Update wasm-bindgen manifest

```
verifying https://github.com/astral-sh/uv/releases/download/0.11.9/uv-x86_64-unknown-linux-musl.tar.gz with gh attestation verify

Error: HTTP 404: Not Found (https://api.github.com/repos/astral-sh/uv/attestations/sha256:ac3e5051edbf30613b0f90d1c18d4807fea6b246f37490799fee0c1284a658b2?per_page=30&predicate_type=https://slsa.dev/provenance/v1)
```

https://github.com/astral-sh/uv/issues/19278

.github/.cspell/project-dictionary.txt

@@ -34,7 +34,6 @@ rdme
 rootfs
 sccache
 SHASUMS
-shortstat
 sigstore
 startswith
 syft
@@ -43,7 +42,6 @@ udeps
 USERPROFILE
 wasmtime
 watchexec
-worktree
 xbuild
 xscale
 xwin

.github/workflows/ci.yml

@@ -32,20 +32,20 @@ concurrency:
 
 jobs:
   miri:
-    uses: taiki-e/github-actions/.github/workflows/miri.yml@68753a4331ec78cb842512fd16ae32da0c066e31 # main
+    uses: taiki-e/github-actions/.github/workflows/miri.yml@2474ed4664eb8903c151603a9d841512c069f7f6 # main
     with:
       # NB: sync with test job's --exclude option
       args: --exclude install-action-internal-codegen
   msrv:
-    uses: taiki-e/github-actions/.github/workflows/msrv.yml@68753a4331ec78cb842512fd16ae32da0c066e31 # main
+    uses: taiki-e/github-actions/.github/workflows/msrv.yml@2474ed4664eb8903c151603a9d841512c069f7f6 # main
   test-manifest-schema:
-    uses: taiki-e/github-actions/.github/workflows/test.yml@68753a4331ec78cb842512fd16ae32da0c066e31 # main
+    uses: taiki-e/github-actions/.github/workflows/test.yml@2474ed4664eb8903c151603a9d841512c069f7f6 # main
     with:
       # NB: sync with miri job's --exclude option
       test-args: --exclude install-action-internal-codegen
       no-std: false
   tidy:
-    uses: taiki-e/github-actions/.github/workflows/tidy.yml@68753a4331ec78cb842512fd16ae32da0c066e31 # main
+    uses: taiki-e/github-actions/.github/workflows/tidy.yml@2474ed4664eb8903c151603a9d841512c069f7f6 # main
     permissions:
       contents: write # for creating branch for pr
       pull-requests: write # unused (used in `codegen-automerge: true` case)
@@ -117,26 +117,24 @@ jobs:
       - uses: ./
         with:
           tool: ${{ steps.tool-list.outputs.tool }}
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       # Test all shells listed in https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsshell
       - name: Test bash
-        run: just --version && shfmt --version && protoc --version
+        run: just --version && shfmt --version && protoc --version && rustc --version && cargo --version && rustup --version
         shell: bash
       - name: Test sh
-        run: just --version && shfmt --version && protoc --version
+        run: just --version && shfmt --version && protoc --version && rustc --version && cargo --version && rustup --version
         shell: sh
         if: startsWith(matrix.os, 'ubuntu') || startsWith(matrix.os, 'macos')
       - name: Test pwsh
-        run: just --version; shfmt --version; protoc --version
+        run: just --version; shfmt --version; protoc --version; rustc --version; cargo --version; rustup --version
         shell: pwsh
         if: matrix.os != 'ubuntu-slim'
       - name: Test powershell
-        run: just --version; shfmt --version; protoc --version
+        run: just --version; shfmt --version; protoc --version; rustc --version; cargo --version; rustup --version
         shell: powershell
         if: startsWith(matrix.os, 'windows')
       - name: Test cmd
-        run: just --version & shfmt --version & protoc --version
+        run: just --version & shfmt --version & protoc --version & rustc --version & cargo --version & rustup --version
         shell: cmd # zizmor: ignore[misfeature] used for compatibility testing
         if: startsWith(matrix.os, 'windows')
       # We use the version output to check the version of cargo-binstall, but they
@@ -159,7 +157,7 @@ jobs:
       - run: env
       - uses: ./
         with:
-          # NB: Update alias list in release.yml, case for aliases in main.sh,
+          # NB: Update alias list in tools/ci/release-post-commit.sh, case for aliases in main.sh,
           # and match for alias for tools/codegen/src/tools-markdown.rs.
           tool: |
             nextest
@@ -167,8 +165,6 @@ jobs:
             typos-cli
             wasm-bindgen-cli
             wasmtime-cli
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Test bash
         run: cargo-nextest nextest --version && taplo --version
         shell: bash
@@ -300,6 +296,10 @@ jobs:
         env:
           CONTAINER: ${{ matrix.container }}
         if: startsWith(matrix.container, 'centos')
+      # gcc for rustc
+      - run: apk --no-cache add gcc
+        shell: sh
+        if: startsWith(matrix.container, 'alpine')
       - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
       # cross attempts to install rust-src when Cargo.toml is available even if `cross --version`
       - run: rm -- Cargo.toml
@@ -315,8 +315,6 @@ jobs:
       - uses: ./
         with:
           tool: ${{ steps.tool-list.outputs.tool }}
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Test bash
         run: just --version && shfmt --version
         shell: bash

.github/workflows/manifest.yml

@@ -32,7 +32,7 @@ concurrency:
 
 jobs:
   manifest:
-    uses: taiki-e/github-actions/.github/workflows/gen.yml@68753a4331ec78cb842512fd16ae32da0c066e31 # main
+    uses: taiki-e/github-actions/.github/workflows/gen.yml@2474ed4664eb8903c151603a9d841512c069f7f6 # main
     permissions:
       contents: write # for creating branch for pr
       pull-requests: write # for gh pr review --approve
@@ -46,3 +46,4 @@ jobs:
       automerge: true
       install-rust: true
       install-cosign: true
+      install-parse-changelog: true

.github/workflows/release.yml

@@ -1,7 +1,5 @@
 name: Release
 
-# Adapted from https://github.com/taiki-e/github-actions/blob/HEAD/.github/workflows/action-release.yml.
-
 permissions: {}
 
 on:
@@ -32,408 +30,21 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
-  prepare:
-    if: github.repository_owner == 'taiki-e' && inputs.target == 'install-action'
-    runs-on: ubuntu-24.04
-    timeout-minutes: 60
-    steps:
-      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
-      - uses: taiki-e/install-action@58e862542551f667fa44c8a2a4a1d64ad477c96a # v2.75.17
-        with:
-          tool: parse-changelog
-          fallback: none
-      - id: check
-        run: |
-          IFS=$'\n\t'
-          trap -- 's=$?; printf >&2 "%s\n" "${0##*/}:${LINENO}: \`${BASH_COMMAND}\` exit with ${s}"; exit ${s}' ERR
-          retry() {
-            for i in {1..10}; do
-              if "$@"; then
-                return 0
-              else
-                sleep "${i}"
-              fi
-            done
-            "$@"
-          }
-          bail() {
-            printf '::error::%s\n' "$*"
-            exit 1
-          }
-          if { sed --help 2>&1 || true; } | grep -Eq -e '-i extension'; then
-            in_place=(-i '')
-          else
-            in_place=(-i)
-          fi
-
-          # shellcheck disable=SC2153
-          version="${VERSION}"
-          printf 'version(input): %s\n' "${version}"
-          # shellcheck disable=SC2153
-          tag_prefix="${TAG_PREFIX}"
-          printf 'tag_prefix: %s\n' "${tag_prefix}"
-          # shellcheck disable=SC2153
-          changelog="${CHANGELOG}"
-          printf 'changelog: %s\n' "${changelog}"
-
-          # Get the current date.
-          release_date=$(date -u '+%Y-%m-%d')
-          printf 'release-date: %s\n' "${release_date}"
-          printf 'release-date=%s\n' "${release_date}" >>"${GITHUB_OUTPUT}"
-
-          # Get the current revision.
-          rev=$(git rev-parse HEAD)
-          printf 'rev: %s\n' "${rev}"
-          printf 'rev=%s\n' "${rev}" >>"${GITHUB_OUTPUT}"
-
-          prev_version=$(parse-changelog --title-no-link "${changelog}" | cut -d' ' -f1)
-
-          # Determine the new version number and tag name.
-          case "${version}" in
-            major | minor | patch)
-              if [[ ! "${prev_version}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-                bail "pre-release/build-metadata"
-              fi
-              major="${prev_version%%.*}"
-              minor_patch="${prev_version#*.}"
-              minor="${minor_patch%%.*}"
-              patch="${minor_patch#*.}"
-              case "${version}" in
-                major) version="$((major+1)).0.0" ;;
-                minor) version="${major}.$((minor+1)).0" ;;
-                patch) version="${major}.${minor}.$((patch+1))" ;;
-              esac
-              ;;
-            *) version="${version#v}" ;;
-          esac
-          if [[ ! "${version}" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z\.-]+)?(\+[0-9A-Za-z\.-]+)?$ ]]; then
-            bail "invalid version format '${version}'"
-          fi
-          printf 'version: %s\n' "${version}"
-          printf 'version=%s\n' "${version}" >>"${GITHUB_OUTPUT}"
-          tag="${tag_prefix}${version}"
-          printf 'tag: %s\n' "${tag}"
-          printf 'tag=%s\n' "${tag}" >>"${GITHUB_OUTPUT}"
-
-          # Make sure the same release has not been created in the past.
-          if gh release view "${tag}" &>/dev/null; then
-            bail "tag '${tag}' has already been created and pushed"
-          fi
-          # Make sure that the release was created from an allowed branch.
-          if ! git branch | grep -Eq '\* '"${BRANCH}"'$'; then
-            bail "current branch is not '${BRANCH}'"
-          fi
-
-          changed_paths=()
-          retry git fetch origin --tags &>/dev/null
-          tags=$(git --no-pager tag | { grep -E "^${tag_prefix}[0-9]+" || true; })
-          if [[ -n "${tags}" ]]; then
-            printf 'has-tags=true\n' >>"${GITHUB_OUTPUT}"
-            # Make sure the same release does not exist in changelog.
-            if grep -Eq "^## \\[${version//./\\.}\\]" "${changelog}"; then
-              bail "release ${version} already exist in ${changelog}"
-            fi
-            if grep -Eq "^\\[${version//./\\.}\\]: " "${changelog}"; then
-              bail "link to ${version} already exist in ${changelog}"
-            fi
-
-            # Update changelog.
-            changed_paths+=("${changelog}")
-            remote_url=$(grep -E '^\[Unreleased\]: https://' "${changelog}" | sed -E 's/^\[Unreleased\]: //; s/\.\.\.HEAD$//')
-            prev_tag="${remote_url#*/compare/}"
-            remote_url="${remote_url%/compare/*}"
-            sed -E "${in_place[@]}" \
-              -e "s/^## \\[Unreleased\\]/## [Unreleased]\\n\\n## [${version}] - ${release_date}/" \
-              -e "s#^\[Unreleased\]: https://.*#[Unreleased]: ${remote_url}/compare/${tag}...HEAD\\n[${version}]: ${remote_url}/compare/${prev_tag}...${tag}#" "${changelog}"
-            if ! grep -Eq "^## \\[${version//./\\.}\\] - ${release_date}$" "${changelog}"; then
-              bail "failed to update ${changelog}"
-            fi
-            if ! grep -Eq "^\\[${version//./\\.}\\]: " "${changelog}"; then
-              bail "failed to update ${changelog}"
-            fi
-          else
-            # Make sure the release exists in changelog.
-            if ! grep -Eq "^## \\[${version//./\\.}\\] - ${release_date}$" "${changelog}"; then
-              bail "release ${version} does not exist in ${changelog} or has wrong release date"
-            fi
-            if ! grep -Eq "^\\[${version//./\\.}\\]: " "${changelog}"; then
-              bail "link to ${version} does not exist in ${changelog}"
-            fi
-          fi
-          # Make sure that a valid release note for this version exists.
-          # https://github.com/taiki-e/parse-changelog
-          changes=$(parse-changelog "${changelog}" "${version}")
-          if [[ -z "${changes}" ]]; then
-            bail "changelog for ${version} has no body"
-          fi
-          printf '============== CHANGELOG ==============\n'
-          printf '%s\n' "${changes}"
-          printf '=======================================\n'
-
-          if [[ -n "${tags}" ]]; then
-            git -c color.ui=always diff "${changed_paths[@]}"
-            git add "${changed_paths[@]}"
-          fi
-          # Make sure that there is no unintended change.
-          git add -N .
-          git -c color.ui=always diff --exit-code
-
-          (
-            set -x
-            git show HEAD --shortstat
-          )
-        env:
-          VERSION: ${{ inputs.version }}
-          TAG_PREFIX: v
-          CHANGELOG: CHANGELOG.md
-          BRANCH: main
-    outputs:
-      has-tags: ${{ steps.check.outputs.has-tags }}
-      release-date: ${{ steps.check.outputs.release-date }}
-      rev: ${{ steps.check.outputs.rev }}
-      tag: ${{ steps.check.outputs.tag }}
-      version: ${{ steps.check.outputs.version }}
-
   release:
     if: github.repository_owner == 'taiki-e' && inputs.target == 'install-action'
-    needs: prepare
+    uses: taiki-e/github-actions/.github/workflows/action-release.yml@2474ed4664eb8903c151603a9d841512c069f7f6 # main
-    runs-on: ubuntu-24.04
-    timeout-minutes: 60
-    environment:
-      name: release
-      deployment: false
     permissions:
       contents: write # for taiki-e/create-gh-release-action
-    steps:
+    secrets:
-      - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
+      PUSH_TOKEN_APP_CLIENT_ID: ${{ secrets.PUSH_TOKEN_APP_CLIENT_ID }}
-      - uses: taiki-e/install-action@58e862542551f667fa44c8a2a4a1d64ad477c96a # v2.75.17
+      PUSH_TOKEN_APP_PRIVATE_KEY: ${{ secrets.PUSH_TOKEN_APP_PRIVATE_KEY }}
-        with:
+    with:
-          tool: parse-changelog
+      version: ${{ inputs.version }}
-          fallback: none
+      post-commit-script: tools/ci/release-post-commit.sh
-      - uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
-        id: push-token
-        with:
-          client-id: ${{ secrets.PUSH_TOKEN_APP_CLIENT_ID }}
-          private-key: ${{ secrets.PUSH_TOKEN_APP_PRIVATE_KEY }}
-      - name: Create and push release commit and tag
-        id: push
-        run: |
-          IFS=$'\n\t'
-          trap -- 's=$?; printf >&2 "%s\n" "${0##*/}:${LINENO}: \`${BASH_COMMAND}\` exit with ${s}"; exit ${s}' ERR
-          retry() {
-            for i in {1..10}; do
-              if "$@"; then
-                return 0
-              else
-                sleep "${i}"
-              fi
-            done
-            "$@"
-          }
-          bail() {
-            printf '::error::%s\n' "$*"
-            exit 1
-          }
-          if { sed --help 2>&1 || true; } | grep -Eq -e '-i extension'; then
-            in_place=(-i '')
-          else
-            in_place=(-i)
-          fi
-
-          git config user.name 'Taiki Endo'
-          git config user.email 'te316e89@gmail.com'
-
-          # shellcheck disable=SC2153
-          version="${VERSION}"
-          # shellcheck disable=SC2153
-          tag="${TAG}"
-          # shellcheck disable=SC2153
-          changelog="${CHANGELOG}"
-          # shellcheck disable=SC2153
-          release_date="${RELEASE_DATE}"
-
-          # Make sure the current revision is same as prepare step.
-          # --unshallow is necessary to successfully push the
-          # "releases/${major_version_tag}" branch in the subsequent step.
-          retry git fetch origin --unshallow &>/dev/null
-          rev=$(git rev-parse HEAD)
-          if [[ "${rev}" != "${PREPARE_REV}" ]]; then
-            bail "revision difference between prepare step"
-          fi
-
-          # Make sure the same release has not been created in the past.
-          if gh release view "${tag}" &>/dev/null; then
-            bail "tag '${tag}' has already been created and pushed"
-          fi
-          # Make sure that the release was created from an allowed branch.
-          if ! git branch | grep -Eq '\* '"${BRANCH}"'$'; then
-            bail "current branch is not '${BRANCH}'"
-          fi
-
-          changed_paths=()
-          if [[ "${HAS_TAGS}" == "true" ]]; then
-            # Update changelog.
-            changed_paths+=("${changelog}")
-            remote_url=$(grep -E '^\[Unreleased\]: https://' "${changelog}" | sed -E 's/^\[Unreleased\]: //; s/\.\.\.HEAD$//')
-            prev_tag="${remote_url#*/compare/}"
-            remote_url="${remote_url%/compare/*}"
-            sed -E "${in_place[@]}" \
-              -e "s/^## \\[Unreleased\\]/## [Unreleased]\\n\\n## [${version}] - ${release_date}/" \
-              -e "s#^\[Unreleased\]: https://.*#[Unreleased]: ${remote_url}/compare/${tag}...HEAD\\n[${version}]: ${remote_url}/compare/${prev_tag}...${tag}#" "${changelog}"
-            if ! grep -Eq "^## \\[${version//./\\.}\\] - ${release_date}$" "${changelog}"; then
-              bail "failed to update ${changelog}"
-            fi
-            if ! grep -Eq "^\\[${version//./\\.}\\]: " "${changelog}"; then
-              bail "failed to update ${changelog}"
-            fi
-          fi
-          changes=$(parse-changelog "${changelog}" "${version}")
-          printf '============== CHANGELOG ==============\n'
-          printf '%s\n' "${changes}"
-          printf '=======================================\n'
-
-          if [[ "${HAS_TAGS}" == "true" ]]; then
-            # Create a release commit.
-            (
-              set -x
-              git add "${changed_paths[@]}"
-              git commit -m "Release ${version}"
-            )
-          fi
-
-          major_version_tag="v${version%%.*}"
-          (
-            set -x
-            git tag "${tag}"
-            git branch "releases/${major_version_tag}"
-            git tag -f "${major_version_tag}"
-          )
-          refs=("refs/heads/${BRANCH}" "refs/tags/${tag}" "refs/heads/releases/${major_version_tag}" "+refs/tags/${major_version_tag}")
-
-          tools=()
-          for tool in tools/codegen/base/*.json; do
-            tool="${tool##*/}"
-            tools+=("${tool%.*}")
-          done
-          # Aliases.
-          # NB: Update case for aliases in main.sh, tool input option in test-alias job
-          # in .github/workflows/ci.yml, and match for alias for tools/codegen/src/tools-markdown.rs.
-          tools+=(
-            nextest
-            taplo-cli
-            typos-cli
-            wasm-bindgen-cli
-            wasmtime-cli
-          )
-          # Non-manifest-based tools.
-          tools+=(valgrind)
-
-          branches=()
-          for tool in "${tools[@]}"; do
-            (
-              set -x
-              git checkout -b "releases/${tool}"
-              sed -E "${in_place[@]}" action.yml \
-                -e "s/required: true/required: false/g" \
-                -e "s/# default: #publish:tool/default: ${tool}/g"
-              git add action.yml
-              git commit -m "${tool}"
-              git tag -f "${tool}"
-              git checkout refs/tags/"${tag}"
-            )
-            refs+=("+refs/heads/releases/${tool}" "+refs/tags/${tool}")
-            branches+=("releases/${tool}")
-          done
-
-          prev_credential_helper=$(git config get --local credential.helper || true)
-          if [[ -n "${prev_credential_helper}" ]]; then
-            printf 'credential helper is already set (%s)\n' "${prev_credential_helper}"
-          else
-            protocol="${GITHUB_SERVER_URL%%://*}"
-            hostname="${GITHUB_SERVER_URL#*://}"
-            (
-              set -x
-              git config --local credential.helper cache
-            )
-            git credential approve <<EOF
-          protocol=${protocol}
-          host=${hostname}
-          username=${GITHUB_ACTOR}
-          password=${PUSH_TOKEN}
-          EOF
-            # Remove credential helper config on exit.
-            trap -- '(set -x; git credential-cache exit; git config --local --unset credential.helper || true)' EXIT
-          fi
-
-          (
-            set -x
-            retry git push origin --atomic "${refs[@]}"
-            git branch -d "releases/${major_version_tag}"
-            git branch -D "${branches[@]}"
-
-            schema_workspace=/tmp/workspace
-            rm -rf -- "${schema_workspace}"
-            # Checkout manifest-schema branch
-            schema_version="$(cargo metadata --format-version=1 --no-deps | jq -r '.packages[] | select(.name == "install-action-manifest-schema") | .version')"
-            if [[ "${schema_version}" == "0."* ]]; then
-              schema_version="0.$(cut -d. -f2 <<<"${schema_version}")"
-            else
-              schema_version="$(cut -d. -f1 <<<"${schema_version}")"
-            fi
-            schema_branch="manifest-schema-${schema_version}"
-
-            git worktree add --force "${schema_workspace}"
-            (
-              cd -- "${schema_workspace}"
-              if git fetch origin "${schema_branch}"; then
-                git checkout "origin/${schema_branch}" -B "${schema_branch}"
-              elif ! git checkout "${schema_branch}"; then
-                # New branch with no history. Credit: https://stackoverflow.com/a/13969482
-                git checkout --orphan "${schema_branch}"
-                git rm -rf -- . || true
-                git commit -m 'Initial commit' --allow-empty
-              fi
-            )
-
-            # Copy over schema
-            cp -- ./manifests/* "${schema_workspace}"
-
-            (
-              cd -- "${schema_workspace}"
-              # Stage changes
-              git add .
-              # Detect changes, then commit and push if changes exist
-              if [[ "$(git status --porcelain=v1 | LC_ALL=C wc -l)" != "0" ]]; then
-                git commit -m 'Update manifest schema'
-                retry git push origin HEAD
-              fi
-            )
-
-            rm -rf -- "${schema_workspace}"
-            git worktree prune
-            # TODO: get branch in schema_workspace dir instead
-            git branch -D "${schema_branch}" "${schema_workspace##*/}"
-          )
-        env:
-          VERSION: ${{ needs.prepare.outputs.version }}
-          RELEASE_DATE: ${{ needs.prepare.outputs.release-date }}
-          HAS_TAGS: ${{ needs.prepare.outputs.has-tags }}
-          TAG: ${{ needs.prepare.outputs.tag }}
-          CHANGELOG: CHANGELOG.md
-          BRANCH: main
-          PREPARE_REV: ${{ needs.prepare.outputs.rev }}
-          # Note that if we use secrets.GITHUB_TOKEN, the pushed commit/tag cannot trigger other workflows.
-          PUSH_TOKEN: ${{ steps.push-token.outputs.token }}
-      - uses: taiki-e/create-gh-release-action@eba8ea96c86cca8a37f1b56e94b4d13301fba651 # v1.11.0
-        with:
-          changelog: CHANGELOG.md
-          title: $version
-          branch: main
-          ref: refs/tags/${{ needs.prepare.outputs.tag }}
 
   release-manifest-schema:
     if: github.repository_owner == 'taiki-e' && inputs.target == 'install-action-manifest-schema'
-    uses: taiki-e/github-actions/.github/workflows/rust-release.yml@68753a4331ec78cb842512fd16ae32da0c066e31 # main
+    uses: taiki-e/github-actions/.github/workflows/rust-release.yml@2474ed4664eb8903c151603a9d841512c069f7f6 # main
     permissions:
       contents: write # for taiki-e/create-gh-release-action
       id-token: write # for rust-lang/crates-io-auth-action
@@ -444,7 +55,7 @@ jobs:
     with:
       version: ${{ inputs.version }}
       tag-prefix: install-action-manifest-schema-
-      crates: tools/manifest-schema
+      package: install-action-manifest-schema
       changelog: tools/manifest-schema/CHANGELOG.md
       title: $prefix $version
       prefix: install-action-manifest-schema

CHANGELOG.md

@@ -10,14 +10,65 @@ Note: In this file, do not use the hard wrap in the middle of a sentence for com
 
 ## [Unreleased]
 
+- Update `mise@latest` to 2026.5.1.
+
+- Update `prek@latest` to 0.3.13.
+
+- Update `tombi@latest` to 0.10.4.
+
+## [2.77.1] - 2026-05-05
+
+- Support `taiki-e/install-action@rust` tag.
+
+- Update `tombi@latest` to 0.10.3.
+
+- Update `martin@latest` to 1.8.2.
+
+## [2.77.0] - 2026-05-05
+
+- Support `rust`. ([#1779](https://github.com/taiki-e/install-action/pull/1779))
+
+  This installs rust using rustup.
+
+  If rustup is not yet installed, this action downloads [rustup-init for the current platform](https://rust-lang.github.io/rustup/installation/other.html#manual-installation) using HTTPS with tlsv1.2+, verifies SHA256 checksum, and then installs rustup using it.
+
+  This also supports installing additional components at the same time by `+<additional>` syntax:
+
+  ```yaml
+  - uses: taiki-e/install-action@v2
+    with:
+      # Install rust stable with rustfmt component and wasm32-wasip1 target.
+      tool: rust+rustfmt+wasm32-wasip1
+      # When installing another rust version:
+      # tool: rust@nightly + rustfmt + wasm32-wasip1
+  ```
+
+- Fix issue where x86_64 binary will be installed on AArch64 Windows even when AArch64 Windows binary available.
+
+- Update `mise@latest` to 2026.5.0.
+
+- Diagnostic improvements.
+
+## [2.76.0] - 2026-05-04
+
+- Support `mdbook-d2`. ([#1737](https://github.com/taiki-e/install-action/pull/1737), thanks @nhu)
+
+- Support `cargo-apple-runner`. ([#1731](https://github.com/taiki-e/install-action/pull/1731), thanks @madsmtm)
+
+- Support `cargo-binstall` on riscv64 Linux.
+
+- Update `cargo-deb@latest` to 3.7.0.
+
+- Update `tombi@latest` to 0.10.2.
+
 ## [2.75.30] - 2026-05-03
 
+- Support `cargo-spellcheck` on AArch64 Linux/Windows.
+
 - Update `cargo-spellcheck@latest` to 0.15.7.
 
 - Update `biome@latest` to 2.4.14.
 
-- Support `cargo-spellcheck` on AArch64 Linux/Windows.
-
 ## [2.75.29] - 2026-05-02
 
 - Update `syft@latest` to 1.44.0.
@@ -6423,7 +6474,10 @@ Note: This release is considered a breaking change because installing on version
 
 Initial release
 
-[Unreleased]: https://github.com/taiki-e/install-action/compare/v2.75.30...HEAD
+[Unreleased]: https://github.com/taiki-e/install-action/compare/v2.77.1...HEAD
+[2.77.1]: https://github.com/taiki-e/install-action/compare/v2.77.0...v2.77.1
+[2.77.0]: https://github.com/taiki-e/install-action/compare/v2.76.0...v2.77.0
+[2.76.0]: https://github.com/taiki-e/install-action/compare/v2.75.30...v2.76.0
 [2.75.30]: https://github.com/taiki-e/install-action/compare/v2.75.29...v2.75.30
 [2.75.29]: https://github.com/taiki-e/install-action/compare/v2.75.28...v2.75.29
 [2.75.28]: https://github.com/taiki-e/install-action/compare/v2.75.27...v2.75.28

DEVELOPMENT.md

@@ -36,3 +36,29 @@ to the platform object.
 
