Release 2.38.2

.github/.cspell/project-dictionary.txt

@@ -4,6 +4,7 @@ bindgen
 binstall
 coreutils
 cyclonedx
+deepsource
 distro
 doas
 dprint

.github/workflows/ci.yml

@@ -9,6 +9,7 @@ on:
     branches:
       - main
       - dev
+      - ci-*
   schedule:
     - cron: '0 0,3,6,9,12,15,18,21 * * *'
   workflow_dispatch:
@@ -83,7 +84,7 @@ jobs:
         run: just --version & shfmt --version & protoc --version
         shell: cmd
         if: startsWith(matrix.os, 'windows')
-      # We use the version output to check the version of binstall, but they
+      # We use the version output to check the version of cargo-binstall, but they
       # several times change the version output format in the past so we need to
       # check it with CI. (e.g., 0.14.0->0.16.0 update change it
       # from "cargo-binstall <version>" to "<version>")

CHANGELOG.md

@@ -10,15 +10,38 @@ Note: In this file, do not use the hard wrap in the middle of a sentence for com
 
 ## [Unreleased]
 
+## [2.38.2] - 2024-06-10
+
+- Update `syft@latest` to 1.6.0.
+
+## [2.38.1] - 2024-06-10
+
+- Update `biome@latest` to 1.8.1.
+
+## [2.38.0] - 2024-06-09
+
+- Support `earthly`. ([#520](https://github.com/taiki-e/install-action/pull/520), thanks @jayvdb)
+
+- Support `deepsource`. ([#522](https://github.com/taiki-e/install-action/pull/522), thanks @jayvdb)
+
+- Add `fallback: none` input option to ensure that fallback is not used. ([#517](https://github.com/taiki-e/install-action/pull/517))
+
+- `cargo-nextest` installation no longer use `cargo-binstall`. ([#518](https://github.com/taiki-e/install-action/pull/518))
+  This improves security, performance, robustness of installation. See [#487](https://github.com/taiki-e/install-action/issues/487) for more.
+
+- Update `dprint@latest` to 0.46.2.
+
+- Workaround glibc compatibility issue on archlinux. ([#525](https://github.com/taiki-e/install-action/pull/525), thanks @jayvdb)
+
 ## [2.37.0] - 2024-06-08
 
-- Support `rclone` ([#511](https://github.com/taiki-e/install-action/pull/511), thanks @jayvdb)
+- Support `rclone`. ([#511](https://github.com/taiki-e/install-action/pull/511), thanks @jayvdb)
 
-- Support `xh` ([#512](https://github.com/taiki-e/install-action/pull/512), thanks @jayvdb)
+- Support `xh`. ([#512](https://github.com/taiki-e/install-action/pull/512), thanks @jayvdb)
 
-- Support `jaq` ([#513](https://github.com/taiki-e/install-action/pull/513), thanks @jayvdb)
+- Support `jaq`. ([#513](https://github.com/taiki-e/install-action/pull/513), thanks @jayvdb)
 
-- Support `wait-for-them` ([#514](https://github.com/taiki-e/install-action/pull/514), thanks @jayvdb)
+- Support `wait-for-them`. ([#514](https://github.com/taiki-e/install-action/pull/514), thanks @jayvdb)
 
 - Update `cargo-binstall@latest` to 1.6.9.
 
@@ -26,11 +49,11 @@ Note: In this file, do not use the hard wrap in the middle of a sentence for com
 
 ## [2.36.0] - 2024-06-07
 
-- Support `cargo-zigbuild` ([#508](https://github.com/taiki-e/install-action/pull/508), thanks @jayvdb)
+- Support `cargo-zigbuild`. ([#508](https://github.com/taiki-e/install-action/pull/508), thanks @jayvdb)
 
 ## [2.35.0] - 2024-06-05
 
-- Support `cargo-semver-checks` ([#507](https://github.com/taiki-e/install-action/pull/507), thanks @jayvdb)
+- Support `cargo-semver-checks`. ([#507](https://github.com/taiki-e/install-action/pull/507), thanks @jayvdb)
 
 - Update `osv-scanner@latest` to 1.7.4. ([#506](https://github.com/taiki-e/install-action/pull/506), thanks @nmcdaines)
 
@@ -2273,7 +2296,10 @@ Note: This release is considered a breaking change because installing on version
 
 Initial release
 
-[Unreleased]: https://github.com/taiki-e/install-action/compare/v2.37.0...HEAD
+[Unreleased]: https://github.com/taiki-e/install-action/compare/v2.38.2...HEAD
+[2.38.2]: https://github.com/taiki-e/install-action/compare/v2.38.1...v2.38.2
+[2.38.1]: https://github.com/taiki-e/install-action/compare/v2.38.0...v2.38.1
+[2.38.0]: https://github.com/taiki-e/install-action/compare/v2.37.0...v2.38.0
 [2.37.0]: https://github.com/taiki-e/install-action/compare/v2.36.0...v2.37.0
 [2.36.0]: https://github.com/taiki-e/install-action/compare/v2.35.0...v2.36.0
 [2.35.0]: https://github.com/taiki-e/install-action/compare/v2.34.3...v2.35.0

README.md

@@ -79,6 +79,18 @@ See [TOOLS.md](TOOLS.md) for the list of tools that are installed from manifests
 
 If a tool not included in the list above is specified, this action uses [cargo-binstall] as a fallback.
 
+If you want to ensure that fallback is not used, use `fallback: none`.
+
+```yaml
+- uses: taiki-e/install-action@v2
+  with:
+    tool: cargo-hack
+    # Possible values:
+    # - none: disable all fallback
+    # - cargo-binstall (default): cargo-binstall (includes quickinstall)
+    fallback: none
+```
+
 ### Add support for new tool
 
 See the [development guide](DEVELOPMENT.md) for how to add support for new tool.
@@ -93,6 +105,8 @@ Additionally, we also verify signature if the tool distributes signed archives.
 
 See the linked documentation for information on security when installed using [snap](https://snapcraft.io/docs) or [cargo-binstall](https://github.com/cargo-bins/cargo-binstall#faq).
 
+See the [Supported tools section](#supported-tools) for how to ensure that fallback is not used.
+
 ## Compatibility
 
 This action has been tested for GitHub-hosted runners (Ubuntu, macOS, Windows) and containers (Ubuntu, Debian, Fedora, CentOS, Alma, openSUSE, Arch, Alpine).

TOOLS.md

@@ -4,6 +4,8 @@ This is a list of tools that are installed from manifests managed in this action
 
 If a tool not included in the list below is specified, this action uses [cargo-binstall] as a fallback.
 
+See the [Supported tools section in README.md](README.md#supported-tools) for how to ensure that fallback is not used.
+
 > If `$CARGO_HOME/bin` is not available, Rust-related binaries will be installed to `$HOME/.cargo/bin`.<br>
 > If `$HOME/.cargo/bin` is not available, Rust-related binaries will be installed to `/usr/local/bin`.<br>
 > If `/usr/local/bin` is not available, binaries will be installed to `$HOME/.install-action/bin`.<br>
@@ -23,6 +25,7 @@ If a tool not included in the list below is specified, this action uses [cargo-b
 | [**cargo-machete**](https://github.com/bnjbvr/cargo-machete) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/bnjbvr/cargo-machete/releases) | Linux, macOS, Windows | [MIT](https://github.com/bnjbvr/cargo-machete/blob/main/LICENSE.md) |
 | [**cargo-make**](https://github.com/sagiegurari/cargo-make) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/sagiegurari/cargo-make/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/sagiegurari/cargo-make/blob/master/LICENSE) |
 | [**cargo-minimal-versions**](https://github.com/taiki-e/cargo-minimal-versions) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/taiki-e/cargo-minimal-versions/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/taiki-e/cargo-minimal-versions/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/taiki-e/cargo-minimal-versions/blob/main/LICENSE-MIT) |
+| [**cargo-nextest**](https://github.com/nextest-rs/nextest) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/nextest-rs/nextest/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/nextest-rs/nextest/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/nextest-rs/nextest/blob/main/LICENSE-MIT) |
 | [**cargo-no-dev-deps**](https://github.com/taiki-e/cargo-no-dev-deps) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/taiki-e/cargo-no-dev-deps/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/taiki-e/cargo-no-dev-deps/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/taiki-e/cargo-no-dev-deps/blob/main/LICENSE-MIT) |
 | [**cargo-rdme**](https://github.com/orium/cargo-rdme) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/orium/cargo-rdme/releases) | Linux, macOS, Windows | [MPL-2.0](https://github.com/orium/cargo-rdme/blob/main/LICENSE.md) |
 | [**cargo-semver-checks**](https://github.com/obi1kenobi/cargo-semver-checks) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/obi1kenobi/cargo-semver-checks/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/obi1kenobi/cargo-semver-checks/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/obi1kenobi/cargo-semver-checks/blob/main/LICENSE-MIT) |
@@ -33,7 +36,9 @@ If a tool not included in the list below is specified, this action uses [cargo-b
 | [**cargo-valgrind**](https://github.com/jfrimmel/cargo-valgrind) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/jfrimmel/cargo-valgrind/releases) | Linux, macOS, Windows | [MIT](https://github.com/jfrimmel/cargo-valgrind/blob/master/LICENSE-MIT) OR [Apache-2.0](https://github.com/jfrimmel/cargo-valgrind/blob/master/LICENSE-APACHE) |
 | [**cargo-zigbuild**](https://github.com/rust-cross/cargo-zigbuild) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/rust-cross/cargo-zigbuild/releases) | Linux, macOS, Windows | [MIT](https://github.com/rust-cross/cargo-zigbuild/blob/main/LICENSE) |
 | [**cross**](https://github.com/cross-rs/cross) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/cross-rs/cross/releases) | Linux, macOS, Windows | [MIT](https://github.com/cross-rs/cross/blob/main/LICENSE-MIT) OR [Apache-2.0](https://github.com/cross-rs/cross/blob/main/LICENSE-APACHE) |
+| [**deepsource**](https://github.com/DeepSourceCorp/cli) | `/usr/local/bin` | [GitHub Releases](https://github.com/DeepSourceCorp/cli/releases) | Linux, macOS, Windows | [BSD-2-Clause](https://github.com/DeepSourceCorp/cli/blob/master/LICENSE) |
 | [**dprint**](https://github.com/dprint/dprint) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/dprint/dprint/releases) | Linux, macOS, Windows | [MIT](https://github.com/dprint/dprint/blob/main/LICENSE) |
+| [**earthly**](https://github.com/earthly/earthly) | `/usr/local/bin` | [GitHub Releases](https://github.com/earthly/earthly/releases) | Linux, macOS, Windows | [MPL-2.0](https://github.com/earthly/earthly/blob/main/LICENSE) |
 | [**editorconfig-checker**](https://github.com/editorconfig-checker/editorconfig-checker) | `/usr/local/bin` | [GitHub Releases](https://github.com/editorconfig-checker/editorconfig-checker/releases) | Linux, macOS, Windows | [MIT](https://github.com/editorconfig-checker/editorconfig-checker/blob/main/LICENSE) |
 | [**espup**](https://github.com/esp-rs/espup) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/esp-rs/espup/releases) | Linux, macOS, Windows | [MIT](https://github.com/esp-rs/espup/blob/main/LICENSE-MIT) OR [Apache-2.0](https://github.com/esp-rs/espup/blob/main/LICENSE-APACHE) |
 | [**git-cliff**](https://github.com/orhun/git-cliff) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/orhun/git-cliff/releases) | Linux, macOS, Windows | [MIT](https://github.com/orhun/git-cliff/blob/main/LICENSE-MIT) OR [Apache-2.0](https://github.com/orhun/git-cliff/blob/main/LICENSE-APACHE) |
@@ -43,7 +48,6 @@ If a tool not included in the list below is specified, this action uses [cargo-b
 | [**just**](https://github.com/casey/just) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/casey/just/releases) | Linux, macOS, Windows | [CC0-1.0](https://github.com/casey/just/blob/master/LICENSE) |
 | [**mdbook**](https://github.com/rust-lang/mdBook) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/rust-lang/mdBook/releases) | Linux, macOS, Windows | [MPL-2.0](https://github.com/rust-lang/mdBook/blob/master/LICENSE) |
 | [**mdbook-linkcheck**](https://github.com/Michael-F-Bryan/mdbook-linkcheck) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/Michael-F-Bryan/mdbook-linkcheck/releases) | Linux, macOS, Windows | [MIT](https://github.com/Michael-F-Bryan/mdbook-linkcheck/blob/master/LICENSE) |
-| [**nextest**](https://nexte.st/) (alias: `cargo-nextest`)| `$CARGO_HOME/bin` | `cargo-binstall` | Linux, macOS, Windows | [Apache-2.0](https://github.com/nextest-rs/nextest/blob/HEAD/LICENSE-APACHE) OR [MIT](https://github.com/nextest-rs/nextest/blob/HEAD/LICENSE-MIT) |
 | [**osv-scanner**](https://github.com/google/osv-scanner) | `/usr/local/bin` | [GitHub Releases](https://github.com/google/osv-scanner/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/google/osv-scanner/blob/main/LICENSE) |
 | [**parse-changelog**](https://github.com/taiki-e/parse-changelog) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/taiki-e/parse-changelog/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/taiki-e/parse-changelog/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/taiki-e/parse-changelog/blob/main/LICENSE-MIT) |
 | [**protoc**](https://github.com/protocolbuffers/protobuf) | `/usr/local/bin` | [GitHub Releases](https://github.com/protocolbuffers/protobuf/releases) | Linux, macOS, Windows | [BSD-3-Clause](https://github.com/protocolbuffers/protobuf/blob/HEAD/LICENSE) |

action.yml

@@ -10,6 +10,10 @@ inputs:
     description: Whether to enable checksums
     required: false
     default: 'true'
+  fallback:
+    description: Whether to use fallback (none or cargo-binstall)
+    required: false
+    default: 'cargo-binstall'
 
