fix: fixed CI issues, and added docs check to pre push

Author: sandyfzu

.github/workflows/ci.yml

@@ -53,6 +53,9 @@ jobs:
           - target: aarch64-unknown-linux-gnu
             os: ubuntu-22.04
             artifact: apvm-napi.linux-arm64-gnu.node
+            # Vendor OpenSSL from source for cross-compilation (no system libssl-dev:arm64)
+            # https://docs.rs/openssl/latest/openssl/#vendored
+            features: vendored-openssl
           - target: x86_64-pc-windows-msvc
             os: windows-latest
             artifact: apvm-napi.win32-x64-msvc.node
@@ -72,9 +75,15 @@ jobs:
           sudo apt-get install -y gcc-aarch64-linux-gnu
       - run: npm install
       - name: Build NAPI
-        run: npx napi build --release --platform --manifest-path crates/napi/Cargo.toml --output-dir . --target ${{ matrix.settings.target }}
+        run: >
+          npx napi build --release --platform
+          --manifest-path crates/napi/Cargo.toml --output-dir .
+          --target ${{ matrix.settings.target }}
+          ${{ matrix.settings.features && format('--features {0}', matrix.settings.features) || '' }}
         env:
           CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER: aarch64-linux-gnu-gcc
+          CC_aarch64_unknown_linux_gnu: aarch64-linux-gnu-gcc
+          AR_aarch64_unknown_linux_gnu: aarch64-linux-gnu-ar
       - name: Upload .node artifact
         uses: actions/upload-artifact@v7
         with:

.husky/pre-push

@@ -8,10 +8,11 @@
 # Steps:
 #   1. Rust formatting     — cargo fmt --all --check
 #   2. Clippy lints        — cargo clippy (deny all warnings)
-#   3. Rust tests          — cargo test --workspace
-#   4. Native module build — npm run build (NAPI binary)
-#   5. TypeScript typecheck — tsc --noEmit
-#   6. Integration tests   — vitest (Node.js tests)
+#   3. Rust documentation  — cargo doc (deny all warnings)
+#   4. Rust tests          — cargo test --workspace
+#   5. Native module build — npm run build (NAPI binary)
+#   6. TypeScript typecheck — tsc --noEmit
+#   7. Integration tests   — vitest (Node.js tests)
 #
 # Skip with: git push --no-verify
 # Docs:  https://typicode.github.io/husky/
@@ -23,7 +24,7 @@ CYAN='\033[0;36m'
 NC='\033[0m' # No Color
 
 step=0
-total=6
+total=7
 
 run_step() {
   step=$((step + 1))
@@ -42,6 +43,7 @@ printf "${CYAN}═════════════════════
 
 run_step "Rust formatting"      "cargo fmt --all --check"
 run_step "Clippy lints"         "cargo clippy --workspace --all-targets --locked -- -D warnings"
+run_step "Rust documentation"   "RUSTDOCFLAGS='-D warnings' cargo doc --workspace --no-deps --locked"
 run_step "Rust tests"           "cargo test --workspace --locked"
 run_step "Native module build"  "npm run build"
 run_step "TypeScript typecheck" "npm run typecheck"

Cargo.lock

@@ -75,6 +75,13 @@ tempfile = "3"
 # https://docs.rs/reqwest/0.13 — pre-1.0, 0.13.x is compatible range
 reqwest = { version = "0.13", default-features = false, features = ["native-tls"] }
 
+# OpenSSL vendored build (for Linux cross-compilation)
+# When the `vendored-openssl` feature is enabled, openssl-sys builds OpenSSL
+# from source using the target's C cross-compiler instead of requiring system
+# libraries. Only needed for CI cross-compile (aarch64-unknown-linux-gnu).
+# https://docs.rs/openssl/latest/openssl/#vendored
+openssl = { version = "0.10", features = ["vendored"] }
+
 # Internal crates
 apvm-config = { path = "crates/config" }
 apvm-core = { path = "crates/core" }

Cargo.toml

@@ -136,7 +136,7 @@ impl Config {
 /// # Adding a new key
 ///
 /// 1. Add a variant here.
-/// 2. The compiler will guide you to update [`FromStr`], [`Display`],
+/// 2. The compiler will guide you to update [`FromStr`], [`fmt::Display`],
 ///    [`ConfigKey::all`], [`ConfigKey::is_sensitive`], and the
 ///    [`ConfigFile`] methods that match on this enum.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]

crates/config/src/config.rs

@@ -114,7 +114,7 @@ pub fn matches_any_exclusion(filename: &str, patterns: &[ExclusionPattern<'_>])
 ///
 /// # Behavior
 ///
-/// - Uses [`WalkDir::filter_entry`] to prevent **descending** into excluded
+/// - Uses [`walkdir::IntoIter::filter_entry`] to prevent **descending** into excluded
 ///   directories entirely (critical for performance — e.g., `node_modules`
 ///   can contain 50,000+ files).
 ///   Source: <https://docs.rs/walkdir/2/walkdir/struct.IntoIter.html#method.filter_entry>

crates/core/src/build/fs.rs

@@ -79,7 +79,7 @@ impl BuildOutput {
     /// Convert to storage metadata.
     ///
     /// Creates a [`BuildMetadata`] struct suitable for passing to
-    /// [`ArtifactStore::store()`].
+    /// [`apvm_storage::ArtifactStore::store()`].
     ///
     /// # Arguments
     ///
@@ -107,7 +107,7 @@ impl BuildOutput {
     /// Convert artifacts to storage format.
     ///
     /// Transforms [`ProducedArtifact`]s into [`SourceArtifact`]s suitable
-    /// for passing to [`ArtifactStore::store()`].
+    /// for passing to [`apvm_storage::ArtifactStore::store()`].
     ///
     /// # Returns
     ///

crates/core/src/commands/build.rs

@@ -152,7 +152,7 @@ impl BuildWorkspace {
         self.temp_dir.path().join(&self.repo_name)
     }
 
-    /// Create a [`BuildContext`] from this workspace.
+    /// Create a [`crate::build::BuildContext`] from this workspace.
     ///
     /// Maps the workspace's directory structure to the build context:
     /// - `workspace_dir` → the temp directory root ([`path()`](Self::path))

crates/core/src/git/workspace.rs

@@ -9,6 +9,13 @@ license = "MIT"
 [lib]
 crate-type = ["cdylib"]
 
+[features]
+# Build OpenSSL from source for cross-compilation (e.g. aarch64-unknown-linux-gnu).
+# Activates the `vendored` feature of the `openssl` crate, which causes `openssl-sys`
+# to compile OpenSSL using the target's C cross-compiler instead of relying on
+# system-installed libraries. Only needed in CI for Linux ARM64 cross-builds.
+vendored-openssl = ["dep:openssl"]
+
 [dependencies]
 # Internal crates
 apvm-core = { workspace = true }
@@ -22,5 +29,8 @@ napi-derive = { workspace = true }
 # Async runtime (needs rt-multi-thread for napi async)
 tokio = { workspace = true }
 
+# OpenSSL vendored build — only activated by the `vendored-openssl` feature
+openssl = { workspace = true, optional = true }
+
 [build-dependencies]
 napi-build = { workspace = true }