git-cliff

This reverts commit 4976db3862.

.github/dependabot.yml

@@ -15,7 +15,7 @@ updates:
   - package-ecosystem: github-actions
     directory: /
     schedule:
-      interval: weekly
+      interval: monthly
     cooldown:
       default-days: 14
     commit-message:

.github/workflows/ci.yml

@@ -1,7 +1,6 @@
 name: CI
 
-permissions:
+permissions: {}
-  contents: read
 
 on:
   pull_request:
@@ -33,20 +32,20 @@ concurrency:
 
 jobs:
   miri:
-    uses: taiki-e/github-actions/.github/workflows/miri.yml@3c1cac16ef654d1febb66f21f328fa167f0d2fef # main
+    uses: taiki-e/github-actions/.github/workflows/miri.yml@75415970465917c31d702710acd9c9248b9af314 # main
     with:
       # NB: sync with test job's --exclude option
       args: --exclude install-action-internal-codegen
   msrv:
-    uses: taiki-e/github-actions/.github/workflows/msrv.yml@3c1cac16ef654d1febb66f21f328fa167f0d2fef # main
+    uses: taiki-e/github-actions/.github/workflows/msrv.yml@75415970465917c31d702710acd9c9248b9af314 # main
   test-manifest-schema:
-    uses: taiki-e/github-actions/.github/workflows/test.yml@3c1cac16ef654d1febb66f21f328fa167f0d2fef # main
+    uses: taiki-e/github-actions/.github/workflows/test.yml@75415970465917c31d702710acd9c9248b9af314 # main
     with:
       # NB: sync with miri job's --exclude option
       test-args: --exclude install-action-internal-codegen
       no-std: false
   tidy:
-    uses: taiki-e/github-actions/.github/workflows/tidy.yml@3c1cac16ef654d1febb66f21f328fa167f0d2fef # main
+    uses: taiki-e/github-actions/.github/workflows/tidy.yml@75415970465917c31d702710acd9c9248b9af314 # main
     permissions:
       contents: write # for creating branch for pr
       pull-requests: write # unused (used in `codegen-automerge: true` case)
@@ -151,7 +150,7 @@ jobs:
         if: matrix.bash != 'cygwin' && matrix.os != 'windows-11-arm'
 
   test-alias:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 60
     steps:
       - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
@@ -255,7 +254,7 @@ jobs:
           - alpine:3.22 # musl 1.2.5
           - alpine:3.23 # musl 1.2.5
           # - openwrt/rootfs:x86-64-openwrt-24.10 # musl 1.2.5
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 60
     container: ${{ matrix.container }}
     steps:

.github/workflows/manifest.yml

@@ -1,7 +1,6 @@
 name: Manifest
 
-permissions:
+permissions: {}
-  contents: read
 
 on:
   pull_request:
@@ -33,7 +32,7 @@ concurrency:
 
 jobs:
   manifest:
-    uses: taiki-e/github-actions/.github/workflows/gen.yml@3c1cac16ef654d1febb66f21f328fa167f0d2fef # main
+    uses: taiki-e/github-actions/.github/workflows/gen.yml@75415970465917c31d702710acd9c9248b9af314 # main
     permissions:
       contents: write # for creating branch for pr
       pull-requests: write # for gh pr review --approve

.github/workflows/release.yml

@@ -2,8 +2,7 @@ name: Release
 
 # Adapted from https://github.com/taiki-e/github-actions/blob/HEAD/.github/workflows/action-release.yml.
 
-permissions:
+permissions: {}
-  contents: read
 
 on:
   workflow_dispatch:
@@ -26,7 +25,7 @@ on:
 
 defaults:
   run:
-    shell: bash --noprofile --norc -CeEuxo pipefail {0}
+    shell: bash --noprofile --norc -CeEuo pipefail {0}
 
 concurrency:
   group: ${{ github.workflow }}
@@ -35,17 +34,16 @@ concurrency:
 jobs:
   prepare:
     if: github.repository_owner == 'taiki-e' && inputs.target == 'install-action'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 60
     steps:
       - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
-      - uses: taiki-e/install-action@b8be7f5e140177087325943c4a8e169d01c59b3d # v2.75.3
+      - uses: taiki-e/install-action@58e862542551f667fa44c8a2a4a1d64ad477c96a # v2.75.17
         with:
           tool: parse-changelog
           fallback: none
       - id: check
         run: |
-          set +x
           IFS=$'\n\t'
           trap -- 's=$?; printf >&2 "%s\n" "${0##*/}:${LINENO}: \`${BASH_COMMAND}\` exit with ${s}"; exit ${s}' ERR
           retry() {
@@ -70,23 +68,23 @@ jobs:
 
           # shellcheck disable=SC2153
           version="${VERSION}"
-          printf '%s\n' "version(input): ${version}"
+          printf 'version(input): %s\n' "${version}"
           # shellcheck disable=SC2153
           tag_prefix="${TAG_PREFIX}"
-          printf '%s\n' "tag_prefix: ${tag_prefix}"
+          printf 'tag_prefix: %s\n' "${tag_prefix}"
           # shellcheck disable=SC2153
           changelog="${CHANGELOG}"
-          printf '%s\n' "changelog: ${changelog}"
+          printf 'changelog: %s\n' "${changelog}"
 
           # Get the current date.
           release_date=$(date -u '+%Y-%m-%d')
-          printf '%s\n' "release-date: ${release_date}"
+          printf 'release-date: %s\n' "${release_date}"
-          printf '%s\n' "release-date=${release_date}" >>"${GITHUB_OUTPUT}"
+          printf 'release-date=%s\n' "${release_date}" >>"${GITHUB_OUTPUT}"
 
           # Get the current revision.
           rev=$(git rev-parse HEAD)
-          printf '%s\n' "rev: ${rev}"
+          printf 'rev: %s\n' "${rev}"
-          printf '%s\n' "rev=${rev}" >>"${GITHUB_OUTPUT}"
+          printf 'rev=%s\n' "${rev}" >>"${GITHUB_OUTPUT}"
 
           prev_version=$(parse-changelog --title-no-link "${changelog}" | cut -d' ' -f1)
 
