cargo-minimal-versions

behavior

.clippy.toml

@@ -1,13 +1,13 @@
 # Clippy configuration
 # https://doc.rust-lang.org/nightly/clippy/lint_configuration.html
 
+allow-private-module-inception = true
 avoid-breaking-exported-api = false
 disallowed-names = []
 disallowed-macros = [
     { path = "std::dbg", reason = "it is okay to use during development, but please do not include it in main branch" },
 ]
 disallowed-methods = [
-    { path = "std::env::remove_var", reason = "this is not thread-safe and inherently unsafe; see <https://github.com/rust-lang/rust/issues/27970> for more" },
-    { path = "std::env::set_var", reason = "this is not thread-safe and inherently unsafe; see <https://github.com/rust-lang/rust/issues/27970> for more" },
 ]
-disallowed-types = []
+disallowed-types = [
+]

.cspell.json

@@ -27,24 +27,25 @@
   "ignoreRegExpList": [
     // Copyright notice
     "Copyright .*",
+    "SPDX-(File|Snippet)CopyrightText: .*",
     // GHA actions/workflows
-    "uses: .+@",
+    "uses: .+@[\\w_.-]+",
     // GHA context (repo name, owner name, etc.)
-    "github.\\w+ (=|!)= '.+'",
+    "github.[\\w_.-]+ (=|!)= '[^']+'",
     // GH username
     "( |\\[)@[\\w_-]+",
     // Git config username
-    "git config user.name .*",
+    "git config( --[^ ]+)? user.name .*",
-    // Username in todo comment
+    // Username in TODO|FIXME comment
     "(TODO|FIXME)\\([\\w_., -]+\\)",
     // Cargo.toml authors
-    "authors *= *\\[.*\\]",
+    "authors *= *\\[[^\\]]*\\]",
-    "\".* <[\\w_.+-]+@[\\w.-]+>\""
+    "\"[^\"]* <[\\w_.+-]+@[\\w.-]+>\""
   ],
   "languageSettings": [
     {
       "languageId": ["*"],
-      "dictionaries": ["rust"]
+      "dictionaries": ["bash", "cpp-refined", "rust"]
     }
   ],
   "ignorePaths": []

.deny.toml

@@ -0,0 +1,48 @@
+# https://embarkstudios.github.io/cargo-deny/checks/advisories/cfg.html
+[advisories]
+unused-ignored-advisory = "deny"
+yanked = "deny"
+unmaintained = "none"
+unsound = "all"
+git-fetch-with-cli = true
+ignore = [
+]
+
+# https://embarkstudios.github.io/cargo-deny/checks/bans/cfg.html
+[bans]
+multiple-versions = "warn"
+wildcards = "deny"
+allow-wildcard-paths = true
+build.executables = "deny"
+build.interpreted = "deny"
+build.include-dependencies = true
+build.include-workspace = false # covered by tools/tidy.sh
+build.include-archives = true
+build.allow-build-scripts = [
+    { name = "proc-macro2" }, # via serde_derive
+    { name = "quote" }, # via serde_derive
+    { name = "semver" },
+    { name = "serde_core" },
+    { name = "serde" }, # https://github.com/serde-rs/serde/issues/2972
+]
+build.bypass = [
+]
+
+# https://embarkstudios.github.io/cargo-deny/checks/licenses/cfg.html
+[licenses]
+unused-allowed-license = "deny"
+unused-license-exception = "deny"
+private.ignore = true
+allow = [
+    "Apache-2.0",
+    "MIT",
+    "Unicode-3.0", # unicode-ident
+]
+
+# https://embarkstudios.github.io/cargo-deny/checks/sources/cfg.html
+[sources]
+unused-allowed-source = "deny"
+unknown-registry = "deny"
+unknown-git = "deny"
+allow-git = [
+]

.editorconfig

@@ -11,12 +11,14 @@ indent_style = space
 insert_final_newline = true
 trim_trailing_whitespace = true
 
-[*.{json,md,rb,yml,yaml}]
+[*.{css,html,json,md,rb,sh,yml,yaml}]
 indent_size = 2
 
 [*.{js,yml,yaml}]
 quote_type = single
 
 [*.sh]
+# https://google.github.io/styleguide/shellguide.html#s5.3-pipelines
 binary_next_line = true
+# https://google.github.io/styleguide/shellguide.html#s5.5-case-statement
 switch_case_indent = true

.git-blame-ignore-revs

@@ -0,0 +1,2 @@
+# Change indent size of shell script files to match scripts in CI config
+946918579413996845b77e146aa8eb3c6f40f7ab

.gitattributes

@@ -1,3 +1,4 @@
 * text=auto eol=lf
-manifests/** linguist-generated
+tools/tidy.sh linguist-detectable=false
 .github/.cspell/rust-dependencies.txt linguist-generated
+manifests/** linguist-generated

.github/.cspell/project-dictionary.txt

@@ -1,31 +1,49 @@
 almalinux
 archlinux
-bindgen
 binstall
+callgrind
+CDPATH
 coreutils
+covgate
 cyclonedx
-distro
+cygdrive
+deadlinks
+deepsource
 doas
-dprint
 enablerepo
-endgroup
 epel
 espup
+fastestmirror
 grcov
+gungraun
+insta
+knope
+LASTEXITCODE
+libicu
 linkcheck
 mdbook
 microdnf
+minisig
+mirrorlist
 nextest
-protoc
+pluginconf
-pubkey
+ppcle
-pwsh
+prek
 quickinstall
 rdme
+rootfs
 sccache
-shfmt
+SHASUMS
+shortstat
+sigstore
+startswith
 syft
+tombi
 udeps
+USERPROFILE
 wasmtime
 watchexec
+worktree
 xbuild
 xscale
+xwin

.github/.cspell/rust-dependencies.txt

@@ -1,5 +1,5 @@
-// This file is @generated by tidy.sh.
+# This file is @generated by tidy.sh.
-// It is not intended for manual editing.
+# It is not intended for manual editing.
 
 flate
 minisign

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1 @@
+blank_issues_enabled: true

.github/ISSUE_TEMPLATE/new_tool.yml

@@ -0,0 +1,46 @@
+name: New tool suggestion
+description: Suggest support for a new tool
+labels: [enhancement]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for a new tool suggestion!
+
+        Normally, you don't need to open an issue to request support for a new tool.
+        Instead, please submit a pull request.
+        (See [DEVELOPMENT.md](https://github.com/taiki-e/install-action/blob/main/DEVELOPMENT.md) for how to add support for a new tool.)
+
+        That said, if you have any questions before getting started, or if you’re unable to contribute for any reason, feel free to open an issue.
+  - type: input
+    id: name
+    attributes:
+      label: Tool name
+    validations:
+      required: true
+  - type: dropdown
+    id: pre-built
+    attributes:
+      label: Are official pre-built binaries provided?
+      description: |
+        If "No", this issue will be blocked until official pre-built binaries are provided.<br>
+        If "Unknown", this issue will be blocked until it is determined that it is provided.<br>
+        (When the tool is a Rust crate, it may already be available via fallback even if "No" or "Unknown".)<br>
+      options:
+        - 'Yes'
+        - 'No'
+        - Unknown
+      default: 2
+    validations:
+      required: true
+  - type: input
+    id: url
+    attributes:
+      label: Website or repository link
+    validations:
+      required: true
+  - type: textarea
+    id: context
+    attributes:
+      label: Additional Context
+      description: Any additional context that you believe may be relevant.

.github/dependabot.yml

@@ -3,14 +3,25 @@ updates:
   - package-ecosystem: cargo
     directory: /
     schedule:
-      interval: daily
+      interval: weekly
+    cooldown:
+      default-days: 14 # Note: Unless dependencies are pinned/locked, the effect is limited.
     commit-message:
       prefix: ''
+    ignore:
+      # https://github.com/taiki-e/install-action/pull/831#issuecomment-2650284580
+      - dependency-name: ureq
     labels: []
   - package-ecosystem: github-actions
     directory: /
     schedule:
-      interval: daily
+      interval: weekly
+    cooldown:
+      default-days: 14
     commit-message:
       prefix: ''
     labels: []
+    groups:
+      github-actions:
+        patterns:
+          - '*'

.github/workflows/ci.yml

@@ -9,8 +9,9 @@ on:
     branches:
       - main
       - dev
+      - ci-*
   schedule:
-    - cron: '0 0,3,6,9,12,15,18,21 * * *'
+    - cron: '0 2 * * *'
   workflow_dispatch:
 
 env:
@@ -24,185 +25,306 @@ env:
 
 defaults:
   run:
-    shell: bash
+    shell: bash --noprofile --norc -CeEuxo pipefail {0}
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
   cancel-in-progress: true
 
 jobs:
+  miri:
+    uses: taiki-e/github-actions/.github/workflows/miri.yml@3c1cac16ef654d1febb66f21f328fa167f0d2fef # main
+    with:
+      # NB: sync with test job's --exclude option
+      args: --exclude install-action-internal-codegen
+  msrv:
+    uses: taiki-e/github-actions/.github/workflows/msrv.yml@3c1cac16ef654d1febb66f21f328fa167f0d2fef # main
+  test-manifest-schema:
+    uses: taiki-e/github-actions/.github/workflows/test.yml@3c1cac16ef654d1febb66f21f328fa167f0d2fef # main
+    with:
+      # NB: sync with miri job's --exclude option
+      test-args: --exclude install-action-internal-codegen
+      no-std: false
   tidy:
-    uses: taiki-e/github-actions/.github/workflows/tidy.yml@main
+    uses: taiki-e/github-actions/.github/workflows/tidy.yml@3c1cac16ef654d1febb66f21f328fa167f0d2fef # main
+    permissions:
+      contents: write # for creating branch for pr
+      pull-requests: write # unused (used in `codegen-automerge: true` case)
+      security-events: write # for github/codeql-action/*
+    secrets:
+      PR_TOKEN_APP_PRIVATE_KEY: ${{ secrets.PR_TOKEN_APP_PRIVATE_KEY }}
 
   test:
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-20.04
+          # NB: Sync list with https://github.com/taiki-e/checkout-action/blob/HEAD/.github/workflows/ci.yml
           - os: ubuntu-22.04
+          - os: ubuntu-22.04-arm
+          - os: ubuntu-24.04
+          - os: ubuntu-24.04-arm
+          - os: ubuntu-slim
           - os: ubuntu-22.04
             tool: major.minor.patch
           - os: ubuntu-22.04
             tool: major.minor
           - os: ubuntu-22.04
             tool: major
-          - os: macos-12
-          - os: macos-13
           - os: macos-14
-          - os: windows-2019
+          - os: macos-15
+          - os: macos-15-intel
+          - os: macos-26
           - os: windows-2022
+          - os: windows-2022
+            bash: msys64
+          - os: windows-2022
+            bash: cygwin
+          - os: windows-2025
+          - os: windows-2025
+            bash: msys64
+          - os: windows-2025
+            bash: cygwin
+          - os: windows-11-arm
+          - os: windows-2022
+            tool: major.minor.patch
+          - os: windows-2022
+            tool: major.minor
+          - os: windows-2022
+            tool: major
     runs-on: ${{ matrix.os }}
     timeout-minutes: 60
     steps:
-      - uses: taiki-e/checkout-action@v1
+      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
       # cross attempts to install rust-src when Cargo.toml is available even if `cross --version`
-      - run: rm Cargo.toml
+      - run: rm -- Cargo.toml
       - name: Generate tool list
         id: tool-list
-        run: tools/ci/tool-list.sh "${{ matrix.tool }}" >>"${GITHUB_OUTPUT}"
+        run: tools/ci/tool-list.sh "${TOOL}" "${OS}" "${BASH}" >>"${GITHUB_OUTPUT}"
+        env:
+          TOOL: ${{ matrix.tool }}
+          OS: ${{ matrix.os }}
+          BASH: ${{ matrix.bash }}
+      - run: |
+          printf '%s\n' 'C:\msys64\mingw32\bin' >>"${GITHUB_PATH}"
+          printf '%s\n' 'C:\msys64\usr\bin' >>"${GITHUB_PATH}"
+        if: matrix.bash == 'msys64'
+      - run: |
+          choco install --no-progress --requirechecksums cygwin
+          printf '%s\n' 'C:\tools\cygwin\bin' >>"${GITHUB_PATH}"
+          printf '%s\n' 'C:\tools\cygwin\usr\bin' >>"${GITHUB_PATH}"
+        if: matrix.bash == 'cygwin'
+      - run: env
       - uses: ./
         with:
           tool: ${{ steps.tool-list.outputs.tool }}
-      # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsshell
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      # Test all shells listed in https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsshell
       - name: Test bash
-        run: just --version; shfmt --version; protoc --version
+        run: just --version && shfmt --version && protoc --version
         shell: bash
       - name: Test sh
-        run: just --version; shfmt --version; protoc --version
+        run: just --version && shfmt --version && protoc --version
         shell: sh
         if: startsWith(matrix.os, 'ubuntu') || startsWith(matrix.os, 'macos')
       - name: Test pwsh
         run: just --version; shfmt --version; protoc --version
         shell: pwsh
+        if: matrix.os != 'ubuntu-slim'
       - name: Test powershell
         run: just --version; shfmt --version; protoc --version
         shell: powershell
         if: startsWith(matrix.os, 'windows')
       - name: Test cmd
         run: just --version & shfmt --version & protoc --version
-        shell: cmd
+        shell: cmd # zizmor: ignore[misfeature] used for compatibility testing
         if: startsWith(matrix.os, 'windows')
-      # We use the version output to check the version of binstall, but they
+      # We use the version output to check the version of cargo-binstall, but they
       # several times change the version output format in the past so we need to
       # check it with CI. (e.g., 0.14.0->0.16.0 update change it
       # from "cargo-binstall <version>" to "<version>")
       - run: |
-          if [[ "$(cargo binstall -V)" != "$(jq -r '.latest.version' manifests/cargo-binstall.json)" ]]; then
+          if [[ "$(cargo-binstall binstall -V)" != "$(jq -r '.latest.version' manifests/cargo-binstall.json)" ]]; then
             exit 1
           fi
+        if: matrix.bash != 'cygwin' && matrix.os != 'windows-11-arm'
+
+  test-alias:
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
+      # cross attempts to install rust-src when Cargo.toml is available even if `cross --version`
+      - run: rm -- Cargo.toml
+      - run: env
+      - uses: ./
+        with:
+          # NB: Update alias list in release.yml, case for aliases in main.sh,
+          # and match for alias for tools/codegen/src/tools-markdown.rs.
+          tool: |
+            nextest
+            taplo-cli
+            typos-cli
+            wasm-bindgen-cli
+            wasmtime-cli
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Test bash
+        run: cargo-nextest nextest --version && taplo --version
+        shell: bash
+      - name: Test sh
+        run: cargo-nextest nextest --version && taplo --version
+        shell: sh
+
+  test-fallback:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - fallback: none
+          - fallback: cargo-install
+          - fallback: cargo-binstall
+          - fallback: cargo-binstall
+            version: 0.3
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 60
+    steps:
+      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
+      # cross attempts to install rust-src when Cargo.toml is available even if `cross --version`
+      - run: rm -- Cargo.toml
+      - run: env
+      - uses: ./
+        id: install
+        continue-on-error: ${{ matrix.fallback == 'none' }}
+        with:
+          tool: parse-changelog@${{ matrix.version || '0.4.6' }}
+          fallback: ${{ matrix.fallback }}
+      - run: exit 1
+        if: matrix.fallback == 'none' && steps.install.outcome != 'failure'
+      - name: Test bash
+        run: parse-changelog --version
+        shell: bash
+        if: matrix.fallback != 'none'
+      - name: Test sh
+        run: parse-changelog --version
+        shell: sh
+        if: matrix.fallback != 'none'
 
   test-container:
     strategy:
       fail-fast: false
       matrix:
         container:
+          # NB: Sync list with https://github.com/taiki-e/checkout-action/blob/HEAD/.github/workflows/ci.yml
+          - ubuntu:14.04 # glibc 2.19
+          - ubuntu:16.04 # glibc 2.23
           - ubuntu:18.04 # glibc 2.27
           - ubuntu:20.04 # glibc 2.31
           - ubuntu:22.04 # glibc 2.35
+          - ubuntu:24.04 # glibc 2.39
+          - ubuntu:26.04 # glibc 2.42
+          - ubuntu:rolling
+          - debian:9-slim # glibc 2.24
           - debian:10-slim # glibc 2.28
           - debian:11-slim # glibc 2.31
           - debian:12-slim # glibc 2.36
-          - fedora:latest # glibc 2.38 (as of fedora 39)
+          - debian:13-slim # glibc 2.41
+          - debian:testing
+          - fedora:latest # glibc 2.39 (as of fedora 40)
           - almalinux:8 # glibc 2.28
           - almalinux:8-minimal # glibc 2.28
           - almalinux:9 # glibc 2.34
           - almalinux:9-minimal # glibc 2.34
+          - almalinux:10 # glibc 2.39
+          - almalinux:10-minimal # glibc 2.39
+          - centos:6 # glibc 2.12
           - centos:7 # glibc 2.17
-          - opensuse/leap:latest # glibc 2.31 (as of leap 15.5)
+          - opensuse/leap:latest # glibc 2.38 (as of leap 15.6)
-          - opensuse/tumbleweed:latest # glibc 2.39 (as of 2024-04-18)
+          - opensuse/tumbleweed:latest # glibc 2.39 (as of 2024-07-19)
-          - archlinux:latest # glibc 2.38 (as of 2024-04-18)
+          # - archlinux:latest # glibc 2.39 (as of 2024-07-19)
-          - alpine:latest # musl 1.2.4 (as of alpine 3.19)
+          - alpine:3.2 # musl 1.1.11
+          - alpine:3.14 # musl 1.2.2
+          - alpine:3.15 # musl 1.2.2
+          - alpine:3.16 # musl 1.2.3
+          - alpine:3.17 # musl 1.2.3
+          - alpine:3.18 # musl 1.2.4
+          - alpine:3.19 # musl 1.2.4
+          - alpine:3.20 # musl 1.2.5
+          - alpine:3.21 # musl 1.2.5
+          - alpine:3.22 # musl 1.2.5
+          - alpine:3.23 # musl 1.2.5
+          # - openwrt/rootfs:x86-64-openwrt-24.10 # musl 1.2.5
     runs-on: ubuntu-latest
     timeout-minutes: 60
     container: ${{ matrix.container }}
     steps:
-      - name: Install requirements (ubuntu/debian)
+      - name: Install requirements (old debian)
         run: |
-          set -eEuxo pipefail
+          # In Debian, the old repositories is removed from the main mirrors some time after EoL.
-          apt-get -o Acquire::Retries=10 -qq update
+          codename=$(grep -E '^VERSION_CODENAME=' /etc/os-release | cut -d= -f2)
-          apt-get -o Acquire::Retries=10 -o Dpkg::Use-Pty=0 install -y --no-install-recommends cargo
+          sed -i /etc/apt/sources.list -e 's/deb.debian.org/archive.debian.org/g' \
-        if: startsWith(matrix.container, 'ubuntu') || startsWith(matrix.container, 'debian')
+            -e 's|security.debian.org|archive.debian.org/|g' \
-      - name: Install requirements (fedora/almalinux/centos)
+            -e "/${codename}-updates/d"
+        if: startsWith(matrix.container, 'debian:9') || startsWith(matrix.container, 'debian:10')
+      - name: Install requirements (centos)
         run: |
-          set -eEuxo pipefail
+          retry() {
-          curl --proto '=https' --tlsv1.2 -fsSL --retry 10 https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain stable --no-modify-path
+            for i in {1..10}; do
-          echo "$HOME/.cargo/bin" >>"${GITHUB_PATH}"
+              if "$@"; then
-        if: startsWith(matrix.container, 'fedora') || startsWith(matrix.container, 'almalinux') ||  startsWith(matrix.container, 'centos')
+                return 0
-      - name: Install requirements (opensuse)
+              else
-        run: |
+                sleep "${i}"
-          set -eEuxo pipefail
+              fi
-          zypper install -y rustup
+            done
-          rustup toolchain add stable --profile minimal
+            "$@"
-        if: startsWith(matrix.container, 'opensuse')
+          }
-      - name: Install requirements (archlinux)
+          # In CentOS, the old repositories is removed from the main mirrors just after EoL.
-        run: pacman -Sy --noconfirm rust
+          # https://github.com/rust-lang/rust/pull/126352
-        if: startsWith(matrix.container, 'archlinux')
+          sed -i /etc/yum.repos.d/*.repo -e 's!^mirrorlist!#mirrorlist!' \
-      - name: Install requirements (alpine)
+            -e 's!^#baseurl=http://mirror.centos.org/!baseurl=https://vault.centos.org/!'
-        run: apk --no-cache add bash cargo
+          sed -i 's/enabled=1/enabled=0/' /etc/yum/pluginconf.d/fastestmirror.conf
+          if [[ "${CONTAINER}" == "centos:6" ]]; then
+            # CentOS 6's curl (7.19.7) has no curl has no --proto/--tlsv1.2.
+            retry yum install -y gcc openssl-devel
+            retry curl -fsSL --retry 10 https://curl.se/download/curl-7.34.0.tar.gz | tar xzf -
+            cd -- curl-*
+            ./configure --prefix=/usr/local --with-ssl
+            make
+            make install
+            # for checkout-action https://github.com/taiki-e/checkout-action/blob/v1.3.0/.github/workflows/ci.yml#L135-L143
+            retry yum install -y openssh-clients perl perl-Error perl-TermReadKey rsync
+            retry rpm -i \
+              https://vault.ius.io/el6/x86_64/packages/p/perl-Git18-1.8.5.5-4.ius.el6.noarch.rpm \
+              https://vault.ius.io/el6/x86_64/packages/g/git18-1.8.5.5-4.ius.el6.x86_64.rpm
+          fi
+        env:
+          CONTAINER: ${{ matrix.container }}
+        if: startsWith(matrix.container, 'centos')
+      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
+      # cross attempts to install rust-src when Cargo.toml is available even if `cross --version`
+      - run: rm -- Cargo.toml
+      - name: Generate tool list
+        id: tool-list
+        run: tools/ci/tool-list.sh "" "${CONTAINER}" >>"${GITHUB_OUTPUT}"
+        env:
+          CONTAINER: ${{ matrix.container }}
+      # remove bash installed by checkout-action
+      - run: apk --no-cache del bash
         shell: sh
         if: startsWith(matrix.container, 'alpine')
-      - uses: taiki-e/checkout-action@v1
-      # cross attempts to install rust-src when Cargo.toml is available even if `cross --version`
-      - run: rm Cargo.toml
-      - name: Generate tool list
-        id: tool-list
-        run: tools/ci/tool-list.sh >>"${GITHUB_OUTPUT}"
       - uses: ./
         with:
           tool: ${{ steps.tool-list.outputs.tool }}
-
-  test-no-cargo:
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
-    container: ubuntu:22.04
-    steps:
-      - uses: taiki-e/checkout-action@v1
-      - name: Generate tool list
-        id: tool-list
-        run: tools/ci/tool-list.sh >>"${GITHUB_OUTPUT}"
-      - uses: ./
-        with:
-          tool: ${{ steps.tool-list.outputs.tool }}
-
-  manifest:
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
-    permissions:
-      contents: write
-      pull-requests: write
-    steps:
-      - uses: taiki-e/checkout-action@v1
-      - name: Install Rust
-        run: rustup toolchain add nightly --no-self-update && rustup default nightly
-      - run: tools/manifest.sh
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - id: diff
+      - name: Test bash
-        run: tools/ci/manifest.sh
+        run: just --version && shfmt --version
-        if: github.repository_owner == 'taiki-e' && (github.event_name == 'schedule' || github.event_name == 'push' && github.ref == 'refs/heads/main')
+        shell: bash
-      - name: Create PR
+        # TODO: OCI runtime exec failed: exec failed: unable to start container process: exec: "bash": executable file not found in $PATH: unknown
-        id: create-pull-request
+        if: (!startsWith(matrix.container, 'opensuse'))
-        uses: peter-evans/create-pull-request@v6
+      - name: Test sh
-        with:
+        run: just --version && shfmt --version
-          title: Update manifest
+        shell: sh
-          body: |
+        # TODO: OCI runtime exec failed: exec failed: unable to start container process: exec: "sh": executable file not found in $PATH: unknown
-            Auto-generated by [create-pull-request](https://github.com/peter-evans/create-pull-request).
+        if: (!startsWith(matrix.container, 'opensuse'))
-
-            This will be auto-merged when CI has passed because this is an auto-generated PR in a defined format and is usually considered no additional review is required.
-          branch: update-manifest
-          token: ${{ secrets.CREATE_PR_TOKEN }}
-        if: github.repository_owner == 'taiki-e' && (github.event_name == 'schedule' || github.event_name == 'push' && github.ref == 'refs/heads/main') && steps.diff.outputs.success == 'false'
-      - name: Enable auto-merge for auto-generated PR
-        run: gh pr merge --rebase --auto "${PR_NUMBER:?}"
-        env:
-          GITHUB_TOKEN: ${{ secrets.CREATE_PR_TOKEN }}
-          PR_NUMBER: ${{ steps.create-pull-request.outputs.pull-request-number }}
-        if: github.repository_owner == 'taiki-e' && (github.event_name == 'schedule' || github.event_name == 'push' && github.ref == 'refs/heads/main') && steps.diff.outputs.success == 'false' && steps.create-pull-request.outputs.pull-request-operation == 'created'
-      - name: Auto approve for auto-generated PR
-        run: gh pr review --approve "${PR_NUMBER:?}"
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          PR_NUMBER: ${{ steps.create-pull-request.outputs.pull-request-number }}
-        if: github.repository_owner == 'taiki-e' && (github.event_name == 'schedule' || github.event_name == 'push' && github.ref == 'refs/heads/main') && steps.diff.outputs.success == 'false' && steps.create-pull-request.outputs.pull-request-operation == 'created'
-      - run: git add -N . && git diff --exit-code

.github/workflows/manifest.yml

@@ -0,0 +1,49 @@
+name: Manifest
+
+permissions:
+  contents: read
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+      - dev
+      - ci-*
+  schedule:
+    - cron: '0 0,3,6,9,12,15,18,21 * * *'
+  workflow_dispatch:
+
+env:
+  CARGO_INCREMENTAL: 0
+  CARGO_NET_GIT_FETCH_WITH_CLI: true
+  CARGO_NET_RETRY: 10
+  CARGO_TERM_COLOR: always
+  RUST_BACKTRACE: 1
+  RUSTFLAGS: -D warnings
+  RUSTUP_MAX_RETRIES: 10
+
+defaults:
+  run:
+    shell: bash --noprofile --norc -CeEuxo pipefail {0}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+jobs:
+  manifest:
+    uses: taiki-e/github-actions/.github/workflows/gen.yml@3c1cac16ef654d1febb66f21f328fa167f0d2fef # main
+    permissions:
+      contents: write # for creating branch for pr
+      pull-requests: write # for gh pr review --approve
+    secrets:
+      PR_TOKEN_APP_PRIVATE_KEY: ${{ secrets.PR_TOKEN_APP_PRIVATE_KEY }}
+    with:
+      script: tools/manifest.sh
+      commit-script: tools/ci/manifest.sh
+      title: Update manifest
+      branch: update-manifest
+      automerge: true
+      install-rust: true
+      install-cosign: true

.github/workflows/release.yml

@@ -1,29 +1,454 @@
 name: Release
 
+# Adapted from https://github.com/taiki-e/github-actions/blob/HEAD/.github/workflows/action-release.yml.
+
 permissions:
   contents: read
 
 on:
-  push:
+  workflow_dispatch:
-    tags:
+    inputs:
-      - v[0-9]+.[0-9]+.*
+      target:
+        description: Package to be released
+        required: true
+        type: choice
+        options:
+          - install-action
+          - install-action-manifest-schema
+      version:
+        description: Version to be increased
+        required: true
+        type: choice
+        options:
+          - patch
+          - minor
+          - major
 
 defaults:
   run:
-    shell: bash
+    shell: bash --noprofile --norc -CeEuxo pipefail {0}
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
 
 jobs:
-  create-release:
+  prepare:
-    if: github.repository_owner == 'taiki-e'
+    if: github.repository_owner == 'taiki-e' && inputs.target == 'install-action'
     runs-on: ubuntu-latest
     timeout-minutes: 60
-    permissions:
-      contents: write
     steps:
-      - uses: taiki-e/checkout-action@v1
+      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
-      - uses: taiki-e/create-gh-release-action@v1
+      - uses: taiki-e/install-action@b8be7f5e140177087325943c4a8e169d01c59b3d # v2.75.3
+        with:
+          tool: parse-changelog
+          fallback: none
+      - id: check
+        run: |
+          set +x
+          IFS=$'\n\t'
+          trap -- 's=$?; printf >&2 "%s\n" "${0##*/}:${LINENO}: \`${BASH_COMMAND}\` exit with ${s}"; exit ${s}' ERR
+          retry() {
+            for i in {1..10}; do
+              if "$@"; then
+                return 0
+              else
+                sleep "${i}"
+              fi
+            done
+            "$@"
+          }
+          bail() {
+            printf '::error::%s\n' "$*"
+            exit 1
+          }
+          if { sed --help 2>&1 || true; } | grep -Eq -e '-i extension'; then
+            in_place=(-i '')
+          else
+            in_place=(-i)
+          fi
+
+          # shellcheck disable=SC2153
+          version="${VERSION}"
+          printf '%s\n' "version(input): ${version}"
+          # shellcheck disable=SC2153
+          tag_prefix="${TAG_PREFIX}"
+          printf '%s\n' "tag_prefix: ${tag_prefix}"
+          # shellcheck disable=SC2153
+          changelog="${CHANGELOG}"
+          printf '%s\n' "changelog: ${changelog}"
+
+          # Get the current date.
+          release_date=$(date -u '+%Y-%m-%d')
+          printf '%s\n' "release-date: ${release_date}"
+          printf '%s\n' "release-date=${release_date}" >>"${GITHUB_OUTPUT}"
+
+          # Get the current revision.
+          rev=$(git rev-parse HEAD)
+          printf '%s\n' "rev: ${rev}"
+          printf '%s\n' "rev=${rev}" >>"${GITHUB_OUTPUT}"
+
+          prev_version=$(parse-changelog --title-no-link "${changelog}" | cut -d' ' -f1)
+
+          # Determine the new version number and tag name.
+          case "${version}" in
+            major | minor | patch)
+              if [[ ! "${prev_version}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+                bail "pre-release/build-metadata"
+              fi
+              major="${prev_version%%.*}"
+              minor_patch="${prev_version#*.}"
+              minor="${minor_patch%%.*}"
+              patch="${minor_patch#*.}"
+              case "${version}" in
+                major) version="$((major+1)).0.0" ;;
+                minor) version="${major}.$((minor+1)).0" ;;
+                patch) version="${major}.${minor}.$((patch+1))" ;;
+              esac
+              ;;
+            *) version="${version#v}" ;;
+          esac
+          if [[ ! "${version}" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z\.-]+)?(\+[0-9A-Za-z\.-]+)?$ ]]; then
+            bail "invalid version format '${version}'"
+          fi
+          printf '%s\n' "version: ${version}"
+          printf '%s\n' "version=${version}" >>"${GITHUB_OUTPUT}"
+          tag="${tag_prefix}${version}"
+          printf '%s\n' "tag: ${tag}"
+          printf '%s\n' "tag=${tag}" >>"${GITHUB_OUTPUT}"
+
+          # Make sure the same release has not been created in the past.
+          if gh release view "${tag}" &>/dev/null; then
+            bail "tag '${tag}' has already been created and pushed"
+          fi
+          # Make sure that the release was created from an allowed branch.
+          if ! git branch | grep -Eq '\* '"${BRANCH}"'$'; then
+            bail "current branch is not '${BRANCH}'"
+          fi
+
+          changed_paths=()
+          retry git fetch origin --tags &>/dev/null
+          tags=$(git --no-pager tag | { grep -E "^${tag_prefix}[0-9]+" || true; })
+          if [[ -n "${tags}" ]]; then
+            printf 'has-tags=true\n' >>"${GITHUB_OUTPUT}"
+            # Make sure the same release does not exist in changelog.
+            if grep -Eq "^## \\[${version//./\\.}\\]" "${changelog}"; then
+              bail "release ${version} already exist in ${changelog}"
+            fi
+            if grep -Eq "^\\[${version//./\\.}\\]: " "${changelog}"; then
+              bail "link to ${version} already exist in ${changelog}"
+            fi
+
+            # Update changelog.
+            changed_paths+=("${changelog}")
+            remote_url=$(grep -E '^\[Unreleased\]: https://' "${changelog}" | sed -E 's/^\[Unreleased\]: //; s/\.\.\.HEAD$//')
+            prev_tag="${remote_url#*/compare/}"
+            remote_url="${remote_url%/compare/*}"
+            sed -E "${in_place[@]}" \
+              -e "s/^## \\[Unreleased\\]/## [Unreleased]\\n\\n## [${version}] - ${release_date}/" \
+              -e "s#^\[Unreleased\]: https://.*#[Unreleased]: ${remote_url}/compare/${tag}...HEAD\\n[${version}]: ${remote_url}/compare/${prev_tag}...${tag}#" "${changelog}"
+            if ! grep -Eq "^## \\[${version//./\\.}\\] - ${release_date}$" "${changelog}"; then
+              bail "failed to update ${changelog}"
+            fi
+            if ! grep -Eq "^\\[${version//./\\.}\\]: " "${changelog}"; then
+              bail "failed to update ${changelog}"
+            fi
+          else
+            # Make sure the release exists in changelog.
+            if ! grep -Eq "^## \\[${version//./\\.}\\] - ${release_date}$" "${changelog}"; then
+              bail "release ${version} does not exist in ${changelog} or has wrong release date"
+            fi
+            if ! grep -Eq "^\\[${version//./\\.}\\]: " "${changelog}"; then
+              bail "link to ${version} does not exist in ${changelog}"
+            fi
+          fi
+          # Make sure that a valid release note for this version exists.
+          # https://github.com/taiki-e/parse-changelog
+          changes=$(parse-changelog "${changelog}" "${version}")
+          if [[ -z "${changes}" ]]; then
+            bail "changelog for ${version} has no body"
+          fi
+          printf '============== CHANGELOG ==============\n'
+          printf '%s\n' "${changes}"
+          printf '=======================================\n'
+
+          if [[ -n "${tags}" ]]; then
+            git -c color.ui=always diff "${changed_paths[@]}"
+            git add "${changed_paths[@]}"
+          fi
+          # Make sure that there is no unintended change.
+          git add -N .
+          git -c color.ui=always diff --exit-code
+
+          (
+            set -x
+            git show HEAD --shortstat
+          )
+        env:
+          VERSION: ${{ inputs.version }}
+          TAG_PREFIX: v
+          CHANGELOG: CHANGELOG.md
+          BRANCH: main
+    outputs:
+      has-tags: ${{ steps.check.outputs.has-tags }}
+      release-date: ${{ steps.check.outputs.release-date }}
+      rev: ${{ steps.check.outputs.rev }}
+      tag: ${{ steps.check.outputs.tag }}
+      version: ${{ steps.check.outputs.version }}
+
+  release:
+    if: github.repository_owner == 'taiki-e' && inputs.target == 'install-action'
+    needs: prepare
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    environment:
+      name: release
+      deployment: false
+    permissions:
+      contents: write # for taiki-e/create-gh-release-action
+    steps:
+      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
+      - uses: taiki-e/install-action@b8be7f5e140177087325943c4a8e169d01c59b3d # v2.75.3
+        with:
+          tool: parse-changelog
+          fallback: none
+      - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+        id: push-token
+        with:
+          client-id: ${{ secrets.PUSH_TOKEN_APP_CLIENT_ID }}
+          private-key: ${{ secrets.PUSH_TOKEN_APP_PRIVATE_KEY }}
+      - name: Create and push release commit and tag
+        id: push
+        run: |
+          set +x
+          IFS=$'\n\t'
+          trap -- 's=$?; printf >&2 "%s\n" "${0##*/}:${LINENO}: \`${BASH_COMMAND}\` exit with ${s}"; exit ${s}' ERR
+          retry() {
+            for i in {1..10}; do
+              if "$@"; then
+                return 0
+              else
+                sleep "${i}"
+              fi
+            done
+            "$@"
+          }
+          bail() {
+            printf '::error::%s\n' "$*"
+            exit 1
+          }
+          if { sed --help 2>&1 || true; } | grep -Eq -e '-i extension'; then
+            in_place=(-i '')
+          else
+            in_place=(-i)
+          fi
+
+          git config user.name 'Taiki Endo'
+          git config user.email 'te316e89@gmail.com'
+
+          # shellcheck disable=SC2153
+          version="${VERSION}"
+          # shellcheck disable=SC2153
+          tag="${TAG}"
+          # shellcheck disable=SC2153
+          changelog="${CHANGELOG}"
+          # shellcheck disable=SC2153
+          release_date="${RELEASE_DATE}"
+
+          # Make sure the current revision is same as prepare step.
+          # --unshallow is necessary to successfully push the
+          # "releases/${major_version_tag}" branch in the subsequent step.
+          retry git fetch origin --unshallow &>/dev/null
+          rev=$(git rev-parse HEAD)
+          if [[ "${rev}" != "${PREPARE_REV}" ]]; then
+            bail "revision difference between prepare step"
+          fi
+
+          # Make sure the same release has not been created in the past.
+          if gh release view "${tag}" &>/dev/null; then
+            bail "tag '${tag}' has already been created and pushed"
+          fi
+          # Make sure that the release was created from an allowed branch.
+          if ! git branch | grep -Eq '\* '"${BRANCH}"'$'; then
+            bail "current branch is not '${BRANCH}'"
+          fi
+
+          changed_paths=()
+          if [[ "${HAS_TAGS}" == "true" ]]; then
+            # Update changelog.
+            changed_paths+=("${changelog}")
+            remote_url=$(grep -E '^\[Unreleased\]: https://' "${changelog}" | sed -E 's/^\[Unreleased\]: //; s/\.\.\.HEAD$//')
+            prev_tag="${remote_url#*/compare/}"
+            remote_url="${remote_url%/compare/*}"
+            sed -E "${in_place[@]}" \
+              -e "s/^## \\[Unreleased\\]/## [Unreleased]\\n\\n## [${version}] - ${release_date}/" \
+              -e "s#^\[Unreleased\]: https://.*#[Unreleased]: ${remote_url}/compare/${tag}...HEAD\\n[${version}]: ${remote_url}/compare/${prev_tag}...${tag}#" "${changelog}"
+            if ! grep -Eq "^## \\[${version//./\\.}\\] - ${release_date}$" "${changelog}"; then
+              bail "failed to update ${changelog}"
+            fi
+            if ! grep -Eq "^\\[${version//./\\.}\\]: " "${changelog}"; then
+              bail "failed to update ${changelog}"
+            fi
+          fi
+          changes=$(parse-changelog "${changelog}" "${version}")
+          printf '============== CHANGELOG ==============\n'
+          printf '%s\n' "${changes}"
+          printf '=======================================\n'
+
+          if [[ "${HAS_TAGS}" == "true" ]]; then
+            # Create a release commit.
+            (
+              set -x
+              git add "${changed_paths[@]}"
+              git commit -m "Release ${version}"
+            )
+          fi
+
+          major_version_tag="v${version%%.*}"
+          (
+            set -x
+            git tag "${tag}"
+            git branch "releases/${major_version_tag}"
+            git tag -f "${major_version_tag}"
+          )
+          refs=("refs/heads/${BRANCH}" "refs/tags/${tag}" "refs/heads/releases/${major_version_tag}" "+refs/tags/${major_version_tag}")
+
+          tools=()
+          for tool in tools/codegen/base/*.json; do
+            tool="${tool##*/}"
+            tools+=("${tool%.*}")
+          done
+          # Aliases.
+          # NB: Update case for aliases in main.sh, tool input option in test-alias job
+          # in .github/workflows/ci.yml, and match for alias for tools/codegen/src/tools-markdown.rs.
+          tools+=(
+            nextest
+            taplo-cli
+            typos-cli
+            wasm-bindgen-cli
+            wasmtime-cli
+          )
+          # Non-manifest-based tools.
+          tools+=(valgrind)
+
+          branches=()
+          for tool in "${tools[@]}"; do
+            (
+              set -x
+              git checkout -b "releases/${tool}"
+              sed -E "${in_place[@]}" action.yml \
+                -e "s/required: true/required: false/g" \
+                -e "s/# default: #publish:tool/default: ${tool}/g"
+              git add action.yml
+              git commit -m "${tool}"
+              git tag -f "${tool}"
+              git checkout refs/tags/"${tag}"
+            )
+            refs+=("+refs/heads/releases/${tool}" "+refs/tags/${tool}")
+            branches+=("releases/${tool}")
+          done
+
+          prev_credential_helper=$(git config get --local credential.helper || true)
+          if [[ -n "${prev_credential_helper}" ]]; then
+            printf 'credential helper is already set (%s)\n' "${prev_credential_helper}"
+          else
+            protocol="${GITHUB_SERVER_URL%%://*}"
+            hostname="${GITHUB_SERVER_URL#*://}"
+            (
+              set -x
+              git config --local credential.helper cache
+            )
+            git credential approve <<EOF
+          protocol=${protocol}
+          host=${hostname}
+          username=${GITHUB_ACTOR}
+          password=${PUSH_TOKEN}
+          EOF
+            # Remove credential helper config on exit.
+            trap -- '(set -x; git credential-cache exit; git config --local --unset credential.helper || true)' EXIT
+          fi
+
+          (
+            set -x
+            retry git push origin --atomic "${refs[@]}"
+            git branch -d "releases/${major_version_tag}"
+            git branch -D "${branches[@]}"
+
+            schema_workspace=/tmp/workspace
+            rm -rf -- "${schema_workspace}"
+            # Checkout manifest-schema branch
+            schema_version="$(cargo metadata --format-version=1 --no-deps | jq -r '.packages[] | select(.name == "install-action-manifest-schema") | .version')"
+            if [[ "${schema_version}" == "0."* ]]; then
+              schema_version="0.$(cut -d. -f2 <<<"${schema_version}")"
+            else
+              schema_version="$(cut -d. -f1 <<<"${schema_version}")"
+            fi
+            schema_branch="manifest-schema-${schema_version}"
+
+            git worktree add --force "${schema_workspace}"
+            (
+              cd -- "${schema_workspace}"
+              if git fetch origin "${schema_branch}"; then
+                git checkout "origin/${schema_branch}" -B "${schema_branch}"
+              elif ! git checkout "${schema_branch}"; then
+                # New branch with no history. Credit: https://stackoverflow.com/a/13969482
+                git checkout --orphan "${schema_branch}"
+                git rm -rf -- . || true
+                git commit -m 'Initial commit' --allow-empty
+              fi
+            )
+
+            # Copy over schema
+            cp -- ./manifests/* "${schema_workspace}"
+
+            (
+              cd -- "${schema_workspace}"
+              # Stage changes
+              git add .
+              # Detect changes, then commit and push if changes exist
+              if [[ "$(git status --porcelain=v1 | LC_ALL=C wc -l)" != "0" ]]; then
+                git commit -m 'Update manifest schema'
+                retry git push origin HEAD
+              fi
+            )
+
+            rm -rf -- "${schema_workspace}"
+            git worktree prune
+            # TODO: get branch in schema_workspace dir instead
+            git branch -D "${schema_branch}" "${schema_workspace##*/}"
+          )
+        env:
+          VERSION: ${{ needs.prepare.outputs.version }}
+          RELEASE_DATE: ${{ needs.prepare.outputs.release-date }}
+          HAS_TAGS: ${{ needs.prepare.outputs.has-tags }}
+          TAG: ${{ needs.prepare.outputs.tag }}
+          CHANGELOG: CHANGELOG.md
+          BRANCH: main
+          PREPARE_REV: ${{ needs.prepare.outputs.rev }}
+          # Note that if we use secrets.GITHUB_TOKEN, the pushed commit/tag cannot trigger other workflows.
+          PUSH_TOKEN: ${{ steps.push-token.outputs.token }}
+      - uses: taiki-e/create-gh-release-action@eba8ea96c86cca8a37f1b56e94b4d13301fba651 # v1.11.0
         with:
           changelog: CHANGELOG.md
           title: $version
-          branch: 'main|v[0-9]+'
+          branch: main
-          token: ${{ secrets.GITHUB_TOKEN }}
+          ref: refs/tags/${{ needs.prepare.outputs.tag }}
+
+  release-manifest-schema:
+    if: github.repository_owner == 'taiki-e' && inputs.target == 'install-action-manifest-schema'
+    uses: taiki-e/github-actions/.github/workflows/rust-release.yml@3c1cac16ef654d1febb66f21f328fa167f0d2fef # main
+    permissions:
+      contents: write # for taiki-e/create-gh-release-action
+      id-token: write # for rust-lang/crates-io-auth-action
+      attestations: write # unused (used when options for uploading binaries are set)
+    secrets:
+      PUSH_TOKEN_APP_CLIENT_ID: ${{ secrets.PUSH_TOKEN_APP_CLIENT_ID }}
+      PUSH_TOKEN_APP_PRIVATE_KEY: ${{ secrets.PUSH_TOKEN_APP_PRIVATE_KEY }}
+    with:
+      version: ${{ inputs.version }}
+      tag-prefix: install-action-manifest-schema-
+      crates: tools/manifest-schema
+      changelog: tools/manifest-schema/CHANGELOG.md
+      title: $prefix $version
+      prefix: install-action-manifest-schema
+      commit-prefix: 'manifest-schema: '

.github/zizmor.yml

@@ -0,0 +1,6 @@
+# zizmor configuration
+# https://docs.zizmor.sh/configuration/
+
+rules:
+  anonymous-definition: { disable: true } # This is pedantic/auditor only audit and requires explicitly naming each job, but is usually redundant.
+  dependabot-cooldown: { config: { days: 14 } }

.gitignore

@@ -1,6 +1,6 @@
 target
 Cargo.lock
-.venv
+mutants.out*
 tmp
 
 # For platform and editor specific settings, it is recommended to add to

.markdownlint-cli2.yaml

@@ -1,9 +1,10 @@
-# https://github.com/DavidAnson/markdownlint#rules--aliases
+# https://github.com/DavidAnson/markdownlint/blob/HEAD/doc/Rules.md
 config:
-  line-length: false
+  line-length: false # MD013
-  no-duplicate-heading: false
+  no-duplicate-heading: false # MD024
-  no-inline-html: false
+  no-blanks-blockquote: false # MD028 (this warns valid GFM alerts usage)
-  no-emphasis-as-heading: false
+  no-inline-html: false # MD033
+  no-emphasis-as-heading: false # MD036
 
 # https://github.com/DavidAnson/markdownlint-cli2#markdownlint-cli2jsonc
 noBanner: true

.prettierignore

@@ -0,0 +1 @@
+manifests/*.json

.rustfmt.toml

@@ -8,13 +8,14 @@ error_on_line_overflow = true
 # Override the default formatting style.
 # See https://internals.rust-lang.org/t/running-rustfmt-on-rust-lang-rust-and-other-rust-lang-repositories/8732/81.
 use_small_heuristics = "Max"
-# This is the default of 2024 edition https://github.com/rust-lang/rust/pull/114764.
 # This is unstable (tracking issue: https://github.com/rust-lang/rustfmt/issues/3370)
 overflow_delimited_expr = true
 # This is unstable (tracking issue: https://github.com/rust-lang/rustfmt/issues/4991).
 imports_granularity = "Crate"
 # This is unstable (tracking issue: https://github.com/rust-lang/rustfmt/issues/5083).
 group_imports = "StdExternalCrate"
+# This is unstable (tracking issue: https://github.com/rust-lang/rustfmt/issues/5081).
+hex_literal_case = "Upper"
 
 # Apply rustfmt to more places.
 # This is unstable (tracking issue: https://github.com/rust-lang/rustfmt/issues/3348).
@@ -27,6 +28,7 @@ use_try_shorthand = true
 # Set the default settings again to always apply the proper formatting without
 # being affected by the editor settings.
 edition = "2021"
+style_edition = "2024"
 hard_tabs = false
 newline_style = "Unix"
 tab_spaces = 4

.shellcheckrc

@@ -2,13 +2,37 @@
 # https://github.com/koalaman/shellcheck/blob/HEAD/shellcheck.1.md#rc-files
 
 # See also:
-# https://www.shellcheck.net/wiki/Optional
+# https://github.com/koalaman/shellcheck/wiki/Optional
 # https://google.github.io/styleguide/shellguide.html
 
-# https://www.shellcheck.net/wiki/SC2292
+# https://github.com/koalaman/shellcheck/wiki/Directive#external-sources
+external-sources=true
+
+# https://github.com/koalaman/shellcheck/wiki/SC2249
+# enable=add-default-case
+
+# https://github.com/koalaman/shellcheck/wiki/SC2244
+enable=avoid-nullary-conditions
+
+# https://github.com/koalaman/shellcheck/wiki/SC2312
+# enable=check-extra-masked-returns
+
+# https://github.com/koalaman/shellcheck/wiki/SC2310
+# https://github.com/koalaman/shellcheck/wiki/SC2311
+# enable=check-set-e-suppressed
+
+# enable=check-unassigned-uppercase
+
+# https://github.com/koalaman/shellcheck/wiki/SC2230
+enable=deprecate-which
+
+# https://github.com/koalaman/shellcheck/wiki/SC2248
+enable=quote-safe-variables
+
+# https://github.com/koalaman/shellcheck/wiki/SC2292
 # https://google.github.io/styleguide/shellguide.html#s6.3-tests
 enable=require-double-brackets
 
-# https://www.shellcheck.net/wiki/SC2250
+# https://github.com/koalaman/shellcheck/wiki/SC2250
 # https://google.github.io/styleguide/shellguide.html#s5.6-variable-expansion
 enable=require-variable-braces

Cargo.toml

@@ -1,37 +1,48 @@
 [workspace]
 resolver = "2"
-members = ["tools/codegen"]
+members = ["tools/codegen", "tools/manifest-schema"]
 
 # This table is shared by projects under github.com/taiki-e.
-# It is not intended for manual editing.
+# Expect for unexpected_cfgs.check-cfg, it is not intended for manual editing.
 [workspace.lints.rust]
+deprecated_safe = "warn"
 improper_ctypes = "warn"
 improper_ctypes_definitions = "warn"
 non_ascii_idents = "warn"
 rust_2018_idioms = "warn"
 single_use_lifetimes = "warn"
+unexpected_cfgs = { level = "warn", check-cfg = [
+] }
+unnameable_types = "warn"
 unreachable_pub = "warn"
 unsafe_op_in_unsafe_fn = "warn"
 [workspace.lints.clippy]
 all = "warn" # Downgrade deny-by-default lints
 pedantic = "warn"
 as_ptr_cast_mut = "warn"
+as_underscore = "warn"
 default_union_representation = "warn"
 inline_asm_x86_att_syntax = "warn"
 trailing_empty_array = "warn"
 transmute_undefined_repr = "warn"
 undocumented_unsafe_blocks = "warn"
+unused_trait_names = "warn"
 # Suppress buggy or noisy clippy lints
 bool_assert_comparison = { level = "allow", priority = 1 }
 borrow_as_ptr = { level = "allow", priority = 1 } # https://github.com/rust-lang/rust-clippy/issues/8286
+cast_lossless = { level = "allow", priority = 1 } # suggested code has poor codegen with -C opt-level=0 https://godbolt.org/z/GzTxzbd9q
+collapsible_match = { level = "allow", priority = 1 }
 declare_interior_mutable_const = { level = "allow", priority = 1 } # https://github.com/rust-lang/rust-clippy/issues/7665
 doc_markdown = { level = "allow", priority = 1 }
 float_cmp = { level = "allow", priority = 1 } # https://github.com/rust-lang/rust-clippy/issues/7725
+incompatible_msrv = { level = "allow", priority = 1 } # buggy: doesn't consider cfg, https://github.com/rust-lang/rust-clippy/issues/12280, https://github.com/rust-lang/rust-clippy/issues/12257#issuecomment-2093667187
 manual_assert = { level = "allow", priority = 1 }
 manual_range_contains = { level = "allow", priority = 1 } # https://github.com/rust-lang/rust-clippy/issues/6455#issuecomment-1225966395
 missing_errors_doc = { level = "allow", priority = 1 }
-module_name_repetitions = { level = "allow", priority = 1 }
+module_name_repetitions = { level = "allow", priority = 1 } # buggy: https://github.com/rust-lang/rust-clippy/issues?q=is%3Aissue+is%3Aopen+module_name_repetitions
-nonminimal_bool = { level = "allow", priority = 1 } # buggy https://github.com/rust-lang/rust-clippy/issues?q=is%3Aissue+is%3Aopen+nonminimal_bool
+naive_bytecount = { level = "allow", priority = 1 }
+nonminimal_bool = { level = "allow", priority = 1 } # buggy: https://github.com/rust-lang/rust-clippy/issues?q=is%3Aissue+is%3Aopen+nonminimal_bool
+range_plus_one = { level = "allow", priority = 1 } # buggy: https://github.com/rust-lang/rust-clippy/issues?q=is%3Aissue+is%3Aopen+range_plus_one
 similar_names = { level = "allow", priority = 1 }
 single_match = { level = "allow", priority = 1 }
 single_match_else = { level = "allow", priority = 1 }

DEVELOPMENT.md

@@ -4,13 +4,11 @@
 
 (Example: [ffbd316](https://github.com/taiki-e/install-action/commit/ffbd316e0fe98cb460dae3a66cd2ef9deb398bb1))
 
-1\. Add tool name to the table in ["Supported tools" section in `README.md`](https://github.com/taiki-e/install-action#supported-tools).
+1\. Add base manifest to [`tools/codegen/base`](tools/codegen/base) directory.
-
-2\. Add base manifest to [`tools/codegen/base`](tools/codegen/base) directory.
 
 See JSON files in `tools/codegen/base` directory for examples of the manifest.
 
-3\. Generate manifest with the following command (replace `<tool>` with the tool name).
+2\. Generate manifest with the following command (replace `<tool>` with the tool name).
 
 ```sh
 ./tools/manifest.sh <tool>
@@ -19,10 +17,16 @@ See JSON files in `tools/codegen/base` directory for examples of the manifest.
 > If you're having problem with github api rate limit, you can use your GITHUB_TOKEN to increase the rate limit.
 > If you have `Github CLI` installed (the command `gh`), you can:
 >
-> ```shell
+> ```sh
-> GITHUB_TOKEN=$(gh auth status --show-token 2>&1 | sed -n 's/^.*Token: \(.*\)$/\1/p') ./tools/manifest.sh <tool>
+> GITHUB_TOKEN=$(gh auth token) ./tools/manifest.sh <tool>
 > ```
 
+3\. Update `TOOLS.md` with the following command.
+
+```sh
+./tools/update-markdown.sh
+```
+
 ## Troubleshooting
 
 If one of the CI builds fails due to a bin path or release asset_name, fix the problem in the base

README.md

@@ -1,3 +1,4 @@
+<!-- omit in toc -->
 # install-action
 
 [![release](https://img.shields.io/github/release/taiki-e/install-action?style=flat-square&logo=github)](https://github.com/taiki-e/install-action/releases/latest)
@@ -19,10 +20,10 @@ GitHub Action for installing development tools (mainly from GitHub Releases).
 
 ### Inputs
 
-| Name     | Required | Description                             | Type    | Default |
+| Name | Required | Description | Type | Default |
-| -------- |:--------:| --------------------------------------- | ------- | ------- |
+| ---- | :------: | ----------- | ---- | ------- |
-| tool     | **true** | Tools to install (comma-separated list) | String  |         |
+| tool | **✓** | Tools to install (whitespace or comma separated list) | String | |
-| checksum | false    | Whether to enable checksums             | Boolean | `true`  |
+| checksum | | Whether to enable checksums (strongly discouraged to disable) | Boolean | `true` |
 
 ### Example workflow
 
@@ -74,63 +75,24 @@ Or:
 
 ## Supported tools
 
-<!--
+See [TOOLS.md](TOOLS.md) for the list of tools that are installed from manifests managed in this action.
-License should use SPDX license identifiers.
-https://spdx.org/licenses
--->
 
-| Name | Where binaries will be installed | Where will it be installed from | Supported platform | License |
+If a tool not included in the list above is specified, this action uses [cargo-binstall] as a fallback.
-| ---- | -------------------------------- | ------------------------------- | ------------------ | ------- |
-| [**biome**](https://biomejs.dev)| `/usr/local/bin` | [GitHub Releases](https://github.com/biomejs/biome/releases) | Linux, macOS, Windows | [MIT](https://github.com/biomejs/biome/blob/HEAD/LICENSE) |
-| [**cargo-audit**](https://github.com/rustsec/rustsec/tree/HEAD/cargo-audit) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/rustsec/rustsec/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/rustsec/rustsec/blob/HEAD/cargo-audit/LICENSE-APACHE) OR [MIT](https://github.com/rustsec/rustsec/blob/HEAD/cargo-audit/LICENSE-MIT) |
-| [**cargo-binstall**][cargo-binstall] | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/cargo-bins/cargo-binstall/releases) | Linux, macOS, Windows | [GPL-3.0](https://github.com/cargo-bins/cargo-binstall/blob/HEAD/crates/bin/LICENSE) |
-| [**cargo-careful**](https://github.com/RalfJung/cargo-careful) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/RalfJung/cargo-careful/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/RalfJung/cargo-careful/blob/HEAD/LICENSE-APACHE) OR [MIT](https://github.com/RalfJung/cargo-careful/blob/HEAD/LICENSE-MIT) |
-| [**cargo-cyclonedx**](https://github.com/CycloneDX/cyclonedx-rust-cargo) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/CycloneDX/cyclonedx-rust-cargo/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/CycloneDX/cyclonedx-rust-cargo/blob/HEAD/LICENSE) |
-| [**cargo-deny**](https://github.com/EmbarkStudios/cargo-deny) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/EmbarkStudios/cargo-deny/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/EmbarkStudios/cargo-deny/blob/HEAD/LICENSE-APACHE) OR [MIT](https://github.com/EmbarkStudios/cargo-deny/blob/HEAD/LICENSE-MIT) |
-| [**cargo-dinghy**](https://github.com/sonos/dinghy) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/sonos/dinghy/releases) | Linux, macOS | [Apache-2.0](https://github.com/sonos/dinghy/blob/HEAD/LICENSE-APACHE) OR [MIT](https://github.com/sonos/dinghy/blob/HEAD/LICENSE-MIT) |
-| [**cargo-export**](https://github.com/bazhenov/cargo-export) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/bazhenov/cargo-export/releases) | Linux, macOS, Windows | [MIT](https://github.com/bazhenov/cargo-export/blob/HEAD/LICENSE) |
-| [**cargo-hack**](https://github.com/taiki-e/cargo-hack) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/taiki-e/cargo-hack/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/taiki-e/cargo-hack/blob/HEAD/LICENSE-APACHE) OR [MIT](https://github.com/taiki-e/cargo-hack/blob/HEAD/LICENSE-MIT) |
-| [**cargo-llvm-cov**](https://github.com/taiki-e/cargo-llvm-cov) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/taiki-e/cargo-llvm-cov/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/taiki-e/cargo-llvm-cov/blob/HEAD/LICENSE-APACHE) OR [MIT](https://github.com/taiki-e/cargo-llvm-cov/blob/HEAD/LICENSE-MIT) |
-| [**cargo-machete**](https://github.com/bnjbvr/cargo-machete) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/bnjbvr/cargo-machete/releases) | Linux, macOS, Windows | [MIT](https://github.com/bnjbvr/cargo-machete/blob/HEAD/LICENSE.md) |
-| [**cargo-make**](https://github.com/sagiegurari/cargo-make) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/sagiegurari/cargo-make/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/sagiegurari/cargo-make/blob/HEAD/LICENSE) |
-| [**cargo-minimal-versions**](https://github.com/taiki-e/cargo-minimal-versions) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/taiki-e/cargo-minimal-versions/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/taiki-e/cargo-minimal-versions/blob/HEAD/LICENSE-APACHE) OR [MIT](https://github.com/taiki-e/cargo-minimal-versions/blob/HEAD/LICENSE-MIT) |
-| [**cargo-no-dev-deps**](https://github.com/taiki-e/cargo-no-dev-deps) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/taiki-e/cargo-no-dev-deps/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/taiki-e/cargo-no-dev-deps/blob/HEAD/LICENSE-APACHE) OR [MIT](https://github.com/taiki-e/cargo-no-dev-deps/blob/HEAD/LICENSE-MIT) |
-| [**cargo-rdme**](https://github.com/orium/cargo-rdme) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/orium/cargo-rdme/releases) | Linux, macOS, Windows | [MPL-2.0](https://github.com/orium/cargo-rdme/blob/HEAD/LICENSE.md) |
-| [**cargo-sort**](https://github.com/DevinR528/cargo-sort) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/DevinR528/cargo-sort/releases) | Linux, macOS, Windows | [Apache-2.0 OR MIT](https://github.com/DevinR528/cargo-sort/blob/55ec89082466f6bb246d870a8d56d166a8e1f08b/Cargo.toml#L5) |
-| [**cargo-spellcheck**](https://github.com/drahnr/cargo-spellcheck) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/drahnr/cargo-spellcheck/releases) | Linux and Windows | [LGPLv2.1](https://github.com/drahnr/cargo-spellcheck/blob/f60c81ad0134c12faf08715f08d14f66e749f6e7/docs/checkers.md#nlprules) |
-| [**cargo-tarpaulin**](https://github.com/xd009642/tarpaulin) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/xd009642/tarpaulin/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/xd009642/tarpaulin/blob/HEAD/LICENSE-APACHE) OR [MIT](https://github.com/xd009642/tarpaulin/blob/HEAD/LICENSE-MIT) |
-| [**cargo-udeps**](https://github.com/est31/cargo-udeps) | `$CARGO_HOME/bin` | [GitHub Release](https://github.com/est31/cargo-udeps/releases) | Linux, macOS, Windows | [Apache-2.0 OR MIT](https://github.com/est31/cargo-udeps/blob/HEAD/LICENSE) |
-| [**cargo-valgrind**](https://github.com/jfrimmel/cargo-valgrind) | `$CARGO_HOME/bin` | [GitHub Release](https://github.com/jfrimmel/cargo-valgrind/releases) | Linux, macOS, Windows | [MIT](https://github.com/jfrimmel/cargo-valgrind/blob/HEAD/LICENSE-MIT) or [Apache-2.0](https://github.com/jfrimmel/cargo-valgrind/blob/HEAD/LICENSE-APACHE) |
-| [**cross**](https://github.com/cross-rs/cross) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/cross-rs/cross/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/cross-rs/cross/blob/HEAD/LICENSE-APACHE) OR [MIT](https://github.com/cross-rs/cross/blob/HEAD/LICENSE-MIT) |
-| [**dprint**](https://github.com/dprint/dprint) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/dprint/dprint/releases) | Linux, macOS, Windows | [MIT](https://github.com/dprint/dprint/blob/HEAD/LICENSE) |
-| [**espup**](https://github.com/esp-rs/espup) | `$CARGO_HOME/bin` | [GitHub Release](https://github.com/esp-rs/espup/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/esp-rs/espup/blob/HEAD/LICENSE-APACHE) OR [MIT](https://github.com/esp-rs/espup/blob/HEAD/LICENSE-MIT) |
-| [**git-cliff**](https://github.com/orhun/git-cliff) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/orhun/git-cliff/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/orhun/git-cliff/blob/HEAD/LICENSE-APACHE) OR [MIT](https://github.com/orhun/git-cliff/blob/HEAD/LICENSE-MIT) |
-| [**grcov**](https://github.com/mozilla/grcov) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/mozilla/grcov/releases) | Linux, macOS, Windows | [MPL-2.0](https://github.com/mozilla/grcov/blob/HEAD/LICENSE-MPL-2.0) |
-| [**hyperfine**](https://github.com/sharkdp/hyperfine) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/sharkdp/hyperfine/releases) | Linux, macOS, Windows | [MIT](https://github.com/sharkdp/hyperfine/blob/HEAD/LICENSE-MIT) or [Apache-2.0](https://github.com/sharkdp/hyperfine/blob/HEAD/LICENSE-APACHE) |
-| [**just**](https://github.com/casey/just) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/casey/just/releases) | Linux, macOS, Windows | [CC0-1.0](https://github.com/casey/just/blob/HEAD/LICENSE) |
-| [**mdbook-linkcheck**](https://github.com/Michael-F-Bryan/mdbook-linkcheck) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/Michael-F-Bryan/mdbook-linkcheck/releases) | Linux, macOS, Windows | [MIT](https://github.com/Michael-F-Bryan/mdbook-linkcheck/blob/HEAD/LICENSE) |
-| [**mdbook**](https://github.com/rust-lang/mdBook) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/rust-lang/mdBook/releases) | Linux, macOS, Windows | [MPL-2.0](https://github.com/rust-lang/mdBook/blob/HEAD/LICENSE) |
-| [**nextest**](https://github.com/nextest-rs/nextest) (alias: `cargo-nextest`) | `$CARGO_HOME/bin` | cargo-binstall | Linux, macOS, Windows | [Apache-2.0](https://github.com/nextest-rs/nextest/blob/HEAD/LICENSE-APACHE) OR [MIT](https://github.com/nextest-rs/nextest/blob/HEAD/LICENSE-MIT) |
-| [**osv-scanner**]( https://github.com/google/osv-scanner) | `/usr/local/bin` | [GitHub Releases]( https://github.com/google/osv-scanner/releases) | Linux, macOS, Windows | [Apache-2](https://github.com/google/osv-scanner/blob/HEAD/LICENSE) |
-| [**parse-changelog**](https://github.com/taiki-e/parse-changelog) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/taiki-e/parse-changelog/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/taiki-e/parse-changelog/blob/HEAD/LICENSE-APACHE) OR [MIT](https://github.com/taiki-e/parse-changelog/blob/HEAD/LICENSE-MIT) |
-| [**protoc**](https://github.com/protocolbuffers/protobuf) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/protocolbuffers/protobuf/releases) | Linux, macOS, Windows | [BSD-3-Clause](https://github.com/protocolbuffers/protobuf/blob/HEAD/LICENSE) |
-| [**sccache**](https://github.com/mozilla/sccache) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/mozilla/sccache/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/mozilla/sccache/blob/HEAD/LICENSE) |
-| [**shellcheck**](https://www.shellcheck.net) | `/usr/local/bin` | [GitHub Releases](https://github.com/koalaman/shellcheck/releases) | Linux, macOS, Windows | [GPL-3.0-or-later](https://github.com/koalaman/shellcheck/blob/HEAD/LICENSE) |
-| [**shfmt**](https://github.com/mvdan/sh) | `/usr/local/bin` | [GitHub Releases](https://github.com/mvdan/sh/releases) | Linux, macOS, Windows | [BSD-3-Clause](https://github.com/mvdan/sh/blob/HEAD/LICENSE) |
-| [**syft**](https://github.com/anchore/syft) | `/usr/local/bin` | [Github Releases](https://github.com/anchore/syft/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/anchore/syft/blob/HEAD/LICENSE) |
-| [**typos**](https://github.com/crate-ci/typos) | `$CARGO_HOME/bin` | [Github Releases](https://github.com/crate-ci/typos/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/crate-ci/typos/blob/HEAD/LICENSE-APACHE) OR [MIT](https://github.com/crate-ci/typos/blob/HEAD/LICENSE-MIT) |
-| [**valgrind**](https://valgrind.org) | `/snap/bin` | [snap](https://snapcraft.io/install/valgrind/ubuntu) | Linux | [GPL-2.0-or-later](https://valgrind.org/docs/manual/license.gpl.html) |
-| [**wasm-bindgen**](https://github.com/rustwasm/wasm-bindgen) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/rustwasm/wasm-bindgen/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/rustwasm/wasm-bindgen/blob/HEAD/LICENSE-APACHE) OR [MIT](https://github.com/rustwasm/wasm-bindgen/blob/HEAD/LICENSE-MIT) |
-| [**wasm-pack**](https://github.com/rustwasm/wasm-pack) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/rustwasm/wasm-pack/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/rustwasm/wasm-pack/blob/HEAD/LICENSE-APACHE) OR [MIT](https://github.com/rustwasm/wasm-pack/blob/HEAD/LICENSE-MIT) |
-| [**wasmtime**](https://github.com/bytecodealliance/wasmtime) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/bytecodealliance/wasmtime/releases) | Linux, macOS, Windows | [Apache-2.0 WITH LLVM-exception](https://github.com/bytecodealliance/wasmtime/blob/HEAD/LICENSE) |
-| [**xbuild**](https://github.com/rust-mobile/xbuild) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/rust-mobile/xbuild/releases) | Linux, macOS, Windows | Apache-2.0 OR MIT |
-| [**zola**](https://github.com/getzola/zola) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/getzola/zola/releases) | Linux, macOS, Windows | [MIT](https://github.com/getzola/zola/blob/HEAD/LICENSE) |
 
-If `$CARGO_HOME/bin` is not available, Rust-related binaries will be installed to `$HOME/.cargo/bin`.<br>
+If you want to ensure that fallback is not used, use `fallback: none`.
-If `$HOME/.cargo/bin` is not available, Rust-related binaries will be installed to `/usr/local/bin`.<br>
-If `/usr/local/bin` is not available, binaries will be installed to `$HOME/.install-action/bin`.<br>
 
-**If a tool not included in the list above is specified, this action uses [cargo-binstall] as a fallback.**
+```yaml
+- uses: taiki-e/install-action@v2
+  with:
+    tool: cargo-hack
+    # Possible values:
+    # - none: disable all fallback options
+    # - cargo-binstall (default): use cargo-binstall (includes "quickinstall" and "install from source")
+    # - cargo-install: use `cargo install`
+    fallback: none
+```
+
+On platforms where cargo-binstall does not provide prebuilt binaries, cargo-install fallback is used instead of cargo-binstall fallback.
 
 ### Add support for new tool
 
@@ -138,21 +100,51 @@ See the [development guide](DEVELOPMENT.md) for how to add support for new tool.
 
 ## Security
 
-When installing the tool from GitHub Releases, this action will download the tool or its installer from GitHub Releases using HTTPS with tlsv1.2+. This is basically considered to be the same level of security as [the recommended installation of rustup](https://www.rust-lang.org/tools/install).
+The `@v<major>` and `@<tool_name>` tags are updated with each release. If you want to enhance workflow stability and security against supply chain attacks, consider using the `@v<major>.<minor>.<patch>` tag or their hash to pin the version and regularly updating with [dependency cooldown]. Since all releases are immutable, pinning the version in either way should have the same effect. Pinning `@<tool_name>` tags by hash is strongly discouraged, as it causes the workflow to reference a [commit that is not present on the repository](https://docs.zizmor.sh/audits/#impostor-commit) when a new version is released.
 
-Additionally, this action will also verify SHA256 checksums for downloaded files in all tools installed from GitHub Releases. This is enabled by default and can be disabled by setting the `checksum` input option to `false`.
+The default fallback (cargo-binstall) is often affected by GitHub's API rate limits, so we [pass the `${{ github.token }}` to cargo-binstall](https://github.com/taiki-e/install-action/issues/561). Disabling the cargo-binstall fallback prevent passing token so helps enhance security.
 
-Additionally, we also verify signature if the tool distributes signed archives. Signature verification is done at the stage of getting the checksum, so disabling the checksum will also disable signature verification.
+See the [Supported tools section](#supported-tools) for how to ensure that fallback is not used.
+
+<!-- omit in toc -->
+### Security on installation from GitHub Releases
+
+**Tools covered in this section:** Tools in the [supported tools list](TOOLS.md) where column "Where will it be installed from" is "GitHub Releases".
+
+This action will download the tool or its installer from GitHub Releases using HTTPS with tlsv1.2+. This is basically considered to be the same level of security as [the recommended installation of rustup](https://www.rust-lang.org/tools/install).
+
+Additionally, this action will also verify SHA256 checksums for downloaded files for all tools covered in this section. This is enabled by default and can be disabled by setting the `checksum` input option to `false` (strongly discouraged to disable).
+
+Additionally, we also verify [artifact attestations](https://docs.github.com/en/actions/concepts/security/artifact-attestations) or signature if the tool publishes artifact attestations or distributes signed archives. Verification is done at the stage of getting the checksum, so disabling the checksum will also disable verification.
+
+When installing with `taiki-e/install-action@<tool_name>`, `tool: <tool_name>`, or `tool: <tool_name>@<omitted_version>`, The tool version is reflects upstream releases with a delay of one to a few days (as with other common package managers that verify checksums or signatures). A delay of at least one day is known as [dependency cooldown] and is intended to mitigate the risk of supply chain attacks (the specific cooldown period may be changed in the future). You can bypass the cooldown by explicitly specifying a version. If you want a longer cooldown, consider using the property described below.
+
+When installing with `tool: <tool_name>` or `tool: <tool_name>@<omitted_version>`, the tool version is associated with the install-action version, so pinning install-action version with the `@v<major>.<minor>.<patch>` tag or their hash also pins the version of the tool being installed. This also means that if a [dependency cooldown] applies to the action itself, a cooldown of one to a few days longer will apply to the tools installed by that action.
+
+[dependency cooldown]: https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns
+
+<!-- omit in toc -->
+### Security on other installation methods
 
 See the linked documentation for information on security when installed using [snap](https://snapcraft.io/docs) or [cargo-binstall](https://github.com/cargo-bins/cargo-binstall#faq).
 
+See the [Supported tools section](#supported-tools) for how to ensure that fallback is not used.
+
 ## Compatibility
 
 This action has been tested for GitHub-hosted runners (Ubuntu, macOS, Windows) and containers (Ubuntu, Debian, Fedora, CentOS, Alma, openSUSE, Arch, Alpine).
-To use this action in self-hosted runners or in containers, at least the following tools are required:
 
-- bash
+On Linux, if any required tools are missing, this action will attempt to install them from distro's package manager, so no pre-setup is usually required (except for CentOS or Debian 10 (or older) or very old distro described below, which was already EoL and needs to use vault/archive repos -- see "Install requirements" in [our CI config](https://github.com/taiki-e/install-action/blob/HEAD/.github/workflows/ci.yml) for example of setup).
-- cargo (if you use cargo-binstall fallback)
+
+On other platforms, at least the following tools are required:
+
+- bash 3.2+
+- jq 1.3+ (only on non-Windows platforms)
+- curl 7.34+ (or RHEL7/CentOS7's patched curl 7.29)
+
+Known environments affected by the above version requirements are CentOS 6 (EoL on 2020-11) using curl 7.19, and Ubuntu 12.04 (EoL on 2017-04) using curl 7.22 (see "Install requirements" in [our CI config](https://github.com/taiki-e/install-action/blob/HEAD/.github/workflows/ci.yml) for example of workaround).
+
+Note that what this action installs for its setup (such as above tools) is considered an implementation detail if they are installed by this action's side, and there is no guarantee that they will be available in subsequent steps, because this action is not an action for installing those tools.
 
 ## Related Projects
 
@@ -160,9 +152,11 @@ To use this action in self-hosted runners or in containers, at least the followi
 - [create-gh-release-action]: GitHub Action for creating GitHub Releases based on changelog.
 - [upload-rust-binary-action]: GitHub Action for building and uploading Rust binary to GitHub Releases.
 - [setup-cross-toolchain-action]: GitHub Action for setup toolchains for cross compilation and cross testing for Rust.
+- [checkout-action]: GitHub Action for checking out a repository. (Simplified actions/checkout alternative that does not depend on Node.js.)
 
 [cache-cargo-install-action]: https://github.com/taiki-e/cache-cargo-install-action
 [cargo-binstall]: https://github.com/cargo-bins/cargo-binstall
+[checkout-action]: https://github.com/taiki-e/checkout-action
 [create-gh-release-action]: https://github.com/taiki-e/create-gh-release-action
 [setup-cross-toolchain-action]: https://github.com/taiki-e/setup-cross-toolchain-action
 [upload-rust-binary-action]: https://github.com/taiki-e/upload-rust-binary-action

TOOLS.md

@@ -0,0 +1,105 @@
+# Tools
+
+This is a list of tools that are installed from manifests managed in this action.
+
+If a tool not included in the list below is specified, this action uses [cargo-binstall] as a fallback.
+
+See the [Supported tools section in README.md](README.md#supported-tools) for how to ensure that fallback is not used.
+
+> If `$CARGO_HOME/bin` is not available, Rust-related binaries will be installed to `$HOME/.cargo/bin`.<br>
+> If `$HOME/.cargo/bin` is not available, Rust-related binaries will be installed to `$HOME/.install-action/bin`.<br>
+
+> [!WARNING]
+> Please note that the fact that a specific tool is listed here does **NOT** mean that the maintainer trusts the tool for safety or has reviewed its code.
+
+| Name | Where binaries will be installed | Where will it be installed from | Supported platform | License |
