ci: make manual workflow default safe

.gitea/workflows/ci-cd.yml

@@ -14,9 +14,9 @@ on:
   workflow_dispatch:
     inputs:
       manual_action:
-        description: "Manual action: dokploy_start or cleanup_dev_database"
+        description: "Manual action: noop, cleanup_dev_database, or dokploy_start"
         required: true
-        default: "dokploy_start"
+        default: "noop"
       dokploy_target:
         description: "Dokploy dev target: all, web, or celery"
         required: true
@@ -41,6 +41,27 @@ env:
   PIP_DISABLE_PIP_VERSION_CHECK: "1"
 
 jobs:
+  manual_action_noop:
+    name: Manual Action Help
+    runs-on: ubuntu-latest
+    timeout-minutes: 1
+    if: |
+      github.event_name == 'workflow_dispatch' &&
+      github.ref == 'refs/heads/dev' &&
+      (github.event.inputs.manual_action == '' || github.event.inputs.manual_action == 'noop')
+
+    steps:
+      - name: Show manual action usage
+        run: |
+          set -euo pipefail
+          {
+            echo "No manual action selected."
+            echo "For dev DB cleanup run with:"
+            echo "- manual_action=cleanup_dev_database"
+            echo "- cleanup_confirm=CLEAN_DEV_DB"
+            echo "For Dokploy start run with manual_action=dokploy_start."
+          } >> "${GITHUB_STEP_SUMMARY:-/dev/stdout}"
+
   quality:
     name: Quality Gate
     runs-on: ubuntu-latest