fix: also inject internal CA into BuildKit system CA store

.gitea/workflows/rsyncd.yaml

@@ -38,6 +38,23 @@ jobs:
             [registry."harbor.lan"]
               ca=["/tmp/buildkit-certs/harbor-ca.pem"]
 
+      - name: Trust internal CA in BuildKit system store
+        run: |
+          BUILDER=$(docker ps --filter "name=buildx_buildkit" --format "{{.Names}}" | head -1)
+          echo "Builder: $BUILDER"
+          docker exec "$BUILDER" sh -c '
+            echo "--- cert landscape ---"
+            ls -la /etc/ssl/ /etc/ssl/certs/ 2>/dev/null | head -15
+            for f in /etc/ssl/certs/ca-certificates.crt /etc/ssl/cert.pem; do
+              [ -e "$f" ] || continue
+              cat /etc/buildkit/certs/harbor.lan/harbor-ca.pem >> "$f"
+              echo "Appended CA to $f"
+              break
+            done
+          '
+          docker restart "$BUILDER"
+          sleep 5
+
       - name: Build and push image
         uses: docker/build-push-action@v6
         with:

.gitea/workflows/telegraf-snmp.yaml

@@ -38,6 +38,23 @@ jobs:
             [registry."harbor.lan"]
               ca=["/tmp/buildkit-certs/harbor-ca.pem"]
 
+      - name: Trust internal CA in BuildKit system store
+        run: |
+          BUILDER=$(docker ps --filter "name=buildx_buildkit" --format "{{.Names}}" | head -1)
+          echo "Builder: $BUILDER"
+          docker exec "$BUILDER" sh -c '
+            echo "--- cert landscape ---"
+            ls -la /etc/ssl/ /etc/ssl/certs/ 2>/dev/null | head -15
+            for f in /etc/ssl/certs/ca-certificates.crt /etc/ssl/cert.pem; do
+              [ -e "$f" ] || continue
+              cat /etc/buildkit/certs/harbor.lan/harbor-ca.pem >> "$f"
+              echo "Appended CA to $f"
+              break
+            done
+          '
+          docker restart "$BUILDER"
+          sleep 5
+
       - name: Build and push image
         uses: docker/build-push-action@v6
         with: