From 01f02e01565e2bbd2f723010d9564e1c1dff3faf Mon Sep 17 00:00:00 2001 From: Daewoon Kim Date: Fri, 11 Sep 2026 10:55:27 +0900 Subject: [PATCH 1/2] =?UTF-8?q?fix(scatterlab-prebuild-android):=20?= =?UTF-8?q?=EC=9E=A1=20=EC=BB=A8=ED=85=8C=EC=9D=B4=EB=84=88=EC=97=90=20?= =?UTF-8?q?=ED=98=B8=EC=8A=A4=ED=8A=B8=20CA=20=EB=B2=88=EB=93=A4=EC=9D=84?= =?UTF-8?q?=20=EB=A7=88=EC=9A=B4=ED=8A=B8=ED=95=9C=EB=8B=A4?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 컨테이너로 옮기고 나니 checkout 이 죽었다 (run 34551986915): fatal: unable to access 'https://github.com/scatterlab/react-native/': server certificate verification failed. CAfile: none CRLfile: none 같은 주소를 호스트 러너의 git 은 잘 받아온다 — 호스트가 가진 신뢰가 컨테이너 안에 없는 것이다. 이미지에 ca-certificates 가 없는 경우와, 조직 TLS 프록시의 사설 CA 를 호스트만 신뢰하는 경우를 둘 다 덮으려고 호스트 번들을 읽기 전용으로 마운트한다. 첫 네트워크 스텝 앞에 진단 출력을 둔다. 다음에 TLS 로 막히면 증거가 같은 실행에 남아 원인 규명에 실행을 한 번 더 쓰지 않아도 된다. Co-Authored-By: Claude Opus 5 (1M context) --- .../workflows/scatterlab-prebuild-android.yml | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/.github/workflows/scatterlab-prebuild-android.yml b/.github/workflows/scatterlab-prebuild-android.yml index cafc61740c8..b1a35d169ad 100644 --- a/.github/workflows/scatterlab-prebuild-android.yml +++ b/.github/workflows/scatterlab-prebuild-android.yml @@ -137,11 +137,28 @@ jobs: # https://github.com/gradle/gradle/issues/23391#issuecomment-1878979127 LC_ALL: C.UTF8 GRADLE_OPTS: '-Dorg.gradle.daemon=false' + # The image's git could not verify github.com ("CAfile: none") while the host runner + # reaches the same URL fine - the trust the host has is not inside the container. + # Mounting the host's bundle covers both causes: an image without ca-certificates, + # and an org TLS proxy whose CA only the host trusts. + volumes: + - /etc/ssl/certs:/etc/ssl/certs:ro permissions: contents: write outputs: sha256: ${{ steps.pack.outputs.sha256 }} steps: + # Printed before the first network step so a TLS failure carries its evidence instead + # of costing another run to diagnose. Never fails the job. + - name: Diagnose TLS trust inside the container + continue-on-error: true + run: | + echo "certs in /etc/ssl/certs: $(find /etc/ssl/certs -type f -o -type l 2>/dev/null | wc -l)" + echo "SSL_CERT_FILE=${SSL_CERT_FILE:-unset} GIT_SSL_CAINFO=${GIT_SSL_CAINFO:-unset}" + git config --get http.sslCAInfo || echo "http.sslCAInfo unset" + echo "github.com -> $(curl -sS -o /dev/null -w '%{http_code}' https://github.com 2>&1 || true)" + echo "repo1.maven.org -> $(curl -sS -o /dev/null -w '%{http_code}' https://repo1.maven.org/maven2/ 2>&1 || true)" + - uses: actions/checkout@v4 - name: Setup git safe folders From a0c17987cac35591ca2a5038cb3d6a559c3b458f Mon Sep 17 00:00:00 2001 From: Daewoon Kim Date: Fri, 11 Sep 2026 11:09:59 +0900 Subject: [PATCH 2/2] =?UTF-8?q?fix(scatterlab-prebuild-android):=20?= =?UTF-8?q?=EC=A7=84=EB=8B=A8=20curl=20=EC=97=90=20=EC=8B=9C=EA=B0=84=20?= =?UTF-8?q?=EC=A0=9C=ED=95=9C=EC=9D=84=20=EA=B1=B4=EB=8B=A4?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `continue-on-error` 는 실패를 무시할 뿐 매달린 연결을 끊지 않는다. 이 스텝은 `actions/checkout` 앞에 있어서, 응답 없는 네트워크를 만나면 잡 전체가 거기 묶인다. 진단이 잡을 막는 건 목적과 정반대다. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/scatterlab-prebuild-android.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/scatterlab-prebuild-android.yml b/.github/workflows/scatterlab-prebuild-android.yml index b1a35d169ad..afa3d72025a 100644 --- a/.github/workflows/scatterlab-prebuild-android.yml +++ b/.github/workflows/scatterlab-prebuild-android.yml @@ -156,8 +156,8 @@ jobs: echo "certs in /etc/ssl/certs: $(find /etc/ssl/certs -type f -o -type l 2>/dev/null | wc -l)" echo "SSL_CERT_FILE=${SSL_CERT_FILE:-unset} GIT_SSL_CAINFO=${GIT_SSL_CAINFO:-unset}" git config --get http.sslCAInfo || echo "http.sslCAInfo unset" - echo "github.com -> $(curl -sS -o /dev/null -w '%{http_code}' https://github.com 2>&1 || true)" - echo "repo1.maven.org -> $(curl -sS -o /dev/null -w '%{http_code}' https://repo1.maven.org/maven2/ 2>&1 || true)" + echo "github.com -> $(curl -sS -o /dev/null -w '%{http_code}' --connect-timeout 5 --max-time 30 https://github.com 2>&1 || true)" + echo "repo1.maven.org -> $(curl -sS -o /dev/null -w '%{http_code}' --connect-timeout 5 --max-time 30 https://repo1.maven.org/maven2/ 2>&1 || true)" - uses: actions/checkout@v4