Isolate manual artifact validation without package publication

2026-10-05 13:09:17 +08:00
1 parent 98976747c3
commit 2b39fd1430
@@ -1,8 +1,17 @@
 name: staticlink-avalonia-native

 on:
-  schedule:
-    - cron: "17 3 * * *"
+  workflow_call:
+    inputs:
+      avalonia_version:
+        type: string
+        default: ''
+      force_build:
+        type: boolean
+        default: false
+      publish_to_nuget:
+        type: boolean
+        default: false
  workflow_dispatch:
    inputs:
      avalonia_version:
@@ -17,7 +26,7 @@ on:
      publish_to_nuget:
        description: Publish with NuGet Trusted Publishing after smoke tests
        required: true
-        default: true
+        default: false
        type: boolean

 jobs:
@@ -58,9 +67,14 @@ jobs:
              exit 1
            fi

-            package_version="$avalonia_version.1"
+            package_version="$avalonia_version.2"
            package_url="https://api.nuget.org/v3-flatcontainer/staticlink.avalonia.native/$package_version/staticlink.avalonia.native.$package_version.nupkg"
-            if [ "$FORCE_BUILD" != "true" ] && curl --fail --silent --location --output /dev/null "$package_url"; then
+            status=$(curl --retry 3 --silent --show-error --location --output /dev/null --write-out '%{http_code}' "$package_url")
+            if [ "$status" != 200 ] && [ "$status" != 404 ]; then
+              echo "NuGet availability check failed: HTTP $status" >&2
+              exit 1
+            fi
+            if [ "$FORCE_BUILD" != "true" ] && [ "$status" = 200 ]; then
              echo "Already published: $package_version"
              continue
            fi
@@ -79,9 +93,17 @@ jobs:
            echo 'should_build=true' >> "$GITHUB_OUTPUT"
          fi

-  build:
+  toolchain:
    needs: detect
    if: ${{ needs.detect.outputs.should_build == 'true' }}
+    permissions:
+      contents: read
+      packages: write
+    uses: ./.github/workflows/zig-toolchain-image.yml
+
+  build:
+    needs: [detect, toolchain]
+    if: ${{ needs.detect.outputs.should_build == 'true' }}
    strategy:
      fail-fast: false
      matrix:
@@ -92,10 +114,12 @@ jobs:
            runner: macos-14
          - rid: osx-arm64
            runner: macos-15
-    runs-on: ${{ matrix.runner }}
+    runs-on: ubuntu-24.04
    permissions:
      contents: read
+      packages: read
    env:
+      TOOLCHAIN_IMAGE: ${{ needs.toolchain.outputs.image }}
      RID: ${{ matrix.rid }}
      AVALONIA_VERSION: ${{ matrix.version.avalonia_version }}
      WORK_DIR: ${{ github.workspace }}/External/AvaloniaNative/.work
@@ -103,18 +127,32 @@ jobs:
    steps:
      - uses: actions/checkout@v4

-      - name: Setup .NET for Avalonia header generation
-        uses: actions/setup-dotnet@v4
-        with:
-          dotnet-version: |
-            8.0.x
-            10.0.x
+      - name: Pull immutable toolchain image
+        env:
+          GH_TOKEN: ${{ github.token }}
+          ACTOR: ${{ github.actor }}
+        run: |
+          printf '%s' "$GH_TOKEN" | docker login ghcr.io -u "$ACTOR" --password-stdin
+          docker pull "$TOOLCHAIN_IMAGE"

-      - name: Build static AvaloniaNative
-        run: bash scripts/build-macos-avalonia-native-static.sh
-
-      - name: Build macOS font preinit object
-        run: bash scripts/build-macos-font-preinit.sh
+      - name: Build static AvaloniaNative and font preinit with Zig
+        run: |
+          mkdir -p "$WORK_DIR" "$OUTPUT_DIR"
+          docker run --rm --user "$(id -u):$(id -g)" \
+            -e HOME=/tmp/staticlink-home -e RID -e AVALONIA_VERSION \
+            -v "$PWD:/src" -w /src --entrypoint bash "$TOOLCHAIN_IMAGE" -c '
+              set -euo pipefail
+              mkdir -p "$HOME"
+              src="/src/External/AvaloniaNative/.work/Avalonia-$AVALONIA_VERSION"
+              git clone --depth 1 --branch "$AVALONIA_VERSION" https://github.com/AvaloniaUI/Avalonia.git "$src"
+              if git -C "$src" config -f .gitmodules --get-regexp path | awk '{print $2}' | grep -qx external/Numerge; then
+                git -C "$src" submodule update --init --depth 1 external/Numerge
+              fi
+              python3 build/linux-toolchain/build-avalonia-native-cross.py \
+                --source "$src" --rid "$RID" --sdk /opt/macos-sdk/MacOSX15.5.sdk \
+                --work "/src/External/AvaloniaNative/.work/zig-$AVALONIA_VERSION-$RID" \
+                --output "/src/External/AvaloniaNative/$RID/native"
+            '

      - name: Upload static AvaloniaNative
        uses: actions/upload-artifact@v4
@@ -123,6 +161,7 @@ jobs:
          path: |
            External/AvaloniaNative/${{ matrix.rid }}/native/libAvaloniaNative.a
            External/AvaloniaNative/${{ matrix.rid }}/native/macos_font_preinit.o
+            External/AvaloniaNative/${{ matrix.rid }}/native/avalonia-native-build.json
          if-no-files-found: error

  pack:
@@ -260,11 +299,19 @@ jobs:
          sys.exit(proc.returncode if proc.returncode > 0 else 1)
          PY

+      - name: Upload AvaloniaNative smoke app
+        if: ${{ always() }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: avalonia-native-smoke-${{ matrix.version.avalonia_version }}-${{ matrix.rid }}
+          path: artifacts/smoke-${{ matrix.rid }}/**
+          if-no-files-found: warn
+
  publish:
    needs:
      - detect
      - smoke
-    if: ${{ needs.detect.outputs.should_build == 'true' && (github.event_name == 'schedule' || inputs.publish_to_nuget == true) }}
+    if: ${{ needs.detect.outputs.should_build == 'true' && inputs.publish_to_nuget == true }}
    strategy:
      matrix:
        version: ${{ fromJSON(needs.detect.outputs.versions) }}
@@ -279,20 +326,32 @@ jobs:
          name: staticlink-avalonia-native-${{ matrix.version.package_version }}
          path: artifacts/nuget

+      - uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: "10.0.302"
+
      - name: Validate Trusted Publishing configuration
        env:
          NUGET_USER: ${{ vars.NUGET_USER }}
-        run: test -n "$NUGET_USER"
+          NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}
+        run: |
+          if [ -z "$NUGET_USER" ] && [ -z "$NUGET_API_KEY" ]; then
+            echo 'Configure NUGET_USER with Trusted Publishing or NUGET_API_KEY.' >&2
+            exit 1
+          fi

      - name: NuGet login
+        if: ${{ vars.NUGET_USER != '' }}
        id: login
        uses: NuGet/login@v1
