Use NuGet for vcpkg binary cache

.cicd/platforms/asan.Dockerfile

@@ -32,6 +32,7 @@ RUN apt-get update && apt-get upgrade -y && \
                        zip                  \
                        unzip                \
                        tar                  \
+                       mono-complete        \
                        vim                  \
                        sudo                 \
                        doxygen              \
@@ -75,4 +76,4 @@ COPY <<-EOF /extras.cmake
 EOF
 
 ENV SYSIO_PLATFORM_HAS_EXTRAS_CMAKE=1
-ENV ASAN_OPTIONS=detect_leaks=0
+ENV ASAN_OPTIONS=detect_leaks=0

.cicd/platforms/asserton.Dockerfile

@@ -32,6 +32,7 @@ RUN apt-get update && apt-get upgrade -y && \
                        zip                  \
                        unzip                \
                        tar                  \
+                       mono-complete        \
                        vim                  \
                        sudo                 \
                        doxygen              \
@@ -78,4 +79,4 @@ COPY <<-EOF /extras.cmake
   set(SYSIO_ENABLE_RELEASE_BUILD_TEST "Off" CACHE BOOL "")
 EOF
 
-ENV SYSIO_PLATFORM_HAS_EXTRAS_CMAKE=1
+ENV SYSIO_PLATFORM_HAS_EXTRAS_CMAKE=1

.cicd/platforms/gcc.Dockerfile

@@ -28,6 +28,7 @@ RUN apt-get update && apt-get upgrade -y && \
     zip                  \
     unzip                \
     tar                  \
+    mono-complete        \
     sudo                 \
     golang               \
     python3-dev          \
@@ -62,4 +63,4 @@ COPY <<-EOF /extras.cmake
   set(CMAKE_CXX_FLAGS "-Wall -Wextra -fdiagnostics-color=always" CACHE STRING "")
 EOF
 
-ENV SYSIO_PLATFORM_HAS_EXTRAS_CMAKE=1
+ENV SYSIO_PLATFORM_HAS_EXTRAS_CMAKE=1

.cicd/platforms/ubsan.Dockerfile

@@ -32,6 +32,7 @@ RUN apt-get update && apt-get upgrade -y && \
                        zip                  \
                        unzip                \
                        tar                  \
+                       mono-complete        \
                        vim                  \
                        sudo                 \
                        doxygen              \
@@ -79,4 +80,4 @@ COPY <<-EOF /extras.cmake
 EOF
 
 ENV SYSIO_PLATFORM_HAS_EXTRAS_CMAKE=1
-ENV UBSAN_OPTIONS=print_stacktrace=1,suppressions=/ubsan.supp
+ENV UBSAN_OPTIONS=print_stacktrace=1,suppressions=/ubsan.supp

.cicd/platforms/ubuntu24.Dockerfile

@@ -27,6 +27,7 @@ RUN apt-get update && apt-get upgrade -y && \
     zip                  \
     unzip                \
     tar                  \
+    mono-complete        \
     sudo                 \
     golang               \
     python3-dev          \
@@ -52,4 +53,4 @@ RUN apt-get update && apt-get upgrade -y && \
 
 ENV CC=/usr/bin/clang-18
 ENV CXX=/usr/bin/clang++-18
-ENV CMAKE_MAKE_PROGRAM=/usr/bin/ninja
+ENV CMAKE_MAKE_PROGRAM=/usr/bin/ninja

.github/vcpkg-triplets/x64-linux-release.cmake

@@ -0,0 +1,5 @@
+set(VCPKG_TARGET_ARCHITECTURE x64)
+set(VCPKG_CRT_LINKAGE dynamic)
+set(VCPKG_LIBRARY_LINKAGE static)
+set(VCPKG_CMAKE_SYSTEM_NAME Linux)
+set(VCPKG_BUILD_TYPE release)

.github/workflows/build.yaml

@@ -52,6 +52,9 @@ jobs:
     name: Run Build Workflow
     uses: ./.github/workflows/build_base.yaml
     needs: [platform-cache]
+    permissions:
+      packages: write
+      contents: read
     secrets:
       GH_TOKEN_DEV: ${{ secrets.GH_TOKEN_DEV }}
     with:

