Release 2.34.2

https://github.com/rust-lang/rust-clippy/issues/12270

```
error: lint group `rust_2018_idioms` has the same priority (0) as a lint
  --> Cargo.toml:11:1
   |
11 | rust_2018_idioms = "warn"
   | ^^^^^^^^^^^^^^^^   ------ has an implicit priority of 0
12 | single_use_lifetimes = "warn"
   | -------------------- has the same priority as this lint
   |
   = note: the order of the lints in the table is ignored by Cargo
   = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#lint_groups_priority
   = note: `-D clippy::lint-groups-priority` implied by `-D warnings`
   = help: to override `-D warnings` add `#[allow(clippy::lint_groups_priority)]`
help: to have lints override the group set `rust_2018_idioms` to a lower priority
   |
11 | rust_2018_idioms = { level = "warn", priority = -1 }
   |                    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

error: lint group `all` has the same priority (0) as a lint
  --> Cargo.toml:16:1
   |
16 | all = "warn" # Downgrade deny-by-default lints
   | ^^^   ------ has an implicit priority of 0
17 | pedantic = "warn"
18 | as_ptr_cast_mut = "warn"
   | --------------- has the same priority as this lint
   |
   = note: the order of the lints in the table is ignored by Cargo
   = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#lint_groups_priority
help: to have lints override the group set `all` to a lower priority
   |
16 | all = { level = "warn", priority = -1 } # Downgrade deny-by-default lints
   |       ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

error: lint group `pedantic` has the same priority (0) as a lint
  --> Cargo.toml:17:1
   |
17 | pedantic = "warn"
   | ^^^^^^^^   ------ has an implicit priority of 0
18 | as_ptr_cast_mut = "warn"
   | --------------- has the same priority as this lint
   |
   = note: the order of the lints in the table is ignored by Cargo
   = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#lint_groups_priority
help: to have lints override the group set `pedantic` to a lower priority
   |
17 | pedantic = { level = "warn", priority = -1 }
   |            ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
```

.cspell.json

@@ -44,7 +44,7 @@
   "languageSettings": [
     {
       "languageId": ["*"],
-      "dictionaries": ["rust"]
+      "dictionaries": ["bash", "rust"]
     }
   ],
   "ignorePaths": []

.github/.cspell/project-dictionary.txt

@@ -22,7 +22,6 @@ pwsh
 quickinstall
 rdme
 sccache
-shfmt
 syft
 udeps
 wasmtime

.github/workflows/ci.yml

@@ -66,10 +66,10 @@ jobs:
           tool: ${{ steps.tool-list.outputs.tool }}
       # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsshell
       - name: Test bash
-        run: just --version; shfmt --version; protoc --version
+        run: just --version && shfmt --version && protoc --version
         shell: bash
       - name: Test sh
-        run: just --version; shfmt --version; protoc --version
+        run: just --version && shfmt --version && protoc --version
         shell: sh
         if: startsWith(matrix.os, 'ubuntu') || startsWith(matrix.os, 'macos')
       - name: Test pwsh
@@ -118,29 +118,8 @@ jobs:
     timeout-minutes: 60
     container: ${{ matrix.container }}
     steps:
-      - name: Install requirements (ubuntu/debian)
-        run: |
-          set -eEuxo pipefail
-          apt-get -o Acquire::Retries=10 -qq update
-          apt-get -o Acquire::Retries=10 -o Dpkg::Use-Pty=0 install -y --no-install-recommends cargo
-        if: startsWith(matrix.container, 'ubuntu') || startsWith(matrix.container, 'debian')
-      - name: Install requirements (fedora/almalinux/centos)
-        run: |
-          set -eEuxo pipefail
-          curl --proto '=https' --tlsv1.2 -fsSL --retry 10 https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain stable --no-modify-path
-          echo "$HOME/.cargo/bin" >>"${GITHUB_PATH}"
-        if: startsWith(matrix.container, 'fedora') || startsWith(matrix.container, 'almalinux') ||  startsWith(matrix.container, 'centos')
-      - name: Install requirements (opensuse)
-        run: |
-          set -eEuxo pipefail
-          zypper install -y rustup
-          rustup toolchain add stable --profile minimal
-        if: startsWith(matrix.container, 'opensuse')
-      - name: Install requirements (archlinux)
-        run: pacman -Sy --noconfirm rust
-        if: startsWith(matrix.container, 'archlinux')
       - name: Install requirements (alpine)
-        run: apk --no-cache add bash cargo
+        run: apk --no-cache add bash
         shell: sh
         if: startsWith(matrix.container, 'alpine')
       - uses: taiki-e/checkout-action@v1
@@ -153,19 +132,6 @@ jobs:
         with:
           tool: ${{ steps.tool-list.outputs.tool }}
 
-  test-no-cargo:
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
-    container: ubuntu
-    steps:
-      - uses: taiki-e/checkout-action@v1
-      - name: Generate tool list
-        id: tool-list
-        run: tools/ci/tool-list.sh >>"${GITHUB_OUTPUT}"
-      - uses: ./
-        with:
-          tool: ${{ steps.tool-list.outputs.tool }}
-
   manifest:
     runs-on: ubuntu-latest
     timeout-minutes: 60

CHANGELOG.md

@@ -10,6 +10,80 @@ Note: In this file, do not use the hard wrap in the middle of a sentence for com
 
 ## [Unreleased]
 
+## [2.34.2] - 2024-06-03
+
+- Update `typos@latest` to 1.22.0.
+
+## [2.34.1] - 2024-06-03
+
+- Update `git-cliff@latest` to 2.3.0.
+
+## [2.34.0] - 2024-06-01
+
+- Support cargo-binstall fallback without cargo.
+
+## [2.33.36] - 2024-06-01
+
+- Update `cargo-llvm-cov@latest` to 0.6.10.
+
+## [2.33.35] - 2024-05-28
+
+- Update `syft@latest` to 1.5.0.
+
+## [2.33.34] - 2024-05-26
+
+- Update `dprint@latest` to 0.46.1.
+
+## [2.33.33] - 2024-05-25
+
+- Update `dprint@latest` to 0.46.0.
+
+## [2.33.32] - 2024-05-25
+
+- Update `just@latest` to 1.27.0.
+
+## [2.33.31] - 2024-05-25
+
+- Update `cargo-binstall@latest` to 1.6.8.
+
+- Update `sccache@latest` to 0.8.1.
+
+## [2.33.30] - 2024-05-24
+
+- Update `cargo-deny@latest` to 0.14.24.
+
+## [2.33.29] - 2024-05-23
+
+- Update `protoc@latest` to 3.27.0.
+
+## [2.33.28] - 2024-05-22
+
+- Update `wasmtime@latest` to 21.0.1.
+
+## [2.33.27] - 2024-05-21
+
+- Update `wasmtime@latest` to 21.0.0.
+
+## [2.33.26] - 2024-05-19
+
+- Update `cargo-careful@latest` to 0.4.2.
+
+## [2.33.25] - 2024-05-18
+
+- Update `cargo-binstall@latest` to 1.6.7.
+
+## [2.33.24] - 2024-05-17
+
+- Update `mdbook@latest` to 0.4.40.
+
+## [2.33.23] - 2024-05-14
+
+- Update `just@latest` to 1.26.0.
+
+## [2.33.22] - 2024-05-12
+
+- Update `git-cliff@latest` to 2.2.2.
+
 ## [2.33.21] - 2024-05-11
 
 - Update `cargo-binstall@latest` to 1.6.6.
@@ -2165,7 +2239,25 @@ Note: This release is considered a breaking change because installing on version
 
 Initial release
 
-[Unreleased]: https://github.com/taiki-e/install-action/compare/v2.33.21...HEAD
+[Unreleased]: https://github.com/taiki-e/install-action/compare/v2.34.2...HEAD
+[2.34.2]: https://github.com/taiki-e/install-action/compare/v2.34.1...v2.34.2
+[2.34.1]: https://github.com/taiki-e/install-action/compare/v2.34.0...v2.34.1
+[2.34.0]: https://github.com/taiki-e/install-action/compare/v2.33.36...v2.34.0
+[2.33.36]: https://github.com/taiki-e/install-action/compare/v2.33.35...v2.33.36
+[2.33.35]: https://github.com/taiki-e/install-action/compare/v2.33.34...v2.33.35
+[2.33.34]: https://github.com/taiki-e/install-action/compare/v2.33.33...v2.33.34
+[2.33.33]: https://github.com/taiki-e/install-action/compare/v2.33.32...v2.33.33
+[2.33.32]: https://github.com/taiki-e/install-action/compare/v2.33.31...v2.33.32
+[2.33.31]: https://github.com/taiki-e/install-action/compare/v2.33.30...v2.33.31
+[2.33.30]: https://github.com/taiki-e/install-action/compare/v2.33.29...v2.33.30
+[2.33.29]: https://github.com/taiki-e/install-action/compare/v2.33.28...v2.33.29
+[2.33.28]: https://github.com/taiki-e/install-action/compare/v2.33.27...v2.33.28
+[2.33.27]: https://github.com/taiki-e/install-action/compare/v2.33.26...v2.33.27
+[2.33.26]: https://github.com/taiki-e/install-action/compare/v2.33.25...v2.33.26
+[2.33.25]: https://github.com/taiki-e/install-action/compare/v2.33.24...v2.33.25
+[2.33.24]: https://github.com/taiki-e/install-action/compare/v2.33.23...v2.33.24
+[2.33.23]: https://github.com/taiki-e/install-action/compare/v2.33.22...v2.33.23
+[2.33.22]: https://github.com/taiki-e/install-action/compare/v2.33.21...v2.33.22
 [2.33.21]: https://github.com/taiki-e/install-action/compare/v2.33.20...v2.33.21
 [2.33.20]: https://github.com/taiki-e/install-action/compare/v2.33.19...v2.33.20
 [2.33.19]: https://github.com/taiki-e/install-action/compare/v2.33.18...v2.33.19

Cargo.toml

@@ -10,6 +10,8 @@ improper_ctypes_definitions = "warn"
 non_ascii_idents = "warn"
 rust_2018_idioms = "warn"
 single_use_lifetimes = "warn"
+unexpected_cfgs = { level = "warn", check-cfg = [
+] }
 unreachable_pub = "warn"
 unsafe_op_in_unsafe_fn = "warn"
 [workspace.lints.clippy]
@@ -27,11 +29,13 @@ borrow_as_ptr = { level = "allow", priority = 1 } # https://github.com/rust-lang
 declare_interior_mutable_const = { level = "allow", priority = 1 } # https://github.com/rust-lang/rust-clippy/issues/7665
 doc_markdown = { level = "allow", priority = 1 }
 float_cmp = { level = "allow", priority = 1 } # https://github.com/rust-lang/rust-clippy/issues/7725
+incompatible_msrv = { level = "allow", priority = 1 } # buggy: doesn't consider cfg, https://github.com/rust-lang/rust-clippy/issues/12280, https://github.com/rust-lang/rust-clippy/issues/12257#issuecomment-2093667187
+lint_groups_priority = { level = "allow", priority = 1 } # https://github.com/rust-lang/rust-clippy/issues/12270
 manual_assert = { level = "allow", priority = 1 }
 manual_range_contains = { level = "allow", priority = 1 } # https://github.com/rust-lang/rust-clippy/issues/6455#issuecomment-1225966395
 missing_errors_doc = { level = "allow", priority = 1 }
 module_name_repetitions = { level = "allow", priority = 1 }
-nonminimal_bool = { level = "allow", priority = 1 } # buggy https://github.com/rust-lang/rust-clippy/issues?q=is%3Aissue+is%3Aopen+nonminimal_bool
+nonminimal_bool = { level = "allow", priority = 1 } # buggy: https://github.com/rust-lang/rust-clippy/issues?q=is%3Aissue+is%3Aopen+nonminimal_bool
 similar_names = { level = "allow", priority = 1 }
 single_match = { level = "allow", priority = 1 }
 single_match_else = { level = "allow", priority = 1 }

README.md

@@ -152,7 +152,6 @@ This action has been tested for GitHub-hosted runners (Ubuntu, macOS, Windows) a
 To use this action in self-hosted runners or in containers, at least the following tools are required:
 
 - bash
-- cargo (if you use cargo-binstall fallback)
 
 ## Related Projects
 

main.sh

@@ -748,5 +748,11 @@ if [[ ${#unsupported_tools[@]} -gt 0 ]]; then
     # By default, cargo-binstall enforce downloads over secure transports only.
     # As a result, http will be disabled, and it will also set
     # min tls version to be 1.2
-    cargo binstall --force --no-confirm --locked "${unsupported_tools[@]}"
+    cargo-binstall binstall --force --no-confirm --locked "${unsupported_tools[@]}"
+    if ! type -P cargo >/dev/null; then
+        _bin_dir=$(canonicalize_windows_path "${HOME}/.cargo/bin")
+        # TODO: avoid this when already added
+        info "adding '${_bin_dir}' to PATH"
+        echo "${_bin_dir}" >>"${GITHUB_PATH}"
+    fi
 fi

manifests/cargo-binstall.json

@@ -21,26 +21,26 @@
     }
   },
   "latest": {
-    "version": "1.6.6"
+    "version": "1.6.8"
   },
-  "1.6.6": {
+  "1.6.8": {
     "x86_64_linux_musl": {
-      "checksum": "49f891fddf795f33b02c0ea58d7af7a7dc087fbb47a504ca1bf69f403f711c46"
+      "checksum": "581eb7c97b2767a468afb0505c416eb727b469c029b36470288fc30b26517101"
     },
     "x86_64_macos": {
-      "checksum": "7c7e59c116fc452cedfd7142224729ec8e6ec4ff1962fda3a3e87e1c7c51fbb9"
+      "checksum": "590ff2a4b50d67ce52b35895e4cb8d75fefdc591988dafb2687c6461b50e3885"
     },
     "x86_64_windows": {
-      "checksum": "5556b4d1c829b854dc71ca3b258950227957d7f9c258f808d8eb15849810a9b4"
+      "checksum": "0c1cd165f4460a9d5c1f5c2a67e5faf53913694ba207ddc18b44f6c5de6ba6c5"
     },
     "aarch64_linux_musl": {
-      "checksum": "141b546d52353657706e63ee596f2637c4b34b1705aaa9ec716db74f813d436f"
+      "checksum": "2433118983ade85388be17d442b430c4932eb2dad834143f9a6a25646563281f"
     },
     "aarch64_macos": {
-      "checksum": "6670805e15799cc6caa5ac35f0c0bc599ee6d51cdf2f21346deeaaf821e763a8"
+      "checksum": "1b0ea154b639dc7d8b49c6a2fa300964357a67a1b2441e9f29b61c7b7b79d23d"
     },
     "aarch64_windows": {
-      "checksum": "bf7321de10806e051868819c3fe61127f5bac1619181c955da06f5e06c2612e8"
+      "checksum": "f440401a77b284a8b52ba0052fe26628e8658d4febc91108c28542a0843d341a"
     }
   }
 }

