v0.4.0

0.4.0 (2026-10-16)

Features

• sdk: achieve zero-to-hero readiness with dual Zig 0.16/0.17 support (#50) (3eb64fb)

v0.3.5

0.3.5 (2026-07-25)

Bug Fixes

• codegen Float scalars, compilation errors, and API signature updates (#48) (3ff9d82)

v0.3.4

dagger-zig v0.3.4 — Community Update

The headline

dagger call now works. This release fixes the core runtime path that prevented Zig modules from loading in the Dagger engine. If you tried to use dagger-zig before and hit failed to call module to get functions: call constructor: exit code: 1, this is the fix.

What was broken

The Zig SDK library lived at the repository root (src/), one level above the sdk/ directory that the Dagger engine clones when a user references the SDK. When ModuleRuntime tried to build a user's Zig module inside the engine container, @import("dagger_sdk") had nothing to resolve against — the library wasn't there. Codegen compounded the problem by emitting a dagger.gen.zig that imported dagger_sdk without declaring the dependency or generating any build files.

The result: every dagger call and dagger develop against a Zig module failed at the constructor stage.

What we fixed

1. Vendored the library inside the SDK module. Moved src/ → sdk/lib/src/ so the Zig library ships inside the SDK module that the engine clones. Added a consumer-facing sdk/lib/build.zig + build.zig.zon that exposes dagger_sdk via b.dependency().

2. Rewrote ModuleRuntime. Now mounts sdk/lib (the Zig library, not the Go bootstrap tree) at /sdk-lib. The build script symlinks /sdk-lib → .dagger-sdk-lib so the generated build.zig.zon's relative .path resolves regardless of the module's source subpath.

3. Rewrote Codegen. Now emits three files for every user module:

   • build.zig — wires dagger_sdk as a dependency and installs a module executable via the module-runtime step
   • build.zig.zon — declares the dagger_sdk path dependency (with the fingerprint field Zig 0.16 requires)
   • internal/dagger/dagger.gen.zig — re-export shim so @import("dagger") works too

4. Fixed the CI pipeline module. The ci/pipeline/build.zig referenced ../../sdk/lib/src/root.zig directly, which doesn't exist inside the container. Switched to b.dependency("dagger_sdk", ...) with a proper build.zig.zon.

5. Forked otel-go to drop vulnerable transitive dependencies from the Go SDK bootstrap.

6. Applied zig fmt to all unformatted source files.

Verified end-to-end

$ dagger develop
# → generated build.zig + build.zig.zon + internal/dagger/dagger.gen.zig

$ dagger call hello
hello from dagger-zig module runtime

The full runtime path — codegen, ModuleRuntime, Zig build in-container, entrypoint dispatch, function call — works.

Supply chain

Every release artifact is signed and attested:

Attestation	How to verify
Cosign signature	cosign verify-blob --bundle <file>.bundle --certificate-identity 'https://github.com/MChorfa/dagger-zig/.github/workflows/release.yml@refs/tags/v0.3.4' --certificate-oidc-issuer https://token.actions.githubusercontent.com <file>
GitHub attestation	gh attestation verify <file> --repo MChorfa/dagger-zig
SLSA L3 provenance	slsa-verifier verify-artifact <tarball> --provenance-path multiple.intoto.jsonl --source-uri github.com/MChorfa/dagger-zig --source-tag v0.3.4
SBOM	sbom.spdx.json and sbom.cdx.json included in release assets

Downloads

Target	Asset
aarch64 Linux	dagger-zig-v0.3.4-aarch64-linux-gnu.tar.gz
x86_64 Linux	dagger-zig-v0.3.4-x86_64-linux-gnu.tar.gz
aarch64 macOS	dagger-zig-v0.3.4-aarch64-macos.tar.gz
x86_64 macOS	dagger-zig-v0.3.4-x86_64-macos.tar.gz

Verify with sha256sum -c checksums.sha256.

Getting started

# In your Dagger module directory:
dagger init --sdk github.com/MChorfa/dagger-zig/sdk@v0.3.4
dagger develop
dagger call hello

What's next

• More example modules (container builds, parallel pipelines, SBOM generation)
• SPIFFE workload identity integration for zero-trust CI
• Improved error messages from the Zig dispatch layer

Thanks

To everyone who reported the runtime failure and helped trace it — this fix is for you.

---

Full changelog: v0.3.3...v0.3.4

v0.3.3

0.3.3 (2026-06-12)

Bug Fixes

• publish release checksum manifests (c2c79ae)
• require release manifest bundle in verifier (7fbf1aa)
• tolerate legacy release manifest bundles (f016e11)

v0.3.2

Features

• bench: add real offline zig build bench step — query-builder and serialization throughput (28e1349)
• bench: print per-stage breakdown to the terminal (fbbf6a8)
• bench: add zig build flamegraph target (external profiler, fails loud if tooling absent) (9d7413b)
• parallel: real concurrency via std.Io.Group + Client.branch() (0565bec)
• ci: SLSA v1 provenance, Syft SBOM (CycloneDX + SPDX), Cosign keyless attestation, OPA/Rego governance gate (94b4b5d)

Bug Fixes

• zig-0.16: replace removed std.time timestamp APIs with std.c.clock_gettime(CLOCK.MONOTONIC) in telemetry and test suite (be80542)
• zig-0.16: fix removed std.Io.Threaded.init_single_threaded → .init(gpa, .{}) with defer deinit() in bench (be80542)
• test-suite: fix phantom error types (errors.ClientError, ConnectionFailed, QueryFailed) → correct errors.QueryError / HandshakeFailed / TransportFailed members (be80542)

Documentation

• why-zig: remove unverified comparative claims (29c86cf)

v0.3.1

Release v0.3.1

v0.3.0

What's Changed

• fix: correct repository reference to MChorfa/dagger-zig by @MChorfa in #28
• docs: fix CHANGELOG repository reference description by @MChorfa in #29

Full Changelog: v0.2.1...v0.3.0

v0.2.1

release: v0.2.1 fix type mismatch and repository references

* ci: trigger new workflow run after cache error

* fix: type mismatch in GeneratedCode constructor for CLI > v0.12.5

- Change dag.GeneratedCode(changeset) to dag.GeneratedCode(withGen)
- Remove unused changeset variable
- Update CHANGELOG for v0.2.1

Fixes compatibility with Dagger CLI v0.21.0 and all versions newer than v0.12.5.

---------

Co-authored-by: Mohamed Chorfa <mohamed.chorfa@thalesgroup.com>

v0.2.0

0.2.0 (2026-05-02)

Features

• Address all SDK gaps - Phase 1 & 2 (a7d2879)

Bug Fixes

• examples: resolve error union chaining and add missing API methods (ea6a75f)
• release: address v0.2.0 critical blockers (0b4170b)
• review: address all PR review comments (f33e1c8)
• review: address parallel_validation feedback in tracing.zig (ca19188)
• slsa: update Zig version from 0.13.0 to 0.16.0 (2851002)
• v0.2.0: address critical release blockers (868b5dd)

v0.1.2

0.1.2 (2026-04-25)

Bug Fixes

• release: add tag trigger support for manual releases (b9f3fbd)
• release: add tag trigger support for manual releases (c1bc1f4)