fix: allow guarded paused dry-run invocation

.github/workflows/invoke-cloud-run.yml

@@ -22,6 +22,11 @@ on:
         required: false
         default: false
         type: boolean
+      allow_paused_dry_run:
+        description: "Temporarily resume a paused /dry-run scheduler for one validation run, then pause it again"
+        required: false
+        default: false
+        type: boolean
 
 env:
   GCP_PROJECT_ID: longbridgequant
@@ -91,6 +96,10 @@ jobs:
             echo "Calling ${raw_path} can trigger the live execution entrypoint. Re-run with allow_live_execution=true if this is intentional." >&2
             exit 1
           fi
+          if [ "${{ inputs.allow_paused_dry_run }}" = "true" ] && [ "${raw_path}" != "/dry-run" ]; then
+            echo "allow_paused_dry_run is permitted only for the /dry-run validation endpoint." >&2
+            exit 1
+          fi
 
           service_json="$(
             gcloud run services describe "${CLOUD_RUN_SERVICE}" \
@@ -246,6 +255,28 @@ jobs:
           started_at="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
           scheduler_job="${{ steps.service.outputs.scheduler_job }}"
           scheduler_location="${{ steps.service.outputs.scheduler_location }}"
+          temporarily_resumed=false
+
+          restore_paused_scheduler() {
+            if [ "${temporarily_resumed}" = "true" ]; then
+              echo "Restoring ${scheduler_job} to PAUSED after one dry-run validation."
+              gcloud scheduler jobs pause "${scheduler_job}" \
+                --location="${scheduler_location}" \
+                --quiet || true
+            fi
+          }
+          trap restore_paused_scheduler EXIT
+
+          scheduler_state="$(gcloud scheduler jobs describe "${scheduler_job}" \
+            --location="${scheduler_location}" \
+            --format='value(state)')"
+          if [ "${scheduler_state}" = "PAUSED" ] && [ "${{ inputs.allow_paused_dry_run }}" = "true" ]; then
+            echo "Temporarily resuming paused ${scheduler_job} for one dry-run validation."
+            gcloud scheduler jobs resume "${scheduler_job}" \
+              --location="${scheduler_location}" \
+              --quiet
+            temporarily_resumed=true
+          fi
 
           echo "Triggering ${scheduler_job} at ${started_at}."
           gcloud scheduler jobs run "${scheduler_job}" \

tests/test_invoke_cloud_run_workflow.sh

@@ -9,7 +9,9 @@ grep -Fq "workflow_dispatch:" "$workflow_file"
 grep -Fq "environment: \${{ inputs.environment }}" "$workflow_file"
 grep -Fq 'default: "/dry-run"' "$workflow_file"
 grep -Fq "allow_live_execution:" "$workflow_file"
+grep -Fq "allow_paused_dry_run:" "$workflow_file"
 grep -Fq "Calling \${raw_path} can trigger the live execution entrypoint." "$workflow_file"
+grep -Fq "allow_paused_dry_run is permitted only for the /dry-run validation endpoint." "$workflow_file"
 grep -Fq "id-token: write" "$workflow_file"
 grep -Fq "google-github-actions/auth@v3" "$workflow_file"
 grep -Fq "google-github-actions/setup-gcloud@v3" "$workflow_file"
@@ -23,6 +25,9 @@ grep -Fq "Use one of the scheduler-backed paths: /run, /probe, /dry-run." "$work
 grep -Fq "scheduler_job=\"\${CLOUD_RUN_SERVICE}-precheck-scheduler\"" "$workflow_file"
 grep -Fq "Invoke internal service through Cloud Scheduler" "$workflow_file"
 grep -Fq "gcloud scheduler jobs run \"\${scheduler_job}\"" "$workflow_file"
+grep -Fq "Temporarily resuming paused \${scheduler_job} for one dry-run validation." "$workflow_file"
+grep -Fq "Restoring \${scheduler_job} to PAUSED after one dry-run validation." "$workflow_file"
+grep -Fq "trap restore_paused_scheduler EXIT" "$workflow_file"
 grep -Fq "token_format: id_token" "$workflow_file"
 grep -Fq "id_token_audience: \${{ steps.service.outputs.url }}" "$workflow_file"
 grep -Fq "id_token_include_email: true" "$workflow_file"