Isolate manual artifact validation without package publication

.github/workflows/nuget-avalonia-native.yml

@@ -1,298 +0,0 @@
-name: staticlink-avalonia-native
-
-on:
-  schedule:
-    - cron: "17 3 * * *"
-  workflow_dispatch:
-    inputs:
-      avalonia_version:
-        description: Avalonia version to build; empty checks the latest stable 11.x and 12.x versions
-        required: false
-        type: string
-      force_build:
-        description: Build even when this StaticLink.Avalonia.Native version already exists
-        required: true
-        default: false
-        type: boolean
-      publish_to_nuget:
-        description: Publish with NuGet Trusted Publishing after smoke tests
-        required: true
-        default: true
-        type: boolean
-
-jobs:
-  detect:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    outputs:
-      versions: ${{ steps.version.outputs.versions }}
-      should_build: ${{ steps.version.outputs.should_build }}
-    steps:
-      - name: Detect unpublished Avalonia version
-        id: version
-        shell: bash
-        env:
-          REQUESTED_VERSION: ${{ inputs.avalonia_version }}
-          FORCE_BUILD: ${{ inputs.force_build }}
-        run: |
-          set -euo pipefail
-
-          if [ -n "$REQUESTED_VERSION" ]; then
-            candidate_versions=("$REQUESTED_VERSION")
-          else
-            nuget_versions="$(curl --fail --silent --show-error --location \
-              https://api.nuget.org/v3-flatcontainer/avalonia/index.json)"
-            candidate_versions=()
-            for major in 11 12; do
-              candidate_versions+=("$(jq -r --arg major "$major" \
-                '[.versions[] | select(startswith($major + ".") and (contains("-") | not))] | last' \
-                <<< "$nuget_versions")")
-            done
-          fi
-
-          versions='[]'
-          for avalonia_version in "${candidate_versions[@]}"; do
-            if [ -z "$avalonia_version" ] || [ "$avalonia_version" = "null" ]; then
-              echo "Could not determine a stable Avalonia version." >&2
-              exit 1
-            fi
-
-            package_version="$avalonia_version.1"
-            package_url="https://api.nuget.org/v3-flatcontainer/staticlink.avalonia.native/$package_version/staticlink.avalonia.native.$package_version.nupkg"
-            if [ "$FORCE_BUILD" != "true" ] && curl --fail --silent --location --output /dev/null "$package_url"; then
-              echo "Already published: $package_version"
-              continue
-            fi
-
-            echo "Build required: $package_version"
-            versions="$(jq -cn --argjson versions "$versions" \
-              --arg avalonia_version "$avalonia_version" \
-              --arg package_version "$package_version" \
-              '$versions + [{avalonia_version: $avalonia_version, package_version: $package_version}]')"
-          done
-
-          echo "versions=$versions" >> "$GITHUB_OUTPUT"
-          if [ "$versions" = '[]' ]; then
-            echo 'should_build=false' >> "$GITHUB_OUTPUT"
-          else
-            echo 'should_build=true' >> "$GITHUB_OUTPUT"
-          fi
-
-  build:
-    needs: detect
-    if: ${{ needs.detect.outputs.should_build == 'true' }}
-    strategy:
-      fail-fast: false
-      matrix:
-        version: ${{ fromJSON(needs.detect.outputs.versions) }}
-        rid: [osx-x64, osx-arm64]
-        include:
-          - rid: osx-x64
-            runner: macos-14
-          - rid: osx-arm64
-            runner: macos-15
-    runs-on: ${{ matrix.runner }}
-    permissions:
-      contents: read
-    env:
-      RID: ${{ matrix.rid }}
-      AVALONIA_VERSION: ${{ matrix.version.avalonia_version }}
-      WORK_DIR: ${{ github.workspace }}/External/AvaloniaNative/.work
-      OUTPUT_DIR: ${{ github.workspace }}/External/AvaloniaNative/${{ matrix.rid }}/native
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Setup .NET for Avalonia header generation
-        uses: actions/setup-dotnet@v4
-        with:
-          dotnet-version: |
-            8.0.x
-            10.0.x
-
-      - name: Build static AvaloniaNative
-        run: bash scripts/build-macos-avalonia-native-static.sh
-
-      - name: Build macOS font preinit object
-        run: bash scripts/build-macos-font-preinit.sh
-
-      - name: Upload static AvaloniaNative
-        uses: actions/upload-artifact@v4
-        with:
-          name: native-avalonia-${{ matrix.version.avalonia_version }}-${{ matrix.rid }}
-          path: |
-            External/AvaloniaNative/${{ matrix.rid }}/native/libAvaloniaNative.a
-            External/AvaloniaNative/${{ matrix.rid }}/native/macos_font_preinit.o
-          if-no-files-found: error
-
-  pack:
-    needs:
-      - detect
-      - build
-    if: ${{ needs.detect.outputs.should_build == 'true' }}
-    strategy:
-      matrix:
-        version: ${{ fromJSON(needs.detect.outputs.versions) }}
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Setup .NET
-        uses: actions/setup-dotnet@v4
-        with:
-          dotnet-version: "10.0.x"
-
-      - name: Download static AvaloniaNative archives
-        uses: actions/download-artifact@v4
-        with:
-          pattern: native-avalonia-${{ matrix.version.avalonia_version }}-*
-          path: artifacts/native
-          merge-multiple: false
-
-      - name: Prepare package inputs
-        shell: bash
-        run: |
-          set -euo pipefail
-          for rid in osx-x64 osx-arm64; do
-            mkdir -p "External/AvaloniaNative/$rid/native"
-            cp "artifacts/native/native-avalonia-${{ matrix.version.avalonia_version }}-$rid/libAvaloniaNative.a" "External/AvaloniaNative/$rid/native/"
-            cp "artifacts/native/native-avalonia-${{ matrix.version.avalonia_version }}-$rid/macos_font_preinit.o" "External/AvaloniaNative/$rid/native/"
-          done
-
-      - name: Pack StaticLink.Avalonia.Native
-        run: |
-          dotnet pack NuGet/AvaloniaNative/StaticLink.Avalonia.Native.csproj \
-            -c Release \
-            -o artifacts/nuget \
-            /p:PackageVersion=${{ matrix.version.package_version }} \
-            /p:Version=${{ matrix.version.package_version }}
-
-      - name: Upload NuGet package
-        uses: actions/upload-artifact@v4
-        with:
-          name: staticlink-avalonia-native-${{ matrix.version.package_version }}
-          path: artifacts/nuget/*.nupkg
-          if-no-files-found: error
-
-  smoke:
-    needs:
-      - detect
-      - pack
-    if: ${{ needs.detect.outputs.should_build == 'true' }}
-    strategy:
-      fail-fast: false
-      matrix:
-        version: ${{ fromJSON(needs.detect.outputs.versions) }}
-        rid: [osx-x64, osx-arm64]
-        include:
-          - rid: osx-x64
-            runner: macos-14
-          - rid: osx-arm64
-            runner: macos-15
-    runs-on: ${{ matrix.runner }}
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Setup .NET
-        uses: actions/setup-dotnet@v4
-        with:
-          dotnet-version: "10.0.x"
-
-      - name: Download NuGet package
-        uses: actions/download-artifact@v4
-        with:
-          name: staticlink-avalonia-native-${{ matrix.version.package_version }}
-          path: artifacts/nuget
-
-      - name: Publish Avalonia NativeAOT smoke app
-        shell: pwsh
-        run: |
-          $projectDir = Join-Path $PWD "artifacts/avalonia-native-smoke-src"
-          pwsh ./scripts/create-avalonia-smoke.ps1 `
-            -ProjectDir $projectDir `
-            -NuGetSource (Resolve-Path "artifacts/nuget") `
-            -AvaloniaVersion "${{ matrix.version.avalonia_version }}" `
-            -StaticLinkNativeVersion "${{ matrix.version.package_version }}"
-          dotnet publish (Join-Path $projectDir "AvaloniaStaticLinkSmoke.csproj") `
-            -c Release `
-            -r "${{ matrix.rid }}" `
-            --configfile (Join-Path $projectDir "NuGet.config") `
-            /p:PublishDir="$PWD/artifacts/smoke-${{ matrix.rid }}/"
-
-      - name: Verify AvaloniaNative is statically linked
-        shell: bash
-        run: |
-          set -euo pipefail
-          test ! -f "artifacts/smoke-${{ matrix.rid }}/libAvaloniaNative.dylib"
-          test -x "artifacts/smoke-${{ matrix.rid }}/AvaloniaStaticLinkSmoke"
-
-      - name: Run Avalonia smoke app
-        shell: bash
-        run: |
-          set -euo pipefail
-          cd "artifacts/smoke-${{ matrix.rid }}"
-          python3 - <<'PY'
-          import subprocess
-          import sys
-
-          proc = subprocess.Popen(
-              ["./AvaloniaStaticLinkSmoke"],
-              stdout=subprocess.PIPE,
-              stderr=subprocess.STDOUT,
-              text=True,
-          )
-          try:
-              output, _ = proc.communicate(timeout=15)
-          except subprocess.TimeoutExpired:
-              proc.kill()
-              output, _ = proc.communicate()
-              print(output or "")
-              print("Avalonia smoke app stayed alive for 15 seconds.")
-              sys.exit(0)
-
-          print(output or "")
-          if proc.returncode == 0:
-              sys.exit(0)
-          sys.exit(proc.returncode if proc.returncode > 0 else 1)
-          PY
-
-  publish:
-    needs:
-      - detect
-      - smoke
-    if: ${{ needs.detect.outputs.should_build == 'true' && (github.event_name == 'schedule' || inputs.publish_to_nuget == true) }}
-    strategy:
-      matrix:
-        version: ${{ fromJSON(needs.detect.outputs.versions) }}
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      id-token: write
-    steps:
-      - name: Download NuGet package
-        uses: actions/download-artifact@v4
-        with:
-          name: staticlink-avalonia-native-${{ matrix.version.package_version }}
-          path: artifacts/nuget
-
-      - name: Validate Trusted Publishing configuration
-        env:
-          NUGET_USER: ${{ vars.NUGET_USER }}
-        run: test -n "$NUGET_USER"
-
-      - name: NuGet login
-        id: login
-        uses: NuGet/login@v1
-        with:
-          user: ${{ vars.NUGET_USER }}
-
-      - name: Publish to nuget.org
-        run: |
-          dotnet nuget push artifacts/nuget/*.nupkg \
-            --source https://www.nuget.org/api/v2/package \
-            --api-key "${{ steps.login.outputs.NUGET_API_KEY }}" \
-            --skip-duplicate

