Wire native voice dependencies into full Rust CI (#58719)

## What changed

- Build native voice SDK and runtime artifacts with Bazel for Linux GNU, macOS, and Windows on x64 and ARM64, then configure Cargo jobs to consume them. Keep musl builds in a separate job without these inputs.
- Validate artifact receipts against the target, source commit, and source manifest; verify SDK file hashes and relocate pkg-config metadata. Package the runtime and plugins with nextest archives and restore `CODEX_TEST_VOICE_RUNTIME` when running shards.
- Prepare native Windows voice tools for argument-comment linting and install ARM64 DotSlash on Windows ARM64. Reduce archive disk usage, bound Linux ARM64 build concurrency, and correct the JUnit artifact path.
- Recognize TLS errors wrapped directly in `io::Error`. Make TLS fallback fixtures select the native backend explicitly, allow the MCP test server's non-loopback address, and isolate skill-root tests from ancestor Git markers. Install `git` in remote test containers and filter MCP discovery assertions to POST requests.

## Testing

Add tests for relocated voice inputs, Windows ARM64 import libraries with host-native pkgconf, and rejection of mismatched receipts or corrupt SDK files. Extend untrusted-certificate coverage to an explicitly selected rustls backend.

GitOrigin-RevId: da3ff690b94906edc1f8f60a3c7feda1bf66134a

.github/actions/run-argument-comment-lint/action.yml

@@ -18,6 +18,26 @@ runs:
         target: ${{ inputs.target }}
         cache-scope: bazel-argument-comment-lint
 
+    - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      if: ${{ runner.os == 'Windows' && inputs.buildbuddy-api-key == '' }}
+      with:
+        python-version: "3.12"
+        architecture: x64
+
+    - name: Prepare native Windows audio dependencies
+      if: ${{ runner.os == 'Windows' && inputs.buildbuddy-api-key == '' }}
+      uses: ./third_party/voice/cargo-ci/windows-setup
+      with:
+        target: x86_64-pc-windows-msvc
+
+    - name: Verify native Windows audio dependencies
+      if: ${{ runner.os == 'Windows' && inputs.buildbuddy-api-key == '' }}
+      shell: bash
+      run: |
+        : "${VOICE_WINDOWS_BAZEL_REPOSITORY:?Windows voice tools are required}"
+        : "${VOICE_WINDOWS_SYSTEM_ROOT:?Windows SystemRoot is required}"
+        : "${VOICE_WINDOWS_HOST_ARCH:?Windows host architecture is required}"
+
     - name: Install Linux sandbox build dependencies
       if: ${{ runner.os == 'Linux' }}
       shell: bash

.github/actions/setup-ci/action.yml

@@ -81,10 +81,28 @@ runs:
       run: mkdir -p "$RUNNER_TEMP/dotslash-curl" && echo retry-all-errors > "$RUNNER_TEMP/dotslash-curl/.curlrc"
 
     - name: Install DotSlash
+      if: runner.os != 'Windows' || runner.arch != 'ARM64'
       uses: meta/install-dotslash@1e4e7b3e07eaca387acb98f1d4720e0bee8dbb6a # v2
       env:
         CURL_HOME: ${{ runner.temp }}/dotslash-curl
 
+    - name: Install native DotSlash (Windows ARM64)
+      if: runner.os == 'Windows' && runner.arch == 'ARM64'
+      shell: bash
+      run: |
+        set -euo pipefail
+        # DotSlash selects resource architecture from its own executable.
+        destination="$RUNNER_TEMP/install-dotslash-arm64/bin"
+        archive="$RUNNER_TEMP/dotslash-windows-arm64.v0.5.9.tar.gz"
+        mkdir -p "$destination"
+        curl --location --silent --show-error --fail --retry 5 --retry-all-errors \
+          https://github.com/facebook/dotslash/releases/download/v0.5.9/dotslash-windows-arm64.v0.5.9.tar.gz \
+          --output "$archive"
+        echo "43d49d3472808738993ccf95a36dda8cc2869996d9a397bb02bde1e39b16146b  $archive" | sha256sum --check
+        tar xzf "$archive" -O --force-local > "$destination/dotslash.exe"
+        echo "$destination" >> "$GITHUB_PATH"
+        "$destination/dotslash.exe" --version
+
     - name: Install just
       uses: taiki-e/install-action@4cef1412cce204788f482e778a0b9187f9626a29 # v2.87.21
       with:

