ci: fix release workflow build failures for musl, aarch64, and Windows targets

Resolve 3 platform build failures across the 6-target release matrix:

- Add `vendored-openssl` feature chain (spectre-cli -> spectre-core ->
  prtip-scanner) enabling OpenSSL compilation from source via openssl-src
  crate for environments without system OpenSSL (musl static linking,
  aarch64 cross-compilation). Matrix entries for x86_64-unknown-linux-musl
  and aarch64-unknown-linux-gnu now pass `--features vendored-openssl`
  via conditional matrix expression.

- Add `LIB` env var for Windows pointing to Npcap SDK `Lib\x64` directory
  so the MSVC linker can locate `Packet.lib` and `wpcap.lib` at build time.

- Make LICENSE copy conditional in both Unix (`if [ -f LICENSE ]`) and
  Windows (`if (Test-Path LICENSE)`) packaging steps to prevent failures
  when the file path varies. Split Windows `Copy-Item` into separate calls
  for PowerShell compatibility.

- Add `CARGO_HOME` env var set to `${{ github.workspace }}/.cargo` for
  consistent cargo behavior across CI runners.

Also updates CHANGELOG.md, CLAUDE.md (musl build command), and .gitignore
(.cargo/ directory from CARGO_HOME override).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: doublegate

.github/workflows/release.yml

@@ -8,6 +8,7 @@ on:
 
 env:
   CARGO_TERM_COLOR: always
+  CARGO_HOME: ${{ github.workspace }}/.cargo
 
 permissions:
   contents: write
@@ -27,10 +28,12 @@ jobs:
           - target: x86_64-unknown-linux-musl
             os: ubuntu-latest
             artifact: spectre-linux-x86_64-musl
+            features: vendored-openssl
           - target: aarch64-unknown-linux-gnu
             os: ubuntu-latest
             artifact: spectre-linux-aarch64
             cross: true
+            features: vendored-openssl
           - target: x86_64-apple-darwin
             os: macos-latest
             artifact: spectre-macos-x86_64
@@ -70,21 +73,23 @@ jobs:
         run: |
           Invoke-WebRequest -Uri "https://npcap.com/dist/npcap-sdk-1.13.zip" -OutFile "npcap-sdk.zip"
           Expand-Archive -Path "npcap-sdk.zip" -DestinationPath "npcap-sdk"
+          echo "LIB=${{ github.workspace }}\npcap-sdk\Lib\x64" >> $env:GITHUB_ENV
 
       - name: Build (native)
         if: '!matrix.cross'
-        run: cargo build --release --target ${{ matrix.target }}
+        run: cargo build --release --target ${{ matrix.target }} ${{ matrix.features && format('--features {0}', matrix.features) || '' }}
 
       - name: Build (cross)
         if: matrix.cross
-        run: cross build --release --target ${{ matrix.target }}
+        run: cross build --release --target ${{ matrix.target }} ${{ matrix.features && format('--features {0}', matrix.features) || '' }}
 
       - name: Package (Unix)
         if: runner.os != 'Windows'
         run: |
           mkdir -p dist
           cp target/${{ matrix.target }}/release/spectre dist/
-          cp README.md LICENSE CHANGELOG.md dist/
+          cp README.md CHANGELOG.md dist/
+          if [ -f LICENSE ]; then cp LICENSE dist/; fi
           cd dist && tar -czvf ../${{ matrix.artifact }}.tar.gz *
 
       - name: Package (Windows)
@@ -93,7 +98,9 @@ jobs:
         run: |
           New-Item -ItemType Directory -Force -Path dist
           Copy-Item "target/${{ matrix.target }}/release/spectre${{ matrix.ext }}" dist/
-          Copy-Item README.md, LICENSE, CHANGELOG.md dist/
+          Copy-Item README.md dist/
+          Copy-Item CHANGELOG.md dist/
+          if (Test-Path LICENSE) { Copy-Item LICENSE dist/ }
           Compress-Archive -Path dist/* -DestinationPath "${{ matrix.artifact }}.zip"
 
