ci: consolidate Nexus deployment and provenance

.gitea/workflows/ci.yaml

@@ -8,9 +8,12 @@ concurrency:
 
 on:
   push:
-    branches: [main]
+    branches:
+      - main
+      - 'codex/**'
   pull_request:
     branches: [main]
+  workflow_dispatch:
 
 jobs:
   # ─── Backend ───────────────────────────────────
@@ -73,7 +76,7 @@ jobs:
   security:
     name: Security Check
     runs-on: linux
-    if: github.ref == 'refs/heads/main'
+    if: gitea.ref == 'refs/heads/main' || startsWith(gitea.ref, 'refs/heads/codex/')
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -106,8 +109,8 @@ jobs:
       group: deploy-production
       cancel-in-progress: false
     if: |
-      github.event_name == 'push' &&
-      github.ref == 'refs/heads/main'
+      gitea.event_name == 'push' &&
+      gitea.ref == 'refs/heads/main'
     env:
       DEPLOY_PATH: /home/projekte_bao/openclaw/data/openclaw/workspace/nexus
       ENV_POSTGRES_PASSWORD: ${{ secrets.ENV_POSTGRES_PASSWORD }}