From 02f6a5cb98fd4f6fd1a4b80d00bdae7cc2fd0adb Mon Sep 17 00:00:00 2001
From: xj <gh-xj@users.noreply.github.com>
Date: Tue, 3 Mar 2026 01:19:31 -0800
Subject: [PATCH 1/2] fix(release): isolate rust toolchain homes in pub-release

---
 .github/workflows/pub-release.yml | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/.github/workflows/pub-release.yml b/.github/workflows/pub-release.yml
index bfda91146..f0f64408b 100644
--- a/.github/workflows/pub-release.yml
+++ b/.github/workflows/pub-release.yml
@@ -183,6 +183,9 @@ jobs:
         needs: [prepare]
         runs-on: ${{ matrix.os }}
         timeout-minutes: 40
+        env:
+            CARGO_HOME: ${{ github.workspace }}/.ci-rust/${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}-${{ matrix.target }}/cargo
+            RUSTUP_HOME: ${{ github.workspace }}/.ci-rust/${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}-${{ matrix.target }}/rustup
         strategy:
             fail-fast: false
             matrix:
@@ -279,6 +282,10 @@ jobs:
               with:
                   ref: ${{ needs.prepare.outputs.release_ref }}
 
+            - name: Self-heal Rust toolchain cache
+              shell: bash
+              run: ./scripts/ci/self_heal_rust_toolchain.sh 1.92.0
+
             - uses: dtolnay/rust-toolchain@631a55b12751854ce901bb631d5902ceb48146f7 # stable
               with:
                   toolchain: 1.92.0
@@ -389,6 +396,10 @@ jobs:
 
             - name: Check binary size (Unix)
               if: runner.os != 'Windows'
+              env:
+                  BINARY_SIZE_HARD_LIMIT_MB: 28
+                  BINARY_SIZE_ADVISORY_MB: 20
+                  BINARY_SIZE_TARGET_MB: 5
               run: bash scripts/ci/check_binary_size.sh "target/${{ matrix.target }}/release-fast/${{ matrix.artifact }}" "${{ matrix.target }}"
 
             - name: Package (Unix)

From 07ba229a4670663506a31c0ea75e7896042eece9 Mon Sep 17 00:00:00 2001
From: xj <gh-xj@users.noreply.github.com>
Date: Tue, 3 Mar 2026 01:25:18 -0800
Subject: [PATCH 2/2] fix(release): harden pub-release cross and apt
 reliability

---
 .github/workflows/pub-release.yml | 40 ++++++++++++++++++++++++++++++-
 1 file changed, 39 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/pub-release.yml b/.github/workflows/pub-release.yml
index f0f64408b..441ecc4ed 100644
--- a/.github/workflows/pub-release.yml
+++ b/.github/workflows/pub-release.yml
@@ -111,6 +111,7 @@ jobs:
             - name: Install gh CLI
               shell: bash
               run: |
+                  set -euo pipefail
                   if command -v gh &>/dev/null; then
                     echo "gh already available: $(gh --version | head -1)"
                     exit 0
@@ -120,6 +121,16 @@ jobs:
                     | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg
                   echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
                     | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null
+                  for i in {1..60}; do
+                    if sudo fuser /var/lib/apt/lists/lock >/dev/null 2>&1 \
+                      || sudo fuser /var/lib/dpkg/lock-frontend >/dev/null 2>&1 \
+                      || sudo fuser /var/lib/dpkg/lock >/dev/null 2>&1; then
+                      echo "apt/dpkg locked; waiting ($i/60)..."
+                      sleep 5
+                    else
+                      break
+                    fi
+                  done
                   sudo apt-get update -qq
                   sudo apt-get install -y gh
               env:
@@ -186,6 +197,7 @@ jobs:
         env:
             CARGO_HOME: ${{ github.workspace }}/.ci-rust/${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}-${{ matrix.target }}/cargo
             RUSTUP_HOME: ${{ github.workspace }}/.ci-rust/${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}-${{ matrix.target }}/rustup
+            CARGO_TARGET_DIR: ${{ github.workspace }}/target
         strategy:
             fail-fast: false
             matrix:
@@ -296,12 +308,28 @@ jobs:
 
             - name: Install cross for cross-built targets
               if: matrix.use_cross
+              shell: bash
               run: |
-                  cargo install cross --git https://github.com/cross-rs/cross
+                  set -euo pipefail
+                  echo "${CARGO_HOME:-$HOME/.cargo}/bin" >> "$GITHUB_PATH"
+                  cargo install cross --locked --version 0.2.5
+                  command -v cross
+                  cross --version
 
             - name: Install cross-compilation toolchain (Linux)
               if: runner.os == 'Linux' && matrix.cross_compiler != ''
               run: |
+                  set -euo pipefail
+                  for i in {1..60}; do
+                    if sudo fuser /var/lib/apt/lists/lock >/dev/null 2>&1 \
+                      || sudo fuser /var/lib/dpkg/lock-frontend >/dev/null 2>&1 \
+                      || sudo fuser /var/lib/dpkg/lock >/dev/null 2>&1; then
+                      echo "apt/dpkg locked; waiting ($i/60)..."
+                      sleep 5
+                    else
+                      break
+                    fi
+                  done
                   sudo apt-get update -qq
                   sudo apt-get install -y "${{ matrix.cross_compiler }}"
                   # Install matching libc dev headers for cross targets
@@ -324,6 +352,16 @@ jobs:
                   NDK_ROOT="${RUNNER_TEMP}/android-ndk"
                   NDK_HOME="${NDK_ROOT}/android-ndk-${NDK_VERSION}"
 
+                  for i in {1..60}; do
+                    if sudo fuser /var/lib/apt/lists/lock >/dev/null 2>&1 \
+                      || sudo fuser /var/lib/dpkg/lock-frontend >/dev/null 2>&1 \
+                      || sudo fuser /var/lib/dpkg/lock >/dev/null 2>&1; then
+                      echo "apt/dpkg locked; waiting ($i/60)..."
+                      sleep 5
+                    else
+                      break
+                    fi
+                  done
                   sudo apt-get update -qq
                   sudo apt-get install -y unzip