From 50b1f2fb9d010899410009e804ef7e082cbc2509 Mon Sep 17 00:00:00 2001
From: Pigbibi <20649888+Pigbibi@users.noreply.github.com>
Date: Mon, 13 Jul 2026 06:02:38 +0800
Subject: [PATCH] fix(ops): fail closed before manual VM reset

Co-Authored-By: Codex <noreply@openai.com>
---
 .github/workflows/main.yml           | 12 ++++++++++++
 tests/test_workflow_shared_config.sh |  2 ++
 2 files changed, 14 insertions(+)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index a9798d6..939a2ad 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -28,6 +28,11 @@ on:
         options:
           - keepalive
           - full
+      allow_vm_reset:
+        description: permit automatic VM reset after SSH/SCP/deploy failure
+        required: false
+        default: false
+        type: boolean
       sync_github_secrets_to_secret_manager:
         description: write current GitHub secrets into Secret Manager before deploy
         required: false
@@ -223,6 +228,7 @@ jobs:
       VNC_SERVER_PASSWORD_SECRET_NAME: ${{ matrix.target.vnc_server_password_secret_name }}
       WORKFLOW_DISPATCH_MODE: ${{ github.event.inputs.deploy_mode }}
       WORKFLOW_DISPATCH_TARGET: ${{ github.event.inputs.target }}
+      WORKFLOW_DISPATCH_ALLOW_VM_RESET: ${{ github.event.inputs.allow_vm_reset }}
     steps:
       - name: Checkout code
         uses: actions/checkout@v6
@@ -511,6 +517,12 @@ jobs:
           )
 
           reset_instance_and_wait_for_ssh() {
+            if [ "${DEPLOY_EVENT_NAME}" = "workflow_dispatch" ] \
+              && [ "${WORKFLOW_DISPATCH_ALLOW_VM_RESET:-false}" != "true" ]; then
+              echo "Manual workflow VM reset is disabled; failing closed." >&2
+              return 1
+            fi
+
             log_step "Resetting ${GCE_INSTANCE_NAME} after SSH/SCP failure"
             gcloud compute instances reset "${GCE_INSTANCE_NAME}" \
               --project "${GCP_PROJECT_ID}" \
diff --git a/tests/test_workflow_shared_config.sh b/tests/test_workflow_shared_config.sh
index 5dde48c..2f782f2 100644
--- a/tests/test_workflow_shared_config.sh
+++ b/tests/test_workflow_shared_config.sh
@@ -21,6 +21,7 @@ grep -Fq 'workload_identity_provider: ${{ env.GCP_WORKLOAD_IDENTITY_PROVIDER }}'
 grep -Fq 'service_account: ${{ env.GCP_WORKLOAD_IDENTITY_SERVICE_ACCOUNT }}' "$workflow_file"
 grep -Fq "DEPLOY_EVENT_NAME: \${{ github.event_name }}" "$workflow_file"
 grep -Fq "WORKFLOW_DISPATCH_MODE: \${{ github.event.inputs.deploy_mode }}" "$workflow_file"
+grep -Fq "WORKFLOW_DISPATCH_ALLOW_VM_RESET: \${{ github.event.inputs.allow_vm_reset }}" "$workflow_file"
 grep -Fq 'vars.IB_GATEWAY_INSTANCE_NAME' "$workflow_file"
 grep -Fq 'vars.IB_GATEWAY_ZONE' "$workflow_file"
 grep -Fq 'vars.IB_GATEWAY_MODE' "$workflow_file"
@@ -64,6 +65,7 @@ grep -Fq 'elif [ "${DEPLOY_EVENT_NAME}" = "workflow_dispatch" ]; then' "$workflo
 grep -Fq 'DEPLOY_MODE="${WORKFLOW_DISPATCH_MODE:-keepalive}"' "$workflow_file"
 grep -Fq 'Scheduled keepalive mode: skip docker build' "$workflow_file"
 grep -Fq 'reset_instance_and_wait_for_ssh()' "$workflow_file"
+grep -Fq 'Manual workflow VM reset is disabled; failing closed.' "$workflow_file"
 grep -Fq 'run_remote_ssh()' "$workflow_file"
 grep -Fq 'copy_remote_file()' "$workflow_file"
 grep -Fq 'git archive --format=tar.gz' "$workflow_file"