fix(fly-deployment-action): use machine update to clear MAINTENANCE_MODE

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: hakalb

packages/fly-deployment-action/src/lib/utils/run-deploy-apps.ts

@@ -223,27 +223,29 @@ export const runDeployApps = async (options: {
             }
           }
 
-          // Fly.io suspends idle machines (auto_stop_machines = 'suspend') by
-          // snapshotting their memory. The unset triggers a machine replacement for
-          // running machines but suspended machines may resume from the snapshot
-          // and still carry the old MAINTENANCE_MODE env. Force-restart all
-          // machines so they pick up the fresh environment.
+          // MAINTENANCE_MODE is baked into the machine's per-machine config.env
+          // from when it was a Fly secret during deployment. fly secrets unset
+          // removes it from the secrets store but NOT from the machine-level config.
+          // fly machine update creates a new machine version with the env var cleared,
+          // forcing a cold restart — not a resume from a suspended memory snapshot.
           if (unsetSucceeded) {
             const statusAfterUnset = await fly.status({ app: appName });
             if (statusAfterUnset?.machines) {
               for (const machine of statusAfterUnset.machines) {
                 try {
                   core.info(
-                    `Restarting machine '${machine.id}' for '${appName}' to clear stale env`
+                    `Clearing MAINTENANCE_MODE env for machine '${machine.id}' of '${appName}'`
                   );
-                  await fly.machines.restart(appName, machine.id);
-                } catch (restartErr) {
+                  await fly.machines.update(appName, machine.id, {
+                    env: { MAINTENANCE_MODE: '' }
+                  });
+                } catch (updateErr) {
                   const msg =
-                    restartErr instanceof Error
-                      ? restartErr.message
-                      : String(restartErr);
+                    updateErr instanceof Error
+                      ? updateErr.message
+                      : String(updateErr);
                   core.warning(
-                    `Failed to restart machine '${machine.id}' for '${appName}': ${msg}`
+                    `Failed to clear MAINTENANCE_MODE for machine '${machine.id}' of '${appName}': ${msg}`
                   );
                 }
               }

packages/fly-node/src/lib/fly.class.ts

@@ -462,6 +462,32 @@ export class Fly {
       } catch (error) {
         throw new Error(`[restart machine] something broke\n${error}`);
       }
+    },
+    /**
+     * Update a machine's per-machine configuration (env vars, etc.).
+     *
+     * Unlike `restart`, this creates a new machine version from the updated config
+     * and forces a cold start — it does NOT resume from a suspended memory snapshot.
+     *
+     * @param app - The name of the application
+     * @param machineId - The machine ID to update
+     * @param options - Fields to update; env values set to `''` clear that var
+     * @throws An error if the machine cannot be updated
+     */
+    update: async (
+      app: string,
+      machineId: string,
+      options: { env?: Record<string, string> }
+    ): Promise<void> => {
+      try {
+        await this.ensureInitialized();
+        await this.updateMachine(app, machineId, options);
+        this.logger.info(
+          `Machine '${machineId}' in app '${app}' was updated`
+        );
+      } catch (error) {
+        throw new Error(`[update machine] something broke\n${error}`);
+      }
     }
   };
   postgres = {
@@ -1037,6 +1063,26 @@ export class Fly {
     await this.startMachine(app, machineId);
   }
 
+  /**
+   * @private
+   * Update a machine's per-machine config (env vars, etc.).
+   * Creates a new machine version so the machine cold-starts from the updated config,
+   * bypassing any suspended memory snapshot.
+   * @throws An error if the machine cannot be updated
+   */
+  private async updateMachine(
+    app: string,
+    machineId: string,
+    options: { env?: Record<string, string> }
+  ): Promise<void> {
+    const args = ['machine', 'update', machineId, '--app', app];
+    for (const [key, value] of Object.entries(options.env || {})) {
+      args.push('--env', `${key}=${this.safeArg(value)}`);
+    }
+    args.push('--yes');
+    await this.execFly(args);
+  }
+
   /**
    * @private
    * @returns A list of all applications or `null` if listing applications fails and `nullOnError` is used