 # Note:
 # - inputs.* should be manually mapped to INPUT_* due to https://github.com/actions/runner/issues/665
@@ -22,3 +26,4 @@ runs:
       env:
         INPUT_TOOL: ${{ inputs.tool }}
         INPUT_CHECKSUM: ${{ inputs.checksum }}
+        INPUT_FALLBACK: ${{ inputs.fallback }}

main.sh

@@ -197,7 +197,29 @@ read_manifest() {
         exact_version="${version}"
     else
         manifest=$(call_jq -r ".\"${exact_version}\"" "${manifest_dir}/${tool}.json")
+        if [[ "${rust_crate}" != "null" ]]; then
+            # TODO: don't hardcode tool name and use 'immediate_yank_reflection' field in base manifest.
+            case "${tool}" in
+                cargo-nextest | nextest)
+                    crate_info=$(retry curl --proto '=https' --tlsv1.2 -fsSL --retry 10 "https://crates.io/api/v1/crates/${rust_crate}")
+                    while true; do
+                        yanked=$(jq <<<"${crate_info}" -r ".versions[] | select(.num == \"${exact_version}\") | .yanked")
+                        if [[ "${yanked}" != "true" ]]; then
+                            break
+                        fi
+                        previous_stable_version=$(jq <<<"${manifest}" -r '.previous_stable_version')
+                        if [[ "${previous_stable_version}" == "null" ]]; then
+                            break
+                        fi
+                        info "${tool}@${exact_version} is yanked; downgrade to ${previous_stable_version}"
+                        exact_version="${previous_stable_version}"
+                        manifest=$(jq -r ".\"${exact_version}\"" "${manifest_dir}/${tool}.json")
+                    done
+                    ;;
+            esac
+        fi
     fi
+
     case "${host_os}" in
         linux)
             # Static-linked binaries compiled for linux-musl will also work on linux-gnu systems and are
@@ -212,6 +234,21 @@ read_manifest() {
                 # TODO: However, a warning may make sense.
                 host_platform="${host_arch}_linux_gnu"
                 download_info=$(call_jq <<<"${manifest}" -r ".${host_platform}")
+            elif [[ "${host_env}" == "gnu" ]]; then
+                # TODO: don't hardcode tool name and use 'prefer_linux_gnu' field in base manifest.
+                case "${tool}" in
+                    cargo-nextest | nextest)
+                        # TODO: don't hardcode required glibc version
+                        required_glibc_version=2.27
+                        higher_glibc_version=$(sort <<<"${required_glibc_version}"$'\n'"${host_glibc_version}" -Vu | tail -1)
+                        if [[ "${higher_glibc_version}" == "${host_glibc_version}" ]]; then
+                            # musl build of nextest is slow, so use glibc build if host_env is gnu.
+                            # https://github.com/taiki-e/install-action/issues/13
+                            host_platform="${host_arch}_linux_gnu"
+                            download_info=$(jq <<<"${manifest}" -r ".${host_platform}")
+                        fi
+                        ;;
+                esac
             fi
             ;;
         macos | windows)
@@ -402,12 +439,25 @@ case "${enable_checksum}" in
     *) bail "'checksum' input option must be 'true' or 'false': '${enable_checksum}'" ;;
 esac
 
+fallback="${INPUT_FALLBACK:-}"
+case "${fallback}" in
+    none | cargo-binstall) ;;
+    *) bail "'fallback' input option must be 'none' or 'cargo-binstall': '${fallback}'" ;;
+esac
+
 # Refs: https://github.com/rust-lang/rustup/blob/HEAD/rustup-init.sh
 base_distro=""
 exe=""
 case "$(uname -s)" in
     Linux)
         host_os=linux
+        ldd_version=$(ldd --version 2>&1 || true)
+        if grep <<<"${ldd_version}" -q 'musl'; then
+            host_env="musl"
+        else
+            host_env="gnu"
+            host_glibc_version=$(grep <<<"${ldd_version}" -E "GLIBC|GNU libc" | sed "s/.* //g")
+        fi
         if grep -q '^ID_LIKE=' /etc/os-release; then
             base_distro=$(grep '^ID_LIKE=' /etc/os-release | cut -d= -f2)
             case "${base_distro}" in
@@ -507,6 +557,10 @@ case "${host_os}" in
                         fi
                     else
                         if ! type -P jq &>/dev/null; then
+                            # https://github.com/taiki-e/install-action/issues/521
+                            if [[ "${base_distro}" == "arch" ]]; then
+                                sys_packages+=(glibc)
+                            fi
                             sys_packages+=(jq)
                         fi
                         sys_install "${sys_packages[@]}"
@@ -743,6 +797,9 @@ done
 
 if [[ ${#unsupported_tools[@]} -gt 0 ]]; then
     IFS=','
+    case "${fallback}" in
+        none) bail "install-action does not support ${unsupported_tools[*]} (fallback is disabled by 'fallback: none' input option)" ;;
+    esac
     info "install-action does not support ${unsupported_tools[*]}; fallback to cargo-binstall"
     IFS=$'\n\t'
     install_cargo_binstall

