From 204727b1a751fe7a02dd366d447acb841bb900b3 Mon Sep 17 00:00:00 2001 From: Julien Gautier Date: Wed, 20 May 2026 15:03:37 +0200 Subject: [PATCH] fix(ci): move grpc-tools to optionalDependencies (revert NODE_OPTIONS attempt) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The NODE_OPTIONS=--use-system-ca workaround merged in #199 did not clear the failure — the same TLS-chain rejection still trips the runner. Either the runner's OS CA store also lacks the missing intermediate, or `--use-system-ca` does not propagate down to the node-fetch@2 used by node-pre-gyp. Without runner shell access the exact reason is not worth investigating. Different angle: grpc-tools is never invoked in CI. The protoc binary it downloads is only used by `pnpm run grpc:codegen`, which runs on a developer's machine when a proto file changes. The generated TypeScript stubs in apps/portal-bff/src/grpc/gen/ are committed (per ADR-0024 §"Sub-decision 3 — vendored protos"), so CI only needs to type-check them — protoc is dead weight there. Move grpc-tools from devDependencies to optionalDependencies. Per pnpm semantics, an optional dependency whose install (including postinstall) fails is logged as a warning and the overall install continues. On the runner: postinstall still fails on TLS, pnpm emits a warning, ci:check proceeds. On a developer machine: TLS validates, postinstall runs, protoc binary lands, `pnpm grpc:codegen` works exactly as before. No dev-side friction; no workflow env vars to maintain. Reverts the workflow `env:` blocks added in #199 — they did not help and adding noise to the workflow YAML for a non-working workaround is worse than removing it. --- .gitea/workflows/ci.yml | 12 ------------ .gitea/workflows/docs-site.yml | 7 ------- package.json | 4 +++- pnpm-lock.yaml | 13 +++++++++---- 4 files changed, 12 insertions(+), 24 deletions(-) diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml index 1bd0753..7123a19 100644 --- a/.gitea/workflows/ci.yml +++ b/.gitea/workflows/ci.yml @@ -11,18 +11,6 @@ on: push: branches: [main] -# Node 24's bundled CA set does not include every intermediate the -# self-hosted runner's network path serves (the precompiled-binary -# CDN behind grpc-tools is the first surface where this surfaced). -# `--use-system-ca` tells Node to consult the OS CA store in -# addition to its bundled set — supported since Node 22 and the -# documented Node-team fix for exactly this class of TLS-chain -# rejection. The runner image (`catthehacker/ubuntu:act-22.04` per -# ADR-0015) carries the standard Ubuntu `ca-certificates` bundle, -# which validates the impacted chains. -env: - NODE_OPTIONS: --use-system-ca - jobs: check: runs-on: [self-hosted, on-prem] diff --git a/.gitea/workflows/docs-site.yml b/.gitea/workflows/docs-site.yml index 113bbce..1d271e1 100644 --- a/.gitea/workflows/docs-site.yml +++ b/.gitea/workflows/docs-site.yml @@ -28,13 +28,6 @@ on: - 'pnpm-lock.yaml' - '.gitea/workflows/docs-site.yml' -# See `.gitea/workflows/ci.yml` for the rationale — Node 24's -# bundled CA set rejects some chains the runner's OS trust store -# validates, and `--use-system-ca` (Node ≥ 22) tells Node to -# consult the OS CA bundle alongside its own. -env: - NODE_OPTIONS: --use-system-ca - jobs: build: runs-on: [self-hosted, on-prem] diff --git a/package.json b/package.json index 22c0363..50f2282 100644 --- a/package.json +++ b/package.json @@ -111,7 +111,6 @@ "eslint": "^9.8.0", "eslint-config-prettier": "^10.0.0", "eslint-plugin-playwright": "^1.6.2", - "grpc-tools": "^1.13.0", "husky": "^9.1.7", "jest": "^30.0.2", "jest-environment-node": "^30.0.2", @@ -196,5 +195,8 @@ "pino-http": "^11.0.0", "reflect-metadata": "^0.2.0", "rxjs": "~7.8.0" + }, + "optionalDependencies": { + "grpc-tools": "^1.13.0" } } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 15828a4..63839d3 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -356,9 +356,6 @@ importers: eslint-plugin-playwright: specifier: ^1.6.2 version: 1.8.3(eslint@9.39.4(jiti@2.7.0)) - grpc-tools: - specifier: ^1.13.0 - version: 1.13.1(encoding@0.1.13) husky: specifier: ^9.1.7 version: 9.1.7 @@ -434,6 +431,10 @@ importers: webpack-cli: specifier: ^5.1.4 version: 5.1.4(webpack@5.106.2) + optionalDependencies: + grpc-tools: + specifier: ^1.13.0 + version: 1.13.1(encoding@0.1.13) libs/shared/tokens: dependencies: @@ -13769,6 +13770,7 @@ snapshots: transitivePeerDependencies: - encoding - supports-color + optional: true '@mermaid-js/mermaid-mindmap@9.3.0': dependencies: @@ -17052,7 +17054,8 @@ snapshots: dependencies: argparse: 2.0.1 - abbrev@3.0.1: {} + abbrev@3.0.1: + optional: true abbrev@4.0.0: {} @@ -19242,6 +19245,7 @@ snapshots: transitivePeerDependencies: - encoding - supports-color + optional: true hachure-fill@0.5.2: {} @@ -20863,6 +20867,7 @@ snapshots: nopt@8.1.0: dependencies: abbrev: 3.0.1 + optional: true nopt@9.0.0: dependencies: