ghostty/.github/workflows/test.yml

on:
  push: {}
  pull_request: {}
  workflow_dispatch: {}

name: Test

# We only want the latest commit to test for any non-main ref.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref_name != 'main' && github.ref || github.run_id }}
  cancel-in-progress: true

jobs:
  # Determines whether other jobs should be skipped. Modify this if there
  # are other fast skip conditions, and add it as an output. Then modify
  # other tests `needs/if` to check them. Document the outputs.
  skip:
    if: github.repository == 'ghostty-org/ghostty'
    runs-on: namespace-profile-ghostty-xsm
    outputs:
      # 'true' when all changed files are non-code (e.g. only VOUCHED.td),
      # signaling that all other jobs can be skipped entirely.
      skip: ${{ steps.determine.outputs.skip }}
      # Path-based filters to gate specific linter/formatter jobs.
      actions_pins: ${{ steps.filter_any.outputs.actions_pins }}
      blueprints: ${{ steps.filter_any.outputs.blueprints }}
      macos: ${{ steps.filter_any.outputs.macos }}
      nix: ${{ steps.filter_any.outputs.nix }}
      shell: ${{ steps.filter_any.outputs.shell }}
      zig: ${{ steps.filter_any.outputs.zig }}

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
        id: filter_every
        with:
          token: ""
          predicate-quantifier: "every"
          filters: |
            code:
              - '**'
              - '!.github/VOUCHED.td'
      - uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
        id: filter_any
        with:
          token: ""
          filters: |
            macos:
              - '.swiftlint.yml'
              - 'macos/**'
            actions_pins:
              - '.github/workflows/**'
              - '.github/pinact.yml'
            shell:
              - '**/*.sh'
              - '**/*.bash'
            nix:
              - 'nix/**'
              - '*.nix'
              - 'flake.nix'
              - 'flake.lock'
              - 'default.nix'
              - 'shell.nix'
            zig:
              - '**/*.zig'
              - 'build.zig*'
            blueprints:
              - 'src/apprt/gtk/**/*.blp'
              - 'nix/build-support/check-blueprints.sh'

      - id: determine
        name: Determine skip
        run: |
          if [ "${{ steps.filter_every.outputs.code }}" = "false" ]; then
            echo "skip=true" >> "$GITHUB_OUTPUT"
          else
            echo "skip=false" >> "$GITHUB_OUTPUT"
          fi

  required:
    name: "Required Checks: Test"
    if: always()
    runs-on: namespace-profile-ghostty-xsm
    needs:
      - skip
      - build-bench
      - build-dist
      - build-dist-lib-vt
      - build-examples-zig
      - build-examples-cmake
      - build-examples-cmake-windows
      - build-examples-swift
      - build-cmake
      - build-flatpak
      - build-libghostty-vt
      - build-libghostty-vt-android
      - build-libghostty-vt-macos
      - build-libghostty-vt-windows
      - build-libghostty-windows-gnu
      - build-linux
      - build-linux-libghostty
      - build-nix
      # - build-nix-macos
      - build-macos
      - build-macos-xcode-27
      - build-macos-freetype
      - build-snap
      - test
      - test-simd
      - test-gtk
      - test-sentry-linux
      - test-i18n
      - test-fuzz-libghostty
      - test-lib-vt
      - test-lib-vt-pkgconfig
      - test-macos
      - test-windows
      - pinact
      - prettier
      - swiftlint
      - alejandra
      - typos
      - shellcheck
      - translations
      - blueprint-compiler
      - test-pkg-linux
      - test-debian-13
      - valgrind
      - zig-fmt

    steps:
      - id: status
        name: Determine status
        run: |
          results=$(tr -d '\n' <<< '${{ toJSON(needs.*.result) }}')
          if ! grep -q -v -E '(failure|cancelled)' <<< "$results"; then
            result="failed"
          else
            result="success"
          fi
          {
            echo "result=${result}"
            echo "results=${results}"
          } | tee -a "$GITHUB_OUTPUT"
      - if: always() && steps.status.outputs.result != 'success'
        name: Check for failed status
        run: |
          echo "One or more required build workflows failed: ${{ steps.status.outputs.results }}"
          exit 1

  build-bench:
    # We build benchmarks on large because it uses ReleaseFast
    runs-on: namespace-profile-ghostty-lg
    needs: test
    env:
      ZIG_LOCAL_CACHE_DIR: /zig/local-cache
      ZIG_GLOBAL_CACHE_DIR: /zig/global-cache
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Cache
        uses: namespacelabs/nscloud-cache-action@c5f8dab7560444c4bf8dbc64f1b203431873c547 # v1.6.1
        with:
          path: |
            /nix
            /zig

      # Install Nix and use that to run our tests so our environment matches exactly.
      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
        with:
          nix_path: nixpkgs=channel:nixos-unstable
      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        with:
          name: ghostty
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"

      - name: Build Benchmarks
        run: nix develop -c zig build -Demit-bench

  list-examples:
    if: github.repository == 'ghostty-org/ghostty' && needs.skip.outputs.skip != 'true'
    needs: skip
    runs-on: namespace-profile-ghostty-xsm
    outputs:
      zig: ${{ steps.list.outputs.zig }}
      cmake: ${{ steps.list.outputs.cmake }}
      swift: ${{ steps.list.outputs.swift }}
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - id: list
        name: List example directories
        run: |
          zig=$(ls example/*/build.zig.zon 2>/dev/null | xargs -n1 dirname | xargs -n1 basename | jq -R -s -c 'split("\n") | map(select(. != ""))')
          echo "$zig" | jq .
          echo "zig=$zig" >> "$GITHUB_OUTPUT"
          cmake=$(ls example/*/CMakeLists.txt 2>/dev/null | xargs -n1 dirname | xargs -n1 basename | jq -R -s -c 'split("\n") | map(select(. != ""))')
          echo "$cmake" | jq .
          echo "cmake=$cmake" >> "$GITHUB_OUTPUT"
          swift=$(ls example/*/Package.swift 2>/dev/null | xargs -n1 dirname | xargs -n1 basename | jq -R -s -c 'split("\n") | map(select(. != ""))')
          echo "$swift" | jq .
          echo "swift=$swift" >> "$GITHUB_OUTPUT"

  build-examples-zig:
    strategy:
      fail-fast: false
      matrix:
        dir: ${{ fromJSON(needs.list-examples.outputs.zig) }}
    name: Example ${{ matrix.dir }}
    runs-on: namespace-profile-ghostty-xsm
    needs: [test, list-examples]
    env:
      ZIG_LOCAL_CACHE_DIR: /zig/local-cache
      ZIG_GLOBAL_CACHE_DIR: /zig/global-cache
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Cache
        uses: namespacelabs/nscloud-cache-action@c5f8dab7560444c4bf8dbc64f1b203431873c547 # v1.6.1
        with:
          path: |
            /nix
            /zig

      # Install Nix and use that to run our tests so our environment matches exactly.
      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
        with:
          nix_path: nixpkgs=channel:nixos-unstable
      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        with:
          name: ghostty
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"

      - name: Build Example
        run: |
          cd example/${{ matrix.dir }}
          nix develop -c zig build

  build-examples-cmake:
    strategy:
      fail-fast: false
      matrix:
        dir: ${{ fromJSON(needs.list-examples.outputs.cmake) }}
    name: Example ${{ matrix.dir }}
    runs-on: namespace-profile-ghostty-xsm
    needs: [test, list-examples]
    env:
      ZIG_LOCAL_CACHE_DIR: /zig/local-cache
      ZIG_GLOBAL_CACHE_DIR: /zig/global-cache
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Cache
        uses: namespacelabs/nscloud-cache-action@c5f8dab7560444c4bf8dbc64f1b203431873c547 # v1.6.1
        with:
          path: |
            /nix
            /zig

      # Install Nix and use that to run our tests so our environment matches exactly.
      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
        with:
          nix_path: nixpkgs=channel:nixos-unstable
      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        with:
          name: ghostty
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"

      - name: Build Example
        run: |
          cd example/${{ matrix.dir }}
          nix develop -c cmake -B build -DFETCHCONTENT_SOURCE_DIR_GHOSTTY=${{ github.workspace }}
          nix develop -c cmake --build build

  build-examples-cmake-windows:
    strategy:
      fail-fast: false
      matrix:
        dir: ${{ fromJSON(needs.list-examples.outputs.cmake) }}
        exclude:
          # Cross-compilation with zig cc requires a single-config
          # generator (Makefiles/Ninja). The Windows CI uses Visual
          # Studio which always uses MSVC and ignores CMAKE_C_COMPILER.
          - dir: c-vt-cmake-cross
    name: Example ${{ matrix.dir }} (Windows)
    runs-on: namespace-profile-ghostty-windows
    timeout-minutes: 45
    needs: [test, list-examples]
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Install zig
        uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1

      - name: Build Example
        shell: pwsh
        run: |
          cd example/${{ matrix.dir }}
          cmake -B build -DFETCHCONTENT_SOURCE_DIR_GHOSTTY=${{ github.workspace }}
          cmake --build build

  build-examples-swift:
    strategy:
      fail-fast: false
      matrix:
        dir: ${{ fromJSON(needs.list-examples.outputs.swift) }}
    name: Example ${{ matrix.dir }}
    runs-on: namespace-profile-ghostty-macos-tahoe
    needs: [test, list-examples]
    env:
      ZIG_LOCAL_CACHE_DIR: /Users/runner/zig/local-cache
      ZIG_GLOBAL_CACHE_DIR: /Users/runner/zig/global-cache
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Cache
        uses: namespacelabs/nscloud-cache-action@c5f8dab7560444c4bf8dbc64f1b203431873c547 # v1.6.1
        with:
          cache: |
            xcode
          path: |
            /Users/runner/zig

      # TODO(tahoe): https://github.com/NixOS/nix/issues/13342
      - uses: DeterminateSystems/nix-installer-action@main
        with:
          determinate: true
      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        with:
          name: ghostty
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"

      - name: Xcode Select
        run: sudo xcode-select -s /Applications/Xcode_26.6.app

      - name: Build XCFramework
        run: nix develop -c zig build -Demit-lib-vt

      - name: Verify XCFramework artifact
        run: test -f zig-out/lib/ghostty-vt.xcframework/Info.plist

      - name: Build and Run Example
        run: |
          cd example/${{ matrix.dir }}
          swift run

  build-cmake:
    runs-on: namespace-profile-ghostty-sm
    needs: test
    env:
      ZIG_LOCAL_CACHE_DIR: /zig/local-cache
      ZIG_GLOBAL_CACHE_DIR: /zig/global-cache
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Cache
        uses: namespacelabs/nscloud-cache-action@c5f8dab7560444c4bf8dbc64f1b203431873c547 # v1.6.1
        with:
          path: |
            /nix
            /zig

      # Install Nix and use that to run our tests so our environment matches exactly.
      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
        with:
          nix_path: nixpkgs=channel:nixos-unstable
      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        with:
          name: ghostty
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"

      - name: Build
        run: |
          nix develop -c cmake -B build
          nix develop -c cmake --build build

      - name: Verify artifacts
        run: |
          test -f zig-out/lib/libghostty-vt.so.0.1.0
          test -d zig-out/include/ghostty
          ls -la zig-out/lib/
          ls -la zig-out/include/ghostty/

  test-lib-vt-pkgconfig:
    runs-on: namespace-profile-ghostty-sm
    needs: test
    env:
      ZIG_LOCAL_CACHE_DIR: /zig/local-cache
      ZIG_GLOBAL_CACHE_DIR: /zig/global-cache
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Cache
        uses: namespacelabs/nscloud-cache-action@c5f8dab7560444c4bf8dbc64f1b203431873c547 # v1.6.1
        with:
          path: |
            /nix
            /zig

      # Install Nix and use that to run our tests so our environment matches exactly.
      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
        with:
          nix_path: nixpkgs=channel:nixos-unstable
      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        with:
          name: ghostty
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"

      - name: Build libghostty-vt
        run: nix develop -c zig build -Demit-lib-vt

      - name: Verify pkg-config file
        run: |
          export PKG_CONFIG_PATH="$PWD/zig-out/share/pkgconfig"
          pkg-config --validate libghostty-vt
          echo "Cflags: $(pkg-config --cflags libghostty-vt)"
          echo "Libs:   $(pkg-config --libs libghostty-vt)"
          echo "Static: $(pkg-config --libs --static libghostty-vt)"

          # Libs.private must NOT include the C++ runtime libraries (all
          # vendored C++ deps are built in no-libcxx mode).
          ! pkg-config --libs --static libghostty-vt | grep -qE -- '-lc\+\+|-lc\+\+abi'

      - name: Verify shared library has no libc++ dependency
        run: |
          ldd zig-out/lib/libghostty-vt.so.0.1.0
          ! ldd zig-out/lib/libghostty-vt.so.0.1.0 2>/dev/null | grep -qE 'libc\+\+|libc\+\+abi'

      - name: Verify static archive contains SIMD deps
        run: |
          nm -g zig-out/lib/libghostty-vt.a | grep -q ' T .*simdutf'
          nm -g zig-out/lib/libghostty-vt.a | grep -q ' T .*3hwy'

      - name: Write test program
        run: |
          cat > /tmp/test_libghostty_vt.c << 'TESTEOF'
          #include <ghostty/vt.h>
          #include <stdio.h>
          int main(void) {
              bool simd = false;
              GhosttyResult r = ghostty_build_info(GHOSTTY_BUILD_INFO_SIMD, &simd);
              if (r != GHOSTTY_SUCCESS) return 1;
              printf("SIMD: %s\n", simd ? "yes" : "no");
              return 0;
          }
          TESTEOF

      - name: Test shared link via pkg-config
        run: |
          export PKG_CONFIG_PATH="$PWD/zig-out/share/pkgconfig"
          nix develop -c cc -o /tmp/test_shared /tmp/test_libghostty_vt.c \
            $(pkg-config --cflags --libs libghostty-vt) \
            -Wl,-rpath,"$PWD/zig-out/lib"
          /tmp/test_shared

      - name: Test static link via pkg-config
        run: |
          export PKG_CONFIG_PATH="$PWD/zig-out/share/pkgconfig"
          # The static archive must link cleanly into a plain C program
          # without any extra C++ runtime flags.
          nix develop -c cc -o /tmp/test_static /tmp/test_libghostty_vt.c \
            $(pkg-config --cflags libghostty-vt) \
            "$PWD/zig-out/lib/libghostty-vt.a" \
            $(pkg-config --libs-only-l --static libghostty-vt | sed 's/-lghostty-vt//')
          /tmp/test_static
          # Verify it doesn't depend on the shared lib or a C++ runtime.
          ! ldd /tmp/test_static 2>/dev/null | grep -qE 'libghostty-vt|libc\+\+|libc\+\+abi'

      # Test system integration: rebuild with -Dsystem-simdutf=true so
      # simdutf comes from the system instead of being vendored. This
      # verifies the .pc file uses Requires.private for system deps and
      # the fat archive only bundles the remaining vendored deps.
      - name: Rebuild with system simdutf
        run: |
          rm -rf zig-out
          nix develop -c zig build -Demit-lib-vt -fsys=simdutf

      - name: Verify pkg-config with system simdutf
        run: |
          export PKG_CONFIG_PATH="$PWD/zig-out/share/pkgconfig"
          pc_content=$(cat zig-out/share/pkgconfig/libghostty-vt.pc)
          echo "$pc_content"

          # Requires.private must reference simdutf
          echo "$pc_content" | grep -q 'Requires.private:.*simdutf'

          # Requires.private must NOT reference libhwy (still vendored)
          ! echo "$pc_content" | grep -q 'Requires.private:.*libhwy'

      - name: Verify archive with system simdutf
        run: |
          # simdutf symbols must NOT be defined (comes from system)
          ! nm -g zig-out/lib/libghostty-vt.a | grep -q ' T .*simdutf'

          # highway symbols must still be defined (vendored)
          nm -g zig-out/lib/libghostty-vt.a | grep -q ' T .*3hwy'

  build-flatpak:
    strategy:
      fail-fast: false
    runs-on: namespace-profile-ghostty-sm
    needs: test
    env:
      ZIG_LOCAL_CACHE_DIR: /zig/local-cache
      ZIG_GLOBAL_CACHE_DIR: /zig/global-cache
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Cache
        uses: namespacelabs/nscloud-cache-action@c5f8dab7560444c4bf8dbc64f1b203431873c547 # v1.6.1
        with:
          path: |
            /nix
            /zig

      # Install Nix and use that to run our tests so our environment matches exactly.
      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
        with:
          nix_path: nixpkgs=channel:nixos-unstable
      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        with:
          name: ghostty
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"

      - name: Build with Flatpak
        run: |
          nix develop -c \
            zig build \
            -Dflatpak

  build-snap:
    strategy:
      fail-fast: false
    runs-on: namespace-profile-ghostty-sm
    needs: test
    env:
      ZIG_LOCAL_CACHE_DIR: /zig/local-cache
      ZIG_GLOBAL_CACHE_DIR: /zig/global-cache
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Cache
        uses: namespacelabs/nscloud-cache-action@c5f8dab7560444c4bf8dbc64f1b203431873c547 # v1.6.1
        with:
          path: |
            /nix
            /zig

      # Install Nix and use that to run our tests so our environment matches exactly.
      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
        with:
          nix_path: nixpkgs=channel:nixos-unstable
      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        with:
          name: ghostty
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"

      - name: Build with Snap
        run: |
          nix develop -c \
            zig build \
            -Dsnap

  build-libghostty-vt:
    strategy:
      matrix:
        target: [
            aarch64-macos,
            x86_64-macos,
            aarch64-linux,
            x86_64-linux,
            x86_64-linux-musl,
            x86_64-windows-gnu,
            # doesn't work yet, we need a way to find msvc libc/c++ headers
            # x86_64-windows-msvc
            wasm32-freestanding,
          ]
    runs-on: namespace-profile-ghostty-sm
    needs: test
    env:
      ZIG_LOCAL_CACHE_DIR: /zig/local-cache
      ZIG_GLOBAL_CACHE_DIR: /zig/global-cache
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Cache
        uses: namespacelabs/nscloud-cache-action@c5f8dab7560444c4bf8dbc64f1b203431873c547 # v1.6.1
        with:
          path: |
            /nix
            /zig

      # Install Nix and use that to run our tests so our environment matches exactly.
      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
        with:
          nix_path: nixpkgs=channel:nixos-unstable
      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        with:
          name: ghostty
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"

      - name: Build
        run: |
          nix develop -c zig build -Demit-lib-vt \
            -Dtarget=${{ matrix.target }}

  # lib-vt requires macOS runner for macOS/iOS builds because it requires the `apple_sdk` path
  build-libghostty-vt-macos:
    strategy:
      matrix:
        include:
          - target: aarch64-macos
            platform: 1
            arch: arm64
            expect_encryption: false
          - target: x86_64-macos
            platform: 1
            arch: x86_64
            expect_encryption: false
          - target: aarch64-ios
            platform: 2
            arch: arm64
            expect_encryption: true
          - target: aarch64-ios-simulator
            platform: 7
            arch: arm64
            expect_encryption: false
    runs-on: namespace-profile-ghostty-macos-tahoe
    needs: test
    env:
      ZIG_LOCAL_CACHE_DIR: /Users/runner/zig/local-cache
      ZIG_GLOBAL_CACHE_DIR: /Users/runner/zig/global-cache
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Cache
        uses: namespacelabs/nscloud-cache-action@c5f8dab7560444c4bf8dbc64f1b203431873c547 # v1.6.1
        with:
          cache: |
            xcode
          path: |
            /Users/runner/zig

      # TODO(tahoe): https://github.com/NixOS/nix/issues/13342
      - uses: DeterminateSystems/nix-installer-action@main
        with:
          determinate: true
      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        with:
          name: ghostty
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"

      - name: Xcode Select
        run: sudo xcode-select -s /Applications/Xcode_26.6.app

      - name: Build
        run: |
          nix develop -c zig build -Demit-lib-vt \
            -Dtarget=${{ matrix.target }}

      - name: Verify Apple dylib
        run: |
          nix develop -c nu .github/scripts/check-apple-libghostty-vt.nu \
            zig-out/lib/libghostty-vt.dylib \
            --expect-platform ${{ matrix.platform }} \
            --expect-arch ${{ matrix.arch }} \
            ${{ matrix.expect_encryption && '--expect-encryption' || '' }}

  # lib-vt requires the Android NDK for Android builds
  build-libghostty-vt-android:
    strategy:
      matrix:
        target:
          [aarch64-linux-android, x86_64-linux-android, arm-linux-androideabi]
    runs-on: namespace-profile-ghostty-sm
    needs: test
    env:
      ZIG_LOCAL_CACHE_DIR: /zig/local-cache
      ZIG_GLOBAL_CACHE_DIR: /zig/global-cache
      ANDROID_NDK_VERSION: r29
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Cache
        uses: namespacelabs/nscloud-cache-action@c5f8dab7560444c4bf8dbc64f1b203431873c547 # v1.6.1
        with:
          path: |
            /nix
            /zig

      # Install Nix and use that to run our tests so our environment matches exactly.
      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
        with:
          nix_path: nixpkgs=channel:nixos-unstable
      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        with:
          name: ghostty
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"

      - name: Setup Android NDK
        uses: nttld/setup-ndk@ed92fe6cadad69be94a966a7ee3271275e62f779 # v1.6.0
        id: setup-ndk
        with:
          ndk-version: r29
          add-to-path: false
          link-to-sdk: false
          local-cache: true

      - name: Build
        run: |
          nix develop -c zig build -Demit-lib-vt \
            -Dtarget=${{ matrix.target }}
        env:
          ANDROID_NDK_HOME: ${{ steps.setup-ndk.outputs.ndk-path }}

  build-libghostty-vt-windows:
    runs-on: namespace-profile-ghostty-windows
    timeout-minutes: 45
    needs: test
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Zig
        uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1

      - name: Test libghostty-vt
        run: zig build test-lib-vt

      - name: Build libghostty-vt
        run: zig build -Demit-lib-vt

  build-libghostty-windows-gnu:
    runs-on: namespace-profile-ghostty-windows
    timeout-minutes: 45
    needs: test
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Zig
        uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1

      - name: Build libghostty (GNU ABI)
        run: zig build -Dtarget=native-native-gnu -Dapp-runtime=none

  build-linux:
    strategy:
      fail-fast: false
      matrix:
        os: [namespace-profile-ghostty-md, namespace-profile-ghostty-md-arm64]
    runs-on: ${{ matrix.os }}
    needs: test
    env:
      ZIG_LOCAL_CACHE_DIR: /zig/local-cache
      ZIG_GLOBAL_CACHE_DIR: /zig/global-cache
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Cache
        uses: namespacelabs/nscloud-cache-action@c5f8dab7560444c4bf8dbc64f1b203431873c547 # v1.6.1
        with:
          path: |
            /nix
            /zig

      # Install Nix and use that to run our tests so our environment matches exactly.
      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
        with:
          nix_path: nixpkgs=channel:nixos-unstable
      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        with:
          name: ghostty
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"

      - name: Test Build
        run: nix develop -c zig build

  build-linux-libghostty:
    runs-on: namespace-profile-ghostty-md
    needs: test
    env:
      ZIG_LOCAL_CACHE_DIR: /zig/local-cache
      ZIG_GLOBAL_CACHE_DIR: /zig/global-cache
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Cache
        uses: namespacelabs/nscloud-cache-action@c5f8dab7560444c4bf8dbc64f1b203431873c547 # v1.6.1
        with:
          path: |
            /nix
            /zig

      # Install Nix and use that to run our tests so our environment matches exactly.
      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
        with:
          nix_path: nixpkgs=channel:nixos-unstable
      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        with:
          name: ghostty
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"

      - name: Build Libghostty
        run: nix develop -c zig build -Dapp-runtime=none

  build-nix:
    strategy:
      fail-fast: false
      matrix:
        os: [namespace-profile-ghostty-md, namespace-profile-ghostty-md-arm64]
    runs-on: ${{ matrix.os }}
    needs: test
    env:
      ZIG_LOCAL_CACHE_DIR: /zig/local-cache
      ZIG_GLOBAL_CACHE_DIR: /zig/global-cache
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Cache
        uses: namespacelabs/nscloud-cache-action@c5f8dab7560444c4bf8dbc64f1b203431873c547 # v1.6.1
        with:
          path: |
            /nix
            /zig

      # Install Nix and use that to run our tests so our environment matches exactly.
      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
        with:
          nix_path: nixpkgs=channel:nixos-unstable
      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        with:
          name: ghostty
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"

      - name: Test release NixOS package build
        run: nix build .#ghostty-releasefast

      - name: Check version
        run: result/bin/ghostty +version | grep -q '.ReleaseFast'

      - name: Check to see if the binary has been stripped
        run: nm result/bin/.ghostty-wrapped 2>&1 | grep -q 'no symbols'

      - name: Test debug NixOS package build
        run: nix build .#ghostty-debug

      - name: Check version
        run: result/bin/ghostty +version | grep -q '.Debug'

      - name: Check to see if the binary has not been stripped
        run: nm result/bin/.ghostty-wrapped 2>&1 | grep -q 'main_ghostty.main'

      - name: Test ReleaseFast build of libghostty-vt
        run: |
          nix build .#libghostty-vt-releasefast
          nix build .#libghostty-vt-releasefast.tests.sanity-check
          nix build .#libghostty-vt-releasefast.tests.pkg-config
          nix build .#libghostty-vt-releasefast.tests.build-with-shared
          nix build .#libghostty-vt-releasefast.tests.build-with-static
          nix build .#libghostty-vt-releasefast.tests.build-example-c-vt-build-info

      - name: Test ReleaseFast (no SIMD) build of libghostty-vt
        run: |
          nix build .#libghostty-vt-releasefast-no-simd
          nix build .#libghostty-vt-releasefast-no-simd.tests.sanity-check
          nix build .#libghostty-vt-releasefast-no-simd.tests.pkg-config
          nix build .#libghostty-vt-releasefast-no-simd.tests.build-with-shared
          nix build .#libghostty-vt-releasefast-no-simd.tests.build-with-static
          nix build .#libghostty-vt-releasefast-no-simd.tests.build-example-c-vt-build-info

      - name: Test Debug build of libghostty-vt
        run: |
          nix build .#libghostty-vt-debug
          nix build .#libghostty-vt-debug.tests.sanity-check
          nix build .#libghostty-vt-debug.tests.pkg-config
          nix build .#libghostty-vt-debug.tests.build-with-shared
          nix build .#libghostty-vt-debug.tests.build-with-static
          nix build .#libghostty-vt-debug.tests.build-example-c-vt-build-info

      - name: Test Debug (no SIMD) build of libghostty-vt
        run: |
          nix build .#libghostty-vt-debug-no-simd
          nix build .#libghostty-vt-debug-no-simd.tests.sanity-check
          nix build .#libghostty-vt-debug-no-simd.tests.pkg-config
          nix build .#libghostty-vt-debug-no-simd.tests.build-with-shared
          nix build .#libghostty-vt-debug-no-simd.tests.build-with-static
          nix build .#libghostty-vt-debug-no-simd.tests.build-example-c-vt-build-info

  build-dist:
    runs-on: namespace-profile-ghostty-sm
    needs: test
    outputs:
      artifact-id: ${{ steps.upload-artifact.outputs.artifact-id }}
    env:
      ZIG_LOCAL_CACHE_DIR: /zig/local-cache
      ZIG_GLOBAL_CACHE_DIR: /zig/global-cache
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Cache
        uses: namespacelabs/nscloud-cache-action@c5f8dab7560444c4bf8dbc64f1b203431873c547 # v1.6.1
        with:
          path: |
            /nix
            /zig

      # Install Nix and use that to run our tests so our environment matches exactly.
      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
        with:
          nix_path: nixpkgs=channel:nixos-unstable
      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        with:
          name: ghostty
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"

      - name: Build and Check Source Tarball
        run: |
          rm -rf zig-out/dist
          nix develop -c zig build distcheck
          cp zig-out/dist/*.tar.gz ghostty-source.tar.gz

      - name: Upload artifact
        id: upload-artifact
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: source-tarball
          path: |-
            ghostty-source.tar.gz

  build-dist-lib-vt:
    runs-on: namespace-profile-ghostty-sm
    needs: test
    env:
      ZIG_LOCAL_CACHE_DIR: /zig/local-cache
      ZIG_GLOBAL_CACHE_DIR: /zig/global-cache
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Cache
        uses: namespacelabs/nscloud-cache-action@c5f8dab7560444c4bf8dbc64f1b203431873c547 # v1.6.1
        with:
          path: |
            /nix
            /zig

      # Install Nix and use that to run our tests so our environment matches exactly.
      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
        with:
          nix_path: nixpkgs=channel:nixos-unstable
      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        with:
          name: ghostty
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"

      - name: Build and Check Source Tarball
        run: |
          rm -rf zig-out/dist
          nix develop -c zig build distcheck -Demit-lib-vt=true

      - name: Verify tarball size
        run: |
          tarball=$(ls zig-out/dist/*.tar.gz)
          size=$(stat --format=%s "$tarball")
          max=$((5 * 1024 * 1024))
          echo "Tarball size: $size bytes (max: $max)"
          if [ "$size" -gt "$max" ]; then
            echo "ERROR: tarball exceeds 5 MB"
            exit 1
          fi

  trigger-snap:
    if: github.event_name != 'pull_request'
    runs-on: namespace-profile-ghostty-xsm
    needs: [build-dist, build-snap]
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Trigger Snap workflow
        run: |
          gh workflow run \
            snap.yml \
            --ref ${{ github.ref_name || 'main' }} \
            --field source-run-id=${{ github.run_id }} \
            --field source-artifact-id=${{ needs.build-dist.outputs.artifact-id }}
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  trigger-flatpak:
    if: github.event_name != 'pull_request'
    runs-on: namespace-profile-ghostty-xsm
    needs: [build-dist, build-flatpak]
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Trigger Flatpak workflow
        run: |
          gh workflow run \
            flatpak.yml \
            --ref ${{ github.ref_name || 'main' }} \
            --field source-run-id=${{ github.run_id }} \
            --field source-artifact-id=${{ needs.build-dist.outputs.artifact-id }}
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  # build-nix-macos:
  #   runs-on: namespace-profile-ghostty-macos-tahoe
  #   needs: test
  #   steps:
  #     - name: Checkout code
  #       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

  #     # Install Nix and use that to run our tests so our environment matches exactly.
  #     - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
  #       with:
  #         nix_path: nixpkgs=channel:nixos-unstable
  #     - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
  #       with:
  #         name: ghostty
  #         authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"

  #     - name: Test ReleaseFast build of libghostty-vt
  #       run: |
  #         nix build .#libghostty-vt-releasefast
  #         nix build .#libghostty-vt-releasefast.tests.sanity-check
  #         nix build .#libghostty-vt-releasefast.tests.pkg-config
  #         nix build .#libghostty-vt-releasefast.tests.build-with-shared
  #         nix build .#libghostty-vt-releasefast.tests.build-with-static
  #         nix build .#libghostty-vt-releasefast.tests.build-example-c-vt-build-info

  #     - name: Test ReleaseFast (no SIMD) build of libghostty-vt
  #       run: |
  #         nix build .#libghostty-vt-releasefast-no-simd
  #         nix build .#libghostty-vt-releasefast-no-simd.tests.sanity-check
  #         nix build .#libghostty-vt-releasefast-no-simd.tests.pkg-config
  #         nix build .#libghostty-vt-releasefast-no-simd.tests.build-with-shared
  #         nix build .#libghostty-vt-releasefast-no-simd.tests.build-with-static
  #         nix build .#libghostty-vt-releasefast-no-simd.tests.build-example-c-vt-build-info

  #     - name: Test Debug build of libghostty-vt
  #       run: |
  #         nix build .#libghostty-vt-debug
  #         nix build .#libghostty-vt-debug.tests.sanity-check
  #         nix build .#libghostty-vt-debug.tests.pkg-config
  #         nix build .#libghostty-vt-debug.tests.build-with-shared
  #         nix build .#libghostty-vt-debug.tests.build-with-static
  #         nix build .#libghostty-vt-debug.tests.build-example-c-vt-build-info

  #     - name: Test Debug (no SIMD) build of libghostty-vt
  #       run: |
  #         nix build .#libghostty-vt-debug-no-simd
  #         nix build .#libghostty-vt-debug-no-simd.tests.sanity-check
  #         nix build .#libghostty-vt-debug-no-simd.tests.pkg-config
  #         nix build .#libghostty-vt-debug-no-simd.tests.build-with-shared
  #         nix build .#libghostty-vt-debug-no-simd.tests.build-with-static
  #         nix build .#libghostty-vt-debug-no-simd.tests.build-example-c-vt-build-info

  build-macos:
    runs-on: namespace-profile-ghostty-macos-tahoe
    needs: test
    env:
      ZIG_LOCAL_CACHE_DIR: /Users/runner/zig/local-cache
      ZIG_GLOBAL_CACHE_DIR: /Users/runner/zig/global-cache
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Cache
        uses: namespacelabs/nscloud-cache-action@c5f8dab7560444c4bf8dbc64f1b203431873c547 # v1.6.1
        with:
          cache: |
            xcode
          path: |
            /Users/runner/zig

      # TODO(tahoe): https://github.com/NixOS/nix/issues/13342
      - uses: DeterminateSystems/nix-installer-action@main
        with:
          determinate: true
      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        with:
          name: ghostty
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"

      - name: Xcode Select
        run: sudo xcode-select -s /Applications/Xcode_26.6.app

      - name: Xcode Version
        run: xcodebuild -version

      - name: get the Zig deps
        id: deps
        run: nix build -L .#deps && echo "deps=$(readlink ./result)" >> $GITHUB_OUTPUT

      # GhosttyKit is the framework that is built from Zig for our native
      # Mac app to access.
      - name: Build GhosttyKit
        run: nix develop -c zig build --system ${{ steps.deps.outputs.deps }} -Demit-macos-app=false

      # The native app is built with native Xcode tooling. This also does
      # codesigning. IMPORTANT: this must NOT run in a Nix environment.
      # Nix breaks xcodebuild so this has to be run outside.
      - name: Build Ghostty.app
        run: |
          cd macos
          xcodebuild -target Ghostty \
            COMPILATION_CACHE_CAS_PATH=/Users/runner/Library/Developer/Xcode/DerivedData/CompilationCache.noindex \
            COMPILATION_CACHE_KEEP_CAS_DIRECTORY=YES

      # Build the iOS target without code signing just to verify it works.
      - name: Build Ghostty iOS
        run: |
          cd macos
          xcodebuild -target Ghostty-iOS "CODE_SIGNING_ALLOWED=NO" \
            COMPILATION_CACHE_CAS_PATH=/Users/runner/Library/Developer/Xcode/DerivedData/CompilationCache.noindex \
            COMPILATION_CACHE_KEEP_CAS_DIRECTORY=YES

  build-macos-xcode-27:
    runs-on: namespace-profile-ghostty-macos-tahoe
    needs: test
    env:
      ZIG_LOCAL_CACHE_DIR: /Users/runner/zig/local-cache
      ZIG_GLOBAL_CACHE_DIR: /Users/runner/zig/global-cache
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Cache
        uses: namespacelabs/nscloud-cache-action@c5f8dab7560444c4bf8dbc64f1b203431873c547 # v1.6.1
        with:
          cache: |
            xcode
          path: |
            /Users/runner/zig

      # TODO(tahoe): https://github.com/NixOS/nix/issues/13342
      - uses: DeterminateSystems/nix-installer-action@main
        with:
          determinate: true
      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        with:
          name: ghostty
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"

      - name: Xcode Select
        run: sudo xcode-select -s /Applications/Xcode_27.app

      - name: Xcode Version
        run: xcodebuild -version

      - name: get the Zig deps
        id: deps
        run: nix build -L .#deps && echo "deps=$(readlink ./result)" >> $GITHUB_OUTPUT

      - name: Build with Xcode 27
        run: nix develop -c zig build --system ${{ steps.deps.outputs.deps }} -Demit-macos-app=false

  build-macos-freetype:
    runs-on: namespace-profile-ghostty-macos-tahoe
    needs: test
    env:
      ZIG_LOCAL_CACHE_DIR: /Users/runner/zig/local-cache
      ZIG_GLOBAL_CACHE_DIR: /Users/runner/zig/global-cache
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Cache
        uses: namespacelabs/nscloud-cache-action@c5f8dab7560444c4bf8dbc64f1b203431873c547 # v1.6.1
        with:
          cache: |
            xcode
          path: |
            /Users/runner/zig

      # TODO(tahoe): https://github.com/NixOS/nix/issues/13342
      - uses: DeterminateSystems/nix-installer-action@main
        with:
          determinate: true
      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        with:
          name: ghostty
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"

      - name: Xcode Select
        run: sudo xcode-select -s /Applications/Xcode_26.6.app

      - name: Xcode Version
        run: xcodebuild -version

      - name: get the Zig deps
        id: deps
        run: nix build -L .#deps && echo "deps=$(readlink ./result)" >> $GITHUB_OUTPUT

      # We run tests with an empty test filter so it runs all unit tests
      # but skips Xcode tests
      - name: Test All
        run: |
          nix develop -c zig build test --system ${{ steps.deps.outputs.deps }} -Drenderer=metal -Dfont-backend=coretext_freetype -Dtest-filter=""