        with:
          user: ${{ vars.NUGET_USER }}

      - name: Publish to nuget.org
+        env:
+          NUGET_API_KEY: ${{ steps.login.outputs.NUGET_API_KEY || secrets.NUGET_API_KEY }}
        run: |
          dotnet nuget push artifacts/nuget/*.nupkg \
            --source https://www.nuget.org/api/v2/package \
-            --api-key "${{ steps.login.outputs.NUGET_API_KEY }}" \
+            --api-key "$NUGET_API_KEY" \
            --skip-duplicate
@@ -1,106 +0,0 @@
-name: staticlink-avalonia-repack
-
-on:
-  workflow_dispatch:
-    inputs:
-      source_version:
-        description: Existing package version containing the static libraries
-        required: true
-        default: 4.150.1-7922.1
-        type: string
-      publish_to_nuget:
-        description: Publish package to nuget.org
-        required: true
-        default: false
-        type: boolean
-
-jobs:
-  repack:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Setup .NET
-        uses: actions/setup-dotnet@v4
-        with:
-          dotnet-version: "10.0.x"
-
-      - name: Extract static libraries from existing package
-        env:
-          SOURCE_VERSION: ${{ inputs.source_version }}
-        run: |
-          python3 - <<'PY'
-          import os
-          import pathlib
-          import urllib.request
-          import zipfile
-
-          version = os.environ["SOURCE_VERSION"]
-          package = pathlib.Path("artifacts/source.nupkg")
-          package.parent.mkdir(parents=True, exist_ok=True)
-          urllib.request.urlretrieve(
-              f"https://api.nuget.org/v3-flatcontainer/staticlink.avalonia/{version}/staticlink.avalonia.{version}.nupkg",
-              package,
-          )
-
-          output = pathlib.Path("External/NativeStatic")
-          with zipfile.ZipFile(package) as archive:
-              for entry in archive.infolist():
-                  name = entry.filename.replace("\\", "/")
-                  if not name.startswith("static/") or name.endswith("/"):
-                      continue
-                  destination = output / name.removeprefix("static/")
-                  destination.parent.mkdir(parents=True, exist_ok=True)
-                  destination.write_bytes(archive.read(entry))
-          PY
-
-      - name: Verify static archives
-        run: |
-          for rid in linux-x64 linux-arm64 linux-musl-x64 linux-musl-arm64 osx-x64 osx-arm64; do
-            test -f External/NativeStatic/$rid/native/libskia.a
-            test -f External/NativeStatic/$rid/native/libSkiaSharp.a
-            test -f External/NativeStatic/$rid/native/libHarfBuzzSharp.a
-            test -f External/NativeStatic/$rid/native/libANGLE_static.a
-            test -f External/NativeStatic/$rid/native/libGLESv2_static.a
-          done
-
-          for rid in win-x64 win-x86 win-arm64; do
-            test -f External/NativeStatic/$rid/native/skia.lib
-            test -f External/NativeStatic/$rid/native/SkiaSharp.lib
-            test -f External/NativeStatic/$rid/native/libHarfBuzzSharp.lib
-            test -f External/NativeStatic/$rid/native/libANGLE_static.lib
-            test -f External/NativeStatic/$rid/native/libGLESv2_static.lib
-          done
-          test -f External/NativeStatic/win-x86/native/skia_x86_stdcall_thunks.lib
-
-      - name: Pack NuGet package
-        run: dotnet pack NuGet/StaticGraphics/StaticLink.Avalonia.csproj -c Release -o artifacts/nuget
-
-      - name: Verify portable NuGet paths
-        run: |
-          package=$(find artifacts/nuget -name 'StaticLink.Avalonia.*.nupkg' ! -name 'StaticLink.Avalonia.Native.*.nupkg' -print -quit)
-          test -n "$package"
-          if unzip -Z1 "$package" | grep -F '\'; then
-            echo "NuGet package contains Windows-only backslash paths."
-            exit 1
-          fi
-          unzip -Z1 "$package" | grep -Fx 'buildTransitive/StaticLink.Avalonia.props'
-          unzip -Z1 "$package" | grep -Fx 'buildTransitive/StaticLink.Avalonia.targets'
-
-      - name: Upload NuGet artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: staticlink-avalonia-repacked-nuget
-          path: artifacts/nuget/*.nupkg
-          if-no-files-found: error
-
-      - name: Publish to nuget.org
-        if: ${{ inputs.publish_to_nuget == true }}
-        env:
-          NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}
-        run: |
-          test -n "$NUGET_API_KEY"
-          dotnet nuget push artifacts/nuget/*.nupkg \
-            --source "https://api.nuget.org/v3/index.json" \
-            --api-key "$NUGET_API_KEY" \
-            --skip-duplicate
@@ -1,547 +0,0 @@
-name: staticlink-avalonia
-
-on:
-  workflow_dispatch:
-    inputs:
-      publish_to_nuget:
-        description: Publish package to nuget.org
-        required: true
-        default: false
-        type: boolean
-      publish_to_release:
-        description: Publish NuGet package and smoke apps to GitHub Release
-        required: true
-        default: true
-        type: boolean
-  push:
-    tags:
-      - "staticlink-avalonia-v*"
-
-env:
-  DOTNET_ALPINE_IMAGE: mcr.microsoft.com/dotnet/sdk:10.0.302-alpine3.23
-
-jobs:
-  preflight:
-    uses: ./.github/workflows/static-graphics-preflight.yml
-
-  build-linux:
-    needs: preflight
-    uses: ./.github/workflows/static-graphics-linux.yml
-    with:
-      skiasharp_version: ${{ needs.preflight.outputs.skiasharp_version }}
-      angle_branch: ${{ needs.preflight.outputs.angle_branch }}
-
-  build-musl:
-    needs: preflight
-    uses: ./.github/workflows/static-graphics-musl.yml
-    with:
-      skiasharp_version: ${{ needs.preflight.outputs.skiasharp_version }}
-      angle_branch: ${{ needs.preflight.outputs.angle_branch }}
-      dotnet_alpine_image: mcr.microsoft.com/dotnet/sdk:10.0.302-alpine3.23
-
-  build-windows:
-    needs: preflight
-    uses: ./.github/workflows/static-graphics-windows.yml
-    with:
-      skiasharp_version: ${{ needs.preflight.outputs.skiasharp_version }}
-      angle_branch: ${{ needs.preflight.outputs.angle_branch }}
-
-  build-macos:
-    needs: preflight
-    uses: ./.github/workflows/static-graphics-macos.yml
-    with:
-      skiasharp_version: ${{ needs.preflight.outputs.skiasharp_version }}
-      angle_branch: ${{ needs.preflight.outputs.angle_branch }}
-
-  pack:
-    runs-on: ubuntu-24.04
-    needs:
-      - build-linux
-      - build-musl
-      - build-windows
