Zig build is somewhat poorly documented currently, which can lead to some annoyance (also some other annoyances with dependency hashes), but in my experimentation:

Dependencies in build.zig.zon are downloaded in to ~/.cache/zig/p/<hash> (incidentally, this means you need to mangle the hash if you are copying and pasting the hash for a dependency, at least currently. Dependency hashes are a sore spot tbh, and needs to be better)

Then when you are using said dependency in your build.zig, the function provided will refer to that source artifact in .cache.

At least this seems to be the case. I write a decent amount of zig, but haven’t dove too much in to the build system till recently, when I tried (and failed due to translate-c bugs), to get some C libraries added to zig using only zig build.

zig fetch fills the hash for you, or simply omitting .hash in zon and the compiler tells it for you. I'm writing backend in zig and I have zstd directly from zon as a dependency.

    .dependencies = .{
        .zstd = .{
            .url = "git+https://github.com/facebook/zstd.git#v1.5.5",
            .hash = "1220185ad79a437fd9f148d1422ff756287534c79a0712105039b4034031480e41a9",
        },
    },

You then refer to that with dep = b.dependency(...) and can get paths to the unpacked source with dep.path(...)

I’m intrigued. Do you have a starting point? And how does it handle if I need to integrate with another language as well, like Swift?

I was researching this the other day, here is a non trivial example:

https://github.com/floooh/sokol-tools/blob/master/build.zig

Here is a tutorial: https://www.zvm.app/tutorials/zig-build-cpp.html