fix(cli): apply extraCACerts on deploy by princejain756 · Pull Request #5053 · triggerdotdev/trigger.dev

princejain756 · 2026-10-22T18:50:00Z

Summary

resolvedConfig.extraCACerts was never passed to buildImage(), so the generated Containerfile set NODE_EXTRA_CA_CERTS= (empty) and Node ignored the configured CA bundle at runtime.

Two pieces were missing:

The CA file never entered the deployment image. validateConfig now appends the additionalFiles build extension for config.extraCACerts, the same mechanism the deprecated additionalFiles config option already uses, so the file is copied into the build output.
deploy did not pass the option to buildImage. It now passes resolveExtraCACertsImagePath(resolvedConfig.extraCACerts, resolvedConfig.workingDir), which maps the project-relative path to its location under /app in the image using the same rules as copyFiles.ts (leading ./ and ../ segments stripped, absolute paths relativized to the working dir).

Test plan

4 new unit tests for resolveExtraCACertsImagePath in buildImage.test.ts (undefined, project-relative, leading ../, absolute)
Verified the resolver against 6 input shapes with tsx since the workspace test run is not possible in this sparse checkout (@trigger.dev/database is pruned, so packages/core cannot build for vitest); oxlint and oxfmt pass on all touched files

resolvedConfig.extraCACerts was never passed to buildImage(), so the generated Containerfile set NODE_EXTRA_CA_CERTS to an empty value and Node ignored the configured CA bundle at runtime. The CA file is now copied into the build output via the additionalFiles extension, and the deploy command passes its image path (resolved the same way additionalFiles maps files under /app) as the NODE_EXTRA_CA_CERTS build arg. Fixes triggerdotdev#5028

changeset-bot · 2026-10-22T18:50:05Z

🦋 Changeset detected

Latest commit: 4f03f71

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 30 packages

Name	Type
trigger.dev	Patch
@internal/dashboard-agent	Patch
@trigger.dev/build	Patch
@trigger.dev/core	Patch
@trigger.dev/linear	Patch
@trigger.dev/python	Patch
@trigger.dev/react-hooks	Patch
@trigger.dev/redis-worker	Patch
@trigger.dev/rsc	Patch
@trigger.dev/schema-to-json	Patch
@trigger.dev/slack	Patch
@trigger.dev/sdk	Patch
@trigger.dev/billing	Patch
@trigger.dev/database	Patch
@trigger.dev/otlp-importer	Patch
@trigger.dev/rbac	Patch
@trigger.dev/sso	Patch
@internal/clickhouse	Patch
@internal/llm-model-catalog	Patch
@internal/metrics-pipeline	Patch
@internal/redis	Patch
@internal/replication	Patch
@internal/run-engine	Patch
@internal/run-store	Patch
@internal/schedule-engine	Patch
@internal/tracing	Patch
@internal/webhook-engine	Patch
@internal/webhook-sources	Patch
@internal/testcontainers	Patch
@internal/cache	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

github-actions · 2026-10-22T18:50:16Z

Hi @princejain756, thanks for your interest in contributing!

This project requires that pull request authors are vouched, and you are not in the list of vouched users.

This PR will be closed automatically. See https://github.com/triggerdotdev/trigger.dev/blob/main/CONTRIBUTING.md for more details.

coderabbitai · 2026-10-22T18:50:22Z

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Repository UI
Review profile: CHILL
Plan: Advanced
Run ID: 16e927e2-2070-48e4-b402-ebd240966a86

📥 Commits

Reviewing files that changed from the base of the PR and between 8491915 and 4f03f71.

📒 Files selected for processing: 5

.changeset/extra-ca-certs-deploy.md
packages/cli-v3/src/commands/deploy.ts
packages/cli-v3/src/config.ts
packages/cli-v3/src/deploy/buildImage.test.ts
packages/cli-v3/src/deploy/buildImage.ts

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

devin-ai-integration

Devin Review found 3 potential issues.

devin-ai-integration · 2026-10-22T18:52:18Z

handleNativeBuildServerDeploy

+    extraCACerts: resolveExtraCACertsImagePath(
+      resolvedConfig.extraCACerts,
+      resolvedConfig.workingDir
+    ),


🔴 Native deployments ignore configured CA certificates

For native or local-bundle deployments, extraCACerts copies the certificate but never sets its image path. Both paths return before buildImage, leaving NODE_EXTRA_CA_CERTS empty in deployed tasks.

Learn more

The CLI selects its build path before this call. handleNativeBuildServerDeploy uploads source for a server-side build, while handleLocalBundleDeploy uploads the already bundled output. Both return without calling buildImage, so the new build argument only reaches the Depot and local Docker paths. The certificate is included by the new extension, but the generated Containerfile still sets NODE_EXTRA_CA_CERTS from an unset build argument.