+| ---- | -------------------------------- | ------------------------------- | ------------------ | ------- |
+| [**auto-doc**](https://github.com/tj-actions/auto-doc) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/tj-actions/auto-doc/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/tj-actions/auto-doc/blob/main/LICENSE) |
+| [**biome**](https://biomejs.dev) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/biomejs/biome/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/biomejs/biome/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/biomejs/biome/blob/main/LICENSE-MIT) |
+| [**cargo-audit**](https://github.com/rustsec/rustsec/tree/HEAD/cargo-audit) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/rustsec/rustsec/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/rustsec/rustsec/blob/HEAD/cargo-audit/LICENSE-APACHE) OR [MIT](https://github.com/rustsec/rustsec/blob/HEAD/cargo-audit/LICENSE-MIT) |
+| [**cargo-auditable**](https://github.com/rust-secure-code/cargo-auditable) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/rust-secure-code/cargo-auditable/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/rust-secure-code/cargo-auditable/blob/HEAD/LICENSE-APACHE) OR [MIT](https://github.com/rust-secure-code/cargo-auditable/blob/HEAD/LICENSE-MIT) |
+| [**cargo-binstall**](https://github.com/cargo-bins/cargo-binstall) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/cargo-bins/cargo-binstall/releases) | Linux, macOS, Windows | [GPL-3.0](https://github.com/cargo-bins/cargo-binstall/blob/HEAD/crates/bin/LICENSE) |
+| [**cargo-careful**](https://github.com/RalfJung/cargo-careful) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/RalfJung/cargo-careful/releases) | Linux, macOS, Windows | [MIT](https://github.com/RalfJung/cargo-careful/blob/master/LICENSE-MIT) OR [Apache-2.0](https://github.com/RalfJung/cargo-careful/blob/master/LICENSE-APACHE) |
+| [**cargo-cyclonedx**](https://github.com/CycloneDX/cyclonedx-rust-cargo) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/CycloneDX/cyclonedx-rust-cargo/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/CycloneDX/cyclonedx-rust-cargo/blob/main/LICENSE) |
+| [**cargo-deadlinks**](https://github.com/deadlinks/cargo-deadlinks) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/deadlinks/cargo-deadlinks/releases) | Linux, macOS, Windows | [MIT](https://github.com/deadlinks/cargo-deadlinks/blob/master/LICENSE-MIT) OR [Apache-2.0](https://github.com/deadlinks/cargo-deadlinks/blob/master/LICENSE-APACHE) |
+| [**cargo-deb**](https://github.com/kornelski/cargo-deb) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/kornelski/cargo-deb/releases) | Linux | [MIT](https://github.com/kornelski/cargo-deb/blob/main/LICENSE) |
+| [**cargo-deny**](https://github.com/EmbarkStudios/cargo-deny) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/EmbarkStudios/cargo-deny/releases) | Linux, macOS, Windows | [MIT](https://github.com/EmbarkStudios/cargo-deny/blob/main/LICENSE-MIT) OR [Apache-2.0](https://github.com/EmbarkStudios/cargo-deny/blob/main/LICENSE-APACHE) |
+| [**cargo-dinghy**](https://github.com/sonos/dinghy) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/sonos/dinghy/releases) | Linux, macOS | [MIT](https://github.com/sonos/dinghy/blob/main/LICENSE-MIT) OR [Apache-2.0](https://github.com/sonos/dinghy/blob/main/LICENSE-APACHE) |
+| [**cargo-export**](https://github.com/bazhenov/cargo-export) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/bazhenov/cargo-export/releases) | Linux, macOS, Windows | [MIT](https://github.com/bazhenov/cargo-export/blob/master/LICENSE) |
+| [**cargo-hack**](https://github.com/taiki-e/cargo-hack) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/taiki-e/cargo-hack/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/taiki-e/cargo-hack/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/taiki-e/cargo-hack/blob/main/LICENSE-MIT) |
+| [**cargo-insta**](https://insta.rs/) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/mitsuhiko/insta/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/mitsuhiko/insta/blob/master/LICENSE) |
+| [**cargo-lambda**](https://github.com/cargo-lambda/cargo-lambda) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/cargo-lambda/cargo-lambda/releases) | Linux, macOS, Windows | [MIT](https://github.com/cargo-lambda/cargo-lambda/blob/main/LICENSE) |
+| [**cargo-llvm-cov**](https://github.com/taiki-e/cargo-llvm-cov) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/taiki-e/cargo-llvm-cov/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/taiki-e/cargo-llvm-cov/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/taiki-e/cargo-llvm-cov/blob/main/LICENSE-MIT) |
+| [**cargo-machete**](https://github.com/bnjbvr/cargo-machete) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/bnjbvr/cargo-machete/releases) | Linux, macOS, Windows | [MIT](https://github.com/bnjbvr/cargo-machete/blob/main/LICENSE.md) |
+| [**cargo-make**](https://github.com/sagiegurari/cargo-make) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/sagiegurari/cargo-make/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/sagiegurari/cargo-make/blob/master/LICENSE) |
+| [**cargo-minimal-versions**](https://github.com/taiki-e/cargo-minimal-versions) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/taiki-e/cargo-minimal-versions/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/taiki-e/cargo-minimal-versions/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/taiki-e/cargo-minimal-versions/blob/main/LICENSE-MIT) |
+| [**cargo-neat**](https://github.com/killzoner/cargo-neat) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/killzoner/cargo-neat/releases) | Linux, macOS, Windows | [MIT](https://github.com/killzoner/cargo-neat/blob/master/LICENSE-MIT) OR [Apache-2.0](https://github.com/killzoner/cargo-neat/blob/master/LICENSE-APACHE) |
+| [**cargo-nextest**](https://github.com/nextest-rs/nextest) (alias: `nextest`) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/nextest-rs/nextest/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/nextest-rs/nextest/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/nextest-rs/nextest/blob/main/LICENSE-MIT) |
+| [**cargo-no-dev-deps**](https://github.com/taiki-e/cargo-no-dev-deps) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/taiki-e/cargo-no-dev-deps/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/taiki-e/cargo-no-dev-deps/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/taiki-e/cargo-no-dev-deps/blob/main/LICENSE-MIT) |
+| [**cargo-rdme**](https://github.com/orium/cargo-rdme) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/orium/cargo-rdme/releases) | Linux, macOS, Windows | [MPL-2.0](https://github.com/orium/cargo-rdme/blob/main/LICENSE.md) |
+| [**cargo-semver-checks**](https://github.com/obi1kenobi/cargo-semver-checks) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/obi1kenobi/cargo-semver-checks/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/obi1kenobi/cargo-semver-checks/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/obi1kenobi/cargo-semver-checks/blob/main/LICENSE-MIT) |
+| [**cargo-shear**](https://github.com/Boshen/cargo-shear) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/Boshen/cargo-shear/releases) | Linux, macOS, Windows | [MIT](https://github.com/Boshen/cargo-shear/blob/main/LICENSE) |
+| [**cargo-sort**](https://github.com/DevinR528/cargo-sort) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/DevinR528/cargo-sort/releases) | Linux, macOS, Windows | [Apache-2.0 OR MIT](https://github.com/DevinR528/cargo-sort/blob/v1.0.9/Cargo.toml#L5) |
+| [**cargo-spellcheck**](https://github.com/drahnr/cargo-spellcheck) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/drahnr/cargo-spellcheck/releases) | Linux, Windows | [LGPLv2.1](https://github.com/drahnr/cargo-spellcheck/blob/master/LICENSE-LGPL) |
+| [**cargo-tarpaulin**](https://github.com/xd009642/tarpaulin) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/xd009642/tarpaulin/releases) | Linux, macOS, Windows | [MIT](https://github.com/xd009642/tarpaulin/blob/develop/LICENSE-MIT) OR [Apache-2.0](https://github.com/xd009642/tarpaulin/blob/develop/LICENSE-APACHE) |
+| [**cargo-udeps**](https://github.com/est31/cargo-udeps) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/est31/cargo-udeps/releases) | Linux, macOS, Windows | [Apache-2.0 OR MIT](https://github.com/est31/cargo-udeps/blob/HEAD/LICENSE) |
+| [**cargo-valgrind**](https://github.com/jfrimmel/cargo-valgrind) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/jfrimmel/cargo-valgrind/releases) | Linux, macOS, Windows | [MIT](https://github.com/jfrimmel/cargo-valgrind/blob/master/LICENSE-MIT) OR [Apache-2.0](https://github.com/jfrimmel/cargo-valgrind/blob/master/LICENSE-APACHE) |
+| [**cargo-xwin**](https://github.com/rust-cross/cargo-xwin) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/rust-cross/cargo-xwin/releases) | Linux, macOS, Windows | [MIT](https://github.com/rust-cross/cargo-xwin/blob/main/LICENSE) |
+| [**cargo-zigbuild**](https://github.com/rust-cross/cargo-zigbuild) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/rust-cross/cargo-zigbuild/releases) | Linux, macOS, Windows | [MIT](https://github.com/rust-cross/cargo-zigbuild/blob/main/LICENSE) |
+| [**coreutils**](https://github.com/uutils/coreutils) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/uutils/coreutils/releases) | Linux, macOS, Windows | [MIT](https://github.com/uutils/coreutils/blob/main/LICENSE) |
+| [**cosign**](https://github.com/sigstore/cosign) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/sigstore/cosign/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/sigstore/cosign/blob/main/LICENSE) |
+| [**covgate**](https://github.com/jesse-black/covgate) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/jesse-black/covgate/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/jesse-black/covgate/blob/main/LICENSE) |
+| [**cross**](https://github.com/cross-rs/cross) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/cross-rs/cross/releases) | Linux, macOS, Windows | [MIT](https://github.com/cross-rs/cross/blob/main/LICENSE-MIT) OR [Apache-2.0](https://github.com/cross-rs/cross/blob/main/LICENSE-APACHE) |
+| [**cyclonedx**](https://github.com/CycloneDX/cyclonedx-cli) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/CycloneDX/cyclonedx-cli/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/CycloneDX/cyclonedx-cli/blob/main/LICENSE) |
+| [**deepsource**](https://github.com/DeepSourceCorp/cli) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/DeepSourceCorp/cli/releases) | Linux, macOS, Windows | [BSD-2-Clause](https://github.com/DeepSourceCorp/cli/blob/master/LICENSE) |
+| [**dprint**](https://github.com/dprint/dprint) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/dprint/dprint/releases) | Linux, macOS, Windows | [MIT](https://github.com/dprint/dprint/blob/main/LICENSE) |
+| [**earthly**](https://github.com/earthly/earthly) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/earthly/earthly/releases) | Linux, macOS, Windows | [MPL-2.0](https://github.com/earthly/earthly/blob/main/LICENSE) |
+| [**editorconfig-checker**](https://github.com/editorconfig-checker/editorconfig-checker) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/editorconfig-checker/editorconfig-checker/releases) | Linux, macOS, Windows | [MIT](https://github.com/editorconfig-checker/editorconfig-checker/blob/main/LICENSE) |
+| [**espup**](https://github.com/esp-rs/espup) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/esp-rs/espup/releases) | Linux, macOS, Windows | [MIT](https://github.com/esp-rs/espup/blob/main/LICENSE-MIT) OR [Apache-2.0](https://github.com/esp-rs/espup/blob/main/LICENSE-APACHE) |
+| [**git-cliff**](https://github.com/orhun/git-cliff) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/orhun/git-cliff/releases) | Linux, macOS, Windows | [MIT](https://github.com/orhun/git-cliff/blob/main/LICENSE-MIT) OR [Apache-2.0](https://github.com/orhun/git-cliff/blob/main/LICENSE-APACHE) |
+| [**grcov**](https://github.com/mozilla/grcov) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/mozilla/grcov/releases) | Linux, macOS, Windows | [MPL-2.0](https://github.com/mozilla/grcov/blob/HEAD/LICENSE-MPL-2.0) |
+| [**gungraun-runner**](https://gungraun.github.io/gungraun/) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/gungraun/gungraun/releases) | Linux | [Apache-2.0](https://github.com/gungraun/gungraun/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/gungraun/gungraun/blob/main/LICENSE-MIT) |
+| [**hyperfine**](https://github.com/sharkdp/hyperfine) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/sharkdp/hyperfine/releases) | Linux, macOS, Windows | [MIT](https://github.com/sharkdp/hyperfine/blob/master/LICENSE-MIT) OR [Apache-2.0](https://github.com/sharkdp/hyperfine/blob/master/LICENSE-APACHE) |
+| [**iai-callgrind-runner**](https://gungraun.github.io/gungraun/) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/iai-callgrind/iai-callgrind/releases) | Linux | [Apache-2.0](https://github.com/iai-callgrind/iai-callgrind/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/iai-callgrind/iai-callgrind/blob/main/LICENSE-MIT) |
+| [**jaq**](https://github.com/01mf02/jaq) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/01mf02/jaq/releases) | Linux, macOS, Windows | [MIT](https://github.com/01mf02/jaq/blob/main/LICENSE-MIT) |
+| [**just**](https://github.com/casey/just) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/casey/just/releases) | Linux, macOS, Windows | [CC0-1.0](https://github.com/casey/just/blob/master/LICENSE) |
+| [**knope**](https://github.com/knope-dev/knope) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/knope-dev/knope/releases) | Linux, macOS, Windows | [MIT](https://github.com/knope-dev/knope/blob/main/LICENSE) |
+| [**martin**](https://maplibre.org/martin/) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/maplibre/martin/releases) | Linux, macOS | [MIT](https://github.com/maplibre/martin/blob/main/LICENSE-MIT) OR [Apache-2.0](https://github.com/maplibre/martin/blob/main/LICENSE-APACHE) |
+| [**mdbook**](https://github.com/rust-lang/mdBook) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/rust-lang/mdBook/releases) | Linux, macOS, Windows | [MPL-2.0](https://github.com/rust-lang/mdBook/blob/master/LICENSE) |
+| [**mdbook-alerts**](https://github.com/lambdalisue/rs-mdbook-alerts) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/lambdalisue/rs-mdbook-alerts/releases) | Linux, macOS, Windows | [MIT](https://github.com/lambdalisue/rs-mdbook-alerts/blob/main/LICENSE) |
+| [**mdbook-linkcheck**](https://github.com/Michael-F-Bryan/mdbook-linkcheck) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/Michael-F-Bryan/mdbook-linkcheck/releases) | Linux, macOS, Windows | [MIT](https://github.com/Michael-F-Bryan/mdbook-linkcheck/blob/master/LICENSE) |
+| [**mdbook-mermaid**](https://github.com/badboy/mdbook-mermaid) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/badboy/mdbook-mermaid/releases) | Linux, macOS, Windows | [MPL-2.0](https://github.com/badboy/mdbook-mermaid/blob/main/LICENSE) |
+| [**mdbook-mermaid-ssr**](https://github.com/CommanderStorm/mdbook-mermaid-ssr) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/CommanderStorm/mdbook-mermaid-ssr/releases) | Linux, macOS, Windows | [MPL-2.0](https://github.com/CommanderStorm/mdbook-mermaid-ssr/blob/main/LICENSE) |
+| [**mise**](https://github.com/jdx/mise) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/jdx/mise/releases) | Linux, macOS, Windows | [MIT](https://github.com/jdx/mise/blob/main/LICENSE) |
+| [**osv-scanner**](https://github.com/google/osv-scanner) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/google/osv-scanner/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/google/osv-scanner/blob/main/LICENSE) |
+| [**parse-changelog**](https://github.com/taiki-e/parse-changelog) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/taiki-e/parse-changelog/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/taiki-e/parse-changelog/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/taiki-e/parse-changelog/blob/main/LICENSE-MIT) |
+| [**parse-dockerfile**](https://github.com/taiki-e/parse-dockerfile) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/taiki-e/parse-dockerfile/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/taiki-e/parse-dockerfile/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/taiki-e/parse-dockerfile/blob/main/LICENSE-MIT) |
+| [**prek**](https://github.com/j178/prek) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/j178/prek/releases) | Linux, macOS, Windows | [MIT](https://github.com/j178/prek/blob/master/LICENSE) |
+| [**protoc**](https://github.com/protocolbuffers/protobuf) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/protocolbuffers/protobuf/releases) | Linux, macOS, Windows | [BSD-3-Clause](https://github.com/protocolbuffers/protobuf/blob/HEAD/LICENSE) |
+| [**rclone**](https://github.com/rclone/rclone) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/rclone/rclone/releases) | Linux, macOS, Windows | [MIT](https://github.com/rclone/rclone/blob/master/COPYING) |
+| [**release-plz**](https://release-plz.dev/) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/release-plz/release-plz/releases) | Linux, macOS, Windows | [MIT](https://github.com/release-plz/release-plz/blob/main/LICENSE-MIT) OR [Apache-2.0](https://github.com/release-plz/release-plz/blob/main/LICENSE-APACHE) |
+| [**sccache**](https://github.com/mozilla/sccache) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/mozilla/sccache/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/mozilla/sccache/blob/main/LICENSE) |
+| [**shellcheck**](https://www.shellcheck.net) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/koalaman/shellcheck/releases) | Linux, macOS, Windows | [GPL-3.0](https://github.com/koalaman/shellcheck/blob/master/LICENSE) |
+| [**shfmt**](https://github.com/mvdan/sh) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/mvdan/sh/releases) | Linux, macOS, Windows | [BSD-3-Clause](https://github.com/mvdan/sh/blob/master/LICENSE) |
+| [**syft**](https://github.com/anchore/syft) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/anchore/syft/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/anchore/syft/blob/main/LICENSE) |
+| [**taplo**](https://github.com/tamasfe/taplo) (alias: `taplo-cli`) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/tamasfe/taplo/releases) | Linux, macOS, Windows | [MIT](https://github.com/tamasfe/taplo/blob/master/LICENSE) |
+| [**tombi**](https://tombi-toml.github.io/tombi/) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/tombi-toml/tombi/releases) | Linux, macOS, Windows | [MIT](https://github.com/tombi-toml/tombi/blob/main/LICENSE) |
+| [**trivy**](https://github.com/aquasecurity/trivy) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/aquasecurity/trivy/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/aquasecurity/trivy/blob/main/LICENSE) |
+| [**trunk**](https://github.com/trunk-rs/trunk) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/trunk-rs/trunk/releases) | Linux, macOS, Windows | [MIT](https://github.com/trunk-rs/trunk/blob/main/LICENSE-MIT) OR [Apache-2.0](https://github.com/trunk-rs/trunk/blob/main/LICENSE-APACHE) |
+| [**typos**](https://github.com/crate-ci/typos) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/crate-ci/typos/releases) | Linux, macOS, Windows | [MIT](https://github.com/crate-ci/typos/blob/master/LICENSE-MIT) OR [Apache-2.0](https://github.com/crate-ci/typos/blob/master/LICENSE-APACHE) |
+| [**ubi**](https://github.com/houseabsolute/ubi) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/houseabsolute/ubi/releases) | Linux, macOS, Windows | [MIT](https://github.com/houseabsolute/ubi/blob/master/LICENSE-MIT) OR [Apache-2.0](https://github.com/houseabsolute/ubi/blob/master/LICENSE-APACHE) |
+| [**uv**](https://github.com/astral-sh/uv) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/astral-sh/uv/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/astral-sh/uv/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/astral-sh/uv/blob/main/LICENSE-MIT) |
+| [**vacuum**](https://github.com/daveshanley/vacuum) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/daveshanley/vacuum/releases) | Linux, macOS, Windows | [MIT](https://github.com/daveshanley/vacuum/blob/main/LICENSE) |
+| [**valgrind**](https://valgrind.org/) | `/snap/bin` | [snap](https://snapcraft.io/install/valgrind/ubuntu) | Linux | [GPL-2.0](https://sourceware.org/git/?p=valgrind.git;a=blob;f=COPYING;hb=HEAD) |
+| [**wait-for-them**](https://github.com/shenek/wait-for-them) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/shenek/wait-for-them/releases) | Linux, macOS, Windows | [GPL-3.0](https://github.com/shenek/wait-for-them/blob/v0.4.0/Cargo.toml#L7) |
+| [**wash**](https://github.com/wasmCloud/wasmCloud) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/wasmCloud/wasmCloud/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/wasmCloud/wasmCloud/blob/main/LICENSE) |
+| [**wasm-bindgen**](https://github.com/wasm-bindgen/wasm-bindgen) (alias: `wasm-bindgen-cli`) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/wasm-bindgen/wasm-bindgen/releases) | Linux, macOS, Windows | [MIT](https://github.com/wasm-bindgen/wasm-bindgen/blob/main/LICENSE-MIT) OR [Apache-2.0](https://github.com/wasm-bindgen/wasm-bindgen/blob/main/LICENSE-APACHE) |
+| [**wasm-pack**](https://github.com/drager/wasm-pack) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/drager/wasm-pack/releases) | Linux, macOS, Windows | [MIT](https://github.com/drager/wasm-pack/blob/master/LICENSE-MIT) OR [Apache-2.0](https://github.com/drager/wasm-pack/blob/master/LICENSE-APACHE) |
+| [**wasm-tools**](https://github.com/bytecodealliance/wasm-tools) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/bytecodealliance/wasm-tools/releases) | Linux, macOS, Windows | [Apache-2.0 WITH LLVM-exception](https://github.com/bytecodealliance/wasm-tools/blob/main/LICENSE-APACHE) OR [Apache-2.0](https://github.com/bytecodealliance/wasm-tools/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/bytecodealliance/wasm-tools/blob/main/LICENSE-MIT) |
+| [**wasmtime**](https://github.com/bytecodealliance/wasmtime) (alias: `wasmtime-cli`) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/bytecodealliance/wasmtime/releases) | Linux, macOS, Windows | [Apache-2.0 WITH LLVM-exception](https://github.com/bytecodealliance/wasmtime/blob/main/LICENSE) |
+| [**xbuild**](https://github.com/rust-mobile/xbuild) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/rust-mobile/xbuild/releases) | Linux, macOS, Windows | [Apache-2.0 OR MIT](https://github.com/rust-mobile/xbuild/blob/v0.2.0/xbuild/Cargo.toml#L7) |
+| [**xh**](https://github.com/ducaale/xh) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/ducaale/xh/releases) | Linux, macOS, Windows | [MIT](https://github.com/ducaale/xh/blob/master/LICENSE) |
+| [**zizmor**](https://github.com/zizmorcore/zizmor) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/zizmorcore/zizmor/releases) | Linux, macOS, Windows | [MIT](https://github.com/zizmorcore/zizmor/blob/main/LICENSE) |
+| [**zola**](https://github.com/getzola/zola) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/getzola/zola/releases) | Linux, macOS, Windows | [MIT](https://github.com/getzola/zola/blob/master/LICENSE) |
+
+[cargo-binstall]: https://github.com/cargo-bins/cargo-binstall

action.yml

@@ -3,13 +3,17 @@ description: GitHub Action for installing development tools
 
 inputs:
   tool:
-    description: Tools to install (comma-separated list)
+    description: Tools to install (whitespace or comma separated list)
-    required: true
+    required: false
-    # default: #publish:tool
+    default: cargo-minimal-versions
   checksum:
-    description: Whether to enable checksums
+    description: Whether to enable checksums (strongly discouraged to disable)
     required: false
     default: 'true'
+  fallback:
+    description: Whether to use fallback (none, cargo-binstall, cargo-install)
+    required: false
+    default: 'cargo-binstall'
 
 # Note:
 # - inputs.* should be manually mapped to INPUT_* due to https://github.com/actions/runner/issues/665
@@ -17,8 +21,74 @@ inputs:
 runs:
   using: composite
   steps:
-    - run: bash --noprofile --norc "${GITHUB_ACTION_PATH:?}/main.sh"
+    - run: |
-      shell: bash
+        if /usr/bin/env | grep -Eq '^BASH_FUNC_'; then
+          printf '::error::bash function injection via BASH_FUNC_ environment variable is not allowed for security reasons\n'
+          exit 1
+        fi
+        if ! command -v bash >/dev/null; then
+          if grep -Eq '^ID=alpine' /etc/os-release; then
+            printf '::group::Install packages required for install-action (bash)\n'
+            # NB: sync with apk_install in main.sh
+            if command -v sudo >/dev/null; then
+              sudo apk --no-cache add bash
+            elif command -v doas >/dev/null; then
+              doas apk --no-cache add bash
+            else
+              apk --no-cache add bash
+            fi
+            printf '::endgroup::\n'
+          else
+            printf '::error::install-action requires bash\n'
+            exit 1
+          fi
+        fi
+        bash --noprofile --norc "${GITHUB_ACTION_PATH:?}/main.sh"
+      shell: /usr/bin/env -u ENV -u BASH_ENV -u CDPATH -u SHELLOPTS -u BASHOPTS /bin/sh -eu {0} # zizmor: ignore[misfeature] false positive
       env:
+        # NB: Sync with Windows case.
         INPUT_TOOL: ${{ inputs.tool }}
         INPUT_CHECKSUM: ${{ inputs.checksum }}
+        INPUT_FALLBACK: ${{ inputs.fallback }}
+        DEFAULT_GITHUB_TOKEN: ${{ inputs.fallback == 'cargo-binstall' && github.token || '' }}
+        ACTION_USER_AGENT: ${{ github.action_repository }} (${{ github.action_ref }})
+      if: runner.os != 'Windows'
+    # Use pwsh and retry on bash startup failure to work around windows-11-arm runner bug:
+    # https://github.com/actions/partner-runner-images/issues/169
+    - run: |
+        Set-StrictMode -Version Latest
+        if (Test-Path "Env:ENV") { Remove-Item Env:\ENV }
+        if (Test-Path "Env:BASH_ENV") { Remove-Item Env:\BASH_ENV }
+        if (Test-Path "Env:CDPATH") { Remove-Item Env:\CDPATH }
+        if (Test-Path "Env:SHELLOPTS") { Remove-Item Env:\SHELLOPTS }
+        if (Test-Path "Env:BASHOPTS") { Remove-Item Env:\BASHOPTS }
+        if (Test-Path "Env:BASH_FUNC_*") {
+          Write-Output "::error::bash function injection via BASH_FUNC_ environment variable is not allowed for security reasons"
+          exit 1
+        }
+        for ($i=1; $i -le 10; $i++) {
+          $prev_err_action = $ErrorActionPreference
+          $ErrorActionPreference = "Continue"
+          & bash --noprofile --norc "$env:GITHUB_ACTION_PATH\main.sh"
+          $code = $LASTEXITCODE
+          $ErrorActionPreference = "$prev_err_action"
+          if (Test-Path "$env:USERPROFILE\.install-action\init") {
+            # If bash started successfully, main.sh creates init file.
+            Remove-Item "$env:USERPROFILE\.install-action\init" -Force
+            exit $code
+          }
+          if ($i -lt 10) {
+            Write-Output "::warning::installation failed due to bash startup failure (<https://github.com/actions/partner-runner-images/issues/169>); retrying..."
+          }
+        }
+        Write-Output "::error::installation failed due to bash startup failure (<https://github.com/actions/partner-runner-images/issues/169>); this maybe resolved by re-running job"
+        exit 1
+      shell: pwsh
+      env:
+        # NB: Sync with non-Windows case.
+        INPUT_TOOL: ${{ inputs.tool }}
+        INPUT_CHECKSUM: ${{ inputs.checksum }}
+        INPUT_FALLBACK: ${{ inputs.fallback }}
+        DEFAULT_GITHUB_TOKEN: ${{ inputs.fallback == 'cargo-binstall' && github.token || '' }}
+        ACTION_USER_AGENT: ${{ github.action_repository }} (${{ github.action_ref }})
+      if: runner.os == 'Windows'

manifests/auto-doc.json

@@ -0,0 +1,342 @@
+{
+  "rust_crate": null,
+  "template": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/tj-actions/auto-doc/releases/download/v${version}/auto-doc_${version}_Linux_x86_64.tar.gz",
+      "bin": "auto-doc"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/tj-actions/auto-doc/releases/download/v${version}/auto-doc_${version}_Darwin_x86_64.tar.gz",
+      "bin": "auto-doc"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/tj-actions/auto-doc/releases/download/v${version}/auto-doc_${version}_Windows_x86_64.zip",
+      "bin": "auto-doc.exe"
+    },
+    "aarch64_linux_musl": {
+      "url": "https://github.com/tj-actions/auto-doc/releases/download/v${version}/auto-doc_${version}_Linux_arm64.tar.gz",
+      "bin": "auto-doc"
+    },
+    "aarch64_macos": {
+      "url": "https://github.com/tj-actions/auto-doc/releases/download/v${version}/auto-doc_${version}_Darwin_arm64.tar.gz",
+      "bin": "auto-doc"
+    },
+    "aarch64_windows": {
+      "url": "https://github.com/tj-actions/auto-doc/releases/download/v${version}/auto-doc_${version}_Windows_arm64.zip",
+      "bin": "auto-doc.exe"
+    }
+  },
+  "latest": {
+    "version": "3.6.0"
+  },
+  "3": {
+    "version": "3.6.0"
+  },
+  "3.6": {
+    "version": "3.6.0"
+  },
+  "3.6.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DD6969CA0AF360",
+      "hash": "7d48b15f8ccc24a90c358632cc4095299667c7d8348b9a9a22759d8fa6ff63f6"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DD6969C9F5D586",
+      "hash": "b6d49dc9d38981df9abd96b38911fcb9f71ba9c7f2b745c3e005c6b1b1c42c4c"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DD6969C99DDF69",
+      "hash": "0c4afb8ef7fc1b3519d39dc8f1e586e67352dcebe6bf612f72f157f4ff77d6ac"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DD6969CA5DBF27",
+      "hash": "004b2427e626b785598d546cc227abd538211d30505000c503001b74393e65d4"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DD6969C9EA22DA",
+      "hash": "a65a28c1faaddb9d3d5237c73cf5111bef197754906d1c530c83dcac3443169f"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DD6969C9905A17",
+      "hash": "ed12610509bf36c42a1c34d0e0cece1f5120a5381b23751c4d1fa8a44b908d83"
+    }
+  },
+  "3.5": {
+    "version": "3.5.0"
+  },
+  "3.5.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DC65D142257ECD",
+      "hash": "0c49170d137ab1b1f6a0f7bce8ab6c8f1c7be5f5232c4c447e2d4681944c98e4"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DC65D1435E4C83",
+      "hash": "65e99107be982f4a084ac9b7fc9db495f1c307d0334c190164635cca4577224f"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DC65D14230481F",
+      "hash": "43798a7fbb25a125c2339ea60d3de5e68c54a9f21776ede80bc5a01a4357bf73"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DC65D1435BDE40",
+      "hash": "d7aa932e5da21e44b4980b53ae507d1f3d55fed686d7d2d3a18d47014dbd27ce"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DC65D1422BB95B",
+      "hash": "98a6fa12ddd70b76259c04db3b81e7c5b845fe9e24a75632521b376a80d802df"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DC65D14241C0AE",
+      "hash": "1a22dabee9ec7b865163b41cff4dd227490881382fd351d0719aff7d42c324a3"
+    }
+  },
+  "3.4": {
+    "version": "3.4.1"
+  },
+  "3.4.1": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DC0CE3CEC5DED0",
+      "hash": "6558c5cdeb79a4a3ed90f6f4f2409ec4cf8900278e686abfb0ffa3bdf2e2815b"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DC0CE3CEEC7544",
+      "hash": "6b7e86e555159c6058ab2e4df521370d7a7b41522eb5736245bb503d230d076b"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DC0CE3CE72298C",
+      "hash": "0dfc7ecbc2cd263d5329a1e618ba8fc06439f2f9f826269ba45cc70c2fcce078"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DC0CE3CEFBCD57",
+      "hash": "17140370329a7f59d86d49d1a82e4c089a40cfb79d2340034041226c97131966"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DC0CE3D7100B1F",
+      "hash": "6f61a5a5162ff3614fd444e8909b0f81b28bdb5b1d6f2fc247ceaaff827f4d81"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DC0CE3CF3E7EB6",
+      "hash": "43285d732f987bdbfb0264c6aff208f391969784d58da4871e8eab1e8a4aaf97"
+    }
+  },
+  "3.4.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DBE8B5B371D05E",
+      "hash": "9bdd3c0852814a3761b5bf06b078f3f85e9a982fc938fe174efd12280b669028"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DBE8B5B271AD7D",
+      "hash": "bf9ba0171c3e1490a08268b342d4c09c9350faf53674a736e42d9cd240f7f2ec"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DBE8B5B27296DE",
+      "hash": "b55bec9ccd7b65b0833610cc8e16e18fd7024a73d87c21a7490727da432bc449"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DBE8B5B254F704",
+      "hash": "434459a478c7d0483b684bd2ee6a2febb5f5ee93a0eca9d352162d866d4bb6fe"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DBE8B5B34F7AE7",
+      "hash": "e387010d53a490fd6f9dd52a1284967447d4c9521734367dc77a2c262198b59d"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DBE8B5B46494CD",
+      "hash": "34f7f0bc2ebcda0da150e90578b441b590f1f6795dc9adfdabfa005f3539aaa3"
+    }
+  },
+  "3.3": {
+    "version": "3.3.0"
+  },
+  "3.3.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DBE654B8C22BB8",
+      "hash": "aee132848c1ff48576c9d4b6afd9cb09d960e3506f0a9d749813702bd64b7beb"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DBE654CADCEE10",
+      "hash": "0eebc51f42f357ad30bdccb7de0b5a5ebad04e58818c89d25e4b4cc6ae2a01ad"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DBE654BBCF5736",
+      "hash": "b940ab87696f25de1de2d896e17cf78c40bb2415a0f169a49272c05649f8624f"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DBE654CA9A8A8B",
+      "hash": "97291d19167023840656860589ce6dc3888c6f27fe588688c2da08487d615acb"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DBE654B7D994FE",
+      "hash": "0e6f10f25895ae055351fb4c5afc1b11ca34ad26ce9a1b9c2d5897578c93aa8a"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DBE654BE084771",
+      "hash": "a199341f984375bb02ef3f7c89ec24d1bd7d35017c7185b1b96b3cc06403ab20"
+    }
+  },
+  "3.2": {
+    "version": "3.2.1"
+  },
+  "3.2.1": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DBE5F2F94C6800",
+      "hash": "fe44709bbd9886b8d9f441ad7f6bf3d105a8a24e3ea3dd603eb2d6c4957c7273"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DBE5F2E998C4FD",
+      "hash": "652c6c26327f43113edbdd1701411d8c44f238c931a1fdd334b2ad4ebae3ce69"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DBE5F2E9727C50",
+      "hash": "d55e685da3dc2c1b53352a111b6283a533aa063c45e6466dfd0e0698b26bebf5"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DBE5F2EA2351E3",
+      "hash": "fb82a8e9ff9ced50491056eb8fbbe66cc7b5f0721649c266d84c09b11821a500"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DBE5F2E9DA6605",
+      "hash": "0c83d263eeab4037c65d715af12e64f1563499afad7934616bdea40b5bd21574"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DBE5F2EA87E3F7",
+      "hash": "6e604776a1d72c5722062c808f06492e90f975d88b426fcd76d077be0c6a58c7"
+    }
+  },
+  "3.2.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DBE596A0D6471B",
+      "hash": "7c5cdb8e11b1bdb74761fbf2a19034ba69e0369d802d4bd5f0da4842c4d21818"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DBE596A15A729E",
+      "hash": "a1318e97da9d7b678479f2903979b00805e2f798cd67cef9e0940bad8d75de2e"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DBE596A0E771D2",
+      "hash": "af13aa77295865a15ede68b6fbce57d2e0bdced9cb6fc70496d9cc61f411b913"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DBE596A02B1084",
+      "hash": "ca460fe62381e622c2f58030715068589b383ec999d81adab3ac1c324d3e6b20"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DBE596A6C9454C",
+      "hash": "acc1cbae30971d07a4dcec7b42bfa645ddf2568639a481443c6a44e4bcdabd79"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DBE596A77B9FCE",
+      "hash": "cd713cb6471389cda1ac73c1def9966bc7b77fac56b6c024032f416924fb4d33"
+    }
+  },
+  "3.1": {
+    "version": "3.1.1"
+  },
+  "3.1.1": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DBE2FBB991EC80",
+      "hash": "70f956effa6bf14c17a1a6743d0be113f0e48109c62e2ec1c73bb07ef4f04d94"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DBE2FBB8E7788A",
+      "hash": "b82ee75f351e15584be180900d7cbaa0a889b14b8de170ab4591bc85ea84e8fd"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DBE2FBB7D3BCE8",
+      "hash": "7ed5ddc15603726cf02772e770d68a15bccd38acb0719afcd37ab5c7be96a245"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DBE2FBB853A75D",
+      "hash": "75af80cbe3dce49489add93bdb8b9c68c7a4339d16bb4c93d3c911ac24622538"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DBE2FBB7CE1DF9",
+      "hash": "ee777e74975811b926b1c6580cd28aa81749f1fac2cbbf325a16ce754fe02a8c"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DBE2FBB7F832D2",
+      "hash": "66f087a13557118ecb2f0f14e90015d3fe184cd052968655cfd986a236b3023e"
+    }
+  },
+  "3.1.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DBBC8C702FC588",
+      "hash": "f59d87a44332e196de7cbde48066e8dd08c1f78a311cacadaf87a7af8b218c69"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DBBC8C719ECF49",
+      "hash": "d792253adcac5cc73d07a377ac57aef0847d11cc6516e21ea2ee90b99c1632a3"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DBBC8C72A77440",
+      "hash": "24a5876e920135cb438ce9c754cd121f7ec0cf419d72861ca9ea1be2f61830b6"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DBBC8C71C90B1B",
+      "hash": "a4415633faf1a0dcca96e2c56b5b590dda585df91c72d90268102ef1c338182e"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DBBC8C70C0DADB",
+      "hash": "f0529aad4cca0c584d68d11f76c943476c08ea2f5656bff3fba13c3a304f7a31"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DBBC8C70A81788",
+      "hash": "15f05eb364103f9ab62d8bdafe0d18884718c37bd9c457dbed7f2dd89a7b8d86"
+    }
+  },
+  "3.0": {
+    "version": "3.0.1"
+  },
+  "3.0.1": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DBB54FC922B951",
+      "hash": "8d2aea8302d709643aa463deec09b8f980283b97ae5e1fce6d5f5daf10213a3b"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DBB54FCA342DDC",
+      "hash": "59dba1bcaa80a91b8e0efad5f3e824baa72055110719230cc7cd53349b7b3aaa"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DBB54FC9982862",
+      "hash": "cc1ebbd2c21b34f0249aef8e46dabcab1f01c51a341056add10c940ced1811d8"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DBB54FCB174C8A",
+      "hash": "f5dc146f7ad89b7946bbec72e9a25d6f260be21031ae1a71288fafec906ae70c"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DBB54FC8BD16F7",
+      "hash": "4714ad284a94cb911325cf45724b135e49b83e91484a3296d023f8fd33add16a"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DBB54FCA04530E",
+      "hash": "8642a01e7fb1343193d5578744d3bea15232a1b9d48a149e16e9572488565e54"
+    }
+  },
+  "3.0.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DBA448EB128B2D",
+      "hash": "0411abbcc4ccadfd991e6d5e1ff9b358034dc7f174f87b57597f6aa3fd9a64e4"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DBA448EA97085D",
+      "hash": "521b0483cce97928aaf64fb7636e9ea92f56140bd9e258643357bd123c00e0ca"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DBA448EC0990C9",
+      "hash": "dafb22369b616cb9d0fb28dece56a1c525c507060a74b46741681374f60cfc45"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DBA448EA93FE89",
+      "hash": "a71aed4198e41e3c1e38cc9c5c9c4b733c0181a113ac511a9b342f34ec4d3df8"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DBA448EB28B956",
+      "hash": "a6392e2ec6946ee56cb912b751d97ef89b79de2253d3cc1ff9608fdc8662343a"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DBA448EC76572C",
+      "hash": "e03f041feeea504104edb2b742761de044b55b965223044c1abb9ce2ed37bd6a"
+    }
+  }
+}

manifests/cargo-audit.json

@@ -16,26 +16,134 @@
     "aarch64_linux_gnu": {
       "url": "https://github.com/rustsec/rustsec/releases/download/cargo-audit/v${version}/cargo-audit-aarch64-unknown-linux-gnu-v${version}.tgz",
       "bin": "cargo-audit-aarch64-unknown-linux-gnu-v${version}/cargo-audit"
+    },
+    "aarch64_macos": {
+      "url": "https://github.com/rustsec/rustsec/releases/download/cargo-audit/v${version}/cargo-audit-aarch64-apple-darwin-v${version}.tgz",
+      "bin": "cargo-audit-aarch64-apple-darwin-v${version}/cargo-audit"
     }
   },
   "latest": {
-    "version": "0.20.0"
+    "version": "0.22.1"
+  },
+  "0.22": {
+    "version": "0.22.1"
+  },
+  "0.22.1": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE64325DF487BC",
+      "hash": "c32506f338bdcdaef5a17fb9f33abb6ecf9561324cfd34237fd335f9283a1eab"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE643275BD00A9",
+      "hash": "582d104a2a4bdb127c6bf6d056d89eede40686d11f52e4bc1765132ec99d2fca"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE6432BF97AAED",
+      "hash": "1523eedc57675eff07b230c06dcd545f3cb04e0ebf92f4009218c79000279a74"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DE64326434D959",
+      "hash": "4c8df835ee484441bd2c8c6bcac28c4ce4b4058ba9e7477cb9e0012fe7769f66"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE643283AA3EF2",
+      "hash": "04e76e1da25f597bea4814c44faf8aac215838b9f3646e3b6a873d87acd31b73"
+    }
+  },
+  "0.22.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE1E42AFC17765",
+      "hash": "0ea7a15f67d5007af5bd18f89be38a90ebd004f149dc36ebfab0aedba24cbb4f"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE1E42C23BA523",
+      "hash": "be2c3f86cdaf39ad88a58a151a946b2360c38cc2ec056dd6aa4cf0dbbcf9e809"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE1E431B4A43B3",
+      "hash": "c4e309c9b6da7dd63a0c191b39ce4c2d48eb7c5cd538dbfdc180c26f02baa777"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DE1E42B2AAA237",
+      "hash": "64ddb7e99b171a881ea2c9f4ec5efa7b988f9131949d957bcd18d17a981b5302"
+    }
+  },
+  "0.21": {
+    "version": "0.21.2"
+  },
+  "0.21.2": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DD57EB7FBC973F",
+      "hash": "422912aa851458bc9bf37a458b75890cb5a4e2a7e5216dcee7df91507fc594d9"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DD57EB6E096D56",
+      "hash": "35bb991a09591ace872c86210931875dca013a53400eddb75ff2883e00b8eb67"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DD57EBD7A4AB19",
+      "hash": "9499b234149962c03f2e4d089ecc756c598d8fee6531f76c719a47feaff7468e"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DD57EB8E4432AF",
+      "hash": "f29959b2792bb0864db5db1d2facf16c2f8bc3be323ca57cee9609147cd6f64d"
+    }
+  },
+  "0.21.1": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DD383807A86B60",
+      "hash": "e1d057a43028cb2359adcb75029e345b5791fbd2a1a01a3b8f16521035662cf3"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DD3837D203A3C3",
+      "hash": "ca21223691975d97a2442623a4d90e933d349199a728fdabaf98124ff65ee53f"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DD383870DE65E0",
+      "hash": "cb90ebf6c76bdf7014fb0114b3bc897917ce0ea5ecaf16f7dc7009612941dace"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DD383809DEED88",
+      "hash": "bd9a9ceb4887f28c8ace1a35da39818cbdcf98b1088bcd47544bff3a07e856bf"
+    }
+  },
+  "0.21.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DCF84BECAB600C",
+      "hash": "1afe6f3dba2e3d81dfb8db34be37ae9647480b132cd719357276ae643ebf962a"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DCF84BD142518E",
+      "hash": "87e0a4aece55917ebe02b73e7c69fe83c4d995b8fc435820f24bd92a9c2c1fb8"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DCF84C58F8B68A",
+      "hash": "eee7d67cdb72188df354215b9a8f034caf5d928662743350f06db2c3ae677b90"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DCF84BEA0119A8",
+      "hash": "cbe5617406a1af2270f4ffc1b933759bd9bb0d890c0b2efafdf31ecf5b0adfa3"
+    }
   },
   "0.20": {
     "version": "0.20.0"
   },
   "0.20.0": {
     "x86_64_linux_musl": {
-      "checksum": "c8bb83967f74734a5a4b23b0136c26db3fcc81570eb389cffda4d67ea6d8ad9a"
+      "etag": "0x8DC2E91E9960B2A",
+      "hash": "c8bb83967f74734a5a4b23b0136c26db3fcc81570eb389cffda4d67ea6d8ad9a"
     },
     "x86_64_macos": {
-      "checksum": "3f4022fd3010e0e9ffa8b8a75b80ab365c9ab1c3f3d2dd6af6385bb803778f9f"
+      "etag": "0x8DC2E91F7376884",
+      "hash": "3f4022fd3010e0e9ffa8b8a75b80ab365c9ab1c3f3d2dd6af6385bb803778f9f"
     },
     "x86_64_windows": {
-      "checksum": "ec8d3b6e722b01bf51efc1b56dbaf542f4d4101e70f3f45ae4dda52e6f71d2b0"
+      "etag": "0x8DC2E924FCC97C6",
+      "hash": "ec8d3b6e722b01bf51efc1b56dbaf542f4d4101e70f3f45ae4dda52e6f71d2b0"
     },
     "aarch64_linux_gnu": {
-      "checksum": "fb2fbd1f5d36aa131451115183d24605e3ca7f656c6994ec03dfc3b7c581cf4a"
+      "etag": "0x8DC2E91E8770F94",
+      "hash": "fb2fbd1f5d36aa131451115183d24605e3ca7f656c6994ec03dfc3b7c581cf4a"
     }
   },
   "0.19": {
@@ -43,16 +151,20 @@
   },
   "0.19.0": {
     "x86_64_linux_musl": {
-      "checksum": "5f27032694119fd990ac92ec093b78c192631c36200d67f5eeb4cb1d42316bae"
+      "etag": "0x8DC24F5D027FC0F",
+      "hash": "5f27032694119fd990ac92ec093b78c192631c36200d67f5eeb4cb1d42316bae"
     },
     "x86_64_macos": {
-      "checksum": "371c2f464bb6152307318dede563c8fb8ecdc456224b21bdf018af58be739068"
+      "etag": "0x8DC24F5C0EF40C1",
+      "hash": "371c2f464bb6152307318dede563c8fb8ecdc456224b21bdf018af58be739068"
     },
     "x86_64_windows": {
-      "checksum": "ab2cd04392480becd704a48bc70485310e4f029431f87303fa9aeb485fd463bd"
+      "etag": "0x8DC24F62F6FF95E",
+      "hash": "ab2cd04392480becd704a48bc70485310e4f029431f87303fa9aeb485fd463bd"
     },
     "aarch64_linux_gnu": {
-      "checksum": "a5b27ba8fdde75814d96a501c564f10cd4a553c0e8a19f4f1746283a7fda5296"
+      "etag": "0x8DC24F5CB42CD4D",
+      "hash": "a5b27ba8fdde75814d96a501c564f10cd4a553c0e8a19f4f1746283a7fda5296"
     }
   },
   "0.18": {
@@ -60,16 +172,20 @@
   },
   "0.18.3": {
     "x86_64_linux_musl": {
-      "checksum": "2cc37ceefda1d8fc4be45363639e696f31d5bae12c47ce05146a06c432f37290"
+      "etag": "0x8DBD4A05733B7C4",
+      "hash": "2cc37ceefda1d8fc4be45363639e696f31d5bae12c47ce05146a06c432f37290"
     },
     "x86_64_macos": {
-      "checksum": "2dbf9a0861a83bef081f5a864b0d1d3464164146a9d230a0f4beb64be5e93eb4"
+      "etag": "0x8DBD4A05D6DD0AD",
+      "hash": "2dbf9a0861a83bef081f5a864b0d1d3464164146a9d230a0f4beb64be5e93eb4"
     },
     "x86_64_windows": {
-      "checksum": "6d7111be9b30683ae6fb558ba8a5e3b0ed3153f645e2e1549122af69625c478e"
