From c419a73bf509088234bccac061c2305de0b10e68 Mon Sep 17 00:00:00 2001 From: Julien Gautier Date: Wed, 20 May 2026 10:15:09 +0200 Subject: [PATCH] fix(ci): pass NODE_OPTIONS=--use-system-ca to clear grpc-tools tls install The CI runner (catthehacker/ubuntu:act-22.04) fails `pnpm install --frozen-lockfile` because grpc-tools' postinstall downloads a precompiled protoc archive from node-precompiled-binaries.grpc.io and Node 24's bundled CA set cannot verify the chain there. Node 24 itself surfaces the fix in the error message: pass `--use-system-ca` so Node consults the OS CA store in addition to its bundled set. The runner image carries the standard Ubuntu `ca-certificates` bundle, which validates the impacted chains. Applied at workflow scope (env: block) on both ci.yml and docs-site.yml so every Node child (pnpm itself plus every postinstall it spawns) inherits the option. Future native deps that hit the same TLS rejection will benefit automatically. --- .gitea/workflows/ci.yml | 12 ++++++++++++ .gitea/workflows/docs-site.yml | 7 +++++++ 2 files changed, 19 insertions(+) diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml index 7123a19..1bd0753 100644 --- a/.gitea/workflows/ci.yml +++ b/.gitea/workflows/ci.yml @@ -11,6 +11,18 @@ on: push: branches: [main] +# Node 24's bundled CA set does not include every intermediate the +# self-hosted runner's network path serves (the precompiled-binary +# CDN behind grpc-tools is the first surface where this surfaced). +# `--use-system-ca` tells Node to consult the OS CA store in +# addition to its bundled set — supported since Node 22 and the +# documented Node-team fix for exactly this class of TLS-chain +# rejection. The runner image (`catthehacker/ubuntu:act-22.04` per +# ADR-0015) carries the standard Ubuntu `ca-certificates` bundle, +# which validates the impacted chains. +env: + NODE_OPTIONS: --use-system-ca + jobs: check: runs-on: [self-hosted, on-prem] diff --git a/.gitea/workflows/docs-site.yml b/.gitea/workflows/docs-site.yml index 1d271e1..113bbce 100644 --- a/.gitea/workflows/docs-site.yml +++ b/.gitea/workflows/docs-site.yml @@ -28,6 +28,13 @@ on: - 'pnpm-lock.yaml' - '.gitea/workflows/docs-site.yml' +# See `.gitea/workflows/ci.yml` for the rationale — Node 24's +# bundled CA set rejects some chains the runner's OS trust store +# validates, and `--use-system-ca` (Node ≥ 22) tells Node to +# consult the OS CA bundle alongside its own. +env: + NODE_OPTIONS: --use-system-ca + jobs: build: runs-on: [self-hosted, on-prem]