xbuild

.github/dependabot.yml

@@ -15,7 +15,7 @@ updates:
   - package-ecosystem: github-actions
     directory: /
     schedule:
-      interval: monthly
+      interval: weekly
     cooldown:
       default-days: 14
     commit-message:

.github/workflows/ci.yml

@@ -1,6 +1,7 @@
 name: CI
 
-permissions: {}
+permissions:
+  contents: read
 
 on:
   pull_request:
@@ -32,20 +33,20 @@ concurrency:
 
 jobs:
   miri:
-    uses: taiki-e/github-actions/.github/workflows/miri.yml@5f549ff6b21e9a853f5f613784d5db27746fd2bc # main
+    uses: taiki-e/github-actions/.github/workflows/miri.yml@3c1cac16ef654d1febb66f21f328fa167f0d2fef # main
     with:
       # NB: sync with test job's --exclude option
       args: --exclude install-action-internal-codegen
   msrv:
-    uses: taiki-e/github-actions/.github/workflows/msrv.yml@5f549ff6b21e9a853f5f613784d5db27746fd2bc # main
+    uses: taiki-e/github-actions/.github/workflows/msrv.yml@3c1cac16ef654d1febb66f21f328fa167f0d2fef # main
   test-manifest-schema:
-    uses: taiki-e/github-actions/.github/workflows/test.yml@5f549ff6b21e9a853f5f613784d5db27746fd2bc # main
+    uses: taiki-e/github-actions/.github/workflows/test.yml@3c1cac16ef654d1febb66f21f328fa167f0d2fef # main
     with:
       # NB: sync with miri job's --exclude option
       test-args: --exclude install-action-internal-codegen
       no-std: false
   tidy:
-    uses: taiki-e/github-actions/.github/workflows/tidy.yml@5f549ff6b21e9a853f5f613784d5db27746fd2bc # main
+    uses: taiki-e/github-actions/.github/workflows/tidy.yml@3c1cac16ef654d1febb66f21f328fa167f0d2fef # main
     permissions:
       contents: write # for creating branch for pr
       pull-requests: write # unused (used in `codegen-automerge: true` case)
@@ -150,7 +151,7 @@ jobs:
         if: matrix.bash != 'cygwin' && matrix.os != 'windows-11-arm'
 
   test-alias:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
       - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
@@ -254,7 +255,7 @@ jobs:
           - alpine:3.22 # musl 1.2.5
           - alpine:3.23 # musl 1.2.5
           # - openwrt/rootfs:x86-64-openwrt-24.10 # musl 1.2.5
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     timeout-minutes: 60
     container: ${{ matrix.container }}
     steps:

.github/workflows/manifest.yml

@@ -1,6 +1,7 @@
 name: Manifest
 
-permissions: {}
+permissions:
+  contents: read
 
 on:
   pull_request:
@@ -32,7 +33,7 @@ concurrency:
 
 jobs:
   manifest:
-    uses: taiki-e/github-actions/.github/workflows/gen.yml@5f549ff6b21e9a853f5f613784d5db27746fd2bc # main
+    uses: taiki-e/github-actions/.github/workflows/gen.yml@3c1cac16ef654d1febb66f21f328fa167f0d2fef # main
     permissions:
       contents: write # for creating branch for pr
       pull-requests: write # for gh pr review --approve

.github/workflows/release.yml

@@ -2,7 +2,8 @@ name: Release
 
 # Adapted from https://github.com/taiki-e/github-actions/blob/HEAD/.github/workflows/action-release.yml.
 
-permissions: {}
+permissions:
+  contents: read
 
 on:
   workflow_dispatch:
@@ -25,7 +26,7 @@ on:
 
 defaults:
   run:
-    shell: bash --noprofile --norc -CeEuo pipefail {0}
+    shell: bash --noprofile --norc -CeEuxo pipefail {0}
 
 concurrency:
   group: ${{ github.workflow }}
@@ -34,7 +35,7 @@ concurrency:
 jobs:
   prepare:
     if: github.repository_owner == 'taiki-e' && inputs.target == 'install-action'
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
       - uses: taiki-e/checkout-action@7d1e50e93dc4fb3bba58f85018fadf77898aee8b # v1.4.2
@@ -44,6 +45,7 @@ jobs:
           fallback: none
       - id: check
         run: |
+          set +x
           IFS=$'\n\t'
           trap -- 's=$?; printf >&2 "%s\n" "${0##*/}:${LINENO}: \`${BASH_COMMAND}\` exit with ${s}"; exit ${s}' ERR
           retry() {
@@ -68,23 +70,23 @@ jobs:
 
           # shellcheck disable=SC2153
           version="${VERSION}"
-          printf 'version(input): %s\n' "${version}"
+          printf '%s\n' "version(input): ${version}"
           # shellcheck disable=SC2153
           tag_prefix="${TAG_PREFIX}"
-          printf 'tag_prefix: %s\n' "${tag_prefix}"
+          printf '%s\n' "tag_prefix: ${tag_prefix}"
           # shellcheck disable=SC2153
           changelog="${CHANGELOG}"
-          printf 'changelog: %s\n' "${changelog}"
+          printf '%s\n' "changelog: ${changelog}"
 