-      - build-macos
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Setup .NET
-        uses: actions/setup-dotnet@v4
-        with:
-          dotnet-version: "10.0.302"
-
-      - name: Download static archives
-        uses: actions/download-artifact@v4
-        with:
-          pattern: native-static-*
-          path: External/NativeStatic
-          merge-multiple: false
-
-      - name: Move static archives into RID directories
-        run: |
-          for rid in win-x64 win-x86 win-arm64 linux-x64 linux-arm64 linux-musl-x64 linux-musl-arm64 osx-x64 osx-arm64; do
-            mkdir -p "External/NativeStatic/$rid"
-            mv "External/NativeStatic/native-static-$rid"/* "External/NativeStatic/$rid/"
-            rmdir "External/NativeStatic/native-static-$rid"
-            if [ ! -d "External/NativeStatic/$rid/native" ]; then
-              mkdir -p "External/NativeStatic/$rid/native"
-              find "External/NativeStatic/$rid" -maxdepth 1 -type f -exec mv {} "External/NativeStatic/$rid/native/" \;
-            fi
-          done
-
-      - name: Verify static archives
-        run: |
-          for rid in linux-x64 linux-arm64 linux-musl-x64 linux-musl-arm64 osx-x64 osx-arm64; do
-            test -f External/NativeStatic/$rid/native/libskia.a
-            test -f External/NativeStatic/$rid/native/libSkiaSharp.a
-            test -f External/NativeStatic/$rid/native/libHarfBuzzSharp.a
-            test -f External/NativeStatic/$rid/native/libANGLE_static.a
-            test -f External/NativeStatic/$rid/native/libGLESv2_static.a
-          done
-
-          for rid in win-x64 win-x86 win-arm64; do
-            test -f External/NativeStatic/$rid/native/skia.lib
-            test -f External/NativeStatic/$rid/native/SkiaSharp.lib
-            test -f External/NativeStatic/$rid/native/libHarfBuzzSharp.lib
-            test -f External/NativeStatic/$rid/native/libANGLE_static.lib
-            test -f External/NativeStatic/$rid/native/libGLESv2_static.lib
-          done
-          test -f External/NativeStatic/win-x86/native/skia_x86_stdcall_thunks.lib
-
-      - name: Pack NuGet package
-        run: dotnet pack NuGet/StaticGraphics/StaticLink.Avalonia.csproj -c Release -o artifacts/nuget
-
-      - name: Verify portable NuGet paths
-        shell: bash
-        run: |
-          package=$(find artifacts/nuget -name 'StaticLink.Avalonia.*.nupkg' ! -name 'StaticLink.Avalonia.Native.*.nupkg' -print -quit)
-          test -n "$package"
-          if unzip -Z1 "$package" | grep -F '\'; then
-            echo "NuGet package contains Windows-only backslash paths."
-            exit 1
-          fi
-          unzip -Z1 "$package" | grep -Fx 'buildTransitive/StaticLink.Avalonia.props'
-          unzip -Z1 "$package" | grep -Fx 'buildTransitive/StaticLink.Avalonia.targets'
-
-      - name: Upload NuGet artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: staticlink-avalonia-nuget
-          path: |
-            artifacts/nuget/*.nupkg
-            artifacts/nuget/*.snupkg
-          if-no-files-found: error
-
-  smoke-avalonia:
-    needs: pack
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - rid: win-x64
-            runner: windows-2022
-            msvc_arch: x64
-          - rid: win-x86
-            runner: windows-2022
-            msvc_arch: x86
-          - rid: win-arm64
-            runner: windows-2022
-            msvc_arch: amd64_arm64
-          - rid: linux-x64
-            runner: ubuntu-24.04
-          - rid: linux-arm64
-            runner: ubuntu-24.04-arm
-          - rid: linux-musl-x64
-            runner: ubuntu-24.04
-          - rid: linux-musl-arm64
-            runner: ubuntu-24.04-arm
-          - rid: osx-x64
-            runner: macos-15
-            avalonia_version: 11.3.14
-          - rid: osx-arm64
-            runner: macos-15
-            avalonia_version: 11.3.14
-    runs-on: ${{ matrix.runner }}
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Setup MSVC environment
-        if: ${{ startsWith(matrix.rid, 'win-') }}
-        uses: ilammy/msvc-dev-cmd@v1
-        with:
-          arch: ${{ matrix.msvc_arch }}
-
-      - name: Install Linux publish dependencies
-        if: ${{ startsWith(matrix.rid, 'linux-') && !startsWith(matrix.rid, 'linux-musl-') }}
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y clang lld xvfb zlib1g-dev libfontconfig1-dev libfreetype6 libgl1 libice6 libsm6 libx11-6 libxcb1 libxcursor1 libxext6 libxfixes3 libxinerama1 libxrandr2 libxrender1 libxi6
-
-      - name: Setup .NET
-        uses: actions/setup-dotnet@v4
-        with:
-          dotnet-version: "10.0.302"
-
-      - name: Download NuGet package
-        uses: actions/download-artifact@v4
-        with:
-          name: staticlink-avalonia-nuget
-          path: artifacts/nuget
-
-      - name: Publish Avalonia single-file smoke app
-        if: ${{ !startsWith(matrix.rid, 'linux-musl-') }}
-        shell: pwsh
-        run: |
-          $ErrorActionPreference = "Stop"
-          $package = Get-ChildItem -Path "artifacts/nuget" -Filter "StaticLink.Avalonia.*.nupkg" | Where-Object { $_.Name -notlike "StaticLink.Avalonia.Native.*" } | Select-Object -First 1
-          if (-not $package) { throw "StaticLink NuGet package was not downloaded." }
-          if ($package.BaseName -notmatch '^StaticLink\.Avalonia\.(.+)$') { throw "Unexpected package name: $($package.Name)" }
-          $version = $Matches[1]
-          $avaloniaVersion = "${{ matrix.avalonia_version }}"
-          if (-not $avaloniaVersion) { $avaloniaVersion = "11.3.14" }
-          $projectDir = Join-Path $PWD "artifacts/avalonia-smoke-src"
-          pwsh ./scripts/create-avalonia-smoke.ps1 -ProjectDir $projectDir -NuGetSource (Resolve-Path "artifacts/nuget") -StaticLinkVersion $version -AvaloniaVersion $avaloniaVersion
-          dotnet publish (Join-Path $projectDir "AvaloniaStaticLinkSmoke.csproj") `
-            -c Release `
-            -r "${{ matrix.rid }}" `
-            --configfile (Join-Path $projectDir "NuGet.config") `
-            /p:PublishAot=true `
-            /p:SelfContained=true `
-            /p:PublishSingleFile=true `
-            /p:StripSymbols=true `
-            /p:PublishDir="$PWD/artifacts/smoke-${{ matrix.rid }}/"
-
-      - name: Publish Avalonia musl smoke app
-        if: ${{ startsWith(matrix.rid, 'linux-musl-') }}
-        shell: pwsh
-        run: |
-          $ErrorActionPreference = "Stop"
