Release 2.52.0

CHANGELOG.md

@@ -10,6 +10,16 @@ Note: In this file, do not use the hard wrap in the middle of a sentence for com
 
 ## [Unreleased]
 
+## [2.52.0] - 2025-05-22
+
+- Support `trivy`. ([#970](https://github.com/taiki-e/install-action/pull/970), thanks @jayvdb)
+
+- Update `syft@latest` to 1.26.1.
+
+- Update `rclone@latest` to 1.69.3.
+
+- Update `cargo-shear@latest` to 1.2.8.
+
 ## [2.51.3] - 2025-05-20
 
 - Update `wasmtime@latest` to 33.0.0.
@@ -3916,7 +3926,8 @@ Note: This release is considered a breaking change because installing on version
 
 Initial release
 
-[Unreleased]: https://github.com/taiki-e/install-action/compare/v2.51.3...HEAD
+[Unreleased]: https://github.com/taiki-e/install-action/compare/v2.52.0...HEAD
+[2.52.0]: https://github.com/taiki-e/install-action/compare/v2.51.3...v2.52.0
 [2.51.3]: https://github.com/taiki-e/install-action/compare/v2.51.2...v2.51.3
 [2.51.2]: https://github.com/taiki-e/install-action/compare/v2.51.1...v2.51.2
 [2.51.1]: https://github.com/taiki-e/install-action/compare/v2.51.0...v2.51.1

TOOLS.md

@@ -62,6 +62,7 @@ See the [Supported tools section in README.md](README.md#supported-tools) for ho
 | [**shfmt**](https://github.com/mvdan/sh) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/mvdan/sh/releases) | Linux, macOS, Windows | [BSD-3-Clause](https://github.com/mvdan/sh/blob/master/LICENSE) |
 | [**syft**](https://github.com/anchore/syft) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/anchore/syft/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/anchore/syft/blob/main/LICENSE) |
 | [**taplo**](https://github.com/tamasfe/taplo) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/tamasfe/taplo/releases) | Linux, macOS, Windows | [MIT](https://github.com/tamasfe/taplo/blob/master/LICENSE) |
+| [**trivy**](https://github.com/aquasecurity/trivy) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/aquasecurity/trivy/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/aquasecurity/trivy/blob/main/LICENSE) |
 | [**trunk**](https://github.com/trunk-rs/trunk) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/trunk-rs/trunk/releases) | Linux, macOS, Windows | [MIT](https://github.com/trunk-rs/trunk/blob/main/LICENSE-MIT) OR [Apache-2.0](https://github.com/trunk-rs/trunk/blob/main/LICENSE-APACHE) |
 | [**typos**](https://github.com/crate-ci/typos) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/crate-ci/typos/releases) | Linux, macOS, Windows | [MIT](https://github.com/crate-ci/typos/blob/master/LICENSE-MIT) OR [Apache-2.0](https://github.com/crate-ci/typos/blob/master/LICENSE-APACHE) |
 | [**valgrind**](https://valgrind.org/) | `/snap/bin` | [snap](https://snapcraft.io/install/valgrind/ubuntu) | Linux | [GPL-2.0](https://sourceware.org/git/?p=valgrind.git;a=blob;f=COPYING;hb=HEAD) |

manifests/cargo-shear.json

@@ -28,13 +28,39 @@
   },
   "license_markdown": "[MIT](https://github.com/Boshen/cargo-shear/blob/main/LICENSE)",
   "latest": {
-    "version": "1.2.7"
+    "version": "1.2.8"
   },
   "1": {
-    "version": "1.2.7"
+    "version": "1.2.8"
   },
   "1.2": {
-    "version": "1.2.7"
+    "version": "1.2.8"
+  },
+  "1.2.8": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DD982697163822",
+      "checksum": "f1cd7bef53d18ea89f0681396185f45d9c8aaee9df4c29fb23d1b04c84df5751"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DD982690010D13",
+      "checksum": "33b90bc8c6349c1e4b62cbb1e18b9558fe763e6384b4eb16dd5e384db660182a"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DD9826B76CF533",
+      "checksum": "959df98ee9145c769a7c78eda3bb18557919f9223d68c8e33f7b86232f69bcd0"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DD9826965AE6D9",
+      "checksum": "36d079caa9aa83f8aa76b54a8e08acc1f1983f0d81ac19779b0631d8686305dd"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DD9826977B65F8",
+      "checksum": "1f8867e9a1aa9bb6df19398f780b92ddf985b8729f72d8abf0a822c69ff622ea"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DD9826C4751FA2",
+      "checksum": "b0f801a4e3585eedf8811c6a4e34490c195d92ce167c0aaec676cc4640353f25"
+    }
   },
   "1.2.7": {
     "x86_64_linux_musl": {

manifests/rclone.json

@@ -28,13 +28,39 @@
   },
   "license_markdown": "[MIT](https://github.com/rclone/rclone/blob/master/COPYING)",
   "latest": {
-    "version": "1.69.2"
+    "version": "1.69.3"
   },
   "1": {
-    "version": "1.69.2"
+    "version": "1.69.3"
   },
   "1.69": {
-    "version": "1.69.2"
+    "version": "1.69.3"
+  },
+  "1.69.3": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DD98A9E1AF392F",
+      "checksum": "14c841f24de6dfb5b914900b345b02e6a00278ad20e7502041d856a4f1d4e221"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DD98AAAEE85BEF",
+      "checksum": "b2e9e178f2aebee4033b7c02105ef250da61846a8c7dab00fb71281983c9762e"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DD98AAEAB69E14",
+      "checksum": "9b32123fd33c805d44c1598dc529062a48cbee7573f7a66794722ce0ae7af058"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DD98A9FAE1684C",
+      "checksum": "c23f03c11931b2dd4c6ccc091a11ec508f1ca936cc8916ac69669be5b433941c"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DD98AAB72DCEE0",
+      "checksum": "c8c4a8a76990aeec4774832046471d46a556cedf6a42cb328055b6012b1dc3aa"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DD98AAF2709AC0",
+      "checksum": "001da6d6b66f8b54a006118071c7200ba93dbfe9bfe02c67b92bc327ba1e7625"
+    }
   },
   "1.69.2": {
     "x86_64_linux_musl": {

manifests/syft.json

@@ -24,10 +24,57 @@
   },
   "license_markdown": "[Apache-2.0](https://github.com/anchore/syft/blob/main/LICENSE)",
   "latest": {
-    "version": "1.25.1"
+    "version": "1.26.1"
   },
   "1": {
-    "version": "1.25.1"
+    "version": "1.26.1"
+  },
+  "1.26": {
+    "version": "1.26.1"
+  },
+  "1.26.1": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DD992E8B20F6FE",
+      "checksum": "4f3e84f9467080c876deb0fa968da54309c6d21fb8c00fd3a4e547eb9f006835"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DD992E8C0A9DF3",
+      "checksum": "2eae0b76a208c5916cf02847b94e861024c7a5a6c1e2e606f5436f97747b1f76"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DD992E8BFE28D3",
+      "checksum": "7af7acb9f81bdddbc343855cb3a42e1d38ae9a1b044bfcd9b975a118d107849e"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DD992E8B117805",
+      "checksum": "ed3915cbc9c039f0501cb49d4485125befbd729acc263e767f70a18de3fec10d"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DD992E8BF0CA9A",
+      "checksum": "00435a3fe2ae940203708ee2eae9976d1719982c628d30b2b78aacd36133ec6b"
+    }
+  },
+  "1.26.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DD97E6326C9DAC",
+      "checksum": "2db9f93ba88edc4b23d09b414954847130c59c625e5cd55c1ca1e3951a56c802"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DD97E6331F6CB6",
+      "checksum": "18a82757a400766e9ce51686de5594b5e09a8f4454c0a8b58707157d52f02687"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DD97E6331F6CB6",
+      "checksum": "eca51fb712144a3af97c3699bde32e0ff5d389ed97985fff975fd46b92410075"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DD97E6327766F7",
+      "checksum": "17710a79dd4d5664bf175c776d04163d0031dc3ec041d5df6a2a5701b8248464"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DD97E6332201E7",
+      "checksum": "9af29fa25554b4ae801b3ced7f4b13b2542c8ec201ec09b1809ead2703a0fd90"
+    }
   },
   "1.25": {
     "version": "1.25.1"

manifests/trivy.json

@@ -0,0 +1,76 @@
+{
+  "rust_crate": null,
+  "template": {
+    "x86_64_linux_gnu": {
+      "url": "https://github.com/aquasecurity/trivy/releases/download/v${version}/trivy_${version}_Linux-64bit.tar.gz",
+      "bin": "trivy"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/aquasecurity/trivy/releases/download/v${version}/trivy_${version}_macOS-64bit.tar.gz",
+      "bin": "trivy"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/aquasecurity/trivy/releases/download/v${version}/trivy_${version}_windows-64bit.zip",
+      "bin": "trivy.exe"
+    },
+    "aarch64_linux_gnu": {
+      "url": "https://github.com/aquasecurity/trivy/releases/download/v${version}/trivy_${version}_Linux-ARM64.tar.gz",
+      "bin": "trivy"
+    },
+    "aarch64_macos": {
+      "url": "https://github.com/aquasecurity/trivy/releases/download/v${version}/trivy_${version}_macOS-ARM64.tar.gz",
+      "bin": "trivy"
+    }
+  },
+  "license_markdown": "[Apache-2.0](https://github.com/aquasecurity/trivy/blob/main/LICENSE)",
+  "latest": {
+    "version": "0.62.1"
+  },
+  "0.62": {
+    "version": "0.62.1"
+  },
+  "0.62.1": {
+    "x86_64_linux_gnu": {
+      "etag": "0x8DD8CD66B2C973F",
+      "checksum": "7da92b2ca503d08eb15e717585fa4ffb95ef2c5dc4c554204882d7d26d386a6a"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DD8CD66B02A920",
+      "checksum": "819bf4dad9c3bb4e78bbd11d08b61bdc4663b33777121b3f43372986f7cb3d3e"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DD8CD66CA4E62B",
+      "checksum": "f6d9b422f10af2d7a21b4924d36400d8a76932c9159b5feefaa8aee3e45a82bd"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DD8CD669AB51A2",
+      "checksum": "50e13c5cdd3e3b610e0dc554e3bc58bc6f58eabe3e42a6b28961a23ac6eff0df"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DD8CD66C735F7B",
+      "checksum": "0bbfa581a4139c6fef21f4129233ae6f02a9f4b53039327e62eccd7956af2ba1"
+    }
+  },
+  "0.62.0": {
+    "x86_64_linux_gnu": {
+      "etag": "0x8DD880CCF3EE84C",
+      "checksum": "1be4420999ffde59b9a6900f2c2481a2f4e50fd2e0ac738ad028944563ee6c60"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DD880CCD4C9C5F",
+      "checksum": "8f6d54c7de5c7247bb92b51d29d2542be8006111515ceaf50fe8185adb59ad89"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DD880CCD7359BB",
+      "checksum": "b30da5d15587824335cbb88a62585f00a3aac18f3f754d3ad74d68327e2efc46"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DD880CCF085E40",
+      "checksum": "82c8acca00390bf5e014b26abb03e24ba754824c4f87ead5564cd56375df07c1"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DD880CCF853F18",
+      "checksum": "727a8865c2caf6841a1f4668fd7702f442ae088fd08e3c3719e4f731c1f11333"
+    }
+  }
+}

tools/codegen/base/trivy.json

@@ -0,0 +1,23 @@
+{
+  "repository": "https://github.com/aquasecurity/trivy",
+  "tag_prefix": "v",
+  "bin": "${package}${exe}",
+  "version_range": ">= 0.62.0",
+  "platform": {
+    "x86_64_linux_gnu": {
+      "asset_name": "${package}_${version}_Linux-64bit.tar.gz"
+    },
+    "x86_64_macos": {
+      "asset_name": "${package}_${version}_macOS-64bit.tar.gz"
+    },
+    "x86_64_windows": {
+      "asset_name": "${package}_${version}_windows-64bit.zip"
+    },
+    "aarch64_linux_gnu": {
+      "asset_name": "${package}_${version}_Linux-ARM64.tar.gz"
+    },
+    "aarch64_macos": {
+      "asset_name": "${package}_${version}_macOS-ARM64.tar.gz"
+    }
+  }
+}

tools/codegen/src/main.rs

@@ -127,7 +127,9 @@ fn main() -> Result<()> {
             latest_only = true;
         }
     }
+
     if manifest_path.is_file() {
+        println!("loading pre-existing manifest {}", manifest_path.display());
         match serde_json::from_slice(&fs::read(manifest_path)?) {
             Ok(m) => {
                 manifests = m;
@@ -161,34 +163,57 @@ fn main() -> Result<()> {
         }
     }
 
-    // Populate license_markdown
+    // Populate license_markdown from the base manifest if present.
     if let Some(license_markdown) = base_info.license_markdown {
         if license_markdown.is_empty() {
             panic!("license_markdown can not be an empty value");
         }
         manifests.license_markdown = license_markdown;
-    } else if let Some(detail) = crates_io_version_detail {
-        if let Some(license) = detail.license {
-            eprintln!("Trying to using license '{license}' from crates.io ...");
-            if let Some(license_markdown) =
-                get_license_markdown(&license, repo, &repo_info.default_branch)
-            {
-                manifests.license_markdown = license_markdown;
-            }
+    }
+
+    // Check if the license_markdown is valid.
+    if !manifests.license_markdown.is_empty() {
+        let urls = get_license_markdown_urls(&manifests.license_markdown);
+        if urls.is_empty() {
+            bail!("Could not find URLs in license_markdown: {}.", manifests.license_markdown);
         }
-    } else if let Some(license) = repo_info.license {
-        if let Some(license) = license.spdx_id {
-            eprintln!("Trying to using license '{license}' from github.com ...");
-            if let Some(license_markdown) =
-                get_license_markdown(&license, repo, &repo_info.default_branch)
-            {
-                manifests.license_markdown = license_markdown;
+        for url in urls {
+            if let Err(err) = github_head(&url) {
+                eprintln!("Failed to fetch pre-existing license_markdown {url}: {err}");
+                manifests.license_markdown = String::new();
+                break;
             }
         }
     }
 
+    // Try to detect license_markdown from crates.io or GitHub.
     if manifests.license_markdown.is_empty() {
-        panic!("Unable to determine license_markdown; set manually")
+        let license = match (crates_io_version_detail, repo_info.license) {
+            (Some(crates_io::VersionMetadataDetail { license: Some(license) }), _) => {
+                eprintln!("Trying to verify license '{license}' obtained from crates.io ...");
+                license
+            }
+            (_, Some(github::RepoLicense { spdx_id: Some(spdx_id) })) => {
+                eprintln!("Trying to verify license '{spdx_id}' obtained from github.com ...");
+                spdx_id
+            }
+            _ => {
+                bail!(
+                    "No license SPDX found in crates.io or GitHub metadata.\n\
+                    Please set license_markdown in the base manifest"
+                );
+            }
+        };
+        if let Some(license_markdown) =
+            get_license_markdown(&license, repo, &repo_info.default_branch)
+        {
+            manifests.license_markdown = license_markdown;
+        } else {
+            bail!(
+                "Unable to verify license file(s) in the repo for license {license}.\n\
+                Please set license_markdown in the base manifest"
+            );
+        }
     }
 
     let version_req: Option<semver::VersionReq> = match version_req {
@@ -766,11 +791,18 @@ fn github_head(url: &str) -> Result<()> {
     Err(last_error.unwrap().into())
 }
 
+#[allow(dead_code)]
 #[must_use]
 fn create_github_raw_link(repository: &str, branch: &str, filename: &str) -> String {
     format!("https://raw.githubusercontent.com/{repository}/{branch}/{filename}")
 }
 
+/// Create URLs for https://docs.github.com/en/rest/repos/contents
+#[must_use]
+fn github_content_api_url(repository: &str, branch: &str, filename: &str) -> String {
+    format!("https://api.github.com/repos/{repository}/contents/{filename}?ref={branch}")
+}
+
 #[must_use]
 fn create_github_link(repository: &str, branch: &str, filename: &str) -> String {
     format!("https://github.com/{repository}/blob/{branch}/{filename}")
@@ -814,7 +846,7 @@ fn get_license_markdown(spdx_expr: &str, repo: &str, default_branch: &str) -> Op
     }
 
     match license_ids.len() {
-        0 => panic!("No licenses"),
+        0 => panic!("No licenses detected in SPDX expression: {expr}"),
         1 => {
             let (license_id, exception_id) = license_ids.first().unwrap();
             let license_name = if let Some(exception_id) = exception_id {
@@ -829,10 +861,15 @@ fn get_license_markdown(spdx_expr: &str, repo: &str, default_branch: &str) -> Op
                 "LICENSE.md".to_owned(),
                 "COPYING".to_owned(),
             ] {
-                let url = create_github_raw_link(repo, default_branch, &filename);
-                if github_head(&url).is_ok() {
-                    let url = create_github_link(repo, default_branch, &filename);
-                    return Some(format!("[{license_name}]({url})"));
+                let url = github_content_api_url(repo, default_branch, &filename);
+                match download(&url) {
+                    Ok(_) => {
+                        let url = create_github_link(repo, default_branch, &filename);
+                        return Some(format!("[{license_name}]({url})"));
+                    }
+                    Err(e) => {
+                        eprintln!("Failed to fetch {url}: {e}");
+                    }
                 }
             }
         }
@@ -841,15 +878,20 @@ fn get_license_markdown(spdx_expr: &str, repo: &str, default_branch: &str) -> Op
             for (license_id, exception_id) in &license_ids {
                 let name = license_id.name.split('-').next().unwrap().to_ascii_uppercase();
                 let filename = format!("LICENSE-{name}");
-                let url = create_github_raw_link(repo, default_branch, &filename);
+                let url = github_content_api_url(repo, default_branch, &filename);
                 let license_name = if let Some(exception_id) = exception_id {
                     format!("{} WITH {}", license_id.name, exception_id.name)
                 } else {
                     license_id.name.to_owned()
                 };
-                if github_head(&url).is_ok() {
-                    let url = create_github_link(repo, default_branch, &filename);
-                    license_markdowns.push(format!("[{license_name}]({url})"));
+                match download(&url) {
+                    Ok(_) => {
+                        let url = create_github_link(repo, default_branch, &filename);
+                        license_markdowns.push(format!("[{license_name}]({url})"));
+                    }
+                    Err(e) => {
+                        eprintln!("Failed to fetch {url}: {e}");
+                    }
                 }
             }
             if license_markdowns.is_empty() {
@@ -874,6 +916,14 @@ fn get_license_markdown(spdx_expr: &str, repo: &str, default_branch: &str) -> Op
     None
 }
 
+fn get_license_markdown_urls(license_markdown: &str) -> Vec<String> {
+    license_markdown
+        .split(['(', ')'])
+        .filter(|s| s.starts_with("http"))
+        .map(|s| s.trim().to_string())
+        .collect::<Vec<_>>()
+}
+
 mod github {
     use serde_derive::Deserialize;