${compose_service_name}"' "$workflow_file"
+grep -Fq 'if [ "${WORKFLOW_DISPATCH_REBUILD_WITHOUT_CACHE:-false}" = '\''true'\'' ]; then' "$workflow_file"
 grep -Fq 'run_remote_ssh()' "$workflow_file"
 grep -Fq 'copy_remote_file()' "$workflow_file"
 grep -Fq 'git archive --format=tar.gz' "$workflow_file"
@@ -167,6 +170,8 @@ grep -Fq '| redact_diagnostics' "$diagnose_workflow_file"
 grep -Fq 'section "runtime executable metadata"' "$diagnose_workflow_file"
 grep -Fq 'image_os={{.Os}} image_arch={{.Architecture}}' "$diagnose_workflow_file"
 grep -Fq 'run_first_bytes=' "$diagnose_workflow_file"
+grep -Fq 'source_run_size=%s' "$diagnose_workflow_file"
+grep -Fq 'source_run_sha256=' "$diagnose_workflow_file"
 grep -Fq 'CONTAINER_NAME=__CONTAINER_NAME__' "$diagnose_workflow_file"
 grep -Fq 'sudo docker inspect "$CONTAINER_NAME"' "$diagnose_workflow_file"
 grep -Fq 'sudo docker cp "$CONTAINER_NAME":/home/ibgateway/scripts/run.sh' "$diagnose_workflow_file"