From 8aaf6e3bb1a1dcbf0e514e89cc5e626fe5252869 Mon Sep 17 00:00:00 2001
From: cneicy <im@crash.work>
Date: Sat, 5 Sep 2026 04:04:25 +0800
Subject: [PATCH] ci: trust bundled CAs during NuGet publish

---
 .gitea/workflows/publish-nuget.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.gitea/workflows/publish-nuget.yml b/.gitea/workflows/publish-nuget.yml
index 1b18a2f..6c47920 100644
--- a/.gitea/workflows/publish-nuget.yml
+++ b/.gitea/workflows/publish-nuget.yml
@@ -17,6 +17,7 @@ jobs:
       DOTNET_SYSTEM_GLOBALIZATION_INVARIANT: '1'
       DOTNET_CLI_TELEMETRY_OPTOUT: '1'
       LD_LIBRARY_PATH: /opt/dotnet-libs/usr/lib/x86_64-linux-gnu
+      SSL_CERT_FILE: /opt/ca-certificates.crt
     steps:
       - name: Fetch exact tagged source
         env:
@@ -51,6 +52,9 @@ jobs:
           set -euo pipefail
           node --input-type=module <<'NODE'
           import { writeFile } from 'node:fs/promises';
+          import { rootCertificates } from 'node:tls';
+
+          await writeFile('/opt/ca-certificates.crt', rootCertificates.join('\n'));
 
           const metadataResponse = await fetch('https://dotnetcli.blob.core.windows.net/dotnet/release-metadata/8.0/releases.json');
           if (!metadataResponse.ok) throw new Error(`Release metadata download failed: ${metadataResponse.status}`);