ci: trust bundled CAs during NuGet publish

2026-09-05 04:05:09 +08:00
parent fac1818d6f
commit 66623203c8
3 changed files with 43 additions and 0 deletions
@@ -17,6 +17,7 @@ jobs:
      DOTNET_SYSTEM_GLOBALIZATION_INVARIANT: '1'
      DOTNET_CLI_TELEMETRY_OPTOUT: '1'
      LD_LIBRARY_PATH: /opt/dotnet-libs/usr/lib/x86_64-linux-gnu
+      SSL_CERT_FILE: /opt/ca-certificates.crt
    steps:
      - name: Fetch exact tagged source
        env:
@@ -51,6 +52,9 @@ jobs:
          set -euo pipefail
          node --input-type=module <<'NODE'
          import { writeFile } from 'node:fs/promises';
+          import { rootCertificates } from 'node:tls';
+
+          await writeFile('/opt/ca-certificates.crt', rootCertificates.join('\n'));

          const metadataResponse = await fetch('https://dotnetcli.blob.core.windows.net/dotnet/release-metadata/8.0/releases.json');
          if (!metadataResponse.ok) throw new Error(`Release metadata download failed: ${metadataResponse.status}`);