fix: make release host builds portable

Author: Loongphy

.agents/skills/codex-upstream-reapply/SKILL.md

@@ -152,7 +152,7 @@ bash .agents/skills/codex-upstream-reapply/scripts/start_from_tag.sh \
 
 如果分支上包含 codext npm / release 相关改动，必须先看 `references/npm-release.md`。这份文档明确要求：在 `NEW_BRANCH` 上用 `OLD_BRANCH` 的 `rust-release.yml` 覆盖当前 tag 分支内容，删除其他 workflow，并直接复制 `.github/scripts/install-musl-build-tools.sh`、`.github/scripts/rusty_v8_bazel.py`、`codex-cli/package.json`、`codex-cli/bin/codex.js`、`codex-cli/bin/rg`、`codex-cli/scripts/build_npm_package.py`、`codex-cli/scripts/install_native_deps.py`；这些是必做项，不是建议。只有这些动作完成后，才允许评估上游 / 新 tag 额外新增或改动的 CI 是否要合并或忽略。
 
-完成 mandatory carry-over 后，必须执行 release artifact parity audit：逐个核对 upstream TAG 的 `cargo --bin`、artifact upload、release archive、vendor tree 与 npm platform package。特别是 `codex-code-mode-host` 必须随 `codex` 一起发布；只构建 CLI 或只复制 CLI 会导致运行时出现 “codex-code-mode-host 不存在”，这不是 API 认证失败。使用 `.agents/skills/codex-upstream-reapply/scripts/check_release_artifact_parity.sh` 做静态检查。
+完成 mandatory carry-over 后，必须执行 release artifact parity audit：逐个核对 upstream TAG 的 `cargo --bin`、artifact upload、release archive、vendor tree 与 npm platform package。特别是 `codex-code-mode-host` 必须随 `codex` 一起发布；只构建 CLI 或只复制 CLI 会导致运行时出现 “codex-code-mode-host 不存在”，这不是 API 认证失败。若 host 需要独立 Cargo 命令，还必须核对 musl target 的 `openssl-sys` vendored 配置和 release job 的 `CARGO_NET_GIT_FETCH_WITH_CLI`。使用 `.agents/skills/codex-upstream-reapply/scripts/check_release_artifact_parity.sh` 做静态检查。
 
 如果这套 codext npm / release 规则生效，所有用户可见文案、提示、tooltips、README/技能文档里凡是引用安装后命令名的地方，也必须同步使用 `codext`。例如恢复会话提示应写成 `codext resume <session>`，不要继续保留 `codex resume ...` 这类上游命令名。
 

.agents/skills/codex-upstream-reapply/references/npm-release.md

@@ -35,7 +35,9 @@ Trace every runtime binary from build to package before committing:
 2. Follow each binary through build output, uploaded artifact, standalone archive, vendor tree, and npm platform package.
 3. Include `codex-code-mode-host` anywhere the CLI is shipped. It must sit beside `codex`/`codext`; `cargo build -p codex-cli` does not build it.
    Because Cargo resolves `--bin` within the selected package, build it in a separate command with `-p codex-code-mode-host`; do not append its `--bin` flag to the `codex-cli` command.
-4. Keep Windows-only helpers (`codex-windows-sandbox-setup.exe`, `codex-command-runner.exe`) and Linux resources such as `bwrap` aligned with the current release scripts.
+4. When the host is built separately for musl, keep target-specific vendored `openssl-sys` dependencies on `codex-protocol`; otherwise its `reqwest` native-tls dependency falls back to host OpenSSL headers.
+5. Keep Windows-only helpers (`codex-windows-sandbox-setup.exe`, `codex-command-runner.exe`) and Linux resources such as `bwrap` aligned with the current release scripts.
+6. Preserve `CARGO_NET_GIT_FETCH_WITH_CLI: "true"` in release jobs. The workspace contains git dependencies with nested submodules, and macOS runners can fail when Cargo uses libgit2/SecureTransport.
 
 Run the static parity audit after the carry-over copy:
 

.agents/skills/codex-upstream-reapply/scripts/check_release_artifact_parity.sh

@@ -13,6 +13,7 @@ required_patterns=(
   "--bin codex-code-mode-host"
   "codex-code-mode-host"
   "codex-bin-"
+  "CARGO_NET_GIT_FETCH_WITH_CLI"
 )
 for pattern in "${required_patterns[@]}"; do
   if ! rg -F --quiet -- "${pattern}" "${workflow}"; then
@@ -33,4 +34,13 @@ for path in \
   fi
 done
 
+protocol_manifest="${repo_root}/codex-rs/protocol/Cargo.toml"
+for target in x86_64-unknown-linux-musl aarch64-unknown-linux-musl; do
+  if ! rg -F --quiet -- "[target.${target}.dependencies]" "${protocol_manifest}" || \
+    ! rg -F --quiet -- 'openssl-sys = { workspace = true, features = ["vendored"] }' "${protocol_manifest}"; then
+    echo "[ERROR] Musl release dependency parity is missing vendored OpenSSL for ${target}" >&2
+    exit 1
+  fi
+done
+
 echo "[OK] Release artifact parity includes codex-code-mode-host"

.github/workflows/rust-release.yml

@@ -23,6 +23,9 @@ jobs:
     env:
       CARGO_PROFILE_RELEASE_LTO: thin
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+      # Avoid intermittent SecureTransport/libgit2 failures while fetching
+      # libwebrtc's nested libyuv submodule on macOS release runners.
+      CARGO_NET_GIT_FETCH_WITH_CLI: "true"
     strategy:
       fail-fast: false
       matrix:
@@ -225,6 +228,8 @@ jobs:
     defaults:
       run:
         working-directory: codex-rs
+    env:
+      CARGO_NET_GIT_FETCH_WITH_CLI: "true"
     strategy:
       fail-fast: false
       matrix:

codex-rs/Cargo.lock

@@ -52,6 +52,14 @@ wildmatch = { workspace = true }
 landlock = { workspace = true }
 seccompiler = { workspace = true }
 
+# Keep native-tls usable when codex-code-mode-host is built as a separate
+# package for musl release artifacts.
+[target.x86_64-unknown-linux-musl.dependencies]
+openssl-sys = { workspace = true, features = ["vendored"] }
+
+[target.aarch64-unknown-linux-musl.dependencies]
+openssl-sys = { workspace = true, features = ["vendored"] }
+
 [dev-dependencies]
 anyhow = { workspace = true }
 http = { workspace = true }
@@ -62,4 +70,4 @@ tempfile = { workspace = true }
 # Required because:
 # `icu_provider`: contains a required `sync` feature for `icu_decimal`
 # `strum`: is referenced by generated `EnumIter` derive implementations
-ignored = ["icu_provider", "strum"]
+ignored = ["icu_provider", "openssl-sys", "strum"]