ci: consolidate Nexus deployment and provenance

.gitea/scripts/deploy-nexus.sh

@@ -53,6 +53,7 @@ if ! echo "$VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$'; then
   exit 1
 fi
 
+GIT_SHA="$(git rev-parse HEAD 2>/dev/null || echo unknown)"
 GIT_REF="$(git rev-parse --short HEAD 2>/dev/null || echo unknown)"
 echo "Deploying Nexus v$VERSION from $GIT_REF"
 
@@ -68,6 +69,8 @@ BOOTSTRAP_OWNER_EMAIL=vmbao62@hotmail.de
 OPENCLAW_BASE_URL=http://host.docker.internal:18789
 OPENCLAW_GATEWAY_TOKEN=${ENV_OPENCLAW_TOKEN:-}
 OPENCLAW_GATEWAY_PASSWORD=
+NEXUS_VERSION=${VERSION}
+NEXUS_GIT_SHA=${GIT_SHA}
 EOF_ENV
 
 echo "Syncing source to deploy path: $DEPLOY_PATH"
@@ -128,6 +131,21 @@ docker run --rm \
   docker:cli \
   sh /deploy.sh < "$ENV_TMPFILE"
 
+echo "Verifying image provenance"
+for container in nexus-api-1 nexus-web-1; do
+  revision="$(docker inspect --format '{{ index .Config.Labels "org.opencontainers.image.revision" }}' "$container")"
+  version="$(docker inspect --format '{{ index .Config.Labels "org.opencontainers.image.version" }}' "$container")"
+  if [ "$revision" != "$GIT_SHA" ]; then
+    echo "Image revision mismatch for $container: expected $GIT_SHA, got $revision" >&2
+    exit 1
+  fi
+  if [ "$version" != "$VERSION" ]; then
+    echo "Image version mismatch for $container: expected $VERSION, got $version" >&2
+    exit 1
+  fi
+  echo "$container provenance verified: v$version $revision"
+done
+
 echo "Checking live health"
 retry=0
 while [ "$retry" -lt 6 ]; do