protoc

.github/workflows/ci.yml

@@ -121,22 +121,22 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       # Test all shells listed in https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsshell
       - name: Test bash
-        run: just --version && shfmt --version && protoc --version
+        run: just --version && shfmt --version && protoc --version && rustc --version && cargo --version && rustup --version
         shell: bash
       - name: Test sh
-        run: just --version && shfmt --version && protoc --version
+        run: just --version && shfmt --version && protoc --version && rustc --version && cargo --version && rustup --version
         shell: sh
         if: startsWith(matrix.os, 'ubuntu') || startsWith(matrix.os, 'macos')
       - name: Test pwsh
-        run: just --version; shfmt --version; protoc --version
+        run: just --version; shfmt --version; protoc --version; rustc --version; cargo --version; rustup --version
         shell: pwsh
         if: matrix.os != 'ubuntu-slim'
       - name: Test powershell
-        run: just --version; shfmt --version; protoc --version
+        run: just --version; shfmt --version; protoc --version; rustc --version; cargo --version; rustup --version
         shell: powershell
         if: startsWith(matrix.os, 'windows')
       - name: Test cmd
-        run: just --version & shfmt --version & protoc --version
+        run: just --version & shfmt --version & protoc --version & rustc --version & cargo --version & rustup --version
         shell: cmd # zizmor: ignore[misfeature] used for compatibility testing
         if: startsWith(matrix.os, 'windows')
       # We use the version output to check the version of cargo-binstall, but they
@@ -300,6 +300,10 @@ jobs:
         env:
           CONTAINER: ${{ matrix.container }}
         if: startsWith(matrix.container, 'centos')
+      # gcc for rustc
+      - run: apk --no-cache add gcc
+        shell: sh
+        if: startsWith(matrix.container, 'alpine')
       - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
       # cross attempts to install rust-src when Cargo.toml is available even if `cross --version`
       - run: rm -- Cargo.toml

.github/workflows/manifest.yml

@@ -32,7 +32,7 @@ concurrency:
 
 jobs:
   manifest:
-    uses: taiki-e/github-actions/.github/workflows/gen.yml@75415970465917c31d702710acd9c9248b9af314 # main
+    uses: taiki-e/github-actions/.github/workflows/gen.yml@a6df8c9ea0038c730f138f0f849d692cf387ea4e # main
     permissions:
       contents: write # for creating branch for pr
       pull-requests: write # for gh pr review --approve
@@ -46,3 +46,4 @@ jobs:
       automerge: true
       install-rust: true
       install-cosign: true
+      install-parse-changelog: true

CHANGELOG.md

@@ -10,6 +10,31 @@ Note: In this file, do not use the hard wrap in the middle of a sentence for com
 
 ## [Unreleased]
 
+## [2.77.0] - 2026-05-05
+
+- Support `rust`. ([#1779](https://github.com/taiki-e/install-action/pull/1779))
+
+  This installs rust using rustup.
+
+  If rustup is not yet installed, this action downloads [rustup-init for the current platform](https://rust-lang.github.io/rustup/installation/other.html#manual-installation) using HTTPS with tlsv1.2+, verifies SHA256 checksum, and then installs rustup using it.
+
+  This also supports installing additional components at the same time by `+<additional>` syntax:
+
+  ```yaml
+  - uses: taiki-e/install-action@v2
+    with:
+      # Install rust stable with rustfmt component and wasm32-wasip1 target.
+      tool: rust+rustfmt+wasm32-wasip1
+      # When installing another rust version:
+      # tool: rust@nightly + rustfmt + wasm32-wasip1
+  ```
+
+- Fix issue where x86_64 binary will be installed on AArch64 Windows even when AArch64 Windows binary available.
+
+- Update `mise@latest` to 2026.5.0.
+
+- Diagnostic improvements.
+
 ## [2.76.0] - 2026-05-04
 
 - Support `mdbook-d2`. ([#1737](https://github.com/taiki-e/install-action/pull/1737), thanks @nhu)
@@ -6435,7 +6460,8 @@ Note: This release is considered a breaking change because installing on version
 
 Initial release
 
-[Unreleased]: https://github.com/taiki-e/install-action/compare/v2.76.0...HEAD
+[Unreleased]: https://github.com/taiki-e/install-action/compare/v2.77.0...HEAD
+[2.77.0]: https://github.com/taiki-e/install-action/compare/v2.76.0...v2.77.0
 [2.76.0]: https://github.com/taiki-e/install-action/compare/v2.75.30...v2.76.0
 [2.75.30]: https://github.com/taiki-e/install-action/compare/v2.75.29...v2.75.30
 [2.75.29]: https://github.com/taiki-e/install-action/compare/v2.75.28...v2.75.29

README.md

@@ -58,6 +58,17 @@ You can also omit patch version.
     tool: cargo-hack@0.5
 ```
 
+For some tools, we support installing additional components at the same time by `+<additional>` syntax:
+
+```yaml
+- uses: taiki-e/install-action@v2
+  with:
+    # Install rust stable with rustfmt component and wasm32-wasip1 target.
+    tool: rust+rustfmt+wasm32-wasip1
+    # When installing another rust version:
+    # tool: rust@nightly + rustfmt + wasm32-wasip1
+```
+
 To install multiple tools:
 
