Disable daily publishing and add isolated manual branch dispatcher

.github/workflows/daily-native-release.yml

@@ -0,0 +1,76 @@
+name: daily-native-release
+
+on:
+  workflow_dispatch:
+    inputs:
+      force_build:
+        description: Build current stable versions even if already published
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+  actions: write
+
+concurrency:
+  group: daily-native-release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  dispatch:
+    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        branch: [skia3, skia4, avalonia-native]
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ matrix.branch }}
+      - name: Check and dispatch this branch
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TRACK_BRANCH: ${{ matrix.branch }}
+          FORCE_BUILD: ${{ inputs.force_build }}
+        run: |
+          python3 - <<'PY'
+          import json
+          import os
+          import subprocess
+
+          branch = os.environ["TRACK_BRANCH"]
+          force = os.environ["FORCE_BUILD"] == "true"
+
+          def dispatch(workflow, inputs):
+              payload = json.dumps({"ref": branch, "inputs": inputs})
+              subprocess.run(
+                  ["gh", "api", "--method", "POST",
+                   f"repos/{os.environ['GITHUB_REPOSITORY']}/actions/workflows/{workflow}/dispatches",
+                   "--input", "-"],
+                  input=payload, text=True, check=True,
+              )
+
+          if branch == "avalonia-native":
+              dispatch("nuget-avalonia-native.yml", {
+                  "force_build": force, "publish_to_nuget": False,
+              })
+          else:
+              command = ["python3", "scripts/check-upstream-releases.py"]
+              if force:
+                  command.append("--force")
+              subprocess.run(command, check=True)
+              for release in json.load(open("release-plan.json")):
+                  if release["ref"] != branch:
+                      raise SystemExit("Release track does not match the checked-out branch")
+                  dispatch("nuget-static-graphics.yml", {
+                      "skiasharp_version": release["skiasharp_version"],
+                      "publish_to_nuget": False, "publish_to_release": False,
+                  })
+                  print(f"Dispatched {release['package_version']} on {branch}")
+          PY
+      - uses: actions/upload-artifact@v4
+        if: ${{ always() && matrix.branch != 'avalonia-native' }}
+        with:
+          name: daily-release-plan-${{ matrix.branch }}
+          path: release-plan.json
+          if-no-files-found: warn

.github/workflows/nuget-avalonia-native.yml

@@ -1,8 +1,6 @@
 name: staticlink-avalonia-native
 
 on:
-  schedule:
-    - cron: "17 3 * * *"
   workflow_dispatch:
     inputs:
       avalonia_version:
@@ -17,7 +15,7 @@ on:
       publish_to_nuget:
         description: Publish with NuGet Trusted Publishing after smoke tests
         required: true
-        default: true
+        default: false
         type: boolean
 
 jobs:

ACTION-TESTING.md

@@ -0,0 +1,32 @@
+# Manual artifact validation
+
+Daily schedules are disabled during validation. No NuGet.org publication or
+GitHub Release is requested by the manual dispatcher on main.
+
+- skia3: nuget-static-graphics.yml; latest stable SkiaSharp 3.
+- skia4: nuget-static-graphics.yml; latest stable SkiaSharp 4.
+- avalonia-native: nuget-avalonia-native.yml; latest stable Avalonia 11 and 12.
+
+Download staticlink-avalonia-nuget and avalonia-smoke-<RID> from each graphics run.
+Download staticlink-avalonia-native-<version> and
+avalonia-native-smoke-<AvaloniaVersion>-<RID> from the native run.
+Native archives and source locks are also retained as Actions artifacts.
+
+Graphics macOS smoke tests use the already published AvaloniaNative revision 1
+by default, so the graphics builds do not require the experimental native
+revision 2 to be published. The native branch validates its own local revision 2
+package separately. To test both experimental packages together, put both
+downloaded packages in a local NuGet feed and reference their exact versions.
+
+Smoke executables are retained even if a later runtime validation fails.
+An artifact is not evidence that all validation gates passed; check job results.
+
+The daily-native-release workflow on main currently supports manual dispatch
+only. Its three matrix jobs check out their own branch and dispatch independently.
+Use force_build=true to rebuild published versions for testing.
+After validation, enable the schedule on main only; non-default branches cannot
+run their own GitHub cron schedules. Publication remains an explicit opt-in.
+While publication is disabled, an unpublished package may be rebuilt on every
+check; add successful-run tracking before enabling artifact-only daily builds
+if avoiding repeated builds is required.
+