ci: limit test-sfw to ubuntu-latest, document sfw rustls TLS limitation

sfw v1.10.0 issues a CA cert with a present-but-empty EKU extension.
OpenSSL accepts it; rustls (vp's TLS stack), Go crypto/x509, and other
strict implementations reject it as UnknownIssuer. So `vp install`
through sfw works on Ubuntu only because pnpm is preinstalled and vp
skips the bootstrap fetch. On macOS / Windows, vp must fetch
`https://registry.npmjs.org/pnpm/latest` and the handshake fails before
sfw can inspect the install.

Action still installs the sfw binary on all OSes (asset mapping unit-
tested) so users can call `sfw npm ci` directly; only setup-vp's own
run-install path is Linux-verified for now.

Tracking upstream:
  SocketDev/sfw-free#30
  SocketDev/sfw-free#43

Author: fengmk2

.github/workflows/test.yml

@@ -293,12 +293,20 @@ jobs:
         run: vp exec node -e "console.log('vp exec works in Alpine')"
 
   test-sfw:
+    # Linux-only: sfw's MITM proxy issues a CA cert with a present-but-empty
+    # EKU extension. OpenSSL accepts it, but rustls / Go's crypto/x509 reject
+    # it as UnknownIssuer. vp is a Rust binary (rustls), so on macOS / Windows
+    # any HTTPS call vp makes through sfw fails the TLS handshake before sfw
+    # can inspect the install. Ubuntu happens to work because pnpm is
+    # preinstalled on the runner and vp skips its bootstrap fetch.
+    # Tracking upstream:
+    #   https://github.com/SocketDev/sfw-free/issues/30
+    #   https://github.com/SocketDev/sfw-free/issues/43
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
         version: [latest, alpha]
-    runs-on: ${{ matrix.os }}
+    runs-on: ubuntu-latest
     steps:
       - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
 

README.md

@@ -151,6 +151,9 @@ steps:
 
 `sfw` is only applied when `run-install` is enabled; other `vp` commands (e.g. `vp env use`, `vp --version`) run unwrapped.
 
+> [!IMPORTANT]
+> **Linux-only on hosted GitHub runners.** `sfw` ships a self-signed CA whose certificate has an empty Extended Key Usage extension. Strict TLS stacks like rustls (used by `vp`) reject this as `UnknownIssuer`, so `vp install` fails the TLS handshake on macOS / Windows runners (which have to bootstrap pnpm through `sfw`'s proxy). Ubuntu runners work because pnpm is preinstalled, letting `vp install` skip the bootstrap fetch. The action will still install the `sfw` binary on macOS / Windows so users can call it directly (e.g. `sfw npm ci` in a follow-up step), but `setup-vp`'s own `run-install` step is only verified end-to-end on Linux. Track upstream at [SocketDev/sfw-free#30](https://github.com/SocketDev/sfw-free/issues/30) and [#43](https://github.com/SocketDev/sfw-free/issues/43).
+
 ### Alpine Container
 
 Alpine Linux uses musl libc instead of glibc. Install compatibility packages before using the action: