fix: add insecure=true to GitHub provider; install GHE CA cert in bui…

…ldspec

codebuild/buildspec.yml

@@ -34,6 +34,21 @@ phases:
       - |
         curl -sLo /tmp/tf.zip "https://releases.hashicorp.com/terraform/${TF_VERSION}/terraform_${TF_VERSION}_linux_amd64.zip"
       - unzip -q /tmp/tf.zip -d /usr/local/bin && rm /tmp/tf.zip
+      - echo "Installing GHE CA certificate into system trust store..."
+      - |
+        # Extract full cert chain from the GHE endpoint and install so the
+        # Terraform GitHub provider (Go TLS) trusts the internal CA.
+        # Uses HTTPS_PROXY via curl; openssl parses the PEM from the output.
+        curl -vsk --proxy "${HTTPS_PROXY}" \
+          https://github.e.it.census.gov 2>&1 \
+          | awk '/-----BEGIN CERTIFICATE-----/,/-----END CERTIFICATE-----/' \
+          > /usr/local/share/ca-certificates/ghe-internal.crt
+        if [ -s /usr/local/share/ca-certificates/ghe-internal.crt ]; then
+          update-ca-certificates --fresh
+          echo "GHE CA cert installed."
+        else
+          echo "WARNING: could not extract GHE cert; TLS verification may fail for GitHub provider."
+        fi
       - terraform version
       - echo "Installing tf wrapper script from repo..."
       - cp codebuild/tf /usr/local/bin/tf

providers.tf

@@ -15,6 +15,7 @@ terraform {
 provider "github" {
   owner    = var.repo_org
   base_url = var.base_url
+  insecure = true # GHE uses an internal CA not trusted by default
   # token is automatically read from GITHUB_TOKEN env var
 }