From 38954feb8faa3c52e238bbffbf508d489a557b2b Mon Sep 17 00:00:00 2001
From: DevOps <devops@noveria.net>
Date: Wed, 24 Jun 2026 07:52:24 +0200
Subject: [PATCH] fix: snapshot deploy source before sync

---
 .gitea/scripts/deploy-nexus.sh | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/.gitea/scripts/deploy-nexus.sh b/.gitea/scripts/deploy-nexus.sh
index 025fd71..7456477 100755
--- a/.gitea/scripts/deploy-nexus.sh
+++ b/.gitea/scripts/deploy-nexus.sh
@@ -4,8 +4,10 @@ set -eu
 DEPLOY_PATH="${DEPLOY_PATH:-/home/projekte_bao/openclaw/data/openclaw/workspace/nexus}"
 ENV_TMPFILE_TEMPLATE="${ENV_TMPFILE:-/tmp/nexus-deploy-env}"
 COMPOSE_SCRIPT_TEMPLATE="${COMPOSE_SCRIPT:-/tmp/nexus-compose-deploy.sh}"
+SOURCE_ARCHIVE_TEMPLATE="${SOURCE_ARCHIVE:-/tmp/nexus-source.tar}"
 ENV_TMPFILE=""
 COMPOSE_SCRIPT=""
+SOURCE_ARCHIVE=""
 BASE_URL="${BASE_URL:-https://nexus.noveria.net}"
 
 cleanup() {
@@ -15,6 +17,9 @@ cleanup() {
   if [ -n "$COMPOSE_SCRIPT" ]; then
     rm -f "$COMPOSE_SCRIPT"
   fi
+  if [ -n "$SOURCE_ARCHIVE" ]; then
+    rm -f "$SOURCE_ARCHIVE"
+  fi
 }
 trap cleanup EXIT INT TERM
 
@@ -40,7 +45,8 @@ secure_tmpfile() {
 
 ENV_TMPFILE="$(secure_tmpfile "$ENV_TMPFILE_TEMPLATE")"
 COMPOSE_SCRIPT="$(secure_tmpfile "$COMPOSE_SCRIPT_TEMPLATE")"
-chmod 600 "$ENV_TMPFILE" "$COMPOSE_SCRIPT"
+SOURCE_ARCHIVE="$(secure_tmpfile "$SOURCE_ARCHIVE_TEMPLATE")"
+chmod 600 "$ENV_TMPFILE" "$COMPOSE_SCRIPT" "$SOURCE_ARCHIVE"
 
 if [ ! -f VERSION ]; then
   echo "VERSION file not found" >&2
@@ -56,6 +62,8 @@ fi
 GIT_REF="$(git rev-parse --short HEAD 2>/dev/null || echo unknown)"
 echo "Deploying Nexus v$VERSION from $GIT_REF"
 
+git archive --format=tar HEAD > "$SOURCE_ARCHIVE"
+
 umask 077
 cat > "$ENV_TMPFILE" <<EOF_ENV
 POSTGRES_DB=nexus
@@ -72,12 +80,14 @@ EOF_ENV
 
 echo "Syncing source to deploy path: $DEPLOY_PATH"
 docker run --rm \
-  -v "$PWD:/src:ro" \
+  -v "$SOURCE_ARCHIVE:/source.tar:ro" \
   -v "$DEPLOY_PATH:/dest" \
   alpine:3.20 \
   sh -c '
     set -eu
     dest_owner="$(stat -c "%u:%g" /dest)"
+    mkdir -p /src-snapshot
+    tar -xf /source.tar -C /src-snapshot
 
     is_protected_path() {
       case "$1" in
@@ -97,7 +107,7 @@ docker run --rm \
       fi
     done
 
-    cd /src
+    cd /src-snapshot
     find . -mindepth 1 -maxdepth 1 | while IFS= read -r path; do
       if ! is_protected_path "$path"; then
         cp -a "$path" /dest/