Validate the complete container toolchain before release builds

.github/workflows/zig-toolchain-image.yml

@@ -34,6 +34,7 @@ jobs:
           repository="ghcr.io/${REPOSITORY,,}-zig"
           image="$repository:recipe-$RECIPE_HASH"
           base="$repository:debian12-$BASE_HASH"
+          built_image=false
           if ! docker pull "$image"; then
             if ! docker pull "$base"; then
               docker build --platform linux/amd64 \
@@ -48,6 +49,14 @@ jobs:
               --label "org.opencontainers.image.source=https://github.com/$REPOSITORY" \
               -f build/linux-toolchain/Dockerfile.cross-probe \
               -t "$image" build/linux-toolchain
+            built_image=true
+          fi
+          mkdir -p artifacts/toolchain-environment
+          docker run --rm --user "$(id -u):$(id -g)" \
+            -e HOME=/tmp -e DOTNET_CLI_HOME=/tmp -e ZIG_GLOBAL_CACHE_DIR=/tmp/zig-cache \
+            -v "$PWD/artifacts/toolchain-environment:/validation" \
+            --entrypoint python3 "$image" /opt/staticlink/validate-toolchain.py --output /validation
+          if [ "$built_image" = true ]; then
             docker push "$image"
             docker pull "$image"
           fi
@@ -55,3 +64,10 @@ jobs:
           case "$digest" in "$repository"@sha256:*) ;; *) echo 'No immutable image digest' >&2; exit 1 ;; esac
           echo "image=$digest" >> "$GITHUB_OUTPUT"
           echo "Toolchain: $digest" >> "$GITHUB_STEP_SUMMARY"
+      - name: Upload environment validation report
+        if: ${{ always() }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: toolchain-environment-validation
+          path: artifacts/toolchain-environment/
+          if-no-files-found: warn