Harden cross command construction

.github/actions/rust-build-release/README.md

@@ -1,5 +1,7 @@
 # rust-build-release
 
+<!-- markdownlint-disable MD013 MD060 -->
+
 Build Rust application release artefacts using the repository's `setup-rust` action, `uv`, and `cross`.
 
 FreeBSD targets (for example `x86_64-unknown-freebsd`) require `cross` with a
@@ -27,6 +29,20 @@ Toolchains are resolved from the target repository in this order: explicit
 `toolchain` input, repository `rust-toolchain.toml` or `rust-toolchain`,
 manifest `rust-version`, then the action's bundled fallback version.
 
+## Toolchain specification for cross builds
+
+When `cross` is used for compilation, toolchain selection must be made via one
+of the following methods — **not** via a `+<toolchain>` CLI override:
+
+- **`rust-toolchain.toml`** in the project repository (recommended).
+- The `toolchain` action input, which is propagated as the `RUSTUP_TOOLCHAIN`
+  environment variable for the `cross` invocation.
+- The `RUSTUP_TOOLCHAIN` environment variable set upstream in the workflow.
+
+Passing a `+<toolchain>` override on the `cross` command line is rejected by the
+action and will cause the build to fail with a `::error::` annotation. This
+restriction does not apply to `cargo`-only builds.
+
 ## Inputs
 
 | Name          | Type   | Default                    | Description                                                        | Required |

.github/actions/rust-build-release/src/cross_manager.py

@@ -4,6 +4,7 @@
 
 import hashlib
 import shutil
+import subprocess
 import sys
 import tempfile
 import urllib.error
@@ -214,7 +215,7 @@ def version_compare(installed: str, required: str) -> bool:
                         required_cross_version,
                     ]
                 )
-            except ProcessExecutionError:
+            except (ProcessExecutionError, subprocess.CalledProcessError):
                 try:
                     run_cmd(
                         local["cargo"][
@@ -227,7 +228,7 @@ def version_compare(installed: str, required: str) -> bool:
                             f"v{required_cross_version}",
                         ]
                     )
-                except ProcessExecutionError:
+                except (ProcessExecutionError, subprocess.CalledProcessError):
                     if sys.platform == "win32":
                         typer.echo(
                             "::warning:: cross install failed; continuing without "

.github/actions/rust-build-release/src/gha.py

@@ -0,0 +1,30 @@
+"""GitHub Actions workflow command helpers."""
+
+from __future__ import annotations
+
+import typing as typ
+
+import typer
+
+
+class _Echo(typ.Protocol):
+    """Callable shape used by typer.echo-compatible adapters."""
+
+    def __call__(self, message: str, *, err: bool = False) -> None:
+        """Emit *message*, optionally to stderr."""
+        ...
+
+
+def debug(message: str, *, echo: _Echo = typer.echo) -> None:
+    """Emit a ::debug:: workflow command."""
+    echo(f"::debug:: {message}")
+
+
+def warning(message: str, *, echo: _Echo = typer.echo) -> None:
+    """Emit a ::warning:: workflow command."""
+    echo(f"::warning:: {message}", err=True)
+
+
+def error(message: str, *, echo: _Echo = typer.echo) -> None:
+    """Emit a ::error:: workflow command."""
+    echo(f"::error:: {message}", err=True)