devenv: Install pinned nightly Rust toolchain via rustup

devenv/Containerfile.c10s

@@ -1,7 +1,7 @@
 # These aren't packages, just low-dependency binaries dropped in /usr/local/bin
 # so we can fetch them independently in a separate build.
 ARG base=quay.io/centos/centos:stream10
 FROM $base as base
 # Life is too short to care about dash
 RUN ln -sfr /bin/bash /bin/sh
 RUN <<EORUN
@@ -25,7 +25,7 @@
 dnf -y makecache
 EORUN
 
 FROM base as tools
 # renovate: datasource=github-releases depName=bootc-dev/bcvk
 ARG bcvkversion=v0.9.0
 # renovate: datasource=github-releases depName=ossf/scorecard
@@ -38,12 +38,14 @@
 RUN bcvkversion=$bcvkversion scorecardversion=$scorecardversion nushellversion=$nushellversion /run/src/fetch-tools.sh
 RUN uvversion=$uvversion /run/src/install-uv.sh
 
 FROM base as rust
+# renovate: datasource=custom.rust-nightly depName=rust-nightly versioning=rust-release-channel
+ARG rust_nightly=nightly-2026-03-02
 COPY install-rust.sh /run/src/
-RUN /run/src/install-rust.sh
+RUN rust_nightly=$rust_nightly /run/src/install-rust.sh
 
 # Kani formal verification tool - requires rustup for toolchain management
 FROM rust as kani
 # renovate: datasource=crate depName=kani-verifier
 ARG kaniversion=0.67.0
 RUN dnf install -y gcc && dnf clean all

devenv/Containerfile.debian

@@ -1,7 +1,7 @@
 # These aren't packages, just low-dependency binaries dropped in /usr/local/bin
 # so we can fetch them independently in a separate build.
 ARG base=docker.io/library/debian:sid
 FROM $base as base
 # Life is too short to care about dash
 RUN ln -sfr /bin/bash /bin/sh
 RUN <<EORUN
@@ -28,7 +28,7 @@
 apt -y update
 EORUN
 
 FROM base as tools
 # renovate: datasource=github-releases depName=bootc-dev/bcvk
 ARG bcvkversion=v0.9.0
 # renovate: datasource=github-releases depName=ossf/scorecard
@@ -41,12 +41,14 @@
 RUN bcvkversion=$bcvkversion scorecardversion=$scorecardversion nushellversion=$nushellversion /run/src/fetch-tools.sh
 RUN uvversion=$uvversion /run/src/install-uv.sh
 
 FROM base as rust
+# renovate: datasource=custom.rust-nightly depName=rust-nightly versioning=rust-release-channel
+ARG rust_nightly=nightly-2026-03-02
 COPY install-rust.sh /run/src/
-RUN /run/src/install-rust.sh
+RUN rust_nightly=$rust_nightly /run/src/install-rust.sh
 
 # Kani formal verification tool - requires rustup for toolchain management
 FROM rust as kani
 # renovate: datasource=crate depName=kani-verifier
 ARG kaniversion=0.67.0
 RUN apt-get update && apt-get install -y --no-install-recommends gcc libc6-dev && rm -rf /var/lib/apt/lists/*

devenv/install-rust.sh

@@ -9,6 +9,15 @@ export CARGO_HOME=/usr/local/cargo
 # Install Rust system-wide
 curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile default
 
+# Install nightly toolchain if requested (pinned date, e.g. nightly-2026-03-02)
+if [ -n "${rust_nightly:-}" ]; then
+  /usr/local/cargo/bin/rustup toolchain install "${rust_nightly}" --profile minimal
+  # Symlink the dated nightly as "nightly" so `cargo +nightly` works without
+  # requiring write access to RUSTUP_HOME for channel updates.
+  host=$(/usr/local/cargo/bin/rustc --print host-tuple)
+  ln -sf "${rust_nightly}-${host}" "$RUSTUP_HOME/toolchains/nightly-${host}"
+fi
+
 # Move binaries to /usr/local/bin (system-managed, root-owned)
 mv /usr/local/cargo/bin/* /usr/local/bin/
 

renovate-shared-config.json

@@ -15,6 +15,19 @@
   // referenced in Cargo.toml files. Without initializing submodules, Renovate
   // will fail to analyze these dependencies.
   "cloneSubmodules": true,
+  // Custom datasource for tracking Rust nightly toolchain releases via the
+  // official release manifest. This is the same data source the upcoming
+  // native rust-version datasource (renovatebot/renovate#39529) will use;
+  // once that merges this can be replaced with zero-config native support.
+  "customDatasources": {
+    "rust-nightly": {
+      "defaultRegistryUrlTemplate": "https://static.rust-lang.org/manifests.txt",
+      "format": "plain",
+      "transformTemplates": [
+        "{ \"releases\": $filter(releases, function($r) { $contains($r.version, \"channel-rust-nightly.toml\") }).$merge([{ \"version\": \"nightly-\" & $match(version, /(\\d{4}-\\d{2}-\\d{2})/).groups[0] }]) }"
+      ]
+    }
+  },
   // Custom managers for detecting dependencies in non-standard files
   //
   // - Containerfile/Dockerfile: Match "# renovate:" comments with ARG statements
@@ -24,7 +37,8 @@
       "customType": "regex",
       "managerFilePatterns": ["/(^|/)Containerfile(\\.[^/]*)?$/", "/(^|/)Dockerfile(\\.[^/]*)?$/"],
       "matchStrings": [
-        "# renovate: datasource=(?<datasource>[a-z-]+) depName=(?<depName>[^\\s]+)\\s+ARG \\w+version=(?<currentValue>.+)"
+        "# renovate: datasource=(?<datasource>[a-z.-]+) depName=(?<depName>[^\\s]+)\\s+ARG \\w+version=(?<currentValue>.+)",
+        "# renovate: datasource=(?<datasource>[a-z.-]+) depName=(?<depName>[^\\s]+) versioning=(?<versioning>[^\\s]+)\\s+ARG \\w+=(?<currentValue>.+)"
       ]
     },
     {
@@ -159,6 +173,11 @@
         "composefs-oci"
       ],
       "enabled": false
+    },
+    // Rust nightly toolchain: use rust-release-channel versioning for nightly-YYYY-MM-DD format
+    {
+      "matchDatasources": ["custom.rust-nightly"],
+      "versioning": "rust-release-channel"
     }
   ]
 }