manifests/biome.json

@@ -36,13 +36,33 @@
   },
   "license_markdown": "[Apache-2.0](https://github.com/biomejs/biome/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/biomejs/biome/blob/main/LICENSE-MIT)",
   "latest": {
-    "version": "1.8.0"
+    "version": "1.8.1"
   },
   "1": {
-    "version": "1.8.0"
+    "version": "1.8.1"
   },
   "1.8": {
-    "version": "1.8.0"
+    "version": "1.8.1"
+  },
+  "1.8.1": {
+    "x86_64_linux_musl": {
+      "checksum": "344a08e4300074612dbf71d417e54816234175e7095f58ce7f10559349d9bc82"
+    },
+    "x86_64_macos": {
+      "checksum": "777cf17639d33ee9a4272176dfec3aa74a0860b46a33f1b8e7e2a4f2266027a0"
+    },
+    "x86_64_windows": {
+      "checksum": "ae12100af43da3c188b59889baf2f7a9748dc62fb3eff15f48feb082351e288c"
+    },
+    "aarch64_linux_musl": {
+      "checksum": "c0dfd1bb4cef5ca36c9aec8b4c7ae478ba81331f013a74f23807f20232988008"
+    },
+    "aarch64_macos": {
+      "checksum": "2433998fcf918069b217d7f379e7adbaa5a758a8aec0a1cdbf626778f3f873e7"
+    },
+    "aarch64_windows": {
+      "checksum": "e865748ffeee8c81f4556a60d389c631eb6c93d29875006524f422024f3a174a"
+    }
   },
   "1.8.0": {
     "x86_64_linux_musl": {

manifests/deepsource.json

@@ -0,0 +1,44 @@
+{
+  "rust_crate": null,
+  "template": {
+    "x86_64_linux_gnu": {
+      "url": "https://github.com/DeepSourceCorp/cli/releases/download/v${version}/deepsource_${version}_linux_amd64.tar.gz"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/DeepSourceCorp/cli/releases/download/v${version}/deepsource_${version}_darwin_amd64.tar.gz"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/DeepSourceCorp/cli/releases/download/v${version}/deepsource_${version}_windows_amd64.tar.gz"
+    },
+    "aarch64_linux_gnu": {
+      "url": "https://github.com/DeepSourceCorp/cli/releases/download/v${version}/deepsource_${version}_linux_arm64.tar.gz"
+    },
+    "aarch64_macos": {
+      "url": "https://github.com/DeepSourceCorp/cli/releases/download/v${version}/deepsource_${version}_darwin_arm64.tar.gz"
+    }
+  },
+  "license_markdown": "[BSD-2-Clause](https://github.com/DeepSourceCorp/cli/blob/master/LICENSE)",
+  "latest": {
+    "version": "0.8.6"
+  },
+  "0.8": {
+    "version": "0.8.6"
+  },
+  "0.8.6": {
+    "x86_64_linux_gnu": {
+      "checksum": "40490fa8403496d354ac5e69ba4a71c287bee579d4413b62ee54c5c3038792ca"
+    },
+    "x86_64_macos": {
+      "checksum": "0970061b4755ecce8736f1d9bc8932cdafb452528432267ce33a0d566a3ecdeb"
+    },
+    "x86_64_windows": {
+      "checksum": "10d7bf2d6d8073a20f47982fd1db4f285666c1a6be2d89f555b097676da106d2"
+    },
+    "aarch64_linux_gnu": {
+      "checksum": "9f4f2a22ec412ed826e011afca3bb49979e4ee89434abbf8086324c5b9ccc074"
+    },
+    "aarch64_macos": {
+      "checksum": "b4223a8a03f16853cdbc4d5d40a586fa9291167e55d21f051ae3bf0c359f693a"
+    }
+  }
+}

manifests/dprint.json

@@ -25,10 +25,27 @@
   },
   "license_markdown": "[MIT](https://github.com/dprint/dprint/blob/main/LICENSE)",
   "latest": {
-    "version": "0.46.1"
+    "version": "0.46.2"
   },
   "0.46": {
-    "version": "0.46.1"
+    "version": "0.46.2"
+  },
+  "0.46.2": {
+    "x86_64_linux_musl": {
+      "checksum": "bbe9fe8eae9abdcfccdeca97fd8c524efd6137de702ee96e82b0ecb4ad432ebf"
+    },
+    "x86_64_macos": {
+      "checksum": "88abd8a6f416b624fdfae338ae6fca440f4a36b35199f0d03438caeb7715d820"
+    },
+    "x86_64_windows": {
+      "checksum": "53ab1991d23be9de8bf3b920f8605aee55629321fcacccfc5df38d49b2eb5160"
+    },
+    "aarch64_linux_musl": {
+      "checksum": "d7b6f88c320bffcbb1dfeb6030d5a1ef23d18d81721e39abdbf4b8bdab389ba4"
+    },
+    "aarch64_macos": {
+      "checksum": "a331d1c9ad2abb96d46c33d25f1166bd5497dde0c48eb8a8f3d98143cd4bca5b"
+    }
   },
   "0.46.1": {
     "x86_64_linux_musl": {