+      "etag": "0x8DBD4A0AA768DBC",
+      "hash": "6d7111be9b30683ae6fb558ba8a5e3b0ed3153f645e2e1549122af69625c478e"
     },
     "aarch64_linux_gnu": {
-      "checksum": "9655a1b5d8b4bde20eeceb2ee0701149eb954b008a3711a207014fadb9623753"
+      "etag": "0x8DBD4A052372232",
+      "hash": "9655a1b5d8b4bde20eeceb2ee0701149eb954b008a3711a207014fadb9623753"
     }
   },
   "0.17": {
@@ -77,86 +193,110 @@
   },
   "0.17.6": {
     "x86_64_linux_musl": {
-      "checksum": "62272b41f946c77193e47a96ef8a891df0ec9af6cbefa1e373b42f42a9f99b7e"
+      "etag": "0x8DB5187527EB84E",
+      "hash": "62272b41f946c77193e47a96ef8a891df0ec9af6cbefa1e373b42f42a9f99b7e"
     },
     "x86_64_macos": {
-      "checksum": "a0ec73e774d187a704f3410337f8a878cc49bd2872eccb152ccaf6500fb177cf"
+      "etag": "0x8DB5187908359D1",
+      "hash": "a0ec73e774d187a704f3410337f8a878cc49bd2872eccb152ccaf6500fb177cf"
     },
     "x86_64_windows": {
-      "checksum": "a9c7427725b137a6eec66cc36b673024af34870f4193ec33b293db32826a28bc"
+      "etag": "0x8DB51962A8DD0CF",
+      "hash": "a9c7427725b137a6eec66cc36b673024af34870f4193ec33b293db32826a28bc"
     },
     "aarch64_linux_gnu": {
-      "checksum": "84821b0a3ec175a13fd499d22214a02e0df84944d5a44414fda92cdb21ef26a1"
+      "etag": "0x8DB51875B93B162",
+      "hash": "84821b0a3ec175a13fd499d22214a02e0df84944d5a44414fda92cdb21ef26a1"
     }
   },
   "0.17.5": {
     "x86_64_linux_musl": {
-      "checksum": "6124641659a333285d9002e4f3e46a58782ad6e0bd54aa001747bb3cbe8d4af9"
+      "etag": "0x8DB2D554F62A383",
+      "hash": "6124641659a333285d9002e4f3e46a58782ad6e0bd54aa001747bb3cbe8d4af9"
     },
     "x86_64_macos": {
-      "checksum": "61daf860ca51e5f4da236cc0d5fef94b0ef89bcefa950a7f8ede4101e150250b"
+      "etag": "0x8DB2D5554039295",
+      "hash": "61daf860ca51e5f4da236cc0d5fef94b0ef89bcefa950a7f8ede4101e150250b"
     },
     "x86_64_windows": {
-      "checksum": "a1a8905406a50d63293410fe424c67232337fefadff9d7507a09bb803f1cbc6d"
+      "etag": "0x8DB2D558B04C35E",
+      "hash": "a1a8905406a50d63293410fe424c67232337fefadff9d7507a09bb803f1cbc6d"
     },
     "aarch64_linux_gnu": {
-      "checksum": "8ee364de52f333da580c678b3804a579ef2d7beecef3647e2c19c823baa10390"
+      "etag": "0x8DB2D5547BC8642",
+      "hash": "8ee364de52f333da580c678b3804a579ef2d7beecef3647e2c19c823baa10390"
     }
   },
   "0.17.4": {
     "x86_64_linux_musl": {
-      "checksum": "7787092990768eb44e12ea489fbf94c46efdf1e74209d6eed3da39a770c0ab61"
+      "etag": "0x8DAC1D09F469DA0",
+      "hash": "7787092990768eb44e12ea489fbf94c46efdf1e74209d6eed3da39a770c0ab61"
     },
     "x86_64_macos": {
-      "checksum": "e0b0a432f45e6951a0eb45124697eaed5e01ce0a3452d1f2b1bb0e8baad266cb"
+      "etag": "0x8DAC1D0E9C00253",
+      "hash": "e0b0a432f45e6951a0eb45124697eaed5e01ce0a3452d1f2b1bb0e8baad266cb"
     },
     "x86_64_windows": {
-      "checksum": "7faa864c7474e9df44ea04d5757b1b6c600df09d28e48825a160d1d7271de2f7"
+      "etag": "0x8DAC1D049E726C8",
+      "hash": "7faa864c7474e9df44ea04d5757b1b6c600df09d28e48825a160d1d7271de2f7"
     },
     "aarch64_linux_gnu": {
-      "checksum": "418e8212e79d7a9d3241a6bc8b7cca9016d59d7e3a680cf0d1a36d34e853f98b"
+      "etag": "0x8DAC1D01EA52D25",
+      "hash": "418e8212e79d7a9d3241a6bc8b7cca9016d59d7e3a680cf0d1a36d34e853f98b"
     }
   },
   "0.17.3": {
     "x86_64_linux_musl": {
-      "checksum": "a46d436e83eb4e220dcf6a1fc91dbeae6cd549b5809c070b958e4871e0c49f39"
+      "etag": "0x8DABC3C9F7F80AE",
+      "hash": "a46d436e83eb4e220dcf6a1fc91dbeae6cd549b5809c070b958e4871e0c49f39"
     },
     "x86_64_macos": {
-      "checksum": "20daa15f351d7f44ff256e9b7deb588b2cc37254b3410cf3b02be60db1eb2eb4"
+      "etag": "0x8DABC3CA818A429",
+      "hash": "20daa15f351d7f44ff256e9b7deb588b2cc37254b3410cf3b02be60db1eb2eb4"
     },
     "x86_64_windows": {
-      "checksum": "51ca34dd3c0f3ba69b369e3b97ac6b8efd19ae27b65e78708c437596c597dbb5"
+      "etag": "0x8DABC3D51D036C4",
+      "hash": "51ca34dd3c0f3ba69b369e3b97ac6b8efd19ae27b65e78708c437596c597dbb5"
     },
     "aarch64_linux_gnu": {
-      "checksum": "f8495db7044f804fc9d0adddae000cc25bbe145fc4e69922c91326ba20850c2f"
+      "etag": "0x8DABC3C9585F1AE",
+      "hash": "f8495db7044f804fc9d0adddae000cc25bbe145fc4e69922c91326ba20850c2f"
     }
   },
   "0.17.2": {
     "x86_64_linux_musl": {
-      "checksum": "c22e29bd95092e0681716c55cd2c5993aa8f85e1d602bec57a018c1690e07bf9"
+      "etag": "0x8DAA7EFC1EE56B9",
+      "hash": "c22e29bd95092e0681716c55cd2c5993aa8f85e1d602bec57a018c1690e07bf9"
     },
     "x86_64_macos": {
-      "checksum": "ccc0e0b742020a2aa524d0902557af6ef0ca55e2f36a054fd7f2ecb3b154c42c"
+      "etag": "0x8DAA7F0BFA33266",
+      "hash": "ccc0e0b742020a2aa524d0902557af6ef0ca55e2f36a054fd7f2ecb3b154c42c"
     },
     "x86_64_windows": {
-      "checksum": "71130a0cabe200944b325bd38e64dde80f8756c333f619b1a88a5860e045e055"
+      "etag": "0x8DAA7F02AA22FB4",
+      "hash": "71130a0cabe200944b325bd38e64dde80f8756c333f619b1a88a5860e045e055"
     },
     "aarch64_linux_gnu": {
-      "checksum": "b0ade081038ea20fa0943aa6b9b1ce586c4be1eaf69b8897d2495792eac7648c"
+      "etag": "0x8DAA7F0014C43A8",
+      "hash": "b0ade081038ea20fa0943aa6b9b1ce586c4be1eaf69b8897d2495792eac7648c"
     }
   },
   "0.17.0": {
     "x86_64_linux_musl": {
-      "checksum": "552bec2dc3de9913c2783624dce3022ea305bfd4b79994a3c0879ac509c765f0"
+      "etag": "0x8DA3CC8C31E8286",
+      "hash": "552bec2dc3de9913c2783624dce3022ea305bfd4b79994a3c0879ac509c765f0"
     },
     "x86_64_macos": {
-      "checksum": "a54ca8139a8c3e4680a4a3009971fc47aca7a2fe5684399888d03934bfba51d3"
+      "etag": "0x8DA3CC952C2314A",
+      "hash": "a54ca8139a8c3e4680a4a3009971fc47aca7a2fe5684399888d03934bfba51d3"
     },
     "x86_64_windows": {
-      "checksum": "4ae4919ab5e2f7e212272e84d3d54b231e534aa8c7fc7d4dfc08c2c9cad4f679"
+      "etag": "0x8DA3CC9C3C9A467",
+      "hash": "4ae4919ab5e2f7e212272e84d3d54b231e534aa8c7fc7d4dfc08c2c9cad4f679"
     },
     "aarch64_linux_gnu": {
-      "checksum": "525a3ab948836ae04a9af680a754c4a05222fd6beb145e08f8a8e0b80089422b"
+      "etag": "0x8DA3CC9172EEBE5",
+      "hash": "525a3ab948836ae04a9af680a754c4a05222fd6beb145e08f8a8e0b80089422b"
     }
   },
   "0.16": {
@@ -164,16 +304,20 @@
   },
   "0.16.0": {
     "x86_64_linux_musl": {
-      "checksum": "c8abe5afdba8fc206dcd1d18a6b3ba68378e07172ecbfe66576672d247eeb794"
+      "etag": "0x8D9BA1AF966A141",
+      "hash": "c8abe5afdba8fc206dcd1d18a6b3ba68378e07172ecbfe66576672d247eeb794"
     },
     "x86_64_macos": {
-      "checksum": "247eebba6e55efc629dab78cb9322505201288b23905a858e9791e576ade483f"
+      "etag": "0x8D9BA1B03A9E6B7",
+      "hash": "247eebba6e55efc629dab78cb9322505201288b23905a858e9791e576ade483f"
     },
     "x86_64_windows": {
-      "checksum": "f6c1c4a3e6d25b9d42e5c19055cfb26351ae732a65aa23dfedbbff32028aa3cd"
+      "etag": "0x8D9BA1AFF137F82",
+      "hash": "f6c1c4a3e6d25b9d42e5c19055cfb26351ae732a65aa23dfedbbff32028aa3cd"
     },
     "aarch64_linux_gnu": {
-      "checksum": "64c62fb185036e3838426b9271f36f283e77a2fc60d1c08583113977f29d4f0f"
+      "etag": "0x8D9BA1AFD92486D",
+      "hash": "64c62fb185036e3838426b9271f36f283e77a2fc60d1c08583113977f29d4f0f"
     }
   }
 }

manifests/cargo-auditable.json

@@ -0,0 +1,188 @@
+{
+  "rust_crate": "cargo-auditable",
+  "template": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/rust-secure-code/cargo-auditable/releases/download/v${version}/cargo-auditable-x86_64-unknown-linux-musl.tar.xz",
+      "bin": "cargo-auditable-x86_64-unknown-linux-musl/cargo-auditable"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/rust-secure-code/cargo-auditable/releases/download/v${version}/cargo-auditable-x86_64-apple-darwin.tar.xz",
+      "bin": "cargo-auditable-x86_64-apple-darwin/cargo-auditable"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/rust-secure-code/cargo-auditable/releases/download/v${version}/cargo-auditable-x86_64-pc-windows-msvc.zip",
+      "bin": "cargo-auditable.exe"
+    },
+    "aarch64_linux_gnu": {
+      "url": "https://github.com/rust-secure-code/cargo-auditable/releases/download/v${version}/cargo-auditable-aarch64-unknown-linux-gnu.tar.xz",
+      "bin": "cargo-auditable-aarch64-unknown-linux-gnu/cargo-auditable"
+    },
+    "aarch64_macos": {
+      "url": "https://github.com/rust-secure-code/cargo-auditable/releases/download/v${version}/cargo-auditable-aarch64-apple-darwin.tar.xz",
+      "bin": "cargo-auditable-aarch64-apple-darwin/cargo-auditable"
+    },
+    "aarch64_windows": {
+      "url": "https://github.com/rust-secure-code/cargo-auditable/releases/download/v${version}/cargo-auditable-aarch64-pc-windows-msvc.zip",
+      "bin": "cargo-auditable.exe"
+    }
+  },
+  "latest": {
+    "version": "0.7.4"
+  },
+  "0.7": {
+    "version": "0.7.4"
+  },
+  "0.7.4": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE7A2374CF1CFA",
+      "hash": "4a4f0c124543c065f03d89aee26550305143c6e4af3e46270dbabefeb79895d2"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE7A23746A3D21",
+      "hash": "2a1e73d769b2ab6c027178d11c6ba6bf3ad7c1e756910b349b513583da9d52bc"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE7A23747DAF46",
+      "hash": "e2da8d873978982381269c27be8b76cfd4084fbf99c43bd83231ac9c714488bb"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DE7A237416D5D6",
+      "hash": "fcf9121e5a0115cb1563852dd532d8c6aec3e84229908c576462c98eb4006521"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE7A23741AA219",
+      "hash": "fade0f3befebce7b54a46edfa31bea27789ea2136c51e662c2922b10f9d6f701"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE7A2374234AE3",
+      "hash": "f7e64d1b6762c15cc4bc91afdd5366797239c503b983593c252b088ab4b2f2bf"
+    }
+  },
+  "0.7.3": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE7972E285D550",
+      "hash": "c002aed9b9cee768575777ee51974af427f47bfd85ead731014fb637e7fd9e5b"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE7972E23E6E64",
+      "hash": "0325aa84965f224ecddf9af473c9ed1c7f374f82edb4172511a69229f19ed17e"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE7972E26AA3C4",
+      "hash": "78c9f05a39d2104b8177820e459e831edc64d595e8b5e7506718dc19678574e5"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DE7972E1F0F3D0",
+      "hash": "0a3cea758e8e76da048ed588a084b1c466306ec914eeab98deea3eeae2c49e3f"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE7972E1F66BE9",
+      "hash": "a78e886dbb15646dbeb435f1270ecf0b36688d87ce7e2e0cce823b655adda755"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE7972E2026C53",
+      "hash": "7a61dfc607bd7fdf601662ecbfd12efdd8fa1eeeb9c7d645d0a064dee951133b"
+    }
+  },
+  "0.7.2": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE1F786D9469E9",
+      "hash": "f194cc63276f458dc72ac157dfd6e668ab3eebf1e25769fcd55fcf318e6bcf18"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE1F786D4239B2",
+      "hash": "5c2d84ca478116d900b68b33be6d6ec16ba0d096e45d2e7e5e08293a7b6f3a86"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE1F786D79ACFC",
+      "hash": "cbee5b0e2465793c260468afaeee3c77234e7aafaae123e2ce8d148c933c9840"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DE1F786CFFFCF3",
+      "hash": "4979df37f1512e44fc4e309503fd44d6dd5869a559c5e501f089942b3179d6f8"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE1F786CF202FF",
+      "hash": "9b0a5aea8bb3aec6c2bf303ea5068a7c6c3521e875f571b41cda491baa150960"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE1F786CFD1A09",
+      "hash": "1c0cf4c27877cc8c9439478f5e79f4d0bf83b3395edaeac489cc0f4dad23ddc9"
+    }
+  },
+  "0.7.1": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE0F0432B09789",
+      "hash": "fcb8d9bdff017feb1c6a58cd7cb3f349f145a36b6016e7e6060526257f830658"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE0F04324E739F",
+      "hash": "b60375765500418dd921bc522ac7cf2611a89f53efeafbc51be0580aa0d9623d"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE0F04329A903B",
+      "hash": "c5f36611faa6110291ab45b0ad5a8c13249243918c573c8b54b363f980568f16"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE0F04324FAAC8",
+      "hash": "edbae5d6d5002d9e4b966f37648b54bae0cf263cd5e001be68d31cda10b69f1e"
+    }
+  },
+  "0.6": {
+    "version": "0.6.6"
+  },
+  "0.6.6": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DD0C3D4484F0AE",
+      "hash": "ccbec5ea7b120b27da34e267065110cc208a19d5e7bc15b41ef545a25e0e52c2"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DD0C3D45AF01FA",
+      "hash": "6da9ff7263e2cc96c20400e34e2131ebce3610451e52cdfa1ae86b49211b03da"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DD0C3D454FE855",
+      "hash": "cc9fedabae5097a755fab5c435cd616a0458894e01b8c5de6eceb189e784299b"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DD0C3D4664DB40",
+      "hash": "fe7351c3fe4070da48901aee6d2661c2df1c6068dfef4b0b44a353d537e9cc66"
+    }
+  },
+  "0.6.5": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DD026635663221",
+      "hash": "1c8f1079d49ec7d29c134ed5e833c56552391db2eb8968a5a8e3cffebb160454"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DD0266371D1878",
+      "hash": "6b7f9ae0eb0a70ab01fe37f776e901f86f22a270491944db1f169b6cc2a6162c"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DD026636A97BCE",
+      "hash": "4aa3d953cb90c177a46e5c70cbb4050e2e06d756cfd14a0d6fd28daf7d38967b"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DD02663824ADB8",
+      "hash": "635fe55a50e6dbb65caa1e45b5703c75a1a00a5dadddf40862c7e91012b06f94"
+    }
+  },
+  "0.6.4": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DC7C39FA3B2719",
+      "hash": "e75d161e101be7f501e71e9dddd3f0c823e6776a45f884340ad42ec268321ea3"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DC7C39FB75C7E7",
+      "hash": "02572f75d434ea03da5eac8b82230e4b3b9e2974549e22092bccb1ef92ac28ef"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DC7C39FB1638FE",
+      "hash": "ea452ae7d3dbc2dd1f747861245be8fd6740da12b351f65c59a212df370b144c"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DC7C39FC410D14",
+      "hash": "02e0faa19a9e9ceee43f83b2b557c536624a0c868307b9b2b3a5f617ef3b7cfb"
+    }
+  }
+}

manifests/cargo-binstall.json

@@ -21,26 +21,32 @@
     }
   },
   "latest": {
-    "version": "1.6.4"
+    "version": "1.18.1"
   },
-  "1.6.4": {
+  "1.18.1": {
     "x86_64_linux_musl": {
-      "checksum": "b07160c21cdfcc24c3afe94b3cb12bf6d111cef7b218cce85a0c1dfae7e106dd"
+      "etag": "0x8DE9959D5E8FE78",
+      "hash": "cf2a4b54494ea8555d6349685e9a301efc1051d9fba6308c76914b2486f8700f"
     },
     "x86_64_macos": {
-      "checksum": "761839db77de482f9bbddb87d43563f8308e7dbdccf2bb3c66f3bcbe13a5dee0"
+      "etag": "0x8DE9959DBCBBA2C",
+      "hash": "e06370bec7143668653bb7c09d0b8b689fc703dd4fa58ec5847c4b571d8a490d"
     },
     "x86_64_windows": {
-      "checksum": "2a05851e1a854cc27c7c6a04f665d506bf2b7aa0aa62721a82af9aeeff9d20d2"
+      "etag": "0x8DE9959D9E5BCF3",
+      "hash": "89706aa5215c164d8d091597a470fee72308ac87e8553af395ea77db844a888c"
     },
     "aarch64_linux_musl": {
-      "checksum": "70c17459e4bc0b417679e66af55199603d80fa751d819b86713f700e3e9a6602"
+      "etag": "0x8DE9959E60E685D",
+      "hash": "c55962a0115f9716b709216de7f8bdd59d6ba8738779e60b051b4593f677717a"
     },
     "aarch64_macos": {
-      "checksum": "64755bfa178ba061c90d46fdf6c977c9b78564bcb4605ff827855d6623453be9"
+      "etag": "0x8DE9959ED2C11A4",
+      "hash": "955abf167994c90f3547e233edace4c0f794465dd4aa408249b38999aa5ca3cf"
     },
     "aarch64_windows": {
-      "checksum": "1277c4ae1a772f803355e256192c2b8bc434421dbd137a9b895ca8031a31ddb3"
+      "etag": "0x8DE9959EAAC5732",
+      "hash": "c6873e81457d9e44973a8e9a849795f2c83765fce0af8ad68b597b5b40dec418"
     }
   }
 }

manifests/cargo-careful.json

@@ -1,42 +1,180 @@
 {
   "rust_crate": "cargo-careful",
-  "template": {
+  "template": null,
-    "x86_64_linux_musl": {
-      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v${version}/cargo-careful.x86_64-unknown-linux-musl"
-    },
-    "x86_64_macos": {
-      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v${version}/cargo-careful.x86_64-apple-darwin"
-    },
-    "x86_64_windows": {
-      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v${version}/cargo-careful.exe"
-    }
-  },
   "latest": {
-    "version": "0.4.1"
+    "version": "0.4.10"
   },
   "0.4": {
-    "version": "0.4.1"
+    "version": "0.4.10"
+  },
+  "0.4.10": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.10/cargo-careful-x86_64-unknown-linux-musl",
+      "etag": "0x8DE8FC4E147531F",
+      "hash": "bd0937ba41dec5ba45ca7cb9c502060fbcf625d12f5cf8d0b0c47328b4d82ac4"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.10/cargo-careful-x86_64-apple-darwin",
+      "etag": "0x8DE8FC4E136EADB",
+      "hash": "5f39ae33320bc0fb101e1be2020a69c2e6368bc26ee6ef7207e89ae39b2cf351"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.10/cargo-careful-windows.exe",
+      "etag": "0x8DE8FC4E141665F",
+      "hash": "89e2e95a6347595d73326b9ed014a58fb397f5a3cf9887ee8b9d92c181e20828"
+    }
+  },
+  "0.4.9": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.9/cargo-careful-x86_64-unknown-linux-musl",
+      "etag": "0x8DE3125D4C34BAD",
+      "hash": "a329e0711910fb7f0f7e803ad243f5a1edac85e885eba0d15e986aac30508fe4"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.9/cargo-careful-x86_64-apple-darwin",
+      "etag": "0x8DE3125D4BC758E",
+      "hash": "9ccfb3a0d502eec025841b11cf06b5a3359b72979e3317dab699aa5806725f1a"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.9/cargo-careful-windows.exe",
+      "etag": "0x8DE3125D4BF3189",
+      "hash": "d329ad9f85da406c52f846d568a1406b71058bccdc85c79fad8d5cf828456518"
+    }
+  },
+  "0.4.8": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.8/cargo-careful-x86_64-unknown-linux-musl",
+      "etag": "0x8DDB61A17F9E28C",
+      "hash": "005394c8fe43f8f759dd7c7acbb3aee4e824651d29e8c4779f03e30ac9f7f2d8"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.8/cargo-careful-x86_64-apple-darwin",
+      "etag": "0x8DDB61A17F88483",
+      "hash": "a77f01f08f01655d37094ed702874012f74cf3e55a265fcaba0b634dd335fa7e"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.8/cargo-careful-windows.exe",
+      "etag": "0x8DDB61A17F6FF9F",
+      "hash": "89cf667991f6ed681a0ed29128d27f6c7efc74dd26867c33cf2d5956ceb32498"
+    }
+  },
+  "0.4.7": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.7/cargo-careful-x86_64-unknown-linux-musl",
+      "etag": "0x8DDA9EA18FE3BD8",
+      "hash": "9a53546e2e038cc723439ad7ba1cce3774fc3fa229ee59d1b45929b8666d6cde"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.7/cargo-careful-x86_64-apple-darwin",
+      "etag": "0x8DDA9EA18FD04D6",
+      "hash": "1d48f5f24ab5a0069b2f6772e1060d6ab8bbd652b09262576cfce5838490f2e3"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.7/cargo-careful-windows.exe",
+      "etag": "0x8DDA9EA190AB0F5",
+      "hash": "854d2e191338145a948d87813a2ec9a8095ecca1eddc8911b1f4fe98345fa6b2"
+    }
+  },
+  "0.4.6": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.6/cargo-careful-x86_64-unknown-linux-musl",
+      "etag": "0x8DD9D21CC303869",
+      "hash": "7486474f22bc719ba7ea57bb6b36e3a362ffa163d80878bfd8106a675339382f"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.6/cargo-careful-x86_64-apple-darwin",
+      "etag": "0x8DD9D21CC206BAE",
+      "hash": "4dd7928eb69dd0839e8782da294db9c2e0c4f05277727d1c342870e8409898de"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.6/cargo-careful-windows.exe",
+      "etag": "0x8DD9D21CC26F3FC",
+      "hash": "a187648862d4a4e63fe33c2675bd5281c506b96839711803be467b3fd5e23447"
+    }
+  },
+  "0.4.5": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.5/cargo-careful-x86_64-unknown-linux-musl",
+      "etag": "0x8DD8F0CCB92AD10",
+      "hash": "1541426e95e779530c5770f98dd9adff5d376b555f8a97f1bf95728ecf281230"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.5/cargo-careful-x86_64-apple-darwin",
+      "etag": "0x8DD8F0CCB86D38F",
+      "hash": "03abfdb85d35857c2ef14793b548f976318169bde7a856e830a3b84e84626200"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.5/cargo-careful-windows.exe",
+      "etag": "0x8DD8F0CCB9899CF",
+      "hash": "d68b34d8fa1d6d97ab47a895d8beaf1f18634fce26beb2fa1f21af7cc20fbebf"
+    }
+  },
+  "0.4.3": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.3/cargo-careful.x86_64-unknown-linux-musl",
+      "etag": "0x8DCB92F10570A48",
+      "hash": "8a39c7c88744b7dec49fdedd08588e75343aabd466c9ec811832b65680c64e6d"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.3/cargo-careful.x86_64-apple-darwin",
+      "etag": "0x8DCB92F104F71BD",
+      "hash": "c4d1b19bc243bd1d8ed5d99413d9a625b852e394e614b7871d71deb9557940e9"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.3/cargo-careful.exe",
+      "etag": "0x8DCB92F104F4AD5",
+      "hash": "1a3bb682553c48cef478609a377e8f845929efad8c4c903ae4ad66348ac5b0c3"
+    }
+  },
+  "0.4.2": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.2/cargo-careful.x86_64-unknown-linux-musl",
+      "etag": "0x8DC77FF17EF35B7",
+      "hash": "ee14c5796acab604714e358de11bf5204055410ae8fd4891df7f5d62461402c3"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.2/cargo-careful.x86_64-apple-darwin",
+      "etag": "0x8DC77FF17F769E4",
+      "hash": "480efaf0a577161332b27ea13c8703ead1b6355b5c6541f5bd61d440440b4bde"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.2/cargo-careful.exe",
+      "etag": "0x8DC77FF17F3EB5D",
+      "hash": "ac374b7799a37e3ef21c6bfe409583c3acbc57242fbb32e8534269b5e97b8ee9"
+    }
   },
   "0.4.1": {
     "x86_64_linux_musl": {
-      "checksum": "ea403df41ca913e536f97b8a039343173abae399436570a16d271908af989808"
+      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.1/cargo-careful.x86_64-unknown-linux-musl",
+      "etag": "0x8DC0FA12501A132",
+      "hash": "ea403df41ca913e536f97b8a039343173abae399436570a16d271908af989808"
     },
     "x86_64_macos": {
-      "checksum": "ccbee4b5a0f5bf235c038b89d6046c08b2bff405ffa7289f4194f5402ea96c15"
+      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.1/cargo-careful.x86_64-apple-darwin",
+      "etag": "0x8DC0FA124F8F869",
+      "hash": "ccbee4b5a0f5bf235c038b89d6046c08b2bff405ffa7289f4194f5402ea96c15"
     },
     "x86_64_windows": {
-      "checksum": "655ac5c504b2f54f11807edc6d9a19cea668bfb119ea086c5848504f7d09071c"
+      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.1/cargo-careful.exe",
+      "etag": "0x8DC0FA124FEBE49",
+      "hash": "655ac5c504b2f54f11807edc6d9a19cea668bfb119ea086c5848504f7d09071c"
     }
   },
   "0.4.0": {
     "x86_64_linux_musl": {
-      "checksum": "54cd7e1972e9faf085e3d0798c02054d064bc72de051a2636ece6f5b0ce0176d"
+      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.0/cargo-careful.x86_64-unknown-linux-musl",
+      "etag": "0x8DBBB2F3DD23635",
+      "hash": "54cd7e1972e9faf085e3d0798c02054d064bc72de051a2636ece6f5b0ce0176d"
     },
     "x86_64_macos": {
-      "checksum": "70d92ad8adf84192caa2066ba981780df926c8aa6cbd398fe489f87af336fe61"
+      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.0/cargo-careful.x86_64-apple-darwin",
