ci: replace docker .rpm builds with cargo zigbuild

[kixelated]

Summary

Two fixes folded together to get the release workflows actually green:

1. envsubst pre-rendering before nfpm pkg. nfpm's ${VAR} expansion only fires on a small allow-list of top-level fields (name, arch, version); for contents[].src and contents[].dst the value flows straight into the glob handler, which treats ${BINARY_PATH} as a literal pattern and fails with glob failed: ${BINARY_PATH}: no matching files. {{ .Env.VAR }} doesn't help either: nfpm's templating doc lists the same restricted field set. Each .deb/.rpm step now does envsubst '$VERSION $ARCH ...' < nfpm.yaml > /tmp/nfpm.yaml before invoking nfpm.

2. cargo zigbuild in place of the AlmaLinux 9 / Debian 12 docker rebuilds. The previous Package .rpm (and Package .deb for moq-gst) reinstalled Rust inside a container on every run just to link against an older glibc. That path was slow (~7-15 min, no cargo cache), fragile (hit curl-minimal vs curl dnf conflicts, exit-127 surprises), and easy to break invisibly. Replaced with cargo zigbuild --target <triple>.2.34, which produces one binary covering Debian 12+, Ubuntu 22.04+, and RHEL/Rocky/Alma 9+. The .deb and .rpm steps now point nfpm at the same artifact.

For moq-gst the deb and rpm jobs collapse into one package job per arch on ubuntu-24.04 (ships GStreamer 1.24, satisfies gstreamer-rs 0.23's >= 1.22 headers requirement). The resulting .so still dynamic-links to the host's libgstreamer-1.0.so.0, matching the existing nfpm >= 1.22 depends.

Wiring

• cargo-zigbuild, zig, and gettext added to the .#packaging derivation so CI and local nix develop users share the toolchain.
• nfpm.yaml libc6 depends drop from >= 2.35 / >= 2.36 to >= 2.34 to match the zigbuild floor.

Net diff

9 files, +89 / -153 (Docker block removal more than pays for the new lines).

Test plan

• yaml.safe_load parses cleanly on all touched workflow and nfpm.yaml files.
• PR dry-run exercises .deb and .rpm end-to-end for moq-cli, moq-relay, moq-token-cli (moq-gst's workflow has no PR dry-run, so its fix is exercised only on the next moq-gst-v* tag).

https://claude.ai/code/session_015J5tVAQ7ESjBhnzdeXfhgX

[coderabbitai]

Walkthrough

This PR updates the packaging workflows for moq-cli, moq-gst, moq-relay, and moq-token-cli to apply consistent templating behavior. Both Debian and RPM packaging steps now render nfpm configuration files using envsubst to interpolate environment variables (VERSION, ARCH, BINARY_PATH, and others depending on the package) into /tmp/nfpm.yaml before passing the rendered file to nfpm pkg. RPM builds additionally adopt dnf install --allowerasing during container dependency installation to enable package replacement when needed.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	The PR title describes replacing Docker RPM builds with cargo zigbuild, but the primary change (emphasized in the PR description and objectives) is adding envsubst pre-rendering for nfpm config files. The title does not reflect the main fix.	Update the title to better reflect the primary change: 'ci: pre-process nfpm configs with envsubst' or similar, as the envsubst fix is the blocking issue being solved in this PR.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	The PR description comprehensively explains both the envsubst pre-rendering fix and the cargo zigbuild optimization, detailing the root cause, solution, and testing approach related to the changeset.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/nfpm-env-template

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch claude/nfpm-env-template

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}