ci(publish): build and publish container runner release artifacts

.github/workflows/publish.yaml

@@ -157,6 +157,23 @@ jobs:
             upload_prefix: engine
             platform: windows-x64
             release_only: true
+          # Container runner binary: static musl builds only. The runner only ever
+          # runs inside Linux containers, where users curl the released binary into
+          # their image.
+          - name: container-runner (linux-x64-musl)
+            build_target: container-runner
+            docker: docker/build/linux-x64-musl.Dockerfile
+            artifact: rivet-container-runner-x86_64-unknown-linux-musl
+            upload_prefix: container-runner
+            platform: linux-x64-musl
+            release_only: false
+          - name: container-runner (linux-arm64-musl)
+            build_target: container-runner
+            docker: docker/build/linux-arm64-musl.Dockerfile
+            artifact: rivet-container-runner-aarch64-unknown-linux-musl
+            upload_prefix: container-runner
+            platform: linux-arm64-musl
+            release_only: false
           # Rivet Cloud CLI: 4 platforms for preview, 5 for release. The publish
           # job also places the matching rivet-engine artifact next to the CLI
           # binary so `rivet dev` works from the npm package.
@@ -407,6 +424,12 @@ jobs:
           path: cli-artifacts
           pattern: cli-*
           merge-multiple: true
+      - name: Download container runner artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: container-runner-artifacts
+          pattern: container-runner-*
+          merge-multiple: true
       - name: Place native binaries in platform packages
         run: |
           NATIVE_DIR=rivetkit-typescript/packages/rivetkit-napi
@@ -552,6 +575,12 @@ jobs:
           R2_RELEASES_SECRET_ACCESS_KEY: ${{ secrets.R2_RELEASES_SECRET_ACCESS_KEY }}
         run: pnpm --filter=publish exec tsx src/ci/bin.ts upload-r2 --source "$GITHUB_WORKSPACE/engine-artifacts" --sha ${{ needs.context.outputs.sha }}
 
+      - name: Upload container runner binaries to R2
+        env:
+          R2_RELEASES_ACCESS_KEY_ID: ${{ secrets.R2_RELEASES_ACCESS_KEY_ID }}
+          R2_RELEASES_SECRET_ACCESS_KEY: ${{ secrets.R2_RELEASES_SECRET_ACCESS_KEY }}
+        run: pnpm --filter=publish exec tsx src/ci/bin.ts upload-r2 --source "$GITHUB_WORKSPACE/container-runner-artifacts" --sha ${{ needs.context.outputs.sha }} --name container-runner
+
       - name: Copy R2 artifacts to version path
         if: needs.context.outputs.trigger == 'release'
         env:
@@ -562,6 +591,11 @@ jobs:
             --sha ${{ needs.context.outputs.sha }} \
             --version ${{ needs.context.outputs.version }} \
             --latest ${{ needs.context.outputs.latest }}
+          pnpm --filter=publish exec tsx src/ci/bin.ts copy-r2 \
+            --sha ${{ needs.context.outputs.sha }} \
+            --version ${{ needs.context.outputs.version }} \
+            --latest ${{ needs.context.outputs.latest }} \
+            --name container-runner
 
       - name: Dry-run Rust crate publish
         if: needs.context.outputs.trigger != 'release'

docker/build/linux-arm64-musl.Dockerfile

@@ -76,6 +76,11 @@ RUN --mount=type=cache,id=cargo-registry-linux-arm64-musl,target=/usr/local/carg
             cargo build -p rivet-cli --bin rivet $CARGO_FLAG --target aarch64-unknown-linux-musl && \
         /opt/aarch64-linux-musl-cross/bin/aarch64-linux-musl-strip target/aarch64-unknown-linux-musl/$PROFILE_DIR/rivet && \
         cp target/aarch64-unknown-linux-musl/$PROFILE_DIR/rivet /artifacts/rivet-aarch64-unknown-linux-musl; \
+    elif [ "$BUILD_TARGET" = "container-runner" ]; then \
+        RUSTFLAGS="-C target-feature=+crt-static -C link-arg=-static-libgcc" \
+            cargo build -p rivet-container-runner --bin rivet-container-runner $CARGO_FLAG --target aarch64-unknown-linux-musl && \
+        /opt/aarch64-linux-musl-cross/bin/aarch64-linux-musl-strip target/aarch64-unknown-linux-musl/$PROFILE_DIR/rivet-container-runner && \
+        cp target/aarch64-unknown-linux-musl/$PROFILE_DIR/rivet-container-runner /artifacts/rivet-container-runner-aarch64-unknown-linux-musl; \
     elif [ "$BUILD_TARGET" = "rivetkit-napi" ]; then \
         cd rivetkit-typescript/packages/rivetkit-napi && \
         RUSTFLAGS="--cfg tokio_unstable -C target-feature=-crt-static" \

docker/build/linux-x64-musl.Dockerfile

@@ -75,6 +75,11 @@ RUN --mount=type=cache,id=cargo-registry-linux-x64-musl,target=/usr/local/cargo/
             cargo build -p rivet-cli --bin rivet $CARGO_FLAG --target x86_64-unknown-linux-musl && \
         /opt/x86_64-unknown-linux-musl/bin/x86_64-unknown-linux-musl-strip target/x86_64-unknown-linux-musl/$PROFILE_DIR/rivet && \
         cp target/x86_64-unknown-linux-musl/$PROFILE_DIR/rivet /artifacts/rivet-x86_64-unknown-linux-musl; \
+    elif [ "$BUILD_TARGET" = "container-runner" ]; then \
+        RUSTFLAGS="-C target-feature=+crt-static -C link-arg=-static-libgcc" \
+            cargo build -p rivet-container-runner --bin rivet-container-runner $CARGO_FLAG --target x86_64-unknown-linux-musl && \
+        /opt/x86_64-unknown-linux-musl/bin/x86_64-unknown-linux-musl-strip target/x86_64-unknown-linux-musl/$PROFILE_DIR/rivet-container-runner && \
+        cp target/x86_64-unknown-linux-musl/$PROFILE_DIR/rivet-container-runner /artifacts/rivet-container-runner-x86_64-unknown-linux-musl; \
     elif [ "$BUILD_TARGET" = "rivetkit-napi" ]; then \
         cd rivetkit-typescript/packages/rivetkit-napi && \
         RUSTFLAGS="--cfg tokio_unstable -C target-feature=-crt-static" \