manifests/earthly.json

@@ -0,0 +1,44 @@
+{
+  "rust_crate": null,
+  "template": {
+    "x86_64_linux_gnu": {
+      "url": "https://github.com/earthly/earthly/releases/download/v${version}/earthly-linux-amd64"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/earthly/earthly/releases/download/v${version}/earthly-darwin-amd64"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/earthly/earthly/releases/download/v${version}/earthly-windows-amd64.exe"
+    },
+    "aarch64_linux_gnu": {
+      "url": "https://github.com/earthly/earthly/releases/download/v${version}/earthly-linux-arm64"
+    },
+    "aarch64_macos": {
+      "url": "https://github.com/earthly/earthly/releases/download/v${version}/earthly-darwin-arm64"
+    }
+  },
+  "license_markdown": "[MPL-2.0](https://github.com/earthly/earthly/blob/main/LICENSE)",
+  "latest": {
+    "version": "0.8.13"
+  },
+  "0.8": {
+    "version": "0.8.13"
+  },
+  "0.8.13": {
+    "x86_64_linux_gnu": {
+      "checksum": "5e1d7a41cd7a5c22f7c5c71f08e99cab3964eb604ca223b36312c755fbbce4f8"
+    },
+    "x86_64_macos": {
+      "checksum": "8d50d07d24794fa284ae78a699c45df540e85347ea108374b86df45a7800ff55"
+    },
+    "x86_64_windows": {
+      "checksum": "8201bcdd20272e4e68c56ce3b070fd488e410aef6be1e75b3b1992b4cdd0caaa"
+    },
+    "aarch64_linux_gnu": {
+      "checksum": "6b33bb767f34a94c49fc5db668b3f5936daa01777f3083a217f73b8aefdd7859"
+    },
+    "aarch64_macos": {
+      "checksum": "8d4e2055a761b07f77b11deb2f75914fe20a7bc033eb1115d9b74731df0d3593"
+    }
+  }
+}

manifests/syft.json

@@ -24,10 +24,30 @@
   },
   "license_markdown": "[Apache-2.0](https://github.com/anchore/syft/blob/main/LICENSE)",
   "latest": {
-    "version": "1.5.0"
+    "version": "1.6.0"
   },
   "1": {
-    "version": "1.5.0"
+    "version": "1.6.0"
+  },
+  "1.6": {
+    "version": "1.6.0"
+  },
+  "1.6.0": {
+    "x86_64_linux_musl": {
+      "checksum": "35c8f0912aeb31b36a0621d98e48d0b2761cc896d18d541ed3982721cf2e8f9c"
+    },
+    "x86_64_macos": {
+      "checksum": "93062feafa5c7684b1360e03cf6e3ec64f6b720f329743a00e917cf0a29bacb8"
+    },
+    "x86_64_windows": {
+      "checksum": "6e100901226bf818455f9f138288037b2560e692df3119dd2af74e3959f1d286"
+    },
+    "aarch64_linux_musl": {
+      "checksum": "82fa0d244f84d805589cfbdbe420fbf75ff92574eb85fcfef7de3b0c7f4ef4f8"
+    },
+    "aarch64_macos": {
+      "checksum": "d7d2aa97b08a66281a6137ed0bdef7d08c3613efbc413eee5f8e2fade699cbcc"
+    }
   },
   "1.5": {
     "version": "1.5.0"

tools/ci/tool-list.sh

@@ -27,6 +27,7 @@ glibc_pre_2_27_incompat=(
 )
 musl_incompat=(
     "${glibc_pre_2_27_incompat[@]}"
+    deepsource
 )
 
 incompat_tools=()
@@ -131,9 +132,9 @@ case "${host_os}" in
 esac
 # cargo-watch/watchexec-cli is supported by cargo-binstall (through quickinstall)
 case "${version}" in
-    latest) tools+=(cargo-watch watchexec-cli nextest) ;;
+    latest) tools+=(cargo-watch watchexec-cli) ;;
-    major.minor.patch) tools+=(cargo-watch@8.1.1 watchexec-cli@1.20.5 nextest@0.9.57) ;;
+    major.minor.patch) tools+=(cargo-watch@8.1.1 watchexec-cli@1.20.5) ;;
-    major.minor) tools+=(cargo-watch@8.1 watchexec-cli@1.20 nextest@0.9) ;;
+    major.minor) tools+=(cargo-watch@8.1 watchexec-cli@1.20) ;;
     major) tools+=(cargo-watch@8 watchexec-cli@1) ;;
     *) exit 1 ;;
 esac

tools/codegen/base/cargo-nextest.json

@@ -0,0 +1,17 @@
+{
+  "repository": "https://github.com/nextest-rs/nextest",
+  "tag_prefix": "cargo-nextest-",
+  "rust_crate": "${package}",
+  "asset_name": "${package}-${version}-${rust_target}.tar.gz",
+  "prefer_linux_gnu": true,
+  "immediate_yank_reflection": true,
+  "platform": {
+    "x86_64_linux_gnu": {},
+    "x86_64_linux_musl": {},
+    "x86_64_macos": {
+      "asset_name": "${package}-${version}-universal-apple-darwin.tar.gz"
+    },
+    "x86_64_windows": {},
+    "aarch64_linux_gnu": {}
+  }
+}