.github/scripts/run-argument-comment-lint-bazel.sh

@@ -9,6 +9,21 @@ if [[ "${RUNNER_OS:-}" == "Windows" ]]; then
   # lint aspect can run across the compatible crate graph instead of failing the
   # whole build after analysis.
   bazel_lint_args+=("--skip_incompatible_explicit_targets")
+  if [[ -z "${BUILDBUDDY_API_KEY:-}" && -n "${VOICE_WINDOWS_BAZEL_REPOSITORY:-}" ]]; then
+    : "${VOICE_WINDOWS_BAZEL_REPOSITORY:?Windows voice tools are required}"
+    : "${VOICE_WINDOWS_SYSTEM_ROOT:?Windows SystemRoot is required}"
+    : "${VOICE_WINDOWS_HOST_ARCH:?Windows host architecture is required}"
+    bazel_lint_args+=(
+      "--extra_toolchains=//third_party/voice:windows_pkg_config_toolchain,//third_party/voice:windows_cmake_toolchain"
+      "--repo_env=BAZEL_MSVC_RUNTIME_VISUAL_STUDIO_EULA=1"
+      "--inject_repository=voice_windows_tools=${VOICE_WINDOWS_BAZEL_REPOSITORY}"
+      "--//third_party/voice:windows_installed_tools=@voice_windows_tools//:tools"
+      "--action_env=SystemRoot=${VOICE_WINDOWS_SYSTEM_ROOT}"
+      "--host_action_env=SystemRoot=${VOICE_WINDOWS_SYSTEM_ROOT}"
+      "--action_env=PROCESSOR_ARCHITECTURE=${VOICE_WINDOWS_HOST_ARCH}"
+      "--host_action_env=PROCESSOR_ARCHITECTURE=${VOICE_WINDOWS_HOST_ARCH}"
+    )
+  fi
 fi
 
 read_query_labels() {

.github/workflows/rust-ci-full-nextest-platform.yml

@@ -65,6 +65,8 @@ jobs:
       CODEX_CI_PROFILE: ${{ inputs.profile }}
       CODEX_CI_TARGET: ${{ inputs.target }}
       CARGO_INCREMENTAL: "0"
+      # Debug symbols for hundreds of test binaries can exhaust the archive runner's disk.
+      CARGO_PROFILE_CI_TEST_DEBUG: "0"
       SCCACHE_CACHE_SIZE: 10G
       NEXTEST_ARCHIVE_FILE: nextest-${{ inputs.artifact_id }}.tar.zst
       TEST_HELPERS_ARTIFACT: nextest-test-helpers-${{ inputs.artifact_id }}
@@ -73,6 +75,15 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Free disk space for the macOS test archive
+        if: ${{ runner.os == 'macOS' && runner.arch == 'ARM64' && runner.environment == 'github-hosted' }}
+        shell: bash
+        run: |
+          # The macOS build does not use the hosted image's Android SDK or NDKs.
+          df -h "$RUNNER_TEMP"
+          sudo rm -rf /Users/runner/Library/Android/sdk
+          df -h "$RUNNER_TEMP"
+
       - uses: ./.github/actions/setup-ci
 
       - name: Install Linux build dependencies
@@ -165,13 +176,25 @@ jobs:
           tool: nextest
           version: 0.9.103
 
+      - name: Set up native voice dependencies
+        uses: ./third_party/voice/cargo-ci/setup
+        with:
+          target: ${{ inputs.target }}
+
       - name: Build nextest archive
         shell: bash
         run: |
           set -euo pipefail
           archive_dir="${RUNNER_TEMP}/nextest-archive"
           mkdir -p "${archive_dir}"
-          cargo nextest archive \
+          if [[ "${RUNNER_OS}" == "Linux" && "${RUNNER_ARCH}" == "ARM64" && "${CODEX_CI_TARGET}" == "aarch64-unknown-linux-gnu" ]]; then
+            # Bound concurrency for full GNU ARM archives on native Linux runners.
+            nproc
+            free -h
+            export CARGO_BUILD_JOBS=4
+          fi
+          printf '%s\n' "$CODEX_VOICE_RUNTIME_RELATIVE" > "$archive_dir/voice-runtime-path.txt"
+          cargo nextest --tool-config-file "codex-voice:$CODEX_VOICE_NEXTEST_CONFIG" archive \
             --target "${CODEX_CI_TARGET}" \
             --cargo-profile "${CODEX_CI_PROFILE}" \
             --timings \
@@ -215,7 +238,7 @@ jobs:
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: nextest-archive-${{ inputs.artifact_id }}
-          path: ${{ runner.temp }}/nextest-archive/${{ env.NEXTEST_ARCHIVE_FILE }}
+          path: ${{ runner.temp }}/nextest-archive/
           if-no-files-found: error
           retention-days: 1
 
