From e200d850f91795d983db8a70cba800f41abfc61b Mon Sep 17 00:00:00 2001 From: Jacky Date: Tue, 29 Sep 2026 01:41:35 +0800 Subject: [PATCH] fix: trust system CA in production smoke test --- .gitea/workflows/deploy.yml | 1 + backend/common/test_deployment_security.py | 2 ++ 2 files changed, 3 insertions(+) diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml index 60c01a0..fd00ddf 100644 --- a/.gitea/workflows/deploy.yml +++ b/.gitea/workflows/deploy.yml @@ -100,6 +100,7 @@ jobs: chmod +x scripts/deploy_production.sh + SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt \ DJANGO_HSTS_AT_EDGE=true \ PROJECT_DIR="$PROJECT" \ PYTHON_BIN="$PYTHON_BIN" \ diff --git a/backend/common/test_deployment_security.py b/backend/common/test_deployment_security.py index e3fbbc0..3945e5c 100644 --- a/backend/common/test_deployment_security.py +++ b/backend/common/test_deployment_security.py @@ -12,6 +12,7 @@ def test_edge_hsts_ownership_is_explicit_and_verified(): assert 'os.getenv("DJANGO_HSTS_AT_EDGE", "false")' in settings assert '["security.W004"]' in settings assert "DJANGO_HSTS_AT_EDGE=true" in workflow + assert "SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt" in workflow assert 'DEPLOY_HEALTH_HOST="math.jacky0987.xyz"' in workflow assert 'DEPLOY_SMOKE_BASE_URL="https://math.jacky0987.xyz"' in workflow assert 'DEPLOY_SMOKE_WS_URL="wss://math.jacky0987.xyz/ws/health/"' in workflow @@ -20,4 +21,5 @@ def test_edge_hsts_ownership_is_explicit_and_verified(): assert "curl --silent --show-error --head" in deploy assert "curl --fail --silent --show-error --head" not in deploy assert "strict-transport-security:.*max-age=[1-9][0-9]*" in deploy + assert "unverified" not in deploy.lower() assert "DJANGO_HSTS_AT_EDGE=false" in example -- 2.54.0