      - name: Build All
        run: |
          nix develop -c zig build --system ${{ steps.deps.outputs.deps }} -Demit-macos-app=false -Drenderer=metal -Dfont-backend=coretext_freetype

  test:
    if: github.repository == 'ghostty-org/ghostty' && needs.skip.outputs.skip != 'true'
    needs: skip
    runs-on: namespace-profile-ghostty-md
    outputs:
      zig_version: ${{ steps.zig.outputs.version }}
    env:
      ZIG_LOCAL_CACHE_DIR: /zig/local-cache
      ZIG_GLOBAL_CACHE_DIR: /zig/global-cache
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Get required Zig version
        id: zig
        run: |
          echo "version=$(sed -n -E 's/^\s*\.?minimum_zig_version\s*=\s*"([^"]+)".*/\1/p' build.zig.zon)" >> $GITHUB_OUTPUT

      - name: Setup Cache
        uses: namespacelabs/nscloud-cache-action@c5f8dab7560444c4bf8dbc64f1b203431873c547 # v1.6.1
        with:
          path: |
            /nix
            /zig

      # Install Nix and use that to run our tests so our environment matches exactly.
      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
        with:
          nix_path: nixpkgs=channel:nixos-unstable
      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        with:
          name: ghostty
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"

      - name: test
        run: nix develop -c zig build -Dapp-runtime=none test

      - name: Test GTK Build
        run: nix develop -c zig build -Dapp-runtime=gtk -Demit-docs -Demit-webdata

        # NOTE: This used to point to the Zig global cache directory before
        # 0.16.0. Now, the cache directory exclusively stores "minified"
        # archives of each dependency (i.e., only the paths defined in
        # build.zig.zon), and an uncompressed, working copy is stored in
        # PROJECT_ROOT/zig-pkg. The zig-pkg directory is warmed up during the
        # regular fetching process from the global cache directory if
        # possible.
        #
        # Nothing else should change; zon2nix's store path mimics what a
        # zig-pkg directory should look like, so actual build steps should be
        # fine, it's just here where we assume that all dependencies have been
        # downloaded, and we want to test the validity of the package
        # directory, do we need to have it pointing to zig-pkg and not the
        # zon2nix store path.
        #
        # Note that this can also be attempted by running:
        #   zig build --fetch=needed
        #
        # Note that --system PKGDIR should not be added to this invocation as
        # it disables fetching altogether (even, seemingly, from the local
        # cache).
      - name: Test System Build
        run: nix develop -c zig build --system "$(realpath zig-pkg)"

  test-lib-vt:
    if: github.repository == 'ghostty-org/ghostty' && needs.skip.outputs.skip != 'true'
    needs: skip
    runs-on: namespace-profile-ghostty-md
    env:
      ZIG_LOCAL_CACHE_DIR: /zig/local-cache
      ZIG_GLOBAL_CACHE_DIR: /zig/global-cache
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Cache
        uses: namespacelabs/nscloud-cache-action@c5f8dab7560444c4bf8dbc64f1b203431873c547 # v1.6.1
        with:
          path: |
            /nix
            /zig

      # Install Nix and use that to run our tests so our environment matches exactly.
      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
        with:
          nix_path: nixpkgs=channel:nixos-unstable
      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        with:
          name: ghostty
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"

      - name: Test
        run: nix develop -c zig build test-lib-vt

  test-gtk:
    strategy:
      fail-fast: false
      matrix:
        x11: ["true", "false"]
        wayland: ["true", "false"]
    name: GTK x11=${{ matrix.x11 }} wayland=${{ matrix.wayland }}
    runs-on: namespace-profile-ghostty-sm
    needs: test
    env:
      ZIG_LOCAL_CACHE_DIR: /zig/local-cache
      ZIG_GLOBAL_CACHE_DIR: /zig/global-cache
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Cache
        uses: namespacelabs/nscloud-cache-action@c5f8dab7560444c4bf8dbc64f1b203431873c547 # v1.6.1
        with:
          path: |
            /nix
            /zig

      # Install Nix and use that to run our tests so our environment matches exactly.
      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
        with:
          nix_path: nixpkgs=channel:nixos-unstable
      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        with:
          name: ghostty
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"

      - name: Test
        run: |
          nix develop -c \
            zig build \
            -Dapp-runtime=gtk \
            -Dgtk-x11=${{ matrix.x11 }} \
            -Dgtk-wayland=${{ matrix.wayland }} \
            test

      - name: Build
        run: |
          nix develop -c \
            zig build \
            -Dapp-runtime=gtk \
            -Dgtk-x11=${{ matrix.x11 }} \
            -Dgtk-wayland=${{ matrix.wayland }}

  test-simd:
    strategy:
      fail-fast: false
      matrix:
        simd: ["true", "false"]
    name: Build -Dsimd=${{ matrix.simd }}
    runs-on: namespace-profile-ghostty-sm
    needs: test
    env:
      ZIG_LOCAL_CACHE_DIR: /zig/local-cache
      ZIG_GLOBAL_CACHE_DIR: /zig/global-cache
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Cache
        uses: namespacelabs/nscloud-cache-action@c5f8dab7560444c4bf8dbc64f1b203431873c547 # v1.6.1
        with:
          path: |
            /nix
            /zig

      # Install Nix and use that to run our tests so our environment matches exactly.
      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
        with:
          nix_path: nixpkgs=channel:nixos-unstable
      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        with:
          name: ghostty
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"

      - name: Test
        run: |
          nix develop -c zig build test -Dsimd=${{ matrix.simd }}

  test-sentry-linux:
    strategy:
      fail-fast: false
      matrix:
        sentry: ["true", "false"]
    name: Build -Dsentry=${{ matrix.sentry }}
    runs-on: namespace-profile-ghostty-sm
    needs: test
    env:
      ZIG_LOCAL_CACHE_DIR: /zig/local-cache
      ZIG_GLOBAL_CACHE_DIR: /zig/global-cache
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Cache
        uses: namespacelabs/nscloud-cache-action@c5f8dab7560444c4bf8dbc64f1b203431873c547 # v1.6.1
        with:
          path: |
            /nix
            /zig

      # Install Nix and use that to run our tests so our environment matches exactly.
      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
        with:
          nix_path: nixpkgs=channel:nixos-unstable
      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        with:
          name: ghostty
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"

      - name: Test Sentry Build
        run: |
          nix develop -c zig build -Dsentry=${{ matrix.sentry }}

  test-macos:
    runs-on: namespace-profile-ghostty-macos-tahoe
    needs: test
    env:
      ZIG_LOCAL_CACHE_DIR: /Users/runner/zig/local-cache
      ZIG_GLOBAL_CACHE_DIR: /Users/runner/zig/global-cache
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Cache
        uses: namespacelabs/nscloud-cache-action@c5f8dab7560444c4bf8dbc64f1b203431873c547 # v1.6.1
        with:
          cache: |
            xcode
          path: |
            /Users/runner/zig

      # TODO(tahoe): https://github.com/NixOS/nix/issues/13342
      - uses: DeterminateSystems/nix-installer-action@main
        with:
          determinate: true
      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        with:
          name: ghostty
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"

      - name: Xcode Select
        run: sudo xcode-select -s /Applications/Xcode_26.6.app

      - name: Xcode Version
        run: xcodebuild -version

      - name: get the Zig deps
        id: deps
        run: nix build -L .#deps && echo "deps=$(readlink ./result)" >> $GITHUB_OUTPUT

      - name: test
        run: nix develop -c zig build test --system ${{ steps.deps.outputs.deps }}

  test-windows:
    if: github.repository == 'ghostty-org/ghostty' && needs.skip.outputs.skip != 'true'
    needs: skip
    runs-on: namespace-profile-ghostty-windows
    timeout-minutes: 45
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Zig
        uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1