manifests/cargo-careful.json

@@ -12,10 +12,21 @@
     }
   },
   "latest": {
-    "version": "0.4.1"
+    "version": "0.4.2"
   },
   "0.4": {
-    "version": "0.4.1"
+    "version": "0.4.2"
+  },
+  "0.4.2": {
+    "x86_64_linux_musl": {
+      "checksum": "ee14c5796acab604714e358de11bf5204055410ae8fd4891df7f5d62461402c3"
+    },
+    "x86_64_macos": {
+      "checksum": "480efaf0a577161332b27ea13c8703ead1b6355b5c6541f5bd61d440440b4bde"
+    },
+    "x86_64_windows": {
+      "checksum": "ac374b7799a37e3ef21c6bfe409583c3acbc57242fbb32e8534269b5e97b8ee9"
+    }
   },
   "0.4.1": {
     "x86_64_linux_musl": {

manifests/cargo-deny.json

@@ -23,10 +23,27 @@
     }
   },
   "latest": {
-    "version": "0.14.23"
+    "version": "0.14.24"
   },
   "0.14": {
-    "version": "0.14.23"
+    "version": "0.14.24"
+  },
+  "0.14.24": {
+    "x86_64_linux_musl": {
+      "checksum": "df57dd1ccbc44c4445cb72974562ed934637d982fb0f6d62105dddc290beaaad"
+    },
+    "x86_64_macos": {
+      "checksum": "47b7b07fb210b871027adb3a08fe85fa1a54e4403b523feaa844f3db029e96c8"
+    },
+    "x86_64_windows": {
+      "checksum": "35e6709107c13d35b9c2a9ee6d9db4cdf52f008e84334597e796305b95a72bdd"
+    },
+    "aarch64_linux_musl": {
+      "checksum": "8b1142bc6b7968169781a0ce01c74dc553468d968eda931c0a9e7420ae82e20d"
+    },
+    "aarch64_macos": {
+      "checksum": "636f9e6e509bc43fab9ab6c2f2470dc027d05badce47b075bd27d9b05ffb162f"
+    }
   },
   "0.14.23": {
     "x86_64_linux_musl": {

manifests/cargo-llvm-cov.json

@@ -18,10 +18,27 @@
     }
   },
   "latest": {
-    "version": "0.6.9"
+    "version": "0.6.10"
   },
   "0.6": {
-    "version": "0.6.9"
+    "version": "0.6.10"
+  },
+  "0.6.10": {
+    "x86_64_linux_musl": {
+      "checksum": "2350d7d6586c8b1ac828ad5578225fafb6a43fa9c35fe835c28a5ed63499df60"
+    },
+    "x86_64_macos": {
+      "checksum": "6355b4536798ba0cea459729cc531f7bbf252d51c86b02683c0b4a4033d8cb96"
+    },
+    "x86_64_windows": {
+      "checksum": "3090e71ba2c0e16e593d338f4ed696f3829544f53dea63bdd966398f4379259c"
+    },
+    "aarch64_linux_musl": {
+      "checksum": "7921682e7bd925b69bbecaf9bf42f99a6404ef60049b1a9f87fe97dc697265f4"
+    },
+    "aarch64_macos": {
+      "checksum": "46fe1d529755ca1a39dc7995374eef4482a20f0f632dd113430641c06fc4b466"
+    }
   },
   "0.6.9": {
     "x86_64_linux_musl": {

manifests/dprint.json

@@ -24,7 +24,44 @@
     }
   },
   "latest": {
-    "version": "0.45.1"
+    "version": "0.46.1"
+  },
+  "0.46": {
+    "version": "0.46.1"
+  },
+  "0.46.1": {
+    "x86_64_linux_musl": {
+      "checksum": "4a7d6fa6b920ab150f580965556086cdd7992e07078e627ab9a9d1c3bd30ba85"
+    },
+    "x86_64_macos": {
+      "checksum": "cdea84bce1d84c26e8eced2265d246b79a849ec2e7d1377d98dd7bdb21c7ce83"
+    },
+    "x86_64_windows": {
+      "checksum": "74e5ab38c744d5903862c2b5174d0fef9759b5506da775e1fb93b6a68c63101d"
+    },
+    "aarch64_linux_musl": {
+      "checksum": "e2b6d87167d21f1f01571790e79526ef9caff3b8b75f5cac348c4f06f60a8c16"
+    },
+    "aarch64_macos": {
+      "checksum": "f3ff4faef83d14c3b4ae262e79a40d4e0fc3fa1903d0b6e9b82f0b25b00e9499"
+    }
+  },
+  "0.46.0": {
+    "x86_64_linux_musl": {
+      "checksum": "7a2c12edc868259be890174c4ec3bd51c81ec8773aa294e12fac0634f36d15f5"
+    },
+    "x86_64_macos": {
+      "checksum": "e339f1f891c60087676d72f70ba5f80dcaedde4bdc58730b9cb68a5483b3abfd"
+    },
+    "x86_64_windows": {
+      "checksum": "786201545938f6f7c6d407e6404b31ae9bbf9e5a4abc4c88dc9bd73da369a906"
+    },
+    "aarch64_linux_musl": {
+      "checksum": "e52c0a3398e34e88ffe560e719bf8361ba3f35b4e0927ab9ba0761796884ce24"
+    },
+    "aarch64_macos": {
+      "checksum": "4b608b3676f10e04328c3d8be396bded96328ebca9b95b70bf5baf67bed7b135"
+    }
   },
   "0.45": {
     "version": "0.45.1"

manifests/git-cliff.json

@@ -27,13 +27,56 @@
     }
   },
   "latest": {
-    "version": "2.2.1"
+    "version": "2.3.0"
   },
   "2": {
-    "version": "2.2.1"
+    "version": "2.3.0"
+  },
+  "2.3": {
+    "version": "2.3.0"
+  },
+  "2.3.0": {
+    "x86_64_linux_musl": {
+      "checksum": "0371c0c2fd948a711d05198f719a2ec8ccb2a43ae5e4760394916d5cf6b45c6c"
+    },
+    "x86_64_macos": {
+      "checksum": "73ce46c671a593fe1acef725e7816c793968e3c315fd72107280e830eaa55820"
+    },
+    "x86_64_windows": {
+      "checksum": "90bc9c60b5db44a62fae51fb09e9565e2d460e107df3404ac5384a2f0bdd96d1"
+    },
+    "aarch64_linux_musl": {
+      "checksum": "aed0a6fba4d5b309be98ef71db75928c84c57495d46843791e95870582f0d1a6"
+    },
+    "aarch64_macos": {
+      "checksum": "1fd8e277212db52c791a20b6ecdb993ce47884a1aca3ee3d31066fd29acea6bb"
+    },
+    "aarch64_windows": {
+      "checksum": "059a29642ffe16ad720cb383290564df35bddd329fa34f6d1d1a4f633d6dad48"
+    }
   },
   "2.2": {
-    "version": "2.2.1"
+    "version": "2.2.2"
+  },
+  "2.2.2": {
+    "x86_64_linux_musl": {
+      "checksum": "3a199e08786eeb8801e40c6f2e022e236c1a640eb172695898ded679089eb5cf"
+    },
+    "x86_64_macos": {
+      "checksum": "3efc16a26b1e511f285395a241d338991dc89494a1d3b4fc4c67c99a5b8cedce"
+    },
+    "x86_64_windows": {
+      "checksum": "9e2956b4ec65dbf48ca9b9fa1815012ca9486c721a143b6eb35412f395f2fd7f"
+    },
+    "aarch64_linux_musl": {
+      "checksum": "a5484af486d8ac20748c681ae205c698415550783d3cf13d0a5e230c0cca5961"
+    },
+    "aarch64_macos": {
+      "checksum": "0f5b598795b6b6f2c6b7f683559ef90b2cbe59393c88c057892a12713e08d20b"
+    },
+    "aarch64_windows": {
+      "checksum": "919f5b90966dc90c695ab327cedd840ef2fe705270c3a0902d106abde8110c0f"
+    }
   },
   "2.2.1": {
     "x86_64_linux_musl": {

manifests/just.json

@@ -18,10 +18,50 @@
     }
   },
   "latest": {
-    "version": "1.25.2"
+    "version": "1.27.0"
   },
   "1": {
-    "version": "1.25.2"
+    "version": "1.27.0"
+  },
+  "1.27": {
+    "version": "1.27.0"
+  },
+  "1.27.0": {
+    "x86_64_linux_musl": {
+      "checksum": "6cc91651c4dd5e287df8ea7b3087c44120ba95a32ee50497bb071695846ab086"
+    },
+    "x86_64_macos": {
+      "checksum": "ae5dae799d3dafeaf4d53e221e1efdeec88980a38375b0d6dbc9c9bb16eec273"
+    },
+    "x86_64_windows": {
+      "checksum": "08dca5c6e30258cbb24ec30eb8ea1e3ba5b2beb5349eaabee450230ce45ef585"
+    },
+    "aarch64_linux_musl": {
+      "checksum": "f049d134d311b3d2190d30a936e0a4257df156082cab37d4eb2ace1b760154ca"
+    },
+    "aarch64_macos": {
+      "checksum": "5d6b05ab581dca9346114df7c9f7285f54d4b80d8082e2c8fce51a42b3dbdb9c"
+    }
+  },
+  "1.26": {
+    "version": "1.26.0"
+  },
+  "1.26.0": {
+    "x86_64_linux_musl": {
+      "checksum": "be7233b3ebfd5bdda8cae6537c21c839d3d24ecf075f1494a2e67f93539b1e12"
+    },
+    "x86_64_macos": {
+      "checksum": "aa9ad8d097c4d3744c9d06520e28837c5e3fa50519a4cd657e0f2f7a226897af"
+    },
+    "x86_64_windows": {
+      "checksum": "e326f8552ac7119b643fed1b8af8fe392593280c185c44beadc313e0291f412a"
+    },
+    "aarch64_linux_musl": {
+      "checksum": "56352027a18e64bc58aa77d4c020bd79163f10cecc859595b0474b5a442369d3"
+    },
+    "aarch64_macos": {
+      "checksum": "1b8b12f348eea603ba935d0799e03b87adb9b15779ff21cd67b3ddb1e6ab21d2"
+    }
   },
   "1.25": {
     "version": "1.25.2"

manifests/mdbook.json

@@ -18,10 +18,38 @@
     }
   },
   "latest": {
-    "version": "0.4.37"
+    "version": "0.4.40"
   },
   "0.4": {
-    "version": "0.4.37"
+    "version": "0.4.40"
+  },
+  "0.4.40": {
+    "x86_64_linux_musl": {
+      "checksum": "f7520ad60d1a6fe81c667d0da876a9ddd736f874eb61c01b025eafdc83381227"
+    },
+    "x86_64_macos": {
+      "checksum": "5783c09bb60b3e2e904d6839e3a1993a4ace1ca30a336a3c78bedac6e938817c"
+    },
+    "x86_64_windows": {
+      "checksum": "1470e5b06614cb2851e8b3c908dfdef2982b90e6cc6045662512ce66d6c7c5d9"
+    },
+    "aarch64_linux_musl": {
+      "checksum": "d5ebfd2e31755726f8c0988a423b1ab5d950bb894fbba170355bb7d1cb852586"
+    }
+  },
+  "0.4.39": {
+    "x86_64_linux_musl": {
+      "checksum": "25d66ee23c67815549a1517c484aad210c5e0f97c68bb990a93a34c03e859d47"
+    },
+    "x86_64_macos": {
+      "checksum": "dd52578a17c892afa805ec29b15c06f1e7c6e6707791ef840165fc3f1763c6bb"
+    },
+    "x86_64_windows": {
+      "checksum": "f8efb854df122d6d99189923d7fe61625f8931e0a46d38d8449fd850a67079d1"
+    },
+    "aarch64_linux_musl": {
+      "checksum": "68fc653b401b6d344eef77f9f119d262acadce248e23a4dd1ef2e958eabc2be8"
+    }
   },
   "0.4.37": {
     "x86_64_linux_musl": {

manifests/protoc.json

@@ -2,10 +2,35 @@
   "rust_crate": null,
   "template": null,
   "latest": {
-    "version": "3.26.1"
+    "version": "3.27.0"
   },
   "3": {
-    "version": "3.26.1"
+    "version": "3.27.0"
+  },
+  "3.27": {
+    "version": "3.27.0"
+  },
+  "3.27.0": {
+    "x86_64_linux_gnu": {
+      "url": "https://github.com/protocolbuffers/protobuf/releases/download/v27.0/protoc-27.0-linux-x86_64.zip",
+      "checksum": "e2bdce49564dbad4676023d174d9cdcf932238bc0b56a8349a5cb27bbafc26b0"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/protocolbuffers/protobuf/releases/download/v27.0/protoc-27.0-osx-x86_64.zip",
+      "checksum": "d956cf3a9e91a687aa4d1026e9261e5a587e4e0b545db0174509f6c448b8ce21"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/protocolbuffers/protobuf/releases/download/v27.0/protoc-27.0-win64.zip",
+      "checksum": "80888b2a38786861c7b3aaf4e0bd5b933a51d750219ee8c61093655fc2924926"
+    },
+    "aarch64_linux_gnu": {
+      "url": "https://github.com/protocolbuffers/protobuf/releases/download/v27.0/protoc-27.0-linux-aarch_64.zip",
+      "checksum": "1e4b2d8b145afe99a36602f305165761e46d2525aa94cbb907e2e983be6717ac"
+    },
+    "aarch64_macos": {
+      "url": "https://github.com/protocolbuffers/protobuf/releases/download/v27.0/protoc-27.0-osx-aarch_64.zip",
+      "checksum": "2cf59e3e3463bede1f10b7517efdddd97a3bd8cfd9cacc286407b657290dc781"
+    }
   },
   "3.26": {
     "version": "3.26.1"