-          $package = Get-ChildItem -Path "artifacts/nuget" -Filter "StaticLink.Avalonia.*.nupkg" | Where-Object { $_.Name -notlike "StaticLink.Avalonia.Native.*" } | Select-Object -First 1
-          if (-not $package) { throw "StaticLink NuGet package was not downloaded." }
-          if ($package.BaseName -notmatch '^StaticLink\.Avalonia\.(.+)$') { throw "Unexpected package name: $($package.Name)" }
-          $version = $Matches[1]
-          $projectDir = Join-Path $PWD "artifacts/avalonia-smoke-src"
-          pwsh ./scripts/create-avalonia-smoke.ps1 -ProjectDir $projectDir -NuGetSource "/workspace/artifacts/nuget" -StaticLinkVersion $version -AvaloniaVersion "11.3.14"
-          docker run --rm `
-            -v "${{ github.workspace }}:/workspace" `
-            -w /workspace `
-            "${{ env.DOTNET_ALPINE_IMAGE }}" `
-            sh -c "apk add --no-cache clang lld build-base zlib-dev fontconfig-dev && dotnet publish /workspace/artifacts/avalonia-smoke-src/AvaloniaStaticLinkSmoke.csproj -c Release -r ${{ matrix.rid }} --configfile /workspace/artifacts/avalonia-smoke-src/NuGet.config /p:PublishAot=true /p:SelfContained=true /p:PublishSingleFile=true /p:StripSymbols=true /p:PublishDir=/workspace/artifacts/smoke-${{ matrix.rid }}/"
-
-      - name: Verify no dynamic graphics libraries remain
-        shell: pwsh
-        run: |
-          $publishDir = "artifacts/smoke-${{ matrix.rid }}"
-          $blocked = Get-ChildItem -Path $publishDir -Recurse -File | Where-Object {
-            $_.Name -in @("libSkiaSharp.dll", "libHarfBuzzSharp.dll", "av_libglesv2.dll", "libSkiaSharp.so", "libHarfBuzzSharp.so", "libSkiaSharp.dylib", "libHarfBuzzSharp.dylib")
-          }
-          if ($blocked) {
-            $blocked | ForEach-Object { Write-Error "Unexpected dynamic graphics library: $($_.FullName)" }
-            exit 1
-          }
-          Get-ChildItem -Path $publishDir -Recurse -File | ForEach-Object { $_.FullName }
-
-      - name: Verify Windows executable architecture
-        if: ${{ startsWith(matrix.rid, 'win-') }}
-        shell: pwsh
-        run: |
-          $ErrorActionPreference = "Stop"
-          $app = Join-Path $PWD "artifacts/smoke-${{ matrix.rid }}/AvaloniaStaticLinkSmoke.exe"
-          $expectedMachine = @{
-            "win-x64" = "8664 machine"
-            "win-x86" = "14C machine"
-            "win-arm64" = "AA64 machine"
-          }["${{ matrix.rid }}"]
-          $headers = & dumpbin /headers $app | Out-String
-          if ($LASTEXITCODE -ne 0 -or $headers -notmatch [regex]::Escape($expectedMachine)) {
-            throw "Expected $expectedMachine in PE headers for $app.`n$headers"
-          }
-
-      - name: Run Windows Avalonia smoke app
-        if: ${{ matrix.rid == 'win-x64' || matrix.rid == 'win-x86' }}
-        shell: pwsh
-        run: |
-          $ErrorActionPreference = "Stop"
-          $publishDir = Join-Path $PWD "artifacts/smoke-${{ matrix.rid }}"
-          $app = Join-Path $publishDir "AvaloniaStaticLinkSmoke.exe"
-          $process = Start-Process -FilePath $app -WorkingDirectory $publishDir -PassThru
-          if ($process.WaitForExit(15000)) {
-            if ($process.ExitCode -eq 0) {
-              Write-Host "Avalonia Windows smoke app exited normally."
-              exit 0
-            }
-            throw "Avalonia Windows smoke app failed with exit code $($process.ExitCode)."
-          }
-
-          Stop-Process -Id $process.Id -Force
-          Write-Host "Avalonia Windows smoke app stayed alive for 15 seconds."
-
-      - name: Run Linux Avalonia smoke app
-        if: ${{ startsWith(matrix.rid, 'linux-') && !startsWith(matrix.rid, 'linux-musl-') }}
-        shell: bash
-        run: |
-          set +e
-          cd "artifacts/smoke-${{ matrix.rid }}"
-          chmod +x ./AvaloniaStaticLinkSmoke
-          timeout 15s xvfb-run -a ./AvaloniaStaticLinkSmoke
-          code=$?
-          if [ "$code" = 124 ] || [ "$code" = 143 ]; then
-            echo "Avalonia Linux smoke app stayed alive for 15 seconds."
-            exit 0
-          fi
-          exit "$code"
-
-      - name: Verify musl ELF dependencies
-        if: ${{ startsWith(matrix.rid, 'linux-musl-') }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          docker run --rm \
-            -v "${{ github.workspace }}:/workspace" \
-            -w /workspace \
-            alpine:3.23 \
-            sh -c 'apk add --no-cache binutils pax-utils && app="artifacts/smoke-${{ matrix.rid }}/AvaloniaStaticLinkSmoke" && readelf -l "$app" | grep "Requesting program interpreter: /lib/ld-musl-" && scanelf -n "$app" && ! scanelf -n "$app" | grep -E "ld-linux|ld64.so"'
-
-      - name: Run Linux musl Avalonia smoke app
-        if: ${{ startsWith(matrix.rid, 'linux-musl-') }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          docker run --rm \
-            -v "${{ github.workspace }}:/workspace" \
-            -w /workspace/artifacts/smoke-${{ matrix.rid }} \
-            alpine:3.23 \
-            sh -c 'apk add --no-cache xvfb-run libstdc++ libgcc fontconfig freetype ttf-dejavu libx11 libxcb libxext libxrender libxi libxrandr libxcursor libxfixes libxinerama libice libsm mesa-gl mesa-egl && fc-cache -f && fc-match sans && chmod +x ./AvaloniaStaticLinkSmoke && timeout 15s xvfb-run -a ./AvaloniaStaticLinkSmoke || code=$?; if [ "${code:-0}" = 124 ] || [ "${code:-0}" = 143 ]; then echo "Avalonia musl smoke app stayed alive for 15 seconds."; exit 0; fi; exit "${code:-0}"'
-
-      - name: Run macOS Avalonia smoke app
-        if: ${{ startsWith(matrix.rid, 'osx-') }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          cd "artifacts/smoke-${{ matrix.rid }}"
-          chmod +x ./AvaloniaStaticLinkSmoke
-          python3 - <<'PY'
-          import pathlib
-          import subprocess
-          import sys
-
-          log = pathlib.Path("avalonia-smoke-run.log")
-          proc = subprocess.Popen(
-              ["./AvaloniaStaticLinkSmoke"],
-              stdout=subprocess.PIPE,
-              stderr=subprocess.STDOUT,
-              text=True,
-          )
-
-          try:
-              output, _ = proc.communicate(timeout=15)
-          except subprocess.TimeoutExpired:
-              proc.kill()
-              output, _ = proc.communicate()
-              log.write_text(output or "")
-              print(output or "")
-              print("Avalonia smoke app stayed alive for 15 seconds.")