@@ -341,10 +364,16 @@ jobs:
           set -euo pipefail
           archive_file="${RUNNER_TEMP}/nextest-archive/${NEXTEST_ARCHIVE_FILE}"
           workspace_root="$(pwd)"
+          extract_dir="${RUNNER_TEMP}/nextest-extracted"
+          mkdir -p "$extract_dir"
+          runtime_relative="$(cat "${RUNNER_TEMP}/nextest-archive/voice-runtime-path.txt")"
+          export CODEX_TEST_VOICE_RUNTIME="$extract_dir/target/$runtime_relative"
 
           if [[ "${RUNNER_OS}" == "Windows" ]]; then
             archive_file="$(cygpath -w "${archive_file}")"
             workspace_root="$(cygpath -w "${workspace_root}")"
+            extract_dir="$(cygpath -w "$extract_dir")"
+            CODEX_TEST_VOICE_RUNTIME="$(cygpath -w "$CODEX_TEST_VOICE_RUNTIME")"
           fi
 
           if [[ "${RUNNER_OS}" == "Linux" ]]; then
@@ -365,6 +394,7 @@ jobs:
             run
             --no-fail-fast
             --archive-file "${archive_file}"
+            --extract-to "$extract_dir"
             --workspace-remap "${workspace_root}"
             --partition "hash:${{ matrix.shard }}/4"
           )
@@ -395,6 +425,8 @@ jobs:
           "${test_command[@]}"
         env:
           RUST_BACKTRACE: 1
+          # Keep panic backtraces without changing the CLI errors asserted by tests.
+          RUST_LIB_BACKTRACE: "0"
           RUST_MIN_STACK: "8388608" # 8 MiB
           NEXTEST_STATUS_LEVEL: leak
 
@@ -403,7 +435,7 @@ jobs:
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: nextest-junit-rust-ci-${{ inputs.artifact_id }}-shard-${{ matrix.shard }}
-          path: ${{ env.CARGO_TARGET_DIR }}/nextest/default/junit.xml
+          path: codex-rs/target/nextest/default/junit.xml
           if-no-files-found: warn
 
       - name: Tear down remote test env

.github/workflows/rust-ci-full.yml

@@ -92,7 +92,7 @@ jobs:
   argument_comment_lint_prebuilt:
     name: Argument comment lint - ${{ matrix.name }}
     runs-on: ${{ matrix.runs_on || matrix.runner }}
-    timeout-minutes: 30
+    timeout-minutes: 120
     environment:
       name: bazel
       deployment: false
@@ -117,17 +117,51 @@ jobs:
         uses: ./.github/actions/run-argument-comment-lint
         with:
           target: ${{ runner.os }}
-          buildbuddy-api-key: ${{ secrets.BUILDBUDDY_API_KEY }}
 