manifests/sccache.json

@@ -23,10 +23,27 @@
     }
   },
   "latest": {
-    "version": "0.8.0"
+    "version": "0.8.1"
   },
   "0.8": {
-    "version": "0.8.0"
+    "version": "0.8.1"
+  },
+  "0.8.1": {
+    "x86_64_linux_musl": {
+      "checksum": "e0ee621fb16b6940666cd770b091c62cadafd3e062dd12e3a49d9caaff3b795f"
+    },
+    "x86_64_macos": {
+      "checksum": "4306fb21606b14e2ce1266b25c40e55c090ea68c2cb54e1c39bfb9b81ea3e342"
+    },
+    "x86_64_windows": {
+      "checksum": "44249088926f52d1fee76cd1dcd1c061e2152a7feedb7ba43d4a4f50be805608"
+    },
+    "aarch64_linux_musl": {
+      "checksum": "452cef732b24415493a7c6bca6e13536eb9464593fa87c753b6b7cb4733e9c50"
+    },
+    "aarch64_macos": {
+      "checksum": "b4029ae790e29333ebcf52faa5bc0559945011d5fdbc7cc15812bc45fc6ea5d4"
+    }
   },
   "0.8.0": {
     "x86_64_linux_musl": {

manifests/syft.json

@@ -23,10 +23,30 @@
     }
   },
   "latest": {
-    "version": "1.4.1"
+    "version": "1.5.0"
   },
   "1": {
-    "version": "1.4.1"
+    "version": "1.5.0"
+  },
+  "1.5": {
+    "version": "1.5.0"
+  },
+  "1.5.0": {
+    "x86_64_linux_musl": {
+      "checksum": "3d10023d46dfaf0fe75288df207b478b43597f7d2fff553f58430817166bd478"
+    },
+    "x86_64_macos": {
+      "checksum": "605322e3e7043a4f2f3d6e37f75a71389d38f6f290bff2e54bb2aaebbbf4829b"
+    },
+    "x86_64_windows": {
+      "checksum": "5079c6a88e130f8677d0701cb2689f9eae2088022ecf5fa2b9f341b96d9983d2"
+    },
+    "aarch64_linux_musl": {
+      "checksum": "ee2b1289a1e4b0de9409c3a78867949ca42788a5f50072b8a6e6e04e6a269f9c"
+    },
+    "aarch64_macos": {
+      "checksum": "fe02d072e7ec9a8eb4ac866ba973396a8beae79829ee870acaadd4d862e5e65a"
+    }
   },
   "1.4": {
     "version": "1.4.1"

manifests/typos.json

@@ -15,10 +15,27 @@
     }
   },
   "latest": {
-    "version": "1.21.0"
+    "version": "1.22.0"
   },
   "1": {
-    "version": "1.21.0"
+    "version": "1.22.0"
+  },
+  "1.22": {
+    "version": "1.22.0"
+  },
+  "1.22.0": {
+    "x86_64_linux_musl": {
+      "checksum": "bfa037cb884797da229768751642191128a8096f34a77c2c2aab81f4ea4add5e"
+    },
+    "x86_64_macos": {
+      "checksum": "5cede24a0c7e7fa826372346ae8a1eb7264741412cf830acb7bd6ba9d261e610"
+    },
+    "x86_64_windows": {
+      "checksum": "cded62aca581b5610a8a8ac88d26c84bbbf02cd988fca64be50da6beb7d6ad85"
+    },
+    "aarch64_macos": {
+      "checksum": "e747252644b76cca8b7c4bf3a36835186773500a2d1964ffe7341bd33ffdfbe2"
+    }
   },
   "1.21": {
     "version": "1.21.0"

manifests/wasmtime.json

@@ -23,7 +23,47 @@
     }
   },
   "latest": {
-    "version": "20.0.2"
+    "version": "21.0.1"
+  },
+  "21": {
+    "version": "21.0.1"
+  },
+  "21.0": {
+    "version": "21.0.1"
+  },
+  "21.0.1": {
+    "x86_64_linux_gnu": {
+      "checksum": "d49619e38c660196a048e80d34292e458a11af010ab1780e7b3ae9a42df6e33b"
+    },
+    "x86_64_macos": {
+      "checksum": "8452dc6e865553cc7027d45a961f86440fd9459de7a48117236c386e4ceb2a1f"
+    },
+    "x86_64_windows": {
+      "checksum": "c2a1e23e2ab49f3f942e6a47aba8c60c863fd66166c3940fa3dd1f9a0286a4b6"
+    },
+    "aarch64_linux_gnu": {
+      "checksum": "77e8a381bbc54f39399c71ee305b6ce5b6807e7c088846ea1e406a3a62b38146"
+    },
+    "aarch64_macos": {
+      "checksum": "816a4a50c875de0804c316fc3171fb20a45fb82e4bf3e3313dec4f6d819df688"
+    }
+  },
+  "21.0.0": {
+    "x86_64_linux_gnu": {
+      "checksum": "605efdd4d073a7574b6d42ef0c9037c6c4e3933ed80615eab84f2d57cfeb3b28"
+    },
+    "x86_64_macos": {
+      "checksum": "7beb9f1b6789af74beef8354b675d5cab6477be708bf45aa86f411c4afe55dfd"
+    },
+    "x86_64_windows": {
+      "checksum": "e57345a2bd644e7f4d0a013617d64a3e16966b9483fee72bad2ab1eebabce59b"
+    },
+    "aarch64_linux_gnu": {
+      "checksum": "0fa42c4555617cb4a602216ec45b8dc43686733653ec07f9488ab5e2e3bf5ec8"
+    },
+    "aarch64_macos": {
+      "checksum": "b4a09d69c2cb4655e68895156a1de713b27a6e64796d9073108d20f55b8d5d5c"
+    }
   },
   "20": {
     "version": "20.0.2"

tools/ci/tool-list.sh

@@ -128,17 +128,14 @@ case "${host_os}" in
         fi
         ;;
 esac
-# cargo-binstall requires cargo
+# cargo-watch/watchexec-cli is supported by cargo-binstall (through quickinstall)
-if type -P cargo &>/dev/null; then
+case "${version}" in
-    # cargo-watch/watchexec-cli is supported by cargo-binstall (through quickinstall)
+    latest) tools+=(cargo-watch watchexec-cli nextest) ;;
-    case "${version}" in
+    major.minor.patch) tools+=(cargo-watch@8.1.1 watchexec-cli@1.20.5 nextest@0.9.57) ;;
-        latest) tools+=(cargo-watch watchexec-cli nextest) ;;
+    major.minor) tools+=(cargo-watch@8.1 watchexec-cli@1.20 nextest@0.9) ;;
-        major.minor.patch) tools+=(cargo-watch@8.1.1 watchexec-cli@1.20.5 nextest@0.9.57) ;;
+    major) tools+=(cargo-watch@8 watchexec-cli@1) ;;
-        major.minor) tools+=(cargo-watch@8.1 watchexec-cli@1.20 nextest@0.9) ;;
+    *) exit 1 ;;
-        major) tools+=(cargo-watch@8 watchexec-cli@1) ;;
+esac
-        *) exit 1 ;;
-    esac
-fi
 
