Isolate manual artifact validation without package publication

.github/workflows/static-graphics-preflight.yml

@@ -2,7 +2,13 @@ name: static-graphics-preflight
 
 on:
   workflow_call:
+    inputs:
+      skiasharp_version:
+        type: string
+        default: ''
     outputs:
+      source_lock:
+        value: ${{ jobs.validate.outputs.source_lock }}
       package_version:
         value: ${{ jobs.validate.outputs.package_version }}
       skiasharp_version:
@@ -15,6 +21,7 @@ jobs:
   validate:
     runs-on: ubuntu-24.04
     outputs:
+      source_lock: ${{ steps.versions.outputs.source_lock }}
       package_version: ${{ steps.versions.outputs.package_version }}
       skiasharp_version: ${{ steps.versions.outputs.skiasharp_version }}
       angle_branch: ${{ steps.versions.outputs.angle_branch }}
@@ -29,7 +36,14 @@ jobs:
       - name: Read and validate versions
         id: versions
         shell: bash
+        env:
+          REQUESTED_VERSION: ${{ inputs.skiasharp_version }}
         run: |
+          if [ "${GITHUB_REF_TYPE:-}" = tag ] && [ -z "$REQUESTED_VERSION" ]; then
+            tag_version="${GITHUB_REF_NAME#staticlink-avalonia-v}"
+            REQUESTED_VERSION="${tag_version%%-*}"
+          fi
+          python3 scripts/resolve-release-lock.py --version "$REQUESTED_VERSION"
           python3 - <<'PY'
           import os
           import pathlib
@@ -37,7 +51,10 @@ jobs:
 
           project = pathlib.Path("NuGet/StaticGraphics/StaticLink.Avalonia.csproj")
           root = ET.parse(project).getroot()
+          import json
+          lock = json.loads(pathlib.Path("build/linux-toolchain/release.lock.json").read_text())
           package_version = root.findtext(".//Version")
+          package_version = lock["skiasharp_version"] + "-" + package_version.split("-", 1)[1]
           skia_reference = next(
               item.attrib["Version"]
               for item in root.findall(".//PackageReference")
@@ -45,7 +62,7 @@ jobs:
           )
           version_base, revision = package_version.rsplit(".", 1)
           skiasharp_version, angle_branch = version_base.split("-", 1)
-          if not revision.isdigit() or skiasharp_version != skia_reference:
+          if not revision.isdigit() or skiasharp_version != lock["skiasharp_version"]:
               raise SystemExit(f"Inconsistent package version: {package_version}, SkiaSharp: {skia_reference}")
           if os.environ.get("GITHUB_REF_TYPE") == "tag":
               expected_tag = f"staticlink-avalonia-v{package_version}"
@@ -53,6 +70,7 @@ jobs:
                   raise SystemExit(f"Release tag must be {expected_tag}")
 
           with open(os.environ["GITHUB_OUTPUT"], "a", encoding="utf-8") as output:
+              output.write("source_lock=" + json.dumps(lock, separators=(",", ":")) + "\n")
               output.write(f"package_version={package_version}\n")
               output.write(f"skiasharp_version={skiasharp_version}\n")
               output.write(f"angle_branch={angle_branch}\n")
@@ -65,7 +83,7 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          git ls-remote --exit-code --heads https://github.com/mono/SkiaSharp.git "refs/heads/release/${SKIASHARP_VERSION}"
+          git ls-remote --exit-code --tags https://github.com/mono/SkiaSharp.git "refs/tags/v${SKIASHARP_VERSION}"
           git clone --depth 1 --branch "chromium/${ANGLE_BRANCH}" https://github.com/google/angle.git /tmp/staticlink-angle
           git -C /tmp/staticlink-angle apply --check "$GITHUB_WORKSPACE/External/NativeStatic/patches/angle-chromium-${ANGLE_BRANCH}.patch"