      - name: Test
        run: zig build -Dapp-runtime=none test

  test-i18n:
    strategy:
      fail-fast: false
      matrix:
        i18n: ["true", "false"]
    name: Build -Di18n=${{ matrix.i18n }}
    runs-on: namespace-profile-ghostty-sm
    needs: test
    env:
      ZIG_LOCAL_CACHE_DIR: /zig/local-cache
      ZIG_GLOBAL_CACHE_DIR: /zig/global-cache
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Cache
        uses: namespacelabs/nscloud-cache-action@c5f8dab7560444c4bf8dbc64f1b203431873c547 # v1.6.1
        with:
          path: |
            /nix
            /zig

      # Install Nix and use that to run our tests so our environment matches exactly.
      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
        with:
          nix_path: nixpkgs=channel:nixos-unstable
      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        with:
          name: ghostty
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"

      - name: Test
        run: |
          nix develop -c zig build -Di18n=${{ matrix.i18n }}

  test-fuzz-libghostty:
    name: Build test/fuzz-libghostty
    runs-on: namespace-profile-ghostty-sm
    needs: test
    env:
      ZIG_LOCAL_CACHE_DIR: /zig/local-cache
      ZIG_GLOBAL_CACHE_DIR: /zig/global-cache
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Cache
        uses: namespacelabs/nscloud-cache-action@c5f8dab7560444c4bf8dbc64f1b203431873c547 # v1.6.1
        with:
          path: |
            /nix
            /zig

      # Install Nix and use that to run our tests so our environment matches exactly.
      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
        with:
          nix_path: nixpkgs=channel:nixos-unstable
      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        with:
          name: ghostty
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"

      - name: Install AFL++ and LLVM
        run: |
          sudo apt-get update
          sudo DEBIAN_FRONTEND=noninteractive apt-get install -y afl++ llvm

      - name: Verify AFL++ and LLVM are available
        run: |
          afl-cc --version
          if command -v llvm-config >/dev/null 2>&1; then
            llvm-config --version
          else
            llvm-config-18 --version
          fi

      - name: Build fuzzer harness
        run: |
          nix develop -c sh -c 'cd test/fuzz-libghostty && zig build'

  zig-fmt:
    if: github.repository == 'ghostty-org/ghostty' && needs.skip.outputs.skip != 'true' && needs.skip.outputs.zig == 'true'
    needs: skip
    runs-on: namespace-profile-ghostty-xsm
    timeout-minutes: 60
    env:
      ZIG_LOCAL_CACHE_DIR: /zig/local-cache
      ZIG_GLOBAL_CACHE_DIR: /zig/global-cache
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Setup Cache
        uses: namespacelabs/nscloud-cache-action@c5f8dab7560444c4bf8dbc64f1b203431873c547 # v1.6.1
        with:
          path: |
            /nix
            /zig
      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
        with:
          nix_path: nixpkgs=channel:nixos-unstable
      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        with:
          name: ghostty
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
          skipPush: true
          useDaemon: false # sometimes fails on short jobs
      - name: zig fmt
        run: nix develop -c zig fmt --check .

  pinact:
    name: "GitHub Actions Pins"
    if: github.repository == 'ghostty-org/ghostty' && needs.skip.outputs.skip != 'true' && needs.skip.outputs.actions_pins == 'true'
    needs: skip
    runs-on: namespace-profile-ghostty-xsm
    timeout-minutes: 60
    permissions:
      contents: read
    env:
      ZIG_LOCAL_CACHE_DIR: /zig/local-cache
      ZIG_GLOBAL_CACHE_DIR: /zig/global-cache
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Setup Cache
        uses: namespacelabs/nscloud-cache-action@c5f8dab7560444c4bf8dbc64f1b203431873c547 # v1.6.1
        with:
          path: |
            /nix
            /zig
      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
        with:
          nix_path: nixpkgs=channel:nixos-unstable
      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        with:
          name: ghostty
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
          skipPush: true
          useDaemon: false # sometimes fails on short jobs
      - name: pinact check
        run: nix develop -c pinact run --check
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

  prettier:
    if: github.repository == 'ghostty-org/ghostty' && needs.skip.outputs.skip != 'true'
    needs: skip
    runs-on: namespace-profile-ghostty-xsm
    timeout-minutes: 60
    env:
      ZIG_LOCAL_CACHE_DIR: /zig/local-cache
      ZIG_GLOBAL_CACHE_DIR: /zig/global-cache
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Setup Cache
        uses: namespacelabs/nscloud-cache-action@c5f8dab7560444c4bf8dbc64f1b203431873c547 # v1.6.1
        with:
          path: |
            /nix
            /zig
      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
        with:
          nix_path: nixpkgs=channel:nixos-unstable
      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        with:
          name: ghostty
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
          skipPush: true
          useDaemon: false # sometimes fails on short jobs
      - name: prettier check
        run: nix develop -c prettier --check .

  swiftlint:
    if: github.repository == 'ghostty-org/ghostty' && needs.skip.outputs.skip != 'true' && needs.skip.outputs.macos == 'true'
    runs-on: namespace-profile-ghostty-macos-tahoe
    needs: skip
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Cache
        uses: namespacelabs/nscloud-cache-action@c5f8dab7560444c4bf8dbc64f1b203431873c547 # v1.6.1
        with:
          cache: |
            xcode
          path: |
            /Users/runner/zig

      # TODO(tahoe): https://github.com/NixOS/nix/issues/13342
      - uses: DeterminateSystems/nix-installer-action@main
        with:
          determinate: true
      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        with:
          name: ghostty
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
          skipPush: true
          useDaemon: false # sometimes fails on short jobs

      - name: swiftlint check
        run: nix develop -c swiftlint lint --strict

  alejandra:
    if: github.repository == 'ghostty-org/ghostty' && needs.skip.outputs.skip != 'true' && needs.skip.outputs.nix == 'true'
    needs: skip
    runs-on: namespace-profile-ghostty-xsm
    timeout-minutes: 60
    env:
      ZIG_LOCAL_CACHE_DIR: /zig/local-cache
      ZIG_GLOBAL_CACHE_DIR: /zig/global-cache
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Setup Cache
        uses: namespacelabs/nscloud-cache-action@c5f8dab7560444c4bf8dbc64f1b203431873c547 # v1.6.1
        with:
          path: |
            /nix
            /zig
      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
        with:
          nix_path: nixpkgs=channel:nixos-unstable
      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        with:
          name: ghostty
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
          skipPush: true
          useDaemon: false # sometimes fails on short jobs
      - name: alejandra check
        run: nix develop -c alejandra --check .

  typos:
    if: github.repository == 'ghostty-org/ghostty' && needs.skip.outputs.skip != 'true'
    needs: skip
    runs-on: namespace-profile-ghostty-xsm
    timeout-minutes: 60
    env:
      ZIG_LOCAL_CACHE_DIR: /zig/local-cache
      ZIG_GLOBAL_CACHE_DIR: /zig/global-cache
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Setup Cache
        uses: namespacelabs/nscloud-cache-action@c5f8dab7560444c4bf8dbc64f1b203431873c547 # v1.6.1
        with:
          path: |
            /nix
            /zig
      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
        with:
          nix_path: nixpkgs=channel:nixos-unstable
      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        with:
          name: ghostty
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
          skipPush: true
          useDaemon: false # sometimes fails on short jobs
      - name: typos check
        run: nix develop -c typos

  shellcheck:
    if: github.repository == 'ghostty-org/ghostty' && needs.skip.outputs.skip != 'true' && needs.skip.outputs.shell == 'true'
    needs: skip
    runs-on: namespace-profile-ghostty-xsm
    timeout-minutes: 60
    env:
      ZIG_LOCAL_CACHE_DIR: /zig/local-cache
      ZIG_GLOBAL_CACHE_DIR: /zig/global-cache
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Setup Cache
        uses: namespacelabs/nscloud-cache-action@c5f8dab7560444c4bf8dbc64f1b203431873c547 # v1.6.1
        with:
          path: |
            /nix
            /zig
      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
        with:
          nix_path: nixpkgs=channel:nixos-unstable
      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        with:
          name: ghostty
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
          skipPush: true
          useDaemon: false # sometimes fails on short jobs
      - name: shellcheck
        run: |
          nix develop -c shellcheck \
            --check-sourced \
            --color=always \
            --severity=warning \
            $(find . \( -name "*.sh" -o -name "*.bash" \) -type f ! -path "./zig-out/*" ! -path "./macos/build/*" ! -path "./.git/*" | sort)

  translations:
    if: github.repository == 'ghostty-org/ghostty' && needs.skip.outputs.skip != 'true'
    needs: skip
    runs-on: namespace-profile-ghostty-xsm
    timeout-minutes: 60
    env:
      ZIG_LOCAL_CACHE_DIR: /zig/local-cache
      ZIG_GLOBAL_CACHE_DIR: /zig/global-cache
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Setup Cache
        uses: namespacelabs/nscloud-cache-action@c5f8dab7560444c4bf8dbc64f1b203431873c547 # v1.6.1
        with:
          path: |
            /nix
            /zig
      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
        with:
          nix_path: nixpkgs=channel:nixos-unstable
      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        with:
          name: ghostty
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
          skipPush: true
          useDaemon: false # sometimes fails on short jobs
      - name: check translations
        run: nix develop -c .github/scripts/check-translations.sh

  blueprint-compiler:
    if: github.repository == 'ghostty-org/ghostty' && needs.skip.outputs.skip != 'true' && needs.skip.outputs.blueprints == 'true'
    needs: skip
    runs-on: namespace-profile-ghostty-xsm
    timeout-minutes: 60
    env:
      ZIG_LOCAL_CACHE_DIR: /zig/local-cache
      ZIG_GLOBAL_CACHE_DIR: /zig/global-cache
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Setup Cache
        uses: namespacelabs/nscloud-cache-action@c5f8dab7560444c4bf8dbc64f1b203431873c547 # v1.6.1
        with:
          path: |
            /nix
            /zig
      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
        with:
          nix_path: nixpkgs=channel:nixos-unstable
      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        with:
          name: ghostty
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
          skipPush: true
          useDaemon: false # sometimes fails on short jobs
      - name: check blueprints
        run: nix develop -c ./nix/build-support/check-blueprints.sh
      - name: check unchanged
        run: git diff --exit-code

  test-pkg-linux:
    strategy:
      fail-fast: false
      matrix:
        pkg: ["wuffs"]
    name: Test pkg/${{ matrix.pkg }}
    runs-on: namespace-profile-ghostty-sm
    needs: test
    env:
      ZIG_LOCAL_CACHE_DIR: /zig/local-cache
      ZIG_GLOBAL_CACHE_DIR: /zig/global-cache
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Cache
        uses: namespacelabs/nscloud-cache-action@c5f8dab7560444c4bf8dbc64f1b203431873c547 # v1.6.1
        with:
          path: |
            /nix
            /zig

      # Install Nix and use that to run our tests so our environment matches exactly.
      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
        with:
          nix_path: nixpkgs=channel:nixos-unstable
      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        with:
          name: ghostty
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"

      - name: Test ${{ matrix.pkg }} Build
        run: |
          nix develop -c sh -c "cd pkg/${{ matrix.pkg }} ; zig build test"

  test-debian-13:
    name: Test build on Debian 13
    runs-on: namespace-profile-ghostty-sm
    timeout-minutes: 10
    needs: [test, build-dist]
    steps:
      - name: Install and configure Namespace CLI
        uses: namespacelabs/nscloud-setup@df198f982fcecfb8264bea3f1274b56a61b6dfdc # v0.0.12

      - name: Configure Namespace powered Buildx
        uses: namespacelabs/nscloud-setup-buildx-action@d059ed7184f0bc7c8b27e8810cea153d02bcc6dd # v0.0.23

      - name: Download Source Tarball Artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: source-tarball

      - name: Extract tarball
        run: |
          mkdir dist
          tar --verbose --extract --strip-components 1 --directory dist --file ghostty-source.tar.gz

      - name: Build and push
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          context: dist
          file: dist/src/build/docker/debian/Dockerfile
          build-args: |
            DISTRO_VERSION=13

  valgrind:
    if: github.repository == 'ghostty-org/ghostty'
    runs-on: namespace-profile-ghostty-lg
    timeout-minutes: 30
    needs: test
    env:
      ZIG_LOCAL_CACHE_DIR: /zig/local-cache
      ZIG_GLOBAL_CACHE_DIR: /zig/global-cache
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Setup Cache
        uses: namespacelabs/nscloud-cache-action@c5f8dab7560444c4bf8dbc64f1b203431873c547 # v1.6.1
        with:
          path: |
            /nix
            /zig

      # Install Nix and use that to run our tests so our environment matches exactly.
      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
        with:
          nix_path: nixpkgs=channel:nixos-unstable
      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        with:
          name: ghostty
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"

      - name: valgrind deps
        run: |
          sudo apt update -y
          sudo apt install -y valgrind libc6-dbg

      - name: valgrind
        run: |
          nix develop -c zig build test-valgrind

  # build-freebsd:
  #   name: Build on FreeBSD
  #   needs: test
  #   runs-on: namespace-profile-mitchellh-sm-systemd
  #   strategy:
  #     matrix:
  #       release:
  #         - "14.3"
  #         - "15.0"
  #   timeout-minutes: 10
  #   steps:
  #     - name: Checkout Ghostty
  #       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
  #
  #     - name: Start SSH
  #       run: |
  #         sudo systemctl start ssh
  #
  #     - name: Set up FreeBSD VM
  #       uses: vmactions/freebsd-vm@487ce35b96fae3e60d45b521735f5aa436ecfade # v1.2.4
  #       with:
  #         release: ${{ matrix.release }}
  #         copyback: false
  #         usesh: true
  #         prepare: |
  #           pkg install -y \
  #             devel/blueprint-compiler \
  #             devel/gettext \
  #             devel/git \
  #             devel/pkgconf \
  #             ftp/curl \
  #             graphics/wayland \
  #             security/ca_root_nss \
  #             textproc/hs-pandoc \
  #             x11-fonts/jetbrains-mono \
  #             x11-toolkits/libadwaita \
  #             x11-toolkits/gtk40 \
  #             x11-toolkits/gtk4-layer-shell
  #           curl -L -o /tmp/zig.tar.xz "https://ziglang.org/download/${{ needs.test.outputs.zig_version }}/zig-x86_64-freebsd-${{ needs.test.outputs.zig_version }}.tar.xz" && \
  #             mkdir /opt && \
  #             tar -xf /tmp/zig.tar.xz -C /opt && \
  #             rm /tmp/zig.tar.xz && \
  #             ln -s "/opt/zig-x86_64-freebsd-${{ needs.test.outputs.zig_version }}/zig" /usr/local/bin/zig
  #
  #         run: |
  #           zig env
  #
  #     - name: Run tests
  #       shell: freebsd {0}
  #       run: |
  #         cd $GITHUB_WORKSPACE
  #         zig build test
  #
  #     - name: Build GTK app runtime
  #       shell: freebsd {0}
  #       run: |
  #         cd $GITHUB_WORKSPACE
  #         zig build
  #         ./zig-out/bin/ghostty +version