Fix Native linker tools, macOS-only validation and package metadata

.github/workflows/nuget-avalonia-native.yml

@@ -0,0 +1,349 @@
+name: staticlink-avalonia-native
+
+on:
+  workflow_call:
+    inputs:
+      avalonia_version:
+        type: string
+        default: ''
+      force_build:
+        type: boolean
+        default: false
+      publish_to_nuget:
+        type: boolean
+        default: false
+  workflow_dispatch:
+    inputs:
+      avalonia_version:
+        description: Avalonia version to build; empty checks the latest stable 11.x and 12.x versions
+        required: false
+        type: string
+      force_build:
+        description: Build even when this StaticLink.Avalonia.Native version already exists
+        required: true
+        default: false
+        type: boolean
+      publish_to_nuget:
+        description: Publish with NuGet Trusted Publishing after smoke tests
+        required: true
+        default: false
+        type: boolean
+
+jobs:
+  detect:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    outputs:
+      versions: ${{ steps.version.outputs.versions }}
+      should_build: ${{ steps.version.outputs.should_build }}
+    steps:
+      - name: Detect unpublished Avalonia version
+        id: version
+        shell: bash
+        env:
+          REQUESTED_VERSION: ${{ inputs.avalonia_version }}
+          FORCE_BUILD: ${{ inputs.force_build }}
+        run: |
+          set -euo pipefail
+
+          if [ -n "$REQUESTED_VERSION" ]; then
+            candidate_versions=("$REQUESTED_VERSION")
+          else
+            nuget_versions="$(curl --fail --silent --show-error --location \
+              https://api.nuget.org/v3-flatcontainer/avalonia/index.json)"
+            candidate_versions=()
+            for major in 11 12; do
+              candidate_versions+=("$(jq -r --arg major "$major" \
+                '[.versions[] | select(startswith($major + ".") and (contains("-") | not))] | last' \
+                <<< "$nuget_versions")")
+            done
+          fi
+
+          versions='[]'
+          for avalonia_version in "${candidate_versions[@]}"; do
+            if [ -z "$avalonia_version" ] || [ "$avalonia_version" = "null" ]; then
+              echo "Could not determine a stable Avalonia version." >&2
+              exit 1
+            fi
+
+            package_version="$avalonia_version.2"
+            package_url="https://api.nuget.org/v3-flatcontainer/staticlink.avalonia.native/$package_version/staticlink.avalonia.native.$package_version.nupkg"
+            status=$(curl --retry 3 --silent --show-error --location --output /dev/null --write-out '%{http_code}' "$package_url")
+            if [ "$status" != 200 ] && [ "$status" != 404 ]; then
+              echo "NuGet availability check failed: HTTP $status" >&2
+              exit 1
+            fi
+            if [ "$FORCE_BUILD" != "true" ] && [ "$status" = 200 ]; then
+              echo "Already published: $package_version"
+              continue
+            fi
+
+            echo "Build required: $package_version"
+            versions="$(jq -cn --argjson versions "$versions" \
+              --arg avalonia_version "$avalonia_version" \
+              --arg package_version "$package_version" \
+              '$versions + [{avalonia_version: $avalonia_version, package_version: $package_version}]')"
+          done
+
+          echo "versions=$versions" >> "$GITHUB_OUTPUT"
+          if [ "$versions" = '[]' ]; then
+            echo 'should_build=false' >> "$GITHUB_OUTPUT"
+          else
+            echo 'should_build=true' >> "$GITHUB_OUTPUT"
+          fi
+
+  toolchain:
+    needs: detect
+    if: ${{ needs.detect.outputs.should_build == 'true' }}
+    permissions:
+      contents: read
+      packages: write
+    uses: ./.github/workflows/zig-toolchain-image.yml
+    with:
+      validation_rids: '["osx-x64","osx-arm64"]'
+
+  build:
+    needs: [detect, toolchain]
+    if: ${{ needs.detect.outputs.should_build == 'true' }}
+    strategy:
+      fail-fast: false
+      matrix:
+        version: ${{ fromJSON(needs.detect.outputs.versions) }}
+        rid: [osx-x64, osx-arm64]
+        include:
+          - rid: osx-x64
+            runner: macos-14
+          - rid: osx-arm64
+            runner: macos-15
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      packages: read
+    env:
+      TOOLCHAIN_IMAGE: ${{ needs.toolchain.outputs.image }}
+      RID: ${{ matrix.rid }}
+      AVALONIA_VERSION: ${{ matrix.version.avalonia_version }}
+      WORK_DIR: ${{ github.workspace }}/External/AvaloniaNative/.work
+      OUTPUT_DIR: ${{ github.workspace }}/External/AvaloniaNative/${{ matrix.rid }}/native
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Pull immutable toolchain image
+        env:
+          GH_TOKEN: ${{ github.token }}
+          ACTOR: ${{ github.actor }}
+        run: |
+          printf '%s' "$GH_TOKEN" | docker login ghcr.io -u "$ACTOR" --password-stdin
+          docker pull "$TOOLCHAIN_IMAGE"
+
+      - name: Build static AvaloniaNative and font preinit with Zig
+        run: |
+          mkdir -p "$WORK_DIR" "$OUTPUT_DIR"
+          docker run --rm --user "$(id -u):$(id -g)" \
+            -e HOME=/tmp/staticlink-home -e RID -e AVALONIA_VERSION \
+            -v "$PWD:/src" -w /src --entrypoint bash "$TOOLCHAIN_IMAGE" \
+            scripts/build-avalonia-native-container.sh
+
+      - name: Upload static AvaloniaNative
+        uses: actions/upload-artifact@v4
+        with:
+          name: native-avalonia-${{ matrix.version.avalonia_version }}-${{ matrix.rid }}
+          path: |
+            External/AvaloniaNative/${{ matrix.rid }}/native/libAvaloniaNative.a
+            External/AvaloniaNative/${{ matrix.rid }}/native/macos_font_preinit.o
+            External/AvaloniaNative/${{ matrix.rid }}/native/avalonia-native-build.json
+          if-no-files-found: error
+
+  pack:
+    needs:
+      - detect
+      - build
+    if: ${{ needs.detect.outputs.should_build == 'true' }}
+    strategy:
+      matrix:
+        version: ${{ fromJSON(needs.detect.outputs.versions) }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: "10.0.x"
+
+      - name: Download static AvaloniaNative archives
+        uses: actions/download-artifact@v4
+        with:
+          pattern: native-avalonia-${{ matrix.version.avalonia_version }}-*
+          path: artifacts/native
+          merge-multiple: false
+
+      - name: Prepare package inputs
+        shell: bash
+        run: |
+          set -euo pipefail
+          for rid in osx-x64 osx-arm64; do
+            mkdir -p "External/AvaloniaNative/$rid/native"
+            cp "artifacts/native/native-avalonia-${{ matrix.version.avalonia_version }}-$rid/libAvaloniaNative.a" "External/AvaloniaNative/$rid/native/"
+            cp "artifacts/native/native-avalonia-${{ matrix.version.avalonia_version }}-$rid/macos_font_preinit.o" "External/AvaloniaNative/$rid/native/"
+            cp "artifacts/native/native-avalonia-${{ matrix.version.avalonia_version }}-$rid/avalonia-native-build.json" "External/AvaloniaNative/$rid/native/"
+          done
+
+      - name: Pack StaticLink.Avalonia.Native
+        run: |
+          dotnet pack NuGet/AvaloniaNative/StaticLink.Avalonia.Native.csproj \
+            -c Release \
+            -o artifacts/nuget \
+            /p:PackageVersion=${{ matrix.version.package_version }} \
+            /p:Version=${{ matrix.version.package_version }}
+
+      - name: Upload NuGet package
+        uses: actions/upload-artifact@v4
+        with:
+          name: staticlink-avalonia-native-${{ matrix.version.package_version }}
+          path: artifacts/nuget/*.nupkg
+          if-no-files-found: error
+
+  smoke:
+    needs:
+      - detect
+      - pack
+    if: ${{ needs.detect.outputs.should_build == 'true' }}
+    strategy:
+      fail-fast: false
+      matrix:
+        version: ${{ fromJSON(needs.detect.outputs.versions) }}
+        rid: [osx-x64, osx-arm64]
+        include:
+          - rid: osx-x64
+            runner: macos-14
+          - rid: osx-arm64
+            runner: macos-15
+    runs-on: ${{ matrix.runner }}
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: "10.0.x"
+
+      - name: Download NuGet package
+        uses: actions/download-artifact@v4
+        with:
+          name: staticlink-avalonia-native-${{ matrix.version.package_version }}
+          path: artifacts/nuget
+
+      - name: Publish Avalonia NativeAOT smoke app
+        shell: pwsh
+        run: |
+          $projectDir = Join-Path $PWD "artifacts/avalonia-native-smoke-src"
+          pwsh ./scripts/create-avalonia-smoke.ps1 `
+            -ProjectDir $projectDir `
+            -NuGetSource (Resolve-Path "artifacts/nuget") `
+            -AvaloniaVersion "${{ matrix.version.avalonia_version }}" `
+            -StaticLinkNativeVersion "${{ matrix.version.package_version }}"
+          dotnet publish (Join-Path $projectDir "AvaloniaStaticLinkSmoke.csproj") `
+            -c Release `
+            -r "${{ matrix.rid }}" `
+            --configfile (Join-Path $projectDir "NuGet.config") `
+            /p:PublishDir="$PWD/artifacts/smoke-${{ matrix.rid }}/"
+
+      - name: Verify AvaloniaNative is statically linked
+        shell: bash
+        run: |
+          set -euo pipefail
+          test ! -f "artifacts/smoke-${{ matrix.rid }}/libAvaloniaNative.dylib"
+          test -x "artifacts/smoke-${{ matrix.rid }}/AvaloniaStaticLinkSmoke"
+
+      - name: Run Avalonia smoke app
+        shell: bash
+        run: |
+          set -euo pipefail
+          cd "artifacts/smoke-${{ matrix.rid }}"
+          python3 - <<'PY'
+          import subprocess
+          import sys
+
+          proc = subprocess.Popen(
+              ["./AvaloniaStaticLinkSmoke"],
+              stdout=subprocess.PIPE,
+              stderr=subprocess.STDOUT,
+              text=True,
+          )
+          try:
+              output, _ = proc.communicate(timeout=15)
+          except subprocess.TimeoutExpired:
+              proc.kill()
+              output, _ = proc.communicate()
+              print(output or "")
+              print("Avalonia smoke app stayed alive for 15 seconds.")
+              sys.exit(0)
+
+          print(output or "")
+          if proc.returncode == 0:
+              sys.exit(0)
+          sys.exit(proc.returncode if proc.returncode > 0 else 1)
+          PY
+
+      - name: Upload AvaloniaNative smoke app
+        if: ${{ always() }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: avalonia-native-smoke-${{ matrix.version.avalonia_version }}-${{ matrix.rid }}
+          path: artifacts/smoke-${{ matrix.rid }}/**
+          if-no-files-found: warn
+
+  publish:
+    needs:
+      - detect
+      - smoke
+    if: ${{ needs.detect.outputs.should_build == 'true' && inputs.publish_to_nuget == true }}
+    strategy:
+      matrix:
+        version: ${{ fromJSON(needs.detect.outputs.versions) }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Download NuGet package
+        uses: actions/download-artifact@v4
+        with:
+          name: staticlink-avalonia-native-${{ matrix.version.package_version }}
+          path: artifacts/nuget
+
+      - uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: "10.0.302"
+
+      - name: Validate Trusted Publishing configuration
+        env:
+          NUGET_USER: ${{ vars.NUGET_USER }}
+          NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}
+        run: |
+          if [ -z "$NUGET_USER" ] && [ -z "$NUGET_API_KEY" ]; then
+            echo 'Configure NUGET_USER with Trusted Publishing or NUGET_API_KEY.' >&2
+            exit 1
+          fi
+
+      - name: NuGet login
+        if: ${{ vars.NUGET_USER != '' }}
+        id: login
+        uses: NuGet/login@v1
+        with:
+          user: ${{ vars.NUGET_USER }}
+
+      - name: Publish to nuget.org
+        env:
+          NUGET_API_KEY: ${{ steps.login.outputs.NUGET_API_KEY || secrets.NUGET_API_KEY }}
+        run: |
+          dotnet nuget push artifacts/nuget/*.nupkg \
+            --source https://www.nuget.org/api/v2/package \
+            --api-key "$NUGET_API_KEY" \
+            --skip-duplicate

.github/workflows/nuget-static-graphics-repack.yml

@@ -1,106 +0,0 @@
-name: staticlink-avalonia-repack
-
-on:
-  workflow_dispatch:
-    inputs:
-      source_version:
-        description: Existing package version containing the static libraries
-        required: true
-        default: 3.119.4-7922.1
-        type: string
-      publish_to_nuget:
-        description: Publish package to nuget.org
-        required: true
-        default: false
-        type: boolean
-
-jobs:
-  repack:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Setup .NET
-        uses: actions/setup-dotnet@v4
-        with:
-          dotnet-version: "10.0.x"
-
-      - name: Extract static libraries from existing package
-        env:
-          SOURCE_VERSION: ${{ inputs.source_version }}
-        run: |
-          python3 - <<'PY'
-          import os
-          import pathlib
-          import urllib.request
-          import zipfile
-
-          version = os.environ["SOURCE_VERSION"]
-          package = pathlib.Path("artifacts/source.nupkg")
-          package.parent.mkdir(parents=True, exist_ok=True)
-          urllib.request.urlretrieve(
-              f"https://api.nuget.org/v3-flatcontainer/staticlink.avalonia/{version}/staticlink.avalonia.{version}.nupkg",
-              package,
-          )
-
-          output = pathlib.Path("External/NativeStatic")
-          with zipfile.ZipFile(package) as archive:
-              for entry in archive.infolist():
-                  name = entry.filename.replace("\\", "/")
-                  if not name.startswith("static/") or name.endswith("/"):
-                      continue
-                  destination = output / name.removeprefix("static/")
-                  destination.parent.mkdir(parents=True, exist_ok=True)
-                  destination.write_bytes(archive.read(entry))
-          PY
-
-      - name: Verify static archives
-        run: |
-          for rid in linux-x64 linux-arm64 linux-musl-x64 linux-musl-arm64 osx-x64 osx-arm64; do
-            test -f External/NativeStatic/$rid/native/libskia.a
-            test -f External/NativeStatic/$rid/native/libSkiaSharp.a
-            test -f External/NativeStatic/$rid/native/libHarfBuzzSharp.a
-            test -f External/NativeStatic/$rid/native/libANGLE_static.a
-            test -f External/NativeStatic/$rid/native/libGLESv2_static.a
-          done
-
-          for rid in win-x64 win-x86 win-arm64; do
-            test -f External/NativeStatic/$rid/native/skia.lib
-            test -f External/NativeStatic/$rid/native/SkiaSharp.lib
-            test -f External/NativeStatic/$rid/native/libHarfBuzzSharp.lib
-            test -f External/NativeStatic/$rid/native/libANGLE_static.lib
-            test -f External/NativeStatic/$rid/native/libGLESv2_static.lib
-          done
-          test -f External/NativeStatic/win-x86/native/skia_x86_stdcall_thunks.lib
-
-      - name: Pack NuGet package
-        run: dotnet pack NuGet/StaticGraphics/StaticLink.Avalonia.csproj -c Release -o artifacts/nuget
-
-      - name: Verify portable NuGet paths
-        run: |
-          package=$(find artifacts/nuget -name 'StaticLink.Avalonia.*.nupkg' ! -name 'StaticLink.Avalonia.Native.*.nupkg' -print -quit)
-          test -n "$package"
-          if unzip -Z1 "$package" | grep -F '\'; then
-            echo "NuGet package contains Windows-only backslash paths."
-            exit 1
-          fi
-          unzip -Z1 "$package" | grep -Fx 'buildTransitive/StaticLink.Avalonia.props'
-          unzip -Z1 "$package" | grep -Fx 'buildTransitive/StaticLink.Avalonia.targets'
-
-      - name: Upload NuGet artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: staticlink-avalonia-repacked-nuget
-          path: artifacts/nuget/*.nupkg
-          if-no-files-found: error
-
-      - name: Publish to nuget.org
-        if: ${{ inputs.publish_to_nuget == true }}
-        env:
-          NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}
-        run: |
-          test -n "$NUGET_API_KEY"
-          dotnet nuget push artifacts/nuget/*.nupkg \
-            --source "https://api.nuget.org/v3/index.json" \
-            --api-key "$NUGET_API_KEY" \
-            --skip-duplicate

