ci: fix the native builds

.github/actions/setup-android-native/action.yml

@@ -6,13 +6,21 @@ description: >
 
 inputs:
   ndk-version:
-    description: NDK version to install via sdkmanager (must match ndkVersion in canvas build.gradle and the default in tools/scripts/build-android.sh)
+    description: NDK the Rust crates build with (must match NDK_VERSION in tools/scripts/build-android.sh and build-svg-android.sh)
+    required: false
+    default: '28.2.13676358'
+  gradle-ndk-version:
+    description: NDK the gradle CMake builds pin (ndkVersion in the canvas and canvassvg build.gradle), installed alongside
     required: false
     default: '29.0.14206865'
   api-level:
-    description: Android API level used for the NDK clang wrappers
+    description: Android API level used for the NDK clang wrappers (API_VERSION in the same scripts)
+    required: false
+    default: '23'
+  rust-toolchain:
+    description: Dated nightly the Rust builds use (exported as CANVAS_RUST_TOOLCHAIN). A newer one lays out i686-android structs unlike Skia's bindgen output.
     required: false
-    default: '21'
+    default: 'nightly-2026-01-25'
   install-rust:
     description: Install Rust nightly + cargo cache (set 'false' for gradle-only projects)
     required: false
@@ -28,13 +36,13 @@ runs:
         cache: gradle
 
     - name: Setup Android SDK
-      uses: android-actions/setup-android@v3
+      uses: android-actions/setup-android@v4
 
     - name: Setup NDK
       shell: bash
       run: |
         set -e
-        (yes || true) | sdkmanager "ndk;${{ inputs.ndk-version }}" > /dev/null
+        (yes || true) | sdkmanager "ndk;${{ inputs.ndk-version }}" "ndk;${{ inputs.gradle-ndk-version }}" > /dev/null
         NDK="$ANDROID_HOME/ndk/${{ inputs.ndk-version }}"
         TOOLCHAIN="$NDK/toolchains/llvm/prebuilt/linux-x86_64"
         API=${{ inputs.api-level }}
@@ -45,6 +53,9 @@ runs:
           echo "ANDROID_NDK_HOME=$NDK"
           echo "ANDROID_NDK_ROOT=$NDK"
           echo "NDK_HOST=linux-x86_64"
+          # bindgen (skia-bindings) otherwise loads the runner's libclang 15, older than the
+          # NDK's libc++ headers accept (Clang 16+)
+          echo "LIBCLANG_PATH=$TOOLCHAIN/lib"
           echo "CARGO_TARGET_ARMV7_LINUX_ANDROIDEABI_LINKER=$TOOLCHAIN/bin/armv7a-linux-androideabi${API}-clang"
           echo "CARGO_TARGET_AARCH64_LINUX_ANDROID_LINKER=$TOOLCHAIN/bin/aarch64-linux-android${API}-clang"
           echo "CARGO_TARGET_I686_LINUX_ANDROID_LINKER=$TOOLCHAIN/bin/i686-linux-android${API}-clang"
@@ -63,6 +74,7 @@ runs:
           echo "AR_x86_64_linux_android=$TOOLCHAIN/bin/llvm-ar"
         } >> "$GITHUB_ENV"
         echo "$TOOLCHAIN/bin" >> "$GITHUB_PATH"
+        ls "$TOOLCHAIN"/lib/libclang.so*
 
     - name: Install build tools
       shell: bash
@@ -72,19 +84,32 @@ runs:
       if: ${{ inputs.install-rust == 'true' }}
       shell: bash
       # rust-src is required: Android release builds go through
-      # `cargo +nightly build -Z build-std` (see tools/scripts/build-android.sh).
+      # `cargo +$CANVAS_RUST_TOOLCHAIN build -Z build-std` (see tools/scripts/build-android.sh).
+      # rustfmt too: skia-bindings fixes up i686 opaque-blob alignment by matching bindgen's
+      # formatted output, which bindgen only formats when rustfmt is there.
       run: |
-        rustup toolchain install nightly --profile minimal --component rust-src
-        rustup default nightly
+        rustup toolchain install ${{ inputs.rust-toolchain }} --profile minimal --component rust-src,rustfmt
+        rustup default ${{ inputs.rust-toolchain }}
+        echo "CANVAS_RUST_TOOLCHAIN=${{ inputs.rust-toolchain }}" >> "$GITHUB_ENV"
         rustc --version
 
-    - name: Cache cargo
+    # Restore only: .github/actions/skia-cache saves it, from master only. No Cargo.lock is
+    # committed, so the key hashes the manifests.
+    - name: Restore cargo registry
+      id: cargo-registry
       if: ${{ inputs.install-rust == 'true' }}
-      uses: actions/cache@v4
+      uses: actions/cache/restore@v4
       with:
         path: |
           ~/.cargo/registry
           ~/.cargo/git
-        key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+        key: ${{ runner.os }}-${{ runner.arch }}-cargo-v2-${{ hashFiles('Cargo.toml', 'crates/*/Cargo.toml') }}
         restore-keys: |
-          ${{ runner.os }}-cargo-
+          ${{ runner.os }}-${{ runner.arch }}-cargo-v2-
+
+    - name: Remember the cargo registry key
+      if: ${{ inputs.install-rust == 'true' }}
+      shell: bash
+      run: |
+        echo "CARGO_REGISTRY_CACHE_KEY=${{ steps.cargo-registry.outputs.cache-primary-key }}" >> "$GITHUB_ENV"
+        echo "CARGO_REGISTRY_CACHE_HIT=${{ steps.cargo-registry.outputs.cache-hit }}" >> "$GITHUB_ENV"

.github/actions/setup-apple-native/action.yml

@@ -2,13 +2,17 @@ name: Setup Apple native build environment
 description: >
   Selects Xcode, installs the visionOS platform (SDK + simulator runtime, not
   preinstalled on GitHub macOS runners), and optionally installs the Rust
-  nightly toolchain (with rust-src for -Z build-std) plus a cargo cache.
+  nightly toolchain (with rust-src for -Z build-std), cbindgen and a cargo cache.
 
 inputs:
   xcode-version:
     description: Xcode version spec passed to setup-xcode
     required: false
     default: '^16.0'
+  rust-toolchain:
+    description: Dated nightly the Rust builds use (exported as CANVAS_RUST_TOOLCHAIN), as setup-android-native pins it.
+    required: false
+    default: 'nightly-2026-01-25'
   install-rust:
     description: Install Rust nightly + cargo cache (set 'false' for xcodebuild-only projects)
     required: false
@@ -34,19 +38,36 @@ runs:
       if: ${{ inputs.install-rust == 'true' }}
       shell: bash
       # rust-src is required: iOS and visionOS release builds go through
-      # `cargo +nightly build -Z build-std` (see Makefile).
+      # `cargo +$CANVAS_RUST_TOOLCHAIN build -Z build-std` (see Makefile).
       run: |
-        rustup toolchain install nightly --profile minimal --component rust-src
-        rustup default nightly
+        rustup toolchain install ${{ inputs.rust-toolchain }} --profile minimal --component rust-src
+        rustup default ${{ inputs.rust-toolchain }}
+        echo "CANVAS_RUST_TOOLCHAIN=${{ inputs.rust-toolchain }}" >> "$GITHUB_ENV"
         rustc --version
 
-    - name: Cache cargo
+    # The Xcode pre-build phases regenerate the C headers with it. No macOS release binaries.
+    - name: Install cbindgen
+      if: ${{ inputs.install-rust == 'true' }}
+      shell: bash
+      run: cargo install [email protected] --locked
+
+    # Restore only: .github/actions/skia-cache saves it, from master only. No Cargo.lock is
+    # committed, so the key hashes the manifests.
+    - name: Restore cargo registry
+      id: cargo-registry
       if: ${{ inputs.install-rust == 'true' }}
-      uses: actions/cache@v4
+      uses: actions/cache/restore@v4
       with:
         path: |
           ~/.cargo/registry
           ~/.cargo/git
-        key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+        key: ${{ runner.os }}-${{ runner.arch }}-cargo-v2-${{ hashFiles('Cargo.toml', 'crates/*/Cargo.toml') }}
         restore-keys: |
-          ${{ runner.os }}-cargo-
+          ${{ runner.os }}-${{ runner.arch }}-cargo-v2-
+
+    - name: Remember the cargo registry key
+      if: ${{ inputs.install-rust == 'true' }}
+      shell: bash
+      run: |
+        echo "CARGO_REGISTRY_CACHE_KEY=${{ steps.cargo-registry.outputs.cache-primary-key }}" >> "$GITHUB_ENV"
+        echo "CARGO_REGISTRY_CACHE_HIT=${{ steps.cargo-registry.outputs.cache-hit }}" >> "$GITHUB_ENV"

.github/actions/setup-linux-native/action.yml

@@ -0,0 +1,56 @@
+name: Setup Linux native build environment
+description: >
+  Installs what tools/scripts/build-linux.sh needs on Ubuntu 22.04 (glibc 2.35, GTK 4.6, the
+  baseline the shipped modules target): the GTK 4 / EGL / GLES / ALSA / GStreamer / udev
+  development files, clang 18 for Skia (22.04's clang is 14), ninja, Rust stable and a cargo
+  cache. Mesa's EGL and lavapipe let the Node-API tests run on the GPU-less runners.
+
+runs:
+  using: composite
+  steps:
+    - name: Install packages
+      shell: bash
+      run: |
+        sudo apt-get update
+        # gstreamer's -dev needs libunwind-dev, which conflicts with the image's LLVM 14 libunwind
+        sudo apt-get remove -y libunwind-14-dev || true
+        sudo apt-get install -y --no-install-recommends \
+          libgtk-4-dev libegl-dev libgles-dev libasound2-dev libfontconfig-dev libfreetype-dev \
+          libgstreamer1.0-dev libgstreamer-plugins-base1.0-dev libudev-dev \
+          ninja-build pkg-config \
+          libegl-mesa0 mesa-vulkan-drivers
+
+    - name: Install clang 18
+      shell: bash
+      run: |
+        wget -qO /tmp/llvm.sh https://apt.llvm.org/llvm.sh
+        sudo bash /tmp/llvm.sh 18
+        sudo apt-get install -y --no-install-recommends libclang-18-dev
+        echo "CANVAS_CLANG_DIR=/usr/lib/llvm-18/bin" >> "$GITHUB_ENV"
+        /usr/lib/llvm-18/bin/clang --version
+
+    - name: Install Rust stable
+      shell: bash
+      run: |
+        rustup toolchain install stable --profile minimal
+        rustup default stable
+        rustc --version
+
+    # Restore only: .github/actions/skia-cache saves it, from master only. No Cargo.lock is
+    # committed, so the key hashes the manifests.
+    - name: Restore cargo registry
+      id: cargo-registry
+      uses: actions/cache/restore@v4
+      with:
+        path: |
+          ~/.cargo/registry
+          ~/.cargo/git
+        key: ${{ runner.os }}-${{ runner.arch }}-cargo-v2-${{ hashFiles('Cargo.toml', 'crates/*/Cargo.toml') }}
+        restore-keys: |
+          ${{ runner.os }}-${{ runner.arch }}-cargo-v2-
+
+    - name: Remember the cargo registry key
+      shell: bash
+      run: |
+        echo "CARGO_REGISTRY_CACHE_KEY=${{ steps.cargo-registry.outputs.cache-primary-key }}" >> "$GITHUB_ENV"
+        echo "CARGO_REGISTRY_CACHE_HIT=${{ steps.cargo-registry.outputs.cache-hit }}" >> "$GITHUB_ENV"

.github/actions/setup-windows-native/action.yml

@@ -43,12 +43,21 @@ runs:
         ninja --version
         python --version
 
-    - name: Cache cargo
-      uses: actions/cache@v4
+    # Restore only: .github/actions/skia-cache saves it, from master only. No Cargo.lock is
+    # committed, so the key hashes the manifests.
+    - name: Restore cargo registry
+      id: cargo-registry
+      uses: actions/cache/restore@v4
       with:
         path: |
           ~/.cargo/registry
           ~/.cargo/git
-        key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+        key: ${{ runner.os }}-${{ runner.arch }}-cargo-v2-${{ hashFiles('Cargo.toml', 'crates/*/Cargo.toml') }}
         restore-keys: |
-          ${{ runner.os }}-cargo-
+          ${{ runner.os }}-${{ runner.arch }}-cargo-v2-
+
+    - name: Remember the cargo registry key
+      shell: bash
+      run: |
+        echo "CARGO_REGISTRY_CACHE_KEY=${{ steps.cargo-registry.outputs.cache-primary-key }}" >> "$GITHUB_ENV"
+        echo "CARGO_REGISTRY_CACHE_HIT=${{ steps.cargo-registry.outputs.cache-hit }}" >> "$GITHUB_ENV"

.github/actions/skia-cache/action.yml

@@ -0,0 +1,84 @@
+name: Skia binary cache
+description: >
+  Caches the Skia libraries skia-bindings builds, per target and feature set, in rust-skia's own
+  prebuilt-binaries format, so a job only builds Skia from source when its inputs change.
+
+  Restore (default): with an exact hit, skia-bindings installs Skia from the cache instead of
+  building it (FORCE_SKIA_BINARIES_DOWNLOAD + a file:// SKIA_BINARIES_URL). Either way it exports
+  what it used into BUILD_ARTIFACTSTAGINGDIRECTORY, and a cargo shim put first on PATH files each
+  export under rust-skia's key (fork commit, target, features) after every cargo run. The export
+  directory has a fixed name, so it has to be collected per build. These variables stay the same
+  for the whole job: skia-bindings rebuilds Skia when one of them changes, and the Xcode pre-build
+  phases call cargo directly.
+
+  Save (save: 'true', as the job's last step): only on pushes to master, so pull requests and
+  releases read master's entries and never write the ones master restores. Also saves the cargo
+  registry the setup-*-native actions restored, under the same rule.
+
+inputs:
+  name:
+    description: Cache slot; one per job (and matrix arch)
+    required: true
+  save:
+    description: "'true' to save the cache instead of restoring it"
+    required: false
+    default: 'false'
+
+runs:
+  using: composite
+  steps:
+    - name: Prepare
+      if: inputs.save != 'true'
+      shell: bash
+      run: |
+        tmp="$RUNNER_TEMP"
+        command -v cygpath > /dev/null && tmp="$(cygpath -m "$RUNNER_TEMP")"
+        real_cargo="$(command -v cargo)" || { echo "skia-cache: no cargo on PATH; run it after the toolchain setup" >&2; exit 1; }
+        mkdir -p "$tmp/skia-cache" "$tmp/skia-export" "$tmp/skia-cache-bin"
+        cp "$GITHUB_ACTION_PATH/cargo-shim.sh" "$tmp/skia-cache-bin/cargo"
+        chmod +x "$tmp/skia-cache-bin/cargo"
+        echo "$tmp/skia-cache-bin" >> "$GITHUB_PATH"
+        {
+          echo "SKIA_CACHE_REAL_CARGO=$real_cargo"
+          echo "SKIA_CACHE_DIR=$tmp/skia-cache"
+          echo "BUILD_ARTIFACTSTAGINGDIRECTORY=$tmp/skia-export"
+          # bump to drop every Skia cache entry
+          echo "SKIA_CACHE_KEY=skia-v1-${{ inputs.name }}-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('Cargo.lock', 'Cargo.toml', 'crates/*/Cargo.toml', '.cargo/config.toml', 'Makefile', 'tools/scripts/*.sh', 'packages/*/src-native/**/pre-build.sh', '.github/actions/setup-*/action.yml') }}"
+        } >> "$GITHUB_ENV"
+
+    # Exact keys only: a partial match could lack a target, and a forced install that finds no
+    # archive fails the build.
+    - name: Restore
+      if: inputs.save != 'true'
+      id: restore
+      uses: actions/cache/restore@v4
+      with:
+        path: ${{ env.SKIA_CACHE_DIR }}
+        key: ${{ env.SKIA_CACHE_KEY }}
+
+    - name: Use cached Skia
+      if: inputs.save != 'true' && steps.restore.outputs.cache-hit == 'true'
+      shell: bash
+      run: |
+        ls "$SKIA_CACHE_DIR"
+        {
+          echo "SKIA_CACHE_HIT=true"
+          echo "FORCE_SKIA_BINARIES_DOWNLOAD=1"
+          echo "SKIA_BINARIES_URL=file://$SKIA_CACHE_DIR/skia-binaries-{key}.tar.gz"
+        } >> "$GITHUB_ENV"
+
+    - name: Save
+      if: inputs.save == 'true' && env.SKIA_CACHE_KEY != '' && env.SKIA_CACHE_HIT != 'true' && github.event_name == 'push' && github.ref == 'refs/heads/master'
+      uses: actions/cache/save@v4
+      with:
+        path: ${{ env.SKIA_CACHE_DIR }}
+        key: ${{ env.SKIA_CACHE_KEY }}
+
+    - name: Save cargo registry
+      if: inputs.save == 'true' && env.CARGO_REGISTRY_CACHE_KEY != '' && env.CARGO_REGISTRY_CACHE_HIT != 'true' && github.event_name == 'push' && github.ref == 'refs/heads/master'
+      uses: actions/cache/save@v4
+      with:
+        path: |
+          ~/.cargo/registry
+          ~/.cargo/git
+        key: ${{ env.CARGO_REGISTRY_CACHE_KEY }}

.github/actions/skia-cache/cargo-shim.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# CI only (installed by the skia-cache action as `cargo`, first on PATH). Runs the real cargo,
+# then files the Skia binaries skia-bindings exported during that run under their rust-skia key,
+# where SKIA_BINARIES_URL finds them on the next run.
+"$SKIA_CACHE_REAL_CARGO" "$@"
+status=$?
+
+staging="$BUILD_ARTIFACTSTAGINGDIRECTORY"
+cache="$SKIA_CACHE_DIR"
+# GNU tar reads D:/... as host:path
+command -v cygpath > /dev/null && staging="$(cygpath -u "$staging")" && cache="$(cygpath -u "$cache")"
+export_dir="$staging/skia-binaries"
+if [ "$status" -eq 0 ] && [ -f "$export_dir/key.txt" ]; then
+    key="$(cat "$export_dir/key.txt")"
+    archive="$cache/skia-binaries-$key.tar.gz"
+    if [ ! -f "$archive" ]; then
+        tar -czf "$archive" -C "$staging" skia-binaries
+        echo "skia-cache: stored $(basename "$archive")"
+    fi
+    rm -rf "$export_dir"
+fi
+exit "$status"