.github/workflows/nuget-static-graphics.yml

@@ -3,6 +3,14 @@ name: staticlink-avalonia
 on:
   workflow_dispatch:
     inputs:
+      skiasharp_version:
+        description: Stable SkiaSharp version from this branch major; empty uses the branch version
+        type: string
+        default: ''
+      native_package_revision:
+        description: Published AvaloniaNative revision for independent graphics smoke tests
+        type: string
+        default: '1'
       publish_to_nuget:
         description: Publish package to nuget.org
         required: true
@@ -11,7 +19,7 @@ on:
       publish_to_release:
         description: Publish NuGet package and smoke apps to GitHub Release
         required: true
-        default: true
+        default: false
         type: boolean
   push:
     tags:
@@ -20,46 +28,31 @@ on:
 env:
   DOTNET_ALPINE_IMAGE: mcr.microsoft.com/dotnet/sdk:10.0.302-alpine3.23
 
+concurrency:
+  group: graphics-${{ github.ref }}-${{ inputs.skiasharp_version }}
+  cancel-in-progress: false
+
 jobs:
   preflight:
     uses: ./.github/workflows/static-graphics-preflight.yml
+    with:
+      skiasharp_version: ${{ inputs.skiasharp_version }}
 
-  build-linux:
+  build-zig:
+    permissions:
+      contents: read
+      packages: write
     needs: preflight
-    uses: ./.github/workflows/static-graphics-linux.yml
+    uses: ./.github/workflows/static-graphics-zig-cross.yml
     with:
       skiasharp_version: ${{ needs.preflight.outputs.skiasharp_version }}
-      angle_branch: ${{ needs.preflight.outputs.angle_branch }}
-
-  build-musl:
-    needs: preflight
-    uses: ./.github/workflows/static-graphics-musl.yml
-    with:
-      skiasharp_version: ${{ needs.preflight.outputs.skiasharp_version }}
-      angle_branch: ${{ needs.preflight.outputs.angle_branch }}
-      dotnet_alpine_image: mcr.microsoft.com/dotnet/sdk:10.0.302-alpine3.23
-
-  build-windows:
-    needs: preflight
-    uses: ./.github/workflows/static-graphics-windows.yml
-    with:
-      skiasharp_version: ${{ needs.preflight.outputs.skiasharp_version }}
-      angle_branch: ${{ needs.preflight.outputs.angle_branch }}
-
-  build-macos:
-    needs: preflight
-    uses: ./.github/workflows/static-graphics-macos.yml
-    with:
-      skiasharp_version: ${{ needs.preflight.outputs.skiasharp_version }}
-      angle_branch: ${{ needs.preflight.outputs.angle_branch }}
+      source_lock: ${{ needs.preflight.outputs.source_lock }}
 
   pack:
     runs-on: ubuntu-24.04
     needs:
-      - build-linux
-      - build-musl
-      - build-windows
-      - build-macos
+      - preflight
+      - build-zig
     permissions:
       contents: read
     steps:
@@ -109,7 +102,13 @@ jobs:
           test -f External/NativeStatic/win-x86/native/skia_x86_stdcall_thunks.lib
 
       - name: Pack NuGet package
-        run: dotnet pack NuGet/StaticGraphics/StaticLink.Avalonia.csproj -c Release -o artifacts/nuget
+        env:
+          SOURCE_LOCK_JSON: ${{ needs.preflight.outputs.source_lock }}
+          PACKAGE_VERSION: ${{ needs.preflight.outputs.package_version }}
+          SKIASHARP_VERSION: ${{ needs.preflight.outputs.skiasharp_version }}
+        run: |
+          python3 scripts/apply-release-version.py
+          dotnet pack NuGet/StaticGraphics/StaticLink.Avalonia.csproj -c Release -o artifacts/nuget
 
       - name: Verify portable NuGet paths
         shell: bash
@@ -123,6 +122,13 @@ jobs:
           unzip -Z1 "$package" | grep -Fx 'buildTransitive/StaticLink.Avalonia.props'
           unzip -Z1 "$package" | grep -Fx 'buildTransitive/StaticLink.Avalonia.targets'
 
+      - name: Upload release source lock
+        uses: actions/upload-artifact@v4
+        with:
+          name: graphics-release-source-lock
+          path: build/linux-toolchain/release.lock.json
+          if-no-files-found: error
+
       - name: Upload NuGet artifact
         uses: actions/upload-artifact@v4
         with:
@@ -171,11 +177,16 @@ jobs:
         with:
           arch: ${{ matrix.msvc_arch }}
 
+      - name: Install LLVM linker for Zig Windows archives
+        if: ${{ startsWith(matrix.rid, 'win-') }}
+        shell: pwsh
+        run: choco install llvm -y
+
       - name: Install Linux publish dependencies
         if: ${{ startsWith(matrix.rid, 'linux-') && !startsWith(matrix.rid, 'linux-musl-') }}
         run: |
           sudo apt-get update
-          sudo apt-get install -y clang lld xvfb zlib1g-dev libfontconfig1-dev libfreetype6 libgl1 libice6 libsm6 libx11-6 libxcb1 libxcursor1 libxext6 libxfixes3 libxinerama1 libxrandr2 libxrender1 libxi6
+          sudo apt-get install -y clang lld xvfb zlib1g-dev libfontconfig1-dev libffi-dev libwayland-dev libx11-dev libxext-dev libxcb1-dev libfreetype6 libgl1 libice6 libsm6 libx11-6 libxcb1 libxcursor1 libxext6 libxfixes3 libxinerama1 libxrandr2 libxrender1 libxi6
 
       - name: Setup .NET
         uses: actions/setup-dotnet@v4
@@ -200,7 +211,9 @@ jobs:
           $avaloniaVersion = "${{ matrix.avalonia_version }}"
           if (-not $avaloniaVersion) { $avaloniaVersion = "11.3.14" }
           $projectDir = Join-Path $PWD "artifacts/avalonia-smoke-src"
-          pwsh ./scripts/create-avalonia-smoke.ps1 -ProjectDir $projectDir -NuGetSource (Resolve-Path "artifacts/nuget") -StaticLinkVersion $version -AvaloniaVersion $avaloniaVersion
+          $nativeVersion = ""
+          if ("${{ matrix.rid }}".StartsWith("osx-")) { $nativeVersion = "$avaloniaVersion.${{ inputs.native_package_revision || '1' }}" }
+          pwsh ./scripts/create-avalonia-smoke.ps1 -ProjectDir $projectDir -NuGetSource (Resolve-Path "artifacts/nuget") -StaticLinkVersion $version -AvaloniaVersion $avaloniaVersion -StaticLinkNativeVersion $nativeVersion
           dotnet publish (Join-Path $projectDir "AvaloniaStaticLinkSmoke.csproj") `
             -c Release `
             -r "${{ matrix.rid }}" `
@@ -226,7 +239,7 @@ jobs:
             -v "${{ github.workspace }}:/workspace" `
             -w /workspace `
             "${{ env.DOTNET_ALPINE_IMAGE }}" `
-            sh -c "apk add --no-cache clang lld build-base zlib-dev fontconfig-dev && dotnet publish /workspace/artifacts/avalonia-smoke-src/AvaloniaStaticLinkSmoke.csproj -c Release -r ${{ matrix.rid }} --configfile /workspace/artifacts/avalonia-smoke-src/NuGet.config /p:PublishAot=true /p:SelfContained=true /p:PublishSingleFile=true /p:StripSymbols=true /p:PublishDir=/workspace/artifacts/smoke-${{ matrix.rid }}/"
+            sh -c "apk add --no-cache clang lld build-base zlib-dev fontconfig-dev libffi-dev wayland-dev libx11-dev libxext-dev libxcb-dev && dotnet publish /workspace/artifacts/avalonia-smoke-src/AvaloniaStaticLinkSmoke.csproj -c Release -r ${{ matrix.rid }} --configfile /workspace/artifacts/avalonia-smoke-src/NuGet.config /p:PublishAot=true /p:SelfContained=true /p:PublishSingleFile=true /p:StripSymbols=true /p:PublishDir=/workspace/artifacts/smoke-${{ matrix.rid }}/"
 
