fix: trust system CA in production smoke test (#46)

.gitea/workflows/deploy.yml

@@ -100,6 +100,7 @@ jobs:
 
           chmod +x scripts/deploy_production.sh
 
+          SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt \
           DJANGO_HSTS_AT_EDGE=true \
           PROJECT_DIR="$PROJECT" \
           PYTHON_BIN="$PYTHON_BIN" \

backend/common/test_deployment_security.py

@@ -12,6 +12,7 @@ def test_edge_hsts_ownership_is_explicit_and_verified():
     assert 'os.getenv("DJANGO_HSTS_AT_EDGE", "false")' in settings
     assert '["security.W004"]' in settings
     assert "DJANGO_HSTS_AT_EDGE=true" in workflow
+    assert "SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt" in workflow
     assert 'DEPLOY_HEALTH_HOST="math.jacky0987.xyz"' in workflow
     assert 'DEPLOY_SMOKE_BASE_URL="https://math.jacky0987.xyz"' in workflow
     assert 'DEPLOY_SMOKE_WS_URL="wss://math.jacky0987.xyz/ws/health/"' in workflow
@@ -20,4 +21,5 @@ def test_edge_hsts_ownership_is_explicit_and_verified():
     assert "curl --silent --show-error --head" in deploy
     assert "curl --fail --silent --show-error --head" not in deploy
     assert "strict-transport-security:.*max-age=[1-9][0-9]*" in deploy
+    assert "unverified" not in deploy.lower()
     assert "DJANGO_HSTS_AT_EDGE=false" in example