fix: ensure clean BoringSSL builds across all platforms

This commit addresses platform cross-contamination issues where cached
BoringSSL directories from one OS (e.g., macOS) would cause build
failures on another OS (e.g., Linux trying to compile Apple assembly files).

Changes:
- Always remove and re-clone BoringSSL to prevent contamination
- Clean build directories before building
- Apply consistent build approach across Linux, macOS, and Windows
- Temporarily reduce Python test matrix to 3.8 only for faster iteration

This fixes the Linux build error where it was trying to assemble
`aes-gcm-avx2-x86_64-apple.S` files with the GNU assembler.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: arman-bd

.github/workflows/_config.yml

@@ -62,7 +62,7 @@ jobs:
 
           # Python versions to test
           PYTHON_MATRIX='[
-            "3.8", "3.11", "3.14"
+            "3.8"
           ]'
           # Python versions: "3.8", "3.9", "3.10", "3.11", "3.12", "3.13", "3.14"
 

scripts/darwin/setup_vendors.sh

@@ -27,11 +27,16 @@ cd "$VENDOR_DIR"
 #
 echo "==> Setting up BoringSSL..."
 
-if [ ! -d "boringssl" ]; then
-    echo "Cloning BoringSSL..."
-    git clone --depth 1 https://boringssl.googlesource.com/boringssl
+# Always remove and re-clone BoringSSL to ensure clean state
+# This prevents platform cross-contamination (e.g., Linux files on macOS runners)
+if [ -d "boringssl" ]; then
+    echo "Removing existing BoringSSL directory to ensure clean build..."
+    rm -rf boringssl
 fi
 
+echo "Cloning BoringSSL..."
+git clone --depth 1 https://boringssl.googlesource.com/boringssl
+
 cd boringssl
 
 # Check if already built
@@ -48,6 +53,12 @@ if [ ! -f "build/ssl/libssl.a" ] && [ ! -f "build/libssl.a" ]; then
         echo "WARNING: go not found. BoringSSL will build without some tests."
     fi
 
+    # Clean build directory if it exists
+    if [ -d "build" ]; then
+        echo "Cleaning previous build..."
+        rm -rf build
+    fi
+
     mkdir -p build
     cd build
 

scripts/linux/setup_vendors.sh

@@ -28,19 +28,15 @@ cd "$VENDOR_DIR"
 #
 echo "==> Setting up BoringSSL..."
 
-# Always ensure clean BoringSSL clone to avoid platform detection issues
+# Always remove and re-clone BoringSSL to ensure clean state
+# This prevents platform cross-contamination (e.g., macOS files on Linux runners)
 if [ -d "boringssl" ]; then
-    # Check if build exists, if not, remove and re-clone
-    if [ ! -f "boringssl/build/libssl.a" ]; then
-        echo "Removing incomplete BoringSSL clone..."
-        rm -rf boringssl
-    fi
+    echo "Removing existing BoringSSL directory to ensure clean build..."
+    rm -rf boringssl
 fi
 
-if [ ! -d "boringssl" ]; then
-    echo "Cloning BoringSSL..."
-    git clone --depth 1 https://boringssl.googlesource.com/boringssl
-fi
+echo "Cloning BoringSSL..."
+git clone --depth 1 https://boringssl.googlesource.com/boringssl
 
 cd boringssl
 

scripts/windows/setup_vendors.sh

@@ -28,11 +28,16 @@ cd "$VENDOR_DIR"
 #
 echo "==> Setting up BoringSSL..."
 
-if [ ! -d "boringssl" ]; then
-    echo "Cloning BoringSSL..."
-    git clone --depth 1 https://boringssl.googlesource.com/boringssl
+# Always remove and re-clone BoringSSL to ensure clean state
+# This prevents platform cross-contamination (e.g., Linux files on Windows runners)
+if [ -d "boringssl" ]; then
+    echo "Removing existing BoringSSL directory to ensure clean build..."
+    rm -rf boringssl
 fi
 
+echo "Cloning BoringSSL..."
+git clone --depth 1 https://boringssl.googlesource.com/boringssl
+
 cd boringssl
 
 # Check if already built
@@ -49,6 +54,12 @@ if [ ! -f "build/ssl/Release/ssl.lib" ] && [ ! -f "build/Release/ssl.lib" ]; the
         echo "WARNING: go not found. BoringSSL will build without some tests."
     fi
 
+    # Clean build directory if it exists
+    if [ -d "build" ]; then
+        echo "Cleaning previous build..."
+        rm -rf build
+    fi
+
     mkdir -p build
     cd build