 If CI fails only for containers using older versions of glibc or musl, you may need to add the tool
 name to one of the `*_incompat` arrays in `tools/ci/tool-list.sh`.
+
+## Release new version
+
+Releases are performed by running the [release workflow](https://github.com/taiki-e/install-action/actions/workflows/release.yml) via workflow dispatch. The owner and collaborators can start the release workflow, but the owner’s [approval](https://docs.github.com/en/actions/reference/workflows-and-actions/deployments-and-environments#required-reviewers) is required before the actual release.
+
+### Minor version vs patch version
+
+Increase the patch version if only the following changes are included.
+
+- Update the `@latest` version of the tool.
+
+  Rationale: Normally, tool versions are controlled by the `@<version>` syntax, which is explicitly separated from the versioning of the install-action itself.
+
+  Exception: If the major or minor version of the `cargo-binstall` is updated, the minor version may be increased because the behavior of the fallback may change slightly.
+
+- Fix regressions or minor bugs.
+
+  Rationale: Semantic Versioning.
+
+- Improve documentation or diagnostics.
+
+  Rationale: Semantic Versioning.
+
+Usually increase the minor version otherwise.
+
+Adding support for a new tool may conflict with existing fallbacks, so it is necessary to increase the minor version.

README.md

@@ -24,6 +24,7 @@ GitHub Action for installing development tools (mainly from GitHub Releases).
 | ---- | :------: | ----------- | ---- | ------- |
 | tool | **✓** | Tools to install (whitespace or comma separated list) | String | |
 | checksum | | Whether to enable checksums (strongly discouraged to disable) | Boolean | `true` |
+| fallback | | Whether to use fallback (none, cargo-binstall, or cargo-install) | String | `cargo-binstall` |
 
 ### Example workflow
 
@@ -58,6 +59,17 @@ You can also omit patch version.
     tool: cargo-hack@0.5
 ```
 
+For some tools, we support installing additional components at the same time by `+<additional>` syntax:
+
+```yaml
+- uses: taiki-e/install-action@v2
+  with:
+    # Install rust stable with rustfmt component and wasm32-wasip1 target.
+    tool: rust+rustfmt+wasm32-wasip1
+    # When installing another rust version:
+    # tool: rust@nightly + rustfmt + wasm32-wasip1
+```
+
 To install multiple tools:
 
 ```yaml
@@ -73,6 +85,16 @@ Or:
 - uses: taiki-e/install-action@cargo-minimal-versions
 ```
 
+Tool names can also be separated with whitespaces (line, space, tab).
+
+```yaml
+- uses: taiki-e/install-action@v2
+  with:
+    tool: |
+      cargo-hack
+      cargo-minimal-versions
+```
+
 ## Supported tools
 
 See [TOOLS.md](TOOLS.md) for the list of tools that are installed from manifests managed in this action.
@@ -126,7 +148,11 @@ When installing with `tool: <tool_name>` or `tool: <tool_name>@<omitted_version>
 <!-- omit in toc -->
 ### Security on other installation methods
 
-See the linked documentation for information on security when installed using [snap](https://snapcraft.io/docs) or [cargo-binstall](https://github.com/cargo-bins/cargo-binstall#faq).
+See the linked documentation for information on security when installed using [rustup](https://rust-lang.github.io/rustup/security.html), [snap](https://snapcraft.io/docs), or [cargo-binstall](https://github.com/cargo-bins/cargo-binstall#faq).
+
+If the installation method is rustup and rustup is not yet installed, this action downloads [rustup-init for the current platform](https://rust-lang.github.io/rustup/installation/other.html#manual-installation) using HTTPS with tlsv1.2+, verifies SHA256 checksum, and then installs rustup using it.
+
+If the installation method is cargo-binstall and cargo-binstall is not yet installed or outdated, this action installs cargo-binstall [from GitHub Releases](#security-on-installation-from-github-releases).
 
 See the [Supported tools section](#supported-tools) for how to ensure that fallback is not used.
 

TOOLS.md

@@ -16,6 +16,7 @@ See the [Supported tools section in README.md](README.md#supported-tools) for ho
 | ---- | -------------------------------- | ------------------------------- | ------------------ | ------- |
 | [**auto-doc**](https://github.com/tj-actions/auto-doc) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/tj-actions/auto-doc/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/tj-actions/auto-doc/blob/main/LICENSE) |
 | [**biome**](https://biomejs.dev) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/biomejs/biome/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/biomejs/biome/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/biomejs/biome/blob/main/LICENSE-MIT) |
+| [**cargo-apple-runner**](https://github.com/madsmtm/cargo-apple-runner) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/madsmtm/cargo-apple-runner/releases) | macOS | [Zlib](https://github.com/madsmtm/cargo-apple-runner/blob/main/LICENSE-ZLIB.txt) OR [Apache-2.0](https://github.com/madsmtm/cargo-apple-runner/blob/main/LICENSE-APACHE.txt) OR [MIT](https://github.com/madsmtm/cargo-apple-runner/blob/main/LICENSE-MIT.txt) |
 | [**cargo-audit**](https://github.com/rustsec/rustsec/tree/HEAD/cargo-audit) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/rustsec/rustsec/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/rustsec/rustsec/blob/main/cargo-audit/LICENSE-APACHE) OR [MIT](https://github.com/rustsec/rustsec/blob/main/cargo-audit/LICENSE-MIT) |
 | [**cargo-auditable**](https://github.com/rust-secure-code/cargo-auditable) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/rust-secure-code/cargo-auditable/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/rust-secure-code/cargo-auditable/blob/master/LICENSE-APACHE) OR [MIT](https://github.com/rust-secure-code/cargo-auditable/blob/master/LICENSE-MIT) |
 | [**cargo-binstall**](https://github.com/cargo-bins/cargo-binstall) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/cargo-bins/cargo-binstall/releases) | Linux, macOS, Windows | [GPL-3.0](https://github.com/cargo-bins/cargo-binstall/blob/main/crates/bin/LICENSE) |
@@ -67,6 +68,7 @@ See the [Supported tools section in README.md](README.md#supported-tools) for ho
 | [**martin**](https://maplibre.org/martin/) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/maplibre/martin/releases) | Linux, macOS | [MIT](https://github.com/maplibre/martin/blob/main/LICENSE-MIT) OR [Apache-2.0](https://github.com/maplibre/martin/blob/main/LICENSE-APACHE) |
 | [**mdbook**](https://github.com/rust-lang/mdBook) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/rust-lang/mdBook/releases) | Linux, macOS, Windows | [MPL-2.0](https://github.com/rust-lang/mdBook/blob/master/LICENSE) |
 | [**mdbook-alerts**](https://github.com/lambdalisue/rs-mdbook-alerts) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/lambdalisue/rs-mdbook-alerts/releases) | Linux, macOS, Windows | [MIT](https://github.com/lambdalisue/rs-mdbook-alerts/blob/main/LICENSE) |
+| [**mdbook-d2**](https://github.com/danieleades/mdbook-d2) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/danieleades/mdbook-d2/releases) | Linux, macOS, Windows | [MIT](https://github.com/danieleades/mdbook-d2/blob/main/LICENSE) |
 | [**mdbook-linkcheck**](https://github.com/Michael-F-Bryan/mdbook-linkcheck) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/Michael-F-Bryan/mdbook-linkcheck/releases) | Linux, macOS, Windows | [MIT](https://github.com/Michael-F-Bryan/mdbook-linkcheck/blob/master/LICENSE) |
 | [**mdbook-mermaid**](https://github.com/badboy/mdbook-mermaid) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/badboy/mdbook-mermaid/releases) | Linux, macOS, Windows | [MPL-2.0](https://github.com/badboy/mdbook-mermaid/blob/main/LICENSE) |
 | [**mdbook-mermaid-ssr**](https://github.com/CommanderStorm/mdbook-mermaid-ssr) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/CommanderStorm/mdbook-mermaid-ssr/releases) | Linux, macOS, Windows | [MPL-2.0](https://github.com/CommanderStorm/mdbook-mermaid-ssr/blob/main/LICENSE) |
@@ -78,6 +80,7 @@ See the [Supported tools section in README.md](README.md#supported-tools) for ho
 | [**protoc**](https://github.com/protocolbuffers/protobuf) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/protocolbuffers/protobuf/releases) | Linux, macOS, Windows | [BSD-3-Clause](https://github.com/protocolbuffers/protobuf/blob/main/LICENSE) |
 | [**rclone**](https://github.com/rclone/rclone) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/rclone/rclone/releases) | Linux, macOS, Windows | [MIT](https://github.com/rclone/rclone/blob/master/COPYING) |
 | [**release-plz**](https://release-plz.dev/) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/release-plz/release-plz/releases) | Linux, macOS, Windows | [MIT](https://github.com/release-plz/release-plz/blob/main/LICENSE-MIT) OR [Apache-2.0](https://github.com/release-plz/release-plz/blob/main/LICENSE-APACHE) |
+| [**rust**](https://rust-lang.org) | `$CARGO_HOME/bin` | rustup | Linux, macOS, Windows | [Apache-2.0 OR MIT](https://github.com/rust-lang/rust/blob/main/COPYRIGHT) |
 | [**sccache**](https://github.com/mozilla/sccache) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/mozilla/sccache/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/mozilla/sccache/blob/main/LICENSE) |
 | [**shellcheck**](https://www.shellcheck.net) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/koalaman/shellcheck/releases) | Linux, macOS, Windows | [GPL-3.0](https://github.com/koalaman/shellcheck/blob/master/LICENSE) |
 | [**shfmt**](https://github.com/mvdan/sh) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/mvdan/sh/releases) | Linux, macOS, Windows | [BSD-3-Clause](https://github.com/mvdan/sh/blob/master/LICENSE) |

action.yml

@@ -11,7 +11,7 @@ inputs:
     required: false
     default: 'true'
   fallback:
-    description: Whether to use fallback (none, cargo-binstall, cargo-install)
+    description: Whether to use fallback (none, cargo-binstall, or cargo-install)
     required: false
     default: 'cargo-binstall'
 
@@ -22,11 +22,14 @@ runs:
   using: composite
   steps:
     - run: |
+        bail() {
+          printf '::error::install-action: %s\n' "$*"
+          exit 1
+        }
         # If /bin/sh is dash, environment variable containing % is not imported, but is fine
         # because it also means that it will not be exposed to subprocess.
         if /usr/bin/env | grep -Eq '^BASH_FUNC_'; then
-          printf '::error::bash function injection via BASH_FUNC_ environment variable is not allowed for security reasons\n'
+          bail 'bash function injection via BASH_FUNC_ environment variable is not allowed for security reasons'
-          exit 1
         fi
         if ! command -v bash >/dev/null; then
           if grep -Eq '^ID=alpine' /etc/os-release; then
@@ -41,8 +44,7 @@ runs:
             fi
             printf '::endgroup::\n'
           else
-            printf '::error::install-action requires bash\n'
+            bail 'this action requires bash'
-            exit 1
           fi
         fi
         bash --noprofile --norc "${GITHUB_ACTION_PATH:?}/main.sh"
@@ -54,6 +56,8 @@ runs:
         INPUT_FALLBACK: ${{ inputs.fallback }}
         DEFAULT_GITHUB_TOKEN: ${{ inputs.fallback == 'cargo-binstall' && github.token || '' }}
         ACTION_USER_AGENT: ${{ github.action_repository }} (${{ github.action_ref }})
+        RUNNER_OS: ${{ runner.os }}
+        RUNNER_ARCH: ${{ runner.arch }}
       if: runner.os != 'Windows'
     # Use pwsh and retry on bash startup failure to work around windows-11-arm runner bug:
     # https://github.com/actions/partner-runner-images/issues/169
@@ -75,10 +79,10 @@ runs:
             exit $code
           }
           if ($i -lt 10) {
-            Write-Output "::warning::installation failed due to bash startup failure (<https://github.com/actions/partner-runner-images/issues/169>); retrying..."
+            Write-Output "::warning::install-action: installation failed due to bash startup failure (<https://github.com/actions/partner-runner-images/issues/169>); retrying..."
           }
         }
-        Write-Output "::error::installation failed due to bash startup failure (<https://github.com/actions/partner-runner-images/issues/169>); this maybe resolved by re-running job"
+        Write-Output "::error::install-action: installation failed due to bash startup failure (<https://github.com/actions/partner-runner-images/issues/169>); this maybe resolved by re-running job"
         exit 1
       shell: pwsh
       env:
@@ -88,4 +92,6 @@ runs:
         INPUT_FALLBACK: ${{ inputs.fallback }}
         DEFAULT_GITHUB_TOKEN: ${{ inputs.fallback == 'cargo-binstall' && github.token || '' }}
         ACTION_USER_AGENT: ${{ github.action_repository }} (${{ github.action_ref }})
+        RUNNER_OS: ${{ runner.os }}
+        RUNNER_ARCH: ${{ runner.arch }}
       if: runner.os == 'Windows'

main.sh

@@ -9,6 +9,14 @@ rx() {
     "$@"
   )
 }
+g() {
+  IFS=' '
+  local cmd="$*"
+  IFS=$'\n\t'
+  printf '::group::%s\n' "${cmd#retry }"
+  "$@"
+  printf '::endgroup::\n'
+}
 retry() {
   for i in {1..10}; do
     if "$@"; then
@@ -20,11 +28,11 @@ retry() {
   "$@"
 }
 bail() {
-  printf '::error::%s\n' "$*"
+  printf '::error::install-action: %s\n' "$*"
   exit 1
 }
 warn() {
-  printf '::warning::%s\n' "$*"
+  printf '::warning::install-action: %s\n' "$*"
 }
 info() {
   printf >&2 'info: %s\n' "$*"
@@ -35,11 +43,11 @@ normalize_comma_or_space_separated() {
   if [[ "${list}" == *","* ]]; then
     # If a comma is contained, consider it is a comma-separated list.
     # Drop leading and trailing whitespaces in each element.
-    sed -E 's/ *, */,/g; s/^.//; s/,,$/,/' <<<",${list},"
+    sed -E 's/ *\+ */+/g; s/ *, */,/g; s/^.//; s/,,$/,/' <<<",${list},"
   else
     # Otherwise, consider it is a whitespace-separated list.
     # Convert whitespace characters into comma.
-    sed -E 's/ +/,/g; s/^.//' <<<" ${list} "
+    sed -E 's/ *\+ */+/g; s/ +/,/g; s/^.//' <<<" ${list} "
   fi
 }
 _sudo() {
@@ -374,7 +382,7 @@ install_cargo_binstall() {
       info "cargo-binstall already installed at ${cargo_bin}/cargo-binstall${exe}"
       install_binstall=''
     else
-      info "cargo-binstall already installed at ${cargo_bin}/cargo-binstall${exe}, but is not compatible version with install-action, upgrading"
+      info "cargo-binstall already installed at ${cargo_bin}/cargo-binstall${exe}, but is not compatible version with this action, upgrading"
       rm -- "${cargo_bin}/cargo-binstall${exe}"
     fi
   fi
@@ -448,7 +456,16 @@ init_install_action_bin_dir() {
 }
 canonicalize_windows_path() {
   case "${host_os}" in
-    windows) sed -E 's/^\/cygdrive\//\//; s/^\/c\//C:\\/; s/\//\\/g' <<<"$1" ;;
+    windows)
+      local t="$1"
+      if [[ "${t}" == '/cygdrive/'* ]]; then
+        t="${t#/cygdrive}"
+      fi
+      if [[ "${t}" == '/c/'* ]]; then
+        t="${t/\/c\//C:\\}"
+      fi
+      printf '%s\n' "${t//\//\\}"
+      ;;
     *) printf '%s\n' "$1" ;;
   esac
 }
@@ -498,10 +515,13 @@ token="${GITHUB_TOKEN:-"${GH_TOKEN:-"${DEFAULT_GITHUB_TOKEN:-}"}"}"
 # via `ps -Eww` on macOS. It only reduces the risk of leaks.
 unset GITHUB_TOKEN GH_TOKEN DEFAULT_GITHUB_TOKEN
 
-# Refs: https://github.com/rust-lang/rustup/blob/HEAD/rustup-init.sh
+# Refs:
+# - https://github.com/rust-lang/rustup/blob/HEAD/rustup-init.sh
+# - https://docs.github.com/en/actions/reference/workflows-and-actions/contexts#runner-context
+# NB: Sync with tools/ci/tool-list.sh.
 base_distro=''
 exe=''
-case "$(uname -s)" in
+case "${RUNNER_OS}" in
   Linux)
     host_os=linux
     ldd_version=$(ldd --version 2>&1 || true)
@@ -551,16 +571,15 @@ case "$(uname -s)" in
         ;;
     esac
     ;;
-  Darwin) host_os=macos ;;
+  macOS) host_os=macos ;;
-  MINGW* | MSYS* | CYGWIN* | Windows_NT)