       - name: Verify no dynamic graphics libraries remain
         shell: pwsh
@@ -354,11 +367,12 @@ jobs:
           PY
 
       - name: Upload Avalonia smoke app
+        if: ${{ always() }}
         uses: actions/upload-artifact@v4
         with:
           name: avalonia-smoke-${{ matrix.rid }}
           path: artifacts/smoke-${{ matrix.rid }}/**
-          if-no-files-found: error
+          if-no-files-found: warn
 
   smoke-macos-metal:
     runs-on: macos-15
@@ -392,7 +406,7 @@ jobs:
             -NuGetSource (Resolve-Path "artifacts/nuget") `
             -StaticLinkVersion $Matches[1] `
             -AvaloniaVersion "12.1.0" `
-            -StaticLinkNativeVersion "12.1.0.1"
+            -StaticLinkNativeVersion "12.1.0.${{ inputs.native_package_revision || '1' }}"
           dotnet publish (Join-Path $projectDir "AvaloniaStaticLinkSmoke.csproj") `
             -c Release `
             -r osx-arm64 `
@@ -451,7 +465,18 @@ jobs:
                   raise SystemExit(f"Avalonia {renderer} smoke app failed with exit code {result.returncode}.")
           PY
 
+      - name: Upload macOS Metal smoke app
+        if: ${{ always() }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: avalonia-smoke-osx-arm64-metal
+          path: artifacts/smoke-osx-arm64-metal/**
+          if-no-files-found: warn
+
   publish-nuget:
+    permissions:
+      contents: read
+      id-token: write
     runs-on: ubuntu-24.04
     needs:
       - pack
@@ -469,14 +494,21 @@ jobs:
           name: staticlink-avalonia-nuget
           path: artifacts/nuget
 
+      - name: NuGet Trusted Publishing login
+        id: login
+        if: ${{ vars.NUGET_USER != '' && (startsWith(github.ref, 'refs/tags/staticlink-avalonia-v') || inputs.publish_to_nuget == true) }}
+        uses: NuGet/login@v1
+        with:
+          user: ${{ vars.NUGET_USER }}
+
       - name: Publish to nuget.org
         if: ${{ startsWith(github.ref, 'refs/tags/staticlink-avalonia-v') || (github.event_name == 'workflow_dispatch' && inputs.publish_to_nuget == true) }}
         env:
-          NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}
+          NUGET_API_KEY: ${{ steps.login.outputs.NUGET_API_KEY || secrets.NUGET_API_KEY }}
         run: |
           if [ -z "$NUGET_API_KEY" ]; then
-            echo "NUGET_API_KEY secret is not configured. Skipping publish."
-            exit 0
+            echo "NUGET_API_KEY secret is not configured." >&2
+            exit 1
           fi
 
           for package in artifacts/nuget/*.nupkg; do
@@ -506,6 +538,12 @@ jobs:
           name: staticlink-avalonia-nuget
           path: release-artifacts/staticlink-avalonia-nuget
 
+      - name: Download release source lock
+        uses: actions/download-artifact@v4
+        with:
+          name: graphics-release-source-lock
+          path: release-artifacts/source-lock
+
       - name: Download smoke artifacts
         uses: actions/download-artifact@v4
         with:
@@ -516,6 +554,7 @@ jobs:
       - name: Prepare release files
         run: |
           mkdir -p release-files
+          cp release-artifacts/source-lock/release.lock.json release-files/
           find release-artifacts/staticlink-avalonia-nuget -type f \( -name '*.nupkg' -o -name '*.snupkg' \) -exec cp {} release-files/ \;
           for dir in release-artifacts/avalonia-smoke-*; do
             [ -d "$dir" ] || continue

.github/workflows/static-graphics-linux-debian.yml

@@ -0,0 +1,28 @@
+name: static-graphics-linux-debian-zig
+
+on:
+  workflow_call:
+    inputs:
+      skiasharp_version:
+        required: true
+        type: string
+      source_lock:
+        type: string
+        default: ''
+  workflow_dispatch:
+    inputs:
+      skiasharp_version:
+        type: string
+        default: '4.150.1'
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  build:
+    uses: ./.github/workflows/static-graphics-zig-cross.yml
+    with:
+      skiasharp_version: ${{ inputs.skiasharp_version }}
+      source_lock: ${{ inputs.source_lock || '' }}
+      rids: '["linux-x64","linux-arm64","linux-musl-x64","linux-musl-arm64"]'

.github/workflows/static-graphics-linux.yml

@@ -1,4 +1,4 @@
-name: static-graphics-linux
+name: static-graphics-linux-zig
 
 on:
   workflow_call:
@@ -6,59 +6,23 @@ on:
       skiasharp_version:
         required: true
         type: string
-      angle_branch:
-        required: true
+      source_lock:
         type: string
+        default: ''
   workflow_dispatch:
     inputs:
       skiasharp_version:
-        required: true
-        default: "4.150.1"
-        type: string
-      angle_branch:
-        required: true
-        default: "7922"
         type: string
+        default: '4.150.1'
+
+permissions:
+  contents: read
+  packages: write
 
 jobs:
   build:
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - rid: linux-x64
-            target_cpu: x64
-            runner: ubuntu-24.04
-          - rid: linux-arm64
-            target_cpu: arm64
-            runner: ubuntu-24.04-arm
-    runs-on: ${{ matrix.runner }}
-    env:
-      SKIASHARP_VERSION: ${{ inputs.skiasharp_version }}
-      ANGLE_BRANCH: ${{ inputs.angle_branch }}
-      RID: ${{ matrix.rid }}
-      TARGET_CPU: ${{ matrix.target_cpu }}
-      LLVM_AR: llvm-ar
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Restore native build cache
-        uses: actions/cache@v4
-        with:
-          path: External/NativeStatic/.work
-          key: native-work-linux-${{ matrix.rid }}-${{ inputs.skiasharp_version }}-${{ inputs.angle_branch }}-${{ hashFiles('External/NativeStatic/patches/*.patch', 'scripts/build-linux-static-graphics.sh') }}
-
-      - name: Install native build dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y clang lld llvm g++ ninja-build pkg-config libfontconfig1-dev libglib2.0-dev libgl1-mesa-dev libpci-dev libx11-dev libxcb1-dev libxext-dev
-
-      - name: Build Linux static graphics libraries
-        run: scripts/build-linux-static-graphics.sh all
-
-      - name: Upload Linux static archives
-        uses: actions/upload-artifact@v4
-        with:
-          name: native-static-${{ matrix.rid }}
-          path: External/NativeStatic/${{ matrix.rid }}/*
-          if-no-files-found: error
+    uses: ./.github/workflows/static-graphics-zig-cross.yml
+    with:
+      skiasharp_version: ${{ inputs.skiasharp_version }}
+      source_lock: ${{ inputs.source_lock || '' }}
+      rids: '["linux-x64","linux-arm64"]'

.github/workflows/static-graphics-macos.yml

@@ -1,4 +1,4 @@
-name: static-graphics-macos
+name: static-graphics-macos-zig
 
 on:
   workflow_call:
@@ -6,69 +6,23 @@ on:
       skiasharp_version:
         required: true
         type: string
-      angle_branch:
-        required: true
+      source_lock:
         type: string
+        default: ''
   workflow_dispatch:
     inputs:
       skiasharp_version:
-        required: true
-        default: "4.150.1"
-        type: string
-      angle_branch:
-        required: true
-        default: "7922"
         type: string
+        default: '4.150.1'
+
+permissions:
+  contents: read
+  packages: write
 
 jobs:
   build:
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - rid: osx-x64
-            target_cpu: x64
-          - rid: osx-arm64
-            target_cpu: arm64
-    runs-on: macos-15
-    env:
-      SKIASHARP_VERSION: ${{ inputs.skiasharp_version }}
-      ANGLE_BRANCH: ${{ inputs.angle_branch }}
-      RID: ${{ matrix.rid }}
-      TARGET_CPU: ${{ matrix.target_cpu }}
-      WORK_DIR: ${{ github.workspace }}/External/NativeStatic/.work
-      OUTPUT_DIR: ${{ github.workspace }}/External/NativeStatic/${{ matrix.rid }}/native
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Restore native build cache
-        uses: actions/cache@v4
-        with:
-          path: External/NativeStatic/.work
-          key: native-work-macos-${{ matrix.rid }}-${{ inputs.skiasharp_version }}-${{ inputs.angle_branch }}-${{ hashFiles('External/NativeStatic/patches/*.patch', 'scripts/build-macos-static-graphics.sh') }}
-
-      - name: Install native build dependencies
-        run: brew install ninja
-
-      - name: Install Xcode Metal toolchain
-        run: |
-          set -euo pipefail
-          cat > /tmp/staticlink-metal-check.metal <<'EOF'
-          #include <metal_stdlib>
-          using namespace metal;
-          kernel void staticlink_metal_check(device float* values [[buffer(0)]], uint id [[thread_position_in_grid]]) { values[id] = 0; }
-          EOF
-          if ! xcrun metal -c /tmp/staticlink-metal-check.metal -o /tmp/staticlink-metal-check.air >/dev/null 2>&1; then
-            sudo xcodebuild -downloadComponent MetalToolchain
-          fi
-          xcrun metal -c /tmp/staticlink-metal-check.metal -o /tmp/staticlink-metal-check.air >/dev/null
-
-      - name: Build macOS static graphics libraries
-        run: bash ./scripts/build-macos-static-graphics.sh all
-
-      - name: Upload macOS static archives
-        uses: actions/upload-artifact@v4
-        with:
-          name: native-static-${{ matrix.rid }}
-          path: External/NativeStatic/${{ matrix.rid }}/*
-          if-no-files-found: error
+    uses: ./.github/workflows/static-graphics-zig-cross.yml
+    with:
+      skiasharp_version: ${{ inputs.skiasharp_version }}
+      source_lock: ${{ inputs.source_lock || '' }}
+      rids: '["osx-x64","osx-arm64"]'

.github/workflows/static-graphics-musl.yml

@@ -1,4 +1,4 @@
-name: static-graphics-musl
+name: static-graphics-musl-zig
 
 on:
   workflow_call:
@@ -6,88 +6,23 @@ on:
       skiasharp_version:
         required: true
         type: string
-      angle_branch:
-        required: true
-        type: string
-      dotnet_alpine_image:
-        required: true
+      source_lock:
         type: string
+        default: ''
   workflow_dispatch:
     inputs:
       skiasharp_version:
-        required: true
-        default: "4.150.1"
-        type: string
-      angle_branch:
-        required: true
-        default: "7922"
-        type: string
-      dotnet_alpine_image:
-        required: true
-        default: mcr.microsoft.com/dotnet/sdk:10.0.302-alpine3.23
         type: string
+        default: '4.150.1'
+
+permissions:
+  contents: read
+  packages: write
 
