fix(ci): persist PATH modifications to GITHUB_PATH across all install scripts

Ensure all tool installation scripts properly export PATH changes to
GITHUB_PATH so subsequent workflow steps can find installed binaries.

Changes:
- install-system-deps: Export cmake and homebrew paths to GITHUB_PATH
- install-cargo tools: Export ~/.cargo/bin to GITHUB_PATH for deny, taplo, llvm-cov
- install-shfmt: Export /usr/local/bin to GITHUB_PATH on Linux
- install-wasm-pack: Export ~/.cargo/bin to GITHUB_PATH
- setup-openssl: Export OpenSSL bin directories to GITHUB_PATH (Linux, macOS, Windows)
- setup-go-cgo-env: Use GITHUB_PATH instead of GITHUB_ENV for PATH on Windows

Fixes publish workflow failures where cmake and other build tools were
not found during cargo builds with build.rs scripts.

Author: Goldziher

scripts/ci/actions/setup-go-cgo-env/windows.ps1

@@ -45,13 +45,20 @@ if ([string]::IsNullOrWhiteSpace($env:PKG_CONFIG_PATH)) {
 
 $env:PATH = "${ffiPath};$($env:PATH)"
 
+# Persist FFI path to GITHUB_PATH for subsequent steps
+if (Test-Path $ffiPath) {
+  Add-Content -Path $env:GITHUB_PATH -Value $ffiPath -Encoding utf8
+}
+
 # Convert FFI path to MSYS2 format for CGO flags
 $msys2FfiPath = ConvertTo-Msys2Path $ffiPath
 $msys2IncludePath = "$msys2RepoRoot/crates/kreuzberg-ffi/include"
 
 $mingwBin = "C:\msys64\mingw64\bin"
 if (Test-Path (Join-Path $mingwBin "x86_64-w64-mingw32-gcc.exe")) {
   $env:PATH = "${mingwBin};$($env:PATH)"
+  # Persist MinGW bin to GITHUB_PATH for subsequent steps
+  Add-Content -Path $env:GITHUB_PATH -Value $mingwBin -Encoding utf8
   $env:CC = "x86_64-w64-mingw32-gcc"
   $env:CXX = "x86_64-w64-mingw32-g++"
   $env:AR = "x86_64-w64-mingw32-ar"
@@ -75,7 +82,7 @@ if ($env:KREUZBERG_GO_LINKER_VERBOSE -eq "1") {
 $cgoLdflags = "-L$msys2FfiPath $linkerVerboseFlags".Trim()
 
 # Add libraries to PATH for runtime discovery
-Add-Content -Path $env:GITHUB_ENV -Value "PATH=$env:PATH"
+# Note: PATH modifications are now handled via GITHUB_PATH above
 Add-Content -Path $env:GITHUB_ENV -Value "PKG_CONFIG_PATH=$pkgConfigPath"
 Add-Content -Path $env:GITHUB_ENV -Value "CGO_ENABLED=$cgoEnabled"
 Add-Content -Path $env:GITHUB_ENV -Value "CGO_CFLAGS=$cgoCflags"

scripts/ci/actions/setup-openssl/linux-configure.sh

@@ -19,6 +19,11 @@ fi
   echo "PKG_CONFIG_PATH=${PKG_CONFIG_DIR}:${PKG_CONFIG_PATH:-}"
 } >>"$GITHUB_ENV"
 
+# Ensure OpenSSL binaries are in PATH for subsequent steps
+if [[ -n "${GITHUB_PATH:-}" && -d "${OPENSSL_ROOT}/bin" ]]; then
+  echo "${OPENSSL_ROOT}/bin" >>"$GITHUB_PATH"
+fi
+
 echo "OpenSSL configuration completed:"
 echo "  OPENSSL_DIR=${OPENSSL_ROOT}"
 echo "  PKG_CONFIG_PATH=${PKG_CONFIG_DIR}"

scripts/ci/actions/setup-openssl/macos-configure.sh

@@ -27,3 +27,8 @@ echo "OpenSSL include path: $prefix/include"
   echo "OPENSSL_INCLUDE_DIR=$prefix/include"
   echo "PKG_CONFIG_PATH=$prefix/lib/pkgconfig:${PKG_CONFIG_PATH:-}"
 } >>"$GITHUB_ENV"
+
+# Ensure OpenSSL binaries are in PATH for subsequent steps
+if [[ -n "${GITHUB_PATH:-}" && -d "$prefix/bin" ]]; then
+  echo "$prefix/bin" >>"$GITHUB_PATH"
+fi

scripts/ci/actions/setup-openssl/windows-configure.ps1

@@ -25,6 +25,13 @@ foreach ($key in $envVars.Keys) {
   Add-Content -Path $env:GITHUB_ENV -Value "$key=$value"
 }
 
+# Ensure OpenSSL binaries are in PATH for subsequent steps
+$opensslBin = "$vcpkgRoot\bin"
+if (Test-Path $opensslBin) {
+  Write-Host "  Adding $opensslBin to GITHUB_PATH"
+  Add-Content -Path $env:GITHUB_PATH -Value $opensslBin -Encoding utf8
+}
+
 Write-Host "OpenSSL environment configuration completed" -ForegroundColor Green
 Write-Host "Summary:" -ForegroundColor Green
 Write-Host "  OPENSSL_DIR=$vcpkgRoot"

scripts/ci/actions/setup-rust/install-cargo-llvm-cov.sh

@@ -7,3 +7,8 @@ if ! command -v cargo-llvm-cov &>/dev/null; then
 else
   echo "cargo-llvm-cov already installed"
 fi
+
+# Ensure ~/.cargo/bin is in PATH for subsequent steps
+if [[ -n "${GITHUB_PATH:-}" && -d "$HOME/.cargo/bin" ]]; then
+  echo "$HOME/.cargo/bin" >>"$GITHUB_PATH"
+fi

scripts/ci/install-system-deps/install-linux.sh

@@ -61,6 +61,12 @@ echo "CMake:"
 if command -v cmake >/dev/null 2>&1; then
   cmake --version | head -1
   echo "✓ CMake available"
+  # Ensure cmake binary directory is in GITHUB_PATH for subsequent steps
+  CMAKE_BIN="$(dirname "$(command -v cmake)")"
+  if [[ -n "$GITHUB_PATH" && -d "$CMAKE_BIN" ]]; then
+    echo "$CMAKE_BIN" >>"$GITHUB_PATH"
+    echo "✓ Added cmake directory to GITHUB_PATH: $CMAKE_BIN"
+  fi
 else
   echo "::error::CMake not found after installation"
   exit 1

scripts/ci/install-system-deps/install-macos.sh

@@ -10,9 +10,13 @@ echo "::group::Installing macOS dependencies"
 
 if [[ -d "/opt/homebrew/bin" ]]; then
   export PATH="/opt/homebrew/bin:/opt/homebrew/sbin:${PATH}"
+  echo "/opt/homebrew/bin" >>"$GITHUB_PATH"
+  echo "/opt/homebrew/sbin" >>"$GITHUB_PATH"
 fi
 if [[ -d "/usr/local/bin" ]]; then
   export PATH="/usr/local/bin:/usr/local/sbin:${PATH}"
+  echo "/usr/local/bin" >>"$GITHUB_PATH"
+  echo "/usr/local/sbin" >>"$GITHUB_PATH"
 fi
 
 if ! brew list cmake &>/dev/null; then
@@ -93,6 +97,12 @@ echo "::group::Verifying macOS installations"
 echo "CMake:"
 if command -v cmake >/dev/null 2>&1; then
   cmake --version | head -1
+  # Ensure cmake binary directory is in GITHUB_PATH for subsequent steps
+  CMAKE_BIN="$(dirname "$(command -v cmake)")"
+  if [[ -n "$GITHUB_PATH" && -d "$CMAKE_BIN" ]]; then
+    echo "$CMAKE_BIN" >>"$GITHUB_PATH"
+    echo "✓ Added cmake directory to GITHUB_PATH: $CMAKE_BIN"
+  fi
 else
   echo "::error::CMake not found on PATH after installation"
   echo "PATH=$PATH"

scripts/ci/validate/install-cargo-deny.sh

@@ -5,6 +5,11 @@ bash scripts/ci/validate/show-disk-space.sh "Before cargo-deny installation"
 
 cargo install cargo-deny --locked
 
+# Ensure ~/.cargo/bin is in PATH for subsequent steps
+if [[ -n "${GITHUB_PATH:-}" && -d "$HOME/.cargo/bin" ]]; then
+  echo "$HOME/.cargo/bin" >>"$GITHUB_PATH"
+fi
+
 rm -rf ~/.cargo/registry/cache/* ~/.cargo/git/db/* 2>/dev/null || true
 
 bash scripts/ci/validate/show-disk-space.sh "After cargo-deny installation and cleanup"

scripts/ci/validate/install-shfmt.sh

@@ -6,6 +6,10 @@ bash scripts/ci/validate/show-disk-space.sh "Before shfmt installation"
 if [[ "${RUNNER_OS:-}" == "Linux" ]]; then
   curl -sSL "https://github.com/mvdan/sh/releases/download/v3.8.0/shfmt_v3.8.0_linux_amd64" -o /usr/local/bin/shfmt
   chmod +x /usr/local/bin/shfmt
+  # Ensure /usr/local/bin is in PATH for subsequent steps
+  if [[ -n "${GITHUB_PATH:-}" ]]; then
+    echo "/usr/local/bin" >>"$GITHUB_PATH"
+  fi
 elif [[ "${RUNNER_OS:-}" == "macOS" ]]; then
   brew install shfmt
 fi

scripts/ci/validate/install-taplo.sh

@@ -7,6 +7,11 @@ if ! command -v taplo >/dev/null 2>&1; then
   cargo install taplo-cli --locked
 fi
 
+# Ensure ~/.cargo/bin is in PATH for subsequent steps
+if [[ -n "${GITHUB_PATH:-}" && -d "$HOME/.cargo/bin" ]]; then
+  echo "$HOME/.cargo/bin" >>"$GITHUB_PATH"
+fi
+
 rm -rf ~/.cargo/registry/cache/* ~/.cargo/git/db/* 2>/dev/null || true
 
 bash scripts/ci/validate/show-disk-space.sh "After taplo installation and cleanup"