Validate the complete container toolchain before release builds

.github/workflows/nuget-static-graphics.yml

@@ -3,6 +3,10 @@ name: staticlink-avalonia
 on:
   workflow_dispatch:
     inputs:
+      environment_only:
+        description: Validate the complete toolchain container without building release libraries
+        type: boolean
+        default: false
       skiasharp_version:
         description: Stable SkiaSharp version from this branch major; empty uses the branch version
         type: string
@@ -33,7 +37,14 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
+  environment:
+    permissions:
+      contents: read
+      packages: write
+    uses: ./.github/workflows/zig-toolchain-image.yml
+
   preflight:
+    if: ${{ inputs.environment_only != true }}
     uses: ./.github/workflows/static-graphics-preflight.yml
     with:
       skiasharp_version: ${{ inputs.skiasharp_version }}
@@ -42,11 +53,12 @@ jobs:
     permissions:
       contents: read
       packages: write
-    needs: preflight
+    needs: [preflight, environment]
     uses: ./.github/workflows/static-graphics-zig-cross.yml
     with:
       skiasharp_version: ${{ needs.preflight.outputs.skiasharp_version }}
       source_lock: ${{ needs.preflight.outputs.source_lock }}
+      toolchain_image: ${{ needs.environment.outputs.image }}
 
   pack:
     runs-on: ubuntu-24.04

.github/workflows/zig-toolchain-image.yml

@@ -34,6 +34,7 @@ jobs:
           repository="ghcr.io/${REPOSITORY,,}-zig"
           image="$repository:recipe-$RECIPE_HASH"
           base="$repository:debian12-$BASE_HASH"
+          built_image=false
           if ! docker pull "$image"; then
             if ! docker pull "$base"; then
               docker build --platform linux/amd64 \
@@ -48,6 +49,14 @@ jobs:
               --label "org.opencontainers.image.source=https://github.com/$REPOSITORY" \
               -f build/linux-toolchain/Dockerfile.cross-probe \
               -t "$image" build/linux-toolchain
+            built_image=true
+          fi
+          mkdir -p artifacts/toolchain-environment
+          docker run --rm --user "$(id -u):$(id -g)" \
+            -e HOME=/tmp -e DOTNET_CLI_HOME=/tmp -e ZIG_GLOBAL_CACHE_DIR=/tmp/zig-cache \
+            -v "$PWD/artifacts/toolchain-environment:/validation" \
+            --entrypoint python3 "$image" /opt/staticlink/validate-toolchain.py --output /validation
+          if [ "$built_image" = true ]; then
             docker push "$image"
             docker pull "$image"
           fi
@@ -55,3 +64,10 @@ jobs:
           case "$digest" in "$repository"@sha256:*) ;; *) echo 'No immutable image digest' >&2; exit 1 ;; esac
           echo "image=$digest" >> "$GITHUB_OUTPUT"
           echo "Toolchain: $digest" >> "$GITHUB_STEP_SUMMARY"
+      - name: Upload environment validation report
+        if: ${{ always() }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: toolchain-environment-validation
+          path: artifacts/toolchain-environment/
+          if-no-files-found: warn