Rewrite Initium from Go to Rust (#13)

* Rewrite Initium from Go to Rust
Complete reimplementation of all 6 subcommands in Rust:
- wait-for (TCP + HTTP/HTTPS with retries, backoff, jitter)
- migrate (command exec with lock file idempotency)
- seed (command exec with structured logging)
- render (envsubst + Jinja2 templates via minijinja)
- fetch (HTTP fetch with auth, TLS, retry)
- exec (arbitrary command with workdir support)
Key dependencies: clap, ureq+rustls, serde_json, minijinja, regex, chrono
36 unit tests covering: logging, retry, safety, render modules
All tests passing.
Binary size comparison (release, stripped, musl-linked):
- Go binary (scratch): ~7.4 MB
- Rust binary (scratch): ~1.8 MB (76% reduction)
Docker image (scratch + binary + CA certs): 1.83 MB total

* Update all build files, workflows, and docs for Rust
- CI workflow: replace setup-go with dtolnay/rust-toolchain, use
  cargo test/clippy/fmt instead of go test/vet/staticcheck
- Release workflow: use dtolnay/rust-toolchain for pre-push tests
- jyq.Dockerfile: rewrite for Rust (rust:1.85-alpine builder, cargo build)
- Dockerfile: already updated in prior commit
- docs/design.md: update architecture diagram, directory structure,
  and 'How to Add a Subcommand' guide for Rust/clap
- docs/usage.md: update template mode description (Go text/template -> minijinja)
- README.md, FAQ.md: update image sizes (10MB -> 2MB), tool references
- CHANGELOG.md: add Rust rewrite entry, update references
- CLAUDE.md: add project config with cargo test references
- tests/README.md: update from go test to cargo test

* Fix clippy warnings and cargo fmt formatting
- Fix dead_code warnings: allow unused Warn variant and warn() method
- Fix useless .into() conversion in logging JSON output
- Fix manual Range::contains in fetch status check
- Fix unit let-binding in command execution
- Fix lines().flatten() -> lines().map_while(Result::ok)
- Apply cargo fmt to all source files

Author: mikkeldamsgaard

.dockerignore

@@ -0,0 +1,9 @@
+target/
+.git/
+bin/
+*.md
+docs/
+examples/
+charts/
+tests/
+.github/

.github/workflows/ci.yml

@@ -11,42 +11,28 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: dtolnay/rust-toolchain@stable
         with:
-          go-version: "1.25"
-      - run: go vet ./...
-      - run: |
-          go install golang.org/x/tools/cmd/staticcheck@latest || true
-          if command -v staticcheck >/dev/null 2>&1; then
-            staticcheck ./...
-          else
-            echo "staticcheck not available, skipping"
-          fi
+          components: clippy, rustfmt
+      - run: cargo fmt --check
+      - run: cargo clippy -- -D warnings
   test:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
-        with:
-          go-version: "1.25"
-      - run: go test ./... -count=1 -timeout 60s -race -coverprofile=coverage.out
-      - uses: actions/upload-artifact@v4
-        with:
-          name: coverage
-          path: coverage.out
+      - uses: dtolnay/rust-toolchain@stable
+      - run: cargo test --all
   build:
     runs-on: ubuntu-latest
     needs: [lint, test]
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
-        with:
-          go-version: "1.25"
-      - run: make build
+      - uses: dtolnay/rust-toolchain@stable
+      - run: cargo build --release
       - uses: actions/upload-artifact@v4
         with:
           name: initium-binary
-          path: bin/initium
+          path: target/release/initium
   helm-lint:
     runs-on: ubuntu-latest
     steps:

.github/workflows/release.yml

@@ -1,40 +1,29 @@
 name: Release
-
 on:
   push:
     tags:
       - "v*"
-
 permissions:
   contents: read
   packages: write
   id-token: write
-
 jobs:
   release:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-
-      - uses: actions/setup-go@v5
-        with:
-          go-version: "1.25"
-
-      - run: go test ./... -count=1 -timeout 60s -race
-
+      - uses: dtolnay/rust-toolchain@stable
+      - run: cargo test --all
       - uses: docker/setup-qemu-action@v3
       - uses: docker/setup-buildx-action@v3
-
       - uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-
       - name: Extract version
         id: version
         run: echo "VERSION=${GITHUB_REF#refs/tags/v}" >> "$GITHUB_OUTPUT"
-
       - uses: docker/build-push-action@v6
         with:
           context: .
@@ -47,7 +36,6 @@ jobs:
             ghcr.io/kitstream/initium:latest
           sbom: true
           provenance: true
-
       - uses: docker/build-push-action@v6
         with:
           context: .
@@ -61,4 +49,3 @@ jobs:
             ghcr.io/kitstream/initium-jyq:latest
           sbom: true
           provenance: true
-

.gitignore

@@ -1,17 +1,4 @@
-# IDE
 .idea/
-*.iml
-# Go
+target/
 bin/
-*.exe
-*.dll
-*.so
-*.dylib
-# Test
-*.test
-*.out
-coverage.out
-# OS
-.DS_Store
-Thumbs.db
-CLAUDE.md
+CLAUDE.md

CHANGELOG.md

@@ -7,16 +7,23 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+- Complete rewrite from Go to Rust for ~76% smaller Docker images (7.4MB → 1.8MB)
+- CLI framework changed from cobra to clap
+- Template engine changed from Go text/template to minijinja (Jinja2-style); access env vars via `{{ env.VAR }}`
+- CI/CD workflows updated for Rust toolchain (cargo test, clippy, rustfmt)
+- Dockerfiles updated to use rust:1.85-alpine builder with musl static linking
+
 ### Added
 - `exec` subcommand: run arbitrary commands with structured logging, exit code forwarding, and optional `--workdir` for child process working directory
 - `jyq.Dockerfile` and `initium-jyq` container image variant with pre-built `jq` and `yq` tools
 - Documentation for building custom images using Initium as a base
 - `fetch` subcommand and `internal/fetch` package: fetch secrets/config from HTTP(S) endpoints with auth header via env var, retry with backoff, TLS options, redirect control (same-site by default), and path traversal prevention
-- `render` subcommand and `internal/render` package: render templates into config files with `envsubst` (default) and Go `text/template` modes, path traversal prevention, and automatic intermediate directory creation
+- `render` subcommand and `internal/render` package: render templates into config files with `envsubst` (default) and Jinja2 template modes, path traversal prevention, and automatic intermediate directory creation
 - `seed` subcommand: run database seed commands with structured logging and exit code forwarding (no idempotency — distinct from `migrate`)
 - `migrate` subcommand: run database migration commands with structured logging, exit code forwarding, and optional idempotency via `--lock-file`
 - FAQ.md with functionality, security, and deployment questions for junior-to-mid-level engineers
-- Project scaffolding with Go module, CLI framework (cobra), and repo layout
+- Project scaffolding with Rust/Cargo, CLI framework (clap), and repo layout
 - `wait-for` subcommand: wait for TCP and HTTP(S) endpoints with retries, exponential backoff, and jitter
 - `internal/retry` package with configurable retry logic, backoff, and jitter
 - `internal/logging` package with text and JSON structured logging, automatic secret redaction