From 9126f6aefc193f576c5751126db15e0db00409d1 Mon Sep 17 00:00:00 2001
From: Dylan Ratcliffe <dylan@overmind.tech>
Date: Wed, 11 Feb 2026 09:41:47 +0000
Subject: [PATCH 1/3] Added failsafe

---
 .github/workflows/validate-shell.yml |  2 +-
 .gitignore                           |  1 +
 env0.plugin.yaml                     | 15 ++++++++++++++-
 3 files changed, 16 insertions(+), 2 deletions(-)
 create mode 100644 .gitignore

diff --git a/.github/workflows/validate-shell.yml b/.github/workflows/validate-shell.yml
index b3cc1da..a4b7730 100644
--- a/.github/workflows/validate-shell.yml
+++ b/.github/workflows/validate-shell.yml
@@ -34,7 +34,7 @@ jobs:
       - name: Validate shell syntax with shellcheck
         run: |
           echo "Validating shell syntax..."
-          shellcheck -x /tmp/script.sh || {
+          shellcheck -s bash -x /tmp/script.sh || {
             echo "::error::Shell syntax validation failed"
             exit 1
           }
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..496ee2c
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+.DS_Store
\ No newline at end of file
diff --git a/env0.plugin.yaml b/env0.plugin.yaml
index 4f6867b..966d9ab 100644
--- a/env0.plugin.yaml
+++ b/env0.plugin.yaml
@@ -19,9 +19,12 @@ inputs:
   comment_provider:
     description: "Where to post PR/MR comments when wait-for-simulation runs with post_comment=true. Must be one of: github, gitlab."
     required: false
+  on_failure:
+    description: "Behavior when an error occurs. 'fail' (default) fails the plugin step and blocks the deployment; 'pass' allows the deployment to continue even if this step errors."
+    required: false
 run:
   exec: |
-    #!/bin/sh
+    #!/usr/bin/env bash
     set -e
 
     TMP_DIR=""
@@ -31,6 +34,16 @@ run:
     JSON_PAYLOAD_FILE=""
     ORIGINAL_DIR=$(pwd)
 
+    ON_FAILURE="${inputs.on_failure:-fail}"
+    ON_FAILURE=$(echo "${ON_FAILURE}" | tr '[:upper:]' '[:lower:]')
+    case "${ON_FAILURE}" in
+        pass|fail) ;;
+        *) echo "Error: on_failure must be 'pass' or 'fail'"; exit 1 ;;
+    esac
+    if [ "${ON_FAILURE}" = "pass" ]; then
+        trap 'echo "Plugin step failed (on_failure=pass); deployment will continue."; exit 0' ERR
+    fi
+
     cleanup() {
         if [ -n "${TMP_DIR}" ] && [ -d "${TMP_DIR}" ]; then
             rm -rf "${TMP_DIR}"

From f7dd168751178a501eecd0f6e775f28b737ddb09 Mon Sep 17 00:00:00 2001
From: Dylan Ratcliffe <dylan@overmind.tech>
Date: Wed, 11 Feb 2026 09:50:03 +0000
Subject: [PATCH 2/3] Convert to use /sh compatible syntax

---
 .github/workflows/validate-shell.yml |  2 +-
 env0.plugin.yaml                     | 29 +++++++++++++++-------------
 2 files changed, 17 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/validate-shell.yml b/.github/workflows/validate-shell.yml
index a4b7730..b3cc1da 100644
--- a/.github/workflows/validate-shell.yml
+++ b/.github/workflows/validate-shell.yml
@@ -34,7 +34,7 @@ jobs:
       - name: Validate shell syntax with shellcheck
         run: |
           echo "Validating shell syntax..."
-          shellcheck -s bash -x /tmp/script.sh || {
+          shellcheck -x /tmp/script.sh || {
             echo "::error::Shell syntax validation failed"
             exit 1
           }
diff --git a/env0.plugin.yaml b/env0.plugin.yaml
index 966d9ab..8f28be2 100644
--- a/env0.plugin.yaml
+++ b/env0.plugin.yaml
@@ -24,15 +24,7 @@ inputs:
     required: false
 run:
   exec: |
-    #!/usr/bin/env bash
-    set -e
-
-    TMP_DIR=""
-    GH_TMP_DIR=""
-    GH_BINARY=""
-    MARKDOWN_FILE=""
-    JSON_PAYLOAD_FILE=""
-    ORIGINAL_DIR=$(pwd)
+    #!/bin/sh
 
     ON_FAILURE="${inputs.on_failure:-fail}"
     ON_FAILURE=$(echo "${ON_FAILURE}" | tr '[:upper:]' '[:lower:]')
@@ -40,9 +32,6 @@ run:
         pass|fail) ;;
         *) echo "Error: on_failure must be 'pass' or 'fail'"; exit 1 ;;
     esac
-    if [ "${ON_FAILURE}" = "pass" ]; then
-        trap 'echo "Plugin step failed (on_failure=pass); deployment will continue."; exit 0' ERR
-    fi
 
     cleanup() {
         if [ -n "${TMP_DIR}" ] && [ -d "${TMP_DIR}" ]; then
@@ -58,7 +47,15 @@ run:
             rm -f "${JSON_PAYLOAD_FILE}"
         fi
     }
-    trap cleanup EXIT
+    main_script() {
+        set -e
+        trap cleanup EXIT
+        TMP_DIR=""
+        GH_TMP_DIR=""
+        GH_BINARY=""
+        MARKDOWN_FILE=""
+        JSON_PAYLOAD_FILE=""
+        ORIGINAL_DIR=$(pwd)
 
     # Export API key as environment variable
     export OVM_API_KEY="${inputs.api_key}"
@@ -460,3 +457,9 @@ run:
             exit 1
             ;;
     esac
+    }
+    if [ "${ON_FAILURE}" = "pass" ]; then
+        ( main_script ) || { echo "Plugin step failed (on_failure=pass); deployment will continue."; exit 0; }
+    else
+        main_script
+    fi

From 5ebdd066293c08795207a11a98b9430aafbf26d6 Mon Sep 17 00:00:00 2001
From: Dylan Ratcliffe <dylan@overmind.tech>
Date: Wed, 11 Feb 2026 09:54:13 +0000
Subject: [PATCH 3/3] Handle default state

---
 env0.plugin.yaml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/env0.plugin.yaml b/env0.plugin.yaml
index 8f28be2..15e7cef 100644
--- a/env0.plugin.yaml
+++ b/env0.plugin.yaml
@@ -26,7 +26,8 @@ run:
   exec: |
     #!/bin/sh
 
-    ON_FAILURE="${inputs.on_failure:-fail}"
+    _on_failure="${inputs.on_failure}"
+    ON_FAILURE="${_on_failure:-fail}"
     ON_FAILURE=$(echo "${ON_FAILURE}" | tr '[:upper:]' '[:lower:]')
     case "${ON_FAILURE}" in
         pass|fail) ;;