fix: harden Nexus runtime health and rollback

.gitea/workflows/rollback.yaml

@@ -112,9 +112,11 @@ jobs:
           JWT_ISSUER=nexus
           JWT_AUDIENCE=nexus-web
           BOOTSTRAP_OWNER_EMAIL=vmbao62@hotmail.de
-          OPENCLAW_BASE_URL=http://host.docker.internal:18789
+          OPENCLAW_BASE_URL=http://openclaw-gateway-bao:18789
           OPENCLAW_GATEWAY_TOKEN=${ENV_OPENCLAW_TOKEN}
           OPENCLAW_GATEWAY_PASSWORD=
+          NEXUS_VERSION=$(tr -d '[:space:]' < VERSION)
+          NEXUS_GIT_SHA=$(git rev-parse HEAD)
           EOF
 
           chmod 600 "${ENV_TMPFILE}"
@@ -127,18 +129,38 @@ jobs:
         run: |
           set -euo pipefail
 
-          docker run --rm \
-            -v "${{ gitea.workspace }}:/src:ro" \
+          git archive --format=tar HEAD | docker run --rm -i \
             -v "${DEPLOY_PATH}:/dest" \
             alpine:latest \
-            sh -c "
-              cd /src && \
-              find . -mindepth 1 -maxdepth 1 \
-                ! -name .git \
-                -exec cp -r {} /dest/ \; && \
-              DEST_OWNER=\$(stat -c '%u:%g' /dest) && \
-              chown -R \"\$DEST_OWNER\" /dest
-            "
+            sh -c '
+              set -eu
+              dest_owner="$(stat -c "%u:%g" /dest)"
+              mkdir -p /src-snapshot
+              tar -xf - -C /src-snapshot
+
+              is_protected_path() {
+                case "$1" in
+                  ./.git|./.env|./.env.*|./data|./logs|./backups|./tmp|./uploads|./storage)
+                    return 0
+                    ;;
+                  *)
+                    return 1
+                    ;;
+                esac
+              }
+
+              cd /dest
+              find . -mindepth 1 -maxdepth 1 | while IFS= read -r path; do
+                if ! is_protected_path "$path"; then rm -rf "$path"; fi
+              done
+
+              cd /src-snapshot
+              find . -mindepth 1 -maxdepth 1 | while IFS= read -r path; do
+                if ! is_protected_path "$path"; then cp -a "$path" /dest/; fi
+              done
+
+              chown -R "$dest_owner" /dest
+            '
 
           echo "✅ Rollback code (${{ inputs.target_tag }}) synced to ${DEPLOY_PATH}"
 
@@ -151,16 +173,18 @@ jobs:
 
           docker run --rm \
             -v "${DEPLOY_PATH}:/workspace/nexus" \
-            -v "/tmp:/tmp-host:ro" \
             -v /var/run/docker.sock:/var/run/docker.sock \
             -w /workspace/nexus \
+            -i \
             docker:cli \
-            sh -c "
-              set -e
-              echo '🔙 Rolling back to ${{ inputs.target_tag }}'
-              docker compose --env-file /tmp-host/$(basename "${ENV_TMPFILE}") build --no-cache
-              docker compose --env-file /tmp-host/$(basename "${ENV_TMPFILE}") up -d --wait --force-recreate
-            "
+            sh -c '
+              set -eu
+              umask 077
+              cat > /tmp/nexus-rollback-env
+              trap '\''rm -f /tmp/nexus-rollback-env'\'' EXIT INT TERM
+              docker compose --env-file /tmp/nexus-rollback-env build --no-cache
+              docker compose --env-file /tmp/nexus-rollback-env up -d --wait --force-recreate
+            ' < "${ENV_TMPFILE}"
 
           echo "✅ Rollback redeploy completed"
 
@@ -186,11 +210,14 @@ jobs:
           WAIT=1
           while [ $RETRY -lt $MAX ]; do
             RETRY=$((RETRY + 1))
-            if curl -sf --max-time 10 https://nexus.noveria.net/health; then
-              echo ""
-              echo "✅ Health check passed (attempt $RETRY/$MAX)"
-              exit 0
-            fi
+            HEALTH_BODY=$(curl -sf --max-time 10 https://nexus.noveria.net/health || true)
+            case "$HEALTH_BODY" in
+              '{"status":"Healthy"'*)
+                echo "✅ Health check passed (attempt $RETRY/$MAX)"
+                exit 0
+                ;;
+            esac
+            [ -n "$HEALTH_BODY" ] && echo "⚠️ Health endpoint is degraded: $HEALTH_BODY"
             echo "⏳ Attempt $RETRY/$MAX failed, waiting ${WAIT}s..."
             sleep $WAIT
             NEXT=$((WAIT + RETRY))