 jobs:
   build:
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - rid: linux-musl-x64
-            target_cpu: x64
-            runner: ubuntu-24.04
-          - rid: linux-musl-arm64
-            target_cpu: arm64
-            runner: ubuntu-24.04-arm
-    runs-on: ${{ matrix.runner }}
-    env:
-      SKIASHARP_VERSION: ${{ inputs.skiasharp_version }}
-      ANGLE_BRANCH: ${{ inputs.angle_branch }}
-      DOTNET_ALPINE_IMAGE: ${{ inputs.dotnet_alpine_image }}
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Restore native build cache
-        uses: actions/cache@v4
-        with:
-          path: External/NativeStatic/.work
-          key: native-work-musl-${{ matrix.rid }}-${{ inputs.skiasharp_version }}-${{ inputs.angle_branch }}-${{ hashFiles('External/NativeStatic/patches/*.patch', 'scripts/build-linux-static-graphics.sh') }}
-
-      - name: Build Linux musl static graphics libraries
-        run: |
-          docker run --rm \
-            -v "$PWD:/workspace" \
-            -w /workspace \
-            -e RID="${{ matrix.rid }}" \
-            -e TARGET_CPU="${{ matrix.target_cpu }}" \
-            -e OUTPUT_DIR="/workspace/External/NativeStatic/${{ matrix.rid }}/native" \
-            -e SKIASHARP_VERSION="$SKIASHARP_VERSION" \
-            -e ANGLE_BRANCH="$ANGLE_BRANCH" \
-            -e LLVM_AR=llvm-ar \
-            -e DEPOT_TOOLS_BOOTSTRAP_PYTHON3=0 \
-            -e VPYTHON_BYPASS="manually managed python not supported by chrome operations" \
-            "$DOTNET_ALPINE_IMAGE" \
-            sh -lc '
-              set -e
-              apk add --no-cache bash ca-certificates git python3 py3-httplib2 py3-pysocks py3-six clang compiler-rt lld llvm g++ ninja pkgconf fontconfig-dev glib-dev mesa-dev libx11-dev libxcb-dev libxext-dev pciutils-dev linux-headers perl curl tar xz patch gcompat libc6-compat
-              git config --global --add safe.directory "*"
-              python3 - <<'"'"'PY'"'"'
-          import pathlib
-          import httplib2
-
-          path = pathlib.Path(httplib2.__file__).with_name("socks.py")
-          if not path.exists():
-            path.write_text("from socks import *\n")
-          PY
-              bash scripts/build-linux-static-graphics.sh all
-            '
-
-      - name: Normalize native build cache ownership
-        run: sudo chown -R "$(id -u):$(id -g)" External/NativeStatic/.work
-
-      - name: Upload Linux musl static archives
-        uses: actions/upload-artifact@v4
-        with:
-          name: native-static-${{ matrix.rid }}
-          path: External/NativeStatic/${{ matrix.rid }}/*
-          if-no-files-found: error
+    uses: ./.github/workflows/static-graphics-zig-cross.yml
+    with:
+      skiasharp_version: ${{ inputs.skiasharp_version }}
+      source_lock: ${{ inputs.source_lock || '' }}
+      rids: '["linux-musl-x64","linux-musl-arm64"]'

.github/workflows/static-graphics-preflight.yml

@@ -2,7 +2,13 @@ name: static-graphics-preflight
 
 on:
   workflow_call:
+    inputs:
+      skiasharp_version:
+        type: string
+        default: ''
     outputs:
+      source_lock:
+        value: ${{ jobs.validate.outputs.source_lock }}
       package_version:
         value: ${{ jobs.validate.outputs.package_version }}
       skiasharp_version:
@@ -15,6 +21,7 @@ jobs:
   validate:
     runs-on: ubuntu-24.04
     outputs:
+      source_lock: ${{ steps.versions.outputs.source_lock }}
       package_version: ${{ steps.versions.outputs.package_version }}
       skiasharp_version: ${{ steps.versions.outputs.skiasharp_version }}
       angle_branch: ${{ steps.versions.outputs.angle_branch }}
@@ -29,7 +36,14 @@ jobs:
       - name: Read and validate versions
         id: versions
         shell: bash
+        env:
+          REQUESTED_VERSION: ${{ inputs.skiasharp_version }}
         run: |
+          if [ "${GITHUB_REF_TYPE:-}" = tag ] && [ -z "$REQUESTED_VERSION" ]; then
+            tag_version="${GITHUB_REF_NAME#staticlink-avalonia-v}"
+            REQUESTED_VERSION="${tag_version%%-*}"
+          fi
+          python3 scripts/resolve-release-lock.py --version "$REQUESTED_VERSION"
           python3 - <<'PY'
           import os
           import pathlib
@@ -37,7 +51,10 @@ jobs:
 
           project = pathlib.Path("NuGet/StaticGraphics/StaticLink.Avalonia.csproj")
           root = ET.parse(project).getroot()
+          import json
+          lock = json.loads(pathlib.Path("build/linux-toolchain/release.lock.json").read_text())
           package_version = root.findtext(".//Version")
+          package_version = lock["skiasharp_version"] + "-" + package_version.split("-", 1)[1]
           skia_reference = next(
               item.attrib["Version"]
               for item in root.findall(".//PackageReference")
@@ -45,7 +62,7 @@ jobs:
           )
           version_base, revision = package_version.rsplit(".", 1)
           skiasharp_version, angle_branch = version_base.split("-", 1)
-          if not revision.isdigit() or skiasharp_version != skia_reference:
+          if not revision.isdigit() or skiasharp_version != lock["skiasharp_version"]:
               raise SystemExit(f"Inconsistent package version: {package_version}, SkiaSharp: {skia_reference}")
           if os.environ.get("GITHUB_REF_TYPE") == "tag":
               expected_tag = f"staticlink-avalonia-v{package_version}"
@@ -53,6 +70,7 @@ jobs:
                   raise SystemExit(f"Release tag must be {expected_tag}")
 
           with open(os.environ["GITHUB_OUTPUT"], "a", encoding="utf-8") as output:
+              output.write("source_lock=" + json.dumps(lock, separators=(",", ":")) + "\n")
               output.write(f"package_version={package_version}\n")
               output.write(f"skiasharp_version={skiasharp_version}\n")
               output.write(f"angle_branch={angle_branch}\n")
@@ -65,7 +83,7 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          git ls-remote --exit-code --heads https://github.com/mono/SkiaSharp.git "refs/heads/release/${SKIASHARP_VERSION}"
+          git ls-remote --exit-code --tags https://github.com/mono/SkiaSharp.git "refs/tags/v${SKIASHARP_VERSION}"
           git clone --depth 1 --branch "chromium/${ANGLE_BRANCH}" https://github.com/google/angle.git /tmp/staticlink-angle
           git -C /tmp/staticlink-angle apply --check "$GITHUB_WORKSPACE/External/NativeStatic/patches/angle-chromium-${ANGLE_BRANCH}.patch"
 

