ci.yml

on:
  push:
    # We intentionally don't run push on feature branches
    branches: [main]
  pull_request:
  workflow_dispatch:

# only one can run at a time in PRs
concurrency:
  # If PR, cancel prev commits. head_ref = source branch name on pull_request, null if push
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true

name: CI

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
      with:
        submodules: recursive

    - name: Set up Zig
      uses: mlugg/setup-zig@v2.0.5
      with:
        version: 0.16.0

    - name: Cache Zig packages
      uses: actions/cache@v4
      with:
        path: ~/.cache/zig
        key: ${{ runner.os }}-zig-${{ hashFiles('build.zig.zon', 'build.zig') }}
        restore-keys: |
          ${{ runner.os }}-zig-

    - name: Fetch Zig dependencies
      run: |
        max_attempts=3
        for attempt in $(seq 1 $max_attempts); do
          if zig build --fetch; then
            echo "Successfully fetched dependencies on attempt $attempt"
            exit 0
          fi
          echo "Attempt $attempt/$max_attempts failed, retrying in 5 seconds..."
          sleep 5
        done
        echo "All fetch attempts failed"
        exit 1

    - name: Set up Rust/Cargo
      uses: actions-rust-lang/setup-rust-toolchain@v1
      with:
        toolchain: stable
        components: clippy, rustfmt
        # Infra (not #863 perf): setup-rust-toolchain's bundled rust-cache
        # runs `cargo metadata` at repo root, but zeam's workspace is rust/.
        # macOS runners also need the Ensure-rustup shim step before any
        # plain `cargo` call — see workflow comments on that step.
        cache: false

    - name: Verify installation
      run: |
        rustc --version
        cargo --version

    - name: Cache dependencies
      uses: Swatinem/rust-cache@v2
      with:
        workspaces: "rust -> target"
        cache-bin: false
        # PR #903 introduced a `multisig-release` cargo profile and pointed the
        # default (dummy) prover at `rust/target/multisig-release/libzeam_glue.a`.
        # Hashing `rust/Cargo.toml` here (in addition to Cargo.lock) busts the
        # cache automatically on any future profile change, avoiding the
        # "restored cache lacks the new profile dir → confusing linker error"
        # failure mode flagged in #903 review.
        key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock', 'rust/Cargo.toml') }}

    - name: Check Rust formatting
      run: |
        cargo fmt --manifest-path rust/Cargo.toml --all -- --check

    - name: Run clippy on hosts
      run: |
        cargo clippy --manifest-path rust/Cargo.toml --workspace -- -D warnings

    - name: Lint
      run: zig fmt --check .

  build:
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest]
    steps:
    - uses: actions/checkout@v4
      with:
        submodules: recursive

    - name: Free disk space (Ubuntu)
      if: runner.os == 'Linux'
      run: |
        sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghcrunner /opt/hostedtoolcache/CodeQL
        sudo docker image prune --all --force || true
        df -h /

    - name: Set up Zig
      uses: mlugg/setup-zig@v2.0.5
      with:
        version: 0.16.0

    - name: Set up Rust/Cargo
      uses: actions-rust-lang/setup-rust-toolchain@v1
      with:
        toolchain: nightly
        cache: false

    - name: Ensure rustup proxy shims (macOS)
      if: runner.os == 'macOS'
      run: |
        # The macos-15-arm64 GitHub Actions runner image ships with
        # `~/.cargo/bin/{cargo,rustup}` as symlinks that resolve to the
        # `rustup-init` installer (same multi-call binary, but rustup picks
        # its mode from the resolved exe basename, so the shims behave as
        # the installer rather than as the rustup/cargo proxies). That
        # breaks every `cargo` / `rustup run` invocation with
        # `error: unexpected argument 'foo' found / Usage: rustup-init…`.
        #
        # The official installer fixes this by recreating the proxy shims
        # as hardlinks, so we re-run it (with --force) before any cargo
        # call. We don't add `~/.cargo/bin` to GITHUB_PATH explicitly
        # because the `actions-rust-lang/setup-rust-toolchain` step has
        # already done that.
        #
        # Swatinem/rust-cache and other steps invoke plain `cargo` on PATH.
        # `rustup run nightly cargo` can still work while ~/.cargo/bin/cargo
        # is broken, so we must not use only the latter as the health check.
        if ! command -v cargo >/dev/null 2>&1 || ! cargo --version >/dev/null 2>&1; then
          echo "Rustup proxy shims are broken; reinstalling via rustup-init"
          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
            | sh -s -- -y --default-toolchain nightly --no-modify-path \
                       --profile minimal --force
        fi
        cargo --version
        rustup run nightly cargo --version

    - name: Cache Zig packages
      uses: actions/cache@v4
      with:
        path: ~/.cache/zig
        key: ${{ runner.os }}-zig-${{ hashFiles('build.zig.zon', 'build.zig') }}
        restore-keys: |
          ${{ runner.os }}-zig-

    - name: Cache Rust dependencies
      uses: Swatinem/rust-cache@v2
      with:
        cache-bin: false
        workspaces: "rust -> target"
        # See cache-key rationale in the `lint` job.
        key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock', 'rust/Cargo.toml') }}

    - name: Fetch Zig dependencies
      run: |
        max_attempts=3
        for attempt in $(seq 1 $max_attempts); do
          if zig build --fetch; then
            echo "Successfully fetched dependencies on attempt $attempt"
            exit 0
          fi
          echo "Attempt $attempt/$max_attempts failed, retrying in 5 seconds..."
          sleep 5
        done
        echo "All fetch attempts failed"
        exit 1

    - name: build
      run: |
        max_attempts=3
        for attempt in $(seq 1 $max_attempts); do
          if zig build all; then
            echo "Successfully built on attempt $attempt"
            exit 0
          fi
          echo "Attempt $attempt/$max_attempts failed, retrying in 5 seconds..."
          sleep 5
        done
        echo "All build attempts failed"
        exit 1

    # The optional ethp2p adapter and its lazy `zig_ethp2p` dependency are only
    # imported under `-Dethp2p=true`, so the default build above can stay green
    # while that path is broken. Compile it here to keep the flag honest.
    - name: build (ethp2p adapter)
      run: |
        max_attempts=3
        for attempt in $(seq 1 $max_attempts); do
          if zig build --fetch -Dethp2p=true && zig build -Dethp2p=true; then
            echo "Successfully built ethp2p variant on attempt $attempt"
            exit 0
          fi
          echo "Attempt $attempt/$max_attempts failed, retrying in 5 seconds..."
          sleep 5
        done
        echo "All ethp2p build attempts failed"
        exit 1

  build-all-provers:
    name: build-all-provers
    runs-on: ${{ matrix.os }}
    needs: build  # Only run if the build job succeeds
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest]
    steps:
    - uses: actions/checkout@v4
      with:
        submodules: recursive

    - name: Free disk space (Ubuntu)
      if: runner.os == 'Linux'
      run: |
        sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghcrunner /opt/hostedtoolcache/CodeQL
        sudo docker image prune --all --force || true
        df -h /

    - name: Set up Zig
      uses: mlugg/setup-zig@v2.0.5
      with:
        version: 0.16.0

    - name: Set up Rust/Cargo
      uses: actions-rust-lang/setup-rust-toolchain@v1
      with:
        toolchain: nightly
        components: clippy, rustfmt
        cache: false

    - name: Ensure rustup proxy shims (macOS)
      if: runner.os == 'macOS'
      run: |
        # The macos-15-arm64 GitHub Actions runner image ships with
        # `~/.cargo/bin/{cargo,rustup}` as symlinks that resolve to the
        # `rustup-init` installer (same multi-call binary, but rustup picks
        # its mode from the resolved exe basename, so the shims behave as
        # the installer rather than as the rustup/cargo proxies). That
        # breaks every `cargo` / `rustup run` invocation with
        # `error: unexpected argument 'foo' found / Usage: rustup-init…`.
        #
        # The official installer fixes this by recreating the proxy shims
        # as hardlinks, so we re-run it (with --force) before any cargo
        # call. We don't add `~/.cargo/bin` to GITHUB_PATH explicitly
        # because the `actions-rust-lang/setup-rust-toolchain` step has
        # already done that.
        #
        # Swatinem/rust-cache and other steps invoke plain `cargo` on PATH.
        # `rustup run nightly cargo` can still work while ~/.cargo/bin/cargo
        # is broken, so we must not use only the latter as the health check.
        if ! command -v cargo >/dev/null 2>&1 || ! cargo --version >/dev/null 2>&1; then
          echo "Rustup proxy shims are broken; reinstalling via rustup-init"
          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
            | sh -s -- -y --default-toolchain nightly --no-modify-path \
                       --profile minimal --force
        fi
        cargo --version
        rustup run nightly cargo --version

    - name: Cache Zig packages
      uses: actions/cache@v4
      with:
        path: ~/.cache/zig
        key: ${{ runner.os }}-zig-${{ hashFiles('build.zig.zon', 'build.zig') }}
        restore-keys: |
          ${{ runner.os }}-zig-

    - name: Cache Rust dependencies
      uses: Swatinem/rust-cache@v2
      with:
        cache-bin: false
        workspaces: "rust -> target"
        # See cache-key rationale in the `lint` job.
        key: ${{ runner.os }}-cargo-all-provers-${{ hashFiles('**/Cargo.lock', 'rust/Cargo.toml') }}

    - name: Fetch Zig dependencies
      run: |
        max_attempts=3
        for attempt in $(seq 1 $max_attempts); do
          if zig build --fetch; then
            echo "Successfully fetched dependencies on attempt $attempt"
            exit 0
          fi
          echo "Attempt $attempt/$max_attempts failed, retrying in 5 seconds..."
          sleep 5
        done
        echo "All fetch attempts failed"
        exit 1

    - name: Build with all provers
      run: |
        # On x86_64 Linux runners, cap the Rust target CPU at x86-64-v3 (AVX2, no AVX-512).
        # GitHub Actions runners lack AVX-512, so target-cpu=native would leave zmm registers
        # unavailable and cause "couldn't allocate output register for constraint 'v'" errors
        # in leanMultisig's SIMD inline assembly. The -Drust-target-cpu option is only declared
        # in build.zig on x86_64, so we must not pass it on aarch64 macOS runners.
        if [ "$RUNNER_OS" = "Linux" ]; then
          CPU_FLAG="-Drust-target-cpu=x86-64-v3"
        else
          CPU_FLAG=""
        fi
        max_attempts=3
        for attempt in $(seq 1 $max_attempts); do
          if zig build -Dprover=all $CPU_FLAG; then
            echo "Successfully built on attempt $attempt"
            exit 0
          fi
          echo "Attempt $attempt/$max_attempts failed, retrying in 5 seconds..."
          sleep 5
        done
        echo "All build attempts failed"
        exit 1

  gen-fixtures:
    name: gen-fixtures
    # LeanSpec fixtures are produced by the real recursive-STARK prover
    # (lean-multisig-py). That proving is done ONCE here on the fast Apple-silicon
    # macOS runner (~30m with -n auto) and published as an artifact. The `test`
    # matrix job downloads it and runs only the cheap spec generate/run on both
    # OSes. This keeps fixture proving off the ubuntu runner, where parallel `fill`
    # saturates its 4 vCPU / 16 GB and the prover's process-global setup wedges,
    # hanging the step for hours.
    runs-on: macos-latest
    steps:
    - uses: actions/checkout@v4
      with:
        submodules: recursive

    - name: Set up Rust/Cargo
      uses: actions-rust-lang/setup-rust-toolchain@v1
      with:
        toolchain: nightly
        cache: false

    - name: Ensure rustup proxy shims (macOS)
      run: |
        # The macos runner ships cargo/rustup shims that resolve to rustup-init
        # (see the fuller note in the `test` job); recreate them before any cargo
        # call so `uv run fill` can build the lean-multisig-py prover extension.
        if ! command -v cargo >/dev/null 2>&1 || ! cargo --version >/dev/null 2>&1; then
          echo "Rustup proxy shims are broken; reinstalling via rustup-init"
          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
            | sh -s -- -y --default-toolchain nightly --no-modify-path \
                       --profile minimal --force
        fi
        cargo --version
        rustup run nightly cargo --version

    - name: Install uv
      shell: bash
      run: |
        curl -LsSf https://astral.sh/uv/install.sh | sh
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"

    - name: Generate LeanSpec fixtures
      working-directory: leanSpec
      run: uv run fill --clean --fork=Lstar -n auto

    - name: Upload LeanSpec fixtures
      uses: actions/upload-artifact@v4
      with:
        name: leanspec-fixtures
        path: leanSpec/fixtures
        retention-days: 1
        if-no-files-found: error

  test:
    name: test
    runs-on: ${{ matrix.os }}
    needs: gen-fixtures
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest]
    steps:
    - uses: actions/checkout@v4
      with:
        submodules: recursive

    - name: Free disk space (Ubuntu)
      if: runner.os == 'Linux'
      run: |
        sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghcrunner /opt/hostedtoolcache/CodeQL
        sudo docker image prune --all --force || true
        df -h /

    - name: Set up Zig
      uses: mlugg/setup-zig@v2.0.5
      with:
        version: 0.16.0

    - name: Set up Rust/Cargo
      uses: actions-rust-lang/setup-rust-toolchain@v1
      with:
        toolchain: nightly
        cache: false

    - name: Ensure rustup proxy shims (macOS)
      if: runner.os == 'macOS'
      run: |
        # The macos-15-arm64 GitHub Actions runner image ships with
        # `~/.cargo/bin/{cargo,rustup}` as symlinks that resolve to the
        # `rustup-init` installer (same multi-call binary, but rustup picks
        # its mode from the resolved exe basename, so the shims behave as
        # the installer rather than as the rustup/cargo proxies). That
        # breaks every `cargo` / `rustup run` invocation with
        # `error: unexpected argument 'foo' found / Usage: rustup-init…`.
        #
        # The official installer fixes this by recreating the proxy shims
        # as hardlinks, so we re-run it (with --force) before any cargo
        # call. We don't add `~/.cargo/bin` to GITHUB_PATH explicitly
        # because the `actions-rust-lang/setup-rust-toolchain` step has
        # already done that.
        #
        # Swatinem/rust-cache and other steps invoke plain `cargo` on PATH.
        # `rustup run nightly cargo` can still work while ~/.cargo/bin/cargo
        # is broken, so we must not use only the latter as the health check.
        if ! command -v cargo >/dev/null 2>&1 || ! cargo --version >/dev/null 2>&1; then
          echo "Rustup proxy shims are broken; reinstalling via rustup-init"
          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
            | sh -s -- -y --default-toolchain nightly --no-modify-path \
                       --profile minimal --force
        fi
        cargo --version
        rustup run nightly cargo --version

    - name: Cache Zig packages
      uses: actions/cache@v4
      with:
        path: ~/.cache/zig
        key: ${{ runner.os }}-zig-${{ hashFiles('build.zig.zon', 'build.zig') }}
        restore-keys: |
          ${{ runner.os }}-zig-

    - name: Cache Rust dependencies
      uses: Swatinem/rust-cache@v2
      with:
        cache-bin: false
        workspaces: "rust -> target"
        # See cache-key rationale in the `lint` job. Also shared with `dummy-prove`
        # (same key prefix) — busting via `rust/Cargo.toml` keeps both in sync.
        key: ${{ runner.os }}-cargo-test-${{ hashFiles('**/Cargo.lock', 'rust/Cargo.toml') }}

    - name: Fetch Zig dependencies
      run: |
        max_attempts=3
        for attempt in $(seq 1 $max_attempts); do
          if zig build --fetch; then
            echo "Successfully fetched dependencies on attempt $attempt"
            exit 0
          fi
          echo "Attempt $attempt/$max_attempts failed, retrying in 5 seconds..."
          sleep 5
        done
        echo "All fetch attempts failed"
        exit 1

    - name: Run all unit tests
      run: |
        max_attempts=3
        for attempt in $(seq 1 $max_attempts); do
          if zig build test --summary all; then
            echo "Successfully ran unit tests on attempt $attempt"
            exit 0
          fi
          echo "Attempt $attempt/$max_attempts failed, retrying in 5 seconds..."
          sleep 5
        done
        echo "All unit test attempts failed"
        exit 1

    - name: Run all sim tests
      # simtest validates consensus / networking / finalization, not prover throughput. On CI's
      # weak CPU the real multi-second XMSS Type-2 merge overruns the default 4s slot, so blocks
      # publish late and the chain can't bootstrap → timeout. Instead of mocking the prover, widen
      # the slot to 12s (-Dseconds-per-slot=12): the real merge then fits within a slot and the
      # ~2.4s interval absorbs the shared-loop drain (#863), so simtest finalizes with the REAL
      # prover. The harness scales its deadlines by SECONDS_PER_SLOT. Prod stays at the 4s preset.
      run: |
        max_attempts=3
        for attempt in $(seq 1 $max_attempts); do
          if zig build simtest -Dseconds-per-slot=12 --summary all; then
            echo "Successfully ran sim tests on attempt $attempt"
            exit 0
          fi
          echo "Attempt $attempt/$max_attempts failed, retrying in 5 seconds..."
          sleep 5
        done
        echo "All sim test attempts failed"
        exit 1

    - name: Download LeanSpec fixtures
      uses: actions/download-artifact@v4
      with:
        name: leanspec-fixtures
        path: leanSpec/fixtures

    - name: Verify fixtures present
      shell: bash
      # Guard against a silent false-green: spectest:generate emits an empty stub
      # (and spectest:run then "passes" with 0 tests) when leanSpec/fixtures is
      # missing or empty. Require the real fixture set before continuing.
      run: |
        count=$(find leanSpec/fixtures -name '*.json' 2>/dev/null | wc -l | tr -d ' ')
        echo "Downloaded fixture JSON files: $count"
        if [ "$count" -lt 50 ]; then
          echo "::error::Expected the LeanSpec fixture set at leanSpec/fixtures (hundreds of JSON files), found $count — artifact download path is wrong or generation produced nothing."
          exit 1
        fi

    - name: Generate spec fixtures
      run: zig build spectest:generate --summary all

    - name: Run all spec tests
      run: zig build spectest:run --summary all

  dummy-prove:
    name: Dummy prove
    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest]
    steps:
    - uses: actions/checkout@v4
      with:
        submodules: recursive

    - name: Free disk space (Ubuntu)
      if: runner.os == 'Linux'
      run: |
        sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghcrunner /opt/hostedtoolcache/CodeQL
        sudo docker image prune --all --force || true
        df -h /

    - name: Set up Zig
      uses: mlugg/setup-zig@v2.0.5
      with:
        version: 0.16.0

    - name: Set up Rust/Cargo
      uses: actions-rust-lang/setup-rust-toolchain@v1
      with:
        toolchain: nightly
        cache: false

    - name: Ensure rustup proxy shims (macOS)
      if: runner.os == 'macOS'
      run: |
        # The macos-15-arm64 GitHub Actions runner image ships with
        # `~/.cargo/bin/{cargo,rustup}` as symlinks that resolve to the
        # `rustup-init` installer (same multi-call binary, but rustup picks
        # its mode from the resolved exe basename, so the shims behave as
        # the installer rather than as the rustup/cargo proxies). That
        # breaks every `cargo` / `rustup run` invocation with
        # `error: unexpected argument 'foo' found / Usage: rustup-init…`.
        #
        # The official installer fixes this by recreating the proxy shims
        # as hardlinks, so we re-run it (with --force) before any cargo
        # call. We don't add `~/.cargo/bin` to GITHUB_PATH explicitly
        # because the `actions-rust-lang/setup-rust-toolchain` step has
        # already done that.
        #
        # Swatinem/rust-cache and other steps invoke plain `cargo` on PATH.
        # `rustup run nightly cargo` can still work while ~/.cargo/bin/cargo
        # is broken, so we must not use only the latter as the health check.
        if ! command -v cargo >/dev/null 2>&1 || ! cargo --version >/dev/null 2>&1; then
          echo "Rustup proxy shims are broken; reinstalling via rustup-init"
          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
            | sh -s -- -y --default-toolchain nightly --no-modify-path \
                       --profile minimal --force
        fi
        cargo --version
        rustup run nightly cargo --version

    - name: Cache Zig packages
      uses: actions/cache@v4
      with:
        path: ~/.cache/zig
        key: ${{ runner.os }}-zig-${{ hashFiles('build.zig.zon', 'build.zig') }}
        restore-keys: |
          ${{ runner.os }}-zig-

    - name: Cache Rust dependencies
      uses: Swatinem/rust-cache@v2
      with:
        cache-bin: false
        workspaces: "rust -> target"
        # See cache-key rationale in the `lint` job. Shared key prefix with
        # `test`/`simtest` so all three jobs invalidate together when the rust
        # workspace profile set changes (e.g. PR #903's `multisig-release`).
        key: ${{ runner.os }}-cargo-test-${{ hashFiles('**/Cargo.lock', 'rust/Cargo.toml') }}

    - name: Fetch Zig dependencies
      run: |
        max_attempts=3
        for attempt in $(seq 1 $max_attempts); do
          if zig build --fetch; then
            echo "Successfully fetched dependencies on attempt $attempt"
            exit 0
          fi
          echo "Attempt $attempt/$max_attempts failed, retrying in 5 seconds..."
          sleep 5
        done
        echo "All fetch attempts failed"
        exit 1

    - name: Run the dummy prover
      run: |
        max_attempts=3
        for attempt in $(seq 1 $max_attempts); do
          if zig build run -Dprover=dummy -- prove --zkvm dummy; then
            echo "Successfully ran dummy prover on attempt $attempt"
            exit 0
          fi
          echo "Attempt $attempt/$max_attempts failed, retrying in 5 seconds..."
          sleep 5
        done
        echo "All dummy prover attempts failed"
        exit 1

  docker-build:
    name: docker-build
    needs: [lint, build, test, build-all-provers]
    strategy:
      matrix:
        builder: [ubuntu-latest, ubuntu-22.04-arm]
    runs-on: ${{ matrix.builder }}
    steps:
    - uses: actions/checkout@v4
      with:
        submodules: recursive
        fetch-depth: 0  # Fetch full history to get git commit info

    - name: Free disk space (Ubuntu)
      if: runner.os == 'Linux'
      run: |
        sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghcrunner /opt/hostedtoolcache/CodeQL
        sudo docker image prune --all --force || true
        df -h /

    - name: Set up Zig
      uses: mlugg/setup-zig@v2.0.5
      with:
        version: 0.16.0

    - name: Set up Rust/Cargo
      uses: actions-rust-lang/setup-rust-toolchain@v1
      with:
        toolchain: nightly
        cache: false

    - name: Cache Zig packages
      uses: actions/cache@v4
      with:
        path: ~/.cache/zig
        key: ${{ runner.os }}-zig-${{ hashFiles('build.zig.zon', 'build.zig') }}
        restore-keys: |
          ${{ runner.os }}-zig-

    - name: Cache Rust dependencies
      uses: Swatinem/rust-cache@v2
      with:
        cache-bin: false
        workspaces: "rust -> target"
        # See cache-key rationale in the `lint` job.
        key: ${{ runner.os }}-cargo-docker-${{ hashFiles('**/Cargo.lock', 'rust/Cargo.toml') }}

    - name: Fetch Zig dependencies
      run: |
        max_attempts=3
        for attempt in $(seq 1 $max_attempts); do
          if zig build --fetch; then
            echo "Successfully fetched dependencies on attempt $attempt"
            exit 0
          fi
          echo "Attempt $attempt/$max_attempts failed, retrying in 5 seconds..."
          sleep 5
        done
        echo "All fetch attempts failed"
        exit 1

    - name: Build zeam natively
      run: |
        max_attempts=3
        for attempt in $(seq 1 $max_attempts); do
          if zig build -Doptimize=ReleaseSafe -Dgit_version="$(git rev-parse --short HEAD)"; then
            echo "Successfully built on attempt $attempt"
            exit 0
          fi
          echo "Attempt $attempt/$max_attempts failed, retrying in 5 seconds..."
          sleep 5
        done
        echo "All build attempts failed"
        exit 1

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: Build Docker image with pre-built binary
      uses: docker/build-push-action@v5
      with:
        context: .
        file: ./Dockerfile.prebuilt
        push: false  # Don't push, just build to verify
        tags: zeam:ci-${{ github.run_number }}
        cache-from: type=gha
        # `ignore-error=true`: cache export talks to GitHub's Actions Cache
        # API; intermittent 502/HTML responses fail the whole job even when
        # the image build succeeded (see docker-build ubuntu-22.04-arm on #886).
        cache-to: type=gha,mode=max,ignore-error=true