fix: set NODE_EXTRA_CA_CERTS for artifact upload/download actions

Node.js actions (checkout, cache, upload-artifact, download-artifact)
use their own TLS stack and don't trust the system CA store. Setting
NODE_EXTRA_CA_CERTS points Node to the system bundle which includes
the Cloudflare origin CA.

.gitea/workflows/build.yml

@@ -20,6 +20,7 @@ jobs:
       CCACHE_SLOPPINESS: "include_file_ctime,include_file_mtime,pch_defines,time_macros"
       CCACHE_BASEDIR: ${{ github.workspace }}
       DEBIAN_FRONTEND: noninteractive
+      NODE_EXTRA_CA_CERTS: /etc/ssl/certs/ca-certificates.crt
 
     steps:
       - name: Trust Cloudflare origin CA

.gitea/workflows/release.yml

@@ -29,6 +29,7 @@ jobs:
       CFLAGS: "-O3"
       CXXFLAGS: "-O3"
       DEBIAN_FRONTEND: noninteractive
+      NODE_EXTRA_CA_CERTS: /etc/ssl/certs/ca-certificates.crt
 
     steps:
       - name: Trust Cloudflare origin CA
@@ -323,6 +324,7 @@ jobs:
 
     env:
       BUILD_TAG: ${{ github.ref_name || inputs.tag }}
+      NODE_EXTRA_CA_CERTS: /etc/ssl/certs/ca-certificates.crt
 
     steps:
       - name: Trust Cloudflare origin CA