       - name: Upload Release Asset

.gitignore

@@ -283,6 +283,9 @@ vgcore.*
 # GitHub Actions local testing
 .act/
 
+# Cargo home override (used in CI release workflow via CARGO_HOME env var)
+.cargo/
+
 # =============================================================================
 # Tauri (GUI)
 # =============================================================================

CHANGELOG.md

@@ -19,6 +19,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Unified asset upload step**: Single upload step per build job handles both `.tar.gz` (Unix) and `.zip` (Windows) with `fail_on_unmatched_files: false` so each platform only uploads its own format without failing on the other's missing archive
 - **Added `SPECTRE.sln` to `.gitignore`**: Visual Studio solution files (`.sln`, `.suo`, `.user`, etc.) now excluded from version control
 
+#### Release Workflow Build Fixes (3 Platform Failures)
+
+- **Added `vendored-openssl` feature chain** for musl and aarch64 cross-compilation targets:
+  - `spectre-cli` feature `vendored-openssl` forwards to `spectre-core/vendored-openssl`
+  - `spectre-core` feature `vendored-openssl` forwards to `prtip-scanner/vendored-openssl`
+  - Enables `openssl-src` crate to compile OpenSSL from source when system OpenSSL is unavailable (musl, cross-compiled aarch64)
+  - Matrix entries for `x86_64-unknown-linux-musl` and `aarch64-unknown-linux-gnu` now set `features: vendored-openssl`
+  - Build commands conditionally pass `--features vendored-openssl` via matrix expression: `${{ matrix.features && format('--features {0}', matrix.features) || '' }}`
+- **Fixed Windows Npcap SDK linker failure**: Added `LIB` environment variable pointing to `npcap-sdk\Lib\x64` directory so the MSVC linker can find `Packet.lib` and `wpcap.lib`
+- **Conditional LICENSE packaging**: `cp LICENSE dist/` replaced with `if [ -f LICENSE ]; then cp LICENSE dist/; fi` (Unix) and `if (Test-Path LICENSE) { Copy-Item LICENSE dist/ }` (Windows) to avoid build failures when LICENSE file path varies
+- **Windows PowerShell packaging fix**: Split single `Copy-Item README.md, LICENSE, CHANGELOG.md dist/` into separate `Copy-Item` calls for PowerShell compatibility
+- **Added `CARGO_HOME` env var**: Set to `${{ github.workspace }}/.cargo` for consistent cargo behavior across CI runners
+
 ### Planned
 - GUI application with Tauri 2.0 — Phase 5
 - MCP server implementation — Phase 6

CLAUDE.md

@@ -34,6 +34,9 @@ cargo build --release --workspace
 # Build specific crate
 cargo build --release -p spectre-cli
 
+# Build for musl or cross-compilation (vendors OpenSSL from source)
+cargo build --release --target x86_64-unknown-linux-musl --features vendored-openssl
+
 # Pull CyberChef-MCP container
 docker pull doublegate/cyberchef-mcp:latest
 

Cargo.lock

@@ -15,6 +15,10 @@ categories = ["command-line-utilities"]
 name = "spectre"
 path = "src/main.rs"
 
+[features]
+# Vendor OpenSSL for static linking (required for musl and cross-compilation builds)
+vendored-openssl = ["spectre-core/vendored-openssl"]
+
 [dependencies]
 # Core library
 spectre-core = { path = "../spectre-core" }

crates/spectre-cli/Cargo.toml

@@ -11,6 +11,10 @@ description = "SPECTRE core orchestration library"
 keywords = ["security", "scanning", "encryption", "orchestration"]
 categories = ["network-programming"]
 
+[features]
+# Vendor OpenSSL for static linking (required for musl and cross-compilation builds)
+vendored-openssl = ["prtip-scanner/vendored-openssl"]
+
 [dependencies]
 # Async runtime
 tokio = { workspace = true }