@@ -111,11 +109,11 @@ jobs:
           if [[ ! "${version}" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z\.-]+)?(\+[0-9A-Za-z\.-]+)?$ ]]; then
             bail "invalid version format '${version}'"
           fi
-          printf '%s\n' "version: ${version}"
+          printf 'version: %s\n' "${version}"
-          printf '%s\n' "version=${version}" >>"${GITHUB_OUTPUT}"
+          printf 'version=%s\n' "${version}" >>"${GITHUB_OUTPUT}"
           tag="${tag_prefix}${version}"
-          printf '%s\n' "tag: ${tag}"
+          printf 'tag: %s\n' "${tag}"
-          printf '%s\n' "tag=${tag}" >>"${GITHUB_OUTPUT}"
+          printf 'tag=%s\n' "${tag}" >>"${GITHUB_OUTPUT}"
 
           # Make sure the same release has not been created in the past.
           if gh release view "${tag}" &>/dev/null; then
@@ -199,7 +197,7 @@ jobs:
   release:
     if: github.repository_owner == 'taiki-e' && inputs.target == 'install-action'
     needs: prepare
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 60
     environment:
       name: release
@@ -208,7 +206,7 @@ jobs:
       contents: write # for taiki-e/create-gh-release-action
     steps:
       - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
-      - uses: taiki-e/install-action@b8be7f5e140177087325943c4a8e169d01c59b3d # v2.75.3
+      - uses: taiki-e/install-action@58e862542551f667fa44c8a2a4a1d64ad477c96a # v2.75.17
         with:
           tool: parse-changelog
           fallback: none
@@ -220,7 +218,6 @@ jobs:
       - name: Create and push release commit and tag
         id: push
         run: |
-          set +x
           IFS=$'\n\t'
           trap -- 's=$?; printf >&2 "%s\n" "${0##*/}:${LINENO}: \`${BASH_COMMAND}\` exit with ${s}"; exit ${s}' ERR
           retry() {
@@ -436,7 +433,7 @@ jobs:
 
   release-manifest-schema:
     if: github.repository_owner == 'taiki-e' && inputs.target == 'install-action-manifest-schema'
-    uses: taiki-e/github-actions/.github/workflows/rust-release.yml@3c1cac16ef654d1febb66f21f328fa167f0d2fef # main
+    uses: taiki-e/github-actions/.github/workflows/rust-release.yml@75415970465917c31d702710acd9c9248b9af314 # main
     permissions:
       contents: write # for taiki-e/create-gh-release-action
       id-token: write # for rust-lang/crates-io-auth-action

CHANGELOG.md

@@ -10,6 +10,34 @@ Note: In this file, do not use the hard wrap in the middle of a sentence for com
 
 ## [Unreleased]
 
+## [2.76.0] - 2026-05-04
+
+- Support `mdbook-d2`. ([#1737](https://github.com/taiki-e/install-action/pull/1737), thanks @nhu)
+
+- Support `cargo-apple-runner`. ([#1731](https://github.com/taiki-e/install-action/pull/1731), thanks @madsmtm)
+
+- Support `cargo-binstall` on riscv64 Linux.
+
+- Update `cargo-deb@latest` to 3.7.0.
+
+- Update `tombi@latest` to 0.10.2.
+
+## [2.75.30] - 2026-05-03
+
+- Support `cargo-spellcheck` on AArch64 Linux/Windows.
+
+- Update `cargo-spellcheck@latest` to 0.15.7.
+
+- Update `biome@latest` to 2.4.14.
+
+## [2.75.29] - 2026-05-02
+
+- Update `syft@latest` to 1.44.0.
+
+- Update `rclone@latest` to 1.74.0.
+
+- Update `osv-scanner@latest` to 2.3.6.
+
 ## [2.75.28] - 2026-05-01
 
 - Update `wasmtime@latest` to 44.0.1.
@@ -6407,7 +6435,10 @@ Note: This release is considered a breaking change because installing on version
 
 Initial release
 
-[Unreleased]: https://github.com/taiki-e/install-action/compare/v2.75.28...HEAD
+[Unreleased]: https://github.com/taiki-e/install-action/compare/v2.76.0...HEAD
+[2.76.0]: https://github.com/taiki-e/install-action/compare/v2.75.30...v2.76.0
+[2.75.30]: https://github.com/taiki-e/install-action/compare/v2.75.29...v2.75.30
+[2.75.29]: https://github.com/taiki-e/install-action/compare/v2.75.28...v2.75.29
 [2.75.28]: https://github.com/taiki-e/install-action/compare/v2.75.27...v2.75.28
 [2.75.27]: https://github.com/taiki-e/install-action/compare/v2.75.26...v2.75.27
 [2.75.26]: https://github.com/taiki-e/install-action/compare/v2.75.25...v2.75.26

