From 04d6703cee7bd300adbcb261fb37b54ee5530e87 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Thu, 15 Oct 2026 02:25:39 +0000
Subject: [PATCH] chore: sync public mirror from internal

---
 .repository-projection.json     | 10 +++++-----
 scripts/ci/aws-lc-system-env.sh | 30 ++++++++++++++++++++++++++++++
 2 files changed, 35 insertions(+), 5 deletions(-)
 create mode 100755 scripts/ci/aws-lc-system-env.sh

diff --git a/.repository-projection.json b/.repository-projection.json
index 03e2759fc..9858ba4dd 100644
--- a/.repository-projection.json
+++ b/.repository-projection.json
@@ -3,11 +3,11 @@
   "projection": "deixic-code",
   "projectionSchemaVersion": 1,
   "sourceRepository": "dx-corp/mono",
-  "sourceSha": "666acb965f6d4e326cdc80c3b9f91364519b4aef",
+  "sourceSha": "6529900782746f88692761b446f8729a9e9d5b82",
   "destinationRepository": "dx-corp/code",
-  "priorProjectedBase": "b8e3c44da2b491903de44f5b2ea654b6af031263",
-  "definitionDigest": "cb9d429542ebb0a2de9b42a7aad60d9d8696a648ceba47c30f05c0b285ca0db7",
-  "toolDigest": "1c203c72efccfef70174b6df0328c22c39a1a42d10fd0c66b3bcb380e45abd24",
-  "contentDigest": "272bcb743f5136be4d3f9ce0c698f4f82b5813ed33bd043f8fc4bcba930518c8",
+  "priorProjectedBase": "63c72682366aca96d1a1ccf399c2268c878c69a0",
+  "definitionDigest": "93eb3fb9be07d3644538c5519cf38973b4246cdcf2f8d7b60ccd593d7ca73033",
+  "toolDigest": "af7618786ec1e7b039f7f09614699596e629012b1f7dac8ca7787895d68744de",
+  "contentDigest": "942ad8423dd2c7a7f3bc92d5cf0a3c851941c19571ad17f9be3d719579c790d2",
   "publicationEligible": true
 }
diff --git a/scripts/ci/aws-lc-system-env.sh b/scripts/ci/aws-lc-system-env.sh
new file mode 100755
index 000000000..a8b8d2079
--- /dev/null
+++ b/scripts/ci/aws-lc-system-env.sh
@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# Point aws-lc-sys at a prebuilt AWS-LC when the host has one for the workspace lockfile version.
+#
+#   scripts/ci/aws-lc-system-env.sh          # in CI: appends the env to $GITHUB_ENV
+#   eval "$(scripts/ci/aws-lc-system-env.sh --print)"   # in a shell
+#
+# The prefix comes from scripts/dev/build-awslc-prefix.sh (baked into the runner image or host). With no
+# matching prefix this does nothing and the crate compiles its bundled copy, so it cannot break a build.
+set -euo pipefail
+repo="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd -P)"
+root="${AWS_LC_PREFIX_ROOT:-/opt}"
+[[ "$(uname -sm)" == "Linux x86_64" ]] || exit 0
+lockfile="$repo/rust/Cargo.lock"
+[[ -f "$lockfile" ]] || lockfile="$repo/Cargo.lock"
+versions="$(awk '/^name = "aws-lc-sys"$/ { getline; gsub(/[^0-9.]/, "", $3); print $3 }' "$lockfile")"
+[[ "$(printf '%s\n' "$versions" | grep -c .)" == 1 ]] || exit 0
+prefix="$root/aws-lc-sys-$versions"
+[[ -f "$prefix/lib/libcrypto.a" && -f "$prefix/share/rust/aws_lc_bindings.rs" ]] || { echo "no prebuilt AWS-LC at $prefix; aws-lc-sys will compile its bundled copy" >&2; exit 0; }
+vars=(
+  "AWS_LC_SYS_SYSTEM_DIR=$prefix"
+  "AWS_LC_SYS_USE_SYSTEM=1"
+  "AWS_LC_SYS_STATIC=1"
+  "AWS_LC_SYS_SYSTEM_BINDINGS=$prefix/share/rust/aws_lc_bindings.rs"
+)
+if [[ "${1:-}" == "--print" ]]; then
+  printf 'export %s\n' "${vars[@]}"
+else
+  printf '%s\n' "${vars[@]}" >> "${GITHUB_ENV:?GITHUB_ENV is required}"
+  echo "linking prebuilt AWS-LC from $prefix"
+fi