.github/workflows/build_base.yaml

@@ -15,8 +15,12 @@ on:
       GH_TOKEN_DEV:
         required: true
 
+# Trusted CI publishes vcpkg binary cache packages to GitHub Packages. Fork pull
+# requests run with GitHub's reduced token permissions and the build script
+# switches them to forked-pr-ci mode, which uses a local vcpkg cache and unsets
+# package credentials before configuring.
 permissions:
-  packages: read
+  packages: write
   contents: read
 
 defaults:
@@ -41,6 +45,8 @@ jobs:
       CCACHE_MAXSIZE: "10G"
       CCACHE_COMPRESS: "true"
       CCACHE_COMPRESSLEVEL: "6"
+      VCPKG_DISABLE_METRICS: "1"
+      VCPKG_NUGET_FEED: https://nuget.pkg.github.com/${{ github.repository_owner }}/index.json
     steps:
         - name: Allow safe directories
           run: git config --global --add safe.directory '*'
@@ -49,14 +55,6 @@ jobs:
           with:
             submodules: recursive
 
-        - name: Restore vcpkg binary cache
-          uses: actions/cache@v5
-          with:
-            path: ${{ github.workspace }}/vcpkg-binary-cache
-            key: vcpkg-binaries-${{ matrix.platform }}-${{ hashFiles('vcpkg.json') }}
-            restore-keys: |
-              vcpkg-binaries-${{ matrix.platform }}-
-
         - name: Restore ccache
           uses: actions/cache@v5
           with:
@@ -67,45 +65,47 @@ jobs:
 
         - name: Build
           id: build
+          env:
+            GITHUB_TOKEN: ${{ github.token }}
+            GITHUB_USER: ${{ github.repository_owner }}
+            IS_FORK_PR: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository }}
+            VCPKG_INSTALL_OPTIONS: --debug
           run: |
             echo "Building for ${{ matrix.platform }}"
 
             # Use $GITHUB_WORKSPACE (container path /__w/...) not ${{ github.workspace }}
-            # (host path /home/runner/work/...) so ccache/vcpkg write to the mounted
-            # volume and persist for actions/cache to save.
+            # (host path /home/runner/work/...) so ccache writes to the mounted
+            # volume and persists for actions/cache to save.
             export CCACHE_DIR="$GITHUB_WORKSPACE/.ccache"
-            export VCPKG_BINARY_SOURCES="clear;files,$GITHUB_WORKSPACE/vcpkg-binary-cache,readwrite"
-
-            # Clean intermediate vcpkg artifacts but preserve binary cache and downloads
-            rm -rf vcpkg/buildtrees vcpkg/packages vcpkg/vcpkg_installed \
-                    build/vcpkg_installed ~/.cache/vcpkg ~/.vcpkg
-
-            mkdir -p "$GITHUB_WORKSPACE/vcpkg-binary-cache"
-
-            ./vcpkg/bootstrap-vcpkg.sh
 
             chown -R $(id -u):$(id -g) $PWD
 
             # Reset ccache stats for this build
             ccache -z || true
 
-            cmake -B build -S . -G Ninja ${SYSIO_PLATFORM_HAS_EXTRAS_CMAKE:+-C /extras.cmake} \
-            -DCMAKE_C_COMPILER=$CC \
-            -DCMAKE_CXX_COMPILER=$CXX \
-            -DCMAKE_MAKE_PROGRAM=$CMAKE_MAKE_PROGRAM \
-            -DCMAKE_TOOLCHAIN_FILE=$PWD/vcpkg/scripts/buildsystems/vcpkg.cmake \
-            -DCMAKE_BUILD_TYPE=Release \
-            -DENABLE_CCACHE=ON \
-            -DENABLE_TESTS=ON \
-            ${CMAKE_PREFIX_PATH:+-DCMAKE_PREFIX_PATH=$CMAKE_PREFIX_PATH}
-
             if [[ "${{ matrix.platform }}" == "gcc" ]]; then
               echo "Using reduced parallelism for gcc platform"
-              cmake --build build -- -j 8
+              BUILD_JOBS=8
             else
-              cmake --build build -- -j 11
+              BUILD_JOBS=11
+            fi
+
+            BUILD_MODE=trusted-ci
+            if [[ "$IS_FORK_PR" == "true" ]]; then
+              echo "Using local vcpkg binary cache for fork pull request"
+              BUILD_MODE=forked-pr-ci
+              unset GITHUB_TOKEN GITHUB_USER
             fi
 
+            scripts/build-with-github-vcpkg-cache.sh \
+              --mode "$BUILD_MODE" \
+              --build-dir build \
+              --jobs "$BUILD_JOBS" \
+              --configure-only
+
+            echo "Diagnostic vcpkg run completed; stopping before project build and artifact upload."
+            exit 1
+
             echo "=== ccache statistics ==="
             ccache -s || true
 

.gitignore

@@ -25,6 +25,7 @@ tmp
 \.#*
 CMakeCache.txt
 CMakeFiles
+CMakeUserPresets.json
 cmake-build-*/
 Makefile
 compile_commands.json