TOOLS.md

@@ -16,9 +16,10 @@ See the [Supported tools section in README.md](README.md#supported-tools) for ho
 | ---- | -------------------------------- | ------------------------------- | ------------------ | ------- |
 | [**auto-doc**](https://github.com/tj-actions/auto-doc) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/tj-actions/auto-doc/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/tj-actions/auto-doc/blob/main/LICENSE) |
 | [**biome**](https://biomejs.dev) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/biomejs/biome/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/biomejs/biome/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/biomejs/biome/blob/main/LICENSE-MIT) |
-| [**cargo-audit**](https://github.com/rustsec/rustsec/tree/HEAD/cargo-audit) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/rustsec/rustsec/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/rustsec/rustsec/blob/main/cargo-audit/LICENSE-APACHE) OR [MIT](https://github.com/rustsec/rustsec/blob/main/cargo-audit/LICENSE-MIT) |
+| [**cargo-apple-runner**](https://github.com/madsmtm/cargo-apple-runner) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/madsmtm/cargo-apple-runner/releases) | macOS | [Zlib](https://github.com/madsmtm/cargo-apple-runner/blob/main/LICENSE-ZLIB.txt) OR [Apache-2.0](https://github.com/madsmtm/cargo-apple-runner/blob/main/LICENSE-APACHE.txt) OR [MIT](https://github.com/madsmtm/cargo-apple-runner/blob/main/LICENSE-MIT.txt) |
-| [**cargo-auditable**](https://github.com/rust-secure-code/cargo-auditable) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/rust-secure-code/cargo-auditable/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/rust-secure-code/cargo-auditable/blob/master/LICENSE-APACHE) OR [MIT](https://github.com/rust-secure-code/cargo-auditable/blob/master/LICENSE-MIT) |
+| [**cargo-audit**](https://github.com/rustsec/rustsec/tree/HEAD/cargo-audit) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/rustsec/rustsec/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/rustsec/rustsec/blob/HEAD/cargo-audit/LICENSE-APACHE) OR [MIT](https://github.com/rustsec/rustsec/blob/HEAD/cargo-audit/LICENSE-MIT) |
-| [**cargo-binstall**](https://github.com/cargo-bins/cargo-binstall) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/cargo-bins/cargo-binstall/releases) | Linux, macOS, Windows | [GPL-3.0](https://github.com/cargo-bins/cargo-binstall/blob/main/crates/bin/LICENSE) |
+| [**cargo-auditable**](https://github.com/rust-secure-code/cargo-auditable) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/rust-secure-code/cargo-auditable/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/rust-secure-code/cargo-auditable/blob/HEAD/LICENSE-APACHE) OR [MIT](https://github.com/rust-secure-code/cargo-auditable/blob/HEAD/LICENSE-MIT) |
+| [**cargo-binstall**](https://github.com/cargo-bins/cargo-binstall) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/cargo-bins/cargo-binstall/releases) | Linux, macOS, Windows | [GPL-3.0](https://github.com/cargo-bins/cargo-binstall/blob/HEAD/crates/bin/LICENSE) |
 | [**cargo-careful**](https://github.com/RalfJung/cargo-careful) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/RalfJung/cargo-careful/releases) | Linux, macOS, Windows | [MIT](https://github.com/RalfJung/cargo-careful/blob/master/LICENSE-MIT) OR [Apache-2.0](https://github.com/RalfJung/cargo-careful/blob/master/LICENSE-APACHE) |
 | [**cargo-cyclonedx**](https://github.com/CycloneDX/cyclonedx-rust-cargo) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/CycloneDX/cyclonedx-rust-cargo/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/CycloneDX/cyclonedx-rust-cargo/blob/main/LICENSE) |
 | [**cargo-deadlinks**](https://github.com/deadlinks/cargo-deadlinks) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/deadlinks/cargo-deadlinks/releases) | Linux, macOS, Windows | [MIT](https://github.com/deadlinks/cargo-deadlinks/blob/master/LICENSE-MIT) OR [Apache-2.0](https://github.com/deadlinks/cargo-deadlinks/blob/master/LICENSE-APACHE) |
@@ -67,6 +68,7 @@ See the [Supported tools section in README.md](README.md#supported-tools) for ho
 | [**martin**](https://maplibre.org/martin/) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/maplibre/martin/releases) | Linux, macOS | [MIT](https://github.com/maplibre/martin/blob/main/LICENSE-MIT) OR [Apache-2.0](https://github.com/maplibre/martin/blob/main/LICENSE-APACHE) |
 | [**mdbook**](https://github.com/rust-lang/mdBook) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/rust-lang/mdBook/releases) | Linux, macOS, Windows | [MPL-2.0](https://github.com/rust-lang/mdBook/blob/master/LICENSE) |
 | [**mdbook-alerts**](https://github.com/lambdalisue/rs-mdbook-alerts) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/lambdalisue/rs-mdbook-alerts/releases) | Linux, macOS, Windows | [MIT](https://github.com/lambdalisue/rs-mdbook-alerts/blob/main/LICENSE) |
+| [**mdbook-d2**](https://github.com/danieleades/mdbook-d2) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/danieleades/mdbook-d2/releases) | Linux, macOS, Windows | [MIT](https://github.com/danieleades/mdbook-d2/blob/main/LICENSE) |
 | [**mdbook-linkcheck**](https://github.com/Michael-F-Bryan/mdbook-linkcheck) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/Michael-F-Bryan/mdbook-linkcheck/releases) | Linux, macOS, Windows | [MIT](https://github.com/Michael-F-Bryan/mdbook-linkcheck/blob/master/LICENSE) |
 | [**mdbook-mermaid**](https://github.com/badboy/mdbook-mermaid) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/badboy/mdbook-mermaid/releases) | Linux, macOS, Windows | [MPL-2.0](https://github.com/badboy/mdbook-mermaid/blob/main/LICENSE) |
 | [**mdbook-mermaid-ssr**](https://github.com/CommanderStorm/mdbook-mermaid-ssr) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/CommanderStorm/mdbook-mermaid-ssr/releases) | Linux, macOS, Windows | [MPL-2.0](https://github.com/CommanderStorm/mdbook-mermaid-ssr/blob/main/LICENSE) |

action.yml

@@ -4,8 +4,8 @@ description: GitHub Action for installing development tools
 inputs:
   tool:
     description: Tools to install (whitespace or comma separated list)
-    required: true
+    required: false
-    # default: #publish:tool
+    default: git-cliff
   checksum:
     description: Whether to enable checksums (strongly discouraged to disable)
     required: false

main.sh

@@ -448,7 +448,16 @@ init_install_action_bin_dir() {
 }
 canonicalize_windows_path() {
   case "${host_os}" in
-    windows) sed -E 's/^\/cygdrive\//\//; s/^\/c\//C:\\/; s/\//\\/g' <<<"$1" ;;
+    windows)
+      local t="$1"
+      if [[ "${t}" == '/cygdrive/'* ]]; then
+        t="${t#/cygdrive}"
+      fi
+      if [[ "${t}" == '/c/'* ]]; then
+        t="${t/\/c\//C:\\}"
+      fi
+      printf '%s\n' "${t//\//\\}"
+      ;;
     *) printf '%s\n' "$1" ;;
   esac
 }
@@ -880,7 +889,7 @@ for tool in "${tools[@]}"; do
       # gungraun-runner up to 0.17.1 (exclusive) does not support --version flag.
       biome | cargo-machete | wait-for-them | gungraun-runner) rx "${tool_bin_stem}" --version || true ;;
       # these packages support neither --version nor --help flag.
-      cargo-auditable | cargo-careful | wasm-bindgen-test-runner) ;;
+      cargo-auditable | cargo-careful | wasm-bindgen-test-runner | cargo-apple-runner) ;;
       # wasm2es6js does not support --version flag and --help flag doesn't contains version info.
       wasm2es6js) ;;
       # iai-callgrind-runner --version works only with iai-callgrind in nearby Cargo.toml.
@@ -916,7 +925,7 @@ if [[ ${#unsupported_tools[@]} -gt 0 ]]; then
     none) bail "install-action does not support ${unsupported_tools[*]} (fallback is disabled by 'fallback: none' input option)" ;;
     cargo-binstall)
       case "${host_arch}" in
-        x86_64 | aarch64) ;;
+        x86_64 | aarch64 | riscv64) ;;
         *)
           info "cargo-binstall does not provide prebuilt binaries for this platform (${host_arch}); use 'cargo-install' fallback instead"
           fallback=cargo-install

manifests/biome.json

@@ -2,13 +2,13 @@
   "rust_crate": null,
   "template": null,
   "latest": {
-    "version": "2.4.13"
+    "version": "2.4.14"
   },
   "2": {
-    "version": "2.4.13"
+    "version": "2.4.14"
   },
   "2.4": {
-    "version": "2.4.13"
+    "version": "2.4.14"
   },
   "2.4.14": {
     "x86_64_linux_musl": {

manifests/cargo-apple-runner.json

@@ -0,0 +1,26 @@
+{
+  "rust_crate": "cargo-apple-runner",
+  "template": {
+    "x86_64_macos": {
+      "url": "https://github.com/madsmtm/cargo-apple-runner/releases/download/v${version}/cargo-apple-runner-x86_64-apple-darwin.tar.gz",
+      "bin": "cargo-apple-runner"
+    },
+    "aarch64_macos": {
+      "url": "https://github.com/madsmtm/cargo-apple-runner/releases/download/v${version}/cargo-apple-runner-aarch64-apple-darwin.tar.gz",
+      "bin": "cargo-apple-runner"
+    }
+  },
+  "latest": {
+    "version": "0.0.1"
+  },
+  "0.0.1": {
+    "x86_64_macos": {
+      "etag": "0x8DE9E56906B2739",
+      "hash": "66e53e60e1502d6c6e57aed9c423ecbe9f155fbcee56824a20eb72c49136a554"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9E56816E1F2D",
+      "hash": "58b94a77328568eff1c8d1216f51933c0753d20365b2284cf3a1dca843a6d0c1"
+    }
+  }
+}

manifests/cargo-binstall.json

@@ -18,6 +18,9 @@
     },
     "aarch64_windows": {
       "url": "https://github.com/cargo-bins/cargo-binstall/releases/download/v${version}/cargo-binstall-aarch64-pc-windows-msvc.zip"
+    },
+    "riscv64_linux_musl": {
+      "url": "https://github.com/cargo-bins/cargo-binstall/releases/download/v${version}/cargo-binstall-riscv64gc-unknown-linux-musl.tgz"
     }
   },
   "latest": {
@@ -47,6 +50,10 @@
     "aarch64_windows": {
       "etag": "0x8DE9959EAAC5732",
       "hash": "c6873e81457d9e44973a8e9a849795f2c83765fce0af8ad68b597b5b40dec418"
+    },
+    "riscv64_linux_musl": {
+      "etag": "0x8DE9959DFE57CE6",
+      "hash": "3eb039f14fa71dd27b614bf692f0bffd4ba087204829805d54b014646aed7c14"
     }
   }
 }

manifests/cargo-deb.json

@@ -7,10 +7,19 @@
     }
   },
   "latest": {
-    "version": "3.6.4"
+    "version": "3.7.0"
   },
   "3": {
-    "version": "3.6.4"
+    "version": "3.7.0"
+  },
+  "3.7": {
+    "version": "3.7.0"
+  },
+  "3.7.0": {
+    "x86_64_linux_gnu": {
+      "etag": "0x8DEA87CE0C3370E",
+      "hash": "e61273031c84b6ef2ca3fb259b594d34d2b592e1c6bc378c1249380c53e5b05e"
+    }
   },
   "3.6": {
     "version": "3.6.4"

