When using the built-in Renovate step, in an environment that presents internal CA certs (already trusted via OneDev's conf/trust-certs) it fails in seconds with UNABLE_TO_GET_ISSUER_CERT_LOCALLY on its first call to https://<onedev-host>/~api/renovate/.

There's no CA file inside the Renovate job's container to point NODE_EXTRA_CA_CERTS at (the workspace is /onedev-build/work and no cert bundle is present), and the Renovate step has no trustCertificates option like the image build/push steps do.