ci(release): use active macOS SDK for stealth builds

.cargo/config.toml

@@ -1,9 +1,2 @@
 [env]
 RUST_TEST_THREADS = "1"
-
-# macOS 26 (Tahoe) moved libc++ headers inside the SDK; Apple clang 17 no longer
-# finds them at the old search path. Scope the workaround to Apple targets so a
-# Linux stealth build never inherits a macOS SDK include flag. cc-rs recognizes
-# the target-suffixed CXXFLAGS variables below. See issue #136.
-CXXFLAGS_aarch64_apple_darwin = { value = "-isystem /Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/usr/include/c++/v1", force = false }
-CXXFLAGS_x86_64_apple_darwin  = { value = "-isystem /Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/usr/include/c++/v1", force = false }

.github/workflows/release.yml

@@ -60,10 +60,13 @@ jobs:
         if: runner.os == 'macOS'
         shell: bash
         run: |
+          # Use one coherent SDK. A hard-coded CommandLineTools include path can
+          # mix libc++ headers with the selected Xcode SDK and break BoringSSL.
+          XCODE_PATH="$(xcode-select -p)"
           SDK_PATH="$(xcrun --show-sdk-path)"
           echo "SDKROOT=$SDK_PATH" >> "$GITHUB_ENV"
           echo "CXXFLAGS=-isystem $SDK_PATH/usr/include/c++/v1" >> "$GITHUB_ENV"
-          echo "LIBCLANG_PATH=$(xcode-select -p)/Toolchains/XcodeDefault.xctoolchain/usr/lib" >> "$GITHUB_ENV"
+          echo "LIBCLANG_PATH=$XCODE_PATH/Toolchains/XcodeDefault.xctoolchain/usr/lib" >> "$GITHUB_ENV"
 
       - name: Configure libclang (Windows)
         if: runner.os == 'Windows'

docs/Build-from-source.md

@@ -37,6 +37,15 @@ the Visual Studio C++ Build Tools, CMake, and LLVM/Clang. Ensure the directory
 containing `libclang` is available through `LIBCLANG_PATH` if bindgen cannot
 locate it automatically.
 
+On macOS 26 with the standalone Command Line Tools, Apple Clang may not find
+libc++ while compiling BoringSSL. Use the active SDK for that build:
+
+```bash
+SDK_PATH="$(xcrun --show-sdk-path)"
+SDKROOT="$SDK_PATH" CXXFLAGS="-isystem $SDK_PATH/usr/include/c++/v1" \
+  cargo build --release --features stealth
+```
+
 ## OpenSSL on older systems
 
 If the build fails on the vendored OpenSSL with an AVX-512 assembler error (common on older VPS hosts):