Dependencies in build.zig.zon are downloaded in to ~/.cache/zig/p/<hash> (incidentally, this means you need to mangle the hash if you are copying and pasting the hash for a dependency, at least currently. Dependency hashes are a sore spot tbh, and needs to be better)
Then when you are using said dependency in your build.zig, the function provided will refer to that source artifact in .cache.
At least this seems to be the case. I write a decent amount of zig, but haven’t dove too much in to the build system till recently, when I tried (and failed due to translate-c bugs), to get some C libraries added to zig using only zig build.
.dependencies = .{
.zstd = .{
.url = "git+https://github.com/facebook/zstd.git#v1.5.5",
.hash = "1220185ad79a437fd9f148d1422ff756287534c79a0712105039b4034031480e41a9",
},
},
You then refer to that with dep = b.dependency(...) and can get paths to the unpacked source with dep.path(...)https://github.com/floooh/sokol-tools/blob/master/build.zig
Here is a tutorial: https://www.zvm.app/tutorials/zig-build-cpp.html