+      "etag": "0x8DBBB2F3D8053BA",
+      "hash": "70d92ad8adf84192caa2066ba981780df926c8aa6cbd398fe489f87af336fe61"
     },
     "x86_64_windows": {
-      "checksum": "01ebcae79d9ba0cbb56e5c6bb5757d9cd074a3635704d15b0ef62a000c5d03a8"
+      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.4.0/cargo-careful.exe",
+      "etag": "0x8DBBB2F40025764",
+      "hash": "01ebcae79d9ba0cbb56e5c6bb5757d9cd074a3635704d15b0ef62a000c5d03a8"
     }
   },
   "0.3": {
@@ -44,24 +182,36 @@
   },
   "0.3.4": {
     "x86_64_linux_musl": {
-      "checksum": "a9cfc7775546bd646a9e9252527c5caa56c429d854c6d8664ab4d63ed87827bd"
+      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.3.4/cargo-careful.x86_64-unknown-linux-musl",
+      "etag": "0x8DB4E18D54BDD62",
+      "hash": "a9cfc7775546bd646a9e9252527c5caa56c429d854c6d8664ab4d63ed87827bd"
     },
     "x86_64_macos": {
-      "checksum": "b29d263648fc287250a413ebf53ddb37310564ac44bfd71c5a35ca8eaddac22f"
+      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.3.4/cargo-careful.x86_64-apple-darwin",
+      "etag": "0x8DB4E18D554FADC",
+      "hash": "b29d263648fc287250a413ebf53ddb37310564ac44bfd71c5a35ca8eaddac22f"
     },
     "x86_64_windows": {
-      "checksum": "50cebcb95cda4fa3b4d5010ed6252be92de2748d3f5c00aff3bc6fe5f39c0906"
+      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.3.4/cargo-careful.exe",
+      "etag": "0x8DB4E18D5625959",
+      "hash": "50cebcb95cda4fa3b4d5010ed6252be92de2748d3f5c00aff3bc6fe5f39c0906"
     }
   },
   "0.3.3": {
     "x86_64_linux_musl": {
-      "checksum": "bb2b06f4df62110c8ae89a006b548a10a4da36d0f8f3ff67f7417fb51ed96b0a"
+      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.3.3/cargo-careful.x86_64-unknown-linux-musl",
+      "etag": "0x8DB44A8B737767B",
+      "hash": "bb2b06f4df62110c8ae89a006b548a10a4da36d0f8f3ff67f7417fb51ed96b0a"
     },
     "x86_64_macos": {
-      "checksum": "c396bae85ad4b414976ea6943bdb6fb666e56735ad51255ab615399e40641fec"
+      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.3.3/cargo-careful.x86_64-apple-darwin",
+      "etag": "0x8DB44A8B749B17A",
+      "hash": "c396bae85ad4b414976ea6943bdb6fb666e56735ad51255ab615399e40641fec"
     },
     "x86_64_windows": {
-      "checksum": "87b35993b38fc60c069c45d58e79bae6c8f5253ce2459dff6a6b0b629c7aeb4c"
+      "url": "https://github.com/RalfJung/cargo-careful/releases/download/v0.3.3/cargo-careful.exe",
+      "etag": "0x8DB44A8B7333585",
+      "hash": "87b35993b38fc60c069c45d58e79bae6c8f5253ce2459dff6a6b0b629c7aeb4c"
     }
   }
 }

manifests/cargo-cyclonedx.json

@@ -1,31 +1,273 @@
 {
   "rust_crate": "cargo-cyclonedx",
-  "template": {
+  "template": null,
-    "x86_64_linux_gnu": {
-      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-${version}/cargo-cyclonedx-linux-amd64.tar.gz"
-    },
-    "x86_64_macos": {
-      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-${version}/cargo-cyclonedx-Darwin-x86_64.tar.gz"
-    },
-    "x86_64_windows": {
-      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-${version}/cargo-cyclonedx-Win-x86_64.zip"
-    }
-  },
   "latest": {
-    "version": "0.5.0"
+    "version": "0.5.9"
   },
   "0.5": {
-    "version": "0.5.0"
+    "version": "0.5.9"
+  },
+  "0.5.9": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.9/cargo-cyclonedx-x86_64-unknown-linux-musl.tar.xz",
+      "etag": "0x8DE859AEF496476",
+      "hash": "9bd3e599314f50810c9d98b8b68a617ff9d3cc20873968d90b29d121f6b226ff",
+      "bin": "cargo-cyclonedx-x86_64-unknown-linux-musl/cargo-cyclonedx"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.9/cargo-cyclonedx-x86_64-apple-darwin.tar.xz",
+      "etag": "0x8DE859AEEE5E2A7",
+      "hash": "59d2a583fa632f8759456c1b531340331255b277386d23c598a3dbbc916fde63",
+      "bin": "cargo-cyclonedx-x86_64-apple-darwin/cargo-cyclonedx"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.9/cargo-cyclonedx-x86_64-pc-windows-msvc.zip",
+      "etag": "0x8DE859AEF0C7909",
+      "hash": "8750e00775661dcb75bc482c1a298839fd94e8a0c033b49905ba0f246ffed202",
+      "bin": "cargo-cyclonedx.exe"
+    },
+    "aarch64_linux_gnu": {
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.9/cargo-cyclonedx-aarch64-unknown-linux-gnu.tar.xz",
+      "etag": "0x8DE859AEEAE6F5C",
+      "hash": "7bf131ca5389b07a4f10c182bcf8a5ad339d64408b6f0d8f6834a0bd6120a06a",
+      "bin": "cargo-cyclonedx-aarch64-unknown-linux-gnu/cargo-cyclonedx"
+    },
+    "aarch64_macos": {
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.9/cargo-cyclonedx-aarch64-apple-darwin.tar.xz",
+      "etag": "0x8DE859AEEB78CD2",
+      "hash": "4c53dfa21e70b65bf7f8d2592aadde3bcb02c1a40b6ec63b877e5ca65a29e180",
+      "bin": "cargo-cyclonedx-aarch64-apple-darwin/cargo-cyclonedx"
+    }
+  },
+  "0.5.8": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.8/cargo-cyclonedx-x86_64-unknown-linux-musl.tar.xz",
+      "etag": "0x8DE805A50426FFF",
+      "hash": "7cda4d471e70cad04daef2d55f3d031a7a246098dad263ca7fbda4e752f3bcc7",
+      "bin": "cargo-cyclonedx-x86_64-unknown-linux-musl/cargo-cyclonedx"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.8/cargo-cyclonedx-x86_64-apple-darwin.tar.xz",
+      "etag": "0x8DE805A4FE43F58",
+      "hash": "fd44040b33bafbb7b5073b8302f83100e02e12327de1e1ac245b32853ca320e7",
+      "bin": "cargo-cyclonedx-x86_64-apple-darwin/cargo-cyclonedx"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.8/cargo-cyclonedx-x86_64-pc-windows-msvc.zip",
+      "etag": "0x8DE805A5010C283",
+      "hash": "81577d0bdc7dbe99bed56ec79437afef476842999541a85096efa1f28f7fd965",
+      "bin": "cargo-cyclonedx.exe"
+    },
+    "aarch64_linux_gnu": {
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.8/cargo-cyclonedx-aarch64-unknown-linux-gnu.tar.xz",
+      "etag": "0x8DE805A4FB0BF22",
+      "hash": "e5b3e6abb9614cd603ea142b35f511976ea14a260f20ecdce9468a1e8e9da3c6",
+      "bin": "cargo-cyclonedx-aarch64-unknown-linux-gnu/cargo-cyclonedx"
+    },
+    "aarch64_macos": {
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.8/cargo-cyclonedx-aarch64-apple-darwin.tar.xz",
+      "etag": "0x8DE805A4FB1F65D",
+      "hash": "0b0b28095b775886a530c2be191a51a053e853d3a0212536b958ebf2828b119b",
+      "bin": "cargo-cyclonedx-aarch64-apple-darwin/cargo-cyclonedx"
+    }
+  },
+  "0.5.7": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.7/cargo-cyclonedx-x86_64-unknown-linux-musl.tar.xz",
+      "etag": "0x8DD10E0A0B0BBB1",
+      "hash": "8ffbc91fa29b82f0b0438939a0421a164a0297b5387208f6170c793bdd22a4c9",
+      "bin": "cargo-cyclonedx-x86_64-unknown-linux-musl/cargo-cyclonedx"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.7/cargo-cyclonedx-x86_64-apple-darwin.tar.xz",
+      "etag": "0x8DD10E0A03AD770",
+      "hash": "f96401f427ec096162493f85ecf67d907ff2fc845d14de3e8fbf62660858afab",
+      "bin": "cargo-cyclonedx-x86_64-apple-darwin/cargo-cyclonedx"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.7/cargo-cyclonedx-x86_64-pc-windows-msvc.zip",
+      "etag": "0x8DD10E0A0B6CF5E",
+      "hash": "f9f39802660c25fa2a841ca098158462b36e59567ed3ea07a57b23bed63f6474",
+      "bin": "cargo-cyclonedx.exe"
+    },
+    "aarch64_macos": {
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.7/cargo-cyclonedx-aarch64-apple-darwin.tar.xz",
+      "etag": "0x8DD10E0A0395289",
+      "hash": "39ae80025f67a98974b4bd9e072ea09d42d3e11d05ef1375e6ff6b8345cf3cfe",
+      "bin": "cargo-cyclonedx-aarch64-apple-darwin/cargo-cyclonedx"
+    }
+  },
+  "0.5.6": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.6/cargo-cyclonedx-x86_64-unknown-linux-musl.tar.xz",
+      "etag": "0x8DCFF38D5B5ABE0",
+      "hash": "2238e1be087623eb139fa03896271612f9bb5d0fe3c67bdc5bcdccae078d53a4",
+      "bin": "cargo-cyclonedx-x86_64-unknown-linux-musl/cargo-cyclonedx"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.6/cargo-cyclonedx-x86_64-apple-darwin.tar.xz",
+      "etag": "0x8DCFF38D55CA58A",
+      "hash": "66d5b8550ccdc07161fa2052e64e63710717978a32ceefe3c780e17b9817d686",
+      "bin": "cargo-cyclonedx-x86_64-apple-darwin/cargo-cyclonedx"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.6/cargo-cyclonedx-x86_64-pc-windows-msvc.zip",
+      "etag": "0x8DCFF38D5A5916F",
+      "hash": "bdd6048a476edaa59e15902ff277f906f28ab74267b44b02b6019242e1ad7f50",
+      "bin": "cargo-cyclonedx.exe"
+    },
+    "aarch64_macos": {
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.6/cargo-cyclonedx-aarch64-apple-darwin.tar.xz",
+      "etag": "0x8DCFF38D561F6C1",
+      "hash": "77d1d014e9ef6a9b0e9481b80c35f4d22bf446ddabfbbc9ebd2e17b4167343f1",
+      "bin": "cargo-cyclonedx-aarch64-apple-darwin/cargo-cyclonedx"
+    }
+  },
+  "0.5.5": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.5/cargo-cyclonedx-x86_64-unknown-linux-musl.tar.xz",
+      "etag": "0x8DCB605BF2376BB",
+      "hash": "e0a872a5a8e32b9621334636e9da444d70527fb138aa75380e0dc20db8b0714b",
+      "bin": "cargo-cyclonedx-x86_64-unknown-linux-musl/cargo-cyclonedx"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.5/cargo-cyclonedx-x86_64-apple-darwin.tar.xz",
+      "etag": "0x8DCB605BECCDE9E",
+      "hash": "98beb669323396428b5c6c7003adc4235207442c7b025743366ee98759b2c3a6",
+      "bin": "cargo-cyclonedx-x86_64-apple-darwin/cargo-cyclonedx"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.5/cargo-cyclonedx-x86_64-pc-windows-msvc.zip",
+      "etag": "0x8DCB605BF0BEA8D",
+      "hash": "7b4507cb8fb260df35bed0ad59f675d569f9bde3423228e8b44c7c378876a410",
+      "bin": "cargo-cyclonedx.exe"
+    },
+    "aarch64_macos": {
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.5/cargo-cyclonedx-aarch64-apple-darwin.tar.xz",
+      "etag": "0x8DCB605BEC91251",
+      "hash": "c296b0821c02ad13cbea6a7173ba6c37fa777acc7d066c5ff8570a600aeb62a7",
+      "bin": "cargo-cyclonedx-aarch64-apple-darwin/cargo-cyclonedx"
+    }
+  },
+  "0.5.4": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.4/cargo-cyclonedx-x86_64-unknown-linux-musl.tar.xz",
+      "etag": "0x8DCA65134CEC9A1",
+      "hash": "8a499153bf20c2e6c180b21404f0a0c8b229f4c254c4b5d1623ae15d130afe49",
+      "bin": "cargo-cyclonedx-x86_64-unknown-linux-musl/cargo-cyclonedx"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.4/cargo-cyclonedx-x86_64-apple-darwin.tar.xz",
+      "etag": "0x8DCA651345F6E35",
+      "hash": "a88e604e696f806559b5a3ade35dccfe0baee885b4e5ad0ef34e280d7073c1c7",
+      "bin": "cargo-cyclonedx-x86_64-apple-darwin/cargo-cyclonedx"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.4/cargo-cyclonedx-x86_64-pc-windows-msvc.zip",
+      "etag": "0x8DCA65134B6A1E2",
+      "hash": "6f42f40bb0a7dd86337cdd3f9dc698167b601b077eaf199161a4e38d209f003a",
+      "bin": "cargo-cyclonedx.exe"
+    },
+    "aarch64_macos": {
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.4/cargo-cyclonedx-aarch64-apple-darwin.tar.xz",
+      "etag": "0x8DCA65134508ADB",
+      "hash": "e8751fb79e8dd33286e85acd3ac34af9ecc7a36e634c35720ed3b302b2a936b0",
+      "bin": "cargo-cyclonedx-aarch64-apple-darwin/cargo-cyclonedx"
+    }
+  },
+  "0.5.3": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.3/cargo-cyclonedx-x86_64-unknown-linux-musl.tar.xz",
+      "etag": "0x8DC84D1C05C733F",
+      "hash": "d303058cfdd5151da7645cc642f0d64e9b4e6ce90cfb8e4955329c58c887114b",
+      "bin": "cargo-cyclonedx-x86_64-unknown-linux-musl/cargo-cyclonedx"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.3/cargo-cyclonedx-x86_64-apple-darwin.tar.xz",
+      "etag": "0x8DC84D1C1F0DBBC",
+      "hash": "e7e19ae5d6f938912c87ea57e27d1549197c4f30ea9e5814ee7dc46d3004a945",
+      "bin": "cargo-cyclonedx-x86_64-apple-darwin/cargo-cyclonedx"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.3/cargo-cyclonedx-x86_64-pc-windows-msvc.zip",
+      "etag": "0x8DC84D1C1809711",
+      "hash": "abc9408ea8239f6a35be92c1ca34d759a12e6e2b804191fbd39e515450c7a104",
+      "bin": "cargo-cyclonedx.exe"
+    },
+    "aarch64_macos": {
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.3/cargo-cyclonedx-aarch64-apple-darwin.tar.xz",
+      "etag": "0x8DC84D1C2D24E48",
+      "hash": "7e3ebf1d9074d5b580561509e30c31bb5b80c6cd3b9df4516c49c1e1062c6391",
+      "bin": "cargo-cyclonedx-aarch64-apple-darwin/cargo-cyclonedx"
+    }
+  },
+  "0.5.2": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.2/cargo-cyclonedx-x86_64-unknown-linux-musl.tar.xz",
+      "etag": "0x8DC849208047BE6",
+      "hash": "4018528cd125a8b0f4d1f990a06a67942a6091d6af519af4ada05918eeea70ef",
+      "bin": "cargo-cyclonedx-x86_64-unknown-linux-musl/cargo-cyclonedx"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.2/cargo-cyclonedx-x86_64-apple-darwin.tar.xz",
+      "etag": "0x8DC8492096A685B",
+      "hash": "aae1a9127a1a7651ec8f648b6924b3139171d2e9faf6548df962feb89f161292",
+      "bin": "cargo-cyclonedx-x86_64-apple-darwin/cargo-cyclonedx"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.2/cargo-cyclonedx-x86_64-pc-windows-msvc.zip",
+      "etag": "0x8DC849208F850B0",
+      "hash": "f6961d56104fa7755bd16590bd98899822a3e06037a88c6899a56803507671c3",
+      "bin": "cargo-cyclonedx.exe"
+    },
+    "aarch64_macos": {
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.2/cargo-cyclonedx-aarch64-apple-darwin.tar.xz",
+      "etag": "0x8DC84920A40EAD3",
+      "hash": "f13ff16d6593395e0a18fc41e67cdba7bb2b2cab532b6e990d79e1be2e2a9222",
+      "bin": "cargo-cyclonedx-aarch64-apple-darwin/cargo-cyclonedx"
+    }
+  },
+  "0.5.1": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.1/cargo-cyclonedx-x86_64-unknown-linux-musl.tar.xz",
+      "etag": "0x8DC7B5D4ACF5327",
+      "hash": "e061a15a7dedcea232acbe6de66a6e8494df0a3609ef5435432b06cf2c3a9cb3",
+      "bin": "cargo-cyclonedx-x86_64-unknown-linux-musl/cargo-cyclonedx"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.1/cargo-cyclonedx-x86_64-apple-darwin.tar.xz",
+      "etag": "0x8DC7B5D4C6CB2FB",
+      "hash": "eedd73b2cf7a1a1f82e991541ea3ab3e15f8393d3267e6775dbcdc3529f04d5e",
+      "bin": "cargo-cyclonedx-x86_64-apple-darwin/cargo-cyclonedx"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.1/cargo-cyclonedx-x86_64-pc-windows-msvc.zip",
+      "etag": "0x8DC7B5D4BF0E261",
+      "hash": "b0c772f9d0e99d89eab0e39955150b09665b4e0a2417a4a43638d5ad1753a96a",
+      "bin": "cargo-cyclonedx.exe"
+    },
+    "aarch64_macos": {
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.1/cargo-cyclonedx-aarch64-apple-darwin.tar.xz",
+      "etag": "0x8DC7B5D4D6A40F2",
+      "hash": "bc3857a058cc01ef92a30071084acf20cf6067a23cf0d5569b629276a441e6ee",
+      "bin": "cargo-cyclonedx-aarch64-apple-darwin/cargo-cyclonedx"
+    }
   },
   "0.5.0": {
     "x86_64_linux_gnu": {
-      "checksum": "7daa885e9b6f59bf7674a2972bf1f37d9e21ab7461c3e2f9c59e99a966ab6026"
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.0/cargo-cyclonedx-linux-amd64.tar.gz",
+      "etag": "0x8DC3A43C920B085",
+      "hash": "7daa885e9b6f59bf7674a2972bf1f37d9e21ab7461c3e2f9c59e99a966ab6026"
     },
     "x86_64_macos": {
-      "checksum": "70b197f8095fe2473baef1d96dd4409abb1aef20aeeea00f8a0cbebc25528ddb"
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.0/cargo-cyclonedx-Darwin-x86_64.tar.gz",
+      "etag": "0x8DC3A43C9165BEA",
+      "hash": "70b197f8095fe2473baef1d96dd4409abb1aef20aeeea00f8a0cbebc25528ddb"
     },
     "x86_64_windows": {
-      "checksum": "11e063c29bdd85ceb061b30aa11073238a8c93302b1ff3f5ac37e91ac90b425a"
+      "url": "https://github.com/CycloneDX/cyclonedx-rust-cargo/releases/download/cargo-cyclonedx-0.5.0/cargo-cyclonedx-Win-x86_64.zip",
+      "etag": "0x8DC3A43C95B54A5",
+      "hash": "11e063c29bdd85ceb061b30aa11073238a8c93302b1ff3f5ac37e91ac90b425a"
     }
   }
 }

manifests/cargo-deadlinks.json

@@ -0,0 +1,141 @@
+{
+  "rust_crate": "cargo-deadlinks",
+  "template": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/deadlinks/cargo-deadlinks/releases/download/${version}/cargo-deadlinks-linux",
+      "bin": "cargo-deadlinks"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/deadlinks/cargo-deadlinks/releases/download/${version}/cargo-deadlinks-macos",
+      "bin": "cargo-deadlinks"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/deadlinks/cargo-deadlinks/releases/download/${version}/cargo-deadlinks-windows",
+      "bin": "cargo-deadlinks"
+    }
+  },
+  "latest": {
+    "version": "0.8.1"
+  },
+  "0.8": {
+    "version": "0.8.1"
+  },
+  "0.8.1": {
+    "x86_64_linux_musl": {
+      "etag": "0x8D9BA04AE1969C6",
+      "hash": "e7a91627a0c7ca6dc13acacdf919d42c5e8f8b83335e1cef40099033418e5775"
+    },
+    "x86_64_macos": {
+      "etag": "0x8D9BA04ADFB85E6",
+      "hash": "59b62815867394d063a6fc9b790a51341cf55d0ecc0cb67c771a09f1b6d86783"
+    },
+    "x86_64_windows": {
+      "etag": "0x8D9BA04B39B217B",
+      "hash": "e739cad916e877f4c93c43e163a09c35b5d3af63dede917b5630226049b1f4f3"
+    }
+  },
+  "0.8.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8D9BA04B6EDEED6",
+      "hash": "2f5d8afb113bab4057f2a19a672ee64675b0c3bce7157f6a7a371662fa20c3e9"
+    },
+    "x86_64_macos": {
+      "etag": "0x8D9BA04A4014970",
+      "hash": "ed1c6f3f2bca18d62d0df547ce512819e85492a132a88f4617c060b66fca9ed0"
+    },
+    "x86_64_windows": {
+      "etag": "0x8D9BA04A7B8BD4D",
+      "hash": "9595d878b7c6e8e432dbe879abc22a3b7c5c669660e57fd69c808864cbece832"
+    }
+  },
+  "0.7": {
+    "version": "0.7.2"
+  },
+  "0.7.2": {
+    "x86_64_linux_musl": {
+      "etag": "0x8D9BA04A4EAC3FF",
+      "hash": "775678a8958978792d86ca5ea84eed067287e0b542689d0e225b2f04068cc4e7"
+    },
+    "x86_64_macos": {
+      "etag": "0x8D9BA04A77AABED",
+      "hash": "fb3a71111e08ce485cca45ab383f4314d73ee300fc7c51f31ac706f1be5c04b8"
+    },
+    "x86_64_windows": {
+      "etag": "0x8D9BA04B256C2F5",
+      "hash": "4e51c0ca562c37297e1a61ab596ae36d2ecdbc4a2e35df054f4f76b45d31ea1f"
+    }
+  },
+  "0.7.1": {
+    "x86_64_linux_musl": {
+      "etag": "0x8D9BA04B278EBFD",
+      "hash": "23eb7c8f172e8208243d44e53c347ba7ffdc5316caf530454ae5458176b6c0c5"
+    },
+    "x86_64_macos": {
+      "etag": "0x8D9BA04AC1EA728",
+      "hash": "4e26562febe0668379030d74a6d1ae70284b4895fc7fe2e341e9e8d600c0cb4c"
+    },
+    "x86_64_windows": {
+      "etag": "0x8D9BA04A81D15BE",
+      "hash": "18b99c056a1f531df4ad68ba8f5a312f2514ce4bdf9abfa5f4d0267ffa3e62f8"
+    }
+  },
+  "0.7.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8D9BA04AFCCA699",
+      "hash": "68e78a562d7a97422d24494d7d0befd2ba57cee7acdba6817fe759b9b57351ea"
+    },
+    "x86_64_macos": {
+      "etag": "0x8D9BA04AA722042",
+      "hash": "4aeb830af22fe5ca9d71f36b374d03a5f407881ca1b323afc96fdeba562da3b7"
+    },
+    "x86_64_windows": {
+      "etag": "0x8D9BA04A299B0A2",
+      "hash": "baf9d4643ee52690cebb2021a7078828769b03fcc302ddff2eacf39b16245491"
+    }
+  },
+  "0.6": {
+    "version": "0.6.2"
+  },
+  "0.6.2": {
+    "x86_64_linux_musl": {
+      "etag": "0x8D9BA04B58914BD",
+      "hash": "6ae09c739f3cde7218964d1350546aa09583e70c14c3d9cf3f3429d6dc79605e"
+    },
+    "x86_64_macos": {
+      "etag": "0x8D9BA04A2D79AF1",
+      "hash": "49412e21e1d9da1f48dd013c3f65aaeb7afce2d72a28b1b66d9a4ac880cdd237"
+    },
+    "x86_64_windows": {
+      "etag": "0x8D9BA04A3B382F2",
+      "hash": "95c8905e32ce32821f38c161587cedc32d445afae92f325abf6dd874ad06f781"
+    }
+  },
+  "0.6.1": {
+    "x86_64_linux_musl": {
+      "etag": "0x8D9BA04A3BCA955",
+      "hash": "3f91dfa4f7bd3ec7402312490729b78db090c4eb8f300f1dc02f09ce454ff04a"
+    },
+    "x86_64_macos": {
+      "etag": "0x8D9BA04B1BD5882",
+      "hash": "c6bbdf55f70bc3b3de6c0e14661b53a3aa89caca888c8417ccc9fa29f2e76ff7"
+    },
+    "x86_64_windows": {
+      "etag": "0x8D9BA04B1DF5A80",
+      "hash": "281b798882ba7ba5beddca349ee832a73b87054ec1dfc526745db8915f51d4d7"
+    }
+  },
+  "0.6.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8D9BA04AF5D532D",
+      "hash": "35504018d645314c8a5e6099d8ae788dcf2bfebdb6876a3349ded95d3656bfc0"
+    },
+    "x86_64_macos": {
+      "etag": "0x8D9BA04A51CC930",
+      "hash": "9e5b558709379032bd5ab434630a1eb1a358c39c6027d5ae1738fa99fc1e814a"
+    },
+    "x86_64_windows": {
+      "etag": "0x8D9BA04AC976F00",
+      "hash": "91908baf3650b41f2b8f1a3f9a506cd79fb4cb316a2349df97f2b7ec74e6f639"
+    }
+  }
+}

manifests/cargo-deb.json

@@ -0,0 +1,36 @@
+{
+  "rust_crate": "cargo-deb",
+  "template": {
+    "x86_64_linux_gnu": {
+      "url": "https://github.com/kornelski/cargo-deb/releases/download/v${version}/cargo-deb_${version}-1_amd64.deb",
+      "bin": "usr/bin/cargo-deb"
+    }
+  },
+  "latest": {
+    "version": "3.6.3"
+  },
+  "3": {
+    "version": "3.6.3"
+  },
+  "3.6": {
+    "version": "3.6.3"
+  },
+  "3.6.3": {
+    "x86_64_linux_gnu": {
+      "etag": "0x8DE63F58EBB06E1",
+      "hash": "e4b8c1a499a8f4e5b96d72f0d1ec9da8005ba379aee95aaeef83860991c831c3"
+    }
+  },
+  "3.6.2": {
+    "x86_64_linux_gnu": {
+      "etag": "0x8DE0A5D04840934",
+      "hash": "a0053e0089f0efb194013e9629087c247d1de6cb439b7381b4109e21153b991e"
+    }
+  },
+  "3.6.1": {
+    "x86_64_linux_gnu": {
+      "etag": "0x8DDE4DDD98766C4",
+      "hash": "c7c890cc90dae8c4f5f9ad0ff3d7675fec74fbb57ff89c4f27cfbbab34676e93"
+    }
+  }
+}

manifests/cargo-dinghy.json

@@ -11,22 +11,88 @@
     }
   },
   "latest": {
-    "version": "0.7.1"
+    "version": "0.8.4"
+  },
+  "0.8": {
+    "version": "0.8.4"
+  },
+  "0.8.4": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE3977FF54E8B5",
+      "hash": "49dbf63d99a3de33a66aea5185995500ea519117416cc1d3c7b8b2f32cb76f2d"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE397825EE0B0E",
+      "hash": "0c5a381f087e0f39793705514cb53f2fdfeb8c8f4c01811c5845eeb7458f8812"
+    }
+  },
+  "0.8.2": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE05C23F4A7254",
+      "hash": "403b4e6ad2965a4dddd1313e8ebd169dab34020d5656c5cfba080a67f2a95308"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE05C27C1E96E1",
+      "hash": "de960d1cba67c9e7c83915d408cc0d9bfefe3c696bc9b815939365f8ca4d1339"
+    }
+  },
+  "0.8.1": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DDB80A9802C524",
+      "hash": "15351a72e44382c7534b6096d372bd7fa1fe730e4e1aa7f2da18c8686eb20869"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DDB80AAA03E5B9",
+      "hash": "5f450dffb9f681a647ecd47206ae241c5209ca5914bb5b8092b80d9060514821"
+    }
+  },
+  "0.8.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DD07EB5F95FDA4",
+      "hash": "225c358aed6275a2de43c1a20006d23631013128b21a07c4977f8619a3970d08"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DD07EBA1A526CA",
+      "hash": "06c79e459ad2b46fd453eaea9da8bde01019214337134b521244e7d74251ee65"
+    }
   },
   "0.7": {
-    "version": "0.7.1"
+    "version": "0.7.3"
+  },
+  "0.7.3": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DCEDC4F45BF8E0",
+      "hash": "a7fed1db91a4903949ec2205e9ca45c9511b5ef823ce4d75f3c07d403dfc49db"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DCEDC5104E1195",
+      "hash": "4cccd564c4d23caa8b91364e30e4e6d5afdbdb38e81168f319e98eb7e78bc6be"
+    }
+  },
+  "0.7.2": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DC8EE73CEDB06E",
+      "hash": "c4c4a912b358729f88ee26b10b8de36bab06d42742539bcc3e98d0533c5f4cec"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DC8EE7531E6D99",