-              sys.exit(0)
-
-          log.write_text(output or "")
-          print(output or "")
-          if proc.returncode == 0:
-              print("Avalonia smoke app exited normally.")
-              sys.exit(0)
-
-          print(f"Avalonia smoke app failed with exit code {proc.returncode}.", file=sys.stderr)
-          sys.exit(proc.returncode if proc.returncode > 0 else 1)
-          PY
-
-      - name: Upload Avalonia smoke app
-        uses: actions/upload-artifact@v4
-        with:
-          name: avalonia-smoke-${{ matrix.rid }}
-          path: artifacts/smoke-${{ matrix.rid }}/**
-          if-no-files-found: error
-
-  smoke-macos-metal:
-    runs-on: macos-15
-    needs: pack
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Setup .NET
-        uses: actions/setup-dotnet@v4
-        with:
-          dotnet-version: "10.0.302"
-
-      - name: Download NuGet package
-        uses: actions/download-artifact@v4
-        with:
-          name: staticlink-avalonia-nuget
-          path: artifacts/nuget
-
-      - name: Publish Avalonia 12 macOS arm64 smoke app
-        shell: pwsh
-        run: |
-          $ErrorActionPreference = "Stop"
-          $package = Get-ChildItem -Path "artifacts/nuget" -Filter "StaticLink.Avalonia.*.nupkg" | Where-Object { $_.Name -notlike "StaticLink.Avalonia.Native.*" } | Select-Object -First 1
-          if (-not $package) { throw "StaticLink NuGet package was not downloaded." }
-          if ($package.BaseName -notmatch '^StaticLink\.Avalonia\.(.+)$') { throw "Unexpected package name: $($package.Name)" }
-          $projectDir = Join-Path $PWD "artifacts/avalonia-metal-smoke-src"
-          pwsh ./scripts/create-avalonia-smoke.ps1 `
-            -ProjectDir $projectDir `
-            -NuGetSource (Resolve-Path "artifacts/nuget") `
-            -StaticLinkVersion $Matches[1] `
-            -AvaloniaVersion "12.1.0" `
-            -StaticLinkNativeVersion "12.1.0.1"
-          dotnet publish (Join-Path $projectDir "AvaloniaStaticLinkSmoke.csproj") `
-            -c Release `
-            -r osx-arm64 `
-            --configfile (Join-Path $projectDir "NuGet.config") `
-            /p:PublishAot=true `
-            /p:SelfContained=true `
-            /p:PublishSingleFile=true `
-            /p:StripSymbols=true `
-            /p:PublishDir="$PWD/artifacts/smoke-osx-arm64-metal/"
-
-      - name: Verify fully static third-party libraries
-        shell: bash
-        run: |
-          set -euo pipefail
-          publish_dir="artifacts/smoke-osx-arm64-metal"
-          test -x "$publish_dir/AvaloniaStaticLinkSmoke"
-          for library in libAvaloniaNative.dylib libSkiaSharp.dylib libHarfBuzzSharp.dylib; do
-            test ! -f "$publish_dir/$library"
-          done
-
-      - name: Run default and Metal-only smoke tests
-        shell: bash
-        run: |
-          set -euo pipefail
-          cd artifacts/smoke-osx-arm64-metal
-          python3 - <<'PY'
-          import os
-          import pathlib
-          import subprocess
-
-          for renderer in ("default", "metal"):
-              environment = os.environ.copy()
-              environment["STATICLINK_MAC_RENDERER"] = renderer
-              environment["STATICLINK_SMOKE_AUTOCLOSE"] = "1"
-              try:
-                  result = subprocess.run(
-                      ["./AvaloniaStaticLinkSmoke"],
-                      env=environment,
-                      stdout=subprocess.PIPE,
-                      stderr=subprocess.STDOUT,
-                      text=True,
-                      timeout=15,
-                  )
-              except subprocess.TimeoutExpired as exception:
-                  output = exception.stdout or ""
-                  if isinstance(output, bytes):
-                      output = output.decode(errors="replace")
-                  pathlib.Path(f"avalonia-{renderer}.log").write_text(output)
-                  raise SystemExit(f"Avalonia {renderer} smoke app timed out.\n{output}")
-
-              output = result.stdout or ""
-              pathlib.Path(f"avalonia-{renderer}.log").write_text(output)
-              print(output, end="")
-              marker = f"STATICLINK_SMOKE_READY={renderer}"
-              if result.returncode != 0 or marker not in output.splitlines():
-                  raise SystemExit(f"Avalonia {renderer} smoke app failed with exit code {result.returncode}.")
-          PY
-
-  publish-nuget:
-    runs-on: ubuntu-24.04
-    needs:
-      - pack
-      - smoke-avalonia
-      - smoke-macos-metal
-    steps:
-      - name: Setup .NET
-        uses: actions/setup-dotnet@v4
-        with:
-          dotnet-version: "10.0.302"
-
-      - name: Download NuGet package
-        uses: actions/download-artifact@v4
-        with:
-          name: staticlink-avalonia-nuget
-          path: artifacts/nuget
-
-      - name: Publish to nuget.org
-        if: ${{ startsWith(github.ref, 'refs/tags/staticlink-avalonia-v') || (github.event_name == 'workflow_dispatch' && inputs.publish_to_nuget == true) }}
-        env:
-          NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}
-        run: |
-          if [ -z "$NUGET_API_KEY" ]; then
-            echo "NUGET_API_KEY secret is not configured. Skipping publish."