   # --- CI to validate on different os/targets --------------------------------
+  cargo_voice_inputs:
+    name: Cargo voice inputs - ${{ matrix.target }}
+    runs-on: ${{ matrix.runner }}
+    environment:
+      name: bazel
+      deployment: false
+    permissions:
+      contents: read
+    timeout-minutes: 120
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { target: x86_64-unknown-linux-gnu, runner: ubuntu-24.04 }
+          - { target: aarch64-unknown-linux-gnu, runner: ubuntu-24.04-arm }
+          - { target: x86_64-apple-darwin, runner: macos-15-intel }
+          - { target: aarch64-apple-darwin, runner: macos-15 }
+          - target: x86_64-pc-windows-msvc
+            runner:
+              group: ${{ github.event.repository.name }}-runners
+              labels: ${{ github.event.repository.name }}-windows-x64
+          - target: aarch64-pc-windows-msvc
+            runner:
+              group: ${{ github.event.repository.name }}-runners
+              labels: ${{ github.event.repository.name }}-windows-arm64
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - uses: ./third_party/voice/cargo-ci/produce
+        with:
+          target: ${{ matrix.target }}
+
   lint_build:
-    name: Lint/Build — ${{ matrix.runner }} - ${{ matrix.target }}${{ matrix.profile == 'release' && ' (release)' || '' }}
-    runs-on: ${{ matrix.runs_on || matrix.runner }}
-    timeout-minutes: 30
-    defaults:
+    needs: cargo_voice_inputs
+    if: &lint_build_if ${{ !cancelled() }}
+    name: &lint_build_name Lint/Build — ${{ matrix.runner }} - ${{ matrix.target }}${{ matrix.profile == 'release' && ' (release)' || '' }}
+    runs-on: &lint_build_runner ${{ matrix.runs_on || matrix.runner }}
+    timeout-minutes: &lint_build_timeout 30
+    defaults: &lint_build_defaults
       run:
         working-directory: codex-rs
-    env:
+    env: &lint_build_env
       # Speed up repeated builds across CI runs by caching compiled objects, except on
       # arm64 macOS runners cross-targeting x86_64 where ring/cc-rs can produce
       # mixed-architecture archives under sccache.
@@ -145,24 +179,12 @@ jobs:
           - runner: macos-15-xlarge
             target: x86_64-apple-darwin
             profile: dev
-          - runner: ubuntu-24.04
-            target: x86_64-unknown-linux-musl
-            profile: dev
-            runs_on:
-              group: ${{ github.event.repository.name }}-runners
-              labels: ${{ github.event.repository.name }}-linux-x64
           - runner: ubuntu-24.04
             target: x86_64-unknown-linux-gnu
             profile: dev
             runs_on:
               group: ${{ github.event.repository.name }}-runners
               labels: ${{ github.event.repository.name }}-linux-x64
-          - runner: ubuntu-24.04-arm
-            target: aarch64-unknown-linux-musl
-            profile: dev
-            runs_on:
-              group: ${{ github.event.repository.name }}-runners
-              labels: ${{ github.event.repository.name }}-linux-arm64
           - runner: ubuntu-24.04-arm
             target: aarch64-unknown-linux-gnu
             profile: dev
@@ -189,18 +211,6 @@ jobs:
           - runner: macos-15-xlarge
             target: aarch64-apple-darwin
             profile: release
-          - runner: ubuntu-24.04
-            target: x86_64-unknown-linux-musl
-            profile: release
-            runs_on:
-              group: ${{ github.event.repository.name }}-runners
-              labels: ${{ github.event.repository.name }}-linux-x64
-          - runner: ubuntu-24.04-arm
-            target: aarch64-unknown-linux-musl
-            profile: release
-            runs_on:
-              group: ${{ github.event.repository.name }}-runners
-              labels: ${{ github.event.repository.name }}-linux-arm64
           - runner: windows-x64
             target: x86_64-pc-windows-msvc
             profile: release
@@ -214,7 +224,7 @@ jobs:
               group: ${{ github.event.repository.name }}-runners
               labels: ${{ github.event.repository.name }}-windows-arm64
 
-    steps:
+    steps: &lint_build_steps
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
@@ -348,6 +358,12 @@ jobs:
         with:
           target: ${{ matrix.target }}
 
+      - name: Set up native voice dependencies
+        if: ${{ !endsWith(matrix.target, '-musl') }}
+        uses: ./third_party/voice/cargo-ci/setup
+        with:
+          target: ${{ matrix.target }}
+
       - name: Install cargo-chef
         if: ${{ matrix.profile == 'release' }}
         uses: taiki-e/install-action@44c6d64aa62cd779e873306675c7a58e86d6d532 # v2.62.49
@@ -427,7 +443,46 @@ jobs:
             /var/cache/apt
           key: apt-${{ matrix.runner }}-${{ matrix.target }}-v1
 
+  lint_build_musl:
+    if: *lint_build_if
+    name: *lint_build_name
+    runs-on: *lint_build_runner
+    timeout-minutes: *lint_build_timeout
+    defaults: *lint_build_defaults
+    env: *lint_build_env
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: ubuntu-24.04
+            target: x86_64-unknown-linux-musl
+            profile: dev
+            runs_on:
+              group: ${{ github.event.repository.name }}-runners
+              labels: ${{ github.event.repository.name }}-linux-x64
+          - runner: ubuntu-24.04-arm
+            target: aarch64-unknown-linux-musl
+            profile: dev
+            runs_on:
+              group: ${{ github.event.repository.name }}-runners
+              labels: ${{ github.event.repository.name }}-linux-arm64
+          - runner: ubuntu-24.04
+            target: x86_64-unknown-linux-musl
+            profile: release
+            runs_on:
+              group: ${{ github.event.repository.name }}-runners
+              labels: ${{ github.event.repository.name }}-linux-x64
+          - runner: ubuntu-24.04-arm
+            target: aarch64-unknown-linux-musl
+            profile: release
+            runs_on:
+              group: ${{ github.event.repository.name }}-runners
+              labels: ${{ github.event.repository.name }}-linux-arm64
+    steps: *lint_build_steps
+
   tests_macos_aarch64:
+    needs: cargo_voice_inputs
+    if: ${{ !cancelled() }}
     name: Tests — macos-15-xlarge - aarch64-apple-darwin
     uses: ./.github/workflows/rust-ci-full-nextest-platform.yml
     with:
@@ -439,6 +494,8 @@ jobs:
     secrets: inherit
 