Example: A project with extraCACerts: "./certs/corp.pem" and the native build path uploads corp.pem. Its deployed tasks start with NODE_EXTRA_CA_CERTS= rather than /app/certs/corp.pem.

Recommended fix: Carry the resolved CA image path through both native deployment requests and set NODE_EXTRA_CA_CERTS in their image-build arguments. Preserve the path through the local-bundle request and verify both build paths with an actual certificate.

Was this helpful? React with 👍 or 👎 to provide feedback.

devin-ai-integration · 2026-10-22T18:52:20Z

findFilesByMatchers

+  const segments = projectRelativePath
+    .split(/[\\/]+/)
+    .filter((segment) => segment && segment !== "." && segment !== "..");
+
+  return `/app/${segments.join("/")}`;


🟡 Parent segments misroute deployed CA files

With extraCACerts: "./certs/../root.pem", resolveExtraCACertsImagePath returns /app/certs/root.pem. The file copier normalizes that path and places the certificate at /app/root.pem, so tasks cannot load it.

Learn more

The certificate copier findFilesByMatchers resolves the matched file and then calculates its destination relative to the project root. This resolves an internal .. segment before copying. The new resolver simply removes .., leaving the preceding folder in the image path.

Example: With a project root of /project and extraCACerts: "./certs/../root.pem", the copier writes /app/root.pem, while NODE_EXTRA_CA_CERTS points at /app/certs/root.pem.

Recommended fix: Normalize the relative input against workingDir with resolve, derive its project-relative destination as the copier does, then strip only leading parent segments.

Was this helpful? React with 👍 or 👎 to provide feedback.

devin-ai-integration · 2026-10-22T18:52:21Z

+"trigger.dev": patch
+---
+
+Fix `extraCACerts` in `trigger.config.ts` having no effect on deployed tasks. The configured CA file is now copied into the deployment image via the `additionalFiles` build extension, and the deploy command passes its image path to the `NODE_EXTRA_CA_CERTS` build argument, so self-signed or corporate certificates are trusted at runtime.


🟡 Release note exposes build internals

The extraCACerts changeset describes build extensions and arguments instead of leading with the user-visible trust fix. Customers receive this implementation detail verbatim in the changelog.

Suggested change

Fix `extraCACerts` in `trigger.config.ts` having no effect on deployed tasks. The configured CA file is now copied into the deployment image via the `additionalFiles` build extension, and the deploy command passes its image path to the `NODE_EXTRA_CA_CERTS` build argument, so self-signed or corporate certificates are trusted at runtime.

Deployed tasks now trust custom CA certificates configured with `extraCACerts`.

Was this helpful? React with 👍 or 👎 to provide feedback.

github-actions Bot closed this Oct 22, 2026

devin-ai-integration Bot reviewed Oct 22, 2026

View reviewed changes

Navigation Menu

Repository navigation

fix(cli): apply extraCACerts on deploy - #5053

fix(cli): apply extraCACerts on deploy#5053
princejain756 wants to merge 1 commit into
triggerdotdev:mainfrom
princejain756:fix-extra-ca-certs-deploy

princejain756 commented Oct 22, 2026

Uh oh!

changeset-bot Bot commented Oct 22, 2026

Uh oh!

github-actions Bot commented Oct 22, 2026

Uh oh!

coderabbitai Bot commented Oct 22, 2026

Uh oh!

devin-ai-integration Bot left a comment

Uh oh!

devin-ai-integration Bot Oct 22, 2026

Uh oh!

devin-ai-integration Bot Oct 22, 2026

Uh oh!

devin-ai-integration Bot Oct 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

	Fix `extraCACerts` in `trigger.config.ts` having no effect on deployed tasks. The configured CA file is now copied into the deployment image via the `additionalFiles` build extension, and the deploy command passes its image path to the `NODE_EXTRA_CA_CERTS` build argument, so self-signed or corporate certificates are trusted at runtime.
	Deployed tasks now trust custom CA certificates configured with `extraCACerts`.

Conversation

princejain756 commented Oct 22, 2026

Summary

Test plan

Uh oh!

changeset-bot Bot commented Oct 22, 2026

🦋 Changeset detected

Uh oh!

github-actions Bot commented Oct 22, 2026

Uh oh!

coderabbitai Bot commented Oct 22, 2026

Uh oh!

devin-ai-integration Bot left a comment

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration Bot Oct 22, 2026

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration Bot Oct 22, 2026

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration Bot Oct 22, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant