Add mTLS client certificate support for proxy authentication

[dhawalseth]

Summary

Add support for configuring TLS client certificates when connecting through proxies that require mTLS authentication.

• Adds environment variable support for mTLS proxy configuration:
  • HTTPS_PROXY_CLIENT_CERT: Path to client certificate file (PEM format)
  • HTTPS_PROXY_CLIENT_KEY: Path to client private key file (PEM format)
  • HTTPS_PROXY_CA_CERT: Path to CA certificate file (PEM format)
• Updates RunnerWebProxy to read and expose these certificate paths
• Updates HttpClientHandlerFactory to load X509 certificates and configure HttpClientHandler.ClientCertificates
• Supports both uppercase and lowercase environment variable names for consistency with existing proxy variables

Use Case

Enterprise environments often use mTLS proxies (like Kraken, Envoy with mTLS, or corporate forward proxies) that require clients to present certificates for authentication. This change enables the GitHub Actions runner to work in such environments.

Example Usage

export HTTPS_PROXY="http://proxy.corp.example.com:8080"
export HTTPS_PROXY_CLIENT_CERT="/etc/runner/certs/client.crt"
export HTTPS_PROXY_CLIENT_KEY="/etc/runner/certs/client.key"
export HTTPS_PROXY_CA_CERT="/etc/runner/certs/ca.crt"

./run.sh

Related PRs

This is part of a broader effort to add mTLS proxy support across the GitHub Actions ecosystem:

• actions-runner-controller PR: #4498
• scaleset PR: #101

Test plan

• Added unit tests for HTTPS_PROXY_CLIENT_CERT, HTTPS_PROXY_CLIENT_KEY, HTTPS_PROXY_CA_CERT environment variable parsing
• Added tests for lowercase environment variable variants
• Error handling for missing or invalid certificate files

🤖 Generated with Claude Code