feat(image): pre-install Rust, Zig, and cargo-lambda

Bake toolchain needed by velmios-aws-lambdas release CI so self-hosted
runners skip moonrepo/setup-rust and setup-zig on every job.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: miragecentury

AGENTS.md

@@ -8,7 +8,7 @@ Self-hosted GitHub Actions runner **container image** for Deerhide / Velmios CI:
 
 - Image: `ghcr.io/deerhide/python-github-runner`
 - Base: `ghcr.io/actions/actions-runner` (`RUNNER_VERSION` in `manifest.yaml`)
-- Includes Python 3.12/3.13 (deadsnakes), Poetry, UV, DevOps CLIs (argo, kargo, kubectl, pack, skopeo, buildah, …), OpenAPI CLIs (redocly, spectral, portman, newman, oasdiff), Node/Bun, and a full OCI build/scan pipeline so the image can build itself.
+- Includes Python 3.12/3.13 (deadsnakes), Poetry, UV, DevOps CLIs (argo, kargo, kubectl, pack, skopeo, buildah, …), OpenAPI CLIs (redocly, spectral, portman, newman, oasdiff), Node/Bun, Rust + Zig + cargo-lambda (AWS Lambda Rust CI), and a full OCI build/scan pipeline so the image can build itself.
 
 Tool inventory and version tables live in [README.md](README.md). Do not duplicate them here.
 

Containerfile

@@ -20,6 +20,7 @@ RUN apt-get update \
        skopeo buildah \
        jq \
        unzip \
+       xz-utils \
     && apt-get autoremove -y \
     && apt-get clean \
     && rm -rf /var/lib/apt/lists/*
@@ -162,6 +163,37 @@ RUN curl -sSL -o /tmp/oasdiff.tgz \
     && chmod +x /usr/local/bin/oasdiff \
     && rm -f /tmp/oasdiff.tgz
 
+# Rust toolchain (velmios-aws-lambdas / cargo-lambda CI)
+ARG RUST_VERSION=1.97.1
+ENV RUSTUP_HOME=/usr/local/rustup \
+    CARGO_HOME=/usr/local/cargo \
+    PATH=/usr/local/cargo/bin:${PATH}
+# hadolint ignore=DL4006
+RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
+      | sh -s -- -y --default-toolchain "${RUST_VERSION}" --profile minimal \
+    && chmod -R a+rX /usr/local/rustup /usr/local/cargo \
+    && rustc --version && cargo --version
+
+# Zig linker for cargo-lambda arm64 cross-builds.
+# 0.14.0 uses zig-linux-x86_64-*; 0.14.1+ renamed to zig-x86_64-linux-* — update URL on bump.
+ARG ZIG_VERSION=0.14.0
+RUN curl -sSL -o /tmp/zig.tar.xz \
+      "https://ziglang.org/download/${ZIG_VERSION}/zig-linux-x86_64-${ZIG_VERSION}.tar.xz" \
+    && tar -xJf /tmp/zig.tar.xz -C /usr/local \
+    && mv "/usr/local/zig-linux-x86_64-${ZIG_VERSION}" /usr/local/zig \
+    && ln -sf /usr/local/zig/zig /usr/local/bin/zig \
+    && rm -f /tmp/zig.tar.xz \
+    && zig version
+
+# cargo-lambda (AWS Lambda Rust packaging)
+ARG CARGO_LAMBDA_VERSION=1.9.1
+RUN curl -sSL -o /tmp/cargo-lambda.tgz \
+      "https://github.com/cargo-lambda/cargo-lambda/releases/download/v${CARGO_LAMBDA_VERSION}/cargo-lambda-v${CARGO_LAMBDA_VERSION}.x86_64-unknown-linux-musl.tar.gz" \
+    && tar -xzf /tmp/cargo-lambda.tgz -C /usr/local/bin cargo-lambda \
+    && chmod +x /usr/local/bin/cargo-lambda \
+    && rm -f /tmp/cargo-lambda.tgz \
+    && cargo lambda --version
+
 # Install pre-commit
 # hadolint ignore=DL3013
 RUN pip3 install --no-cache-dir pre-commit
@@ -198,4 +230,4 @@ RUN chmod +x /tmp/cache_actions.sh \
     && rm -f /tmp/manifest.yaml /tmp/cache_actions.sh
 
 # Add user tool paths to interactive shell PATH
-RUN echo "export PATH=\"/usr/local/bin:${APP_HOME}/.uv/bin:${APP_HOME}/.poetry/bin:${APP_HOME}/.local/bin:\$PATH\"" >> ~/.bashrc
+RUN echo "export PATH=\"/usr/local/bin:/usr/local/cargo/bin:${APP_HOME}/.uv/bin:${APP_HOME}/.poetry/bin:${APP_HOME}/.local/bin:\$PATH\"" >> ~/.bashrc

README.md

@@ -29,6 +29,16 @@ Container image based on the [GitHub Actions Runner](https://github.com/actions/
 | [Node.js](https://nodejs.org/) / npm | JavaScript runtime and package manager (npm/npx bundled) |
 | [Bun](https://bun.sh/) | JavaScript runtime, package manager, bundler, and test runner |
 
+### Rust / AWS Lambda
+
+Pre-installed for [`velmios-aws-lambdas`](https://github.com/Laelidona/velmios-aws-lambdas) release builds (`cargo lambda build --arm64`).
+
+| Tool | Version source | Notes |
+|------|----------------|-------|
+| [Rust](https://www.rust-lang.org/) (rustc, cargo) | `RUST_VERSION` | rustup `minimal` profile under `/usr/local/{rustup,cargo}` |
+| [Zig](https://ziglang.org/) | `ZIG_VERSION` | Linker for cargo-lambda cross-compile; `0.14.0` tarball name differs from `0.14.1+` |
+| [cargo-lambda](https://www.cargo-lambda.info/) | `CARGO_LAMBDA_VERSION` | Musl binary from GitHub releases |
+
 ### Build pipeline tools
 
 These tools allow the image to run its own build pipeline as a self-hosted runner.

manifest.yaml

@@ -22,6 +22,9 @@ build:
     - PORTMAN_VERSION=1.35.0
     - NEWMAN_VERSION=6.2.2
     - OASDIFF_VERSION=1.23.0
+    - RUST_VERSION=1.97.1
+    - ZIG_VERSION=0.14.0
+    - CARGO_LAMBDA_VERSION=1.9.1
   labels:
     - org.opencontainers.image.source=https://github.com/deerhide/python-github-runner
     - org.opencontainers.image.description="Python GitHub Runner"

renovate.json

@@ -101,6 +101,35 @@
       "depNameTemplate": "oven-sh/bun",
       "datasourceTemplate": "github-releases",
       "extractVersionTemplate": "^bun-v?(?<version>.+)$"
+    },
+    {
+      "customType": "regex",
+      "description": "Update Rust toolchain version",
+      "fileMatch": ["^Containerfile$", "^manifest\\.yaml$"],
+      "matchStrings": ["RUST_VERSION=(?<currentValue>\\S+)"],
+      "depNameTemplate": "rust",
+      "datasourceTemplate": "github-releases",
+      "packageNameTemplate": "rust-lang/rust",
+      "extractVersionTemplate": "^v?(?<version>.+)$"
+    },
+    {
+      "customType": "regex",
+      "description": "Update Zig version",
+      "fileMatch": ["^Containerfile$", "^manifest\\.yaml$"],
+      "matchStrings": ["ZIG_VERSION=(?<currentValue>\\S+)"],
+      "depNameTemplate": "zig",
+      "datasourceTemplate": "github-releases",
+      "packageNameTemplate": "ziglang/zig",
+      "extractVersionTemplate": "^v?(?<version>.+)$"
+    },
+    {
+      "customType": "regex",
+      "description": "Update cargo-lambda version",
+      "fileMatch": ["^Containerfile$", "^manifest\\.yaml$"],
+      "matchStrings": ["CARGO_LAMBDA_VERSION=(?<currentValue>\\S+)"],
+      "depNameTemplate": "cargo-lambda/cargo-lambda",
+      "datasourceTemplate": "github-releases",
+      "extractVersionTemplate": "^v?(?<version>.+)$"
     }
   ]
 }