.github/workflows/static-graphics-windows.yml

@@ -1,4 +1,4 @@
-name: static-graphics-windows
+name: static-graphics-windows-zig
 
 on:
   workflow_call:
@@ -6,87 +6,23 @@ on:
       skiasharp_version:
         required: true
         type: string
-      angle_branch:
-        required: true
+      source_lock:
         type: string
+        default: ''
   workflow_dispatch:
     inputs:
       skiasharp_version:
-        required: true
-        default: "4.150.1"
-        type: string
-      angle_branch:
-        required: true
-        default: "7922"
         type: string
+        default: '4.150.1'
+
+permissions:
+  contents: read
+  packages: write
 
 jobs:
   build:
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - rid: win-x64
-            target_cpu: x64
-            msvc_arch: x64
-          - rid: win-x86
-            target_cpu: x86
-            msvc_arch: x86
-          - rid: win-arm64
-            target_cpu: arm64
-            msvc_arch: amd64_arm64
-    runs-on: windows-2022
-    env:
-      SKIASHARP_VERSION: ${{ inputs.skiasharp_version }}
-      ANGLE_BRANCH: ${{ inputs.angle_branch }}
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Restore native build cache
-        uses: actions/cache@v4
-        with:
-          path: External/NativeStatic/.work
-          key: native-work-windows-${{ matrix.rid }}-${{ inputs.skiasharp_version }}-${{ inputs.angle_branch }}-${{ hashFiles('External/NativeStatic/patches/*.patch', 'scripts/build-windows-static-graphics.ps1') }}
-
-      - name: Setup MSVC environment
-        uses: ilammy/msvc-dev-cmd@v1
-        with:
-          arch: ${{ matrix.msvc_arch }}
-
-      - name: Configure Chromium Visual Studio environment
-        shell: pwsh
-        run: |
-          "DEPOT_TOOLS_WIN_TOOLCHAIN=0" >> $env:GITHUB_ENV
-          "GYP_MSVS_VERSION=17.0" >> $env:GITHUB_ENV
-          "GYP_MSVS_OVERRIDE_PATH=$($env:VSINSTALLDIR.TrimEnd('\', '/'))" >> $env:GITHUB_ENV
-
-      - name: Install native build dependencies
-        shell: pwsh
-        run: |
-          git config --global core.longpaths true
-          choco install ninja llvm -y
-
-      - name: Validate Windows ANGLE inputs
-        shell: pwsh
-        env:
-          RID: ${{ matrix.rid }}
-          TARGET_CPU: ${{ matrix.target_cpu }}
-          DEPOT_TOOLS_WIN_TOOLCHAIN: 0
-          GYP_MSVS_VERSION: 17.0
-        run: .\scripts\build-windows-static-graphics.ps1 angle-preflight
-
-      - name: Build Windows static graphics libraries
-        shell: pwsh
-        env:
-          RID: ${{ matrix.rid }}
-          TARGET_CPU: ${{ matrix.target_cpu }}
-          DEPOT_TOOLS_WIN_TOOLCHAIN: 0
-          GYP_MSVS_VERSION: 17.0
-        run: .\scripts\build-windows-static-graphics.ps1 all
-
-      - name: Upload Windows static archives
-        uses: actions/upload-artifact@v4
-        with:
-          name: native-static-${{ matrix.rid }}
-          path: External/NativeStatic/${{ matrix.rid }}/*
-          if-no-files-found: error
+    uses: ./.github/workflows/static-graphics-zig-cross.yml
+    with:
+      skiasharp_version: ${{ inputs.skiasharp_version }}
+      source_lock: ${{ inputs.source_lock || '' }}
+      rids: '["win-x64","win-x86","win-arm64"]'

.github/workflows/static-graphics-zig-cross.yml

@@ -0,0 +1,111 @@
+name: static-graphics-zig-cross-debian12
+
+# All native archives are compiled with Zig on Linux; platform runners validate consumer apps.
+on:
+  workflow_call:
+    inputs:
+      skiasharp_version:
+        type: string
+        required: true
+      toolchain_image:
+        type: string
+        default: ''
+      rids:
+        type: string
+        default: '["linux-x64","linux-arm64","linux-musl-x64","linux-musl-arm64","win-x64","win-x86","win-arm64","osx-x64","osx-arm64"]'
+      artifact_prefix:
+        type: string
+        default: native-static
+      source_lock:
+        type: string
+        required: true
+  workflow_dispatch:
+    inputs:
+      skiasharp_version:
+        description: Locked SkiaSharp release profile
+        type: string
+        default: '4.150.1'
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  image:
+    if: ${{ inputs.toolchain_image == '' }}
+    uses: ./.github/workflows/zig-toolchain-image.yml
+
+  build:
+    needs: image
+    if: ${{ always() && (needs.image.result == 'success' || inputs.toolchain_image != '') }}
+    permissions:
+      contents: read
+      packages: read
+    env:
+      TOOLCHAIN_IMAGE: ${{ inputs.toolchain_image || needs.image.outputs.image }}
+    timeout-minutes: 180
+    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        rid: ${{ fromJSON(inputs.rids || '["linux-x64","linux-arm64","linux-musl-x64","linux-musl-arm64","win-x64","win-x86","win-arm64","osx-x64","osx-arm64"]') }}
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - name: Resolve immutable build inputs
+        env:
+          SOURCE_LOCK_JSON: ${{ inputs.source_lock }}
+          REQUESTED_VERSION: ${{ inputs.skiasharp_version }}
+        run: |
+          if [ -n "$SOURCE_LOCK_JSON" ]; then
+            python3 - <<'PY'
+          import json, os, pathlib
+          lock = json.loads(os.environ['SOURCE_LOCK_JSON'])
+          if lock['skiasharp_version'] != os.environ['REQUESTED_VERSION']:
+              raise SystemExit('Source lock does not match requested version')
+          pathlib.Path('build/linux-toolchain/release.lock.json').write_text(json.dumps(lock, indent=2) + '\n')
+          PY
+          else
+            python3 scripts/resolve-release-lock.py --version "$REQUESTED_VERSION"
+          fi
+      - name: Restore exact target cache
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        with:
+          path: External/NativeStatic/.work
+          key: zig-debian12-v3-${{ inputs.skiasharp_version }}-${{ matrix.rid }}-${{ hashFiles('build/linux-toolchain/**', 'scripts/prepare-cross-sources.sh', 'scripts/build-linux-static-graphics.sh', 'External/NativeStatic/patches/*.patch') }}
+      - name: Pull immutable toolchain image
+        env:
+          GH_TOKEN: ${{ github.token }}
+          ACTOR: ${{ github.actor }}
+        run: |
+          printf '%s' "$GH_TOKEN" | docker login ghcr.io -u "$ACTOR" --password-stdin
+          docker pull "$TOOLCHAIN_IMAGE"
+      - name: Prepare locked sources and build native libraries
+        env:
+          CROSS_RID: ${{ matrix.rid }}
+          SKIASHARP_PROFILE: ${{ inputs.skiasharp_version }}
+        run: |
+          mkdir -p External/NativeStatic/.work/home
+          docker run --rm --user "$(id -u):$(id -g)" \
+            -e HOME=/src/External/NativeStatic/.work/home -e CROSS_RID -e SKIASHARP_PROFILE \
+            -e CCACHE_DIR=/src/External/NativeStatic/.work/ccache -e CCACHE_MAXSIZE=1G \
+            -e ZIG_GLOBAL_CACHE_DIR=/src/External/NativeStatic/.work/zig-global \
+            -v "$PWD:/src" -w /src --entrypoint bash "$TOOLCHAIN_IMAGE" -c '
+              set -euo pipefail
+              export SOURCE_LOCK="/src/build/linux-toolchain/release.lock.json"
+              source scripts/prepare-cross-sources.sh
+              python3 build/linux-toolchain/build-cross.py \
+                --target "$CROSS_RID" \
+                --sources-manifest "$WORK_DIR/cross-sources.json" \
+                --work /src/External/NativeStatic/.work/toolchains \
+                --output "/src/External/NativeStatic/zig-cross/$SKIASHARP_PROFILE/$CROSS_RID" --jobs 4
+              python3 build/linux-toolchain/package-zig.py \
+                --rid "$CROSS_RID" \
+                --input "/src/External/NativeStatic/zig-cross/$SKIASHARP_PROFILE/$CROSS_RID" \
+                --output "/src/External/NativeStatic/$CROSS_RID/native"
+            '
+      - name: Upload archives, link tests and input manifest
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: ${{ inputs.artifact_prefix || 'native-static' }}-${{ matrix.rid }}
+          path: External/NativeStatic/${{ matrix.rid }}/**
+          if-no-files-found: error