 # sort and dedup
 IFS=$'\n'

tools/codegen/src/main.rs

@@ -31,6 +31,7 @@ fn main() -> Result<()> {
         std::process::exit(1);
     }
     let package = &args[0];
+    let skip_existing_manifest_versions = std::env::var("SKIP_EXISTING_MANIFEST_VERSIONS").is_ok();
 
     let workspace_root = &workspace_root();
     let manifest_path = &workspace_root.join("manifests").join(format!("{package}.json"));
@@ -53,7 +54,7 @@ fn main() -> Result<()> {
     // is greater than 100, multiple fetches are needed.
     for page in 1.. {
         let per_page = 100;
-        let mut r: github::Releases = download(&format!(
+        let mut r: github::Releases = download_github(&format!(
             "https://api.github.com/repos/{repo}/releases?per_page={per_page}&page={page}"
         ))?
         .into_json()?;
@@ -179,6 +180,13 @@ fn main() -> Result<()> {
             continue;
         }
 
+        let reverse_semver = Reverse(semver_version.clone().into());
+
+        if skip_existing_manifest_versions && manifests.map.contains_key(&reverse_semver) {
+            eprintln!("Skipping {semver_version} already in manifest");
+            continue;
+        };
+
         let mut download_info = BTreeMap::new();
         let mut pubkey = None;
         for (&platform, base_download_info) in &base_info.platform {
@@ -224,7 +232,7 @@ fn main() -> Result<()> {
                 eprintln!("already downloaded");
                 fs::File::open(download_cache)?.read_to_end(&mut buf)?;
             } else {
-                download(&url)?.into_reader().read_to_end(&mut buf)?;
+                download_github(&url)?.into_reader().read_to_end(&mut buf)?;
                 eprintln!("download complete");
                 fs::write(download_cache, &buf)?;
             }
@@ -246,7 +254,7 @@ fn main() -> Result<()> {
                         eprintln!("already downloaded");
                         minisign_verify::Signature::from_file(sig_download_cache)?
                     } else {
-                        let buf = download(&url)?.into_string()?;
+                        let buf = download_github(&url)?.into_string()?;
                         eprintln!("download complete");
                         fs::write(sig_download_cache, &buf)?;
                         minisign_verify::Signature::decode(&buf)?
@@ -357,10 +365,7 @@ fn main() -> Result<()> {
         if semver_version.pre.is_empty() {
             semver_versions.insert(semver_version.clone());
         }
-        manifests.map.insert(
+        manifests.map.insert(reverse_semver, ManifestRef::Real(Manifest { download_info }));
-            Reverse(semver_version.clone().into()),
-            ManifestRef::Real(Manifest { download_info }),
-        );
     }
     if has_build_metadata {
         eprintln!(
@@ -527,7 +532,9 @@ fn replace_vars(
     Ok(s)
 }
 
-fn download(url: &str) -> Result<ureq::Response> {
+/// Download using GITHUB_TOKEN.
+#[allow(clippy::missing_panics_doc)]
+fn download_github(url: &str) -> Result<ureq::Response> {
     let mut token = env::var("GITHUB_TOKEN").ok().filter(|v| !v.is_empty());
     let mut retry = 0;
     let max_retry = 6;
@@ -554,6 +561,28 @@ fn download(url: &str) -> Result<ureq::Response> {
     Err(last_error.unwrap().into())
 }
 
+/// Download without using GITHUB_TOKEN.
+#[allow(clippy::missing_panics_doc)]
+pub fn download(url: &str) -> Result<ureq::Response> {
+    let mut retry = 0;
+    let max_retry = 6;
+    let mut last_error;
+    loop {
+        let req = ureq::get(url);
+        match req.call() {
+            Ok(res) => return Ok(res),
+            Err(e) => last_error = Some(e),
+        }
+        retry += 1;
+        if retry > max_retry {
+            break;
+        }
+        eprintln!("download of {url} failed; retrying after {}s ({retry}/{max_retry})", retry * 2);
+        std::thread::sleep(Duration::from_secs(retry * 2));
+    }
+    Err(last_error.unwrap().into())
+}
+
 #[derive(Debug, Clone, PartialEq, Eq)]
 struct Version {
     major: Option<u64>,

tools/tidy.sh

@@ -16,7 +16,7 @@ trap 's=$?; echo >&2 "$0: error on line "${LINENO}": ${BASH_COMMAND}"; exit ${s}
 # - shellcheck
 # - npm
 # - jq
-# - python
+# - python 3
 # - rustup (if Rust code exists)
 # - clang-format (if C/C++ code exists)
 #
@@ -40,6 +40,19 @@ check_config() {
         error "could not found $1 in the repository root"
     fi
 }
+check_install() {
+    for tool in "$@"; do
+        if ! type -P "${tool}" &>/dev/null; then
+            if [[ "${tool}" == "python3" ]]; then
+                if type -P python &>/dev/null; then
+                    continue
+                fi
+            fi
+            error "'${tool}' is required to run this check"
+            return 1
+        fi
+    done
+}
 info() {
     echo >&2 "info: $*"
 }
@@ -56,6 +69,27 @@ venv() {
     shift
     "${venv_bin}/${bin}${exe}" "$@"
 }
+venv_install_yq() {
+    local py_suffix=''
+    if type -P python3 &>/dev/null; then
+        py_suffix='3'
+    fi
+    exe=''
+    venv_bin='.venv/bin'
+    case "$(uname -s)" in
+        MINGW* | MSYS* | CYGWIN* | Windows_NT)
+            exe='.exe'
+            venv_bin='.venv/Scripts'
+            ;;
+    esac
+    if [[ ! -d .venv ]]; then
+        "python${py_suffix}" -m venv .venv
+    fi
+    if [[ ! -e "${venv_bin}/yq${exe}" ]]; then
+        info "installing yq to ./.venv using pip"
+        venv "pip${py_suffix}" install yq
+    fi
+}
 