 ```yaml
@@ -73,6 +84,16 @@ Or:
 - uses: taiki-e/install-action@cargo-minimal-versions
 ```
 
+Tool names can also be separated with whitespaces (line, space, tab).
+
+```yaml
+- uses: taiki-e/install-action@v2
+  with:
+    tool: |
+      cargo-hack
+      cargo-minimal-versions
+```
+
 ## Supported tools
 
 See [TOOLS.md](TOOLS.md) for the list of tools that are installed from manifests managed in this action.
@@ -126,7 +147,11 @@ When installing with `tool: <tool_name>` or `tool: <tool_name>@<omitted_version>
 <!-- omit in toc -->
 ### Security on other installation methods
 
-See the linked documentation for information on security when installed using [snap](https://snapcraft.io/docs) or [cargo-binstall](https://github.com/cargo-bins/cargo-binstall#faq).
+See the linked documentation for information on security when installed using [rustup](https://rust-lang.github.io/rustup/security.html), [snap](https://snapcraft.io/docs), or [cargo-binstall](https://github.com/cargo-bins/cargo-binstall#faq).
+
+If the installation method is rustup and rustup is not yet installed, this action downloads [rustup-init for the current platform](https://rust-lang.github.io/rustup/installation/other.html#manual-installation) using HTTPS with tlsv1.2+, verifies SHA256 checksum, and then installs rustup using it.
+
+If the installation method is cargo-binstall and cargo-binstall is not yet installed or outdated, this action installs cargo-binstall [from GitHub Releases](#security-on-installation-from-github-releases).
 
 See the [Supported tools section](#supported-tools) for how to ensure that fallback is not used.
 

TOOLS.md

@@ -17,9 +17,9 @@ See the [Supported tools section in README.md](README.md#supported-tools) for ho
 | [**auto-doc**](https://github.com/tj-actions/auto-doc) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/tj-actions/auto-doc/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/tj-actions/auto-doc/blob/main/LICENSE) |
 | [**biome**](https://biomejs.dev) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/biomejs/biome/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/biomejs/biome/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/biomejs/biome/blob/main/LICENSE-MIT) |
 | [**cargo-apple-runner**](https://github.com/madsmtm/cargo-apple-runner) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/madsmtm/cargo-apple-runner/releases) | macOS | [Zlib](https://github.com/madsmtm/cargo-apple-runner/blob/main/LICENSE-ZLIB.txt) OR [Apache-2.0](https://github.com/madsmtm/cargo-apple-runner/blob/main/LICENSE-APACHE.txt) OR [MIT](https://github.com/madsmtm/cargo-apple-runner/blob/main/LICENSE-MIT.txt) |
-| [**cargo-audit**](https://github.com/rustsec/rustsec/tree/HEAD/cargo-audit) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/rustsec/rustsec/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/rustsec/rustsec/blob/HEAD/cargo-audit/LICENSE-APACHE) OR [MIT](https://github.com/rustsec/rustsec/blob/HEAD/cargo-audit/LICENSE-MIT) |
+| [**cargo-audit**](https://github.com/rustsec/rustsec/tree/HEAD/cargo-audit) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/rustsec/rustsec/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/rustsec/rustsec/blob/main/cargo-audit/LICENSE-APACHE) OR [MIT](https://github.com/rustsec/rustsec/blob/main/cargo-audit/LICENSE-MIT) |
-| [**cargo-auditable**](https://github.com/rust-secure-code/cargo-auditable) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/rust-secure-code/cargo-auditable/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/rust-secure-code/cargo-auditable/blob/HEAD/LICENSE-APACHE) OR [MIT](https://github.com/rust-secure-code/cargo-auditable/blob/HEAD/LICENSE-MIT) |
+| [**cargo-auditable**](https://github.com/rust-secure-code/cargo-auditable) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/rust-secure-code/cargo-auditable/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/rust-secure-code/cargo-auditable/blob/master/LICENSE-APACHE) OR [MIT](https://github.com/rust-secure-code/cargo-auditable/blob/master/LICENSE-MIT) |
-| [**cargo-binstall**](https://github.com/cargo-bins/cargo-binstall) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/cargo-bins/cargo-binstall/releases) | Linux, macOS, Windows | [GPL-3.0](https://github.com/cargo-bins/cargo-binstall/blob/HEAD/crates/bin/LICENSE) |
+| [**cargo-binstall**](https://github.com/cargo-bins/cargo-binstall) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/cargo-bins/cargo-binstall/releases) | Linux, macOS, Windows | [GPL-3.0](https://github.com/cargo-bins/cargo-binstall/blob/main/crates/bin/LICENSE) |
 | [**cargo-careful**](https://github.com/RalfJung/cargo-careful) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/RalfJung/cargo-careful/releases) | Linux, macOS, Windows | [MIT](https://github.com/RalfJung/cargo-careful/blob/master/LICENSE-MIT) OR [Apache-2.0](https://github.com/RalfJung/cargo-careful/blob/master/LICENSE-APACHE) |
