From b676f43afe9e79f7933ce1c959512635465a1e90 Mon Sep 17 00:00:00 2001
From: Bernardo Magri <bernardo@bernardomagri.eu>
Date: Fri, 29 May 2026 22:00:03 +0100
Subject: [PATCH] ci: fix root single-user Nix install (nixbld group + SSL
 cert)

The single-user installer, running as root in the catthehacker container,
aborts because its bundled nix.conf sets build-users-group=nixbld and the
group doesn't exist ("the group 'nixbld' ... does not exist"). Pre-create
an empty nixbld group so config validation passes; single-user builds run
as root and never use it. Also set NIX_SSL_CERT_FILE at the job level
since we add nix to PATH without sourcing the installer profile that would
otherwise export it.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .gitea/workflows/check.yml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/.gitea/workflows/check.yml b/.gitea/workflows/check.yml
index 9e526c4..bf4b933 100644
--- a/.gitea/workflows/check.yml
+++ b/.gitea/workflows/check.yml
@@ -28,8 +28,11 @@ jobs:
     runs-on: ubuntu-latest
     # Flakes for every `nix` invocation in the job (the bare `nix flake
     # check` below relies on this; the scripts pass the flag themselves).
+    # NIX_SSL_CERT_FILE because we add nix to PATH without sourcing the
+    # installer's profile (which is what normally exports it).
     env:
       NIX_CONFIG: "experimental-features = nix-command flakes"
+      NIX_SSL_CERT_FILE: /etc/ssl/certs/ca-certificates.crt
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -40,7 +43,13 @@ jobs:
         # moved to node24 ("runs.using ... got node24"). A run step has no
         # node-runtime coupling. Single-user (--no-daemon) needs no systemd,
         # which the catthehacker container doesn't run as PID 1.
+        #
+        # The installer runs as root here and validates build-users-group=
+        # nixbld from its bundled nix.conf even in single-user mode, aborting
+        # if the group is missing. Pre-create an empty nixbld group so that
+        # check passes — single-user builds run as root and never use it.
         run: |
+          groupadd -r nixbld || true
           curl -L https://nixos.org/nix/install | sh -s -- --no-daemon
           echo "$HOME/.nix-profile/bin" >> "$GITHUB_PATH"