+  Windows)
     host_os=windows
     exe=.exe
     ;;
-  *) bail "unrecognized OS type '$(uname -s)'" ;;
+  *) bail "unrecognized runner.os '${RUNNER_OS}'" ;;
 esac
-# NB: Sync with tools/ci/tool-list.sh.
+case "${RUNNER_ARCH}" in
-case "$(uname -m)" in
+  X64) host_arch=x86_64 ;;
-  aarch64 | arm64) host_arch=aarch64 ;;
   # Ignore 32-bit Arm for now, as we need to consider the version and whether hard-float is supported.
   # https://github.com/rust-lang/rustup/pull/593
   # https://github.com/cross-rs/cross/pull/1018
@@ -569,21 +588,32 @@ case "$(uname -m)" in
   # Does it seem only armv7l+ is supported?
   # https://github.com/actions/runner/blob/v2.321.0/src/Misc/externals.sh#L178
   # https://github.com/actions/runner/issues/688
-  xscale | arm | armv*l) bail "32-bit Arm runner is not supported yet by this action; if you need support for this platform, please submit an issue at <https://github.com/taiki-e/install-action>" ;;
+  ARM) bail "32-bit Arm runner is currently not supported; if you need support for this platform, please submit an issue at <https://github.com/taiki-e/install-action>" ;;
-  ppc64le) host_arch=powerpc64le ;;
+  X86) bail "32-bit x86 runner is currently not supported; if you need support for this platform, please submit an issue at <https://github.com/taiki-e/install-action>" ;;
-  riscv64) host_arch=riscv64 ;;
+  ARM64) host_arch=aarch64 ;;
-  s390x) host_arch=s390x ;;
+  PPC64LE) host_arch=powerpc64le ;;
-  # Very few tools provide prebuilt binaries for these.
+  RISCV64) host_arch=riscv64 ;;
-  # TODO: fallback to `cargo install`? (binstall fallback is not good idea here as cargo-binstall doesn't provide prebuilt binaries for these.)
+  S390X) host_arch=s390x ;;
-  loongarch64 | mips | mips64 | ppc | ppc64 | sun4v) bail "$(uname -m) runner is not supported yet by this action; if you need support for this platform, please submit an issue at <https://github.com/taiki-e/install-action>" ;;
+  *)
-  # GitHub Actions Runner supports x86_64/AArch64/Arm Linux and x86_64/AArch64 Windows/macOS.
+    info "unrecognized runner.arch '${RUNNER_ARCH}'; fallback to uname -m"
-  # https://github.com/actions/runner/blob/v2.332.0/.github/workflows/build.yml#L24
+    case "$(uname -m)" in
-  # https://docs.github.com/en/actions/reference/runners/self-hosted-runners#supported-processor-architectures
+      aarch64 | arm64) host_arch=aarch64 ;;
-  # And IBM provides runners for powerpc64le/s390x Linux.
+      xscale | arm | armv*l) bail "32-bit Arm runner is currently not supported; if you need support for this platform, please submit an issue at <https://github.com/taiki-e/install-action>" ;;
-  # https://github.com/IBM/actionspz
+      ppc64le) host_arch=powerpc64le ;;
-  # So we can assume x86_64 unless it has a known non-x86_64 uname -m result.
+      riscv64) host_arch=riscv64 ;;
-  # TODO: uname -m on windows-11-arm returns "x86_64"
+      s390x) host_arch=s390x ;;
-  *) host_arch=x86_64 ;;
+      # Very few tools provide prebuilt binaries for these.
+      # TODO: fallback to `cargo install`? (binstall fallback is not good idea here as cargo-binstall doesn't provide prebuilt binaries for these.)
+      loongarch64 | mips | mips64 | ppc | ppc64 | sun4v) bail "$(uname -m) runner is not supported yet; please submit an issue at <https://github.com/taiki-e/install-action>" ;;
+      # GitHub Actions Runner supports x86_64/AArch64/Arm Linux and x86_64/AArch64 Windows/macOS.
+      # https://github.com/actions/runner/blob/v2.332.0/.github/workflows/build.yml#L24
+      # https://docs.github.com/en/actions/reference/runners/self-hosted-runners#supported-processor-architectures
+      # And IBM provides runners for powerpc64le/s390x Linux.
+      # https://github.com/IBM/actionspz
+      # So we can assume x86_64 unless it has a known non-x86_64 uname -m result.
+      *) host_arch=x86_64 ;;
+    esac
+    ;;
 esac
 info "host platform: ${host_arch}_${host_os}"
 
@@ -673,18 +703,18 @@ case "${host_os}" in
           fi
           printf '::endgroup::\n'
           ;;
-        *) warn "install-action requires at least jq and curl on non-Debian/Fedora/SUSE/Arch/Alpine-based Linux" ;;
+        *) warn "this action requires at least jq and curl on non-Debian/Fedora/SUSE/Arch/Alpine-based Linux" ;;
       esac
     fi
     ;;
   macos)
     if ! type -P jq >/dev/null || ! type -P curl >/dev/null; then
-      warn "install-action requires at least jq and curl on macOS"
+      warn "this action requires at least jq and curl on macOS"
     fi
     ;;
   windows)
     if ! type -P curl >/dev/null; then
-      warn "install-action requires at least curl on Windows"
+      warn "this action requires at least curl on Windows"
     fi
     if [[ -f "${install_action_dir}/jq/bin/jq.exe" ]]; then
       jq() { "${install_action_dir}/jq/bin/jq.exe" -b "$@"; }
@@ -718,20 +748,150 @@ esac
 
 unsupported_tools=()
 for tool in "${tools[@]}"; do
-  if [[ "${tool}" == *"@"* ]]; then
+  additional=''
+  if [[ "${tool}" == *'+'* ]]; then
+    additional="${tool#*+}"
+    tool="${tool%%+*}"
+  fi
+  if [[ "${tool}" == *'@'* ]]; then
     version="${tool#*@}"
     tool="${tool%@*}"
-    if [[ ! "${version}" =~ ^([1-9][0-9]*(\.[0-9]+(\.[0-9]+)?)?|0\.[1-9][0-9]*(\.[0-9]+)?|^0\.0\.[0-9]+)(-[0-9A-Za-z\.-]+)?$|^latest$ ]]; then
+    if [[ "${tool}" != 'rust' ]]; then
-      if [[ ! "${version}" =~ ^([1-9][0-9]*(\.[0-9]+(\.[0-9]+)?)?|0\.[1-9][0-9]*(\.[0-9]+)?|^0\.0\.[0-9]+)(-[0-9A-Za-z\.-]+)?(\+[0-9A-Za-z\.-]+)?$|^latest$ ]]; then
+      if [[ ! "${version}" =~ ^([1-9][0-9]*(\.[0-9]+(\.[0-9]+)?)?|0\.[1-9][0-9]*(\.[0-9]+)?|^0\.0\.[0-9]+)(-[0-9A-Za-z\.-]+)?$|^latest$ ]]; then
-        bail "install-action does not support semver operators: '${version}'"
+        if [[ ! "${version}" =~ ^([1-9][0-9]*(\.[0-9]+(\.[0-9]+)?)?|0\.[1-9][0-9]*(\.[0-9]+)?|^0\.0\.[0-9]+)(-[0-9A-Za-z\.-]+)?(\+[0-9A-Za-z\.-]+)?$|^latest$ ]]; then
+          bail "semver operators are not supported in 'tool' input option: '${version}'"
+        fi
+        bail "install-action v2 does not support semver build-metadata: '${version}'; if you need these supports again, please submit an issue at <https://github.com/taiki-e/install-action>"
       fi
-      bail "install-action v2 does not support semver build-metadata: '${version}'; if you need these supports again, please submit an issue at <https://github.com/taiki-e/install-action>"
     fi
   else
     version=latest
   fi
+  if [[ -n "${additional}" ]]; then
+    case "${tool}" in
+      rust) ;;
+      *) bail "<tool_name>+<additional> syntax is not supported for ${tool}" ;;
+    esac
+  fi
   installed_bin=()
+  # NB: Update tools/ci/release-post-commit.sh when adding non-manifest-based tools.
   case "${tool}" in
+    rust)
+      if [[ "${version}" == 'latest' ]]; then
+        version=stable
+      fi
+      info "installing ${tool}@${version}"
+      export RUSTUP_MAX_RETRIES="${RUSTUP_MAX_RETRIES:-10}"
+      rustup_args=(--profile minimal)
+      if [[ -n "${additional}" ]]; then
+        component=''
+        target=''
+        while read -rd+; do
+          case "${REPLY}" in
+            # Last checked: nightly-2026-05-03
+            # rustup component list
+            # rustup target list
+            cargo | cargo-* | clippy | clippy-* | llvm-* | miri | miri-* | rust-* | rustc-* | rustfmt | rustfmt-*) component+=",${REPLY}" ;;
+            *) target+=",${REPLY}" ;;
+          esac
+        done <<<"${additional}+"
+        if [[ -n "${component}" ]]; then
+          if [[ "${component}," == *',miri,'* ]] && [[ "${component}," != *',rust-src,'* ]]; then
+            component+=',rust-src'
+          fi
+          rustup_args+=(--component "${component#,}")
+        fi
+        if [[ -n "${target}" ]]; then
+          rustup_args+=(--target "${target#,}")
+        fi
+      fi
+      if type -P rustup >/dev/null; then
+        # --no-self-update is necessary because the windows environment cannot self-update rustup.exe.
+        g retry rustup toolchain add "${version}" --no-self-update "${rustup_args[@]}"
+        g rustup default "${version}"
+      else
+        # https://github.com/rust-lang/rustup/tags
+        # Run tools/rustup-hash.sh to get sha256 hash.
+        rustup_version=1.29.0
+        # https://rust-lang.github.io/rustup/installation/other.html#manual-installation
+        rust_target=''
+        checksum=''
+        case "${host_os}" in
+          linux)
+            rust_target="${host_arch}-unknown-${host_os}-${host_env}"
+            case "${host_arch}" in
+              x86_64)
+                case "${host_env}" in
+                  gnu) checksum=4acc9acc76d5079515b46346a485974457b5a79893cfb01112423c89aeb5aa10 ;;
+                  musl) checksum=9cd3fda5fd293890e36ab271af6a786ee22084b5f6c2b83fd8323cec6f0992c1 ;;
+                esac
+                ;;
+              aarch64)
+                case "${host_env}" in
+                  gnu) checksum=9732d6c5e2a098d3521fca8145d826ae0aaa067ef2385ead08e6feac88fa5792 ;;
+                  musl) checksum=88761caacddb92cd79b0b1f939f3990ba1997d701a38b3e8dd6746a562f2a759 ;;
+                esac
+                ;;
+              powerpc64le)
+                case "${host_env}" in
+                  gnu) checksum=4bfff85bd3967d988e14567aa9cc6ab0ea386f0ffeff0f9f14d23f0103bf1f97 ;;
+                  musl) checksum=e15d033af90b7a55d170aac2d82cc28ddd96dbfcdda7c6d4eb8cb064a99c4646 ;;
+                esac
+                ;;
+              riscv64)
+                rust_target="${host_arch}gc-unknown-${host_os}-${host_env}"
+                # riscv64gc-unknown-linux-musl is tier 2 without host tools
+                case "${host_env}" in
+                  gnu) checksum=7e43f2b2e6307d61da17a4dff61e6bceef408b8189822df64e1094590d2a70f9 ;;
+                esac
+                ;;
+              s390x)
+                # s390x-unknown-linux-musl is tier 3
+                case "${host_env}" in
+                  gnu) checksum=66c2c132428b6b77803facb02cbdf33b89d20c00bd20da142be8cb651f2e7cd8 ;;
+                esac
+                ;;
+            esac
+            ;;
+          macos)
+            rust_target="${host_arch}-apple-darwin"
+            case "${host_arch}" in
+              x86_64) checksum=33cf85df9142bc6d29cbc62fa5ca1d4c29622cddb55213a4c1a43c457fb9b2d7 ;;
+              aarch64) checksum=aeb4105778ca1bd3c6b0e75768f581c656633cd51368fa61289b6a71696ac7e1 ;;
+            esac
+            ;;
+          windows)
+            rust_target="${host_arch}-pc-windows-msvc"
+            case "${host_arch}" in
+              x86_64) checksum=86478e53f769379d7f0ebfa7c9aa97cb76ca92233f79aa2cc0dbee2efaac73c7 ;;
+              aarch64) checksum=3af309e6c3062aa11df0e932954f69d13b734d8a431e593812f3ecd9ff9e6ef6 ;;
+            esac
+            ;;
+        esac
+        if [[ -z "${rust_target}" ]] || [[ -z "${checksum}" ]]; then
+          bail "unsupported host platform ${host_arch}_${host_os} for ${tool}"
+        fi
+        url="https://static.rust-lang.org/rustup/archive/${rustup_version}/${rust_target}/rustup-init${exe}"
+        mkdir -p -- "${tmp_dir}"
+        (
+          cd -- "${tmp_dir}"
+          download_and_checksum "${url}" "${checksum}"
+          mv -- tmp rustup-init
+          case "${host_os}" in
+            linux | macos) chmod +x ./rustup-init ;;
+          esac
+          g retry ./rustup-init -y --default-toolchain "${version}" --no-modify-path "${rustup_args[@]}"
+        )
+        rm -rf -- "${tmp_dir}"
+        cargo_bin_dir="${CARGO_HOME:-"${home}/.cargo"}/bin"
+        export PATH="${PATH}:${cargo_bin_dir}"
+        cargo_bin_dir=$(canonicalize_windows_path "${cargo_bin_dir}")
+        info "adding '${cargo_bin_dir}' to PATH"
+        printf '%s\n' "${cargo_bin_dir}" >>"${GITHUB_PATH}"
+        cargo_path=$(type -P cargo || true)
+      fi
+      installed_bin=("rustc${exe}" "cargo${exe}")
+      ;;
     protoc)
       info "installing ${tool}@${version}"
       read_manifest "protoc" "${version}"
@@ -773,11 +933,11 @@ for tool in "${tools[@]}"; do
       info "installing ${tool}@${version}"
       case "${version}" in
         latest) ;;
-        *) warn "specifying the version of ${tool} is not supported yet by this action" ;;
+        *) warn "specifying the version of ${tool} is not supported" ;;
       esac
       case "${host_os}" in
         linux) ;;
-        macos | windows) bail "${tool} for non-Linux is not supported yet by this action" ;;
+        macos | windows) bail "${tool} for non-Linux is not supported" ;;
         *) bail "unsupported host OS '${host_os}' for ${tool}" ;;
       esac
       # libc6-dbg is needed to run Valgrind
@@ -790,7 +950,7 @@ for tool in "${tools[@]}"; do
     cargo-binstall)
       case "${version}" in
         latest) ;;
-        *) warn "specifying the version of ${tool} is not supported by this action" ;;
+        *) warn "specifying the version of ${tool} is not supported" ;;
       esac
       install_cargo_binstall
       printf '\n'
@@ -798,7 +958,7 @@ for tool in "${tools[@]}"; do
       ;;
     *)
       # Handle aliases.
-      # NB: Update alias list in .github/workflows/release.yml, tool input option in test-alias in .github/workflows/ci.yml,
+      # NB: Update alias list in tools/ci/release-post-commit.sh, tool input option in test-alias in .github/workflows/ci.yml,
       # and match for alias for tools/codegen/src/tools-markdown.rs.
       # TODO(codegen): auto-detect cases where crate name and tool name are different.
       case "${tool}" in
@@ -880,7 +1040,7 @@ for tool in "${tools[@]}"; do
       # gungraun-runner up to 0.17.1 (exclusive) does not support --version flag.
       biome | cargo-machete | wait-for-them | gungraun-runner) rx "${tool_bin_stem}" --version || true ;;
       # these packages support neither --version nor --help flag.
-      cargo-auditable | cargo-careful | wasm-bindgen-test-runner) ;;
+      cargo-auditable | cargo-careful | wasm-bindgen-test-runner | cargo-apple-runner) ;;
       # wasm2es6js does not support --version flag and --help flag doesn't contains version info.
       wasm2es6js) ;;
       # iai-callgrind-runner --version works only with iai-callgrind in nearby Cargo.toml.
@@ -916,7 +1076,7 @@ if [[ ${#unsupported_tools[@]} -gt 0 ]]; then
     none) bail "install-action does not support ${unsupported_tools[*]} (fallback is disabled by 'fallback: none' input option)" ;;
     cargo-binstall)
       case "${host_arch}" in
-        x86_64 | aarch64) ;;
+        x86_64 | aarch64 | riscv64) ;;
         *)
           info "cargo-binstall does not provide prebuilt binaries for this platform (${host_arch}); use 'cargo-install' fallback instead"
           fallback=cargo-install
@@ -993,7 +1153,6 @@ if [[ ${#unsupported_tools[@]} -gt 0 ]]; then
       fi
       if [[ -z "${cargo_path}" ]]; then
         _bin_dir=$(canonicalize_windows_path "${home}/.cargo/bin")
-        # TODO: avoid this when already added
         info "adding '${_bin_dir}' to PATH"
         printf '%s\n' "${_bin_dir}" >>"${GITHUB_PATH}"
       fi

manifests/cargo-apple-runner.json

@@ -0,0 +1,26 @@
+{
+  "rust_crate": "cargo-apple-runner",
+  "template": {
+    "x86_64_macos": {
+      "url": "https://github.com/madsmtm/cargo-apple-runner/releases/download/v${version}/cargo-apple-runner-x86_64-apple-darwin.tar.gz",
+      "bin": "cargo-apple-runner"
+    },
+    "aarch64_macos": {
+      "url": "https://github.com/madsmtm/cargo-apple-runner/releases/download/v${version}/cargo-apple-runner-aarch64-apple-darwin.tar.gz",
+      "bin": "cargo-apple-runner"
+    }
+  },
+  "latest": {
+    "version": "0.0.1"
+  },
+  "0.0.1": {
+    "x86_64_macos": {
+      "etag": "0x8DE9E56906B2739",
+      "hash": "66e53e60e1502d6c6e57aed9c423ecbe9f155fbcee56824a20eb72c49136a554"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE9E56816E1F2D",
+      "hash": "58b94a77328568eff1c8d1216f51933c0753d20365b2284cf3a1dca843a6d0c1"
+    }
+  }
+}

manifests/cargo-binstall.json

@@ -18,6 +18,9 @@
     },
     "aarch64_windows": {
       "url": "https://github.com/cargo-bins/cargo-binstall/releases/download/v${version}/cargo-binstall-aarch64-pc-windows-msvc.zip"
+    },
+    "riscv64_linux_musl": {
+      "url": "https://github.com/cargo-bins/cargo-binstall/releases/download/v${version}/cargo-binstall-riscv64gc-unknown-linux-musl.tgz"
     }
   },
   "latest": {
@@ -47,6 +50,10 @@
     "aarch64_windows": {
       "etag": "0x8DE9959EAAC5732",
       "hash": "c6873e81457d9e44973a8e9a849795f2c83765fce0af8ad68b597b5b40dec418"
+    },
+    "riscv64_linux_musl": {
+      "etag": "0x8DE9959DFE57CE6",
+      "hash": "3eb039f14fa71dd27b614bf692f0bffd4ba087204829805d54b014646aed7c14"
     }
   }
 }

manifests/cargo-deb.json

@@ -7,10 +7,13 @@
     }
   },
   "latest": {
-    "version": "3.6.4"
+    "version": "3.7.0"
   },
   "3": {
-    "version": "3.6.4"
+    "version": "3.7.0"
+  },
+  "3.7": {
+    "version": "3.7.0"
   },
   "3.7.0": {
     "x86_64_linux_gnu": {

manifests/martin.json

@@ -31,13 +31,31 @@
     }
   },
   "latest": {
-    "version": "1.8.0"
+    "version": "1.8.2"
   },
   "1": {
-    "version": "1.8.0"
+    "version": "1.8.2"
   },
   "1.8": {
-    "version": "1.8.0"
+    "version": "1.8.2"
+  },
+  "1.8.2": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DEAA75F9C0717B",
+      "hash": "b7ce4906219974f33c0c80994fde6afe503cd8fc6e4c37fd75caf77f320d98cc"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DEAA75F8954F43",
+      "hash": "6be5743e73b43bc7ef34d17b94e7fdce5f3eafa26120a67ce317b55d557ba481"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DEAA75F885D044",
+      "hash": "d994a862ae5ded571da994f3e525c04e4afb8ee355e3c91135fb0ff78f8d1294"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DEAA75F8A93635",
+      "hash": "11a05523e1e59c8322bae7bb49442eaa22bb355905222f96e723b9ca42dd4316"
+    }
   },
   "1.8.0": {
     "x86_64_linux_musl": {

manifests/mdbook-d2.json

@@ -0,0 +1,61 @@
+{
+  "rust_crate": "mdbook-d2",
+  "template": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/danieleades/mdbook-d2/releases/download/v${version}/mdbook-d2-x86_64-unknown-linux-musl.tar.gz",
+      "bin": "mdbook-d2"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/danieleades/mdbook-d2/releases/download/v${version}/mdbook-d2-x86_64-apple-darwin.tar.gz",
+      "bin": "mdbook-d2"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/danieleades/mdbook-d2/releases/download/v${version}/mdbook-d2-x86_64-pc-windows-msvc.tar.gz",
+      "bin": "mdbook-d2.exe"
+    },
+    "aarch64_linux_musl": {
+      "url": "https://github.com/danieleades/mdbook-d2/releases/download/v${version}/mdbook-d2-aarch64-unknown-linux-musl.tar.gz",
+      "bin": "mdbook-d2"
+    },
+    "aarch64_macos": {
+      "url": "https://github.com/danieleades/mdbook-d2/releases/download/v${version}/mdbook-d2-aarch64-apple-darwin.tar.gz",
+      "bin": "mdbook-d2"
+    },
+    "aarch64_windows": {
+      "url": "https://github.com/danieleades/mdbook-d2/releases/download/v${version}/mdbook-d2-aarch64-pc-windows-msvc.tar.gz",
+      "bin": "mdbook-d2.exe"
+    }
+  },
+  "latest": {
+    "version": "0.3.8"
+  },
+  "0.3": {
+    "version": "0.3.8"
+  },
+  "0.3.8": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE4D1050CFDFE1",
+      "hash": "6601ff37d3f220db0c9617b85c7e80f985a13ea75e2b6bb88b5158ea429455b6"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE4D104B08EF36",
+      "hash": "0ce3bf83daa8f4d458d9acf3cc5e9af1fc85d864854439a8a7d45a9a48166eaf"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE4D106181D5F5",
+      "hash": "89ba967c1f95b32d05612183b9752aeccafa749d5dce0680fb9dcbfda24285fd"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE4D104E5464C8",
+      "hash": "84f37cb1d89f6fabbefb5581205f93035fe5d9f2ace32f01cb76622cb563a9c1"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE4D104A941BA3",
+      "hash": "dcd49feace49c4adce583cfab121885cd84b746fdad6ebc99ca36eb52272f849"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE4D1061C79129",
+      "hash": "6cc7507acae02d73719b260dffd33c3b1d74029cfa97cc7edfe220f8489aef02"
+    }
+  }
+}

manifests/mise.json

@@ -27,10 +27,65 @@
     }
   },
   "latest": {
-    "version": "2026.4.28"
+    "version": "2026.5.1"
   },
   "2026": {
-    "version": "2026.4.28"
+    "version": "2026.5.1"
+  },
+  "2026.5": {
+    "version": "2026.5.1"
+  },
+  "2026.5.1": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DEAAEAFD6A3D30",
+      "hash": "5cb9f8cc7b071c5c5931fafd79bd523a81cbffe6bb23d56daea7b0be86d0a086"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DEAAEAFFDCC12D",
+      "hash": "ed6c715d359bf2313fe793bc44269e38df24246c91a453fffbd0b9d94642af8f"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DEAAEB01618438",
+      "hash": "a82d52bdf35e29e93c264f5dff2bebcc50030101f98dc0902ea039a043b003a5"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DEAAEAF98AF700",
+      "hash": "375c6a365bf7a42b3645fd3816fbd11c94c1d04af9df49910fbe11929878a365"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DEAAEAFF27F87B",
+      "hash": "0eeb03e5f64f2c8fa2b0bcdb3a57fae11057d84d1f24381eb34b90663c68ffa3"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DEAAEB00E9591F",
+      "hash": "d5b6c29be4711ede84b2f08b54b626e6c36ba7b1610b8193d81dcf3a3c0728a4"
+    }
+  },
+  "2026.5.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DEA9471A2EEE95",
+      "hash": "f47a11b64b32f94db74b6792601bd9b0440bf4fe4d1e54056738b3e1eeff13db"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DEA9471C55F180",
+      "hash": "8335873c9280e2dca0b1ceeb0298f2905188732fe128e0f97672f7796bdecbd7"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DEA9471D67181D",
+      "hash": "053de50b0ee574a40ebcca667c17e27b06423bfed3779c623970e0e36e1d6405"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DEA94716D421D2",
+      "hash": "9ff141301ad0eb05ed98c45195de6af9f4f6a2b7ec8ae1acab845e65e4aa1c43"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DEA9471BAE1289",
+      "hash": "c4b34f7d4831f7d296bbd3b1ae50ecca5cbe404650575472c0db6bcaad8bb4e5"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DEA9471D4C0D77",
+      "hash": "43bfe834b2c420b467114cea698f08b8aee26b6be748ec046e8a06915d5003ac"
+    }
   },
   "2026.4": {
     "version": "2026.4.28"

manifests/prek.json

@@ -39,10 +39,78 @@
     }
   },
   "latest": {
-    "version": "0.3.11"
+    "version": "0.3.13"
   },
   "0.3": {
-    "version": "0.3.11"
+    "version": "0.3.13"
+  },
+  "0.3.13": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DEAAD16585793A",
+      "hash": "e10cb36c9181044cda34522899457458e3551396dbc4dcf60e1ac1a8d7a71670"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DEAAD164CE6904",
+      "hash": "2bbfdf15cfe6e954b98cb27094828f5c55a8bec0a02cf55041f783c71e3b8955"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DEAAD165069ED8",
+      "hash": "ca32a6451cfdd22a27d99313b3a2f91eb0ce6d191eb8e35e2467f1551252ebbb"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DEAAD16312F4C4",
+      "hash": "af3122f5ddd69644b7cf4d3e3263305e7e2d12e03be2cb56e8888493ff4d9e72"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DEAAD162CCEBC5",
+      "hash": "0b3b3dd0fbab7b95217280248196bde741b47b8de7bf60de50b4a12a9cc17b1f"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DEAAD162A434DC",
+      "hash": "892cb69e81c5c77c8af23dd930d4bcf578b8f62765ee00e3ba8fb76d2035eb34"
+    },
+    "riscv64_linux_gnu": {
+      "etag": "0x8DEAAD1647231E0",
+      "hash": "8cc1fa33a4cc1fe97312d22558140842324bcc03cde679c01d49bd5d0e16a153"
+    },
+    "s390x_linux_gnu": {
+      "etag": "0x8DEAAD164AE81D1",
+      "hash": "dd447503753d9269894cf9cbc651c493aa0530525bee12f415555d3772860a06"
+    }
+  },
+  "0.3.12": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DEAA7D00F52541",
+      "hash": "6e4874a2d83451df4946e81f161dc8c6bdc675064cca1f2e1e8b0921dc862ae8"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DEAA7D008188C4",
+      "hash": "ed4aa96e2c71a29d30d5e8e8b173155cda9f6aea9822e4773ccff70da5a8287a"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DEAA7D00B66709",
+      "hash": "b75cdae3279806c7a046b18c45c601fe3ec1a380f11911bc39c5273100e18fce"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DEAA7CFF326611",
+      "hash": "2d7bc8ce9bb8521a2b9f67ad23d556fbf208a8cf5d141f09c3dbae919df756aa"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DEAA7CFEEC3638",
+      "hash": "8e31a0e21c2d70e0583500f728e2c1aaba45c397a2ef2c4ea43afb7cd64f5d04"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DEAA7CFEF85D7F",
+      "hash": "6f69d45aa32571e9c34104564dd06a32b7aeec9802831a00a5074fa1a89d5ba9"
+    },
+    "riscv64_linux_gnu": {
+      "etag": "0x8DEAA7D0042F174",
+      "hash": "c4b23c1b7381f251499bba7e5d01c356a39b313f8fe0a5bf53a0e1f4f7d8d91a"
+    },
+    "s390x_linux_gnu": {
+      "etag": "0x8DEAA7D006A2383",
+      "hash": "5b6073abfcfd85c692c6e0f71185f24af911b55d6303a4dfa65fb0c6951d3ede"
+    }
   },
   "0.3.11": {
     "x86_64_linux_musl": {

manifests/tombi.json

@@ -2,10 +2,154 @@
   "rust_crate": null,
   "template": null,
   "latest": {
-    "version": "0.10.1"
+    "version": "0.10.4"
   },
   "0.10": {
-    "version": "0.10.1"
+    "version": "0.10.4"
+  },
+  "0.10.6": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/tombi-toml/tombi/releases/download/v0.10.6/tombi-cli-0.10.6-x86_64-unknown-linux-musl.tar.gz",
+      "etag": "0x8DEABD216B74CCB",
+      "hash": "d91f156278f510c5f159ac3ed3a4c85cf0144e779fffc898756074797fd657fa",
+      "bin": "tombi-cli-0.10.6-x86_64-unknown-linux-musl/tombi"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/tombi-toml/tombi/releases/download/v0.10.6/tombi-cli-0.10.6-x86_64-apple-darwin.tar.gz",
+      "etag": "0x8DEABD21602AAC2",
+      "hash": "624e8c4e0a60e788079c05eff4c31bb1819bac2e02c24b182de52c2f63b6cd25",
+      "bin": "tombi-cli-0.10.6-x86_64-apple-darwin/tombi"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/tombi-toml/tombi/releases/download/v0.10.6/tombi-cli-0.10.6-x86_64-pc-windows-msvc.zip",
+      "etag": "0x8DEABD21611197B",
+      "hash": "06860acc2bc3aef026585dc51dce330469505b5d0c1933621dd6c6a6abc2072b"
+    },
+    "aarch64_linux_musl": {
+      "url": "https://github.com/tombi-toml/tombi/releases/download/v0.10.6/tombi-cli-0.10.6-aarch64-unknown-linux-musl.tar.gz",
+      "etag": "0x8DEABD2162306B9",
+      "hash": "cef1452a2750080e50967e1d0e57d6387e41c20b61b820fb5397407a7b60aa92",
+      "bin": "tombi-cli-0.10.6-aarch64-unknown-linux-musl/tombi"
+    },
+    "aarch64_macos": {
+      "url": "https://github.com/tombi-toml/tombi/releases/download/v0.10.6/tombi-cli-0.10.6-aarch64-apple-darwin.tar.gz",
+      "etag": "0x8DEABD216B615AF",
+      "hash": "b40f5011d27113dff1777e61717bfbe179b0e7cf339c0c8ef18475318a434e2e",
+      "bin": "tombi-cli-0.10.6-aarch64-apple-darwin/tombi"
+    },
+    "aarch64_windows": {
+      "url": "https://github.com/tombi-toml/tombi/releases/download/v0.10.6/tombi-cli-0.10.6-aarch64-pc-windows-msvc.zip",
+      "etag": "0x8DEABD21622DFC4",
+      "hash": "bc18938f699c85220d908a8de27b8a717aa6e15ba00b2b1cff3528c743799234"
+    }
+  },
+  "0.10.5": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/tombi-toml/tombi/releases/download/v0.10.5/tombi-cli-0.10.5-x86_64-unknown-linux-musl.tar.gz",
+      "etag": "0x8DEAB4590C91292",
+      "hash": "a60b4b3fdb9988cf63aeaeeef62251ff35f6dee6e2ea3fa11b1c12988fe57d64",
+      "bin": "tombi-cli-0.10.5-x86_64-unknown-linux-musl/tombi"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/tombi-toml/tombi/releases/download/v0.10.5/tombi-cli-0.10.5-x86_64-apple-darwin.tar.gz",
+      "etag": "0x8DEAB4590D0AB1A",
+      "hash": "536e593c0522212d4ec1b9be97ab202389300a4b1c7bbbba78b640f228c950be",
+      "bin": "tombi-cli-0.10.5-x86_64-apple-darwin/tombi"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/tombi-toml/tombi/releases/download/v0.10.5/tombi-cli-0.10.5-x86_64-pc-windows-msvc.zip",
+      "etag": "0x8DEAB4590DB26A1",
+      "hash": "54d2401bf2e8921f2af826299b016feeb1511c2f4516b83eccbc505ad25c236f"
+    },
+    "aarch64_linux_musl": {
+      "url": "https://github.com/tombi-toml/tombi/releases/download/v0.10.5/tombi-cli-0.10.5-aarch64-unknown-linux-musl.tar.gz",
+      "etag": "0x8DEAB4590C01BF4",
+      "hash": "c952dffaec3441f32abfdde545999296cd3de98d2e71c947693f36686e879941",
+      "bin": "tombi-cli-0.10.5-aarch64-unknown-linux-musl/tombi"
+    },
+    "aarch64_macos": {
+      "url": "https://github.com/tombi-toml/tombi/releases/download/v0.10.5/tombi-cli-0.10.5-aarch64-apple-darwin.tar.gz",
+      "etag": "0x8DEAB45913EF659",
+      "hash": "7fed036c0f85ae60f4f5810ac2554676645dff85e40cee941f98c24228730db7",
+      "bin": "tombi-cli-0.10.5-aarch64-apple-darwin/tombi"
+    },
+    "aarch64_windows": {
+      "url": "https://github.com/tombi-toml/tombi/releases/download/v0.10.5/tombi-cli-0.10.5-aarch64-pc-windows-msvc.zip",
+      "etag": "0x8DEAB45915E4205",
+      "hash": "ca387a677ff18577461f85743cd23405260980ed1c97d75e62877813d9a9340e"
+    }
+  },
+  "0.10.4": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/tombi-toml/tombi/releases/download/v0.10.4/tombi-cli-0.10.4-x86_64-unknown-linux-musl.tar.gz",
+      "etag": "0x8DEAA621E82D459",
+      "hash": "2988df7c5ac115dc20ebd42f45ba039df0b8cda110b444f419bec814db2c880a",
+      "bin": "tombi-cli-0.10.4-x86_64-unknown-linux-musl/tombi"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/tombi-toml/tombi/releases/download/v0.10.4/tombi-cli-0.10.4-x86_64-apple-darwin.tar.gz",
+      "etag": "0x8DEAA621E732E8B",
+      "hash": "f3ba04e491d0e2dbf42ecf6fc5d0e0c54d2b71cc74c8a4f59d34717a57544d15",
+      "bin": "tombi-cli-0.10.4-x86_64-apple-darwin/tombi"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/tombi-toml/tombi/releases/download/v0.10.4/tombi-cli-0.10.4-x86_64-pc-windows-msvc.zip",
+      "etag": "0x8DEAA621EFE096F",
+      "hash": "150c3b9f0ddb3a16faec88980df034889f618d671bdeecec4a49e45f507a4a7d"
+    },
+    "aarch64_linux_musl": {
+      "url": "https://github.com/tombi-toml/tombi/releases/download/v0.10.4/tombi-cli-0.10.4-aarch64-unknown-linux-musl.tar.gz",
+      "etag": "0x8DEAA621E95363E",
+      "hash": "0aac20f61dc0ead3eab386ecaf176ad19b8734e02a2efc031bbaeefc3ace7661",
+      "bin": "tombi-cli-0.10.4-aarch64-unknown-linux-musl/tombi"
+    },
+    "aarch64_macos": {
+      "url": "https://github.com/tombi-toml/tombi/releases/download/v0.10.4/tombi-cli-0.10.4-aarch64-apple-darwin.tar.gz",
+      "etag": "0x8DEAA621EE6566A",
+      "hash": "efff1d4fd57364c1b6f0ab7045006ed58d6fdf79925022213d44f4e0993a37a1",
+      "bin": "tombi-cli-0.10.4-aarch64-apple-darwin/tombi"
+    },
+    "aarch64_windows": {
+      "url": "https://github.com/tombi-toml/tombi/releases/download/v0.10.4/tombi-cli-0.10.4-aarch64-pc-windows-msvc.zip",
+      "etag": "0x8DEAA621E83490D",
+      "hash": "2a035a8a3b51dcc5cbff9c84391734499acf7d70279ecf317fc717d22e003647"
+    }
+  },
+  "0.10.3": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/tombi-toml/tombi/releases/download/v0.10.3/tombi-cli-0.10.3-x86_64-unknown-linux-musl.tar.gz",
+      "etag": "0x8DEA9E19B70067F",
+      "hash": "179a43d5f9656ead70477de4b09c9bdd869ba386618d0b2e2c255b3473dd0593",
+      "bin": "tombi-cli-0.10.3-x86_64-unknown-linux-musl/tombi"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/tombi-toml/tombi/releases/download/v0.10.3/tombi-cli-0.10.3-x86_64-apple-darwin.tar.gz",
+      "etag": "0x8DEA9E19A72ED10",
+      "hash": "e6418659f2ed54c3c1a371cdd9c2281880a8cbba047caf920067843e7bdc7c10",
+      "bin": "tombi-cli-0.10.3-x86_64-apple-darwin/tombi"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/tombi-toml/tombi/releases/download/v0.10.3/tombi-cli-0.10.3-x86_64-pc-windows-msvc.zip",
+      "etag": "0x8DEA9E19A8E6C75",
+      "hash": "0972c9dbbc7a83b30c992c3ac564c6601aca3776c004d9e1b300f03bb410975d"
+    },
+    "aarch64_linux_musl": {
+      "url": "https://github.com/tombi-toml/tombi/releases/download/v0.10.3/tombi-cli-0.10.3-aarch64-unknown-linux-musl.tar.gz",
+      "etag": "0x8DEA9E19A7754EA",
+      "hash": "7c7e0e7950086947137f6d453a0e6137ae08baa5bed491cb10af0528f56768aa",
+      "bin": "tombi-cli-0.10.3-aarch64-unknown-linux-musl/tombi"
+    },
+    "aarch64_macos": {
+      "url": "https://github.com/tombi-toml/tombi/releases/download/v0.10.3/tombi-cli-0.10.3-aarch64-apple-darwin.tar.gz",
+      "etag": "0x8DEA9E19A82B9C9",
+      "hash": "f28035c9bf37d3a3ef73047ba1f31dcdfb9531ff6fe278dcfef1ad6c13c8d5bc",
+      "bin": "tombi-cli-0.10.3-aarch64-apple-darwin/tombi"
+    },
+    "aarch64_windows": {
+      "url": "https://github.com/tombi-toml/tombi/releases/download/v0.10.3/tombi-cli-0.10.3-aarch64-pc-windows-msvc.zip",
+      "etag": "0x8DEA9E19B1B40FC",
+      "hash": "7554606c2e2feb809c748042eb05e3e7303d830e93123e6acad7c53b5ace99da"
+    }
   },
   "0.10.2": {
     "x86_64_linux_musl": {

manifests/uv.json

@@ -73,6 +73,82 @@
   "0.11": {
     "version": "0.11.8"
   },
+  "0.11.11": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DEABAB3A32BEEE",
+      "hash": "80521f18ba83109acd17e0730bd8ff898c3426aa62252c627d63418b353e788a"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DEABAB39981750",
+      "hash": "57a1a8085b4088fbcbd5080c0c30723ba6d0692c89cd071c08a4209e8da602d1"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DEABAB39A6115C",
+      "hash": "2f75a0db2c3530b6b3c24434dc38137f61ff1f4e5f2d7b4ddc5bcd142cf58b65"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DEABAB36BDA901",
+      "hash": "0fc9a49b3900f77ffaccf3ff69a70ddbc1d479e70ac5d8fd6416a7577b03c5a1"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DEABAB36053AA7",
+      "hash": "3a185bf8f46a7b7c8b910d111825907b1638d0ae503cb3c333ae205772354046"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DEABAB366D2476",
+      "hash": "3d8f05de7ed9de885299565f78832a13e443be51de86260f25edb7cfd0fa05f6"
+    },
+    "powerpc64le_linux_gnu": {
+      "etag": "0x8DEABAB38C2092C",
+      "hash": "5348415c8606e5efac5cb293d83d2ae71e43a2dcabf677c6a4cac965c1982c74"
+    },
+    "riscv64_linux_gnu": {
+      "etag": "0x8DEABAB38D70036",
+      "hash": "0eadf068918b960e7bf62eda83613c08d99f0d002b8d475d3383993191554d04"
+    },
+    "s390x_linux_gnu": {
+      "etag": "0x8DEABAB39185391",
+      "hash": "f19c950a93b1f5af4108267743f3de61346250b35c60cc552fb4187b534af770"
+    }
+  },
+  "0.11.10": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DEAAE44DCF49FB",
+      "hash": "e3e78e7698d72c133c5ce851a6d60ee83afdc4c0edced382af9fd1f8e11d0105"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DEAAE44CEF82BE",
+      "hash": "8fd091211089973f528e147166e3af683ab4ecebd4312a55d0d17d87adbde67a"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DEAAE44D040512",
+      "hash": "7a0c424c7bc55a74751f13592235953ebbe182fa00355f7ae3fb7ab734a51638"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DEAAE44A345FEE",
+      "hash": "14c21bef6b54d268c6583d851095a543e6cb03a8e4bdca9a44ab91532b14cbc2"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DEAAE4496FA369",
+      "hash": "e93d6af7dfff7071edd16342ba9eeccfc28d8a7deaa5707efeecf63a63a74453"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DEAAE449BDB9A2",
+      "hash": "3d5878cfc55106083ada1e41cccdde477413701eb9d34767e8ad973bb0863de6"
+    },
+    "powerpc64le_linux_gnu": {
+      "etag": "0x8DEAAE44C0F6DBE",
+      "hash": "dfe5b338e2ebc1e5a2850a17bce35edb8e47550c221d9245c007eaf3003cb6ed"
+    },
+    "riscv64_linux_gnu": {
+      "etag": "0x8DEAAE44C34CD09",
+      "hash": "0c8776a0814bf7e32e025d13c733c3a800171a16fba77d1c21e6f10be6a28d8b"
+    },
+    "s390x_linux_gnu": {
+      "etag": "0x8DEAAE44CE003C6",
+      "hash": "66dfdc5a216a9fbd7c2541a66f753544dddbcbb2f7a597c9bbc91d10af534c7d"
+    }
+  },
   "0.11.8": {
     "x86_64_linux_musl": {
       "etag": "0x8DEA45F71233F4B",

manifests/wasm-bindgen.json

@@ -48,6 +48,28 @@
   "0.2": {
     "version": "0.2.120"
   },
+  "0.2.121": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DEABD2CE026990",
+      "hash": "3039f38f65fe237b640cf06a140c919ca8d717ec5012146d145d3f27bb4d6b28"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DEABD2CE0D80A6",
+      "hash": "199ca4184dc35b57432e820cb9385b5be65b28a152f569f711e6e8a3e56323c8"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DEABD2CDD6CF9C",
+      "hash": "643af23c391340a1069b22a34806c0a0969389ad8fe088160c08d7c53d1b79c4"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DEABD2CE013270",
+      "hash": "e314cffdca0b10ed8768f9225316490512386d449cd95c2f7b16e55abe930161"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DEABD2CDEE5BDA",
+      "hash": "4b36a8a9283808af6d23a0d2d549a299e40045ab8b2279c139cdff6319b6f0c3"
+    }
+  },
   "0.2.120": {
     "x86_64_linux_musl": {
       "etag": "0x8DEA4FA606184E0",

tools/ci/manifest.sh

@@ -30,9 +30,14 @@ for manifest in manifests/*.json; do
     git stash pop
     new_version=$(jq -r '.latest.version' "${manifest}")
     if [[ "${old_version}" != "${new_version}" ]]; then
-      # TODO: If there is a line about updating the same tool in the "Unreleased" section, replace it.
+      unreleased=$(parse-changelog CHANGELOG.md Unreleased)
       msg="Update \`${name}@latest\` to ${new_version}"
-      sed -Ei "s/^## \\[Unreleased\\]/## [Unreleased]\\n\\n- ${msg}./" CHANGELOG.md
+      if grep -Eq "^- Update \`${name}@latest\` to " <<<"${unreleased}"; then
+        # If there is a line about updating the same tool in the "Unreleased" section, replace it.
+        sed -Ei "0,/^- Update \`${name}@latest\` to .*/s//- ${msg}./" CHANGELOG.md
+      else
+        sed -Ei "s/^## \\[Unreleased\\]/## [Unreleased]\\n\\n- ${msg}./" CHANGELOG.md
+      fi
       git add "${manifest}" CHANGELOG.md
     else
       msg="Update ${name} manifest"

tools/ci/release-post-commit.sh

@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: Apache-2.0 OR MIT
+set -CeEuo pipefail
+IFS=$'\n\t'
+trap -- 's=$?; printf >&2 "%s\n" "${0##*/}:${LINENO}: \`${BASH_COMMAND}\` exit with ${s}"; exit ${s}' ERR
+cd -- "$(dirname -- "$0")"/../..
+
+tools=()
+for tool in tools/codegen/base/*.json; do
+  tool="${tool##*/}"
+  tools+=("${tool%.*}")
+done
+# Aliases.
+# NB: Update case for aliases in main.sh, tool input option in test-alias job
+# in .github/workflows/ci.yml, and match for alias for tools/codegen/src/tools-markdown.rs.
+tools+=(
+  nextest
+  taplo-cli
+  typos-cli
+  wasm-bindgen-cli
+  wasmtime-cli
+)
+# Non-manifest-based tools.
+tools+=(
+  rust
+  valgrind
+)
+
+for tool in "${tools[@]}"; do
+  (
+    set -x
+    git checkout -b "releases/${tool}"
+    sed -Ei action.yml \
+      -e "s/required: true/required: false/g" \
+      -e "s/# default: #publish:tool/default: ${tool}/g"
+    git add action.yml
+    git commit -m "${tool}"
+    git tag -f "${tool}"
+    git checkout main
+  )
+  refs+=",+refs/heads/releases/${tool},+refs/tags/${tool}"
+done
+
+set -x
+
+# Copy manifests to tmp dir.
+manifests=/tmp/manifests
+rm -rf -- "${manifests}"
+mkdir -p -- "${manifests}"
+cp -- ./manifests/* "${manifests}"
+
+# Checkout manifest-schema branch
+schema_version="$(grep -Eo "^version = \".*\" #publish:version" tools/manifest-schema/Cargo.toml)"
+schema_version="$(cut -d\" -f2 <<<"${schema_version}")"
+if [[ "${schema_version}" == '0.'* ]]; then
+  schema_version="0.$(cut -d. -f2 <<<"${schema_version}")"
+else
+  schema_version="$(cut -d. -f1 <<<"${schema_version}")"
+fi
+schema_branch="manifest-schema-${schema_version}"
+refs+=",refs/heads/${schema_branch}"
+
+if git fetch origin "${schema_branch}"; then
+  git checkout "origin/${schema_branch}" -B "${schema_branch}"
+elif ! git checkout "${schema_branch}"; then
+  # New branch with no history. Credit: https://stackoverflow.com/a/13969482
+  git checkout --orphan "${schema_branch}"
+  git rm -rf -- . || true
+  git commit -m 'Initial commit' --allow-empty
+fi
+
+# Copy over schema
+cp -- "${manifests}"/* ./
+
+# Stage changes
+git add .
+# Detect changes, then commit and push if changes exist
+if [[ "$(git status --porcelain=v1 | LC_ALL=C wc -l)" != "0" ]]; then
+  git commit -m 'Update manifest schema'
+fi
+git checkout main
+
+printf 'additional-refs: %s\n' "${refs}"
+if [[ -n "${GITHUB_OUTPUT:-}" ]]; then
+  printf 'additional-refs=%s\n' "${refs}" >>"${GITHUB_OUTPUT}"
+fi

tools/ci/tool-list.sh

@@ -48,6 +48,7 @@ glibc_pre_2_27_incompat=(
 glibc_pre_2_17_incompat=(
   "${glibc_pre_2_27_incompat[@]}"
   deepsource # https://github.com/DeepSourceCorp/cli/issues/245
+  rust
 )
 musl_incompat=(
   "${glibc_pre_2_17_incompat[@]}"
@@ -150,6 +151,10 @@ for manifest in tools/codegen/base/*.json; do
   fi
   case "${host_os}" in
     linux*)
+      # cargo-apple-runner is not supported on Linux
+      if [[ "${tool_name}" == "cargo-apple-runner" ]]; then
+        continue
+      fi
       if [[ "${host_arch}" != "x86_64" ]] && [[ "$(jq -r --arg p "${host_arch}_${host_os}_gnu" '.platform[$p]' "${manifest}")" == "null" ]] && [[ "$(jq -r --arg p "${host_arch}_${host_os}_musl" '.platform[$p]' "${manifest}")" == "null" ]]; then
         continue
       fi
@@ -190,6 +195,41 @@ if [[ "${version}" != "latest" ]]; then
 fi
 
 # Not manifest-based
+case "${runner}" in
+  # requires glibc 2.17 / musl 1.2
+  centos:6 | alpine:3.2) ;;
+  *)
+    case $((RANDOM % 4)) in
+      0) rust=rust ;;
+      1) rust=rust@stable ;;
+      2) rust=rust@nightly ;;
+      3) rust=rust@1.93 ;;
+    esac
+    case $((RANDOM % 3)) in
+      0) ;;
+      1) rust+='+thumbv6m-none-eabi' ;;
+      2) rust+=' + thumbv6m-none-eabi' ;;
+    esac
+    if [[ "${rust}" == *'nightly'* ]]; then
+      component=miri
+    else
+      component=rustfmt
+    fi
+    case $((RANDOM % 5)) in
+      0) ;;
+      1) rust+="+${component}" ;;
+      2) rust+=" + ${component}" ;;
+      3) rust+=" +${component}" ;;
+      4) rust+="+ ${component}" ;;
+    esac
+    case $((RANDOM % 3)) in
+      0) ;;
+      1) rust+='+thumbv7m-none-eabi' ;;
+      2) rust+=' + thumbv7m-none-eabi' ;;
+    esac
+    tools+=("${rust}")
+    ;;
+esac
 case "${host_os}" in
   linux*)
     # Installing snap to container is difficult...

tools/codegen/base/cargo-apple-runner.json

@@ -0,0 +1,11 @@
+{
+  "repository": "https://github.com/madsmtm/cargo-apple-runner",
+  "license_markdown": "[Zlib](https://github.com/madsmtm/cargo-apple-runner/blob/main/LICENSE-ZLIB.txt) OR [Apache-2.0](https://github.com/madsmtm/cargo-apple-runner/blob/main/LICENSE-APACHE.txt) OR [MIT](https://github.com/madsmtm/cargo-apple-runner/blob/main/LICENSE-MIT.txt)",
+  "tag_prefix": "v",
+  "rust_crate": "${package}",
+  "asset_name": "${package}-${rust_target}.tar.gz",
+  "platform": {
+    "x86_64_macos": {},
+    "aarch64_macos": {}
+  }
+}

tools/codegen/base/cargo-binstall.json

@@ -4,7 +4,7 @@
   "tag_prefix": "v",
   "rust_crate": "${package}",
   "asset_name": "${package}-${rust_target}.zip",
-  "version_range": "latest",
+  "version_range": "=1.18.1",
   "signing": {
     "kind": "minisign-binstall"
   },
@@ -18,6 +18,9 @@
       "asset_name": "${package}-${rust_target}.tgz"
     },
     "aarch64_macos": {},
-    "aarch64_windows": {}
+    "aarch64_windows": {},
+    "riscv64_linux_musl": {
+      "asset_name": "${package}-${rust_target}.tgz"
+    }
   }
 }

tools/codegen/base/mdbook-d2.json

@@ -0,0 +1,20 @@
+{
+  "repository": "https://github.com/danieleades/mdbook-d2",
+  "license_markdown": "[MIT](https://github.com/danieleades/mdbook-d2/blob/main/LICENSE)",
+  "tag_prefix": "v",
+  "rust_crate": "${package}",
+  "asset_name": [
+    "${package}-${rust_target}.tar.gz",
+    "${package}-${rust_target}.zip"
+  ],
+  "bin": "${package}${exe}",
+  "version_range": ">= 0.3.8",
+  "platform": {
+    "x86_64_linux_musl": {},
+    "x86_64_macos": {},
+    "x86_64_windows": {},
+    "aarch64_linux_musl": {},
+    "aarch64_macos": {},
+    "aarch64_windows": {}
+  }
+}

tools/codegen/base/uv.json

@@ -4,6 +4,7 @@
   "tag_prefix": "",
   "rust_crate": "${package}",
   "version_range": ">= 0.8.16",
+  "ignore": ["0.11.9"],
   "signing": {
     "version_range": ">= 0.9.13",
     "kind": {

tools/codegen/src/lib.rs

@@ -31,9 +31,13 @@ pub struct BaseManifest {
     /// Path to binaries in archive. Default to `${tool}${exe}`.
     pub bin: Option<StringOrArray>,
     pub signing: Option<Signing>,
+    pub version_range: Option<String>,
+    /// Include to manifest, but exclude from candidate for latest and omitted versions.
     #[serde(default)]
     pub broken: Vec<semver::Version>,
-    pub version_range: Option<String>,
+    /// Exclude from manifest.
+    #[serde(default)]
+    pub ignore: Vec<semver::Version>,
     /// Use glibc build if host_env is gnu.
     #[serde(default)]
     pub prefer_linux_gnu: bool,

tools/codegen/src/main.rs

@@ -96,7 +96,11 @@ fn main() {
                     semver_version = format!("{default_major_version}.{version}").parse();
                 }
             }
-            Some((Reverse(semver_version.ok()?), (version, release)))
+            let semver_version = semver_version.ok()?;
+            if base_info.ignore.contains(&semver_version) {
+                return None;
+            }
+            Some((Reverse(semver_version), (version, release)))
         })
         .collect();
 
@@ -129,7 +133,9 @@ fn main() {
 
     let mut latest_only = false;
     if let Some(version_range) = &base_info.version_range {
-        if version_range == "latest" {
+        if version_range == "latest"
+            || version_range.starts_with('=') && !version_range.contains(',')
+        {
             latest_only = true;
         }
     }
@@ -171,13 +177,20 @@ fn main() {
 
     let version_req: semver::VersionReq = match version_req {
         _ if latest_only => {
-            // Exclude very recently released version from candidate for latest version.
+            let version_range = base_info.version_range.as_ref().unwrap();
-            let req =
+            if version_range == "latest" {
-                format!("={}", releases.iter().find(|r| r.1.1.published_at <= before).unwrap().0.0)
+                // Exclude very recently released version from candidate for latest version.
-                    .parse()
+                let req = format!(
-                    .unwrap();
+                    "={}",
-            eprintln!("update manifest for versions '{req}'");
+                    releases.iter().find(|r| r.1.1.published_at <= before).unwrap().0.0
-            req
+                )
+                .parse()
+                .unwrap();
+                eprintln!("update manifest for versions '{req}'");
+                req
+            } else {
+                version_range.parse().unwrap()
+            }
         }
         None => match base_info.version_range {
             Some(version_range) => version_range.parse().unwrap(),

tools/codegen/src/tools-markdown.rs

@@ -52,18 +52,32 @@ fn main() {
     let mut paths: Vec<_> = fs::read_dir(&manifest_dir).unwrap().map(|r| r.unwrap()).collect();
     paths.sort_by_key(fs_err::DirEntry::path);
 
-    let mut tools = vec![MarkdownEntry {
+    let mut tools = vec![
-        name: "valgrind".to_owned(),
+        MarkdownEntry {
-        alias: None,
+            name: "rust".to_owned(),
-        website: "https://valgrind.org/".to_owned(),
+            alias: None,
-        installed_to: InstalledTo::Snap,
+            website: "https://rust-lang.org".to_owned(),
-        installed_from: InstalledFrom::Snap,
+            installed_to: InstalledTo::Cargo,
-        platforms: Platforms { linux: true, ..Default::default() },
+            installed_from: InstalledFrom::Rustup,
-        repository: "https://sourceware.org/git/valgrind.git".to_owned(),
+            platforms: Platforms { linux: true, macos: true, windows: true },
-        license_markdown:
+            repository: "https://github.com/rust-lang/rust".to_owned(),
-            "[GPL-2.0](https://sourceware.org/git/?p=valgrind.git;a=blob;f=COPYING;hb=HEAD)"
+            license_markdown:
-                .to_owned(),
+                "[Apache-2.0 OR MIT](https://github.com/rust-lang/rust/blob/main/COPYRIGHT)"
-    }];
+                    .to_owned(),
+        },
+        MarkdownEntry {
+            name: "valgrind".to_owned(),
+            alias: None,
+            website: "https://valgrind.org/".to_owned(),
+            installed_to: InstalledTo::Snap,
+            installed_from: InstalledFrom::Snap,
+            platforms: Platforms { linux: true, ..Default::default() },
+            repository: "https://sourceware.org/git/valgrind.git".to_owned(),
+            license_markdown:
+                "[GPL-2.0](https://sourceware.org/git/?p=valgrind.git;a=blob;f=COPYING;hb=HEAD)"
+                    .to_owned(),
+        },
+    ];
 
     for path in paths {
         let file_name = path.file_name();
@@ -153,6 +167,7 @@ struct MarkdownEntry {
 #[derive(Debug, Eq, PartialEq)]
 enum InstalledFrom {
     GitHubRelease,
+    Rustup,
     Snap,
 }
 
@@ -215,6 +230,9 @@ impl fmt::Display for MarkdownEntry {
                 let markdown = format!("| [GitHub Releases]({}/releases) ", self.repository);
                 f.write_str(&markdown)?;
             }
+            InstalledFrom::Rustup => {
+                f.write_str("| rustup ")?;
+            }
             InstalledFrom::Snap => {
                 let markdown =
                     format!("| [snap](https://snapcraft.io/install/{}/ubuntu) ", self.name);

tools/rustup-hash.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: Apache-2.0 OR MIT
+set -CeEuo pipefail
+IFS=$'\n\t'
+trap -- 's=$?; printf >&2 "%s\n" "${0##*/}:${LINENO}: \`${BASH_COMMAND}\` exit with ${s}"; exit ${s}' ERR
+cd -- "$(dirname -- "$0")"/..
+
+# Get sha256 hash of rustup-init binaries
+
+# NB: Synch with main.sh.
+rustup_version=1.29.0
+targets=(
+  x86_64-unknown-linux-gnu
+  x86_64-unknown-linux-musl
+  aarch64-unknown-linux-gnu
+  aarch64-unknown-linux-musl
+  powerpc64le-unknown-linux-gnu
+  powerpc64le-unknown-linux-musl
+  riscv64gc-unknown-linux-gnu
+  # riscv64gc-unknown-linux-musl # tier 2 without host tools: TODO: https://github.com/rust-lang/rust/issues/156191
+  s390x-unknown-linux-gnu
+  # s390x-unknown-linux-musl # tier 3
+  x86_64-apple-darwin
+  aarch64-apple-darwin
+  x86_64-pc-windows-msvc
+  aarch64-pc-windows-msvc
+)
+
+for rust_target in "${targets[@]}"; do
+  exe=''
+  case "${rust_target}" in
+    *-windows*) exe=.exe ;;
+  esac
+  url="https://static.rust-lang.org/rustup/archive/${rustup_version}/${rust_target}/rustup-init${exe}.sha256"
+  printf '%s: ' "${rust_target}"
+  curl --proto '=https' --tlsv1.2 -fsSL --retry 10 "${url}" | cut -d' ' -f1
+done

tools/tidy.sh

@@ -9,13 +9,22 @@ cd -- "$(dirname -- "$0")"/..
 #    GITHUB_TOKEN=$(gh auth token) ./tools/tidy.sh
 #
 # Note: This script requires the following tools:
-# - docker
+# - docker or podman (or compatible CLI specified by TIDY_DOCKER_PATH. when both available and TIDY_DOCKER_PATH is not set, docker is preferred)
 #
 # This script is shared by projects under github.com/taiki-e, so there may also
 # be checks for files not included in this repository, but they will be skipped
 # if the corresponding files do not exist.
 # It is not intended for manual editing.
 
+bail() {
+  if [[ -n "${GITHUB_ACTIONS:-}" ]]; then
+    printf '::error::%s\n' "$*"
+  else
+    printf >&2 'error: %s\n' "$*"
+  fi
+  exit 1
+}
+
 if [[ $# -gt 0 ]]; then
   cat <<EOF
 USAGE:
@@ -24,10 +33,11 @@ EOF
   exit 1
 fi
 
+image='ghcr.io/taiki-e/tidy'
 if [[ -n "${TIDY_DEV:-}" ]]; then
-  image="ghcr.io/taiki-e/tidy:latest"
+  image+=':latest'
 else
-  image="ghcr.io/taiki-e/tidy@sha256:c78ba09aa420feddc57ca76fca38b1d4c998a0ede37f76378f12df15a826cf59"
+  image+='@sha256:4d7ec52a86bd3c0a2d96627b0ec3aa534afc02c2d56fc9a898df64e29aa03312'
 fi
 user="$(id -u):$(id -g)"
 workdir=$(pwd)
@@ -40,8 +50,12 @@ color=''
 if [[ -t 1 ]] || [[ -n "${GITHUB_ACTIONS:-}" ]]; then
   color=1
 fi
+# Refs:
+# - https://docs.docker.com/reference/cli/docker/container/run/
+# - https://docs.podman.io/en/latest/markdown/podman-run.1.html
+# - https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html
 common_args=(
-  run --rm --init -i --user "${user}"
+  run --rm --init
   --cap-drop=all
   --security-opt=no-new-privileges
   --read-only
@@ -59,6 +73,30 @@ common_args=(
   --env TIDY_EXPECTED_SHELL_FILE_COUNT
   --env TIDY_EXPECTED_DOCKER_FILE_COUNT
 )
+if [[ -n "${TIDY_DOCKER_PATH:-}" ]]; then
+  docker="${TIDY_DOCKER_PATH}"
+elif type -P docker >/dev/null; then
+  docker='docker'
+elif type -P podman >/dev/null; then
+  docker='podman'
+else
+  bail 'this script requires docker or podman'
+fi
+rootless=''
+if [[ "$("${docker}" --version)" == *'podman'* ]]; then
+  if [[ "$("${docker}" info)" == *'rootless: true'* ]]; then
+    rootless=1
+  fi
+elif [[ "$("${docker}" info -f '{{println .SecurityOptions}}')" == *'rootless'* ]]; then
+  rootless=1
+fi
+if [[ -n "${rootless}" ]]; then
+  printf 'docker path: %s\n' "${docker} (rootless)"
+else
+  printf 'docker path: %s\n' "${docker}"
+  common_args+=(--user "${user}")
+fi
+
 # Map ignored files (e.g., .env) to dummy files.
 while IFS= read -r path; do
   if [[ -d "${path}" ]]; then
@@ -73,7 +111,7 @@ while IFS= read -r path; do
 done < <(git status --porcelain --ignored | grep -E '^!!' | cut -d' ' -f2)
 
 docker_run() {
-  docker "${common_args[@]}" "$@"
+  "${docker}" "${common_args[@]}" "$@"
   code2="$?"
   if [[ ${code} -eq 0 ]] && [[ ${code2} -ne 0 ]]; then
     code="${code2}"
@@ -83,6 +121,7 @@ docker_run() {
 set +e
 docker_run \
   --mount "type=bind,source=${workdir},target=${workdir}" --workdir "${workdir}" \
+  --mount "type=bind,source=${workdir}/.git,target=${workdir}/.git,readonly" \
   --mount "type=bind,source=${tmp}/tmp,target=/tmp/tidy" \
   --mount "type=bind,source=${tmp}/pwsh-cache,target=/.cache/powershell" \
   --mount "type=bind,source=${tmp}/pwsh-local,target=/.local/share/powershell" \