.github/workflows/nuget-static-graphics.yml

@@ -1,598 +0,0 @@
-name: staticlink-avalonia
-
-on:
-  workflow_dispatch:
-    inputs:
-      environment_only:
-        description: Validate the complete toolchain container without building release libraries
-        type: boolean
-        default: false
-      skiasharp_version:
-        description: Stable SkiaSharp version from this branch major; empty uses the branch version
-        type: string
-        default: ''
-      native_package_revision:
-        description: Published AvaloniaNative revision for independent graphics smoke tests
-        type: string
-        default: '1'
-      publish_to_nuget:
-        description: Publish package to nuget.org
-        required: true
-        default: false
-        type: boolean
-      publish_to_release:
-        description: Publish NuGet package and smoke apps to GitHub Release
-        required: true
-        default: false
-        type: boolean
-  push:
-    tags:
-      - "staticlink-avalonia-v*"
-
-env:
-  DOTNET_ALPINE_IMAGE: mcr.microsoft.com/dotnet/sdk:10.0.302-alpine3.23
-
-concurrency:
-  group: graphics-${{ github.ref }}-${{ inputs.skiasharp_version }}
-  cancel-in-progress: false
-
-jobs:
-  environment:
-    permissions:
-      contents: read
-      packages: write
-    uses: ./.github/workflows/zig-toolchain-image.yml
-
-  preflight:
-    if: ${{ inputs.environment_only != true }}
-    uses: ./.github/workflows/static-graphics-preflight.yml
-    with:
-      skiasharp_version: ${{ inputs.skiasharp_version }}
-
-  build-zig:
-    permissions:
-      contents: read
-      packages: write
-    needs: [preflight, environment]
-    uses: ./.github/workflows/static-graphics-zig-cross.yml
-    with:
-      skiasharp_version: ${{ needs.preflight.outputs.skiasharp_version }}
-      source_lock: ${{ needs.preflight.outputs.source_lock }}
-      toolchain_image: ${{ needs.environment.outputs.image }}
-
-  pack:
-    runs-on: ubuntu-24.04
-    needs:
-      - preflight
-      - build-zig
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Setup .NET
-        uses: actions/setup-dotnet@v4
-        with:
-          dotnet-version: "10.0.302"
-
-      - name: Download static archives
-        uses: actions/download-artifact@v4
-        with:
-          pattern: native-static-*
-          path: External/NativeStatic
-          merge-multiple: false
-
-      - name: Move static archives into RID directories
-        run: |
-          for rid in win-x64 win-x86 win-arm64 linux-x64 linux-arm64 linux-musl-x64 linux-musl-arm64 osx-x64 osx-arm64; do
-            mkdir -p "External/NativeStatic/$rid"
-            mv "External/NativeStatic/native-static-$rid"/* "External/NativeStatic/$rid/"
-            rmdir "External/NativeStatic/native-static-$rid"
-            if [ ! -d "External/NativeStatic/$rid/native" ]; then
-              mkdir -p "External/NativeStatic/$rid/native"
-              find "External/NativeStatic/$rid" -maxdepth 1 -type f -exec mv {} "External/NativeStatic/$rid/native/" \;
-            fi
-          done
-
-      - name: Verify static archives
-        run: |
-          for rid in linux-x64 linux-arm64 linux-musl-x64 linux-musl-arm64 osx-x64 osx-arm64; do
-            test -f External/NativeStatic/$rid/native/libskia.a
-            test -f External/NativeStatic/$rid/native/libSkiaSharp.a
-            test -f External/NativeStatic/$rid/native/libHarfBuzzSharp.a
-            test -f External/NativeStatic/$rid/native/libANGLE_static.a
-            test -f External/NativeStatic/$rid/native/libGLESv2_static.a
-          done
-
-          for rid in win-x64 win-x86 win-arm64; do
-            test -f External/NativeStatic/$rid/native/skia.lib
-            test -f External/NativeStatic/$rid/native/SkiaSharp.lib
-            test -f External/NativeStatic/$rid/native/libHarfBuzzSharp.lib
-            test -f External/NativeStatic/$rid/native/libANGLE_static.lib
-            test -f External/NativeStatic/$rid/native/libGLESv2_static.lib
-          done
-          test -f External/NativeStatic/win-x86/native/skia_x86_stdcall_thunks.lib
-
-      - name: Pack NuGet package
-        env:
-          SOURCE_LOCK_JSON: ${{ needs.preflight.outputs.source_lock }}
-          PACKAGE_VERSION: ${{ needs.preflight.outputs.package_version }}
-          SKIASHARP_VERSION: ${{ needs.preflight.outputs.skiasharp_version }}
-        run: |
-          python3 scripts/apply-release-version.py
-          dotnet pack NuGet/StaticGraphics/StaticLink.Avalonia.csproj -c Release -o artifacts/nuget
-
-      - name: Verify portable NuGet paths
-        shell: bash
-        run: |
-          package=$(find artifacts/nuget -name 'StaticLink.Avalonia.*.nupkg' ! -name 'StaticLink.Avalonia.Native.*.nupkg' -print -quit)
-          test -n "$package"
-          if unzip -Z1 "$package" | grep -F '\'; then
-            echo "NuGet package contains Windows-only backslash paths."
-            exit 1
-          fi
-          unzip -Z1 "$package" | grep -Fx 'buildTransitive/StaticLink.Avalonia.props'
-          unzip -Z1 "$package" | grep -Fx 'buildTransitive/StaticLink.Avalonia.targets'
-
-      - name: Upload release source lock
-        uses: actions/upload-artifact@v4
-        with:
-          name: graphics-release-source-lock
-          path: build/linux-toolchain/release.lock.json
-          if-no-files-found: error
-
-      - name: Upload NuGet artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: staticlink-avalonia-nuget
-          path: |
-            artifacts/nuget/*.nupkg
-            artifacts/nuget/*.snupkg
-          if-no-files-found: error
-
-  smoke-avalonia:
-    needs: pack
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - rid: win-x64
-            runner: windows-2022
-            msvc_arch: x64
-          - rid: win-x86
-            runner: windows-2022
-            msvc_arch: x86
-          - rid: win-arm64
-            runner: windows-2022
-            msvc_arch: amd64_arm64
-          - rid: linux-x64
-            runner: ubuntu-24.04
-          - rid: linux-arm64
-            runner: ubuntu-24.04-arm
-          - rid: linux-musl-x64
-            runner: ubuntu-24.04
-          - rid: linux-musl-arm64
-            runner: ubuntu-24.04-arm
-          - rid: osx-x64
-            runner: macos-15
-            avalonia_version: 11.3.14
-          - rid: osx-arm64
-            runner: macos-15
-            avalonia_version: 11.3.14
-    runs-on: ${{ matrix.runner }}
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Setup MSVC environment
-        if: ${{ startsWith(matrix.rid, 'win-') }}
-        uses: ilammy/msvc-dev-cmd@v1
-        with:
-          arch: ${{ matrix.msvc_arch }}
-
-      - name: Install LLVM linker for Zig Windows archives
-        if: ${{ startsWith(matrix.rid, 'win-') }}
-        shell: pwsh
-        run: choco install llvm -y
-
-      - name: Install Linux publish dependencies
-        if: ${{ startsWith(matrix.rid, 'linux-') && !startsWith(matrix.rid, 'linux-musl-') }}
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y clang lld xvfb zlib1g-dev libfontconfig1-dev libffi-dev libwayland-dev libx11-dev libxext-dev libxcb1-dev libfreetype6 libgl1 libice6 libsm6 libx11-6 libxcb1 libxcursor1 libxext6 libxfixes3 libxinerama1 libxrandr2 libxrender1 libxi6
-
-      - name: Setup .NET
-        uses: actions/setup-dotnet@v4
-        with:
-          dotnet-version: "10.0.302"
-
-      - name: Download NuGet package
-        uses: actions/download-artifact@v4
-        with:
-          name: staticlink-avalonia-nuget
-          path: artifacts/nuget
-
-      - name: Publish Avalonia single-file smoke app
-        if: ${{ !startsWith(matrix.rid, 'linux-musl-') }}
-        shell: pwsh
-        run: |
-          $ErrorActionPreference = "Stop"
-          $package = Get-ChildItem -Path "artifacts/nuget" -Filter "StaticLink.Avalonia.*.nupkg" | Where-Object { $_.Name -notlike "StaticLink.Avalonia.Native.*" } | Select-Object -First 1
-          if (-not $package) { throw "StaticLink NuGet package was not downloaded." }
-          if ($package.BaseName -notmatch '^StaticLink\.Avalonia\.(.+)$') { throw "Unexpected package name: $($package.Name)" }
-          $version = $Matches[1]
-          $avaloniaVersion = "${{ matrix.avalonia_version }}"
-          if (-not $avaloniaVersion) { $avaloniaVersion = "11.3.14" }
-          $projectDir = Join-Path $PWD "artifacts/avalonia-smoke-src"
-          $nativeVersion = ""
-          if ("${{ matrix.rid }}".StartsWith("osx-")) { $nativeVersion = "$avaloniaVersion.${{ inputs.native_package_revision || '1' }}" }
-          pwsh ./scripts/create-avalonia-smoke.ps1 -ProjectDir $projectDir -NuGetSource (Resolve-Path "artifacts/nuget") -StaticLinkVersion $version -AvaloniaVersion $avaloniaVersion -StaticLinkNativeVersion $nativeVersion
-          dotnet publish (Join-Path $projectDir "AvaloniaStaticLinkSmoke.csproj") `
-            -c Release `
-            -r "${{ matrix.rid }}" `
-            --configfile (Join-Path $projectDir "NuGet.config") `
-            /p:PublishAot=true `
-            /p:SelfContained=true `
-            /p:PublishSingleFile=true `
-            /p:StripSymbols=true `
-            /p:PublishDir="$PWD/artifacts/smoke-${{ matrix.rid }}/"
-
-      - name: Publish Avalonia musl smoke app
-        if: ${{ startsWith(matrix.rid, 'linux-musl-') }}
-        shell: pwsh
-        run: |
-          $ErrorActionPreference = "Stop"
-          $package = Get-ChildItem -Path "artifacts/nuget" -Filter "StaticLink.Avalonia.*.nupkg" | Where-Object { $_.Name -notlike "StaticLink.Avalonia.Native.*" } | Select-Object -First 1
-          if (-not $package) { throw "StaticLink NuGet package was not downloaded." }
-          if ($package.BaseName -notmatch '^StaticLink\.Avalonia\.(.+)$') { throw "Unexpected package name: $($package.Name)" }
-          $version = $Matches[1]
-          $projectDir = Join-Path $PWD "artifacts/avalonia-smoke-src"
-          pwsh ./scripts/create-avalonia-smoke.ps1 -ProjectDir $projectDir -NuGetSource "/workspace/artifacts/nuget" -StaticLinkVersion $version -AvaloniaVersion "11.3.14"
-          docker run --rm `
-            -v "${{ github.workspace }}:/workspace" `
-            -w /workspace `
-            "${{ env.DOTNET_ALPINE_IMAGE }}" `
-            sh -c "apk add --no-cache clang lld build-base zlib-dev fontconfig-dev libffi-dev wayland-dev libx11-dev libxext-dev libxcb-dev && dotnet publish /workspace/artifacts/avalonia-smoke-src/AvaloniaStaticLinkSmoke.csproj -c Release -r ${{ matrix.rid }} --configfile /workspace/artifacts/avalonia-smoke-src/NuGet.config /p:PublishAot=true /p:SelfContained=true /p:PublishSingleFile=true /p:StripSymbols=true /p:PublishDir=/workspace/artifacts/smoke-${{ matrix.rid }}/"
-
-      - name: Verify no dynamic graphics libraries remain
-        shell: pwsh
-        run: |
-          $publishDir = "artifacts/smoke-${{ matrix.rid }}"
-          $blocked = Get-ChildItem -Path $publishDir -Recurse -File | Where-Object {
-            $_.Name -in @("libSkiaSharp.dll", "libHarfBuzzSharp.dll", "av_libglesv2.dll", "libSkiaSharp.so", "libHarfBuzzSharp.so", "libSkiaSharp.dylib", "libHarfBuzzSharp.dylib")
-          }
-          if ($blocked) {
-            $blocked | ForEach-Object { Write-Error "Unexpected dynamic graphics library: $($_.FullName)" }
-            exit 1
-          }
-          Get-ChildItem -Path $publishDir -Recurse -File | ForEach-Object { $_.FullName }
-
-      - name: Verify Windows executable architecture
-        if: ${{ startsWith(matrix.rid, 'win-') }}
-        shell: pwsh
-        run: |
-          $ErrorActionPreference = "Stop"
-          $app = Join-Path $PWD "artifacts/smoke-${{ matrix.rid }}/AvaloniaStaticLinkSmoke.exe"
-          $expectedMachine = @{
-            "win-x64" = "8664 machine"
-            "win-x86" = "14C machine"
-            "win-arm64" = "AA64 machine"
-          }["${{ matrix.rid }}"]
-          $headers = & dumpbin /headers $app | Out-String
-          if ($LASTEXITCODE -ne 0 -or $headers -notmatch [regex]::Escape($expectedMachine)) {
-            throw "Expected $expectedMachine in PE headers for $app.`n$headers"
-          }
-
-      - name: Run Windows Avalonia smoke app
-        if: ${{ matrix.rid == 'win-x64' || matrix.rid == 'win-x86' }}
-        shell: pwsh
-        run: |
-          $ErrorActionPreference = "Stop"
-          $publishDir = Join-Path $PWD "artifacts/smoke-${{ matrix.rid }}"
-          $app = Join-Path $publishDir "AvaloniaStaticLinkSmoke.exe"
-          $process = Start-Process -FilePath $app -WorkingDirectory $publishDir -PassThru
-          if ($process.WaitForExit(15000)) {
-            if ($process.ExitCode -eq 0) {
-              Write-Host "Avalonia Windows smoke app exited normally."
-              exit 0
-            }
-            throw "Avalonia Windows smoke app failed with exit code $($process.ExitCode)."
-          }
-
-          Stop-Process -Id $process.Id -Force
-          Write-Host "Avalonia Windows smoke app stayed alive for 15 seconds."
-
-      - name: Run Linux Avalonia smoke app
-        if: ${{ startsWith(matrix.rid, 'linux-') && !startsWith(matrix.rid, 'linux-musl-') }}
-        shell: bash
-        run: |
-          set +e
-          cd "artifacts/smoke-${{ matrix.rid }}"
-          chmod +x ./AvaloniaStaticLinkSmoke
-          timeout 15s xvfb-run -a ./AvaloniaStaticLinkSmoke
-          code=$?
-          if [ "$code" = 124 ] || [ "$code" = 143 ]; then
-            echo "Avalonia Linux smoke app stayed alive for 15 seconds."
-            exit 0
-          fi
-          exit "$code"
-
-      - name: Verify musl ELF dependencies
-        if: ${{ startsWith(matrix.rid, 'linux-musl-') }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          docker run --rm \
-            -v "${{ github.workspace }}:/workspace" \
-            -w /workspace \
-            alpine:3.23 \
-            sh -c 'apk add --no-cache binutils pax-utils && app="artifacts/smoke-${{ matrix.rid }}/AvaloniaStaticLinkSmoke" && readelf -l "$app" | grep "Requesting program interpreter: /lib/ld-musl-" && scanelf -n "$app" && ! scanelf -n "$app" | grep -E "ld-linux|ld64.so"'
-
-      - name: Run Linux musl Avalonia smoke app
-        if: ${{ startsWith(matrix.rid, 'linux-musl-') }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          docker run --rm \
-            -v "${{ github.workspace }}:/workspace" \
-            -w /workspace/artifacts/smoke-${{ matrix.rid }} \
-            alpine:3.23 \
-            sh -c 'apk add --no-cache xvfb-run libstdc++ libgcc fontconfig freetype ttf-dejavu libx11 libxcb libxext libxrender libxi libxrandr libxcursor libxfixes libxinerama libice libsm mesa-gl mesa-egl && fc-cache -f && fc-match sans && chmod +x ./AvaloniaStaticLinkSmoke && timeout 15s xvfb-run -a ./AvaloniaStaticLinkSmoke || code=$?; if [ "${code:-0}" = 124 ] || [ "${code:-0}" = 143 ]; then echo "Avalonia musl smoke app stayed alive for 15 seconds."; exit 0; fi; exit "${code:-0}"'
-
-      - name: Run macOS Avalonia smoke app
-        if: ${{ startsWith(matrix.rid, 'osx-') }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          cd "artifacts/smoke-${{ matrix.rid }}"
-          chmod +x ./AvaloniaStaticLinkSmoke
-          python3 - <<'PY'
-          import pathlib
-          import subprocess
-          import sys
-
-          log = pathlib.Path("avalonia-smoke-run.log")
-          proc = subprocess.Popen(
-              ["./AvaloniaStaticLinkSmoke"],
-              stdout=subprocess.PIPE,
-              stderr=subprocess.STDOUT,
-              text=True,
-          )
-
-          try:
-              output, _ = proc.communicate(timeout=15)
-          except subprocess.TimeoutExpired:
-              proc.kill()
-              output, _ = proc.communicate()
-              log.write_text(output or "")
-              print(output or "")
-              print("Avalonia smoke app stayed alive for 15 seconds.")
-              sys.exit(0)
-
-          log.write_text(output or "")
-          print(output or "")
-          if proc.returncode == 0:
-              print("Avalonia smoke app exited normally.")
-              sys.exit(0)
-
-          print(f"Avalonia smoke app failed with exit code {proc.returncode}.", file=sys.stderr)
-          sys.exit(proc.returncode if proc.returncode > 0 else 1)
-          PY
-
-      - name: Upload Avalonia smoke app
-        if: ${{ always() }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: avalonia-smoke-${{ matrix.rid }}
-          path: artifacts/smoke-${{ matrix.rid }}/**
-          if-no-files-found: warn
-
-  smoke-macos-metal:
-    runs-on: macos-15
-    needs: pack
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Setup .NET
-        uses: actions/setup-dotnet@v4
-        with:
-          dotnet-version: "10.0.302"
-
-      - name: Download NuGet package
-        uses: actions/download-artifact@v4
-        with:
-          name: staticlink-avalonia-nuget
-          path: artifacts/nuget
-
-      - name: Publish Avalonia 12 macOS arm64 smoke app
-        shell: pwsh
-        run: |
-          $ErrorActionPreference = "Stop"
-          $package = Get-ChildItem -Path "artifacts/nuget" -Filter "StaticLink.Avalonia.*.nupkg" | Where-Object { $_.Name -notlike "StaticLink.Avalonia.Native.*" } | Select-Object -First 1
-          if (-not $package) { throw "StaticLink NuGet package was not downloaded." }
-          if ($package.BaseName -notmatch '^StaticLink\.Avalonia\.(.+)$') { throw "Unexpected package name: $($package.Name)" }
-          $projectDir = Join-Path $PWD "artifacts/avalonia-metal-smoke-src"
-          pwsh ./scripts/create-avalonia-smoke.ps1 `
-            -ProjectDir $projectDir `
-            -NuGetSource (Resolve-Path "artifacts/nuget") `
-            -StaticLinkVersion $Matches[1] `
-            -AvaloniaVersion "12.1.0" `
-            -StaticLinkNativeVersion "12.1.0.${{ inputs.native_package_revision || '1' }}"
-          dotnet publish (Join-Path $projectDir "AvaloniaStaticLinkSmoke.csproj") `
-            -c Release `
-            -r osx-arm64 `
-            --configfile (Join-Path $projectDir "NuGet.config") `
-            /p:PublishAot=true `
-            /p:SelfContained=true `
-            /p:PublishSingleFile=true `
-            /p:StripSymbols=true `
-            /p:PublishDir="$PWD/artifacts/smoke-osx-arm64-metal/"
-
-      - name: Verify fully static third-party libraries
-        shell: bash
-        run: |
-          set -euo pipefail
-          publish_dir="artifacts/smoke-osx-arm64-metal"
-          test -x "$publish_dir/AvaloniaStaticLinkSmoke"
-          for library in libAvaloniaNative.dylib libSkiaSharp.dylib libHarfBuzzSharp.dylib; do
-            test ! -f "$publish_dir/$library"
-          done
-
-      - name: Run default and Metal-only smoke tests
-        shell: bash
-        run: |
-          set -euo pipefail
-          cd artifacts/smoke-osx-arm64-metal
-          python3 - <<'PY'
-          import os
-          import pathlib
-          import subprocess
-
-          for renderer in ("default", "metal"):
-              environment = os.environ.copy()
-              environment["STATICLINK_MAC_RENDERER"] = renderer
-              environment["STATICLINK_SMOKE_AUTOCLOSE"] = "1"
-              try:
-                  result = subprocess.run(
-                      ["./AvaloniaStaticLinkSmoke"],
-                      env=environment,
-                      stdout=subprocess.PIPE,
-                      stderr=subprocess.STDOUT,
-                      text=True,
-                      timeout=15,
-                  )
-              except subprocess.TimeoutExpired as exception:
-                  output = exception.stdout or ""
-                  if isinstance(output, bytes):
-                      output = output.decode(errors="replace")
-                  pathlib.Path(f"avalonia-{renderer}.log").write_text(output)
-                  raise SystemExit(f"Avalonia {renderer} smoke app timed out.\n{output}")
-
-              output = result.stdout or ""
-              pathlib.Path(f"avalonia-{renderer}.log").write_text(output)
-              print(output, end="")
-              marker = f"STATICLINK_SMOKE_READY={renderer}"
-              if result.returncode != 0 or marker not in output.splitlines():
-                  raise SystemExit(f"Avalonia {renderer} smoke app failed with exit code {result.returncode}.")
-          PY
-
-      - name: Upload macOS Metal smoke app
-        if: ${{ always() }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: avalonia-smoke-osx-arm64-metal
-          path: artifacts/smoke-osx-arm64-metal/**
-          if-no-files-found: warn
-
-  publish-nuget:
-    permissions:
-      contents: read
-      id-token: write
-    runs-on: ubuntu-24.04
-    needs:
-      - pack
-      - smoke-avalonia
-      - smoke-macos-metal
-    steps:
-      - name: Setup .NET
-        uses: actions/setup-dotnet@v4
-        with:
-          dotnet-version: "10.0.302"
-
-      - name: Download NuGet package
-        uses: actions/download-artifact@v4
-        with:
-          name: staticlink-avalonia-nuget
-          path: artifacts/nuget
-
-      - name: NuGet Trusted Publishing login
-        id: login
-        if: ${{ vars.NUGET_USER != '' && (startsWith(github.ref, 'refs/tags/staticlink-avalonia-v') || inputs.publish_to_nuget == true) }}
-        uses: NuGet/login@v1
-        with:
-          user: ${{ vars.NUGET_USER }}
-
-      - name: Publish to nuget.org
-        if: ${{ startsWith(github.ref, 'refs/tags/staticlink-avalonia-v') || (github.event_name == 'workflow_dispatch' && inputs.publish_to_nuget == true) }}
-        env:
-          NUGET_API_KEY: ${{ steps.login.outputs.NUGET_API_KEY || secrets.NUGET_API_KEY }}
-        run: |
-          if [ -z "$NUGET_API_KEY" ]; then
-            echo "NUGET_API_KEY secret is not configured." >&2
-            exit 1
-          fi
-
-          for package in artifacts/nuget/*.nupkg; do
-            dotnet nuget push "$package" \
-              --source "https://api.nuget.org/v3/index.json" \
-              --api-key "$NUGET_API_KEY" \
-              --skip-duplicate
-          done
-
-  release:
-    runs-on: ubuntu-24.04
-    needs:
-      - preflight
-      - pack
-      - smoke-avalonia
-      - smoke-macos-metal
-      - publish-nuget
-    if: ${{ startsWith(github.ref, 'refs/tags/staticlink-avalonia-v') || (github.event_name == 'workflow_dispatch' && inputs.publish_to_release == true) }}
-    permissions:
-      contents: write
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Download NuGet artifact
-        uses: actions/download-artifact@v4
-        with:
-          name: staticlink-avalonia-nuget
-          path: release-artifacts/staticlink-avalonia-nuget
-
-      - name: Download release source lock
-        uses: actions/download-artifact@v4
-        with:
-          name: graphics-release-source-lock
-          path: release-artifacts/source-lock
-
-      - name: Download smoke artifacts
-        uses: actions/download-artifact@v4
-        with:
-          pattern: avalonia-smoke-*
-          path: release-artifacts
-          merge-multiple: false
-
-      - name: Prepare release files
-        run: |
-          mkdir -p release-files
-          cp release-artifacts/source-lock/release.lock.json release-files/
-          find release-artifacts/staticlink-avalonia-nuget -type f \( -name '*.nupkg' -o -name '*.snupkg' \) -exec cp {} release-files/ \;
-          for dir in release-artifacts/avalonia-smoke-*; do
-            [ -d "$dir" ] || continue
-            name="$(basename "$dir")"
-            (cd "$dir" && zip -r "../../release-files/$name.zip" .)
-          done
-          ls -la release-files
-
-      - name: Publish GitHub Release
-        env:
-          GH_TOKEN: ${{ github.token }}
-          PACKAGE_VERSION: ${{ needs.preflight.outputs.package_version }}
-        run: |
-          if [ "${GITHUB_REF_TYPE}" = "tag" ]; then
-            release_tag="${GITHUB_REF_NAME}"
-            title="${GITHUB_REF_NAME}"
-          else
-            release_tag="staticlink-avalonia-v${PACKAGE_VERSION}"
-            title="StaticLink.Avalonia ${PACKAGE_VERSION}"
-          fi
-
-          if gh release view "$release_tag" >/dev/null 2>&1; then
-            gh release upload "$release_tag" release-files/* --clobber
-          else
-            gh release create "$release_tag" release-files/* \
-              --target "$GITHUB_SHA" \
-              --title "$title" \
-              --notes "NuGet package plus Avalonia 11.3.14 NativeAOT single-file smoke apps for win-x64, win-x86, win-arm64, linux-x64, linux-arm64, linux-musl-x64, linux-musl-arm64, osx-x64, and osx-arm64."
-          fi

.github/workflows/static-graphics-linux-debian.yml

@@ -1,28 +0,0 @@
-name: static-graphics-linux-debian-zig
-
-on:
-  workflow_call:
-    inputs:
-      skiasharp_version:
-        required: true
-        type: string
-      source_lock:
-        type: string
-        default: ''
-  workflow_dispatch:
-    inputs:
-      skiasharp_version:
-        type: string
-        default: '3.119.4'
-
-permissions:
-  contents: read
-  packages: write
-
-jobs:
-  build:
-    uses: ./.github/workflows/static-graphics-zig-cross.yml
-    with:
-      skiasharp_version: ${{ inputs.skiasharp_version }}
-      source_lock: ${{ inputs.source_lock || '' }}
-      rids: '["linux-x64","linux-arm64","linux-musl-x64","linux-musl-arm64"]'

.github/workflows/static-graphics-linux.yml

@@ -1,28 +0,0 @@
-name: static-graphics-linux-zig
-
-on:
-  workflow_call:
-    inputs:
-      skiasharp_version:
-        required: true
-        type: string
-      source_lock:
-        type: string
-        default: ''
-  workflow_dispatch:
-    inputs:
-      skiasharp_version:
-        type: string
-        default: '3.119.4'
-
-permissions:
-  contents: read
-  packages: write
-
-jobs:
-  build:
-    uses: ./.github/workflows/static-graphics-zig-cross.yml
-    with:
-      skiasharp_version: ${{ inputs.skiasharp_version }}
-      source_lock: ${{ inputs.source_lock || '' }}
-      rids: '["linux-x64","linux-arm64"]'

.github/workflows/static-graphics-macos.yml

@@ -1,28 +0,0 @@
-name: static-graphics-macos-zig
-
-on:
-  workflow_call:
-    inputs:
-      skiasharp_version:
-        required: true
-        type: string
-      source_lock:
-        type: string
-        default: ''
-  workflow_dispatch:
-    inputs:
-      skiasharp_version:
-        type: string
-        default: '3.119.4'
-
-permissions:
-  contents: read
-  packages: write
-
-jobs:
-  build:
-    uses: ./.github/workflows/static-graphics-zig-cross.yml
-    with:
-      skiasharp_version: ${{ inputs.skiasharp_version }}
-      source_lock: ${{ inputs.source_lock || '' }}
-      rids: '["osx-x64","osx-arm64"]'

.github/workflows/static-graphics-musl.yml

@@ -1,28 +0,0 @@
-name: static-graphics-musl-zig
-
-on:
-  workflow_call:
-    inputs:
-      skiasharp_version:
-        required: true
-        type: string
-      source_lock:
-        type: string
-        default: ''
-  workflow_dispatch:
-    inputs:
-      skiasharp_version:
-        type: string
-        default: '3.119.4'
-
-permissions:
-  contents: read
-  packages: write
-
-jobs:
-  build:
-    uses: ./.github/workflows/static-graphics-zig-cross.yml
-    with:
-      skiasharp_version: ${{ inputs.skiasharp_version }}
-      source_lock: ${{ inputs.source_lock || '' }}
-      rids: '["linux-musl-x64","linux-musl-arm64"]'

.github/workflows/static-graphics-preflight.yml

@@ -1,99 +0,0 @@
-name: static-graphics-preflight
-
-on:
-  workflow_call:
-    inputs:
-      skiasharp_version:
-        type: string
-        default: ''
-    outputs:
-      source_lock:
-        value: ${{ jobs.validate.outputs.source_lock }}
-      package_version:
-        value: ${{ jobs.validate.outputs.package_version }}
-      skiasharp_version:
-        value: ${{ jobs.validate.outputs.skiasharp_version }}
-      angle_branch:
-        value: ${{ jobs.validate.outputs.angle_branch }}
-  workflow_dispatch:
-
-jobs:
-  validate:
-    runs-on: ubuntu-24.04
-    outputs:
-      source_lock: ${{ steps.versions.outputs.source_lock }}
-      package_version: ${{ steps.versions.outputs.package_version }}
-      skiasharp_version: ${{ steps.versions.outputs.skiasharp_version }}
-      angle_branch: ${{ steps.versions.outputs.angle_branch }}
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Setup .NET
-        uses: actions/setup-dotnet@v4
-        with:
-          dotnet-version: "10.0.302"
-
-      - name: Read and validate versions
-        id: versions
-        shell: bash
-        env:
-          REQUESTED_VERSION: ${{ inputs.skiasharp_version }}
-        run: |
-          if [ "${GITHUB_REF_TYPE:-}" = tag ] && [ -z "$REQUESTED_VERSION" ]; then
-            tag_version="${GITHUB_REF_NAME#staticlink-avalonia-v}"
-            REQUESTED_VERSION="${tag_version%%-*}"
-          fi
-          python3 scripts/resolve-release-lock.py --version "$REQUESTED_VERSION"
-          python3 - <<'PY'
-          import os
-          import pathlib
-          import xml.etree.ElementTree as ET
-
-          project = pathlib.Path("NuGet/StaticGraphics/StaticLink.Avalonia.csproj")
-          root = ET.parse(project).getroot()
-          import json
-          lock = json.loads(pathlib.Path("build/linux-toolchain/release.lock.json").read_text())
-          package_version = root.findtext(".//Version")
-          package_version = lock["skiasharp_version"] + "-" + package_version.split("-", 1)[1]
-          skia_reference = next(
-              item.attrib["Version"]
-              for item in root.findall(".//PackageReference")
-              if item.attrib.get("Include") == "SkiaSharp"
-          )
-          version_base, revision = package_version.rsplit(".", 1)
-          skiasharp_version, angle_branch = version_base.split("-", 1)
-          if not revision.isdigit() or skiasharp_version != lock["skiasharp_version"]:
-              raise SystemExit(f"Inconsistent package version: {package_version}, SkiaSharp: {skia_reference}")
-          if os.environ.get("GITHUB_REF_TYPE") == "tag":
-              expected_tag = f"staticlink-avalonia-v{package_version}"
-              if os.environ.get("GITHUB_REF_NAME") != expected_tag:
-                  raise SystemExit(f"Release tag must be {expected_tag}")
-
-          with open(os.environ["GITHUB_OUTPUT"], "a", encoding="utf-8") as output:
-              output.write("source_lock=" + json.dumps(lock, separators=(",", ":")) + "\n")
-              output.write(f"package_version={package_version}\n")
-              output.write(f"skiasharp_version={skiasharp_version}\n")
-              output.write(f"angle_branch={angle_branch}\n")
-          PY
-
-      - name: Validate upstream refs and ANGLE patch
-        env:
-          SKIASHARP_VERSION: ${{ steps.versions.outputs.skiasharp_version }}
-          ANGLE_BRANCH: ${{ steps.versions.outputs.angle_branch }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          git ls-remote --exit-code --tags https://github.com/mono/SkiaSharp.git "refs/tags/v${SKIASHARP_VERSION}"
-          git clone --depth 1 --branch "chromium/${ANGLE_BRANCH}" https://github.com/google/angle.git /tmp/staticlink-angle
-          git -C /tmp/staticlink-angle apply --check "$GITHUB_WORKSPACE/External/NativeStatic/patches/angle-chromium-${ANGLE_BRANCH}.patch"
-
-      - name: Validate scripts
-        shell: bash
-        run: |
-          set -euo pipefail
-          bash -n scripts/build-linux-static-graphics.sh
-          bash -n scripts/build-macos-static-graphics.sh
-          pwsh -NoProfile -Command '$files = @("scripts/build-windows-static-graphics.ps1", "scripts/create-avalonia-smoke.ps1"); foreach ($file in $files) { $errors = $null; [System.Management.Automation.Language.Parser]::ParseFile((Resolve-Path $file), [ref]$null, [ref]$errors) | Out-Null; if ($errors.Count) { $errors | Format-List | Out-String; exit 1 } }'
-
-      - name: Compile smoke project
-        run: dotnet build Smoke/AvaloniaStaticLinkSmoke/AvaloniaStaticLinkSmoke.csproj -c Release -p:PublishAot=false

.github/workflows/static-graphics-windows.yml

@@ -1,28 +0,0 @@
-name: static-graphics-windows-zig
-
-on:
-  workflow_call:
-    inputs:
-      skiasharp_version:
-        required: true
-        type: string
-      source_lock:
-        type: string
-        default: ''
-  workflow_dispatch:
-    inputs:
-      skiasharp_version:
-        type: string
-        default: '3.119.4'
-
-permissions:
-  contents: read
-  packages: write
-
-jobs:
-  build:
-    uses: ./.github/workflows/static-graphics-zig-cross.yml
-    with:
-      skiasharp_version: ${{ inputs.skiasharp_version }}
-      source_lock: ${{ inputs.source_lock || '' }}
-      rids: '["win-x64","win-x86","win-arm64"]'

.github/workflows/static-graphics-zig-cross.yml

@@ -1,111 +0,0 @@
-name: static-graphics-zig-cross-debian12
-
-# All native archives are compiled with Zig on Linux; platform runners validate consumer apps.
-on:
-  workflow_call:
-    inputs:
-      skiasharp_version:
-        type: string
-        required: true
-      toolchain_image:
-        type: string
-        default: ''
-      rids:
-        type: string
-        default: '["linux-x64","linux-arm64","linux-musl-x64","linux-musl-arm64","win-x64","win-x86","win-arm64","osx-x64","osx-arm64"]'
-      artifact_prefix:
-        type: string
-        default: native-static
-      source_lock:
-        type: string
-        required: true
-  workflow_dispatch:
-    inputs:
-      skiasharp_version:
-        description: Locked SkiaSharp release profile
-        type: string
-        default: '3.119.4'
-
-permissions:
-  contents: read
-  packages: write
-
-jobs:
-  image:
-    if: ${{ inputs.toolchain_image == '' }}
-    uses: ./.github/workflows/zig-toolchain-image.yml
-
-  build:
-    needs: image
-    if: ${{ always() && (needs.image.result == 'success' || inputs.toolchain_image != '') }}
-    permissions:
-      contents: read
-      packages: read
-    env:
-      TOOLCHAIN_IMAGE: ${{ inputs.toolchain_image || needs.image.outputs.image }}
-    timeout-minutes: 180
-    runs-on: ubuntu-24.04
-    strategy:
-      fail-fast: false
-      matrix:
-        rid: ${{ fromJSON(inputs.rids || '["linux-x64","linux-arm64","linux-musl-x64","linux-musl-arm64","win-x64","win-x86","win-arm64","osx-x64","osx-arm64"]') }}
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - name: Resolve immutable build inputs
-        env:
-          SOURCE_LOCK_JSON: ${{ inputs.source_lock }}
-          REQUESTED_VERSION: ${{ inputs.skiasharp_version }}
-        run: |
-          if [ -n "$SOURCE_LOCK_JSON" ]; then
-            python3 - <<'PY'
-          import json, os, pathlib
-          lock = json.loads(os.environ['SOURCE_LOCK_JSON'])
-          if lock['skiasharp_version'] != os.environ['REQUESTED_VERSION']:
-              raise SystemExit('Source lock does not match requested version')
-          pathlib.Path('build/linux-toolchain/release.lock.json').write_text(json.dumps(lock, indent=2) + '\n')
-          PY
-          else
-            python3 scripts/resolve-release-lock.py --version "$REQUESTED_VERSION"
-          fi
-      - name: Restore exact target cache
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
-        with:
-          path: External/NativeStatic/.work
-          key: zig-debian12-v3-${{ inputs.skiasharp_version }}-${{ matrix.rid }}-${{ hashFiles('build/linux-toolchain/**', 'scripts/prepare-cross-sources.sh', 'scripts/build-linux-static-graphics.sh', 'External/NativeStatic/patches/*.patch') }}
-      - name: Pull immutable toolchain image
-        env:
-          GH_TOKEN: ${{ github.token }}
-          ACTOR: ${{ github.actor }}
-        run: |
-          printf '%s' "$GH_TOKEN" | docker login ghcr.io -u "$ACTOR" --password-stdin
-          docker pull "$TOOLCHAIN_IMAGE"
-      - name: Prepare locked sources and build native libraries
-        env:
-          CROSS_RID: ${{ matrix.rid }}
-          SKIASHARP_PROFILE: ${{ inputs.skiasharp_version }}
-        run: |
-          mkdir -p External/NativeStatic/.work/home
-          docker run --rm --user "$(id -u):$(id -g)" \
-            -e HOME=/src/External/NativeStatic/.work/home -e CROSS_RID -e SKIASHARP_PROFILE \
-            -e CCACHE_DIR=/src/External/NativeStatic/.work/ccache -e CCACHE_MAXSIZE=1G \
-            -e ZIG_GLOBAL_CACHE_DIR=/src/External/NativeStatic/.work/zig-global \
-            -v "$PWD:/src" -w /src --entrypoint bash "$TOOLCHAIN_IMAGE" -c '
-              set -euo pipefail
-              export SOURCE_LOCK="/src/build/linux-toolchain/release.lock.json"
-              source scripts/prepare-cross-sources.sh
-              python3 build/linux-toolchain/build-cross.py \
-                --target "$CROSS_RID" \
-                --sources-manifest "$WORK_DIR/cross-sources.json" \
-                --work /src/External/NativeStatic/.work/toolchains \
-                --output "/src/External/NativeStatic/zig-cross/$SKIASHARP_PROFILE/$CROSS_RID" --jobs 4
-              python3 build/linux-toolchain/package-zig.py \
-                --rid "$CROSS_RID" \
-                --input "/src/External/NativeStatic/zig-cross/$SKIASHARP_PROFILE/$CROSS_RID" \
-                --output "/src/External/NativeStatic/$CROSS_RID/native"
-            '
-      - name: Upload archives, link tests and input manifest
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
-        with:
-          name: ${{ inputs.artifact_prefix || 'native-static' }}-${{ matrix.rid }}
-          path: External/NativeStatic/${{ matrix.rid }}/**
-          if-no-files-found: error

.github/workflows/zig-recent-regression.yml

@@ -1,55 +0,0 @@
-name: zig-recent-release-regression
-
-on:
-  workflow_dispatch:
-    inputs:
-      versions:
-        description: JSON array of stable SkiaSharp versions from this branch major
-        type: string
-        default: '["3.119.2","3.119.4"]'
-
-permissions:
-  contents: read
-  packages: write
-
-jobs:
-  resolve:
-    runs-on: ubuntu-24.04
-    outputs:
-      releases: ${{ steps.locks.outputs.releases }}
-    steps:
-      - uses: actions/checkout@v4
-      - id: locks
-        env:
-          VERSIONS: ${{ inputs.versions }}
-        run: |
-          python3 - <<'PY'
-          import json, os, pathlib, subprocess
-          versions = json.loads(os.environ['VERSIONS'])
-          if not isinstance(versions, list) or not 1 <= len(versions) <= 5:
-              raise SystemExit('Expected one to five stable versions')
-          releases = []
-          for version in versions:
-              subprocess.run(['python3', 'scripts/resolve-release-lock.py', '--version', version], check=True)
-              lock = json.loads(pathlib.Path('build/linux-toolchain/release.lock.json').read_text())
-              releases.append({'version': version, 'lock': json.dumps(lock)})
-          with open(os.environ['GITHUB_OUTPUT'], 'a') as output:
-              output.write('releases=' + json.dumps(releases, separators=(',', ':')) + '\n')
-          PY
-
-  toolchain:
-    needs: resolve
-    uses: ./.github/workflows/zig-toolchain-image.yml
-
-  build:
-    needs: [resolve, toolchain]
-    strategy:
-      fail-fast: false
-      matrix:
-        release: ${{ fromJSON(needs.resolve.outputs.releases) }}
-    uses: ./.github/workflows/static-graphics-zig-cross.yml
-    with:
-      skiasharp_version: ${{ matrix.release.version }}
-      source_lock: ${{ matrix.release.lock }}
-      toolchain_image: ${{ needs.toolchain.outputs.image }}
-      artifact_prefix: regression-${{ matrix.release.version }}

.woodpecker.yml

@@ -1,22 +0,0 @@
-when:
-  - event: [push, manual]
-    branch: skia3
-
-labels:
-  platform: linux/amd64
-  backend: local
-
-skip_clone: true
-
-steps:
-  - name: checkout
-    image: bash
-    commands:
-      - git init source
-      - git -C source remote add origin https://git.oeo.one/greepar/StaticLink.Avalonia.git
-      - git -C source fetch --depth=1 origin "$CI_COMMIT_SHA"
-      - git -C source checkout --detach FETCH_HEAD
-  - name: nine-platform-build-link-and-pack
-    image: bash
-    commands:
-      - bash source/scripts/woodpecker-cross-test.sh

NuGet/StaticGraphics/README.md

@@ -11,13 +11,13 @@ Choose the static graphics package that matches the Avalonia and SkiaSharp major
 | 11 | 2.88.9 | `2.88.9-7151.10` |
 | 11 | 3.119.4 | `3.119.4-7922.1` |
 | 12 | 3.119.4 | `3.119.4-7922.1` |
-| 12 | 3.119.4 | `3.119.4-7922.1` |
+| 12 | 4.150.1 | `4.150.1-7922.1` |
 
 Example:
 ```xml
 <ItemGroup>
   <PackageReference Include="Avalonia" Version="12.1.0" />
-  <PackageReference Include="StaticLink.Avalonia" Version="3.119.4-7922.1" />
+  <PackageReference Include="StaticLink.Avalonia" Version="4.150.1-7922.1" />
 </ItemGroup>
 ```
 

NuGet/StaticGraphics/StaticLink.Avalonia.csproj

@@ -6,7 +6,7 @@
         <IncludeBuildOutput>false</IncludeBuildOutput>
         <SuppressDependenciesWhenPacking>false</SuppressDependenciesWhenPacking>
         <PackageId>StaticLink.Avalonia</PackageId>
-        <Version>3.119.4-7922.2</Version>
+        <Version>4.150.1-7922.2</Version>
         <Authors>greepar</Authors>
         <Company>greepar</Company>
         <Description>Static SkiaSharp, HarfBuzzSharp, and ANGLE libraries for Avalonia NativeAOT single-file publishing.</Description>
@@ -19,7 +19,7 @@
     </PropertyGroup>
 
     <ItemGroup>
-        <PackageReference Include="SkiaSharp" Version="3.119.4" />
+        <PackageReference Include="SkiaSharp" Version="4.150.1" />
     </ItemGroup>
 
     <ItemGroup>

build/linux-toolchain/angle-linux.gn.in

@@ -21,4 +21,3 @@ clang_version = "19"
 
 # Chromium UI/ATK is not part of the standalone ANGLE library targets.
 use_glib = false
-use_libpci = false

build/linux-toolchain/sources.lock.json

@@ -1,7 +1,7 @@
 {
-  "skiasharp_version": "3.119.4",
+  "skiasharp_version": "4.150.1",
-  "skiasharp_revision": "f568ac94dd768ef9a2f593537cfde2dd0d348ef5",
+  "skiasharp_revision": "c3e4f4c20e1f23ab74d31a8838a5bd6dc55365f2",
   "angle_branch": "7922",
   "angle_revision": "7e08726e32026a0bbabd6ec8a1a90f5ab533ed66",
-  "skia_revision": "7dbfc07dd33181f84e0958afb7ee805c6c769f0b"
+  "skia_revision": "0aa2d542e833ffd1d4d1b68a5152375e7f65ce11"
 }

build/linux-toolchain/zig-cross.py

@@ -67,9 +67,9 @@ def compiler(config, tool, incoming):
         "-F", config["sdk"] + "/System/Library/Frameworks", "-Wno-elaborated-enum-base",
     ] if "macos" in target else []
     if config.get('linux_abi_headers'):
-        args += ['-idirafter', config['linux_abi_headers']]
+        args += ['-I' + config['linux_abi_headers']]
     if config.get('linux_headers'):
-        args += ['-idirafter', config['linux_headers'], '-idirafter', config['linux_headers'] + '/freetype2']
+        args += ['-I' + config['linux_headers'], '-I' + config['linux_headers'] + '/freetype2']
     if config.get('linux_sysroot') and '-c' not in incoming and '-o' in incoming:
         root = Path(config['linux_sysroot'])
         cpu = 'x86_64' if target.startswith('x86_64') else 'aarch64'
@@ -173,10 +173,7 @@ def execute(config, tool, incoming):
                 inputs.append(flag)
         if not output:
             raise SystemExit("Darwin libtool adapter needs -o")
-        libtool = shutil.which('llvm-libtool-darwin') or shutil.which('llvm-libtool-darwin-16')
+        command = [config["zig"], "ar", "--format=darwin", "rcs", output, *inputs]
-        if not libtool:
-            raise SystemExit('The pinned image must provide llvm-libtool-darwin to flatten archive dependencies')
-        command = [libtool, '-static', '-o', output, *inputs]
     if tool in ('ar', 'libtool'):
         # Never leave a truncated archive behind when disk/network/job failures
         # interrupt archiving. GN response files contain a complete member list.
@@ -255,22 +252,13 @@ def prepare(args):
         abi = output / 'include-linux'
         abi.mkdir(exist_ok=True)
         cpu = 'x86_64' if config['target'].startswith('x86_64') else 'aarch64'
-        for name in ('ffi.h', 'ffitarget.h', 'expat.h', 'expat_external.h'):
+        for name in ('ffi.h', 'ffitarget.h'):
             for prefix in (root / 'usr/include' / (cpu + '-linux-gnu'), root / 'usr/include'):
                 src = prefix / name
                 if src.is_file():
                     (abi / name).write_bytes(src.read_bytes())
                     break
         config['linux_abi_headers'] = str(abi)
-        gl_headers = abi / 'GL'
-        gl_headers.mkdir(exist_ok=True)
-        for prefix in (root / 'usr/include/GL', Path('/usr/include/GL')):
-            for header in prefix.glob('*.h'):
-                destination = gl_headers / header.name
-                if not destination.exists():
-                    destination.write_bytes(header.read_bytes())
-        if not (gl_headers / 'glx.h').is_file():
-            raise SystemExit('The pinned Linux SDK/image lacks GL/glx.h')
         pc = output / 'pkg-config'
         dirs = [root / 'usr/lib' / (cpu + '-linux-gnu') / 'pkgconfig', root / 'usr/lib/pkgconfig', root / 'usr/share/pkgconfig']
         pc.write_text('#!/bin/sh\nexport PKG_CONFIG_SYSROOT_DIR=' + shlex.quote(str(root)) + '\nexport PKG_CONFIG_LIBDIR=' + shlex.quote(':'.join(map(str, dirs))) + '\nexec /usr/bin/pkg-config "$@"\n')

