ts_ffi: don't generate tailscale.h on rust publish

Signed-off-by: Nathan Perry <nathan@tailscale.com>
Change-Id: I3efd59754eb1acadea1652db7ac43cba6a6a6964

Author: npry

.github/workflows/ci.yml

@@ -208,4 +208,5 @@ jobs:
       - name: Publish
         run: cargo ws publish --publish-as-is
         env:
+          TS_FFI_BUILDRS_STRICT: 1
           CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}

ts_ffi/build.rs

@@ -11,7 +11,11 @@ fn main() {
         .generate()
         .unwrap();
 
-    bindings.write_to_file("tailscale.h");
+    // We're not supposed to generate anything outside of `OUT_DIR`, but it's useful
+    // as a convenience. Turn it off with this var (for use with publish).
+    if env::var("TS_FFI_BUILDRS_STRICT").is_err_and(|e| e == env::VarError::NotPresent) {
+        bindings.write_to_file("tailscale.h");
+    }
 
     let out = env::var("OUT_DIR").unwrap();
     let out = PathBuf::from(out);