 | [**cargo-cyclonedx**](https://github.com/CycloneDX/cyclonedx-rust-cargo) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/CycloneDX/cyclonedx-rust-cargo/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/CycloneDX/cyclonedx-rust-cargo/blob/main/LICENSE) |
 | [**cargo-deadlinks**](https://github.com/deadlinks/cargo-deadlinks) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/deadlinks/cargo-deadlinks/releases) | Linux, macOS, Windows | [MIT](https://github.com/deadlinks/cargo-deadlinks/blob/master/LICENSE-MIT) OR [Apache-2.0](https://github.com/deadlinks/cargo-deadlinks/blob/master/LICENSE-APACHE) |
@@ -80,6 +80,7 @@ See the [Supported tools section in README.md](README.md#supported-tools) for ho
 | [**protoc**](https://github.com/protocolbuffers/protobuf) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/protocolbuffers/protobuf/releases) | Linux, macOS, Windows | [BSD-3-Clause](https://github.com/protocolbuffers/protobuf/blob/main/LICENSE) |
 | [**rclone**](https://github.com/rclone/rclone) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/rclone/rclone/releases) | Linux, macOS, Windows | [MIT](https://github.com/rclone/rclone/blob/master/COPYING) |
 | [**release-plz**](https://release-plz.dev/) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/release-plz/release-plz/releases) | Linux, macOS, Windows | [MIT](https://github.com/release-plz/release-plz/blob/main/LICENSE-MIT) OR [Apache-2.0](https://github.com/release-plz/release-plz/blob/main/LICENSE-APACHE) |
+| [**rust**](https://rust-lang.org) | `$CARGO_HOME/bin` | rustup | Linux, macOS, Windows | [Apache-2.0 OR MIT](https://github.com/rust-lang/rust/blob/main/COPYRIGHT) |
 | [**sccache**](https://github.com/mozilla/sccache) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/mozilla/sccache/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/mozilla/sccache/blob/main/LICENSE) |
 | [**shellcheck**](https://www.shellcheck.net) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/koalaman/shellcheck/releases) | Linux, macOS, Windows | [GPL-3.0](https://github.com/koalaman/shellcheck/blob/master/LICENSE) |
 | [**shfmt**](https://github.com/mvdan/sh) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/mvdan/sh/releases) | Linux, macOS, Windows | [BSD-3-Clause](https://github.com/mvdan/sh/blob/master/LICENSE) |

action.yml

@@ -4,8 +4,8 @@ description: GitHub Action for installing development tools
 inputs:
   tool:
     description: Tools to install (whitespace or comma separated list)
-    required: true
+    required: false
-    # default: #publish:tool
+    default: protoc
   checksum:
     description: Whether to enable checksums (strongly discouraged to disable)
     required: false
@@ -22,11 +22,14 @@ runs:
   using: composite
   steps:
     - run: |
+        bail() {
+          printf '::error::install-action: %s\n' "$*"
+          exit 1
+        }
         # If /bin/sh is dash, environment variable containing % is not imported, but is fine
         # because it also means that it will not be exposed to subprocess.
         if /usr/bin/env | grep -Eq '^BASH_FUNC_'; then
-          printf '::error::bash function injection via BASH_FUNC_ environment variable is not allowed for security reasons\n'
+          bail 'bash function injection via BASH_FUNC_ environment variable is not allowed for security reasons'
-          exit 1
         fi
         if ! command -v bash >/dev/null; then
           if grep -Eq '^ID=alpine' /etc/os-release; then
@@ -41,8 +44,7 @@ runs:
             fi
             printf '::endgroup::\n'
           else
-            printf '::error::install-action requires bash\n'
+            bail 'this action requires bash'
-            exit 1
           fi
         fi
         bash --noprofile --norc "${GITHUB_ACTION_PATH:?}/main.sh"
@@ -54,6 +56,8 @@ runs:
         INPUT_FALLBACK: ${{ inputs.fallback }}
         DEFAULT_GITHUB_TOKEN: ${{ inputs.fallback == 'cargo-binstall' && github.token || '' }}
         ACTION_USER_AGENT: ${{ github.action_repository }} (${{ github.action_ref }})
+        RUNNER_OS: ${{ runner.os }}
+        RUNNER_ARCH: ${{ runner.arch }}
       if: runner.os != 'Windows'
     # Use pwsh and retry on bash startup failure to work around windows-11-arm runner bug:
     # https://github.com/actions/partner-runner-images/issues/169
@@ -75,10 +79,10 @@ runs:
             exit $code
           }
           if ($i -lt 10) {
-            Write-Output "::warning::installation failed due to bash startup failure (<https://github.com/actions/partner-runner-images/issues/169>); retrying..."
+            Write-Output "::warning::install-action: installation failed due to bash startup failure (<https://github.com/actions/partner-runner-images/issues/169>); retrying..."
           }
         }
-        Write-Output "::error::installation failed due to bash startup failure (<https://github.com/actions/partner-runner-images/issues/169>); this maybe resolved by re-running job"
+        Write-Output "::error::install-action: installation failed due to bash startup failure (<https://github.com/actions/partner-runner-images/issues/169>); this maybe resolved by re-running job"
         exit 1
       shell: pwsh
       env:
@@ -88,4 +92,6 @@ runs:
         INPUT_FALLBACK: ${{ inputs.fallback }}
         DEFAULT_GITHUB_TOKEN: ${{ inputs.fallback == 'cargo-binstall' && github.token || '' }}
         ACTION_USER_AGENT: ${{ github.action_repository }} (${{ github.action_ref }})
+        RUNNER_OS: ${{ runner.os }}
+        RUNNER_ARCH: ${{ runner.arch }}
       if: runner.os == 'Windows'

main.sh

@@ -9,6 +9,14 @@ rx() {
     "$@"
   )
 }
+g() {
+  IFS=' '
+  local cmd="$*"
+  IFS=$'\n\t'
+  printf '::group::%s\n' "${cmd#retry }"
+  "$@"
+  printf '::endgroup::\n'
+}
 retry() {
   for i in {1..10}; do
     if "$@"; then
@@ -20,11 +28,11 @@ retry() {
   "$@"
 }
 bail() {
-  printf '::error::%s\n' "$*"
+  printf '::error::install-action: %s\n' "$*"
   exit 1
 }
 warn() {
-  printf '::warning::%s\n' "$*"
+  printf '::warning::install-action: %s\n' "$*"
 }
 info() {
   printf >&2 'info: %s\n' "$*"
@@ -35,11 +43,11 @@ normalize_comma_or_space_separated() {
   if [[ "${list}" == *","* ]]; then
     # If a comma is contained, consider it is a comma-separated list.
     # Drop leading and trailing whitespaces in each element.
-    sed -E 's/ *, */,/g; s/^.//; s/,,$/,/' <<<",${list},"
+    sed -E 's/ *\+ */+/g; s/ *, */,/g; s/^.//; s/,,$/,/' <<<",${list},"
   else
     # Otherwise, consider it is a whitespace-separated list.
     # Convert whitespace characters into comma.
-    sed -E 's/ +/,/g; s/^.//' <<<" ${list} "
+    sed -E 's/ *\+ */+/g; s/ +/,/g; s/^.//' <<<" ${list} "
   fi
 }
 _sudo() {
@@ -374,7 +382,7 @@ install_cargo_binstall() {
       info "cargo-binstall already installed at ${cargo_bin}/cargo-binstall${exe}"
       install_binstall=''
     else
-      info "cargo-binstall already installed at ${cargo_bin}/cargo-binstall${exe}, but is not compatible version with install-action, upgrading"
+      info "cargo-binstall already installed at ${cargo_bin}/cargo-binstall${exe}, but is not compatible version with this action, upgrading"
       rm -- "${cargo_bin}/cargo-binstall${exe}"
     fi
   fi
@@ -507,10 +515,13 @@ token="${GITHUB_TOKEN:-"${GH_TOKEN:-"${DEFAULT_GITHUB_TOKEN:-}"}"}"
 # via `ps -Eww` on macOS. It only reduces the risk of leaks.
 unset GITHUB_TOKEN GH_TOKEN DEFAULT_GITHUB_TOKEN
 
-# Refs: https://github.com/rust-lang/rustup/blob/HEAD/rustup-init.sh
+# Refs:
+# - https://github.com/rust-lang/rustup/blob/HEAD/rustup-init.sh
+# - https://docs.github.com/en/actions/reference/workflows-and-actions/contexts#runner-context
+# NB: Sync with tools/ci/tool-list.sh.
 base_distro=''
 exe=''
-case "$(uname -s)" in
+case "${RUNNER_OS}" in
   Linux)
     host_os=linux
     ldd_version=$(ldd --version 2>&1 || true)
@@ -560,16 +571,15 @@ case "$(uname -s)" in
         ;;
     esac
     ;;
-  Darwin) host_os=macos ;;
+  macOS) host_os=macos ;;
-  MINGW* | MSYS* | CYGWIN* | Windows_NT)
+  Windows)
     host_os=windows
     exe=.exe
     ;;
-  *) bail "unrecognized OS type '$(uname -s)'" ;;
+  *) bail "unrecognized runner.os '${RUNNER_OS}'" ;;
 esac
-# NB: Sync with tools/ci/tool-list.sh.
+case "${RUNNER_ARCH}" in
-case "$(uname -m)" in
+  X64) host_arch=x86_64 ;;
-  aarch64 | arm64) host_arch=aarch64 ;;
   # Ignore 32-bit Arm for now, as we need to consider the version and whether hard-float is supported.
   # https://github.com/rust-lang/rustup/pull/593
   # https://github.com/cross-rs/cross/pull/1018
@@ -578,21 +588,32 @@ case "$(uname -m)" in
   # Does it seem only armv7l+ is supported?
   # https://github.com/actions/runner/blob/v2.321.0/src/Misc/externals.sh#L178
   # https://github.com/actions/runner/issues/688
-  xscale | arm | armv*l) bail "32-bit Arm runner is not supported yet by this action; if you need support for this platform, please submit an issue at <https://github.com/taiki-e/install-action>" ;;
+  ARM) bail "32-bit Arm runner is currently not supported; if you need support for this platform, please submit an issue at <https://github.com/taiki-e/install-action>" ;;
-  ppc64le) host_arch=powerpc64le ;;
+  X86) bail "32-bit x86 runner is currently not supported; if you need support for this platform, please submit an issue at <https://github.com/taiki-e/install-action>" ;;
-  riscv64) host_arch=riscv64 ;;
+  ARM64) host_arch=aarch64 ;;
-  s390x) host_arch=s390x ;;
+  PPC64LE) host_arch=powerpc64le ;;
-  # Very few tools provide prebuilt binaries for these.
+  RISCV64) host_arch=riscv64 ;;
-  # TODO: fallback to `cargo install`? (binstall fallback is not good idea here as cargo-binstall doesn't provide prebuilt binaries for these.)
+  S390X) host_arch=s390x ;;
-  loongarch64 | mips | mips64 | ppc | ppc64 | sun4v) bail "$(uname -m) runner is not supported yet by this action; if you need support for this platform, please submit an issue at <https://github.com/taiki-e/install-action>" ;;
+  *)
-  # GitHub Actions Runner supports x86_64/AArch64/Arm Linux and x86_64/AArch64 Windows/macOS.
+    info "unrecognized runner.arch '${RUNNER_ARCH}'; fallback to uname -m"
-  # https://github.com/actions/runner/blob/v2.332.0/.github/workflows/build.yml#L24
+    case "$(uname -m)" in
-  # https://docs.github.com/en/actions/reference/runners/self-hosted-runners#supported-processor-architectures
+      aarch64 | arm64) host_arch=aarch64 ;;
-  # And IBM provides runners for powerpc64le/s390x Linux.
+      xscale | arm | armv*l) bail "32-bit Arm runner is currently not supported; if you need support for this platform, please submit an issue at <https://github.com/taiki-e/install-action>" ;;
-  # https://github.com/IBM/actionspz
+      ppc64le) host_arch=powerpc64le ;;
-  # So we can assume x86_64 unless it has a known non-x86_64 uname -m result.
+      riscv64) host_arch=riscv64 ;;
-  # TODO: uname -m on windows-11-arm returns "x86_64"
+      s390x) host_arch=s390x ;;
-  *) host_arch=x86_64 ;;
+      # Very few tools provide prebuilt binaries for these.
+      # TODO: fallback to `cargo install`? (binstall fallback is not good idea here as cargo-binstall doesn't provide prebuilt binaries for these.)
+      loongarch64 | mips | mips64 | ppc | ppc64 | sun4v) bail "$(uname -m) runner is not supported yet; please submit an issue at <https://github.com/taiki-e/install-action>" ;;
+      # GitHub Actions Runner supports x86_64/AArch64/Arm Linux and x86_64/AArch64 Windows/macOS.
+      # https://github.com/actions/runner/blob/v2.332.0/.github/workflows/build.yml#L24
+      # https://docs.github.com/en/actions/reference/runners/self-hosted-runners#supported-processor-architectures
+      # And IBM provides runners for powerpc64le/s390x Linux.
+      # https://github.com/IBM/actionspz
+      # So we can assume x86_64 unless it has a known non-x86_64 uname -m result.
+      *) host_arch=x86_64 ;;
+    esac
+    ;;
 esac
 info "host platform: ${host_arch}_${host_os}"
 
@@ -682,18 +703,18 @@ case "${host_os}" in
           fi
           printf '::endgroup::\n'
           ;;
-        *) warn "install-action requires at least jq and curl on non-Debian/Fedora/SUSE/Arch/Alpine-based Linux" ;;
+        *) warn "this action requires at least jq and curl on non-Debian/Fedora/SUSE/Arch/Alpine-based Linux" ;;
       esac
     fi
     ;;
   macos)
     if ! type -P jq >/dev/null || ! type -P curl >/dev/null; then
-      warn "install-action requires at least jq and curl on macOS"
+      warn "this action requires at least jq and curl on macOS"
     fi
     ;;
   windows)
     if ! type -P curl >/dev/null; then
-      warn "install-action requires at least curl on Windows"
+      warn "this action requires at least curl on Windows"
     fi
     if [[ -f "${install_action_dir}/jq/bin/jq.exe" ]]; then
       jq() { "${install_action_dir}/jq/bin/jq.exe" -b "$@"; }
@@ -727,20 +748,149 @@ esac
 
 unsupported_tools=()
 for tool in "${tools[@]}"; do
-  if [[ "${tool}" == *"@"* ]]; then
+  additional=''
+  if [[ "${tool}" == *'+'* ]]; then
+    additional="${tool#*+}"
+    tool="${tool%%+*}"
+  fi
+  if [[ "${tool}" == *'@'* ]]; then
     version="${tool#*@}"
     tool="${tool%@*}"
-    if [[ ! "${version}" =~ ^([1-9][0-9]*(\.[0-9]+(\.[0-9]+)?)?|0\.[1-9][0-9]*(\.[0-9]+)?|^0\.0\.[0-9]+)(-[0-9A-Za-z\.-]+)?$|^latest$ ]]; then
+    if [[ "${tool}" != 'rust' ]]; then
-      if [[ ! "${version}" =~ ^([1-9][0-9]*(\.[0-9]+(\.[0-9]+)?)?|0\.[1-9][0-9]*(\.[0-9]+)?|^0\.0\.[0-9]+)(-[0-9A-Za-z\.-]+)?(\+[0-9A-Za-z\.-]+)?$|^latest$ ]]; then
+      if [[ ! "${version}" =~ ^([1-9][0-9]*(\.[0-9]+(\.[0-9]+)?)?|0\.[1-9][0-9]*(\.[0-9]+)?|^0\.0\.[0-9]+)(-[0-9A-Za-z\.-]+)?$|^latest$ ]]; then
-        bail "install-action does not support semver operators: '${version}'"
+        if [[ ! "${version}" =~ ^([1-9][0-9]*(\.[0-9]+(\.[0-9]+)?)?|0\.[1-9][0-9]*(\.[0-9]+)?|^0\.0\.[0-9]+)(-[0-9A-Za-z\.-]+)?(\+[0-9A-Za-z\.-]+)?$|^latest$ ]]; then
+          bail "semver operators are not supported in 'tool' input option: '${version}'"
+        fi
+        bail "install-action v2 does not support semver build-metadata: '${version}'; if you need these supports again, please submit an issue at <https://github.com/taiki-e/install-action>"
       fi
-      bail "install-action v2 does not support semver build-metadata: '${version}'; if you need these supports again, please submit an issue at <https://github.com/taiki-e/install-action>"
     fi
   else
     version=latest
   fi
+  if [[ -n "${additional}" ]]; then
+    case "${tool}" in
+      rust) ;;
+      *) bail "<tool_name>+<additional> syntax is not supported for ${tool}" ;;
+    esac
+  fi
   installed_bin=()
   case "${tool}" in
+    rust)
+      if [[ "${version}" == 'latest' ]]; then
+        version=stable
+      fi
+      info "installing ${tool}@${version}"
+      export RUSTUP_MAX_RETRIES="${RUSTUP_MAX_RETRIES:-10}"
+      rustup_args=(--profile minimal)
+      if [[ -n "${additional}" ]]; then
+        component=''
+        target=''
+        while read -rd+; do
+          case "${REPLY}" in
+            # Last checked: nightly-2026-05-03
+            # rustup component list
+            # rustup target list
+            cargo | cargo-* | clippy | clippy-* | llvm-* | miri | miri-* | rust-* | rustc-* | rustfmt | rustfmt-*) component+=",${REPLY}" ;;
+            *) target+=",${REPLY}" ;;
+          esac
+        done <<<"${additional}+"
+        if [[ -n "${component}" ]]; then
+          if [[ "${component}," == *',miri,'* ]] && [[ "${component}," != *',rust-src,'* ]]; then
+            component+=',rust-src'
+          fi
+          rustup_args+=(--component "${component#,}")
+        fi
+        if [[ -n "${target}" ]]; then
+          rustup_args+=(--target "${target#,}")
+        fi
+      fi
+      if type -P rustup >/dev/null; then
+        # --no-self-update is necessary because the windows environment cannot self-update rustup.exe.
+        g retry rustup toolchain add "${version}" --no-self-update "${rustup_args[@]}"
+        g rustup default "${version}"
+      else
+        # https://github.com/rust-lang/rustup/tags
+        # Run tools/rustup-hash.sh to get sha256 hash.
+        rustup_version=1.29.0
+        # https://rust-lang.github.io/rustup/installation/other.html#manual-installation
+        rust_target=''
+        checksum=''
+        case "${host_os}" in
+          linux)
+            rust_target="${host_arch}-unknown-${host_os}-${host_env}"
+            case "${host_arch}" in
+              x86_64)
+                case "${host_env}" in
+                  gnu) checksum=4acc9acc76d5079515b46346a485974457b5a79893cfb01112423c89aeb5aa10 ;;
+                  musl) checksum=9cd3fda5fd293890e36ab271af6a786ee22084b5f6c2b83fd8323cec6f0992c1 ;;
+                esac
+                ;;
+              aarch64)
+                case "${host_env}" in
+                  gnu) checksum=9732d6c5e2a098d3521fca8145d826ae0aaa067ef2385ead08e6feac88fa5792 ;;
+                  musl) checksum=88761caacddb92cd79b0b1f939f3990ba1997d701a38b3e8dd6746a562f2a759 ;;
+                esac
+                ;;
+              powerpc64le)
+                case "${host_env}" in
+                  gnu) checksum=4bfff85bd3967d988e14567aa9cc6ab0ea386f0ffeff0f9f14d23f0103bf1f97 ;;
+                  musl) checksum=e15d033af90b7a55d170aac2d82cc28ddd96dbfcdda7c6d4eb8cb064a99c4646 ;;
+                esac
+                ;;
+              riscv64)
+                rust_target="${host_arch}gc-unknown-${host_os}-${host_env}"
+                # riscv64gc-unknown-linux-musl is tier 2 without host tools
+                case "${host_env}" in
+                  gnu) checksum=7e43f2b2e6307d61da17a4dff61e6bceef408b8189822df64e1094590d2a70f9 ;;
+                esac
+                ;;
+              s390x)
+                # s390x-unknown-linux-musl is tier 3
+                case "${host_env}" in
+                  gnu) checksum=66c2c132428b6b77803facb02cbdf33b89d20c00bd20da142be8cb651f2e7cd8 ;;
+                esac
+                ;;
+            esac
+            ;;
+          macos)
+            rust_target="${host_arch}-apple-darwin"
+            case "${host_arch}" in
+              x86_64) checksum=33cf85df9142bc6d29cbc62fa5ca1d4c29622cddb55213a4c1a43c457fb9b2d7 ;;
+              aarch64) checksum=aeb4105778ca1bd3c6b0e75768f581c656633cd51368fa61289b6a71696ac7e1 ;;
+            esac
+            ;;
+          windows)
+            rust_target="${host_arch}-pc-windows-msvc"
+            case "${host_arch}" in
+              x86_64) checksum=86478e53f769379d7f0ebfa7c9aa97cb76ca92233f79aa2cc0dbee2efaac73c7 ;;
+              aarch64) checksum=3af309e6c3062aa11df0e932954f69d13b734d8a431e593812f3ecd9ff9e6ef6 ;;
+            esac
+            ;;
+        esac
+        if [[ -z "${rust_target}" ]] || [[ -z "${checksum}" ]]; then
+          bail "unsupported host platform ${host_arch}_${host_os} for ${tool}"
+        fi
+        url="https://static.rust-lang.org/rustup/archive/${rustup_version}/${rust_target}/rustup-init${exe}"
+        mkdir -p -- "${tmp_dir}"
+        (
+          cd -- "${tmp_dir}"
+          download_and_checksum "${url}" "${checksum}"
+          mv -- tmp rustup-init
+          case "${host_os}" in
+            linux | macos) chmod +x ./rustup-init ;;
+          esac
+          g retry ./rustup-init -y --default-toolchain "${version}" --no-modify-path "${rustup_args[@]}"
+        )
+        rm -rf -- "${tmp_dir}"
+        cargo_bin_dir="${CARGO_HOME:-"${home}/.cargo"}/bin"
+        export PATH="${PATH}:${cargo_bin_dir}"
+        cargo_bin_dir=$(canonicalize_windows_path "${cargo_bin_dir}")
+        info "adding '${cargo_bin_dir}' to PATH"
+        printf '%s\n' "${cargo_bin_dir}" >>"${GITHUB_PATH}"
+        cargo_path=$(type -P cargo || true)
+      fi
+      installed_bin=("rustc${exe}" "cargo${exe}")
+      ;;
     protoc)
       info "installing ${tool}@${version}"
       read_manifest "protoc" "${version}"
@@ -782,11 +932,11 @@ for tool in "${tools[@]}"; do
       info "installing ${tool}@${version}"
       case "${version}" in
         latest) ;;
-        *) warn "specifying the version of ${tool} is not supported yet by this action" ;;
+        *) warn "specifying the version of ${tool} is not supported" ;;
       esac
       case "${host_os}" in
         linux) ;;
-        macos | windows) bail "${tool} for non-Linux is not supported yet by this action" ;;
+        macos | windows) bail "${tool} for non-Linux is not supported" ;;
         *) bail "unsupported host OS '${host_os}' for ${tool}" ;;
       esac
       # libc6-dbg is needed to run Valgrind
@@ -799,7 +949,7 @@ for tool in "${tools[@]}"; do
     cargo-binstall)
       case "${version}" in
         latest) ;;
-        *) warn "specifying the version of ${tool} is not supported by this action" ;;
+        *) warn "specifying the version of ${tool} is not supported" ;;
       esac
       install_cargo_binstall
       printf '\n'
@@ -1002,7 +1152,6 @@ if [[ ${#unsupported_tools[@]} -gt 0 ]]; then
       fi
       if [[ -z "${cargo_path}" ]]; then
         _bin_dir=$(canonicalize_windows_path "${home}/.cargo/bin")
-        # TODO: avoid this when already added
         info "adding '${_bin_dir}' to PATH"
         printf '%s\n' "${_bin_dir}" >>"${GITHUB_PATH}"
       fi

manifests/mise.json

@@ -27,10 +27,13 @@
     }
   },
   "latest": {
-    "version": "2026.4.28"
+    "version": "2026.5.0"
   },
   "2026": {
-    "version": "2026.4.28"
+    "version": "2026.5.0"
+  },
+  "2026.5": {
+    "version": "2026.5.0"
   },
   "2026.5.0": {
     "x86_64_linux_musl": {

manifests/tombi.json

@@ -7,6 +7,42 @@
   "0.10": {
     "version": "0.10.2"
   },
+  "0.10.3": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/tombi-toml/tombi/releases/download/v0.10.3/tombi-cli-0.10.3-x86_64-unknown-linux-musl.tar.gz",
+      "etag": "0x8DEA9E19B70067F",
+      "hash": "179a43d5f9656ead70477de4b09c9bdd869ba386618d0b2e2c255b3473dd0593",
+      "bin": "tombi-cli-0.10.3-x86_64-unknown-linux-musl/tombi"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/tombi-toml/tombi/releases/download/v0.10.3/tombi-cli-0.10.3-x86_64-apple-darwin.tar.gz",
+      "etag": "0x8DEA9E19A72ED10",
+      "hash": "e6418659f2ed54c3c1a371cdd9c2281880a8cbba047caf920067843e7bdc7c10",
+      "bin": "tombi-cli-0.10.3-x86_64-apple-darwin/tombi"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/tombi-toml/tombi/releases/download/v0.10.3/tombi-cli-0.10.3-x86_64-pc-windows-msvc.zip",
+      "etag": "0x8DEA9E19A8E6C75",
+      "hash": "0972c9dbbc7a83b30c992c3ac564c6601aca3776c004d9e1b300f03bb410975d"
+    },
+    "aarch64_linux_musl": {
+      "url": "https://github.com/tombi-toml/tombi/releases/download/v0.10.3/tombi-cli-0.10.3-aarch64-unknown-linux-musl.tar.gz",
+      "etag": "0x8DEA9E19A7754EA",
+      "hash": "7c7e0e7950086947137f6d453a0e6137ae08baa5bed491cb10af0528f56768aa",
+      "bin": "tombi-cli-0.10.3-aarch64-unknown-linux-musl/tombi"
+    },
+    "aarch64_macos": {
+      "url": "https://github.com/tombi-toml/tombi/releases/download/v0.10.3/tombi-cli-0.10.3-aarch64-apple-darwin.tar.gz",
+      "etag": "0x8DEA9E19A82B9C9",
+      "hash": "f28035c9bf37d3a3ef73047ba1f31dcdfb9531ff6fe278dcfef1ad6c13c8d5bc",
+      "bin": "tombi-cli-0.10.3-aarch64-apple-darwin/tombi"
+    },
+    "aarch64_windows": {
+      "url": "https://github.com/tombi-toml/tombi/releases/download/v0.10.3/tombi-cli-0.10.3-aarch64-pc-windows-msvc.zip",
+      "etag": "0x8DEA9E19B1B40FC",
+      "hash": "7554606c2e2feb809c748042eb05e3e7303d830e93123e6acad7c53b5ace99da"
+    }
+  },
   "0.10.2": {
     "x86_64_linux_musl": {
       "url": "https://github.com/tombi-toml/tombi/releases/download/v0.10.2/tombi-cli-0.10.2-x86_64-unknown-linux-musl.tar.gz",

tools/ci/manifest.sh

@@ -30,9 +30,14 @@ for manifest in manifests/*.json; do
     git stash pop
     new_version=$(jq -r '.latest.version' "${manifest}")
     if [[ "${old_version}" != "${new_version}" ]]; then
-      # TODO: If there is a line about updating the same tool in the "Unreleased" section, replace it.
+      unreleased=$(parse-changelog CHANGELOG.md Unreleased)
       msg="Update \`${name}@latest\` to ${new_version}"
-      sed -Ei "s/^## \\[Unreleased\\]/## [Unreleased]\\n\\n- ${msg}./" CHANGELOG.md
+      if grep -Eq "^- Update \`${name}@latest\` to " <<<"${unreleased}"; then
+        # If there is a line about updating the same tool in the "Unreleased" section, replace it.
+        sed -Ei "0,/^- Update \`${name}@latest\` to .*/s//- ${msg}./" CHANGELOG.md
+      else
+        sed -Ei "s/^## \\[Unreleased\\]/## [Unreleased]\\n\\n- ${msg}./" CHANGELOG.md
+      fi
       git add "${manifest}" CHANGELOG.md
     else
       msg="Update ${name} manifest"

tools/ci/tool-list.sh

@@ -48,6 +48,7 @@ glibc_pre_2_27_incompat=(
 glibc_pre_2_17_incompat=(
   "${glibc_pre_2_27_incompat[@]}"