build/release-tracks.json

@@ -1,5 +1,5 @@
 {
   "branches": [
-    {"major": 3, "ref": "skia3", "angle_branch": "7922", "revision": "2"}
+    {"major": 4, "ref": "skia4", "angle_branch": "7922", "revision": "2"}
   ]
 }

scripts/build-avalonia-native-container.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+set -euo pipefail
+: "${RID:?RID is required}"
+: "${AVALONIA_VERSION:?AVALONIA_VERSION is required}"
+mkdir -p "$HOME"
+source_dir="/src/External/AvaloniaNative/.work/Avalonia-$AVALONIA_VERSION"
+git clone --depth 1 --branch "$AVALONIA_VERSION" https://github.com/AvaloniaUI/Avalonia.git "$source_dir"
+if git -C "$source_dir" config -f .gitmodules --get-regexp path | grep -q "[[:space:]]external/Numerge$"; then
+  git -C "$source_dir" submodule update --init --depth 1 external/Numerge
+fi
+python3 build/linux-toolchain/build-avalonia-native-cross.py \
+  --source "$source_dir" --rid "$RID" --sdk /opt/macos-sdk/MacOSX15.5.sdk \
+  --work "/src/External/AvaloniaNative/.work/zig-$AVALONIA_VERSION-$RID" \
+  --output "/src/External/AvaloniaNative/$RID/native"
+

scripts/build-linux-static-graphics.sh

@@ -12,7 +12,6 @@ BUILD_JOBS="${BUILD_JOBS:-$(nproc)}"
 ANGLE_PATCH_DIR="${ANGLE_PATCH_DIR:-$ROOT_DIR/External/NativeStatic/patches}"
 LLVM_AR="${LLVM_AR:-llvm-ar-19}"
 SKIA_DEPS_RETRIES="${SKIA_DEPS_RETRIES:-3}"
-SOURCE_DOWNLOAD_ATTEMPTS="${SOURCE_DOWNLOAD_ATTEMPTS:-5}"
 
 usage() {
   cat <<'USAGE'
@@ -28,7 +27,6 @@ Environment:
   BUILD_JOBS          Ninja parallelism. Default: nproc
   ANGLE_PATCH_DIR     ANGLE patch directory. Default: External/NativeStatic/patches
   LLVM_AR             llvm-ar command used to expand thin archives. Default: llvm-ar-19
-  SOURCE_DOWNLOAD_ATTEMPTS  Maximum attempts per source download. Default: 5
 USAGE
 }
 
@@ -146,37 +144,22 @@ PY
   export PYTHONPATH="$module_dir:${PYTHONPATH:-}"
 }
 
-retry_source_download() {
-  local attempt status
-  if [[ ! "$SOURCE_DOWNLOAD_ATTEMPTS" =~ ^[1-9][0-9]*$ ]]; then
-    echo "SOURCE_DOWNLOAD_ATTEMPTS must be a positive integer" >&2
-    return 1
-  fi
-  for ((attempt = 1; attempt <= SOURCE_DOWNLOAD_ATTEMPTS; attempt++)); do
-    if "$@"; then
-      return 0
-    else
-      status=$?
-    fi
-    if ((attempt == SOURCE_DOWNLOAD_ATTEMPTS)); then
-      echo "Source download failed after $attempt attempts; stopping" >&2
-      return "$status"
-    fi
-    echo "Source download failed ($attempt/$SOURCE_DOWNLOAD_ATTEMPTS); retrying in $((attempt * 10)) seconds" >&2
-    sleep "$((attempt * 10))"
-  done
-}
-
 sync_skiasharp() {
   local src="$WORK_DIR/SkiaSharp-$SKIASHARP_VERSION"
-  local revision="${SKIASHARP_REVISION:-release/$SKIASHARP_VERSION}"
+  if [[ -n "${SKIASHARP_REVISION:-}" ]]; then
-  if [[ ! -d "$src/.git" ]]; then
+    if [[ ! -d "$src/.git" ]]; then
-    git init "$src" >&2 || return $?
+      git init "$src" >&2
-    git -C "$src" remote add origin https://github.com/mono/SkiaSharp.git || return $?
+      git -C "$src" remote add origin https://github.com/mono/SkiaSharp.git
+    fi
+    git -C "$src" fetch --depth 1 origin "$SKIASHARP_REVISION"
+    git -C "$src" checkout --detach FETCH_HEAD >&2
+  elif [[ ! -d "$src/.git" ]]; then
+    git clone --depth 1 --branch "release/$SKIASHARP_VERSION" https://github.com/mono/SkiaSharp.git "$src"
+  else
+    git -C "$src" fetch --depth 1 origin "release/$SKIASHARP_VERSION"
+    git -C "$src" checkout -q FETCH_HEAD
   fi
-  retry_source_download git -C "$src" fetch --depth 1 origin "$revision" >&2 || return $?
+  git -C "$src" submodule update --init --depth 1 externals/skia >&2
-  git -C "$src" checkout --detach FETCH_HEAD >&2 || return $?
-  retry_source_download git -C "$src" submodule update --init --depth 1 externals/skia >&2 || return $?
   echo "$src"
 }
 
@@ -283,13 +266,19 @@ EOF_ARGS
 
 sync_angle() {
   local src="$WORK_DIR/ANGLE-$ANGLE_BRANCH"
-  local revision="${ANGLE_REVISION:-chromium/$ANGLE_BRANCH}"
+  if [[ -n "${ANGLE_REVISION:-}" ]]; then
-  if [[ ! -d "$src/.git" ]]; then
+    if [[ ! -d "$src/.git" ]]; then
-    git init "$src" >&2 || return $?
+      git init "$src" >&2
-    git -C "$src" remote add origin https://github.com/google/angle.git || return $?
+      git -C "$src" remote add origin https://github.com/google/angle.git
+    fi
+    git -C "$src" fetch --depth 1 origin "$ANGLE_REVISION"
+    git -C "$src" checkout --detach FETCH_HEAD >&2
+  elif [[ ! -d "$src/.git" ]]; then
+    git clone --depth 1 --branch "chromium/$ANGLE_BRANCH" https://github.com/google/angle.git "$src"
+  else
+    git -C "$src" fetch --depth 1 origin "chromium/$ANGLE_BRANCH"
+    git -C "$src" checkout -q FETCH_HEAD
   fi
-  retry_source_download git -C "$src" fetch --depth 1 origin "$revision" >&2 || return $?
-  git -C "$src" checkout --detach FETCH_HEAD >&2 || return $?
   echo "$src"
 }
 

scripts/prepare-cross-sources.sh

@@ -26,9 +26,9 @@ ensure_depot_tools
 initialize_depot_tools_system_python "$DEPOT_TOOLS_DIR"
 patch_depot_tools_python_deps "$DEPOT_TOOLS_DIR"
 export VPYTHON_BYPASS="manually managed python not supported by chrome operations"
-skia_sharp="$(sync_skiasharp)" || exit $?
+skia_sharp="$(sync_skiasharp)"
-retry_source_download python3 "$SCRIPT_ROOT/build/linux-toolchain/sync-skia-deps.py" --source "$skia_sharp/externals/skia" --cache "$SCRIPT_ROOT/External/NativeStatic/.work/skia-deps"
+python3 "$SCRIPT_ROOT/build/linux-toolchain/sync-skia-deps.py" --source "$skia_sharp/externals/skia" --cache "$SCRIPT_ROOT/External/NativeStatic/.work/skia-deps"
-angle="$(sync_angle)" || exit $?
+angle="$(sync_angle)"
 project_patch="$SCRIPT_ROOT/External/NativeStatic/patches/angle-chromium-$ANGLE_BRANCH.patch"
 if git -C "$angle" apply --reverse --check "$project_patch" >/dev/null 2>&1; then
   :
@@ -50,7 +50,7 @@ target_os = ["linux", "win", "mac"]
 PY
 # Zig and the image's SDKs supply the compiler/runtime; skip native Xcode/MSVC
 # setup hooks while retaining the pinned source dependencies for every target.
-(cd "$angle" && retry_source_download gclient sync --nohooks --force)
+(cd "$angle" && gclient sync --nohooks --force)
 python3 - "$WORK_DIR/cross-sources.json" "$skia_sharp/externals/skia" "$angle" "$SOURCE_LOCK" <<'PY'
 import json, sys
 from pathlib import Path

