v0.8.64: Restore Nightly cross-target builds and auto-tag idempotency

[Hmbown]

Problem

Older main CI/CD runs for the v0.8.64 train show release-readiness failures in Nightly cross-target builds and the auto-tag workflow.

Evidence

Nightly run: https://github.com/Hmbown/CodeWhale/actions/runs/27895267897

Failed jobs from the pasted release audit:

• Build codewhale-linux-riscv64
• Build codewhale-tui-linux-riscv64
• Build codewhale-macos-x64
• Build codewhale-tui-macos-x64

Focused log inspection showed the same root cause for macOS x64 and RISC-V jobs: the workflow installed Rust stable targets, but the repository is pinned by rust-toolchain.toml to Rust 1.88, so cargo build --target ... ran under 1.88 and failed with error[E0463]: can't find crate for core.

Auto-tag run: https://github.com/Hmbown/CodeWhale/actions/runs/27895267892

The failed main workflow checked that v0.8.63 did not exist, then git push origin v0.8.63 was rejected because the remote tag already existed. The current integration branch already has an idempotent refresh/recheck around tag creation and push.

Current local integration status

Prepared locally on codex/v0.8.64-integration:

• b331eab2a fix(ci): install pinned Rust targets in release workflows
  • Nightly now uses dtolnay/rust-toolchain@master with toolchain: '1.88'.
  • Nightly and release target installation now call rustup target add --toolchain 1.88 ....
• Current .github/workflows/auto-tag.yml has a second tag refresh/recheck before create/push and treats a tag that appears during push as already handled.

Verification

Local/static verification completed:

• Inspected failed Nightly job logs for x86_64-apple-darwin and riscv64gc-unknown-linux-gnu; both showed stable target install plus active 1.88 override before E0463.
• ruby -e 'require "yaml"; ARGV.each { |f| YAML.load_file(f); puts "ok #{f}" }' .github/workflows/nightly.yml .github/workflows/release.yml .github/workflows/auto-tag.yml passed.
• git diff --check passed.

actionlint is not installed in this local environment, so final validation still needs a pushed-branch GitHub Actions run.

Acceptance criteria

• The v0.8.64 release/integration branch is pushed with the workflow fixes.
• Nightly cross-target jobs for macOS x64 and RISC-V install Rust stdlibs for the repo-pinned toolchain and pass or fail on a later, real build issue.
• Auto-tag is idempotent when the tag appears between the initial check and push.
• The CI result links are recorded on the release tracker before 0.8.64 is cut.

Related

• v0.8.64: Land and verify security hardening/code-scanning fixes #3368 for the security/code-scanning release gate.

[Hmbown]

Additional local v0.8.64 CI readiness update on codex/v0.8.64-integration:

• Confirmed existing local workflow fix b331eab2a is present: Nightly/release target installs use the repo-pinned Rust 1.88 toolchain.
• Ran actionlint locally via Go and found one real release workflow expression issue: the release parity job referenced matrix.target even though that job does not define a matrix.
• Added 137b4ce74 (fix(ci): remove invalid release parity matrix guard) to keep the Linux dependency step scoped to runner.os == 'Linux' in the non-matrix parity job.

Verification:

• go run github.com/rhysd/actionlint/cmd/actionlint@latest .github/workflows/nightly.yml .github/workflows/release.yml .github/workflows/auto-tag.yml
• ruby -e 'require "yaml"; ARGV.each { |f| YAML.load_file(f); puts "ok #{f}" }' .github/workflows/nightly.yml .github/workflows/release.yml .github/workflows/auto-tag.yml
• git diff --check

Still local-only evidence until the integration branch is pushed with approval and the actual GitHub Actions workflows run on the release target.

[Hmbown]

Pushed-branch verification update for codex/v0.8.64-integration at 21aa2364e:

• PR v0.8.64 security and release integration #3373 CI is green, including Test (macos-latest) and Test (windows-latest).
• Version drift, lint, npm wrapper smoke, and mobile runtime smoke are green on the same head.
• Local release checks rerun during takeover: ./scripts/release/check-versions.sh, cargo fmt --all -- --check, git diff --check, provider registry check, cargo test -p codewhale-config --locked, and release build all passed.

This verifies the integration branch. I am leaving the tracker open for the actual post-merge Nightly/auto-tag behavior, since no merge to main, tag, publish, GitHub Release, or artifact push has been performed.