From 7b265b83384a0cd3347c31a1b3f5a00f30e9f699 Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Fri, 21 Aug 2026 15:55:23 -0700
Subject: [PATCH] fix(ci): mount /docker-certs/client into the build job
 container

---
 .gitea/workflows/build.yaml | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/.gitea/workflows/build.yaml b/.gitea/workflows/build.yaml
index d97feb1..9d2213f 100644
--- a/.gitea/workflows/build.yaml
+++ b/.gitea/workflows/build.yaml
@@ -18,10 +18,18 @@ jobs:
     runs-on: docker
     container:
       image: docker:27-cli
-      # The runner's dind sidecar shares the pod network and the mTLS cert
-      # emptyDir, so the daemon is reachable on localhost with the client certs
-      # dind generated at startup.
+      # The runner's dind sidecar shares the pod network, so the daemon is
+      # reachable on localhost -- that part needs no extra config. The mTLS
+      # certs dind generates at startup do NOT come along for free, though:
+      # they live in an emptyDir mounted into the runner/dind containers, not
+      # into containers a workflow spins up. Job containers get no bind mounts
+      # at all unless the path is in the runner's container.valid_volumes
+      # allowlist (empty by default -- confirmed live, this exact mount was
+      # rejected until the runner's Helm chart added a config.yaml scoping
+      # valid_volumes to exactly this path).
       options: --network host
+      volumes:
+        - /docker-certs/client:/docker-certs/client:ro
     env:
       DOCKER_HOST: tcp://localhost:2376
       DOCKER_TLS_VERIFY: "1"