scripts/woodpecker-cross-test.sh

@@ -1,61 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-SCRIPT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-TOOLCHAIN_IMAGE="ghcr.io/greepar/staticlink.avalonia-zig@sha256:a88b5ea9f76f659978cda36dda06233d7fdc9121046eedf945044fc908d24b85"
-export CROSS_RID=linux-x64
-AGENT_HOME="$(getent passwd "$(id -u)" | cut -d: -f6)"
-if [ -z "$AGENT_HOME" ] || [ "$AGENT_HOME" = / ]; then
-  echo "Cannot find a persistent home directory for the agent user" >&2
-  exit 1
-fi
-CACHE_KEY="$(printf '%s\n' "${CI_REPO_OWNER:?}/${CI_REPO_NAME:?}" "${CI_COMMIT_BRANCH:?}" "$TOOLCHAIN_IMAGE" "$CROSS_RID" | sha256sum | cut -c1-24)"
-CACHE_ROOT="$AGENT_HOME/.cache/staticlink-woodpecker/$CACHE_KEY"
-RESULTS="$AGENT_HOME/staticlink-ci-artifacts/${CI_REPO_OWNER}/${CI_REPO_NAME}/${CI_COMMIT_BRANCH}/${CI_PIPELINE_NUMBER:?}"
-mkdir -p "$CACHE_ROOT"
-exec 9>"$CACHE_ROOT/build.lock"
-echo "Waiting for exclusive access to persistent cache: $CACHE_ROOT"
-flock 9
-if [ ! -d "$CACHE_ROOT/source/.git" ]; then
-  git clone --no-hardlinks "$SCRIPT_ROOT" "$CACHE_ROOT/source"
-fi
-git -C "$CACHE_ROOT/source" fetch --depth=1 "$SCRIPT_ROOT" HEAD
-git -C "$CACHE_ROOT/source" checkout --force --detach FETCH_HEAD
-cd "$CACHE_ROOT/source"
-cp build/linux-toolchain/sources.lock.json build/linux-toolchain/release.lock.json
-mkdir -p "$RESULTS/environment"
-df -h .
-free -h
-command -v docker
-docker version
-if [ "$(docker info --format '{{.OSType}}/{{.Architecture}}')" != "linux/x86_64" ]; then
-  echo "Requires a Linux x86_64 Docker daemon on the WSL agent" >&2
-  exit 1
-fi
-AVAILABLE_KB="$(df -Pk . | awk 'NR == 2 {print $4}')"
-if [ "$AVAILABLE_KB" -lt 41943040 ]; then
-  echo "Need at least 40 GiB free before pulling the toolchain and compiling; more is recommended" >&2
-  exit 1
-fi
-echo "Persistent test results: $RESULTS"
-exec > >(tee "$RESULTS/build.log") 2>&1
-trap 'result=$?; trap - EXIT; printf "%s\n" "$result" > "$RESULTS/exit-code"; echo "Results retained at $RESULTS"; exit "$result"' EXIT
-git rev-parse HEAD > "$RESULTS/commit"
-printf '%s\n' "$TOOLCHAIN_IMAGE" > "$RESULTS/toolchain-image"
-docker pull "$TOOLCHAIN_IMAGE"
-docker run --rm --user "$(id -u):$(id -g)" \
-  -e HOME=/tmp -e DOTNET_CLI_HOME=/tmp -e ZIG_GLOBAL_CACHE_DIR=/tmp/zig-cache \
-  -v "$RESULTS/environment:/validation" --entrypoint python3 \
-  "$TOOLCHAIN_IMAGE" /opt/staticlink/validate-toolchain.py \
-  --output /validation --rids '[]'
-mkdir -p External/NativeStatic/.work/home
-docker run --rm --user "$(id -u):$(id -g)" \
-  -e HOME=/src/External/NativeStatic/.work/home -e CROSS_RID \
-  -e CCACHE_DIR=/src/External/NativeStatic/.work/ccache -e CCACHE_MAXSIZE=1G \
-  -e ZIG_GLOBAL_CACHE_DIR=/src/External/NativeStatic/.work/zig-global \
-  -v "$PWD:/src" -v "$RESULTS:/results" -w /src --entrypoint bash "$TOOLCHAIN_IMAGE" -c '
-    set -euo pipefail
-    export SOURCE_LOCK=/src/build/linux-toolchain/release.lock.json
-    source scripts/prepare-cross-sources.sh
-    python3 scripts/woodpecker-nine-platforms.py \
-      --sources-manifest "$WORK_DIR/cross-sources.json" --results /results
-  '

scripts/woodpecker-nine-platforms.py

@@ -1,160 +0,0 @@
-#!/usr/bin/env python3
-import argparse
-from concurrent.futures import ThreadPoolExecutor, as_completed
-import hashlib
-import json
-import os
-from pathlib import Path
-import shutil
-import subprocess
-import sys
-import time
-import zipfile
-
-RIDS = (
-    'osx-arm64', 'osx-x64', 'linux-x64', 'linux-arm64',
-    'linux-musl-x64', 'linux-musl-arm64', 'win-x64', 'win-x86', 'win-arm64',
-)
-
-
-def run(command, logfile, rid=None, env=None):
-    prefix = f'[{rid}] ' if rid else ''
-    print(prefix + '+ ' + ' '.join(map(str, command)), flush=True)
-    with logfile.open('a') as output:
-        process = subprocess.Popen(list(map(str, command)), stdout=subprocess.PIPE,
-                                   stderr=subprocess.STDOUT, text=True, env=env,
-                                   errors='replace')
-        try:
-            for line in process.stdout:
-                print(prefix + line, end='', flush=True)
-                output.write(line)
-        except BaseException:
-            process.terminate()
-            process.wait()
-            raise
-        return process.wait()
-
-
-def isolate_sources(manifest, rid):
-    sources = json.loads(manifest.read_text())
-    source_lock = Path(sources['source_lock'])
-    version = hashlib.sha256(source_lock.read_bytes()).hexdigest()[:16]
-    workspace = Path('External/NativeStatic/.work/parallel-sources').resolve() / version / rid
-    workspace.mkdir(parents=True, exist_ok=True)
-    isolated_manifest = workspace / 'cross-sources.json'
-    if isolated_manifest.is_file():
-        return isolated_manifest, workspace
-    for incomplete in (workspace / 'SkiaSharp', workspace / 'ANGLE'):
-        if incomplete.exists():
-            shutil.rmtree(incomplete)
-    skia = Path(sources['skia'])
-    angle = Path(sources['angle'])
-    parent = workspace / 'SkiaSharp'
-    isolated_skia = parent / 'externals/skia'
-    isolated_angle = workspace / 'ANGLE'
-    for original, destination in ((skia.parent.parent, parent),
-                                  (skia, isolated_skia), (angle, isolated_angle)):
-        if not (destination / '.git').is_dir():
-            destination.parent.mkdir(parents=True, exist_ok=True)
-            subprocess.run(['git', 'clone', '--shared', '--no-checkout', str(original),
-                            str(destination)], check=True)
-    ignored = shutil.ignore_patterns('.git', 'out', 'staticlink_zig_*')
-    for original, destination in ((skia, isolated_skia), (angle, isolated_angle)):
-        shutil.copytree(original, destination, dirs_exist_ok=True, symlinks=True,
-                        ignore=ignored)
-    sources.update(skia=str(isolated_skia), angle=str(isolated_angle),
-                   angle_gn=str(isolated_angle / Path(sources['angle_gn']).relative_to(angle)))
-    isolated_manifest.write_text(json.dumps(sources, indent=2) + '\n')
-    return isolated_manifest, workspace
-
-
-def build_target(rid, args, lock, jobs):
-    print(f'=== {rid}: compile and link with {jobs} jobs ===', flush=True)
-    started = time.monotonic()
-    logfile = args.results / (rid + '.log')
-    status = 1
-    failure = None
-    try:
-        manifest, workspace = isolate_sources(args.sources_manifest, rid)
-        env = os.environ.copy()
-        env['ZIG_GLOBAL_CACHE_DIR'] = str(workspace / 'zig-global')
-        libraries = Path('External/NativeStatic/zig-cross') / lock['skiasharp_version'] / rid
-        native = Path('External/NativeStatic') / rid / 'native'
-        command = [sys.executable, 'build/linux-toolchain/build-cross.py',
-                   '--target', rid, '--sources-manifest', manifest,
-                   '--work', workspace / 'toolchains',
-                   '--output', libraries, '--jobs', str(jobs)]
-        status = run(command, logfile, rid, env)
-        if status == 0:
-            status = run([sys.executable, 'build/linux-toolchain/package-zig.py',
-                          '--rid', rid, '--input', libraries, '--output', native],
-                         logfile, rid, env)
-        if status == 0:
-            shutil.copytree(native, args.results / rid / 'native', dirs_exist_ok=True)
-            shutil.copytree(libraries / 'link-tests', args.results / rid / 'link-tests',
-                            dirs_exist_ok=True)
-    except Exception as error:
-        status = 1
-        failure = f'{type(error).__name__}: {error}'
-        print(f'[{rid}] {failure}', flush=True)
-    print(f'=== {rid}: {"PASS" if status == 0 else "FAIL"} ===', flush=True)
-    return {'exit_code': status, 'passed': status == 0, 'error': failure,
-            'elapsed_seconds': round(time.monotonic() - started, 1)}
-
-
-def main():
-    parser = argparse.ArgumentParser()
-    parser.add_argument('--sources-manifest', type=Path, required=True)
-    parser.add_argument('--results', type=Path, required=True)
-    args = parser.parse_args()
-    args.results.mkdir(parents=True, exist_ok=True)
-    lock = json.loads(Path('build/linux-toolchain/release.lock.json').read_text())
-    processors = int(subprocess.check_output(['nproc'], text=True).strip())
-    workers = min(2, processors)
-    jobs = min(22, max(1, processors // workers))
-    report = {'sources': lock, 'jobs': jobs, 'parallel_platforms': workers,
-              'targets': {}, 'package': 'not-built',
-              'runtime_tests': 'not performed; cross compilation and executable linking only'}
-    descriptor = args.results / 'nine-platform-results.json'
-
-    def save():
-        descriptor.write_text(json.dumps(report, indent=2) + '\n')
-
-    save()
-    print(f'Parallel platforms: {workers}; compile jobs per platform: {jobs}', flush=True)
-    with ThreadPoolExecutor(max_workers=workers) as executor:
-        pending = {executor.submit(build_target, rid, args, lock, jobs): rid for rid in RIDS}
-        for future in as_completed(pending):
-            report['targets'][pending[future]] = future.result()
-            save()
-
-    failed = [rid for rid in RIDS if not report['targets'][rid]['passed']]
-    if failed:
-        print('Failed platforms: ' + ', '.join(failed), flush=True)
-        return 1
-    os.environ['SOURCE_LOCK_JSON'] = json.dumps(lock)
-    os.environ['PACKAGE_VERSION'] = lock['skiasharp_version'] + '-' + lock['angle_branch'] + '.2'
-    logfile = args.results / 'pack.log'
-    status = run([sys.executable, 'scripts/apply-release-version.py'], logfile)
-    if status == 0:
-        status = run(['dotnet', 'pack', 'NuGet/StaticGraphics/StaticLink.Avalonia.csproj',
-                      '-c', 'Release', '-o', args.results / 'nuget'], logfile)
-    if status == 0:
-        package = next((args.results / 'nuget').glob('*.nupkg'))
-        with zipfile.ZipFile(package) as archive:
-            names = set(archive.namelist())
-        required = {'buildTransitive/StaticLink.Avalonia.props',
-                    'buildTransitive/StaticLink.Avalonia.targets'}
-        required.update('static/' + rid + '/native/' +
-                        ('skia.lib' if rid.startswith('win-') else 'libskia.a') for rid in RIDS)
-        if not required.issubset(names) or any('\\' in name for name in names):
-            print('NuGet package is missing target archives or has non-portable paths', flush=True)
-            status = 1
-    report['package'] = 'passed' if status == 0 else 'failed'
-    save()
-    print('Nine-platform build/link/package: ' + report['package'], flush=True)
-    return status
-
-
-if __name__ == '__main__':
-    raise SystemExit(main())