fix(acs-ci): configure gsutil Boto CA bundle

[robbycochran]

Configure gsutil through BOTO_CONFIG with the OpenShell CA bundle. The Cloud SDK custom CA variable does not reach this standalone gsutil; put the setting in the Boto config used by both the preflight and main ACS task. Run the Jira probe first so the two checks report independently.

Summary by CodeRabbit

• Bug Fixes
  • Improved certificate validation for cloud storage connectivity checks in nightly workflows.
  • Updated preflight checks to apply the appropriate certificate authority bundle, reducing false connectivity failures.
  • Adjusted the order of connectivity checks so issue reporting is more consistent while preserving existing timeout and failure handling.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 5f428876-0108-4815-b7de-b09cd91d44d7

📥 Commits

Reviewing files that changed from the base of the PR and between 333da24 and 8fd8b36.

📒 Files selected for processing (2)

• tasks/acs-ci-nightly/workflow/harness.yaml
• tasks/acs-ci-nightly/workflow/preflight.yaml

Included review availability: Your plan provides up to 12 included reviews per hour; 7 remain after this review.

---

Walkthrough

The nightly harness and preflight workflows configure Boto to use the OpenShell CA bundle. The preflight workflow now runs the Jira connectivity check before the GCS bucket check.

Changes

Boto and preflight workflow updates

Layer / File(s)	Summary
Configure Boto CA validation tasks/acs-ci-nightly/workflow/harness.yaml, tasks/acs-ci-nightly/workflow/preflight.yaml	Both workflows set BOTO_CONFIG and write a Boto configuration that uses /etc/openshell-tls/ca-bundle.pem.
Reorder preflight checks tasks/acs-ci-nightly/workflow/preflight.yaml	The Jira check runs before the GCS check. The GCS check retains its 30-second timeout, error capture, limited error output, status reporting, and failure behavior.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 8fd8b

The workflows use the documented OpenShell CA-bundle contract, and the preflight ordering and failure handling remain intact.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: configuring the standalone gsutil Boto CA bundle for ACS CI workflows.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

[stackrox-openshell-workflow]

Using a predictable filename in /tmp can lead to a race condition. A malicious actor could create a symbolic link at this path to trick the application into overwriting an arbitrary file or using a malicious Boto configuration. It is safer to create this file in a more secure, less predictable location, for instance under the /sandbox directory.

[stackrox-openshell-workflow]

Using a predictable filename in /tmp can lead to a race condition. A malicious actor could create a symbolic link at this path to trick the application into overwriting an arbitrary file or using a malicious Boto configuration. It is safer to create this file in a more secure, less predictable location, for instance under the /sandbox directory.