Validate the complete container toolchain before release builds

.github/workflows/nuget-avalonia-native.yml

@@ -140,19 +140,8 @@ jobs:
           mkdir -p "$WORK_DIR" "$OUTPUT_DIR"
           docker run --rm --user "$(id -u):$(id -g)" \
             -e HOME=/tmp/staticlink-home -e RID -e AVALONIA_VERSION \
-            -v "$PWD:/src" -w /src --entrypoint bash "$TOOLCHAIN_IMAGE" -c '
-              set -euo pipefail
-              mkdir -p "$HOME"
-              src="/src/External/AvaloniaNative/.work/Avalonia-$AVALONIA_VERSION"
-              git clone --depth 1 --branch "$AVALONIA_VERSION" https://github.com/AvaloniaUI/Avalonia.git "$src"
-              if git -C "$src" config -f .gitmodules --get-regexp path | awk '{print $2}' | grep -qx external/Numerge; then
-                git -C "$src" submodule update --init --depth 1 external/Numerge
-              fi
-              python3 build/linux-toolchain/build-avalonia-native-cross.py \
-                --source "$src" --rid "$RID" --sdk /opt/macos-sdk/MacOSX15.5.sdk \
-                --work "/src/External/AvaloniaNative/.work/zig-$AVALONIA_VERSION-$RID" \
-                --output "/src/External/AvaloniaNative/$RID/native"
-            '
+            -v "$PWD:/src" -w /src --entrypoint bash "$TOOLCHAIN_IMAGE" \
+            scripts/build-avalonia-native-container.sh
 
       - name: Upload static AvaloniaNative
         uses: actions/upload-artifact@v4

.github/workflows/zig-toolchain-image.yml

@@ -34,6 +34,7 @@ jobs:
           repository="ghcr.io/${REPOSITORY,,}-zig"
           image="$repository:recipe-$RECIPE_HASH"
           base="$repository:debian12-$BASE_HASH"
+          built_image=false
           if ! docker pull "$image"; then
             if ! docker pull "$base"; then
               docker build --platform linux/amd64 \
@@ -48,6 +49,14 @@ jobs:
               --label "org.opencontainers.image.source=https://github.com/$REPOSITORY" \
               -f build/linux-toolchain/Dockerfile.cross-probe \
               -t "$image" build/linux-toolchain
+            built_image=true
+          fi
+          mkdir -p artifacts/toolchain-environment
+          docker run --rm --user "$(id -u):$(id -g)" \
+            -e HOME=/tmp -e DOTNET_CLI_HOME=/tmp -e ZIG_GLOBAL_CACHE_DIR=/tmp/zig-cache \
+            -v "$PWD/artifacts/toolchain-environment:/validation" \
+            --entrypoint python3 "$image" /opt/staticlink/validate-toolchain.py --output /validation
+          if [ "$built_image" = true ]; then
             docker push "$image"
             docker pull "$image"
           fi
@@ -55,3 +64,10 @@ jobs:
           case "$digest" in "$repository"@sha256:*) ;; *) echo 'No immutable image digest' >&2; exit 1 ;; esac
           echo "image=$digest" >> "$GITHUB_OUTPUT"
           echo "Toolchain: $digest" >> "$GITHUB_STEP_SUMMARY"
+      - name: Upload environment validation report
+        if: ${{ always() }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: toolchain-environment-validation
+          path: artifacts/toolchain-environment/
+          if-no-files-found: warn