Gitea Runner With Self Signed Certificate

Short test of the Gitea 1.19.0 actions feature with a runner executing on an MacBook Air with M1 with OrbStack

Gitea Actions

Gitea have a great blog post describing all steps to enable and try out the feature.

When Gitea is running in a private environment with a self-signed certificate, the images that the runner will use to interact with the Gitea server, eg. to check-out the repository, need to include the root CA certificate. Without this step actions in the runner image will fail to connect to the Gitea server with an error like this:

fatal: unable to access 'https://gitea.lan:8080/user/action-test/': server certificate verification failed. CAfile: none CRLfile: none
The process '/usr/bin/git' failed with exit code 128

Node image for actions with root CA

The runner will use a node container image to execute github actions. Create a node container image that includes the root CA certificate so git operations involving the gitea server with the self-signed certificates succeed. Use this Dockerfile:

#Based on the image that the github action is using
FROM node:16-bullseye

#Place the root CA of your self-sign facility into the image
COPY ./rootCA.crt /usr/local/share/ca-certificates/rootCA.crt

#Rebuild the certificate database
RUN USER=root /usr/sbin/update-ca-certificates

and build the image with docker build -t self-signed-ca-node . and tag it like the original node image docker image tag self-signed-ca-node node:16-bullseye. This needs to be done on all hosts that are executing the act_runner.