-            exit 0
-          fi
-
-          for package in artifacts/nuget/*.nupkg; do
-            dotnet nuget push "$package" \
-              --source "https://api.nuget.org/v3/index.json" \
-              --api-key "$NUGET_API_KEY" \
-              --skip-duplicate
-          done
-
-  release:
-    runs-on: ubuntu-24.04
-    needs:
-      - preflight
-      - pack
-      - smoke-avalonia
-      - smoke-macos-metal
-      - publish-nuget
-    if: ${{ startsWith(github.ref, 'refs/tags/staticlink-avalonia-v') || (github.event_name == 'workflow_dispatch' && inputs.publish_to_release == true) }}
-    permissions:
-      contents: write
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Download NuGet artifact
-        uses: actions/download-artifact@v4
-        with:
-          name: staticlink-avalonia-nuget
-          path: release-artifacts/staticlink-avalonia-nuget
-
-      - name: Download smoke artifacts
-        uses: actions/download-artifact@v4
-        with:
-          pattern: avalonia-smoke-*
-          path: release-artifacts
-          merge-multiple: false
-
-      - name: Prepare release files
-        run: |
-          mkdir -p release-files
-          find release-artifacts/staticlink-avalonia-nuget -type f \( -name '*.nupkg' -o -name '*.snupkg' \) -exec cp {} release-files/ \;
-          for dir in release-artifacts/avalonia-smoke-*; do
-            [ -d "$dir" ] || continue
-            name="$(basename "$dir")"
-            (cd "$dir" && zip -r "../../release-files/$name.zip" .)
-          done
-          ls -la release-files
-
-      - name: Publish GitHub Release
-        env:
-          GH_TOKEN: ${{ github.token }}
-          PACKAGE_VERSION: ${{ needs.preflight.outputs.package_version }}
-        run: |
-          if [ "${GITHUB_REF_TYPE}" = "tag" ]; then
-            release_tag="${GITHUB_REF_NAME}"
-            title="${GITHUB_REF_NAME}"
-          else
-            release_tag="staticlink-avalonia-v${PACKAGE_VERSION}"
-            title="StaticLink.Avalonia ${PACKAGE_VERSION}"
-          fi
-
-          if gh release view "$release_tag" >/dev/null 2>&1; then
-            gh release upload "$release_tag" release-files/* --clobber
-          else
-            gh release create "$release_tag" release-files/* \
-              --target "$GITHUB_SHA" \
-              --title "$title" \
-              --notes "NuGet package plus Avalonia 11.3.14 NativeAOT single-file smoke apps for win-x64, win-x86, win-arm64, linux-x64, linux-arm64, linux-musl-x64, linux-musl-arm64, osx-x64, and osx-arm64."
-          fi
@@ -1,64 +0,0 @@
-name: static-graphics-linux
-
-on:
-  workflow_call:
-    inputs:
-      skiasharp_version:
-        required: true
-        type: string
-      angle_branch:
-        required: true
-        type: string
-  workflow_dispatch:
-    inputs:
-      skiasharp_version:
-        required: true
-        default: "4.150.1"
-        type: string
-      angle_branch:
-        required: true
-        default: "7922"
-        type: string
-
-jobs:
-  build:
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - rid: linux-x64
-            target_cpu: x64
-            runner: ubuntu-24.04
-          - rid: linux-arm64
-            target_cpu: arm64
-            runner: ubuntu-24.04-arm
-    runs-on: ${{ matrix.runner }}
-    env:
-      SKIASHARP_VERSION: ${{ inputs.skiasharp_version }}
-      ANGLE_BRANCH: ${{ inputs.angle_branch }}
-      RID: ${{ matrix.rid }}
-      TARGET_CPU: ${{ matrix.target_cpu }}
-      LLVM_AR: llvm-ar
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Restore native build cache
-        uses: actions/cache@v4
-        with:
-          path: External/NativeStatic/.work
-          key: native-work-linux-${{ matrix.rid }}-${{ inputs.skiasharp_version }}-${{ inputs.angle_branch }}-${{ hashFiles('External/NativeStatic/patches/*.patch', 'scripts/build-linux-static-graphics.sh') }}
-
-      - name: Install native build dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y clang lld llvm g++ ninja-build pkg-config libfontconfig1-dev libglib2.0-dev libgl1-mesa-dev libpci-dev libx11-dev libxcb1-dev libxext-dev
-
-      - name: Build Linux static graphics libraries
-        run: scripts/build-linux-static-graphics.sh all
-
-      - name: Upload Linux static archives
-        uses: actions/upload-artifact@v4
-        with:
-          name: native-static-${{ matrix.rid }}
-          path: External/NativeStatic/${{ matrix.rid }}/*
-          if-no-files-found: error
@@ -1,74 +0,0 @@
-name: static-graphics-macos
-
-on:
-  workflow_call:
-    inputs:
-      skiasharp_version:
-        required: true
-        type: string
-      angle_branch:
-        required: true
-        type: string
-  workflow_dispatch:
-    inputs:
-      skiasharp_version:
-        required: true
-        default: "4.150.1"
-        type: string
-      angle_branch:
-        required: true
-        default: "7922"
-        type: string
-
-jobs:
-  build:
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - rid: osx-x64
-            target_cpu: x64
-          - rid: osx-arm64
-            target_cpu: arm64
-    runs-on: macos-15
-    env:
-      SKIASHARP_VERSION: ${{ inputs.skiasharp_version }}
-      ANGLE_BRANCH: ${{ inputs.angle_branch }}
-      RID: ${{ matrix.rid }}
-      TARGET_CPU: ${{ matrix.target_cpu }}
-      WORK_DIR: ${{ github.workspace }}/External/NativeStatic/.work
-      OUTPUT_DIR: ${{ github.workspace }}/External/NativeStatic/${{ matrix.rid }}/native
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Restore native build cache
-        uses: actions/cache@v4
-        with:
-          path: External/NativeStatic/.work
-          key: native-work-macos-${{ matrix.rid }}-${{ inputs.skiasharp_version }}-${{ inputs.angle_branch }}-${{ hashFiles('External/NativeStatic/patches/*.patch', 'scripts/build-macos-static-graphics.sh') }}
-
-      - name: Install native build dependencies
-        run: brew install ninja
-
-      - name: Install Xcode Metal toolchain
-        run: |
-          set -euo pipefail
-          cat > /tmp/staticlink-metal-check.metal <<'EOF'
-          #include <metal_stdlib>
-          using namespace metal;
-          kernel void staticlink_metal_check(device float* values [[buffer(0)]], uint id [[thread_position_in_grid]]) { values[id] = 0; }
-          EOF
-          if ! xcrun metal -c /tmp/staticlink-metal-check.metal -o /tmp/staticlink-metal-check.air >/dev/null 2>&1; then