manifests/cargo-spellcheck.json

@@ -1,35 +1,54 @@
 {
   "rust_crate": "cargo-spellcheck",
-  "template": {
+  "template": null,
-    "x86_64_linux_gnu": {
-      "url": "https://github.com/drahnr/cargo-spellcheck/releases/download/v${version}/cargo-spellcheck-v${version}-x86_64-unknown-linux-gnu"
-    },
-    "x86_64_windows": {
-      "url": "https://github.com/drahnr/cargo-spellcheck/releases/download/v${version}/cargo-spellcheck-v${version}-x86_64-pc-windows-gnu.exe"
-    }
-  },
   "latest": {
-    "version": "0.15.1"
+    "version": "0.15.7"
   },
   "0.15": {
-    "version": "0.15.1"
+    "version": "0.15.7"
+  },
+  "0.15.7": {
+    "x86_64_linux_gnu": {
+      "url": "https://github.com/drahnr/cargo-spellcheck/releases/download/v0.15.7/cargo-spellcheck-v0.15.7-x86_64-unknown-linux-gnu",
+      "etag": "0x8DEA7C00640F8EA",
+      "hash": "6c944067adde19558aff6b6eb0003e82a95a52ac9dd75465ba3df894eeac5b74"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/drahnr/cargo-spellcheck/releases/download/v0.15.7/cargo-spellcheck-v0.15.7-x86_64-pc-windows-msvc.exe",
+      "etag": "0x8DEA7C002803985",
+      "hash": "fef4eae8bd21d1edac52b00c7729fbabd7ad47bb6053e29025d62adb2746c93f"
+    },
+    "aarch64_linux_gnu": {
+      "url": "https://github.com/drahnr/cargo-spellcheck/releases/download/v0.15.7/cargo-spellcheck-v0.15.7-aarch64-unknown-linux-gnu",
+      "etag": "0x8DEA7C0074205C5",
+      "hash": "22c5ea30ca4bc86004022cffb671bdbf971d66f2dd564397e8a7647cadcf3ec8"
+    },
+    "aarch64_windows": {
+      "url": "https://github.com/drahnr/cargo-spellcheck/releases/download/v0.15.7/cargo-spellcheck-v0.15.7-aarch64-pc-windows-msvc.exe",
+      "etag": "0x8DEA7C002536910",
+      "hash": "cc72699c01f192f160d2c402fa44efdd56b9ff5856c5b1d4cd5af1631ded48a3"
+    }
   },
   "0.15.2": {
     "x86_64_linux_gnu": {
+      "url": "https://github.com/drahnr/cargo-spellcheck/releases/download/v0.15.2/cargo-spellcheck-v0.15.2-x86_64-unknown-linux-gnu",
       "etag": "0x8DD4A85530EF13A",
       "hash": "9b36eb04e83aaea2c943064fbb2e5a04d37a46bcf51dfd99495b74b09ff56455"
     },
     "x86_64_windows": {
+      "url": "https://github.com/drahnr/cargo-spellcheck/releases/download/v0.15.2/cargo-spellcheck-v0.15.2-x86_64-pc-windows-gnu.exe",
       "etag": "0x8DD4A8564500872",
       "hash": "5d70eac68be1dae5fb69439217581f79e642867ddd4b67ba258e224de6ff82a2"
     }
   },
   "0.15.1": {
     "x86_64_linux_gnu": {
+      "url": "https://github.com/drahnr/cargo-spellcheck/releases/download/v0.15.1/cargo-spellcheck-v0.15.1-x86_64-unknown-linux-gnu",
       "etag": "0x8DD49AEF852F898",
       "hash": "b96e4e73babd959aa138d1629b143180e83ebd8461064fa68e99e2e961560029"
     },
     "x86_64_windows": {
+      "url": "https://github.com/drahnr/cargo-spellcheck/releases/download/v0.15.1/cargo-spellcheck-v0.15.1-x86_64-pc-windows-gnu.exe",
       "etag": "0x8DD49AF09E6176C",
       "hash": "53e697b1016880ffe864dfba9fda68c050694644267557450881d52d9eed987d"
     }
@@ -39,10 +58,12 @@
   },
   "0.14.0": {
     "x86_64_linux_gnu": {
+      "url": "https://github.com/drahnr/cargo-spellcheck/releases/download/v0.14.0/cargo-spellcheck-v0.14.0-x86_64-unknown-linux-gnu",
       "etag": "0x8DC6466EF3038F3",
       "hash": "6f35073843f2eb87990ef19c841c61ded5263e3a7ff38f885cfab22193b84f13"
     },
     "x86_64_windows": {
+      "url": "https://github.com/drahnr/cargo-spellcheck/releases/download/v0.14.0/cargo-spellcheck-v0.14.0-x86_64-pc-windows-gnu.exe",
       "etag": "0x8DC646705A424A4",
       "hash": "ad97a1471b7e718902ec385c3ad045a6afbc986f736d0c4986855ec99a79c80c"
     }
@@ -52,30 +73,36 @@
   },
   "0.13.2": {
     "x86_64_linux_gnu": {
+      "url": "https://github.com/drahnr/cargo-spellcheck/releases/download/v0.13.2/cargo-spellcheck-v0.13.2-x86_64-unknown-linux-gnu",
       "etag": "0x8DC0E0760B5DD94",
       "hash": "f547b8f992dcc43f8a4106bae8b090ecb3fcb7ef6ce336081c22636f70e876d9"
     },
     "x86_64_windows": {
+      "url": "https://github.com/drahnr/cargo-spellcheck/releases/download/v0.13.2/cargo-spellcheck-v0.13.2-x86_64-pc-windows-gnu.exe",
       "etag": "0x8DC0E07751C8D13",
       "hash": "f54fb8243497258115d1eb55b99bfc94ab3e09636c78665d3b6410885ba9190a"
     }
   },
   "0.13.1": {
     "x86_64_linux_gnu": {
+      "url": "https://github.com/drahnr/cargo-spellcheck/releases/download/v0.13.1/cargo-spellcheck-v0.13.1-x86_64-unknown-linux-gnu",
       "etag": "0x8DBC987279A3734",
       "hash": "17af34dbefad5c45d23df3e4e81b0addc78782db0ed2e8e491a1532761463e1e"
     },
     "x86_64_windows": {
+      "url": "https://github.com/drahnr/cargo-spellcheck/releases/download/v0.13.1/cargo-spellcheck-v0.13.1-x86_64-pc-windows-gnu.exe",
       "etag": "0x8DBC9875250341E",
       "hash": "d18c19a3c5e7eb9ea516e691b54a4517a60517b6b1fb75b7f56a0c1dcc9b177e"
     }
   },
   "0.13.0": {
     "x86_64_linux_gnu": {
+      "url": "https://github.com/drahnr/cargo-spellcheck/releases/download/v0.13.0/cargo-spellcheck-v0.13.0-x86_64-unknown-linux-gnu",
       "etag": "0x8DB98F2A6C10BCB",
       "hash": "41e99240e55f38cc6d43d7ea9f2ccd448f584eefdc262129e4238f057d995923"
     },
     "x86_64_windows": {
+      "url": "https://github.com/drahnr/cargo-spellcheck/releases/download/v0.13.0/cargo-spellcheck-v0.13.0-x86_64-pc-windows-gnu.exe",
       "etag": "0x8DB98F240CB78CC",
       "hash": "57d45d5942d7ccd49599aae549c0bd5d906868eaeb39481088e55001d65f4784"
     }

manifests/mdbook-d2.json

@@ -0,0 +1,61 @@
+{
+  "rust_crate": "mdbook-d2",
+  "template": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/danieleades/mdbook-d2/releases/download/v${version}/mdbook-d2-x86_64-unknown-linux-musl.tar.gz",
+      "bin": "mdbook-d2"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/danieleades/mdbook-d2/releases/download/v${version}/mdbook-d2-x86_64-apple-darwin.tar.gz",
+      "bin": "mdbook-d2"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/danieleades/mdbook-d2/releases/download/v${version}/mdbook-d2-x86_64-pc-windows-msvc.tar.gz",
+      "bin": "mdbook-d2.exe"
+    },
+    "aarch64_linux_musl": {
+      "url": "https://github.com/danieleades/mdbook-d2/releases/download/v${version}/mdbook-d2-aarch64-unknown-linux-musl.tar.gz",
+      "bin": "mdbook-d2"
+    },
+    "aarch64_macos": {
+      "url": "https://github.com/danieleades/mdbook-d2/releases/download/v${version}/mdbook-d2-aarch64-apple-darwin.tar.gz",
+      "bin": "mdbook-d2"
+    },
+    "aarch64_windows": {
+      "url": "https://github.com/danieleades/mdbook-d2/releases/download/v${version}/mdbook-d2-aarch64-pc-windows-msvc.tar.gz",
+      "bin": "mdbook-d2.exe"
+    }
+  },
+  "latest": {
+    "version": "0.3.8"
+  },
+  "0.3": {
+    "version": "0.3.8"
+  },
+  "0.3.8": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE4D1050CFDFE1",
+      "hash": "6601ff37d3f220db0c9617b85c7e80f985a13ea75e2b6bb88b5158ea429455b6"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE4D104B08EF36",
+      "hash": "0ce3bf83daa8f4d458d9acf3cc5e9af1fc85d864854439a8a7d45a9a48166eaf"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE4D106181D5F5",
+      "hash": "89ba967c1f95b32d05612183b9752aeccafa749d5dce0680fb9dcbfda24285fd"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE4D104E5464C8",
+      "hash": "84f37cb1d89f6fabbefb5581205f93035fe5d9f2ace32f01cb76622cb563a9c1"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE4D104A941BA3",
+      "hash": "dcd49feace49c4adce583cfab121885cd84b746fdad6ebc99ca36eb52272f849"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE4D1061C79129",
+      "hash": "6cc7507acae02d73719b260dffd33c3b1d74029cfa97cc7edfe220f8489aef02"
+    }
+  }
+}

manifests/mise.json

@@ -32,6 +32,32 @@
   "2026": {
     "version": "2026.4.28"
   },
+  "2026.5.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DEA9471A2EEE95",
+      "hash": "f47a11b64b32f94db74b6792601bd9b0440bf4fe4d1e54056738b3e1eeff13db"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DEA9471C55F180",
+      "hash": "8335873c9280e2dca0b1ceeb0298f2905188732fe128e0f97672f7796bdecbd7"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DEA9471D67181D",
+      "hash": "053de50b0ee574a40ebcca667c17e27b06423bfed3779c623970e0e36e1d6405"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DEA94716D421D2",
+      "hash": "9ff141301ad0eb05ed98c45195de6af9f4f6a2b7ec8ae1acab845e65e4aa1c43"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DEA9471BAE1289",
+      "hash": "c4b34f7d4831f7d296bbd3b1ae50ecca5cbe404650575472c0db6bcaad8bb4e5"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DEA9471D4C0D77",
+      "hash": "43bfe834b2c420b467114cea698f08b8aee26b6be748ec046e8a06915d5003ac"
+    }
+  },
   "2026.4": {
     "version": "2026.4.28"
   },

manifests/osv-scanner.json

@@ -2,13 +2,13 @@
   "rust_crate": null,
   "template": null,
   "latest": {
-    "version": "2.3.5"
+    "version": "2.3.6"
   },
   "2": {
-    "version": "2.3.5"
+    "version": "2.3.6"
   },
   "2.3": {
-    "version": "2.3.5"
+    "version": "2.3.6"
   },
   "2.3.6": {
     "x86_64_linux_musl": {

manifests/rclone.json

@@ -27,10 +27,13 @@
     }
   },
   "latest": {
-    "version": "1.73.5"
+    "version": "1.74.0"
   },
   "1": {
-    "version": "1.73.5"
+    "version": "1.74.0"
+  },
+  "1.74": {
+    "version": "1.74.0"
   },
   "1.74.0": {
     "x86_64_linux_musl": {

manifests/syft.json

@@ -35,10 +35,13 @@
     }
   },
   "latest": {
-    "version": "1.43.0"
+    "version": "1.44.0"
   },
   "1": {
-    "version": "1.43.0"
+    "version": "1.44.0"
+  },
+  "1.44": {
+    "version": "1.44.0"
   },
   "1.44.0": {
     "x86_64_linux_musl": {

manifests/tombi.json

@@ -2,10 +2,46 @@
   "rust_crate": null,
   "template": null,
   "latest": {
-    "version": "0.10.1"
+    "version": "0.10.2"
   },
   "0.10": {
-    "version": "0.10.1"
+    "version": "0.10.2"
+  },
+  "0.10.2": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/tombi-toml/tombi/releases/download/v0.10.2/tombi-cli-0.10.2-x86_64-unknown-linux-musl.tar.gz",
+      "etag": "0x8DEA86927EBA7E7",
+      "hash": "c4268eaaea8a7eb23c8578b5d8976b2490e748670a3725db4f5e4352f9d3076c",
+      "bin": "tombi-cli-0.10.2-x86_64-unknown-linux-musl/tombi"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/tombi-toml/tombi/releases/download/v0.10.2/tombi-cli-0.10.2-x86_64-apple-darwin.tar.gz",
+      "etag": "0x8DEA86927DE9741",
+      "hash": "b3ed94dc4396f565728a7ccb08de466de13607b3f4e73741ab5a3d13571e46f7",
+      "bin": "tombi-cli-0.10.2-x86_64-apple-darwin/tombi"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/tombi-toml/tombi/releases/download/v0.10.2/tombi-cli-0.10.2-x86_64-pc-windows-msvc.zip",
+      "etag": "0x8DEA86927F5AEC2",
+      "hash": "8ecfb32d7fe90612a626a25500fa92a9b4e42dbad6a00f202849901a058dd6a7"
+    },
+    "aarch64_linux_musl": {
+      "url": "https://github.com/tombi-toml/tombi/releases/download/v0.10.2/tombi-cli-0.10.2-aarch64-unknown-linux-musl.tar.gz",
+      "etag": "0x8DEA869285CD610",
+      "hash": "9cb16ec45802bc84cb76bb955facb4f1c5de9bd36f349075765ed12d180ceccf",
+      "bin": "tombi-cli-0.10.2-aarch64-unknown-linux-musl/tombi"
+    },
+    "aarch64_macos": {
+      "url": "https://github.com/tombi-toml/tombi/releases/download/v0.10.2/tombi-cli-0.10.2-aarch64-apple-darwin.tar.gz",
+      "etag": "0x8DEA86927DA2F62",
+      "hash": "e456b5518923f1c3b3b136aa92c57aa9ffc6f27d8ce155af337509d3f5a3a619",
+      "bin": "tombi-cli-0.10.2-aarch64-apple-darwin/tombi"
+    },
+    "aarch64_windows": {
+      "url": "https://github.com/tombi-toml/tombi/releases/download/v0.10.2/tombi-cli-0.10.2-aarch64-pc-windows-msvc.zip",
+      "etag": "0x8DEA86927F2095A",
+      "hash": "532d25f214564bf685b2bfbd21cf2202c70ff4d8c66b0e449ca669bcffd9eba2"
+    }
   },
   "0.10.1": {
     "x86_64_linux_musl": {

tools/ci/tool-list.sh

@@ -6,11 +6,13 @@ trap -- 's=$?; printf >&2 "%s\n" "${0##*/}:${LINENO}: \`${BASH_COMMAND}\` exit w
 cd -- "$(dirname -- "$0")"/../..
 
 # They don't provide prebuilt binaries for musl or old glibc host.
-# version `GLIBC_2.35' not found
+# version `GLIBC_2.39' not found
 glibc_pre_2_39_incompat=(
   cargo-deb
+  cargo-spellcheck
   zizmor
 )
+# version `GLIBC_2.35' not found
 glibc_pre_2_35_incompat=(
   "${glibc_pre_2_39_incompat[@]}"
   zola
@@ -19,7 +21,6 @@ glibc_pre_2_35_incompat=(
 glibc_pre_2_34_incompat=(
   "${glibc_pre_2_35_incompat[@]}"
   cargo-sort
-  cargo-spellcheck
   espup
   wait-for-them
   xbuild
@@ -149,6 +150,10 @@ for manifest in tools/codegen/base/*.json; do
   fi
   case "${host_os}" in
     linux*)
+      # cargo-apple-runner is not supported on Linux
+      if [[ "${tool_name}" == "cargo-apple-runner" ]]; then
+        continue
+      fi
       if [[ "${host_arch}" != "x86_64" ]] && [[ "$(jq -r --arg p "${host_arch}_${host_os}_gnu" '.platform[$p]' "${manifest}")" == "null" ]] && [[ "$(jq -r --arg p "${host_arch}_${host_os}_musl" '.platform[$p]' "${manifest}")" == "null" ]]; then
         continue
       fi
@@ -191,12 +196,11 @@ fi
 # Not manifest-based
 case "${host_os}" in
   linux*)
-    # TODO: disable valgrind due to Canonical's incident.
     # Installing snap to container is difficult...
     # Specifying the version of valgrind is not supported.
-    # if type -P snap >/dev/null && [[ "${version}" == "latest" ]]; then
+    if type -P snap >/dev/null && [[ "${version}" == "latest" ]]; then
-    #   tools+=(valgrind)
+      tools+=(valgrind)
-    # fi
+    fi
     ;;
 esac
 # cargo-watch/watchexec-cli is supported by cargo-binstall (through quickinstall)

tools/codegen/base/cargo-apple-runner.json

@@ -0,0 +1,11 @@
+{
+  "repository": "https://github.com/madsmtm/cargo-apple-runner",
+  "license_markdown": "[Zlib](https://github.com/madsmtm/cargo-apple-runner/blob/main/LICENSE-ZLIB.txt) OR [Apache-2.0](https://github.com/madsmtm/cargo-apple-runner/blob/main/LICENSE-APACHE.txt) OR [MIT](https://github.com/madsmtm/cargo-apple-runner/blob/main/LICENSE-MIT.txt)",
+  "tag_prefix": "v",
+  "rust_crate": "${package}",
+  "asset_name": "${package}-${rust_target}.tar.gz",
+  "platform": {
+    "x86_64_macos": {},
+    "aarch64_macos": {}
+  }
+}

tools/codegen/base/cargo-binstall.json

@@ -4,7 +4,7 @@
   "tag_prefix": "v",
   "rust_crate": "${package}",
   "asset_name": "${package}-${rust_target}.zip",
-  "version_range": "latest",
+  "version_range": "=1.18.1",
   "signing": {
     "kind": "minisign-binstall"
   },
@@ -18,6 +18,9 @@
       "asset_name": "${package}-${rust_target}.tgz"
     },
     "aarch64_macos": {},
-    "aarch64_windows": {}
+    "aarch64_windows": {},
+    "riscv64_linux_musl": {
+      "asset_name": "${package}-${rust_target}.tgz"
+    }
   }
 }

tools/codegen/base/cargo-spellcheck.json

@@ -3,12 +3,17 @@
   "license_markdown": "[LGPLv2.1](https://github.com/drahnr/cargo-spellcheck/blob/master/LICENSE-LGPL)",
   "tag_prefix": "v",
   "rust_crate": "${package}",
-  "asset_name": "${package}-v${version}-${rust_target}",
+  "asset_name": "${package}-v${version}-${rust_target}${exe}",
   "version_range": ">= 0.13",
   "platform": {
     "x86_64_linux_gnu": {},
     "x86_64_windows": {
-      "asset_name": "${package}-v${version}-x86_64-pc-windows-gnu.exe"
+      "asset_name": [
-    }
+        "${package}-v${version}-${rust_target}${exe}",
+        "${package}-v${version}-x86_64-pc-windows-gnu${exe}"
+      ]
+    },
+    "aarch64_linux_gnu": {},
+    "aarch64_windows": {}
   }
 }

tools/codegen/base/mdbook-d2.json

@@ -0,0 +1,20 @@
+{
+  "repository": "https://github.com/danieleades/mdbook-d2",
+  "license_markdown": "[MIT](https://github.com/danieleades/mdbook-d2/blob/main/LICENSE)",
+  "tag_prefix": "v",
+  "rust_crate": "${package}",
+  "asset_name": [
+    "${package}-${rust_target}.tar.gz",
+    "${package}-${rust_target}.zip"
+  ],
+  "bin": "${package}${exe}",
+  "version_range": ">= 0.3.8",
+  "platform": {
+    "x86_64_linux_musl": {},
+    "x86_64_macos": {},
+    "x86_64_windows": {},
+    "aarch64_linux_musl": {},
+    "aarch64_macos": {},
+    "aarch64_windows": {}
+  }
+}

tools/codegen/src/main.rs

@@ -129,7 +129,9 @@ fn main() {
 
     let mut latest_only = false;
     if let Some(version_range) = &base_info.version_range {
-        if version_range == "latest" {
+        if version_range == "latest"
+            || version_range.starts_with('=') && !version_range.contains(',')
+        {
             latest_only = true;
         }
     }
@@ -171,13 +173,20 @@ fn main() {
 
     let version_req: semver::VersionReq = match version_req {
         _ if latest_only => {
-            // Exclude very recently released version from candidate for latest version.
+            let version_range = base_info.version_range.as_ref().unwrap();
-            let req =
+            if version_range == "latest" {
-                format!("={}", releases.iter().find(|r| r.1.1.published_at <= before).unwrap().0.0)
+                // Exclude very recently released version from candidate for latest version.
-                    .parse()
+                let req = format!(
-                    .unwrap();
+                    "={}",
-            eprintln!("update manifest for versions '{req}'");
+                    releases.iter().find(|r| r.1.1.published_at <= before).unwrap().0.0
-            req
+                )
+                .parse()
+                .unwrap();
+                eprintln!("update manifest for versions '{req}'");
+                req
+            } else {
+                version_range.parse().unwrap()
+            }
         }
         None => match base_info.version_range {
             Some(version_range) => version_range.parse().unwrap(),

tools/tidy.sh

@@ -9,13 +9,22 @@ cd -- "$(dirname -- "$0")"/..
 #    GITHUB_TOKEN=$(gh auth token) ./tools/tidy.sh
 #
 # Note: This script requires the following tools:
-# - docker
+# - docker or podman (or compatible CLI specified by TIDY_DOCKER_PATH. when both available and TIDY_DOCKER_PATH is not set, docker is preferred)
 #
 # This script is shared by projects under github.com/taiki-e, so there may also
 # be checks for files not included in this repository, but they will be skipped
 # if the corresponding files do not exist.
 # It is not intended for manual editing.
 
+bail() {
+  if [[ -n "${GITHUB_ACTIONS:-}" ]]; then
+    printf '::error::%s\n' "$*"
+  else
+    printf >&2 'error: %s\n' "$*"
+  fi
+  exit 1
+}
+
 if [[ $# -gt 0 ]]; then
   cat <<EOF
 USAGE:
@@ -24,10 +33,11 @@ EOF
   exit 1
 fi
 
+image='ghcr.io/taiki-e/tidy'
 if [[ -n "${TIDY_DEV:-}" ]]; then
-  image="ghcr.io/taiki-e/tidy:latest"
+  image+=':latest'
 else
-  image="ghcr.io/taiki-e/tidy@sha256:71def761a5585e83a2672c4051aee13cd886ad5571215aee52f193454bb3cdff"
+  image+='@sha256:4d7ec52a86bd3c0a2d96627b0ec3aa534afc02c2d56fc9a898df64e29aa03312'
 fi
 user="$(id -u):$(id -g)"
 workdir=$(pwd)
@@ -40,8 +50,12 @@ color=''
 if [[ -t 1 ]] || [[ -n "${GITHUB_ACTIONS:-}" ]]; then
   color=1
 fi
+# Refs:
+# - https://docs.docker.com/reference/cli/docker/container/run/
+# - https://docs.podman.io/en/latest/markdown/podman-run.1.html
+# - https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html
 common_args=(
-  run --rm --init -i --user "${user}"
+  run --rm --init
   --cap-drop=all
   --security-opt=no-new-privileges
   --read-only
@@ -59,6 +73,30 @@ common_args=(
   --env TIDY_EXPECTED_SHELL_FILE_COUNT
   --env TIDY_EXPECTED_DOCKER_FILE_COUNT
 )
+if [[ -n "${TIDY_DOCKER_PATH:-}" ]]; then
+  docker="${TIDY_DOCKER_PATH}"
+elif type -P docker >/dev/null; then
+  docker='docker'
+elif type -P podman >/dev/null; then
+  docker='podman'
+else
+  bail 'this script requires docker or podman'
+fi
+rootless=''
+if [[ "$("${docker}" --version)" == *'podman'* ]]; then
+  if [[ "$("${docker}" info)" == *'rootless: true'* ]]; then
+    rootless=1
+  fi
+elif [[ "$("${docker}" info -f '{{println .SecurityOptions}}')" == *'rootless'* ]]; then
+  rootless=1
+fi
+if [[ -n "${rootless}" ]]; then
+  printf 'docker path: %s\n' "${docker} (rootless)"
+else
+  printf 'docker path: %s\n' "${docker}"
+  common_args+=(--user "${user}")
+fi
+
 # Map ignored files (e.g., .env) to dummy files.
 while IFS= read -r path; do
   if [[ -d "${path}" ]]; then
@@ -73,7 +111,7 @@ while IFS= read -r path; do
 done < <(git status --porcelain --ignored | grep -E '^!!' | cut -d' ' -f2)
 
 docker_run() {
-  docker "${common_args[@]}" "$@"
+  "${docker}" "${common_args[@]}" "$@"
   code2="$?"
   if [[ ${code} -eq 0 ]] && [[ ${code2} -ne 0 ]]; then
     code="${code2}"
@@ -83,6 +121,7 @@ docker_run() {
 set +e
 docker_run \
   --mount "type=bind,source=${workdir},target=${workdir}" --workdir "${workdir}" \
+  --mount "type=bind,source=${workdir}/.git,target=${workdir}/.git,readonly" \
   --mount "type=bind,source=${tmp}/tmp,target=/tmp/tidy" \
   --mount "type=bind,source=${tmp}/pwsh-cache,target=/.cache/powershell" \
   --mount "type=bind,source=${tmp}/pwsh-local,target=/.local/share/powershell" \