github-such-software/hash-wallet
1
0
Fork 1
mirror of https://github.com/Such-Software/hash-wallet.git synced 2026-10-17 05:41:29 +02:00
Code Issues Packages Projects Releases Wiki Activity

CI: clarify NODE_TLS_REJECT_UNAUTHORIZED is a fallback now

Browse Source 
Gitea is on the same Mac mini as the runner, behind NPM in a separate
container. The proper fix is a hosts entry on the Mac that points
git.such.software at NPM's LAN IP so the runner reaches Gitea via
NPM's Let's Encrypt cert.

The env var stays in the workflow as a belt-and-suspenders fallback —
no harm if certs already validate cleanly, saves the workflow from
breaking again if the hosts entry ever gets blown away (system reset,
container migration, etc).
This commit is contained in:
jwinterm
2026-05-19 12:52:29 -04:00
parent 9f832633b9
commit ba5c81e78b
2 changed files with 7 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/build-ios-sim.yml
+5 -7
View File
@@ -32,13 +32,11 @@ jobs:
# Gitea runner shell). Force UTF-8 globally so `pod install` succeeds.
LANG: en_US.UTF-8
LC_ALL: en_US.UTF-8
# The Mac runner hits git.such.software via the LAN (NAT hairpin),
# which bypasses the Let's Encrypt-fronted NPM and lands on Gitea's
# internal self-signed cert. Node won't trust it, so artifact upload
# bails with DEPTH_ZERO_SELF_SIGNED_CERT. Acceptable to skip
# validation since we're talking to our own infrastructure on our LAN.
# Long-term fix: point the runner at git.such.software via the public
# IP / NPM cert OR install Gitea's CA into the runner's trust store.
# If you added an /etc/hosts entry on the Mac mini that points
# git.such.software at NPM's LAN IP (so the runner hits NPM's
# Let's Encrypt cert instead of Gitea's internal self-signed),
# this env var can be removed. Left in as a belt-and-suspenders
# fallback — has no effect if certs already verify.
NODE_TLS_REJECT_UNAUTHORIZED: '0'
steps:
.github/workflows/build-ios-testflight.yml
+2 -3
View File
@@ -38,9 +38,8 @@ jobs:
# CocoaPods needs UTF-8; Gitea runner shell defaults to ASCII-8BIT.
LANG: en_US.UTF-8
LC_ALL: en_US.UTF-8
# Mac runner hits internal Gitea over LAN (NAT hairpin), bypassing
# the public Let's Encrypt cert. Skip TLS verification for the
# artifact upload — talking to our own server on our own network.
# See note in build-ios-sim.yml — fallback if /etc/hosts trick
# isn't in place. Safe no-op once it is.
NODE_TLS_REJECT_UNAUTHORIZED: '0'
steps: