fix: install ca-certificates before wget, clean apt after download (#2434)

Co-authored-by: Mariano Fuentes <marfuen98@gmail.com>

Author: github-actions[bot]

.github/workflows/trigger-tasks-deploy-main.yml

@@ -36,9 +36,9 @@ jobs:
       - name: Copy schema to app and generate client
         working-directory: ./apps/app
         run: |
-          mkdir -p prisma
-          cp ../../packages/db/dist/schema.prisma prisma/schema.prisma
-          bunx prisma generate
+          mkdir -p prisma/schema
+          find ../../packages/db/prisma/schema -name '*.prisma' ! -name 'schema.prisma' -exec cp {} prisma/schema/ \;
+          bunx prisma generate --schema=prisma/schema
       - name: 🚀 Deploy Trigger.dev
         working-directory: ./apps/app
         timeout-minutes: 20

.github/workflows/trigger-tasks-deploy-release.yml

@@ -42,9 +42,9 @@ jobs:
       - name: Copy schema to app and generate client
         working-directory: ./apps/app
         run: |
-          mkdir -p prisma
-          cp ../../packages/db/dist/schema.prisma prisma/schema.prisma
-          bunx prisma generate
+          mkdir -p prisma/schema
+          find ../../packages/db/prisma/schema -name '*.prisma' ! -name 'schema.prisma' -exec cp {} prisma/schema/ \;
+          bunx prisma generate --schema=prisma/schema
 
       - name: 🚀 Deploy Trigger.dev
         working-directory: ./apps/app

apps/api/prisma/client.ts

@@ -6,7 +6,11 @@ const globalForPrisma = global as unknown as { prisma: PrismaClient };
 function createPrismaClient(): PrismaClient {
   const url = process.env.DATABASE_URL!;
   const isLocalhost = /localhost|127\.0\.0\.1|::1/.test(url);
-  const adapter = new PrismaPg({ connectionString: url, ssl: isLocalhost ? undefined : true });
+  // Use verified SSL when NODE_EXTRA_CA_CERTS is set (Docker with RDS CA bundle),
+  // otherwise fall back to unverified SSL (Trigger.dev, Vercel, other environments).
+  const hasCABundle = !!process.env.NODE_EXTRA_CA_CERTS;
+  const ssl = isLocalhost ? undefined : hasCABundle ? true : { rejectUnauthorized: false };
+  const adapter = new PrismaPg({ connectionString: url, ssl });
   return new PrismaClient({ adapter });
 }
 

apps/app/prisma/client.ts

@@ -6,7 +6,11 @@ const globalForPrisma = global as unknown as { prisma: PrismaClient };
 function createPrismaClient(): PrismaClient {
   const url = process.env.DATABASE_URL!;
   const isLocalhost = /localhost|127\.0\.0\.1|::1/.test(url);
-  const adapter = new PrismaPg({ connectionString: url, ssl: isLocalhost ? undefined : true });
+  // Use verified SSL when NODE_EXTRA_CA_CERTS is set (Docker with RDS CA bundle),
+  // otherwise fall back to unverified SSL (Trigger.dev, Vercel, other environments).
+  const hasCABundle = !!process.env.NODE_EXTRA_CA_CERTS;
+  const ssl = isLocalhost ? undefined : hasCABundle ? true : { rejectUnauthorized: false };
+  const adapter = new PrismaPg({ connectionString: url, ssl });
   return new PrismaClient({ adapter });
 }
 

apps/framework-editor/prisma/client.ts

@@ -6,7 +6,11 @@ const globalForPrisma = global as unknown as { prisma: PrismaClient };
 function createPrismaClient(): PrismaClient {
   const url = process.env.DATABASE_URL!;
   const isLocalhost = /localhost|127\.0\.0\.1|::1/.test(url);
-  const adapter = new PrismaPg({ connectionString: url, ssl: isLocalhost ? undefined : true });
+  // Use verified SSL when NODE_EXTRA_CA_CERTS is set (Docker with RDS CA bundle),
+  // otherwise fall back to unverified SSL (Trigger.dev, Vercel, other environments).
+  const hasCABundle = !!process.env.NODE_EXTRA_CA_CERTS;
+  const ssl = isLocalhost ? undefined : hasCABundle ? true : { rejectUnauthorized: false };
+  const adapter = new PrismaPg({ connectionString: url, ssl });
   return new PrismaClient({ adapter });
 }
 

apps/portal/prisma/client.ts

@@ -6,7 +6,11 @@ const globalForPrisma = global as unknown as { prisma: PrismaClient };
 function createPrismaClient(): PrismaClient {
   const url = process.env.DATABASE_URL!;
   const isLocalhost = /localhost|127\.0\.0\.1|::1/.test(url);
-  const adapter = new PrismaPg({ connectionString: url, ssl: isLocalhost ? undefined : true });
+  // Use verified SSL when NODE_EXTRA_CA_CERTS is set (Docker with RDS CA bundle),
+  // otherwise fall back to unverified SSL (Trigger.dev, Vercel, other environments).
+  const hasCABundle = !!process.env.NODE_EXTRA_CA_CERTS;
+  const ssl = isLocalhost ? undefined : hasCABundle ? true : { rejectUnauthorized: false };
+  const adapter = new PrismaPg({ connectionString: url, ssl });
   return new PrismaClient({ adapter });
 }
 

packages/db/scripts/combine-schemas.js

@@ -57,7 +57,9 @@ const globalForPrisma = global as unknown as { prisma: PrismaClient };
 function createPrismaClient(): PrismaClient {
   const url = process.env.DATABASE_URL!;
   const isLocalhost = /localhost|127\\.0\\.0\\.1|::1/.test(url);
-  const adapter = new PrismaPg({ connectionString: url, ssl: isLocalhost ? undefined : true });
+  const hasCABundle = !!process.env.NODE_EXTRA_CA_CERTS;
+  const ssl = isLocalhost ? undefined : hasCABundle ? true : { rejectUnauthorized: false };
+  const adapter = new PrismaPg({ connectionString: url, ssl });
   return new PrismaClient({ adapter });
 }
 

packages/db/src/client.ts

@@ -6,7 +6,11 @@ const globalForPrisma = global as unknown as { prisma: PrismaClient };
 function createPrismaClient(): PrismaClient {
   const url = process.env.DATABASE_URL!;
   const isLocalhost = /localhost|127\.0\.0\.1|::1/.test(url);
-  const adapter = new PrismaPg({ connectionString: url, ssl: isLocalhost ? undefined : true });
+  // Use verified SSL when NODE_EXTRA_CA_CERTS is set (Docker with RDS CA bundle),
+  // otherwise fall back to unverified SSL (Trigger.dev, Vercel, other environments).
+  const hasCABundle = !!process.env.NODE_EXTRA_CA_CERTS;
+  const ssl = isLocalhost ? undefined : hasCABundle ? true : { rejectUnauthorized: false };
+  const adapter = new PrismaPg({ connectionString: url, ssl });
   return new PrismaClient({ adapter });
 }