   tests_linux_x64_remote:
+    needs: cargo_voice_inputs
+    if: ${{ !cancelled() }}
     name: Tests — ubuntu-24.04 - x86_64-unknown-linux-gnu (remote)
     uses: ./.github/workflows/rust-ci-full-nextest-platform.yml
     with:
@@ -453,6 +510,8 @@ jobs:
     secrets: inherit
 
   tests_linux_arm64:
+    needs: cargo_voice_inputs
+    if: ${{ !cancelled() }}
     name: Tests — ubuntu-24.04-arm - aarch64-unknown-linux-gnu
     uses: ./.github/workflows/rust-ci-full-nextest-platform.yml
     with:
@@ -466,6 +525,8 @@ jobs:
     secrets: inherit
 
   tests_windows_x64:
+    needs: cargo_voice_inputs
+    if: ${{ !cancelled() }}
     name: Tests — windows-x64 - x86_64-pc-windows-msvc
     uses: ./.github/workflows/rust-ci-full-nextest-platform.yml
     with:
@@ -479,6 +540,8 @@ jobs:
     secrets: inherit
 
   tests_windows_arm64:
+    needs: cargo_voice_inputs
+    if: ${{ !cancelled() }}
     name: Tests — windows-arm64 - aarch64-pc-windows-msvc
     uses: ./.github/workflows/rust-ci-full-nextest-platform.yml
     with:
@@ -504,7 +567,9 @@ jobs:
         cargo_shear,
         argument_comment_lint_package,
         argument_comment_lint_prebuilt,
+        cargo_voice_inputs,
         lint_build,
+        lint_build_musl,
         tests_macos_aarch64,
         tests_linux_x64_remote,
         tests_linux_arm64,
@@ -522,6 +587,7 @@ jobs:
           echo "general: ${{ needs.general.result }}"
           echo "shear  : ${{ needs.cargo_shear.result }}"
           echo "lint   : ${{ needs.lint_build.result }}"
+          echo "musl   : ${{ needs.lint_build_musl.result }}"
           echo "test macos : ${{ needs.tests_macos_aarch64.result }}"
           echo "test linux : ${{ needs.tests_linux_x64_remote.result }}"
           echo "test arm64 : ${{ needs.tests_linux_arm64.result }}"
@@ -531,7 +597,9 @@ jobs:
           [[ '${{ needs.argument_comment_lint_prebuilt.result }}' == 'success' ]] || { echo 'argument_comment_lint_prebuilt failed'; exit 1; }
           [[ '${{ needs.general.result }}' == 'success' ]] || { echo 'general failed'; exit 1; }
           [[ '${{ needs.cargo_shear.result }}' == 'success' ]] || { echo 'cargo_shear failed'; exit 1; }
+          [[ '${{ needs.cargo_voice_inputs.result }}' == 'success' ]] || { echo 'cargo_voice_inputs failed'; exit 1; }
           [[ '${{ needs.lint_build.result }}' == 'success' ]] || { echo 'lint_build failed'; exit 1; }
+          [[ '${{ needs.lint_build_musl.result }}' == 'success' ]] || { echo 'lint_build_musl failed'; exit 1; }
           [[ '${{ needs.tests_macos_aarch64.result }}' == 'success' ]] || { echo 'tests_macos_aarch64 failed'; exit 1; }
           [[ '${{ needs.tests_linux_x64_remote.result }}' == 'success' ]] || { echo 'tests_linux_x64_remote failed'; exit 1; }
           [[ '${{ needs.tests_linux_arm64.result }}' == 'success' ]] || { echo 'tests_linux_arm64 failed'; exit 1; }