From 2539fd01e8474bb65468c8299f4555efef5fcc79 Mon Sep 17 00:00:00 2001
From: Thore Cimbal <cfx@riot.8shield.net>
Date: Tue, 11 Aug 2026 12:00:00 +0000
Subject: [PATCH] ci(gruppenpruefung): trust the lab CA for the git.lab API
 call

The job got past the git fix but then failed the urllib call to https://git.lab
with CERTIFICATE_VERIFY_FAILED: gruppenpruefung.py uses urllib's default trust,
which in python:3.12-alpine does not include the private aXionLabs CA. Point
SSL_CERT_FILE at the repo's ci/lab-ca-chain.crt (the same chain curl --cacert
uses); Python honours it in the default SSL context. Verified locally: the
context loads the 2 lab CA certs.
---
 .gitlab-ci.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index ee6d8d0..2c0752a 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -62,6 +62,10 @@ gruppenpruefung:
   rules:
     - if: $CI_PIPELINE_SOURCE == "schedule"
     - if: $CI_PIPELINE_SOURCE == "web"
+  variables:
+    # gruppenpruefung.py spricht die git.lab-API per urllib an; git.lab läuft
+    # über die private aXionLabs-CA. Python honoriert SSL_CERT_FILE im Default-Context.
+    SSL_CERT_FILE: "$CI_PROJECT_DIR/ci/lab-ca-chain.crt"
   before_script:
     - apk add --no-cache git >/dev/null   # gruppenpruefung.py ruft 'git log' auf
   script: