From a104acf160ce58a52fe5ac4e744f23311ea609be Mon Sep 17 00:00:00 2001
From: DevOps <devops@noveria.net>
Date: Thu, 9 Jul 2026 23:46:46 +0200
Subject: [PATCH] ci: consolidate Nexus deployment and provenance

---
 .gitea/scripts/deploy-nexus.sh | 18 ++++++++++++++++++
 .gitea/workflows/backup.yaml   |  2 +-
 .gitea/workflows/ci.yaml       | 11 +++++++----
 backend/Dockerfile             |  6 ++++++
 compose.yaml                   |  6 ++++++
 frontend/Dockerfile            |  6 ++++++
 6 files changed, 44 insertions(+), 5 deletions(-)

diff --git a/.gitea/scripts/deploy-nexus.sh b/.gitea/scripts/deploy-nexus.sh
index 98c1787..2f01267 100755
--- a/.gitea/scripts/deploy-nexus.sh
+++ b/.gitea/scripts/deploy-nexus.sh
@@ -53,6 +53,7 @@ if ! echo "$VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$'; then
   exit 1
 fi
 
+GIT_SHA="$(git rev-parse HEAD 2>/dev/null || echo unknown)"
 GIT_REF="$(git rev-parse --short HEAD 2>/dev/null || echo unknown)"
 echo "Deploying Nexus v$VERSION from $GIT_REF"
 
@@ -68,6 +69,8 @@ BOOTSTRAP_OWNER_EMAIL=vmbao62@hotmail.de
 OPENCLAW_BASE_URL=http://host.docker.internal:18789
 OPENCLAW_GATEWAY_TOKEN=${ENV_OPENCLAW_TOKEN:-}
 OPENCLAW_GATEWAY_PASSWORD=
+NEXUS_VERSION=${VERSION}
+NEXUS_GIT_SHA=${GIT_SHA}
 EOF_ENV
 
 echo "Syncing source to deploy path: $DEPLOY_PATH"
@@ -128,6 +131,21 @@ docker run --rm \
   docker:cli \
   sh /deploy.sh < "$ENV_TMPFILE"
 
+echo "Verifying image provenance"
+for container in nexus-api-1 nexus-web-1; do
+  revision="$(docker inspect --format '{{ index .Config.Labels "org.opencontainers.image.revision" }}' "$container")"
+  version="$(docker inspect --format '{{ index .Config.Labels "org.opencontainers.image.version" }}' "$container")"
+  if [ "$revision" != "$GIT_SHA" ]; then
+    echo "Image revision mismatch for $container: expected $GIT_SHA, got $revision" >&2
+    exit 1
+  fi
+  if [ "$version" != "$VERSION" ]; then
+    echo "Image version mismatch for $container: expected $VERSION, got $version" >&2
+    exit 1
+  fi
+  echo "$container provenance verified: v$version $revision"
+done
+
 echo "Checking live health"
 retry=0
 while [ "$retry" -lt 6 ]; do
diff --git a/.gitea/workflows/backup.yaml b/.gitea/workflows/backup.yaml
index 5edb30d..b7a0da5 100644
--- a/.gitea/workflows/backup.yaml
+++ b/.gitea/workflows/backup.yaml
@@ -33,7 +33,7 @@ on:
       host_backup_path:
         description: 'Host path for backup (only if keep_on_host is true)'
         required: false
-        default: '/home/projekte_bao/openclaw/backups'
+        default: '/home/projekte_bao/backups/nexus'
         type: string
 
   # Optional: uncomment to enable nightly automatic backups
diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index a93aa6d..e0dd5b0 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -8,9 +8,12 @@ concurrency:
 
 on:
   push:
-    branches: [main]
+    branches:
+      - main
+      - 'codex/**'
   pull_request:
     branches: [main]
+  workflow_dispatch:
 
 jobs:
   # ─── Backend ───────────────────────────────────
@@ -73,7 +76,7 @@ jobs:
   security:
     name: Security Check
     runs-on: linux
-    if: github.ref == 'refs/heads/main'
+    if: gitea.ref == 'refs/heads/main' || startsWith(gitea.ref, 'refs/heads/codex/')
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -106,8 +109,8 @@ jobs:
       group: deploy-production
       cancel-in-progress: false
     if: |
-      github.event_name == 'push' &&
-      github.ref == 'refs/heads/main'
+      gitea.event_name == 'push' &&
+      gitea.ref == 'refs/heads/main'
     env:
       DEPLOY_PATH: /home/projekte_bao/openclaw/data/openclaw/workspace/nexus
       ENV_POSTGRES_PASSWORD: ${{ secrets.ENV_POSTGRES_PASSWORD }}
diff --git a/backend/Dockerfile b/backend/Dockerfile
index 8ad48d9..eb7115f 100644
--- a/backend/Dockerfile
+++ b/backend/Dockerfile
@@ -6,6 +6,12 @@ COPY . .
 RUN dotnet publish -c Release -o /app/publish
 
 FROM mcr.microsoft.com/dotnet/aspnet:10.0-alpine
+ARG NEXUS_VERSION=dev
+ARG NEXUS_GIT_SHA=unknown
+LABEL org.opencontainers.image.title="Nexus API" \
+      org.opencontainers.image.source="https://git.noveria.net/bao/nexus" \
+      org.opencontainers.image.version="${NEXUS_VERSION}" \
+      org.opencontainers.image.revision="${NEXUS_GIT_SHA}"
 WORKDIR /app
 COPY --from=build /app/publish .
 RUN apk add --no-cache curl
diff --git a/compose.yaml b/compose.yaml
index 85f56ee..4656e67 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -31,6 +31,9 @@ services:
   api:
     build:
       context: ./backend
+      args:
+        NEXUS_VERSION: ${NEXUS_VERSION:-dev}
+        NEXUS_GIT_SHA: ${NEXUS_GIT_SHA:-unknown}
     restart: always
     deploy:
       resources:
@@ -83,6 +86,9 @@ services:
   web:
     build:
       context: ./frontend
+      args:
+        NEXUS_VERSION: ${NEXUS_VERSION:-dev}
+        NEXUS_GIT_SHA: ${NEXUS_GIT_SHA:-unknown}
     restart: always
     deploy:
       resources:
diff --git a/frontend/Dockerfile b/frontend/Dockerfile
index 87f7e0b..cf3b0c6 100644
--- a/frontend/Dockerfile
+++ b/frontend/Dockerfile
@@ -7,6 +7,12 @@ COPY . .
 RUN pnpm build
 
 FROM nginx:1.27-alpine
+ARG NEXUS_VERSION=dev
+ARG NEXUS_GIT_SHA=unknown
+LABEL org.opencontainers.image.title="Nexus Web" \
+      org.opencontainers.image.source="https://git.noveria.net/bao/nexus" \
+      org.opencontainers.image.version="${NEXUS_VERSION}" \
+      org.opencontainers.image.revision="${NEXUS_GIT_SHA}"
 COPY nginx.conf /etc/nginx/conf.d/default.conf
 COPY --from=build /app/dist /usr/share/nginx/html
 EXPOSE 80