feat: build the CI image locally instead of pulling from GHCR

Add a build-image action that builds image/Dockerfile for a Rust version and loads it into the daemon, so the Docker actions run against a local rust-ci tag with no registry.
With cache:true it caches only the added layer (clippy/rustfmt/jq) via the GitHub Actions cache (buildx type=gha,mode=min) while the rust base is pulled from Docker Hub; caching is opt-in.

Parameterize image/Dockerfile with ARG RUST_VERSION, point the six Docker actions' image default at the local rust-ci:latest, and remove publish-image.yml.
selftest builds via build-image with the cache on.

Sweep the repo slug in the docs from cicd-rust to rust-ci.

Author: gronke

.github/actions/build-image/README.md

@@ -0,0 +1,38 @@
+# build-image
+
+Build the rust-ci toolchain image locally from [`image/Dockerfile`](../../../image/Dockerfile) and load it into the Docker daemon, so the Docker actions run against a local tag with no registry pull.
+
+## How it works
+
+The image is `rust:<rust-version>` plus clippy, rustfmt, and jq.
+`build-image` builds it for the requested Rust version and `--load`s it into the daemon under `tag`; the Docker actions (`cargo-fetch`, `lint-and-test-docker`, `cargo-docker`, `cargo-use`, `cargo-install`, `publish-dry-run`) then `docker run` that tag — point their `image:` input at it, or use the matching default.
+
+With `cache: "true"` the build runs under buildx with the GitHub Actions cache (`type=gha,mode=min`): only the added layer (clippy/rustfmt/jq) is cached, scoped per Rust version, while the `rust:<version>` base is pulled from Docker Hub.
+Caching is off by default, so a consumer opts in before anything writes to their Actions cache.
+
+## Usage
+
+```yaml
+- uses: gronke/rust-ci/.github/actions/build-image@main
+  with:
+    rust-version: "1"          # any rust:<tag>; default "latest"
+    tag: rust-ci:latest        # the Docker actions' default image
+    cache: "true"              # opt in to caching the added layer
+- uses: gronke/rust-ci/.github/actions/lint-and-test-docker@main
+  with:
+    working-directory: .       # image defaults to rust-ci:latest
+```
+
+## Inputs
+
+| Input | Default | Description |
+| --- | --- | --- |
+| `rust-version` | `latest` | The `rust:<version>` base tag to build on. |
+| `tag` | `rust-ci:latest` | Tag for the built image. |
+| `cache` | `"false"` | Cache the added layer across runs (GitHub Actions cache via buildx `type=gha`). |
+
+## Outputs
+
+| Output | Description |
+| --- | --- |
+| `image` | The built image tag. |

.github/actions/build-image/action.yml

@@ -0,0 +1,49 @@
+name: Build image (local)
+description: >-
+  Build the rust-ci toolchain image from image/Dockerfile for a Rust version and
+  load it into the Docker daemon, so the Docker actions run against a local tag
+  with no registry. With cache:true the added layer (clippy/rustfmt/jq) is cached
+  via the GitHub Actions cache; the rust base is pulled from Docker Hub.
+
+inputs:
+  rust-version:
+    description: Rust base version — the rust:<version> tag to build on.
+    required: false
+    default: latest
+  tag:
+    description: Tag for the built image.
+    required: false
+    default: rust-ci:latest
+  cache:
+    description: Cache the added layer across runs (GitHub Actions cache via buildx type=gha).
+    required: false
+    default: "false"
+
+outputs:
+  image:
+    description: The built image tag.
+    value: ${{ inputs.tag }}
+
+runs:
+  using: composite
+  steps:
+    # Re-export the runtime token + v2 results URL; the runner withholds them from
+    # step processes, and buildx needs them for the type=gha cache.
+    - name: Expose Actions cache tokens
+      if: ${{ inputs.cache == 'true' }}
+      uses: actions/github-script@v7
+      with:
+        script: |
+          for (const k of ['ACTIONS_RUNTIME_TOKEN', 'ACTIONS_RESULTS_URL']) {
+            if (process.env[k]) core.exportVariable(k, process.env[k]);
+          }
+
+    - name: Build image
+      shell: bash
+      env:
+        RUST_VERSION: ${{ inputs.rust-version }}
+        TAG: ${{ inputs.tag }}
+        CACHE: ${{ inputs.cache }}
+        SCOPE: rust-ci-${{ inputs.rust-version }}
+        ACTIONS_CACHE_SERVICE_V2: "true"
+      run: bash "$GITHUB_ACTION_PATH/build-image.sh"

.github/actions/build-image/build-image.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# Build image/Dockerfile and load the result into the Docker daemon. Inputs arrive
+# as env vars from action.yml:
+#   RUST_VERSION  the rust:<version> base tag
+#   TAG           tag for the built image
+#   CACHE         "true" → buildx with the GitHub Actions cache (type=gha,mode=min)
+#   SCOPE         gha cache scope (per Rust version)
+set -euo pipefail
+
+context="$GITHUB_ACTION_PATH/../../../image"
+
+if [ "${CACHE:-false}" = "true" ]; then
+  echo "::group::buildx build (gha cache)"
+  # type=gha caches only the added layer (mode=min); the rust base is pulled from
+  # Docker Hub. A docker-container builder is required; pin a buildkit that speaks
+  # the v2 Actions cache service. ignore-error keeps a cache hiccup from failing
+  # the build (the image still loads).
+  docker buildx inspect rust-ci-builder >/dev/null 2>&1 \
+    || docker buildx create --name rust-ci-builder --driver docker-container \
+         --driver-opt image=moby/buildkit:latest >/dev/null
+  docker buildx build --builder rust-ci-builder \
+    --build-arg "RUST_VERSION=$RUST_VERSION" \
+    --cache-from "type=gha,scope=$SCOPE" \
+    --cache-to "type=gha,mode=min,scope=$SCOPE,ignore-error=true" \
+    --load -t "$TAG" "$context"
+  echo "::endgroup::"
+else
+  echo "::group::docker build"
+  docker build --build-arg "RUST_VERSION=$RUST_VERSION" -t "$TAG" "$context"
+  echo "::endgroup::"
+fi

.github/actions/cargo-docker/action.yml

@@ -10,7 +10,7 @@ inputs:
   image:
     description: CI image (Rust toolchain + clippy/rustfmt + jq).
     required: false
-    default: ghcr.io/gronke/rust-ci:latest
+    default: rust-ci:latest
   working-directory:
     description: Crate/workspace directory (mounted read-only).
     required: false

.github/actions/cargo-fetch/action.yml

@@ -8,7 +8,7 @@ inputs:
   image:
     description: CI image (Rust toolchain + clippy/rustfmt + jq).
     required: false
-    default: ghcr.io/gronke/rust-ci:latest
+    default: rust-ci:latest
   working-directory:
     description: Crate/workspace directory (mounted read-only).
     required: false

.github/actions/cargo-install/README.md

@@ -22,7 +22,7 @@ That mode runs `args` on the host, so use it only with trusted input; Docker mod
 ## Usage
 
 ```yaml
-- uses: gronke/cicd-rust/.github/actions/cargo-install@main
+- uses: gronke/rust-ci/.github/actions/cargo-install@main
   with:
     tool: cargo-audit
     version: "0.21"            # optional; pins the install (and a consumer cache key)
@@ -42,7 +42,7 @@ a binary is only guaranteed to run in the image it was built in.
 | `args` | `""` | Extra flags appended to `cargo install` (for example `--features cli`). Word-split inside the container. |
 | `locked` | `"true"` | Append `--locked`. |
 | `docker` | `"true"` | Install sealed in the container; `"false"` installs on the host. |
-| `image` | `ghcr.io/gronke/rust-ci:latest` | CI image. Match it in `cargo-use`. |
+| `image` | `rust-ci:latest` | CI image. Match it in `cargo-use`. |
 | `cargo-cache` | `.cargo-cache` | Host dir mounted read-write as `CARGO_HOME`; the tool lands in its `bin/`. |
 | `working-directory` | `.` | Directory the action runs from. |
 | `env-include` / `env-exclude` / `env` | (as `cargo-docker`) | Control which runner env vars are forwarded into the container. |

.github/actions/cargo-install/action.yml

@@ -34,7 +34,7 @@ inputs:
   image:
     description: CI image (Rust toolchain). Use the same image in cargo-use (ABI).
     required: false
-    default: ghcr.io/gronke/rust-ci:latest
+    default: rust-ci:latest
   cargo-cache:
     description: >-
       Host dir mounted RW as CARGO_HOME (/cache/cargo); the tool installs to its

.github/actions/cargo-use/README.md

@@ -17,12 +17,12 @@ That mode runs `args` on the host, so use it only with trusted input; Docker mod
 ## Usage
 
 ```yaml
-- uses: gronke/cicd-rust/.github/actions/cargo-use@main      # fetch the advisory DB (networked, runs no project build)
+- uses: gronke/rust-ci/.github/actions/cargo-use@main      # fetch the advisory DB (networked, runs no project build)
   with:
     args: "cargo-audit fetch"
     cargo-cache: .cargo-tools
     offline: "false"
-- uses: gronke/cicd-rust/.github/actions/cargo-use@main      # audit sealed, zero egress
+- uses: gronke/rust-ci/.github/actions/cargo-use@main      # audit sealed, zero egress
   with:
     args: "cargo audit --no-fetch"
     cargo-cache: .cargo-tools
@@ -37,7 +37,7 @@ a binary is only guaranteed to run in the image it was built in.
 | --- | --- | --- |
 | `args` | — (required) | The command line to run, for example `cargo audit --no-fetch`. Word-split inside the container. |
 | `docker` | `"true"` | Run sealed in the container; `"false"` runs on the host. |
-| `image` | `ghcr.io/gronke/rust-ci:latest` | CI image. Match the one `cargo-install` used (binary ABI). |
+| `image` | `rust-ci:latest` | CI image. Match the one `cargo-install` used (binary ABI). |
 | `cargo-cache` | `.cargo-cache` | Host dir mounted read-write as `CARGO_HOME`; its `bin/` is prepended to `PATH`. |
 | `offline` | `"true"` | Run with `--network=none`; set `"false"` for a tool that needs the network. |
 | `target-dir` | `""` | Optional host dir mounted read-write at `/work/target` for a tool that builds. Empty mounts no target. |

.github/actions/cargo-use/action.yml

@@ -14,7 +14,7 @@ inputs:
   image:
     description: CI image. Use the SAME image cargo-install used (binary ABI must match).
     required: false
-    default: ghcr.io/gronke/rust-ci:latest
+    default: rust-ci:latest
   cargo-cache:
     description: >-
       Host dir mounted RW as CARGO_HOME (/cache/cargo); must match the cargo-cache

.github/actions/check-release-readiness/check-release-readiness.sh

@@ -52,7 +52,7 @@ else
   fi
   # Not-already-published guard (crates.io API; non-fatal on a network blip).
   CODE=$(curl -s -o /dev/null -w '%{http_code}' \
-    -H "User-Agent: cicd-rust release-readiness" \
+    -H "User-Agent: rust-ci release-readiness" \
     "https://crates.io/api/v1/crates/${NAME}/${VERSION}" || echo "000")
   if [ "$CODE" = "200" ]; then
     echo "::error::${NAME} ${VERSION} is already published on crates.io"