   deepsource # https://github.com/DeepSourceCorp/cli/issues/245
+  rust
 )
 musl_incompat=(
   "${glibc_pre_2_17_incompat[@]}"
@@ -194,6 +195,41 @@ if [[ "${version}" != "latest" ]]; then
 fi
 
 # Not manifest-based
+case "${runner}" in
+  # requires glibc 2.17 / musl 1.2
+  centos:6 | alpine:3.2) ;;
+  *)
+    case $((RANDOM % 4)) in
+      0) rust=rust ;;
+      1) rust=rust@stable ;;
+      2) rust=rust@nightly ;;
+      3) rust=rust@1.93 ;;
+    esac
+    case $((RANDOM % 3)) in
+      0) ;;
+      1) rust+='+thumbv6m-none-eabi' ;;
+      2) rust+=' + thumbv6m-none-eabi' ;;
+    esac
+    if [[ "${rust}" == *'nightly'* ]]; then
+      component=miri
+    else
+      component=rustfmt
+    fi
+    case $((RANDOM % 5)) in
+      0) ;;
+      1) rust+="+${component}" ;;
+      2) rust+=" + ${component}" ;;
+      3) rust+=" +${component}" ;;
+      4) rust+="+ ${component}" ;;
+    esac
+    case $((RANDOM % 3)) in
+      0) ;;
+      1) rust+='+thumbv7m-none-eabi' ;;
+      2) rust+=' + thumbv7m-none-eabi' ;;
+    esac
+    tools+=("${rust}")
+    ;;
+esac
 case "${host_os}" in
   linux*)
     # Installing snap to container is difficult...

tools/codegen/src/tools-markdown.rs

@@ -52,18 +52,32 @@ fn main() {
     let mut paths: Vec<_> = fs::read_dir(&manifest_dir).unwrap().map(|r| r.unwrap()).collect();
     paths.sort_by_key(fs_err::DirEntry::path);
 
-    let mut tools = vec![MarkdownEntry {
+    let mut tools = vec![
-        name: "valgrind".to_owned(),
+        MarkdownEntry {
-        alias: None,
+            name: "rust".to_owned(),
-        website: "https://valgrind.org/".to_owned(),
+            alias: None,
-        installed_to: InstalledTo::Snap,
+            website: "https://rust-lang.org".to_owned(),
-        installed_from: InstalledFrom::Snap,
+            installed_to: InstalledTo::Cargo,
-        platforms: Platforms { linux: true, ..Default::default() },
+            installed_from: InstalledFrom::Rustup,
-        repository: "https://sourceware.org/git/valgrind.git".to_owned(),
+            platforms: Platforms { linux: true, macos: true, windows: true },
-        license_markdown:
+            repository: "https://github.com/rust-lang/rust".to_owned(),
-            "[GPL-2.0](https://sourceware.org/git/?p=valgrind.git;a=blob;f=COPYING;hb=HEAD)"
+            license_markdown:
-                .to_owned(),
+                "[Apache-2.0 OR MIT](https://github.com/rust-lang/rust/blob/main/COPYRIGHT)"
-    }];
+                    .to_owned(),
+        },
+        MarkdownEntry {
+            name: "valgrind".to_owned(),
+            alias: None,
+            website: "https://valgrind.org/".to_owned(),
+            installed_to: InstalledTo::Snap,
+            installed_from: InstalledFrom::Snap,
+            platforms: Platforms { linux: true, ..Default::default() },
+            repository: "https://sourceware.org/git/valgrind.git".to_owned(),
+            license_markdown:
+                "[GPL-2.0](https://sourceware.org/git/?p=valgrind.git;a=blob;f=COPYING;hb=HEAD)"
+                    .to_owned(),
+        },
+    ];
 
     for path in paths {
         let file_name = path.file_name();
@@ -153,6 +167,7 @@ struct MarkdownEntry {
 #[derive(Debug, Eq, PartialEq)]
 enum InstalledFrom {
     GitHubRelease,
+    Rustup,
     Snap,
 }
 
@@ -215,6 +230,9 @@ impl fmt::Display for MarkdownEntry {
                 let markdown = format!("| [GitHub Releases]({}/releases) ", self.repository);
                 f.write_str(&markdown)?;
             }
+            InstalledFrom::Rustup => {
+                f.write_str("| rustup ")?;
+            }
             InstalledFrom::Snap => {
                 let markdown =
                     format!("| [snap](https://snapcraft.io/install/{}/ubuntu) ", self.name);

tools/rustup-hash.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: Apache-2.0 OR MIT
+set -CeEuo pipefail
+IFS=$'\n\t'
+trap -- 's=$?; printf >&2 "%s\n" "${0##*/}:${LINENO}: \`${BASH_COMMAND}\` exit with ${s}"; exit ${s}' ERR
+cd -- "$(dirname -- "$0")"/..
+
+# Get sha256 hash of rustup-init binaries
+
+# NB: Synch with main.sh.
+rustup_version=1.29.0
+targets=(
+  x86_64-unknown-linux-gnu
+  x86_64-unknown-linux-musl
+  aarch64-unknown-linux-gnu
+  aarch64-unknown-linux-musl
+  powerpc64le-unknown-linux-gnu
+  powerpc64le-unknown-linux-musl
+  riscv64gc-unknown-linux-gnu
+  # riscv64gc-unknown-linux-musl # tier 2 without host tools
+  s390x-unknown-linux-gnu
+  # s390x-unknown-linux-musl # tier 3
+  x86_64-apple-darwin
+  aarch64-apple-darwin
+  x86_64-pc-windows-msvc
+  aarch64-pc-windows-msvc
+)
+
+for rust_target in "${targets[@]}"; do
+  exe=''
+  case "${rust_target}" in
+    *-windows*) exe=.exe ;;
+  esac
+  url="https://static.rust-lang.org/rustup/archive/${rustup_version}/${rust_target}/rustup-init${exe}.sha256"
+  printf '%s: ' "${rust_target}"
+  curl --proto '=https' --tlsv1.2 -fsSL --retry 10 "${url}" | cut -d' ' -f1
+done