From ba5c81e78b5484f84250c4873bcd54e5616df19a Mon Sep 17 00:00:00 2001 From: jwinterm Date: Tue, 19 May 2026 12:52:29 -0400 Subject: [PATCH] CI: clarify NODE_TLS_REJECT_UNAUTHORIZED is a fallback now MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Gitea is on the same Mac mini as the runner, behind NPM in a separate container. The proper fix is a hosts entry on the Mac that points git.such.software at NPM's LAN IP so the runner reaches Gitea via NPM's Let's Encrypt cert. The env var stays in the workflow as a belt-and-suspenders fallback — no harm if certs already validate cleanly, saves the workflow from breaking again if the hosts entry ever gets blown away (system reset, container migration, etc). --- .github/workflows/build-ios-sim.yml | 12 +++++------- .github/workflows/build-ios-testflight.yml | 5 ++--- 2 files changed, 7 insertions(+), 10 deletions(-) diff --git a/.github/workflows/build-ios-sim.yml b/.github/workflows/build-ios-sim.yml index 935744161..4a0d6fa6e 100644 --- a/.github/workflows/build-ios-sim.yml +++ b/.github/workflows/build-ios-sim.yml @@ -32,13 +32,11 @@ jobs: # Gitea runner shell). Force UTF-8 globally so `pod install` succeeds. LANG: en_US.UTF-8 LC_ALL: en_US.UTF-8 - # The Mac runner hits git.such.software via the LAN (NAT hairpin), - # which bypasses the Let's Encrypt-fronted NPM and lands on Gitea's - # internal self-signed cert. Node won't trust it, so artifact upload - # bails with DEPTH_ZERO_SELF_SIGNED_CERT. Acceptable to skip - # validation since we're talking to our own infrastructure on our LAN. - # Long-term fix: point the runner at git.such.software via the public - # IP / NPM cert OR install Gitea's CA into the runner's trust store. + # If you added an /etc/hosts entry on the Mac mini that points + # git.such.software at NPM's LAN IP (so the runner hits NPM's + # Let's Encrypt cert instead of Gitea's internal self-signed), + # this env var can be removed. Left in as a belt-and-suspenders + # fallback — has no effect if certs already verify. NODE_TLS_REJECT_UNAUTHORIZED: '0' steps: diff --git a/.github/workflows/build-ios-testflight.yml b/.github/workflows/build-ios-testflight.yml index 2a0b8f8aa..51228754e 100644 --- a/.github/workflows/build-ios-testflight.yml +++ b/.github/workflows/build-ios-testflight.yml @@ -38,9 +38,8 @@ jobs: # CocoaPods needs UTF-8; Gitea runner shell defaults to ASCII-8BIT. LANG: en_US.UTF-8 LC_ALL: en_US.UTF-8 - # Mac runner hits internal Gitea over LAN (NAT hairpin), bypassing - # the public Let's Encrypt cert. Skip TLS verification for the - # artifact upload — talking to our own server on our own network. + # See note in build-ios-sim.yml — fallback if /etc/hosts trick + # isn't in place. Safe no-op once it is. NODE_TLS_REJECT_UNAUTHORIZED: '0' steps: