From ed030e4830934f2089a3f4e0955ed38f41ee9267 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Wed, 12 Aug 2026 06:50:15 +0000
Subject: [PATCH] ci: pass --use-system-ca to paths-filter under Node 24

Detect changes failed intermittently with a self-signed certificate
error when dorny/paths-filter (node20 action forced onto Node 24)
called the GitHub API. Set NODE_OPTIONS=--use-system-ca on those steps.

Co-authored-by: Rip&Tear <theCyberTech@users.noreply.github.com>
---
 .github/workflows/linter.yml             | 3 +++
 .github/workflows/tests.yml              | 3 +++
 .github/workflows/type-checker.yml       | 3 +++
 .github/workflows/vulnerability-scan.yml | 3 +++
 4 files changed, 12 insertions(+)

diff --git a/.github/workflows/linter.yml b/.github/workflows/linter.yml
index 7c99c7476c..4dd7e67741 100644
--- a/.github/workflows/linter.yml
+++ b/.github/workflows/linter.yml
@@ -15,6 +15,9 @@ jobs:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       - uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590 # v3
         id: filter
+        env:
+          # Node 24 (forced for node20 actions) may not trust system CAs by default.
+          NODE_OPTIONS: --use-system-ca
         with:
           # Exclusion-only patterns match every non-excluded file under the
           # default "some" quantifier. Require all patterns (including "**")
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index e3a34e94c5..2b06695a78 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -15,6 +15,9 @@ jobs:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       - uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590 # v3
         id: filter
+        env:
+          # Node 24 (forced for node20 actions) may not trust system CAs by default.
+          NODE_OPTIONS: --use-system-ca
         with:
           # Exclusion-only patterns match every non-excluded file under the
           # default "some" quantifier. Require all patterns (including "**")
diff --git a/.github/workflows/type-checker.yml b/.github/workflows/type-checker.yml
index 9cb6889247..c064931b34 100644
--- a/.github/workflows/type-checker.yml
+++ b/.github/workflows/type-checker.yml
@@ -15,6 +15,9 @@ jobs:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       - uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590 # v3
         id: filter
+        env:
+          # Node 24 (forced for node20 actions) may not trust system CAs by default.
+          NODE_OPTIONS: --use-system-ca
         with:
           # Exclusion-only patterns match every non-excluded file under the
           # default "some" quantifier. Require all patterns (including "**")
diff --git a/.github/workflows/vulnerability-scan.yml b/.github/workflows/vulnerability-scan.yml
index 0c760c6baa..8ce2e72838 100644
--- a/.github/workflows/vulnerability-scan.yml
+++ b/.github/workflows/vulnerability-scan.yml
@@ -23,6 +23,9 @@ jobs:
       - uses: dorny/paths-filter@d1c1ffe0248fe513906c8e24db8ea791d46f8590 # v3
         id: filter
         if: github.event_name == 'pull_request'
+        env:
+          # Node 24 (forced for node20 actions) may not trust system CAs by default.
+          NODE_OPTIONS: --use-system-ca
         with:
           # Exclusion-only patterns match every non-excluded file under the
           # default "some" quantifier. Require all patterns (including "**")