tools/codegen/base/deepsource.json

@@ -0,0 +1,22 @@
+{
+  "repository": "https://github.com/DeepSourceCorp/cli",
+  "tag_prefix": "v",
+  "version_range": ">= 0.8.6",
+  "platform": {
+    "x86_64_linux_gnu": {
+      "asset_name": "${package}_${version}_linux_amd64.tar.gz"
+    },
+    "x86_64_macos": {
+      "asset_name": "${package}_${version}_darwin_amd64.tar.gz"
+    },
+    "x86_64_windows": {
+      "asset_name": "${package}_${version}_windows_amd64.tar.gz"
+    },
+    "aarch64_linux_gnu": {
+      "asset_name": "${package}_${version}_linux_arm64.tar.gz"
+    },
+    "aarch64_macos": {
+      "asset_name": "${package}_${version}_darwin_arm64.tar.gz"
+    }
+  }
+}

tools/codegen/base/earthly.json

@@ -0,0 +1,22 @@
+{
+  "repository": "https://github.com/earthly/earthly",
+  "tag_prefix": "v",
+  "version_range": ">= 0.8.13",
+  "platform": {
+    "x86_64_linux_gnu": {
+      "asset_name": "${package}-linux-amd64"
+    },
+    "x86_64_macos": {
+      "asset_name": "${package}-darwin-amd64"
+    },
+    "x86_64_windows": {
+      "asset_name": "${package}-windows-amd64.exe"
+    },
+    "aarch64_linux_gnu": {
+      "asset_name": "${package}-linux-arm64"
+    },
+    "aarch64_macos": {
+      "asset_name": "${package}-darwin-arm64"
+    }
+  }
+}

tools/codegen/src/lib.rs

@@ -180,6 +180,8 @@ pub enum ManifestRef {
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct Manifest {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub previous_stable_version: Option<Version>,
     #[serde(flatten)]
     pub download_info: BTreeMap<HostPlatform, ManifestDownloadInfo>,
 }
@@ -229,8 +231,15 @@ pub struct BaseManifest {
     pub signing: Option<Signing>,
     #[serde(default)]
     pub broken: Vec<semver::Version>,
-    pub platform: BTreeMap<HostPlatform, BaseManifestPlatformInfo>,
     pub version_range: Option<String>,
+    /// Use glibc build if host_env is gnu.
+    #[serde(default)]
+    pub prefer_linux_gnu: bool,
+    /// Check that the version is yanked not only when updating the manifest,
+    /// but also when running the action.
+    #[serde(default)]
+    pub immediate_yank_reflection: bool,
+    pub platform: BTreeMap<HostPlatform, BaseManifestPlatformInfo>,
 }
 impl BaseManifest {
     /// Validate the manifest.

tools/codegen/src/main.rs

@@ -405,15 +405,17 @@ fn main() -> Result<()> {
         }
         // compact manifest
         // TODO: do this before download binaries
-        if download_info.contains_key(&HostPlatform::x86_64_linux_gnu)
+        if !base_info.prefer_linux_gnu {
-            && download_info.contains_key(&HostPlatform::x86_64_linux_musl)
+            if download_info.contains_key(&HostPlatform::x86_64_linux_gnu)
-        {
+                && download_info.contains_key(&HostPlatform::x86_64_linux_musl)
-            download_info.remove(&HostPlatform::x86_64_linux_gnu);
+            {
-        }
+                download_info.remove(&HostPlatform::x86_64_linux_gnu);
-        if download_info.contains_key(&HostPlatform::aarch64_linux_gnu)
+            }
-            && download_info.contains_key(&HostPlatform::aarch64_linux_musl)
+            if download_info.contains_key(&HostPlatform::aarch64_linux_gnu)
-        {
+                && download_info.contains_key(&HostPlatform::aarch64_linux_musl)
-            download_info.remove(&HostPlatform::aarch64_linux_gnu);
+            {
+                download_info.remove(&HostPlatform::aarch64_linux_gnu);
+            }
         }
         if download_info.contains_key(&HostPlatform::x86_64_macos)
             && download_info.contains_key(&HostPlatform::aarch64_macos)
@@ -427,7 +429,22 @@ fn main() -> Result<()> {
         if semver_version.pre.is_empty() {
             semver_versions.insert(semver_version.clone());
         }
-        manifests.map.insert(reverse_semver, ManifestRef::Real(Manifest { download_info }));
+        manifests.map.insert(
+            reverse_semver,
+            ManifestRef::Real(Manifest { previous_stable_version: None, download_info }),
+        );
+    }
+    if base_info.immediate_yank_reflection {
+        let mut prev: Option<&Version> = None;
+        for (Reverse(v), m) in manifests.map.iter_mut().rev() {
+            let ManifestRef::Real(m) = m else { continue };
+            if base_info.rust_crate.is_some() {
+                m.previous_stable_version = prev.cloned();
+            } else {
+                m.previous_stable_version = None;
+            }
+            prev = Some(v);
+        }
     }
     if has_build_metadata {
         eprintln!(
@@ -494,15 +511,17 @@ fn main() -> Result<()> {
         if latest_manifest.download_info.contains_key(&p) {
             continue;
         }
-        if p == HostPlatform::x86_64_linux_gnu
+        if !base_info.prefer_linux_gnu {
-            && latest_manifest.download_info.contains_key(&HostPlatform::x86_64_linux_musl)
+            if p == HostPlatform::x86_64_linux_gnu
-        {
+                && latest_manifest.download_info.contains_key(&HostPlatform::x86_64_linux_musl)
-            continue;
+            {
-        }
+                continue;
-        if p == HostPlatform::aarch64_linux_gnu
+            }
-            && latest_manifest.download_info.contains_key(&HostPlatform::aarch64_linux_musl)
+            if p == HostPlatform::aarch64_linux_gnu
-        {
+                && latest_manifest.download_info.contains_key(&HostPlatform::aarch64_linux_musl)
-            continue;
+            {
+                continue;
+            }
         }
         bail!(
             "platform list in base manifest for {package} contains {p:?}, \

tools/codegen/src/tools-markdown.rs

@@ -46,31 +46,18 @@ fn main() -> Result<()> {
         fs::read_dir(manifest_dir.clone()).unwrap().map(|r| r.unwrap()).collect();
     paths.sort_by_key(fs_err::DirEntry::path);
 
-    let mut tools = vec![
+    let mut tools = vec![MarkdownEntry {
-        MarkdownEntry {
+        name: "valgrind".to_string(),
-            name: "nextest".to_string(),
+        alias: None,
-            alias: "cargo-nextest".to_string().into(),
+        website: "https://valgrind.org/".to_string(),
-            website: "https://nexte.st/".to_string(),
+        installed_to: InstalledTo::Snap,
-            installed_to: InstalledTo::Cargo,
+        installed_from: InstalledFrom::Snap,
-            installed_from: InstalledFrom::Binstall,
+        platforms: Platforms { linux: true, ..Default::default() },
-            platforms: Platforms::all(),
+        repository: "https://sourceware.org/git/valgrind.git".to_string(),
-            repository: "https://github.com/nextest-rs/nextest".to_string(),
+        license_markdown:
-            license_markdown: "[Apache-2.0](https://github.com/nextest-rs/nextest/blob/HEAD/LICENSE-APACHE) OR [MIT](https://github.com/nextest-rs/nextest/blob/HEAD/LICENSE-MIT)".to_string()
+            "[GPL-2.0](https://sourceware.org/git/?p=valgrind.git;a=blob;f=COPYING;hb=HEAD)"
-        },
+                .to_string(),
-        MarkdownEntry {
+    }];
-            name: "valgrind".to_string(),
-            alias: None,
-            website: "https://valgrind.org/".to_string(),
-            installed_to: InstalledTo::Snap,
-            installed_from: InstalledFrom::Snap,
-            platforms: Platforms {
-                linux: true,
-                ..Default::default()
-            },
-            repository: "https://sourceware.org/git/valgrind.git".to_string(),
-            license_markdown: "[GPL-2.0](https://sourceware.org/git/?p=valgrind.git;a=blob;f=COPYING;hb=HEAD)".to_string()
-        }
-    ];
 
     for path in paths {
         let file_name = path.file_name();
@@ -152,7 +139,6 @@ struct MarkdownEntry {
 
 #[derive(Debug, Eq, PartialEq)]
 enum InstalledFrom {
-    Binstall,
     GitHubRelease,
     Snap,
 }
@@ -163,11 +149,6 @@ struct Platforms {
     macos: bool,
     windows: bool,
 }
-impl Platforms {
-    fn all() -> Self {
-        Self { linux: true, macos: true, windows: true }
-    }
-}
 
 impl fmt::Display for Platforms {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
@@ -223,7 +204,6 @@ impl fmt::Display for MarkdownEntry {
                 let markdown = format!("| [GitHub Releases]({}/releases) ", self.repository);
                 f.write_str(&markdown)?;
             }
-            InstalledFrom::Binstall => f.write_str("| `cargo-binstall` ")?,
             InstalledFrom::Snap => {
                 let markdown =
                     format!("| [snap](https://snapcraft.io/install/{}/ubuntu) ", self.name);

tools/publish.sh

@@ -102,8 +102,10 @@ tools=()
 for tool in tools/codegen/base/*.json; do
     tools+=("$(basename "${tool%.*}")")
 done
+# Alias
+tools+=(nextest)
 # Not manifest-based
-tools+=(valgrind nextest cargo-nextest)
+tools+=(valgrind)
 
 if [[ -n "${tags}" ]]; then
     # Create a release commit.