fix(build,ci): pyo3-build-config abi3-py311 + PYO3_NO_PYTHON env mirror across CircleCI (unbreaks GHA nightly + CircleCI cluster)

[heyong4725]

Summary

Unbreaks the pyo3 abi3 build regression across both CI providers: GHA nightly cross-check (all 8 targets) and CircleCI's workspace-building jobs (12 jobs). Two coordinated changes — the workspace pyo3-build-config feature addition (which fixes builds with PYO3_NO_PYTHON=1), plus mirroring the GHA nightly env (PYO3_NO_PYTHON=1, plus CROSS_BUILD_ENV_PASSTHROUGH=PYO3_NO_PYTHON for the cross-rs runs) into the CircleCI jobs that were missing it.

Root cause (regression bisection)

Date	GHA Nightly	Notes
2026-05-12	✅ green	Last known-good
2026-05-13	❌ red	PR #1833 (db8dbf60) merged, adding the workspace pyo3-build-config dep with an incomplete feature list
2026-05-14 → 2026-05-19	❌ red	Continuous failure

PR #1833 added:

pyo3-build-config = { version = "0.28", features = ["resolve-config"] }

— missing any abi3-py3X. pyo3-build-config 0.28's own build script then has two failure modes:

1. Interpreter present, version < abi3 minimum (3.11) → fails with Python interpreter version (3.10) is less than abi3 minimum (3.11). Hits every CircleCI job whose container ships Python 3.10 (cimg/rust:1.92.0 linux, the cross-rs Docker images, the older macOS Xcode 15.4 system Python, etc.).

2. PYO3_NO_PYTHON=1 set, no abi3-py3X feature on pyo3-build-config → fails with An abi3-py3* feature must be specified when compiling without a Python interpreter. Hits GHA nightly's cross-check matrix (which sets PYO3_NO_PYTHON=1 from fix(ci): provision Python 3.11+ before pyo3 abi3-py311 builds in nightly (closes #1866) #1869 specifically to skip the probe in cross-rs Docker containers).

The two failure modes together explain every red job on this head — they're the same root cause hitting different env shapes.

Fix

1. Cargo.toml: add abi3-py311 to the workspace pyo3-build-config features, so the no-interpreter path knows which ABI to target.

- pyo3-build-config = { version = "0.28", features = ["resolve-config"] }
+ pyo3-build-config = { version = "0.28", features = ["resolve-config", "abi3-py311"] }

2. .circleci/config.yml: mirror the GHA nightly env (PYO3_NO_PYTHON=1) into every CircleCI job that builds the workspace, so the interpreter probe is skipped on containers without Python 3.11+. The cross-check-cross job additionally gets CROSS_BUILD_ENV_PASSTHROUGH=PYO3_NO_PYTHON so cross-rs propagates the env into the Docker container it spawns.

Jobs touched (all add PYO3_NO_PYTHON: "1" to environment:):

• clippy (was failing)
• cross-check-native (was failing — 1 target)
• cross-check-macos (defensive — macOS Xcode 15.4 ships older Python)
• cross-check-cross (was failing — 5 targets; also gets CROSS_BUILD_ENV_PASSTHROUGH)
• msrv (was failing)
• test-linux (was failing)
• test-macos (was failing)
• examples-linux (was failing)
• bench-example (was failing)
• e2e (defensive — depends on test-linux's workspace)
• contract-tests (defensive — same)
• bench (defensive — cargo test --no-runs the benchmarks)

Verification

Local reproduction + fix confirmation on macos-aarch64:

# Without the fix (Cargo.toml side, simulating GHA nightly env):
$ PYO3_NO_PYTHON=1 cargo check -p dora-runtime
error: failed to run custom build command for `pyo3-build-config v0.28.3`
  error: An abi3-py3* feature must be specified when compiling
         without a Python interpreter.

# With the Cargo.toml fix + PYO3_NO_PYTHON=1:
$ PYO3_NO_PYTHON=1 cargo check -p dora-runtime
Finished `dev` profile in 29.56s ✓

Plus YAML validation on the CircleCI config change:

$ python3 -c "import yaml; yaml.safe_load(open('.circleci/config.yml'))"
(no output, exit 0)  ✓

Test plan

• cargo fmt --all -- --check
• PYO3_NO_PYTHON=1 cargo check --all --exclude dora-{node-api,operator-api,ros2-bridge,cli-api}-python ✓
• cargo clippy --all --exclude dora-{node-api,operator-api,ros2-bridge}-python -- -D warnings ✓
• CircleCI YAML parses
• Reviewer's pointer (.circleci/config.yml:1003, :1018) addressed — cross-check-cross now carries both env vars
• CircleCI green on this head
• Next GHA nightly green

Likely closes #1860

#1860 tracked the CircleCI environment cluster (clippy, cross-check-non-x86_64-linux, msrv) as failing across all PRs this consolidation push. The root cause turned out to be the same pyo3-build-config regression — so this PR should close that issue. I'll confirm after CircleCI runs on this head.

What this does NOT address

The CLI Tests (macos-latest) GHA nightly job failure is unrelated (filed as #1882). Python sender on macOS gets SIGTERMed on --stop-after, exit code 143. Different code path, different fix needed.

🤖 Generated with Claude Code

[trunk-io]

Merging to main in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here