 if [[ $# -gt 0 ]]; then
     cat <<EOF
@@ -68,24 +102,23 @@ fi
 # Rust (if exists)
 if [[ -n "$(git ls-files '*.rs')" ]]; then
     info "checking Rust code style"
+    check_install cargo jq python3
     check_config .rustfmt.toml
-    if type -P rustup &>/dev/null; then
+    if check_install rustup; then
         # `cargo fmt` cannot recognize files not included in the current workspace and modules
         # defined inside macros, so run rustfmt directly.
         # We need to use nightly rustfmt because we use the unstable formatting options of rustfmt.
         rustc_version=$(rustc -vV | grep '^release:' | cut -d' ' -f2)
         if [[ "${rustc_version}" == *"nightly"* ]] || [[ "${rustc_version}" == *"dev"* ]]; then
             rustup component add rustfmt &>/dev/null
-            echo "+ rustfmt \$(git ls-files '*.rs')"
+            info "running \`rustfmt \$(git ls-files '*.rs')\`"
             rustfmt $(git ls-files '*.rs')
         else
             rustup component add rustfmt --toolchain nightly &>/dev/null
-            echo "+ rustfmt +nightly \$(git ls-files '*.rs')"
+            info "running \`rustfmt +nightly \$(git ls-files '*.rs')\`"
             rustfmt +nightly $(git ls-files '*.rs')
         fi
         check_diff $(git ls-files '*.rs')
-    else
-        error "'rustup' is not installed; skipped Rust code style check"
     fi
     cast_without_turbofish=$(grep -n -E '\.cast\(\)' $(git ls-files '*.rs') || true)
     if [[ -n "${cast_without_turbofish}" ]]; then
@@ -122,11 +155,12 @@ if [[ -n "$(git ls-files '*.rs')" ]]; then
     binaries=''
     metadata=$(cargo metadata --format-version=1 --no-deps)
     has_public_crate=''
+    venv_install_yq
     for id in $(jq <<<"${metadata}" '.workspace_members[]'); do
         pkg=$(jq <<<"${metadata}" ".packages[] | select(.id == ${id})")
         publish=$(jq <<<"${pkg}" -r '.publish')
         manifest_path=$(jq <<<"${pkg}" -r '.manifest_path')
-        if ! grep -q '^\[lints\]' "${manifest_path}" && ! grep -q '^\[lints\.rust\]' "${manifest_path}"; then
+        if [[ "$(venv tomlq -c '.lints' "${manifest_path}")" == "null" ]]; then
             error "no [lints] table in ${manifest_path} please add '[lints]' with 'workspace = true'"
         fi
         # Publishing is unrestricted if null, and forbidden if an empty array.
@@ -144,13 +178,14 @@ if [[ -n "$(git ls-files '*.rs')" ]]; then
                 publish=$(jq <<<"${root_pkg}" -r '.publish')
                 # Publishing is unrestricted if null, and forbidden if an empty array.
                 if [[ "${publish}" != "[]" ]]; then
-                    if ! grep -Eq '^exclude = \[.*"/\.\*".*\]' Cargo.toml; then
+                    exclude=$(venv tomlq -r '.package.exclude[]' Cargo.toml)
+                    if ! grep <<<"${exclude}" -Eq '^/\.\*$'; then
                         error "top-level Cargo.toml of non-virtual workspace should have 'exclude' field with \"/.*\""
                     fi
-                    if [[ -e tools ]] && ! grep -Eq '^exclude = \[.*"/tools".*\]' Cargo.toml; then
+                    if [[ -e tools ]] && ! grep <<<"${exclude}" -Eq '^/tools$'; then
                         error "top-level Cargo.toml of non-virtual workspace should have 'exclude' field with \"/tools\" if it exists"
                     fi
-                    if [[ -e target-specs ]] && ! grep -Eq '^exclude = \[.*"/target-specs".*\]' Cargo.toml; then
+                    if [[ -e target-specs ]] && ! grep <<<"${exclude}" -Eq '^/target-specs$'; then
                         error "top-level Cargo.toml of non-virtual workspace should have 'exclude' field with \"/target-specs\" if it exists"
                     fi
                 fi
@@ -196,12 +231,10 @@ fi
 if [[ -n "$(git ls-files '*.c' '*.h' '*.cpp' '*.hpp')" ]]; then
     info "checking C/C++ code style"
     check_config .clang-format
-    if type -P clang-format &>/dev/null; then
+    if check_install clang-format; then
-        echo "+ clang-format -i \$(git ls-files '*.c' '*.h' '*.cpp' '*.hpp')"
+        info "running \`clang-format -i \$(git ls-files '*.c' '*.h' '*.cpp' '*.hpp')\`"
         clang-format -i $(git ls-files '*.c' '*.h' '*.cpp' '*.hpp')
         check_diff $(git ls-files '*.c' '*.h' '*.cpp' '*.hpp')
-    else
-        error "'clang-format' is not installed; skipped C/C++ code style check"
     fi
 elif [[ -e .clang-format ]]; then
     error ".clang-format is unused"
@@ -211,64 +244,39 @@ fi
 if [[ -n "$(git ls-files '*.yml' '*.yaml' '*.js' '*.json')" ]]; then
     info "checking YAML/JavaScript/JSON code style"
     check_config .editorconfig
-    if type -P npm &>/dev/null; then
+    if check_install npm; then
-        echo "+ npx -y prettier -l -w \$(git ls-files '*.yml' '*.yaml' '*.js' '*.json')"
+        info "running \`npx -y prettier -l -w \$(git ls-files '*.yml' '*.yaml' '*.js' '*.json')\`"
         npx -y prettier -l -w $(git ls-files '*.yml' '*.yaml' '*.js' '*.json')
         check_diff $(git ls-files '*.yml' '*.yaml' '*.js' '*.json')
-    else
-        error "'npm' is not installed; skipped YAML/JavaScript/JSON code style check"
     fi
     # Check GitHub workflows.
     if [[ -d .github/workflows ]]; then
         info "checking GitHub workflows"
-        if type -P jq &>/dev/null; then
+        if check_install jq python3; then
-            if type -P python3 &>/dev/null || type -P python &>/dev/null; then
+            venv_install_yq
-                py_suffix=''
+            for workflow in .github/workflows/*.yml; do
-                if type -P python3 &>/dev/null; then
+                # The top-level permissions must be weak as they are referenced by all jobs.
-                    py_suffix='3'
+                permissions=$(venv yq -c '.permissions' "${workflow}")
-                fi
+                case "${permissions}" in
-                exe=''
+                    '{"contents":"read"}' | '{"contents":"none"}') ;;
-                venv_bin='.venv/bin'
+                    null) error "${workflow}: top level permissions not found; it must be 'contents: read' or weaker permissions" ;;
-                case "$(uname -s)" in
+                    *) error "${workflow}: only 'contents: read' and weaker permissions are allowed at top level; if you want to use stronger permissions, please set job-level permissions" ;;
-                    MINGW* | MSYS* | CYGWIN* | Windows_NT)
-                        exe='.exe'
-                        venv_bin='.venv/Scripts'
-                        ;;
                 esac
-                if [[ ! -d .venv ]]; then
+                # Make sure the 'needs' section is not out of date.
-                    "python${py_suffix}" -m venv .venv
+                if grep -q '# tidy:needs' "${workflow}" && ! grep -Eq '# *needs: \[' "${workflow}"; then
-                fi
+                    # shellcheck disable=SC2207
-                if [[ ! -e "${venv_bin}/yq${exe}" ]]; then
+                    jobs_actual=($(venv yq '.jobs' "${workflow}" | jq -r 'keys_unsorted[]'))
-                    venv "pip${py_suffix}" install yq
+                    unset 'jobs_actual[${#jobs_actual[@]}-1]'
-                fi
+                    # shellcheck disable=SC2207
-                for workflow in .github/workflows/*.yml; do
+                    jobs_expected=($(venv yq -r '.jobs."ci-success".needs[]' "${workflow}"))
-                    # The top-level permissions must be weak as they are referenced by all jobs.
+                    if [[ "${jobs_actual[*]}" != "${jobs_expected[*]+"${jobs_expected[*]}"}" ]]; then
-                    permissions=$(venv yq -c '.permissions' "${workflow}")
+                        printf -v jobs '%s, ' "${jobs_actual[@]}"
-                    case "${permissions}" in
+                        sed -i "s/needs: \[.*\] # tidy:needs/needs: [${jobs%, }] # tidy:needs/" "${workflow}"
-                        '{"contents":"read"}' | '{"contents":"none"}') ;;
+                        check_diff "${workflow}"
-                        null) error "${workflow}: top level permissions not found; it must be 'contents: read' or weaker permissions" ;;
+                        error "${workflow}: please update 'needs' section in 'ci-success' job"
-                        *) error "${workflow}: only 'contents: read' and weaker permissions are allowed at top level; if you want to use stronger permissions, please set job-level permissions" ;;
-                    esac
-                    # Make sure the 'needs' section is not out of date.
-                    if grep -q '# tidy:needs' "${workflow}" && ! grep -Eq '# *needs: \[' "${workflow}"; then
-                        # shellcheck disable=SC2207
-                        jobs_actual=($(venv yq '.jobs' "${workflow}" | jq -r 'keys_unsorted[]'))
-                        unset 'jobs_actual[${#jobs_actual[@]}-1]'
-                        # shellcheck disable=SC2207
-                        jobs_expected=($(venv yq -r '.jobs."ci-success".needs[]' "${workflow}"))
-                        if [[ "${jobs_actual[*]}" != "${jobs_expected[*]+"${jobs_expected[*]}"}" ]]; then
-                            printf -v jobs '%s, ' "${jobs_actual[@]}"
-                            sed -i "s/needs: \[.*\] # tidy:needs/needs: [${jobs%, }] # tidy:needs/" "${workflow}"
-                            check_diff "${workflow}"
-                            error "${workflow}: please update 'needs' section in 'ci-success' job"
-                        fi
                     fi
-                done
+                fi
-            else
+            done
-                error "'python3' is not installed; skipped GitHub workflow check"
-            fi
-        else
-            error "'jq' is not installed; skipped GitHub workflow check"
         fi
     fi
 fi
@@ -281,12 +289,10 @@ fi
 if [[ -n "$(git ls-files '*.toml' | (grep -v .taplo.toml || true))" ]]; then
     info "checking TOML style"
     check_config .taplo.toml
-    if type -P npm &>/dev/null; then
+    if check_install npm; then
-        echo "+ npx -y @taplo/cli fmt \$(git ls-files '*.toml')"
+        info "running \`npx -y @taplo/cli fmt \$(git ls-files '*.toml')\`"
         RUST_LOG=warn npx -y @taplo/cli fmt $(git ls-files '*.toml')
         check_diff $(git ls-files '*.toml')
-    else
-        error "'npm' is not installed; skipped TOML style check"
     fi
 elif [[ -e .taplo.toml ]]; then
     error ".taplo.toml is unused"
@@ -296,11 +302,9 @@ fi
 if [[ -n "$(git ls-files '*.md')" ]]; then
     info "checking Markdown style"
     check_config .markdownlint-cli2.yaml
-    if type -P npm &>/dev/null; then
+    if check_install npm; then
-        echo "+ npx -y markdownlint-cli2 \$(git ls-files '*.md')"
+        info "running \`npx -y markdownlint-cli2 \$(git ls-files '*.md')\`"
         npx -y markdownlint-cli2 $(git ls-files '*.md')
-    else
-        error "'npm' is not installed; skipped Markdown style check"
     fi
 elif [[ -e .markdownlint-cli2.yaml ]]; then
     error ".markdownlint-cli2.yaml is unused"
@@ -312,29 +316,25 @@ fi
 
