fix: validate microservices image access early

.gitea/workflows/deploy.yml

@@ -36,6 +36,44 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - name: Validate MicroServices GHCR image access
+        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+        env:
+          GHCR_USERNAME: ${{ secrets.GHCR_USERNAME }}
+          GHCR_READ_TOKEN: ${{ secrets.GHCR_READ_TOKEN }}
+        run: |
+          set -euo pipefail
+
+          if [ -z "${GHCR_USERNAME}" ] || [ -z "${GHCR_READ_TOKEN}" ]; then
+            echo "GHCR_USERNAME and GHCR_READ_TOKEN are required for private MicroServices image pulls" >&2
+            exit 1
+          fi
+
+          check_image() {
+            local repository="$1"
+            local tag="$2"
+            local token
+            local status
+
+            token="$(curl -fsSL \
+              -u "${GHCR_USERNAME}:${GHCR_READ_TOKEN}" \
+              "https://ghcr.io/token?service=ghcr.io&scope=repository:${repository}:pull" \
+              | python3 -c 'import json,sys; print(json.load(sys.stdin)["token"])')"
+
+            status="$(curl -fsS -o /dev/null -w '%{http_code}' \
+              -H "Authorization: Bearer ${token}" \
+              -H 'Accept: application/vnd.oci.image.index.v1+json, application/vnd.docker.distribution.manifest.list.v2+json, application/vnd.oci.image.manifest.v1+json, application/vnd.docker.distribution.manifest.v2+json' \
+              "https://ghcr.io/v2/${repository}/manifests/${tag}" || true)"
+
+            if [ "${status}" != "200" ]; then
+              echo "Cannot pull ghcr.io/${repository}:${tag}; GHCR returned HTTP ${status}. Check package visibility and GHCR_READ_TOKEN read:packages access." >&2
+              exit 1
+            fi
+          }
+
+          check_image openstaticfish/microservices/site-analyzer main
+          check_image openstaticfish/microservices/scraper main
+
       - name: Setup Terraform
         uses: hashicorp/setup-terraform@v3
         with: