feat: add cross-platform Zig setup action

.gitattributes

@@ -0,0 +1,3 @@
+* text=auto eol=lf
+dist/** linguist-generated=true
+pnpm-lock.yaml linguist-generated=true

.github/dependabot.yml

@@ -0,0 +1,19 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      actions-toolkit:
+        patterns: ['@actions/*']
+      development:
+        dependency-type: development
+    open-pull-requests-limit: 5
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      actions:
+        patterns: ['*']

.github/workflows/ci.yml

@@ -0,0 +1,121 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+    paths-ignore: ['**/*.md', 'LICENSE', 'docs/**']
+  pull_request:
+    paths-ignore: ['**/*.md', 'LICENSE', 'docs/**']
+  workflow_dispatch:
+    inputs:
+      full:
+        description: Run all six platform and architecture combinations
+        type: boolean
+        default: false
+  workflow_call:
+    inputs:
+      full:
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  check:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3
+        with:
+          cache: true
+          require-lockfile: true
+      - run: pnpm run check
+      - name: Check committed bundles
+        run: |
+          git diff --exit-code -- dist
+          test -z "$(git ls-files --others --exclude-standard dist)"
+      - run: pnpm audit --prod --audit-level moderate
+
+  smoke:
+    needs: check
+    strategy:
+      fail-fast: false
+      matrix:
+        os: ${{ fromJSON(inputs.full && '["ubuntu-24.04", "ubuntu-24.04-arm", "macos-15", "macos-15-intel", "windows-2025", "windows-11-arm"]' || '["ubuntu-24.04", "macos-15", "windows-2025"]') }}
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: ./
+        id: zig
+        with:
+          version: '0.17.0'
+      - run: zig test test/fixtures/smoke.zig
+      - name: Reuse the runner archive without a working mirror
+        uses: ./
+        id: warm
+        with:
+          version: '0.17.0'
+          mirror: https://unreachable.invalid
+          cache: 'false'
+      - name: Check outputs
+        shell: bash
+        env:
+          VERSION: ${{ steps.zig.outputs.version }}
+          WARM_HIT: ${{ steps.warm.outputs.toolchain-cache-hit }}
+        run: |
+          test "$VERSION" = 0.17.0
+          test "$WARM_HIT" = true
+      - run: zig test test/fixtures/smoke.zig
+
+  restore:
+    needs: smoke
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Restore on a fresh runner without a working mirror
+        uses: ./
+        id: restored
+        with:
+          version: '0.17.0'
+          mirror: https://unreachable.invalid
+          cache-read-only: 'true'
+      - name: Check cache hits
+        env:
+          TOOLCHAIN_HIT: ${{ steps.restored.outputs.toolchain-cache-hit }}
+          BUILD_HIT: ${{ steps.restored.outputs.cache-hit }}
+        run: |
+          test "$TOOLCHAIN_HIT" = true
+          test "$BUILD_HIT" = true
+      - run: zig test test/fixtures/smoke.zig
+
+  versions:
+    if: inputs.full
+    needs: check
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        version: ['0.7.0', '0.13.0', latest, master]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: ./
+        with:
+          version: ${{ matrix.version }}
+      - run: zig test test/fixtures/smoke.zig

.github/workflows/codeql.yml

@@ -0,0 +1,38 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+    paths: ['src/**', 'scripts/**', 'package.json', 'pnpm-lock.yaml', 'pnpm-workspace.yaml', '.github/workflows/codeql.yml']
+  pull_request:
+    paths: ['src/**', 'scripts/**', 'package.json', 'pnpm-lock.yaml', 'pnpm-workspace.yaml', '.github/workflows/codeql.yml']
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: codeql-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    if: github.event.repository.private == false
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      security-events: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
+        with:
+          languages: javascript-typescript
+          build-mode: none
+          config: |
+            paths:
+              - src
+              - scripts
+      - uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4

.github/workflows/release.yml

@@ -0,0 +1,65 @@
+name: Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Release tag (for example, v1.0.0)
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release
+  cancel-in-progress: false
+
+jobs:
+  validate:
+    if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Validate version
+        env:
+          VERSION: ${{ inputs.version }}
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          [[ "$VERSION" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]
+          test "v$(jq -r '.version' package.json)" = "$VERSION"
+          if gh release view "$VERSION" >/dev/null 2>&1; then
+            echo 'This release already exists.' >&2
+            exit 1
+          fi
+  test:
+    needs: validate
+    uses: ./.github/workflows/ci.yml
+    with:
+      full: true
+  publish:
+    needs: test
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Publish release and update the major tag
+        env:
+          VERSION: ${{ inputs.version }}
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh api --method POST "repos/$GITHUB_REPOSITORY/git/refs" -f ref="refs/tags/$VERSION" -f sha="$GITHUB_SHA"
+          gh release create "$VERSION" --verify-tag --generate-notes --title "$VERSION"
+          major="${VERSION%%.*}"
+          if gh api "repos/$GITHUB_REPOSITORY/git/ref/tags/$major" >/dev/null 2>&1; then
+            gh api --method PATCH "repos/$GITHUB_REPOSITORY/git/refs/tags/$major" -f sha="$GITHUB_SHA" -F force=true
+          else
+            gh api --method POST "repos/$GITHUB_REPOSITORY/git/refs" -f ref="refs/tags/$major" -f sha="$GITHUB_SHA"
+          fi

.gitignore

@@ -0,0 +1,6 @@
+node_modules/
+coverage/
+.zig-cache/
+zig-cache/
+zig-out/
+*.log

.node-version

@@ -0,0 +1 @@
+24

CONTRIBUTING.md

@@ -0,0 +1,30 @@
+# Contributing
+
+Use Node 24 and pnpm 12. Install dependencies and run the local checks:
+
+```sh
+pnpm install --frozen-lockfile
+pnpm run check
+```
+
+Follow the [Google TypeScript style guide](https://google.github.io/styleguide/tsguide.html). Run `pnpm run format` before committing. Use descriptive names and document non-obvious contracts with concise JSDoc; use line comments to explain implementation decisions. Avoid repeating what the types and code already say.
+
+Commit `dist/` whenever source or runtime dependencies change. Consumers run these bundles directly without installing npm packages. CI rebuilds them and checks for differences. Bundled dependency licenses are generated alongside the code.
+
+Unit tests use Node's test runner and make no network requests. To test a real download, signature verification, extraction, and offline reuse of the runner cache:
+
+```sh
+node scripts/smoke.mjs 0.17.0
+```
+
+`SETUP_ZIG_TEST_MIRROR` can select a community mirror for this check. Integration jobs exercise the bundled action on Linux, macOS, and Windows. The full matrix also covers arm64 Linux and Windows and Intel macOS.
+
+Keep the input surface small. Add a regression test for changes to version resolution, verification, and cache behavior. Do not bypass verification to support a new download source.
+
+## Releases
+
+1. Update `package.json` and `pnpm-lock.yaml` to the release version. Rebuild `dist/` and merge the change.
+2. Run the **Release** workflow from `main`, with a tag such as `v1.0.0`.
+3. The workflow runs the full test matrix, creates the version tag and GitHub release, then moves the corresponding major tag (for example, `v1`). Existing version tags are never replaced.
+
+Before the first public release, make the repository public and enable private vulnerability reporting in repository settings. Publish the action to GitHub Marketplace from the release page if desired. Release tags identify exact revisions; major tags follow compatible updates.

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Nelson Dominguez
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.