fix(ci): add CA certificate update before checkout

The job containers don't trust the Cloudflare origin cert by
default. Install and update ca-certificates as the first step
so git can clone over HTTPS before actions/checkout runs.

.gitea/workflows/build.yml

@@ -22,6 +22,12 @@ jobs:
       DEBIAN_FRONTEND: noninteractive
 
     steps:
+      - name: Trust Cloudflare origin CA
+        run: |
+          apt-get update -qq
+          apt-get install -y --no-install-recommends ca-certificates
+          update-ca-certificates
+
       - name: Free disk space
         run: |
           echo "=== Disk usage before cleanup ==="

.gitea/workflows/release.yml

@@ -31,6 +31,12 @@ jobs:
       DEBIAN_FRONTEND: noninteractive
 
     steps:
+      - name: Trust Cloudflare origin CA
+        run: |
+          apt-get update -qq
+          apt-get install -y --no-install-recommends ca-certificates
+          update-ca-certificates
+
       - name: Free disk space
         run: |
           echo "=== Disk usage before cleanup ==="
@@ -319,6 +325,12 @@ jobs:
       BUILD_TAG: ${{ github.ref_name || inputs.tag }}
 
     steps:
+      - name: Trust Cloudflare origin CA
+        run: |
+          apt-get update -qq
+          apt-get install -y --no-install-recommends ca-certificates
+          update-ca-certificates
+
       - name: Download all artifacts
         uses: https://git.kindred-systems.com/actions/download-artifact.git@v3
         with: