Avoid Windows trust prompts in local HTTPS CI

Assisted-By: devx/05def498-8bdd-48d0-bd5e-35e4667a2f3d

Author: fredericoo

.github/workflows/ci.yml

@@ -86,7 +86,23 @@ jobs:
         run: pnpm install --frozen-lockfile
 
       - name: Provision local HTTPS certificate
+        if: runner.os != 'Windows'
         run: pnpm https:setup
 
+      - name: Provision local HTTPS certificate on Windows
+        if: runner.os == 'Windows'
+        shell: pwsh
+        env:
+          # GitHub-hosted runners cannot accept Windows' root-store prompt.
+          # Generate the same CA and provide it directly to Node's TLS verifier.
+          TRUST_STORES: none
+        run: |
+          pnpm https:setup
+          $rootCertificate = Join-Path $env:LOCALAPPDATA 'mkcert\rootCA.pem'
+          if (!(Test-Path $rootCertificate)) {
+            throw "mkcert root CA was not created at $rootCertificate"
+          }
+          Add-Content -Path $env:GITHUB_ENV -Value "NODE_EXTRA_CA_CERTS=$rootCertificate"
+
       - name: Verify trusted local HTTPS
         run: pnpm run test:local-https