From 9d6df7b526ee582b079083cc4e0534535e2d1702 Mon Sep 17 00:00:00 2001
From: iHsin <sun@ihsin.dev>
Date: Tue, 9 Jun 2026 15:47:05 +0800
Subject: [PATCH 01/10] ci: release on main push + workflow_dispatch version,
 and GHA-backed sccache

release-libs:
- Trigger on push to main (tag `latest`) and on workflow_dispatch, where
  inputs.version becomes the release tag (falls back to `latest` if empty).
- Pass the version via env var to avoid shell injection from the input.

Windows sccache:
- Replace `choco install sccache` + version detection + manual actions/cache
  of the sccache dir with `mozilla-actions/sccache-action` and
  SCCACHE_GHA_ENABLED=true (GitHub Actions cache backend).
- Keep the 0.12.0 pin (validated for windows/arm64) for both arches.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/workflows/build.yml | 52 ++++++++++---------------------------
 1 file changed, 13 insertions(+), 39 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index e36f97f2..5a1f95b2 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -156,7 +156,10 @@ jobs:
   windows:
     runs-on: windows-2022
     env:
-      SCCACHE_ARM64_VERSION: 0.12.0
+      # sccache stores its cache in the GitHub Actions cache service.
+      SCCACHE_GHA_ENABLED: "true"
+      # Pinned: 0.12.0 is the version validated for the windows/arm64 build.
+      SCCACHE_VERSION: "v0.12.0"
     strategy:
       fail-fast: false
       matrix:
@@ -183,49 +186,20 @@ jobs:
         with:
           path: naiveproxy/src/out
           key: naive-build-${{ steps.naive.outputs.commit }}-${{ hashFiles('scripts/build-cronet.rs') }}-windows-${{ matrix.arch }}
-      - name: Install tools
-        if: steps.build-cache.outputs.cache-hit != 'true'
-        run: |
-          choco install ninja -y
-      - name: Install sccache
-        if: steps.build-cache.outputs.cache-hit != 'true'
-        shell: pwsh
-        run: |
-          if ("${{ matrix.arch }}" -eq "arm64") {
-            choco install sccache --version=${{ env.SCCACHE_ARM64_VERSION }} -y
-          } else {
-            choco install sccache -y
-          }
-      - name: Get sccache version
+      - name: Install ninja
         if: steps.build-cache.outputs.cache-hit != 'true'
-        id: sccache
-        shell: pwsh
-        run: |
-          $rawVersion = sccache --version
-          if ($LASTEXITCODE -ne 0) {
-            throw "failed to get sccache version"
-          }
-          $version = ($rawVersion | Select-Object -First 1) -replace '^sccache\s+', ''
-          if ([string]::IsNullOrWhiteSpace($version)) {
-            throw "invalid sccache version output: $rawVersion"
-          }
-          "version=$version" >> $env:GITHUB_OUTPUT
-      - name: Cache sccache files
+        run: choco install ninja -y
+      - name: Setup sccache
         if: steps.build-cache.outputs.cache-hit != 'true'
-        uses: actions/cache@v4
+        uses: mozilla-actions/sccache-action@v0.0.10
         with:
-          path: ~/AppData/Local/Mozilla/sccache
-          key: sccache-windows-${{ matrix.arch }}-${{ steps.sccache.outputs.version }}-${{ steps.chromium.outputs.version }}
-          restore-keys: sccache-windows-${{ matrix.arch }}-${{ steps.sccache.outputs.version }}-
-      - name: Reset sccache stats
-        if: steps.build-cache.outputs.cache-hit != 'true'
-        run: sccache -z
+          version: ${{ env.SCCACHE_VERSION }}
       - name: Build
         if: steps.build-cache.outputs.cache-hit != 'true'
-        run: just compile windows/${{ matrix.arch }}
-      - name: Show sccache stats
-        if: steps.build-cache.outputs.cache-hit != 'true'
-        run: sccache -s
+        run: |
+          sccache -z
+          just compile windows/${{ matrix.arch }}
+          sccache -s
       - name: Package
         run: just package windows/${{ matrix.arch }}
       - uses: actions/upload-artifact@v4

From 3dbdf6c8463f4926737fbbd308147fca620114c6 Mon Sep 17 00:00:00 2001
From: iHsin <sun@ihsin.dev>
Date: Tue, 9 Jun 2026 15:51:30 +0800
Subject: [PATCH 02/10] ci: unify all platforms on sccache + GitHub Actions
 cache
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Switch linux, darwin, android and linux-musl from ccache + actions/cache
to the same sccache + GHA backend already used by Windows:

- Top-level env sets SCCACHE_GHA_ENABLED=true and SCCACHE_VERSION for all
  jobs; drop the now-redundant per-job (windows) env.
- Each build job uses mozilla-actions/sccache-action and wraps the build
  with `sccache -z` / `sccache -s`; remove the ccache install, the manual
  actions/cache of the ccache dir, and the ccache stat steps.
- build-cronet.rs: cc_wrapper now prefers sccache, falling back to ccache
  (previously it only looked for ccache on non-Windows hosts, so without
  this the build would silently run with no compiler cache).

Note: GHA cache is ~10 GB/repo shared across all jobs and the `out`
build-artifact caches — watch for eviction churn.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/workflows/build.yml | 109 +++++++++++++++---------------------
 scripts/build-cronet.rs     |   4 +-
 2 files changed, 47 insertions(+), 66 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 5a1f95b2..0a858597 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -16,6 +16,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+env:
+  # All platforms use sccache with the GitHub Actions cache service as backend.
+  SCCACHE_GHA_ENABLED: "true"
+  # Pinned: the version validated for the windows/arm64 build.
+  SCCACHE_VERSION: "v0.12.0"
+
 defaults:
   run:
     shell: bash
@@ -51,27 +57,22 @@ jobs:
         with:
           path: naiveproxy/src/out
           key: naive-build-${{ steps.naive.outputs.commit }}-${{ hashFiles('scripts/build-cronet.rs') }}-linux-${{ matrix.arch }}
-      - name: Cache ccache files
-        if: steps.build-cache.outputs.cache-hit != 'true'
-        uses: actions/cache@v4
-        with:
-          path: ~/.cache/ccache
-          key: ccache-linux-${{ matrix.arch }}-${{ steps.chromium.outputs.version }}
-          restore-keys: ccache-linux-${{ matrix.arch }}-
-      - name: Install packages
+      - name: Install ninja
         if: steps.build-cache.outputs.cache-hit != 'true'
         run: |
           sudo apt update
-          sudo apt install -y ninja-build ccache
-      - name: Reset ccache stats
+          sudo apt install -y ninja-build
+      - name: Setup sccache
         if: steps.build-cache.outputs.cache-hit != 'true'
-        run: ccache -z
+        uses: mozilla-actions/sccache-action@v0.0.10
+        with:
+          version: ${{ env.SCCACHE_VERSION }}
       - name: Build
         if: steps.build-cache.outputs.cache-hit != 'true'
-        run: just compile linux/${{ matrix.arch }}
-      - name: Show ccache stats
-        if: steps.build-cache.outputs.cache-hit != 'true'
-        run: ccache -s
+        run: |
+          sccache -z
+          just compile linux/${{ matrix.arch }}
+          sccache -s
       - name: Package
         run: just package linux/${{ matrix.arch }}
       - uses: actions/upload-artifact@v4
@@ -125,25 +126,20 @@ jobs:
         with:
           path: naiveproxy/src/out
           key: naive-build-${{ steps.naive.outputs.commit }}-${{ hashFiles('scripts/build-cronet.rs') }}-${{ matrix.name }}
-      - name: Cache ccache files
-        if: steps.build-cache.outputs.cache-hit != 'true'
-        uses: actions/cache@v4
-        with:
-          path: ~/Library/Caches/ccache
-          key: ccache-darwin-${{ matrix.name }}-${{ steps.chromium.outputs.version }}
-          restore-keys: ccache-darwin-${{ matrix.name }}-
-      - name: Install tools
+      - name: Install ninja
         if: steps.build-cache.outputs.cache-hit != 'true'
-        run: brew install ninja ccache
-      - name: Reset ccache stats
+        run: brew install ninja
+      - name: Setup sccache
         if: steps.build-cache.outputs.cache-hit != 'true'
-        run: ccache -z
+        uses: mozilla-actions/sccache-action@v0.0.10
+        with:
+          version: ${{ env.SCCACHE_VERSION }}
       - name: Build
         if: steps.build-cache.outputs.cache-hit != 'true'
-        run: just compile ${{ matrix.target }}
-      - name: Show ccache stats
-        if: steps.build-cache.outputs.cache-hit != 'true'
-        run: ccache -s
+        run: |
+          sccache -z
+          just compile ${{ matrix.target }}
+          sccache -s
       - name: Package
         run: just package ${{ matrix.target }}
       - uses: actions/upload-artifact@v4
@@ -155,11 +151,6 @@ jobs:
 
   windows:
     runs-on: windows-2022
-    env:
-      # sccache stores its cache in the GitHub Actions cache service.
-      SCCACHE_GHA_ENABLED: "true"
-      # Pinned: 0.12.0 is the version validated for the windows/arm64 build.
-      SCCACHE_VERSION: "v0.12.0"
     strategy:
       fail-fast: false
       matrix:
@@ -235,27 +226,22 @@ jobs:
         with:
           path: naiveproxy/src/out
           key: naive-build-${{ steps.naive.outputs.commit }}-${{ hashFiles('scripts/build-cronet.rs') }}-android-${{ matrix.arch }}
-      - name: Cache ccache files
-        if: steps.build-cache.outputs.cache-hit != 'true'
-        uses: actions/cache@v4
-        with:
-          path: ~/.cache/ccache
-          key: ccache-android-${{ matrix.arch }}-${{ steps.chromium.outputs.version }}
-          restore-keys: ccache-android-${{ matrix.arch }}-
-      - name: Install packages
+      - name: Install ninja
         if: steps.build-cache.outputs.cache-hit != 'true'
         run: |
           sudo apt update
-          sudo apt install -y ninja-build ccache
-      - name: Reset ccache stats
+          sudo apt install -y ninja-build
+      - name: Setup sccache
         if: steps.build-cache.outputs.cache-hit != 'true'
-        run: ccache -z
+        uses: mozilla-actions/sccache-action@v0.0.10
+        with:
+          version: ${{ env.SCCACHE_VERSION }}
       - name: Build
         if: steps.build-cache.outputs.cache-hit != 'true'
-        run: just compile android/${{ matrix.arch }}
-      - name: Show ccache stats
-        if: steps.build-cache.outputs.cache-hit != 'true'
-        run: ccache -s
+        run: |
+          sccache -z
+          just compile android/${{ matrix.arch }}
+          sccache -s
       - name: Package
         run: just package android/${{ matrix.arch }}
       - uses: actions/upload-artifact@v4
@@ -291,27 +277,22 @@ jobs:
         with:
           path: naiveproxy/src/out
           key: naive-build-${{ steps.naive.outputs.commit }}-${{ hashFiles('scripts/build-cronet.rs') }}-linux-musl-${{ matrix.arch }}
-      - name: Cache ccache files
-        if: steps.build-cache.outputs.cache-hit != 'true'
-        uses: actions/cache@v4
-        with:
-          path: ~/.cache/ccache
-          key: ccache-linux-musl-${{ matrix.arch }}-${{ steps.chromium.outputs.version }}
-          restore-keys: ccache-linux-musl-${{ matrix.arch }}-
       - name: Install packages
         if: steps.build-cache.outputs.cache-hit != 'true'
         run: |
           sudo apt update
-          sudo apt install -y ninja-build zstd ccache
-      - name: Reset ccache stats
+          sudo apt install -y ninja-build zstd
+      - name: Setup sccache
         if: steps.build-cache.outputs.cache-hit != 'true'
-        run: ccache -z
+        uses: mozilla-actions/sccache-action@v0.0.10
+        with:
+          version: ${{ env.SCCACHE_VERSION }}
       - name: Build
         if: steps.build-cache.outputs.cache-hit != 'true'
-        run: just compile linux/${{ matrix.arch }} musl
-      - name: Show ccache stats
-        if: steps.build-cache.outputs.cache-hit != 'true'
-        run: ccache -s
+        run: |
+          sccache -z
+          just compile linux/${{ matrix.arch }} musl
+          sccache -s
       - name: Package
         run: just package linux/${{ matrix.arch }} musl
       - uses: actions/upload-artifact@v4
diff --git a/scripts/build-cronet.rs b/scripts/build-cronet.rs
index 80524d58..f034a3cb 100755
--- a/scripts/build-cronet.rs
+++ b/scripts/build-cronet.rs
@@ -476,8 +476,8 @@ fn build_gn_args(src: &Path, t: &Target) -> Vec<String> {
         _ => {}
     }
 
-    let wrapper = if host_goos() == "windows" { "sccache" } else { "ccache" };
-    if let Some(p) = find_in_path(wrapper) {
+    // Compiler cache wrapper: prefer sccache, fall back to ccache.
+    if let Some(p) = find_in_path("sccache").or_else(|| find_in_path("ccache")) {
         args.push(format!("cc_wrapper=\"{}\"", p.to_string_lossy()));
     }
 

From 79cd830d542a6057595c5a755a7f790c34643369 Mon Sep 17 00:00:00 2001
From: iHsin <sun@ihsin.dev>
Date: Tue, 9 Jun 2026 20:03:44 +0800
Subject: [PATCH 03/10] ci: always use the latest sccache

Drop the SCCACHE_VERSION pin (v0.12.0) and the per-step version input;
mozilla-actions/sccache-action installs the latest release by default.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/workflows/build.yml | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 0a858597..5879e49c 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -19,8 +19,6 @@ concurrency:
 env:
   # All platforms use sccache with the GitHub Actions cache service as backend.
   SCCACHE_GHA_ENABLED: "true"
-  # Pinned: the version validated for the windows/arm64 build.
-  SCCACHE_VERSION: "v0.12.0"
 
 defaults:
   run:
@@ -65,8 +63,6 @@ jobs:
       - name: Setup sccache
         if: steps.build-cache.outputs.cache-hit != 'true'
         uses: mozilla-actions/sccache-action@v0.0.10
-        with:
-          version: ${{ env.SCCACHE_VERSION }}
       - name: Build
         if: steps.build-cache.outputs.cache-hit != 'true'
         run: |
@@ -132,8 +128,6 @@ jobs:
       - name: Setup sccache
         if: steps.build-cache.outputs.cache-hit != 'true'
         uses: mozilla-actions/sccache-action@v0.0.10
-        with:
-          version: ${{ env.SCCACHE_VERSION }}
       - name: Build
         if: steps.build-cache.outputs.cache-hit != 'true'
         run: |
@@ -183,8 +177,6 @@ jobs:
       - name: Setup sccache
         if: steps.build-cache.outputs.cache-hit != 'true'
         uses: mozilla-actions/sccache-action@v0.0.10
-        with:
-          version: ${{ env.SCCACHE_VERSION }}
       - name: Build
         if: steps.build-cache.outputs.cache-hit != 'true'
         run: |
@@ -234,8 +226,6 @@ jobs:
       - name: Setup sccache
         if: steps.build-cache.outputs.cache-hit != 'true'
         uses: mozilla-actions/sccache-action@v0.0.10
-        with:
-          version: ${{ env.SCCACHE_VERSION }}
       - name: Build
         if: steps.build-cache.outputs.cache-hit != 'true'
         run: |
@@ -285,8 +275,6 @@ jobs:
       - name: Setup sccache
         if: steps.build-cache.outputs.cache-hit != 'true'
         uses: mozilla-actions/sccache-action@v0.0.10
-        with:
-          version: ${{ env.SCCACHE_VERSION }}
       - name: Build
         if: steps.build-cache.outputs.cache-hit != 'true'
         run: |

From d30a2434bf0a61ed082352364b8b14d4d3d609b3 Mon Sep 17 00:00:00 2001
From: iHsin <sun@ihsin.dev>
Date: Tue, 9 Jun 2026 20:13:49 +0800
Subject: [PATCH 04/10] ci: drive the build matrix from .github/target.toml

Collapse the five near-duplicate per-platform jobs (linux, linux-musl,
darwin, windows, android) into a single matrix-driven `build` job, after
rust-proxy/workflows + Itsusinn/tuic:

- .github/target.toml lists every target (os, target, name, optional libc).
- A `prepare` job converts it with `toml2json | jaq -c '.target'` and exposes
  it as a job output.
- `build` consumes it via `matrix.include: ${{ fromJSON(...) }}`, with the
  per-OS bits (apt/brew/choco ninja, musl zstd, Debian keyring) selected by
  `runner.os` / target conditions. One step set for all 29 targets.
- release-libs now needs [build].

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/target.toml         | 168 ++++++++++++++++++++++
 .github/workflows/build.yml | 271 ++++++------------------------------
 2 files changed, 214 insertions(+), 225 deletions(-)
 create mode 100644 .github/target.toml

diff --git a/.github/target.toml b/.github/target.toml
new file mode 100644
index 00000000..9c22c243
--- /dev/null
+++ b/.github/target.toml
@@ -0,0 +1,168 @@
+# Build target matrix for the cronet libraries.
+#
+# Converted to JSON at CI time (`toml2json target.toml | jaq -c '.target'`) and
+# fed into the build job's `matrix.include`, so every platform shares one job
+# definition.
+#
+# Fields:
+#   os     - GitHub runner (runs-on)
+#   target - passed to `just compile/package` (os/arch[/variant])
+#   name   - artifact name (must start with `cronet-`); also the cache suffix
+#   libc   - optional; "musl" for static musl Linux builds
+
+# ==================== Linux (glibc) ====================
+[[target]]
+os = "ubuntu-24.04"
+target = "linux/amd64"
+name = "cronet-linux-amd64"
+
+[[target]]
+os = "ubuntu-24.04"
+target = "linux/arm64"
+name = "cronet-linux-arm64"
+
+[[target]]
+os = "ubuntu-24.04"
+target = "linux/386"
+name = "cronet-linux-386"
+
+[[target]]
+os = "ubuntu-24.04"
+target = "linux/arm"
+name = "cronet-linux-arm"
+
+[[target]]
+os = "ubuntu-24.04"
+target = "linux/loong64"
+name = "cronet-linux-loong64"
+
+[[target]]
+os = "ubuntu-24.04"
+target = "linux/mipsle"
+name = "cronet-linux-mipsle"
+
+[[target]]
+os = "ubuntu-24.04"
+target = "linux/mips64le"
+name = "cronet-linux-mips64le"
+
+[[target]]
+os = "ubuntu-24.04"
+target = "linux/riscv64"
+name = "cronet-linux-riscv64"
+
+# ==================== Linux (musl) ====================
+[[target]]
+os = "ubuntu-24.04"
+target = "linux/amd64"
+name = "cronet-linux-musl-amd64"
+libc = "musl"
+
+[[target]]
+os = "ubuntu-24.04"
+target = "linux/arm64"
+name = "cronet-linux-musl-arm64"
+libc = "musl"
+
+[[target]]
+os = "ubuntu-24.04"
+target = "linux/386"
+name = "cronet-linux-musl-386"
+libc = "musl"
+
+[[target]]
+os = "ubuntu-24.04"
+target = "linux/arm"
+name = "cronet-linux-musl-arm"
+libc = "musl"
+
+[[target]]
+os = "ubuntu-24.04"
+target = "linux/loong64"
+name = "cronet-linux-musl-loong64"
+libc = "musl"
+
+[[target]]
+os = "ubuntu-24.04"
+target = "linux/mipsle"
+name = "cronet-linux-musl-mipsle"
+libc = "musl"
+
+[[target]]
+os = "ubuntu-24.04"
+target = "linux/riscv64"
+name = "cronet-linux-musl-riscv64"
+libc = "musl"
+
+# ==================== Android ====================
+[[target]]
+os = "ubuntu-22.04"
+target = "android/arm64"
+name = "cronet-android-arm64"
+
+[[target]]
+os = "ubuntu-22.04"
+target = "android/amd64"
+name = "cronet-android-amd64"
+
+[[target]]
+os = "ubuntu-22.04"
+target = "android/arm"
+name = "cronet-android-arm"
+
+[[target]]
+os = "ubuntu-22.04"
+target = "android/386"
+name = "cronet-android-386"
+
+# ==================== Apple (macOS / iOS / tvOS) ====================
+[[target]]
+os = "macos-15"
+target = "darwin/amd64"
+name = "cronet-darwin-amd64"
+
+[[target]]
+os = "macos-15"
+target = "darwin/arm64"
+name = "cronet-darwin-arm64"
+
+[[target]]
+os = "macos-15"
+target = "ios/arm64"
+name = "cronet-ios-arm64"
+
+[[target]]
+os = "macos-15"
+target = "ios/arm64/simulator"
+name = "cronet-ios-arm64-simulator"
+
+[[target]]
+os = "macos-15"
+target = "ios/amd64"
+name = "cronet-ios-amd64-simulator"
+
+[[target]]
+os = "macos-15"
+target = "tvos/arm64"
+name = "cronet-tvos-arm64"
+
+[[target]]
+os = "macos-15"
+target = "tvos/arm64/simulator"
+name = "cronet-tvos-arm64-simulator"
+
+[[target]]
+os = "macos-15"
+target = "tvos/amd64"
+name = "cronet-tvos-amd64-simulator"
+
+# ==================== Windows ====================
+[[target]]
+os = "windows-2022"
+target = "windows/amd64"
+name = "cronet-windows-amd64"
+
+[[target]]
+os = "windows-2022"
+target = "windows/arm64"
+name = "cronet-windows-arm64"
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 5879e49c..09e434b1 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -25,274 +25,99 @@ defaults:
     shell: bash
 
 jobs:
-  linux:
-    runs-on: ubuntu-24.04
-    strategy:
-      fail-fast: false
-      matrix:
-        arch: [amd64, arm64, "386", arm, loong64, mipsle, mips64le, riscv64]
+  # Read .github/target.toml and expose it as a matrix.include payload, so all
+  # platforms share the single `build` job below.
+  prepare:
+    runs-on: ubuntu-latest
+    outputs:
+      targets: ${{ steps.set.outputs.targets }}
     steps:
       - uses: actions/checkout@v4
-        with:
-          submodules: 'recursive'
       - uses: taiki-e/install-action@v2
         with:
-          tool: just
-      - uses: dtolnay/rust-toolchain@nightly
-      - name: Get naiveproxy commit
-        id: naive
-        run: echo "commit=$(git -C naiveproxy rev-parse HEAD)" >> $GITHUB_OUTPUT
-      - name: Get Chromium version
-        id: chromium
-        run: echo "version=$(cat naiveproxy/CHROMIUM_VERSION)" >> $GITHUB_OUTPUT
-      - name: Regenerate Debian keyring
-        run: |
-          rm -f ./naiveproxy/src/build/linux/sysroot_scripts/keyring.gpg
-          GPG_TTY=/dev/null ./naiveproxy/src/build/linux/sysroot_scripts/generate_keyring.sh
-      - name: Cache build artifacts
-        id: build-cache
-        uses: actions/cache@v4
-        with:
-          path: naiveproxy/src/out
-          key: naive-build-${{ steps.naive.outputs.commit }}-${{ hashFiles('scripts/build-cronet.rs') }}-linux-${{ matrix.arch }}
-      - name: Install ninja
-        if: steps.build-cache.outputs.cache-hit != 'true'
+          tool: toml2json,jaq
+      - name: Build matrix from target.toml
+        id: set
         run: |
-          sudo apt update
-          sudo apt install -y ninja-build
-      - name: Setup sccache
-        if: steps.build-cache.outputs.cache-hit != 'true'
-        uses: mozilla-actions/sccache-action@v0.0.10
-      - name: Build
-        if: steps.build-cache.outputs.cache-hit != 'true'
-        run: |
-          sccache -z
-          just compile linux/${{ matrix.arch }}
-          sccache -s
-      - name: Package
-        run: just package linux/${{ matrix.arch }}
-      - uses: actions/upload-artifact@v4
-        with:
-          name: cronet-linux-${{ matrix.arch }}
-          path: |
-            lib/
-            include/
-
-  darwin:
-    runs-on: macos-15
+          targets=$(toml2json .github/target.toml | jaq -c '.target')
+          echo "targets=$targets" >> "$GITHUB_OUTPUT"
+          echo "$targets" | jaq .
+
+  build:
+    name: ${{ matrix.name }}
+    needs: prepare
+    runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
       matrix:
-        include:
-          - target: darwin/amd64
-            name: darwin-amd64
-          - target: darwin/arm64
-            name: darwin-arm64
-          # iOS
-          - target: ios/arm64
-            name: ios-arm64
-          - target: ios/arm64/simulator
-            name: ios-arm64-simulator
-          - target: ios/amd64
-            name: ios-amd64-simulator
-          # tvOS
-          - target: tvos/arm64
-            name: tvos-arm64
-          - target: tvos/arm64/simulator
-            name: tvos-arm64-simulator
-          - target: tvos/amd64
-            name: tvos-amd64-simulator
+        include: ${{ fromJSON(needs.prepare.outputs.targets) }}
     steps:
       - uses: actions/checkout@v4
         with:
           submodules: 'recursive'
+
       - uses: taiki-e/install-action@v2
         with:
           tool: just
+
       - uses: dtolnay/rust-toolchain@nightly
+
       - name: Get naiveproxy commit
         id: naive
-        run: echo "commit=$(git -C naiveproxy rev-parse HEAD)" >> $GITHUB_OUTPUT
-      - name: Get Chromium version
-        id: chromium
-        run: echo "version=$(cat naiveproxy/CHROMIUM_VERSION)" >> $GITHUB_OUTPUT
+        run: echo "commit=$(git -C naiveproxy rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+
       - name: Cache build artifacts
         id: build-cache
         uses: actions/cache@v4
         with:
           path: naiveproxy/src/out
           key: naive-build-${{ steps.naive.outputs.commit }}-${{ hashFiles('scripts/build-cronet.rs') }}-${{ matrix.name }}
-      - name: Install ninja
-        if: steps.build-cache.outputs.cache-hit != 'true'
-        run: brew install ninja
-      - name: Setup sccache
-        if: steps.build-cache.outputs.cache-hit != 'true'
-        uses: mozilla-actions/sccache-action@v0.0.10
-      - name: Build
-        if: steps.build-cache.outputs.cache-hit != 'true'
+
+      - name: Install ninja (Linux)
+        if: steps.build-cache.outputs.cache-hit != 'true' && runner.os == 'Linux'
         run: |
-          sccache -z
-          just compile ${{ matrix.target }}
-          sccache -s
-      - name: Package
-        run: just package ${{ matrix.target }}
-      - uses: actions/upload-artifact@v4
-        with:
-          name: cronet-${{ matrix.name }}
-          path: |
-            lib/
-            include/
+          sudo apt-get update
+          sudo apt-get install -y ninja-build ${{ matrix.libc == 'musl' && 'zstd' || '' }}
 
-  windows:
-    runs-on: windows-2022
-    strategy:
-      fail-fast: false
-      matrix:
-        arch: [amd64, arm64]
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          submodules: 'recursive'
-      - uses: taiki-e/install-action@v2
-        with:
-          tool: just
-      - uses: dtolnay/rust-toolchain@nightly
-      - name: Get naiveproxy commit
-        id: naive
-        shell: bash
-        run: echo "commit=$(git -C naiveproxy rev-parse HEAD)" >> $GITHUB_OUTPUT
-      - name: Get Chromium version
-        id: chromium
-        shell: bash
-        run: echo "version=$(cat naiveproxy/CHROMIUM_VERSION)" >> $GITHUB_OUTPUT
-      - name: Cache build artifacts
-        id: build-cache
-        uses: actions/cache@v4
-        with:
-          path: naiveproxy/src/out
-          key: naive-build-${{ steps.naive.outputs.commit }}-${{ hashFiles('scripts/build-cronet.rs') }}-windows-${{ matrix.arch }}
-      - name: Install ninja
-        if: steps.build-cache.outputs.cache-hit != 'true'
+      - name: Install ninja (macOS)
+        if: steps.build-cache.outputs.cache-hit != 'true' && runner.os == 'macOS'
+        run: brew install ninja
+
+      - name: Install ninja (Windows)
+        if: steps.build-cache.outputs.cache-hit != 'true' && runner.os == 'Windows'
         run: choco install ninja -y
-      - name: Setup sccache
-        if: steps.build-cache.outputs.cache-hit != 'true'
-        uses: mozilla-actions/sccache-action@v0.0.10
-      - name: Build
-        if: steps.build-cache.outputs.cache-hit != 'true'
-        run: |
-          sccache -z
-          just compile windows/${{ matrix.arch }}
-          sccache -s
-      - name: Package
-        run: just package windows/${{ matrix.arch }}
-      - uses: actions/upload-artifact@v4
-        with:
-          name: cronet-windows-${{ matrix.arch }}
-          path: |
-            lib/
-            include/
 
-  android:
-    runs-on: ubuntu-22.04
-    strategy:
-      fail-fast: false
-      matrix:
-        arch: [arm64, amd64, arm, "386"]
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          submodules: 'recursive'
-      - uses: taiki-e/install-action@v2
-        with:
-          tool: just
-      - uses: dtolnay/rust-toolchain@nightly
-      - name: Get naiveproxy commit
-        id: naive
-        run: echo "commit=$(git -C naiveproxy rev-parse HEAD)" >> $GITHUB_OUTPUT
-      - name: Get Chromium version
-        id: chromium
-        run: echo "version=$(cat naiveproxy/CHROMIUM_VERSION)" >> $GITHUB_OUTPUT
-      - name: Cache build artifacts
-        id: build-cache
-        uses: actions/cache@v4
-        with:
-          path: naiveproxy/src/out
-          key: naive-build-${{ steps.naive.outputs.commit }}-${{ hashFiles('scripts/build-cronet.rs') }}-android-${{ matrix.arch }}
-      - name: Install ninja
-        if: steps.build-cache.outputs.cache-hit != 'true'
-        run: |
-          sudo apt update
-          sudo apt install -y ninja-build
-      - name: Setup sccache
-        if: steps.build-cache.outputs.cache-hit != 'true'
-        uses: mozilla-actions/sccache-action@v0.0.10
-      - name: Build
-        if: steps.build-cache.outputs.cache-hit != 'true'
+      # Only Linux glibc targets pull a Debian sysroot that needs the keyring.
+      - name: Regenerate Debian keyring
+        if: steps.build-cache.outputs.cache-hit != 'true' && startsWith(matrix.target, 'linux/') && matrix.libc != 'musl'
         run: |
-          sccache -z
-          just compile android/${{ matrix.arch }}
-          sccache -s
-      - name: Package
-        run: just package android/${{ matrix.arch }}
-      - uses: actions/upload-artifact@v4
-        with:
-          name: cronet-android-${{ matrix.arch }}
-          path: |
-            lib/
-            include/
+          rm -f ./naiveproxy/src/build/linux/sysroot_scripts/keyring.gpg
+          GPG_TTY=/dev/null ./naiveproxy/src/build/linux/sysroot_scripts/generate_keyring.sh
 
-  linux-musl:
-    runs-on: ubuntu-24.04
-    strategy:
-      fail-fast: false
-      matrix:
-        arch: [amd64, arm64, "386", arm, loong64, mipsle, riscv64]
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          submodules: 'recursive'
-      - uses: taiki-e/install-action@v2
-        with:
-          tool: just
-      - uses: dtolnay/rust-toolchain@nightly
-      - name: Get naiveproxy commit
-        id: naive
-        run: echo "commit=$(git -C naiveproxy rev-parse HEAD)" >> $GITHUB_OUTPUT
-      - name: Get Chromium version
-        id: chromium
-        run: echo "version=$(cat naiveproxy/CHROMIUM_VERSION)" >> $GITHUB_OUTPUT
-      - name: Cache build artifacts
-        id: build-cache
-        uses: actions/cache@v4
-        with:
-          path: naiveproxy/src/out
-          key: naive-build-${{ steps.naive.outputs.commit }}-${{ hashFiles('scripts/build-cronet.rs') }}-linux-musl-${{ matrix.arch }}
-      - name: Install packages
-        if: steps.build-cache.outputs.cache-hit != 'true'
-        run: |
-          sudo apt update
-          sudo apt install -y ninja-build zstd
       - name: Setup sccache
         if: steps.build-cache.outputs.cache-hit != 'true'
         uses: mozilla-actions/sccache-action@v0.0.10
+
       - name: Build
         if: steps.build-cache.outputs.cache-hit != 'true'
         run: |
           sccache -z
-          just compile linux/${{ matrix.arch }} musl
+          just compile "${{ matrix.target }}" "${{ matrix.libc }}"
           sccache -s
+
       - name: Package
-        run: just package linux/${{ matrix.arch }} musl
+        run: just package "${{ matrix.target }}" "${{ matrix.libc }}"
+
       - uses: actions/upload-artifact@v4
         with:
-          name: cronet-linux-musl-${{ matrix.arch }}
+          name: ${{ matrix.name }}
           path: |
             lib/
             include/
 
   release-libs:
     if: (github.event_name == 'push' && github.ref_name == 'main') || github.event_name == 'workflow_dispatch'
-    needs: [linux, linux-musl, darwin, windows, android]
+    needs: [build]
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
@@ -304,10 +129,6 @@ jobs:
           path: artifacts/
           merge-multiple: false
 
-      - name: Get Chromium version
-        id: chromium
-        run: echo "version=$(cat naiveproxy/CHROMIUM_VERSION)" >> "$GITHUB_OUTPUT"
-
       - name: Prepare release assets
         run: |
           mkdir -p release

From b0c30224008210d4b5cf73df09aebc4e55b0a8a4 Mon Sep 17 00:00:00 2001
From: iHsin <sun@ihsin.dev>
Date: Tue, 9 Jun 2026 20:27:55 +0800
Subject: [PATCH 05/10] ci: drop the out/ build cache; install ninja via
 setup-ninja action
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Remove the actions/cache of naiveproxy/src/out and every
  `steps.build-cache.outputs.cache-hit != 'true'` gate (and the
  now-unused "Get naiveproxy commit" step that only fed the cache key).
  Compiler caching is handled entirely by sccache + GHA, so the coarse
  full-output cache is redundant; the build always runs now.
- Replace the per-OS apt/brew/choco ninja installs with
  seanmiddleditch/gha-setup-ninja@v6 (cross-platform). Keep a musl-only
  zstd install for the OpenWrt SDK extraction.

Note: without the out/ cache, an unchanged push no longer skips the build
instantly — it re-runs, sped up by warm sccache.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/workflows/build.yml | 30 ++++++------------------------
 1 file changed, 6 insertions(+), 24 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 09e434b1..a284c3cc 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -62,44 +62,26 @@ jobs:
 
       - uses: dtolnay/rust-toolchain@nightly
 
-      - name: Get naiveproxy commit
-        id: naive
-        run: echo "commit=$(git -C naiveproxy rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+      - name: Setup ninja
+        uses: seanmiddleditch/gha-setup-ninja@v6
 
-      - name: Cache build artifacts
-        id: build-cache
-        uses: actions/cache@v4
-        with:
-          path: naiveproxy/src/out
-          key: naive-build-${{ steps.naive.outputs.commit }}-${{ hashFiles('scripts/build-cronet.rs') }}-${{ matrix.name }}
-
-      - name: Install ninja (Linux)
-        if: steps.build-cache.outputs.cache-hit != 'true' && runner.os == 'Linux'
+      - name: Install zstd (musl)
+        if: runner.os == 'Linux' && matrix.libc == 'musl'
         run: |
           sudo apt-get update
-          sudo apt-get install -y ninja-build ${{ matrix.libc == 'musl' && 'zstd' || '' }}
-
-      - name: Install ninja (macOS)
-        if: steps.build-cache.outputs.cache-hit != 'true' && runner.os == 'macOS'
-        run: brew install ninja
-
-      - name: Install ninja (Windows)
-        if: steps.build-cache.outputs.cache-hit != 'true' && runner.os == 'Windows'
-        run: choco install ninja -y
+          sudo apt-get install -y zstd
 
       # Only Linux glibc targets pull a Debian sysroot that needs the keyring.
       - name: Regenerate Debian keyring
-        if: steps.build-cache.outputs.cache-hit != 'true' && startsWith(matrix.target, 'linux/') && matrix.libc != 'musl'
+        if: startsWith(matrix.target, 'linux/') && matrix.libc != 'musl'
         run: |
           rm -f ./naiveproxy/src/build/linux/sysroot_scripts/keyring.gpg
           GPG_TTY=/dev/null ./naiveproxy/src/build/linux/sysroot_scripts/generate_keyring.sh
 
       - name: Setup sccache
-        if: steps.build-cache.outputs.cache-hit != 'true'
         uses: mozilla-actions/sccache-action@v0.0.10
 
       - name: Build
-        if: steps.build-cache.outputs.cache-hit != 'true'
         run: |
           sccache -z
           just compile "${{ matrix.target }}" "${{ matrix.libc }}"

From b77952fff1dff2073836cebf3ed3268c0e0211ca Mon Sep 17 00:00:00 2001
From: iHsin <sun@ihsin.dev>
Date: Tue, 9 Jun 2026 20:37:30 +0800
Subject: [PATCH 06/10] ci: rely on preinstalled ninja, drop setup-ninja action

All runner images (ubuntu-24.04/22.04, macos-15, windows-2022) ship
ninja 1.13.2, so no install step is needed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/workflows/build.yml | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index a284c3cc..f16cc860 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -62,9 +62,6 @@ jobs:
 
       - uses: dtolnay/rust-toolchain@nightly
 
-      - name: Setup ninja
-        uses: seanmiddleditch/gha-setup-ninja@v6
-
       - name: Install zstd (musl)
         if: runner.os == 'Linux' && matrix.libc == 'musl'
         run: |

From 573ec6f2e44bfe8170c7090ab5bf7816050d97b1 Mon Sep 17 00:00:00 2001
From: iHsin <sun@ihsin.dev>
Date: Tue, 9 Jun 2026 21:04:51 +0800
Subject: [PATCH 07/10] ci: sccache local-disk mode + packed per-target
 actions/cache

The ghac backend created one cache entry per compiled object; on a build
this large GitHub's cache service throttled every write (last run: 2459
misses == 2459 write errors, ~0 effective caching).

Switch to sccache local-disk mode (SCCACHE_DIR under runner.temp,
SCCACHE_CACHE_SIZE=2G) and persist the whole cache dir as a single
actions/cache blob per target (key by matrix.name + script hash + run_id,
with restore-keys), following rust-proxy/workflows. One cache op per job
instead of thousands.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/workflows/build.yml | 23 ++++++++++++++++++-----
 1 file changed, 18 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index f16cc860..33926919 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -16,10 +16,6 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
-env:
-  # All platforms use sccache with the GitHub Actions cache service as backend.
-  SCCACHE_GHA_ENABLED: "true"
-
 defaults:
   run:
     shell: bash
@@ -75,9 +71,26 @@ jobs:
           rm -f ./naiveproxy/src/build/linux/sysroot_scripts/keyring.gpg
           GPG_TTY=/dev/null ./naiveproxy/src/build/linux/sysroot_scripts/generate_keyring.sh
 
-      - name: Setup sccache
+      - name: Install sccache
         uses: mozilla-actions/sccache-action@v0.0.10
 
+      # Local-disk mode: sccache writes one cache dir, persisted as a single
+      # actions/cache blob per target (the ghac backend's per-object writes get
+      # throttled by GitHub's cache service on a build this large).
+      - name: Configure sccache (local disk)
+        run: |
+          echo "SCCACHE_DIR=${{ runner.temp }}/sccache" >> "$GITHUB_ENV"
+          echo "SCCACHE_CACHE_SIZE=2G" >> "$GITHUB_ENV"
+
+      - name: Cache sccache directory
+        uses: actions/cache@v4
+        with:
+          path: ${{ runner.temp }}/sccache
+          key: sccache-${{ matrix.name }}-${{ hashFiles('scripts/build-cronet.rs') }}-${{ github.run_id }}
+          restore-keys: |
+            sccache-${{ matrix.name }}-${{ hashFiles('scripts/build-cronet.rs') }}-
+            sccache-${{ matrix.name }}-
+
       - name: Build
         run: |
           sccache -z

From 375b9afab6c3920e9e5d5a906a4b936f798945cc Mon Sep 17 00:00:00 2001
From: iHsin <sun@ihsin.dev>
Date: Tue, 9 Jun 2026 21:32:54 +0800
Subject: [PATCH 08/10] ci: size each target's sccache cache to 10GiB / target
 count

Compute SCCACHE_CACHE_SIZE in the prepare job as 10240M / number of
targets (currently 29 -> 353M) and pass it to the build job, so all
per-target caches sum within the 10 GB GHA quota and stop evicting each
other. Auto-adjusts as targets are added/removed in target.toml.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/workflows/build.yml | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 33926919..ac5b2893 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -27,6 +27,7 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       targets: ${{ steps.set.outputs.targets }}
+      sccache_size: ${{ steps.set.outputs.sccache_size }}
     steps:
       - uses: actions/checkout@v4
       - uses: taiki-e/install-action@v2
@@ -37,6 +38,12 @@ jobs:
         run: |
           targets=$(toml2json .github/target.toml | jaq -c '.target')
           echo "targets=$targets" >> "$GITHUB_OUTPUT"
+          # Split the 10 GiB GHA cache quota evenly across targets so their
+          # per-target sccache caches coexist instead of LRU-evicting each other.
+          count=$(echo "$targets" | jaq 'length')
+          size=$(( 10240 / count ))
+          echo "sccache_size=${size}M" >> "$GITHUB_OUTPUT"
+          echo "targets: $count -> sccache size per target: ${size}M"
           echo "$targets" | jaq .
 
   build:
@@ -80,7 +87,7 @@ jobs:
       - name: Configure sccache (local disk)
         run: |
           echo "SCCACHE_DIR=${{ runner.temp }}/sccache" >> "$GITHUB_ENV"
-          echo "SCCACHE_CACHE_SIZE=2G" >> "$GITHUB_ENV"
+          echo "SCCACHE_CACHE_SIZE=${{ needs.prepare.outputs.sccache_size }}" >> "$GITHUB_ENV"
 
       - name: Cache sccache directory
         uses: actions/cache@v4

From b5193aa9158a666f2a725ef9a0b07fcf6bfaa06e Mon Sep 17 00:00:00 2001
From: iHsin <sun@ihsin.dev>
Date: Tue, 9 Jun 2026 22:09:31 +0800
Subject: [PATCH 09/10] ci: pin sccache to 0.12.0 for win/arm64 (latest breaks
 asm)

sccache 0.15.0 mishandles BoringSSL's assembler output paths on
windows/arm64 (assemblerToPreprocess -> "failed to zip up compiler
outputs", obj not found), failing the build. Pin only that target to the
last known-good 0.12.0 via a per-target sccache_version field in
target.toml; every other target stays on latest.

(The local-disk + packed actions/cache change is confirmed working here:
this run showed 0 cache write errors.)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/target.toml         | 3 +++
 .github/workflows/build.yml | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/.github/target.toml b/.github/target.toml
index 9c22c243..793aedfb 100644
--- a/.github/target.toml
+++ b/.github/target.toml
@@ -166,3 +166,6 @@ name = "cronet-windows-amd64"
 os = "windows-2022"
 target = "windows/arm64"
 name = "cronet-windows-arm64"
+# sccache >=0.13 mishandles BoringSSL's assembler output paths on win/arm64;
+# pin the last known-good version (others use latest).
+sccache_version = "v0.12.0"
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index ac5b2893..67eb695f 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -80,6 +80,9 @@ jobs:
 
       - name: Install sccache
         uses: mozilla-actions/sccache-action@v0.0.10
+        with:
+          # Only win/arm64 pins a version (see target.toml); others use latest.
+          version: ${{ matrix.sccache_version || 'latest' }}
 
       # Local-disk mode: sccache writes one cache dir, persisted as a single
       # actions/cache blob per target (the ghac backend's per-object writes get

From fadd728c6c6815ade09b4b75e4225459a31db1d0 Mon Sep 17 00:00:00 2001
From: iHsin <sun@ihsin.dev>
Date: Tue, 9 Jun 2026 22:13:14 +0800
Subject: [PATCH 10/10] =?UTF-8?q?ci:=20fix=20sccache=20version=20input=20?=
 =?UTF-8?q?=E2=80=94=20empty=20(not=20'latest')=20means=20latest?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The sccache-action uses the version input verbatim as the release tag, so
`version: latest` requested releases/download/latest/... -> 404, failing
every non-pinned target. Pass empty instead (matrix.sccache_version),
which triggers the action's fetch-latest path. win/arm64 keeps its
v0.12.0 pin.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/workflows/build.yml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 67eb695f..9d96bc6e 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -81,8 +81,9 @@ jobs:
       - name: Install sccache
         uses: mozilla-actions/sccache-action@v0.0.10
         with:
-          # Only win/arm64 pins a version (see target.toml); others use latest.
-          version: ${{ matrix.sccache_version || 'latest' }}
+          # Empty -> action fetches the latest release. Only win/arm64 pins a
+          # version (see target.toml), since latest sccache breaks its asm build.
+          version: ${{ matrix.sccache_version }}
 
       # Local-disk mode: sccache writes one cache dir, persisted as a single
       # actions/cache blob per target (the ghac backend's per-object writes get