.github/workflows/zig-recent-regression.yml

@@ -0,0 +1,55 @@
+name: zig-recent-release-regression
+
+on:
+  workflow_dispatch:
+    inputs:
+      versions:
+        description: JSON array of stable SkiaSharp versions from this branch major
+        type: string
+        default: '["4.150.3","4.150.5","4.153.1"]'
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  resolve:
+    runs-on: ubuntu-24.04
+    outputs:
+      releases: ${{ steps.locks.outputs.releases }}
+    steps:
+      - uses: actions/checkout@v4
+      - id: locks
+        env:
+          VERSIONS: ${{ inputs.versions }}
+        run: |
+          python3 - <<'PY'
+          import json, os, pathlib, subprocess
+          versions = json.loads(os.environ['VERSIONS'])
+          if not isinstance(versions, list) or not 1 <= len(versions) <= 5:
+              raise SystemExit('Expected one to five stable versions')
+          releases = []
+          for version in versions:
+              subprocess.run(['python3', 'scripts/resolve-release-lock.py', '--version', version], check=True)
+              lock = json.loads(pathlib.Path('build/linux-toolchain/release.lock.json').read_text())
+              releases.append({'version': version, 'lock': json.dumps(lock)})
+          with open(os.environ['GITHUB_OUTPUT'], 'a') as output:
+              output.write('releases=' + json.dumps(releases, separators=(',', ':')) + '\n')
+          PY
+
+  toolchain:
+    needs: resolve
+    uses: ./.github/workflows/zig-toolchain-image.yml
+
+  build:
+    needs: [resolve, toolchain]
+    strategy:
+      fail-fast: false
+      matrix:
+        release: ${{ fromJSON(needs.resolve.outputs.releases) }}
+    uses: ./.github/workflows/static-graphics-zig-cross.yml
+    with:
+      skiasharp_version: ${{ matrix.release.version }}
+      source_lock: ${{ matrix.release.lock }}
+      toolchain_image: ${{ needs.toolchain.outputs.image }}
+      artifact_prefix: regression-${{ matrix.release.version }}

.github/workflows/zig-toolchain-image.yml

@@ -0,0 +1,57 @@
+name: pinned-zig-toolchain-image
+
+on:
+  workflow_call:
+    outputs:
+      image:
+        description: Immutable Debian 12 Zig toolchain image reference
+        value: ${{ jobs.image.outputs.image }}
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  image:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    outputs:
+      image: ${{ steps.publish.outputs.image }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Publish or reuse exact toolchain image
+        id: publish
+        env:
+          GH_TOKEN: ${{ github.token }}
+          ACTOR: ${{ github.actor }}
+          REPOSITORY: ${{ github.repository }}
+          BASE_HASH: ${{ hashFiles('build/linux-toolchain/Dockerfile') }}
+          RECIPE_HASH: ${{ hashFiles('build/linux-toolchain/Dockerfile*', 'build/linux-toolchain/*.py', 'build/linux-toolchain/*.c', 'build/linux-toolchain/*.gn.in', 'build/linux-toolchain/*lock.json', 'build/linux-toolchain/versions/*.json', 'build/linux-toolchain/patches/**') }}
+        run: |
+          set -euo pipefail
+          printf '%s' "$GH_TOKEN" | docker login ghcr.io -u "$ACTOR" --password-stdin
+          repository="ghcr.io/${REPOSITORY,,}-zig"
+          image="$repository:recipe-$RECIPE_HASH"
+          base="$repository:debian12-$BASE_HASH"
+          if ! docker pull "$image"; then
+            if ! docker pull "$base"; then
+              docker build --platform linux/amd64 \
+                --label "org.opencontainers.image.source=https://github.com/$REPOSITORY" \
+                -t "$base" build/linux-toolchain
+              docker push "$base"
+              docker pull "$base"
+            fi
+            base_digest="$(docker image inspect --format '{{index .RepoDigests 0}}' "$base")"
+            docker build --platform linux/amd64 \
+              --build-arg "TOOLCHAIN_IMAGE=$base_digest" \
+              --label "org.opencontainers.image.source=https://github.com/$REPOSITORY" \
+              -f build/linux-toolchain/Dockerfile.cross-probe \
+              -t "$image" build/linux-toolchain
+            docker push "$image"
+            docker pull "$image"
+          fi
+          digest="$(docker image inspect --format '{{index .RepoDigests 0}}' "$image")"
+          case "$digest" in "$repository"@sha256:*) ;; *) echo 'No immutable image digest' >&2; exit 1 ;; esac
+          echo "image=$digest" >> "$GITHUB_OUTPUT"
+          echo "Toolchain: $digest" >> "$GITHUB_STEP_SUMMARY"