[sodre]

Summary

 image/Dockerfile
-      gh jq make git curl zstd unzip python3 ...
+      gh jq make git curl zstd zip unzip python3 ...
 image/smoke.sh
+check zip            zip --version
+check unzip          unzip -v
 README.md   ("What the job gets")
+`zip`, `unzip`

GitHub's ubuntu-latest runners carry zip and unzip. This image had unzip only (installed for the AWS CLI), so a job that builds a zip, such as a Lambda package, fails its toolset check on a ci-spot runner and passes on a hosted one:

unzip    caution:  both -n and -o specified; ignoring -o
missing tools: zip

zip is a general tool by the image's own rule, so it goes in the image and not in each repo's job.

Evidence

• Before: a job that runs scripts/check-toolset.sh ... zip unzip on a ci-spot runner fails with missing tools: zip.
  After: image/smoke.sh runs zip --version and unzip -v; the image workflow runs it on both architectures on this PR (it builds on any image/** change).
• make test: 146 pass, 0 fail.

Merge Danger

Door: two-way

A later PR removes the package; the image is rebuilt weekly and on image/** changes.

Blast Radius: every job on the runners

The image grows by the zip package (about 200 KB). It takes effect on runners launched after the image workflow publishes from main.

🤖 Generated with Claude Code