-            sudo xcodebuild -downloadComponent MetalToolchain
-          fi
-          xcrun metal -c /tmp/staticlink-metal-check.metal -o /tmp/staticlink-metal-check.air >/dev/null
-
-      - name: Build macOS static graphics libraries
-        run: bash ./scripts/build-macos-static-graphics.sh all
-
-      - name: Upload macOS static archives
-        uses: actions/upload-artifact@v4
-        with:
-          name: native-static-${{ matrix.rid }}
-          path: External/NativeStatic/${{ matrix.rid }}/*
-          if-no-files-found: error
@@ -1,93 +0,0 @@
-name: static-graphics-musl
-
-on:
-  workflow_call:
-    inputs:
-      skiasharp_version:
-        required: true
-        type: string
-      angle_branch:
-        required: true
-        type: string
-      dotnet_alpine_image:
-        required: true
-        type: string
-  workflow_dispatch:
-    inputs:
-      skiasharp_version:
-        required: true
-        default: "4.150.1"
-        type: string
-      angle_branch:
-        required: true
-        default: "7922"
-        type: string
-      dotnet_alpine_image:
-        required: true
-        default: mcr.microsoft.com/dotnet/sdk:10.0.302-alpine3.23
-        type: string
-
-jobs:
-  build:
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - rid: linux-musl-x64
-            target_cpu: x64
-            runner: ubuntu-24.04
-          - rid: linux-musl-arm64
-            target_cpu: arm64
-            runner: ubuntu-24.04-arm
-    runs-on: ${{ matrix.runner }}
-    env:
-      SKIASHARP_VERSION: ${{ inputs.skiasharp_version }}
-      ANGLE_BRANCH: ${{ inputs.angle_branch }}
-      DOTNET_ALPINE_IMAGE: ${{ inputs.dotnet_alpine_image }}
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Restore native build cache
-        uses: actions/cache@v4
-        with:
-          path: External/NativeStatic/.work
-          key: native-work-musl-${{ matrix.rid }}-${{ inputs.skiasharp_version }}-${{ inputs.angle_branch }}-${{ hashFiles('External/NativeStatic/patches/*.patch', 'scripts/build-linux-static-graphics.sh') }}
-
-      - name: Build Linux musl static graphics libraries
-        run: |
-          docker run --rm \
-            -v "$PWD:/workspace" \
-            -w /workspace \
-            -e RID="${{ matrix.rid }}" \
-            -e TARGET_CPU="${{ matrix.target_cpu }}" \
-            -e OUTPUT_DIR="/workspace/External/NativeStatic/${{ matrix.rid }}/native" \
-            -e SKIASHARP_VERSION="$SKIASHARP_VERSION" \
-            -e ANGLE_BRANCH="$ANGLE_BRANCH" \
-            -e LLVM_AR=llvm-ar \
-            -e DEPOT_TOOLS_BOOTSTRAP_PYTHON3=0 \
-            -e VPYTHON_BYPASS="manually managed python not supported by chrome operations" \
-            "$DOTNET_ALPINE_IMAGE" \
-            sh -lc '
-              set -e
-              apk add --no-cache bash ca-certificates git python3 py3-httplib2 py3-pysocks py3-six clang compiler-rt lld llvm g++ ninja pkgconf fontconfig-dev glib-dev mesa-dev libx11-dev libxcb-dev libxext-dev pciutils-dev linux-headers perl curl tar xz patch gcompat libc6-compat
-              git config --global --add safe.directory "*"
-              python3 - <<'"'"'PY'"'"'
-          import pathlib
-          import httplib2
-
-          path = pathlib.Path(httplib2.__file__).with_name("socks.py")
-          if not path.exists():
-            path.write_text("from socks import *\n")
-          PY
-              bash scripts/build-linux-static-graphics.sh all
-            '
-
-      - name: Normalize native build cache ownership
-        run: sudo chown -R "$(id -u):$(id -g)" External/NativeStatic/.work
-
-      - name: Upload Linux musl static archives
-        uses: actions/upload-artifact@v4
-        with:
-          name: native-static-${{ matrix.rid }}
-          path: External/NativeStatic/${{ matrix.rid }}/*
-          if-no-files-found: error
@@ -1,81 +0,0 @@
-name: static-graphics-preflight
-
-on:
-  workflow_call:
-    outputs:
-      package_version:
-        value: ${{ jobs.validate.outputs.package_version }}
-      skiasharp_version:
-        value: ${{ jobs.validate.outputs.skiasharp_version }}
-      angle_branch:
-        value: ${{ jobs.validate.outputs.angle_branch }}
-  workflow_dispatch:
-
-jobs:
-  validate:
-    runs-on: ubuntu-24.04
-    outputs:
-      package_version: ${{ steps.versions.outputs.package_version }}
-      skiasharp_version: ${{ steps.versions.outputs.skiasharp_version }}
-      angle_branch: ${{ steps.versions.outputs.angle_branch }}
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Setup .NET
-        uses: actions/setup-dotnet@v4
-        with:
-          dotnet-version: "10.0.302"
-
-      - name: Read and validate versions
-        id: versions
-        shell: bash
-        run: |
-          python3 - <<'PY'
-          import os
-          import pathlib
-          import xml.etree.ElementTree as ET
-
-          project = pathlib.Path("NuGet/StaticGraphics/StaticLink.Avalonia.csproj")
-          root = ET.parse(project).getroot()
-          package_version = root.findtext(".//Version")
-          skia_reference = next(
-              item.attrib["Version"]
-              for item in root.findall(".//PackageReference")
-              if item.attrib.get("Include") == "SkiaSharp"
-          )
-          version_base, revision = package_version.rsplit(".", 1)
-          skiasharp_version, angle_branch = version_base.split("-", 1)
-          if not revision.isdigit() or skiasharp_version != skia_reference:
-              raise SystemExit(f"Inconsistent package version: {package_version}, SkiaSharp: {skia_reference}")
-          if os.environ.get("GITHUB_REF_TYPE") == "tag":
-              expected_tag = f"staticlink-avalonia-v{package_version}"
-              if os.environ.get("GITHUB_REF_NAME") != expected_tag:
-                  raise SystemExit(f"Release tag must be {expected_tag}")
-
-          with open(os.environ["GITHUB_OUTPUT"], "a", encoding="utf-8") as output:
-              output.write(f"package_version={package_version}\n")
-              output.write(f"skiasharp_version={skiasharp_version}\n")
-              output.write(f"angle_branch={angle_branch}\n")
-          PY
-
-      - name: Validate upstream refs and ANGLE patch
-        env:
-          SKIASHARP_VERSION: ${{ steps.versions.outputs.skiasharp_version }}
-          ANGLE_BRANCH: ${{ steps.versions.outputs.angle_branch }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          git ls-remote --exit-code --heads https://github.com/mono/SkiaSharp.git "refs/heads/release/${SKIASHARP_VERSION}"
-          git clone --depth 1 --branch "chromium/${ANGLE_BRANCH}" https://github.com/google/angle.git /tmp/staticlink-angle
-          git -C /tmp/staticlink-angle apply --check "$GITHUB_WORKSPACE/External/NativeStatic/patches/angle-chromium-${ANGLE_BRANCH}.patch"
-
-      - name: Validate scripts
-        shell: bash
-        run: |
-          set -euo pipefail
-          bash -n scripts/build-linux-static-graphics.sh
-          bash -n scripts/build-macos-static-graphics.sh
-          pwsh -NoProfile -Command '$files = @("scripts/build-windows-static-graphics.ps1", "scripts/create-avalonia-smoke.ps1"); foreach ($file in $files) { $errors = $null; [System.Management.Automation.Language.Parser]::ParseFile((Resolve-Path $file), [ref]$null, [ref]$errors) | Out-Null; if ($errors.Count) { $errors | Format-List | Out-String; exit 1 } }'
-
-      - name: Compile smoke project
-        run: dotnet build Smoke/AvaloniaStaticLinkSmoke/AvaloniaStaticLinkSmoke.csproj -c Release -p:PublishAot=false
@@ -1,92 +0,0 @@
-name: static-graphics-windows
-
-on:
-  workflow_call:
-    inputs:
-      skiasharp_version:
-        required: true
-        type: string
-      angle_branch:
-        required: true
-        type: string
-  workflow_dispatch:
-    inputs:
-      skiasharp_version:
-        required: true
-        default: "4.150.1"
-        type: string
-      angle_branch:
-        required: true
-        default: "7922"
-        type: string
-
-jobs:
-  build:
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - rid: win-x64
-            target_cpu: x64
-            msvc_arch: x64
-          - rid: win-x86
-            target_cpu: x86
-            msvc_arch: x86
-          - rid: win-arm64
-            target_cpu: arm64
-            msvc_arch: amd64_arm64
-    runs-on: windows-2022
-    env:
-      SKIASHARP_VERSION: ${{ inputs.skiasharp_version }}
-      ANGLE_BRANCH: ${{ inputs.angle_branch }}
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Restore native build cache
-        uses: actions/cache@v4
-        with:
-          path: External/NativeStatic/.work
-          key: native-work-windows-${{ matrix.rid }}-${{ inputs.skiasharp_version }}-${{ inputs.angle_branch }}-${{ hashFiles('External/NativeStatic/patches/*.patch', 'scripts/build-windows-static-graphics.ps1') }}
-
-      - name: Setup MSVC environment
-        uses: ilammy/msvc-dev-cmd@v1
-        with:
-          arch: ${{ matrix.msvc_arch }}
-
-      - name: Configure Chromium Visual Studio environment
-        shell: pwsh
-        run: |
-          "DEPOT_TOOLS_WIN_TOOLCHAIN=0" >> $env:GITHUB_ENV
-          "GYP_MSVS_VERSION=17.0" >> $env:GITHUB_ENV
-          "GYP_MSVS_OVERRIDE_PATH=$($env:VSINSTALLDIR.TrimEnd('\', '/'))" >> $env:GITHUB_ENV
-
-      - name: Install native build dependencies
-        shell: pwsh
-        run: |
-          git config --global core.longpaths true
-          choco install ninja llvm -y
-
-      - name: Validate Windows ANGLE inputs
-        shell: pwsh
-        env:
-          RID: ${{ matrix.rid }}
-          TARGET_CPU: ${{ matrix.target_cpu }}
-          DEPOT_TOOLS_WIN_TOOLCHAIN: 0
-          GYP_MSVS_VERSION: 17.0
-        run: .\scripts\build-windows-static-graphics.ps1 angle-preflight
-
-      - name: Build Windows static graphics libraries
-        shell: pwsh
-        env:
-          RID: ${{ matrix.rid }}
-          TARGET_CPU: ${{ matrix.target_cpu }}
-          DEPOT_TOOLS_WIN_TOOLCHAIN: 0
-          GYP_MSVS_VERSION: 17.0
-        run: .\scripts\build-windows-static-graphics.ps1 all
-
-      - name: Upload Windows static archives
-        uses: actions/upload-artifact@v4
-        with:
-          name: native-static-${{ matrix.rid }}
-          path: External/NativeStatic/${{ matrix.rid }}/*
-          if-no-files-found: error
@@ -0,0 +1,57 @@
+name: pinned-zig-toolchain-image
+
+on:
+  workflow_call:
+    outputs:
+      image:
+        description: Immutable Debian 12 Zig toolchain image reference
+        value: ${{ jobs.image.outputs.image }}
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  image:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    outputs:
+      image: ${{ steps.publish.outputs.image }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Publish or reuse exact toolchain image
+        id: publish
+        env:
+          GH_TOKEN: ${{ github.token }}
+          ACTOR: ${{ github.actor }}
+          REPOSITORY: ${{ github.repository }}
+          BASE_HASH: ${{ hashFiles('build/linux-toolchain/Dockerfile') }}
+          RECIPE_HASH: ${{ hashFiles('build/linux-toolchain/Dockerfile*', 'build/linux-toolchain/*.py', 'build/linux-toolchain/*.c', 'build/linux-toolchain/*.gn.in', 'build/linux-toolchain/*lock.json', 'build/linux-toolchain/versions/*.json', 'build/linux-toolchain/patches/**') }}
+        run: |
+          set -euo pipefail
+          printf '%s' "$GH_TOKEN" | docker login ghcr.io -u "$ACTOR" --password-stdin
+          repository="ghcr.io/${REPOSITORY,,}-zig"
+          image="$repository:recipe-$RECIPE_HASH"
+          base="$repository:debian12-$BASE_HASH"
+          if ! docker pull "$image"; then
+            if ! docker pull "$base"; then
+              docker build --platform linux/amd64 \
+                --label "org.opencontainers.image.source=https://github.com/$REPOSITORY" \
+                -t "$base" build/linux-toolchain
+              docker push "$base"
+              docker pull "$base"
+            fi
+            base_digest="$(docker image inspect --format '{{index .RepoDigests 0}}' "$base")"
+            docker build --platform linux/amd64 \
+              --build-arg "TOOLCHAIN_IMAGE=$base_digest" \
+              --label "org.opencontainers.image.source=https://github.com/$REPOSITORY" \
+              -f build/linux-toolchain/Dockerfile.cross-probe \
+              -t "$image" build/linux-toolchain
+            docker push "$image"
+            docker pull "$image"
+          fi
+          digest="$(docker image inspect --format '{{index .RepoDigests 0}}' "$image")"
+          case "$digest" in "$repository"@sha256:*) ;; *) echo 'No immutable image digest' >&2; exit 1 ;; esac
+          echo "image=$digest" >> "$GITHUB_OUTPUT"
+          echo "Toolchain: $digest" >> "$GITHUB_STEP_SUMMARY"