docs: add concise comments to nuke-account.yml

Author: james00012

.github/workflows/nuke-account.yml

@@ -1,3 +1,5 @@
+# Reusable workflow for nuking resources in a single AWS account.
+# Called by nuke.yml with account-specific parameters.
 name: Nuke Account
 
 on:
@@ -19,6 +21,7 @@ on:
 
 env:
   MISE_VERSION: '2025.12.10'
+  # Resources excluded across all accounts to prevent breaking infrastructure
   COMMON_EXCLUDES: >-
     --exclude-resource-type iam
     --exclude-resource-type iam-group
@@ -35,6 +38,7 @@ env:
     --exclude-resource-type ec2-subnet
 
 jobs:
+  # Nuke global resources (IAM, S3, Route53, etc.) - runs in us-east-1
   global:
     name: "${{ inputs.account_name }}: Global"
     runs-on: ubuntu-latest
@@ -71,6 +75,7 @@ jobs:
             --delete-unaliased-kms-keys --log-level info 2>&1 | tee /tmp/nuke-global.log
           EXIT_CODE=${PIPESTATUS[0]}
 
+          # Count deleted/failed resources for reporting
           DELETED=$(grep -c "\[Deleted\]" /tmp/nuke-global.log 2>/dev/null) || DELETED=0
           ERRORS=$(grep -c "\[Failed\]" /tmp/nuke-global.log 2>/dev/null) || ERRORS=0
           echo "deleted_count=${DELETED}" >> $GITHUB_OUTPUT
@@ -85,12 +90,13 @@ jobs:
           path: /tmp/nuke-global.log
           retention-days: 7
 
+  # Nuke regional resources across all supported regions in parallel
   regional:
     name: "${{ inputs.account_name }}: ${{ matrix.region }}"
     runs-on: ubuntu-latest
     timeout-minutes: 20
     strategy:
-      fail-fast: false
+      fail-fast: false  # Continue other regions even if one fails
       matrix:
         region:
           - ap-northeast-1
@@ -157,13 +163,14 @@ jobs:
           path: /tmp/nuke-${{ matrix.region }}.log
           retention-days: 7
 
+  # Aggregate results and send Slack notification
   notify:
     name: "${{ inputs.account_name }}: Notify"
     runs-on: ubuntu-latest
     if: always()
     needs: [global, regional]
     steps:
-      # Always use PhxDevOps role - Slack webhook is stored in PhxDevOps Secrets Manager
+      # Use PhxDevOps role to access Slack webhook stored in Secrets Manager
       - uses: aws-actions/configure-aws-credentials@v4
         with:
           role-to-assume: arn:aws:iam::087285199408:role/cloud-nuke-gha