diff --git a/.github/workflows/cla.test.mjs b/.github/workflows/cla.test.mjs new file mode 100644 index 0000000..9db9a51 --- /dev/null +++ b/.github/workflows/cla.test.mjs @@ -0,0 +1,18 @@ +import assert from "node:assert/strict"; +import { readFile } from "node:fs/promises"; +import test from "node:test"; + +const workflowUrl = new URL("./cla.yml", import.meta.url); + +test("the Node 24 CLA client trusts the runner CA store", async () => { + const workflow = await readFile(workflowUrl, "utf8"); + const claStep = workflow.match( + /uses: contributor-assistant\/github-action@[^\n]+\n(?(?: {8,}.+\n)+)/u, + ); + + assert.ok(claStep?.groups?.["body"], "CLA Assistant step not found"); + assert.match( + claStep.groups["body"], + /^ {10}NODE_OPTIONS: "--use-system-ca"$/mu, + ); +}); diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml index 6c20cfe..fab2b81 100644 --- a/.github/workflows/cla.yml +++ b/.github/workflows/cla.yml @@ -41,6 +41,10 @@ jobs: uses: contributor-assistant/github-action@ca4a40a7d1004f18d9960b404b97e5f30a505a08 # v2.6.1 env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + # This archived action declares Node 20, so GitHub now forces it onto + # Node 24. Use the runner trust store for intermittent proxied TLS + # chains; certificate verification remains enabled. + NODE_OPTIONS: "--use-system-ca" PERSONAL_ACCESS_TOKEN: ${{ steps.app-token.outputs.token }} with: path-to-signatures: "signatures/cla.json"