 # Shell scripts
 info "checking Shell scripts"
-if type -P shfmt &>/dev/null; then
+if check_install shfmt; then
     check_config .editorconfig
-    echo "+ shfmt -l -w \$(git ls-files '*.sh')"
+    info "running \`shfmt -l -w \$(git ls-files '*.sh')\`"
     shfmt -l -w $(git ls-files '*.sh')
     check_diff $(git ls-files '*.sh')
-else
-    error "'shfmt' is not installed; skipped Shell scripts style check"
 fi
-if type -P shellcheck &>/dev/null; then
+if check_install shellcheck; then
     check_config .shellcheckrc
-    echo "+ shellcheck \$(git ls-files '*.sh')"
+    info "running \`shellcheck \$(git ls-files '*.sh')\`"
     if ! shellcheck $(git ls-files '*.sh'); then
         should_fail=1
     fi
     if [[ -n "$(git ls-files '*Dockerfile')" ]]; then
         # SC2154 doesn't seem to work on dockerfile.
-        echo "+ shellcheck -e SC2148,SC2154,SC2250 \$(git ls-files '*Dockerfile')"
+        info "running \`shellcheck -e SC2148,SC2154,SC2250 \$(git ls-files '*Dockerfile')\`"
         if ! shellcheck -e SC2148,SC2154,SC2250 $(git ls-files '*Dockerfile'); then
             should_fail=1
         fi
     fi
-else
-    error "'shellcheck' is not installed; skipped Shell scripts style check"
 fi
 
 # License check
@@ -383,13 +383,14 @@ fi
 if [[ -f .cspell.json ]]; then
     info "spell checking"
     project_dictionary=.github/.cspell/project-dictionary.txt
-    if type -P npm &>/dev/null; then
+    if check_install npm jq python3; then
         has_rust=''
         if [[ -n "$(git ls-files '*Cargo.toml')" ]]; then
+            venv_install_yq
             has_rust='1'
             dependencies=''
             for manifest_path in $(git ls-files '*Cargo.toml'); do
-                if [[ "${manifest_path}" != "Cargo.toml" ]] && ! grep -Eq '\[workspace\]' "${manifest_path}"; then
+                if [[ "${manifest_path}" != "Cargo.toml" ]] && [[ "$(venv tomlq -c '.workspace' "${manifest_path}")" == "null" ]]; then
                     continue
                 fi
                 metadata=$(cargo metadata --format-version=1 --no-deps --manifest-path "${manifest_path}")
@@ -422,7 +423,7 @@ EOF
             error "you may want to mark .github/.cspell/rust-dependencies.txt linguist-generated"
         fi
 
-        echo "+ npx -y cspell --no-progress --no-summary \$(git ls-files)"
+        info "running \`npx -y cspell --no-progress --no-summary \$(git ls-files)\`"
         if ! npx -y cspell --no-progress --no-summary $(git ls-files); then
             error "spellcheck failed: please fix uses of above words or add to ${project_dictionary} if correct"
         fi
@@ -454,8 +455,6 @@ EOF
             echo -n "${unused}"
             echo "======================================="
         fi
-    else
-        error "'npm' is not installed; skipped spell check"
     fi
 fi