           # Get the current date.
           release_date=$(date -u '+%Y-%m-%d')
-          printf 'release-date: %s\n' "${release_date}"
-          printf 'release-date=%s\n' "${release_date}" >>"${GITHUB_OUTPUT}"
+          printf '%s\n' "release-date: ${release_date}"
+          printf '%s\n' "release-date=${release_date}" >>"${GITHUB_OUTPUT}"
 
           # Get the current revision.
           rev=$(git rev-parse HEAD)
-          printf 'rev: %s\n' "${rev}"
-          printf 'rev=%s\n' "${rev}" >>"${GITHUB_OUTPUT}"
+          printf '%s\n' "rev: ${rev}"
+          printf '%s\n' "rev=${rev}" >>"${GITHUB_OUTPUT}"
 
           prev_version=$(parse-changelog --title-no-link "${changelog}" | cut -d' ' -f1)
 
@@ -109,11 +111,11 @@ jobs:
           if [[ ! "${version}" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z\.-]+)?(\+[0-9A-Za-z\.-]+)?$ ]]; then
             bail "invalid version format '${version}'"
           fi
-          printf 'version: %s\n' "${version}"
-          printf 'version=%s\n' "${version}" >>"${GITHUB_OUTPUT}"
+          printf '%s\n' "version: ${version}"
+          printf '%s\n' "version=${version}" >>"${GITHUB_OUTPUT}"
           tag="${tag_prefix}${version}"
-          printf 'tag: %s\n' "${tag}"
-          printf 'tag=%s\n' "${tag}" >>"${GITHUB_OUTPUT}"
+          printf '%s\n' "tag: ${tag}"
+          printf '%s\n' "tag=${tag}" >>"${GITHUB_OUTPUT}"
 
           # Make sure the same release has not been created in the past.
           if gh release view "${tag}" &>/dev/null; then
@@ -197,7 +199,7 @@ jobs:
   release:
     if: github.repository_owner == 'taiki-e' && inputs.target == 'install-action'
     needs: prepare
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     timeout-minutes: 60
     environment:
       name: release
@@ -218,6 +220,7 @@ jobs:
       - name: Create and push release commit and tag
         id: push
         run: |
+          set +x
           IFS=$'\n\t'
           trap -- 's=$?; printf >&2 "%s\n" "${0##*/}:${LINENO}: \`${BASH_COMMAND}\` exit with ${s}"; exit ${s}' ERR
           retry() {
@@ -433,7 +436,7 @@ jobs:
 
   release-manifest-schema:
     if: github.repository_owner == 'taiki-e' && inputs.target == 'install-action-manifest-schema'
-    uses: taiki-e/github-actions/.github/workflows/rust-release.yml@5f549ff6b21e9a853f5f613784d5db27746fd2bc # main
+    uses: taiki-e/github-actions/.github/workflows/rust-release.yml@3c1cac16ef654d1febb66f21f328fa167f0d2fef # main
     permissions:
       contents: write # for taiki-e/create-gh-release-action
       id-token: write # for rust-lang/crates-io-auth-action

CHANGELOG.md

@@ -10,12 +10,6 @@ Note: In this file, do not use the hard wrap in the middle of a sentence for com
 
 ## [Unreleased]
 
-- Update `syft@latest` to 1.44.0.
-
-- Update `rclone@latest` to 1.74.0.
-
-- Update `osv-scanner@latest` to 2.3.6.
-
 ## [2.75.28] - 2026-05-01
 
 - Update `wasmtime@latest` to 44.0.1.

action.yml

@@ -4,8 +4,8 @@ description: GitHub Action for installing development tools
 inputs:
   tool:
     description: Tools to install (whitespace or comma separated list)
-    required: true
-    # default: #publish:tool
+    required: false
+    default: xbuild
   checksum:
     description: Whether to enable checksums (strongly discouraged to disable)
     required: false

manifests/cargo-deb.json

@@ -12,12 +12,6 @@
   "3": {
     "version": "3.6.4"
   },
-  "3.7.0": {
-    "x86_64_linux_gnu": {
-      "etag": "0x8DEA87CE0C3370E",
-      "hash": "e61273031c84b6ef2ca3fb259b594d34d2b592e1c6bc378c1249380c53e5b05e"
-    }
-  },
   "3.6": {
     "version": "3.6.4"
   },

manifests/cargo-spellcheck.json

@@ -14,12 +14,6 @@
   "0.15": {
     "version": "0.15.1"
   },
-  "0.15.7": {
-    "x86_64_linux_gnu": {
-      "etag": "0x8DEA7C00640F8EA",
-      "hash": "6c944067adde19558aff6b6eb0003e82a95a52ac9dd75465ba3df894eeac5b74"
-    }
-  },
   "0.15.2": {
     "x86_64_linux_gnu": {
       "etag": "0x8DD4A85530EF13A",

manifests/osv-scanner.json

@@ -2,13 +2,13 @@
   "rust_crate": null,
   "template": null,
   "latest": {
-    "version": "2.3.6"
+    "version": "2.3.5"
   },
   "2": {
-    "version": "2.3.6"
+    "version": "2.3.5"
   },
   "2.3": {
-    "version": "2.3.6"
+    "version": "2.3.5"
   },
   "2.3.6": {
     "x86_64_linux_musl": {

manifests/rclone.json

@@ -27,13 +27,10 @@
     }
   },
   "latest": {
-    "version": "1.74.0"
+    "version": "1.73.5"
   },
   "1": {
-    "version": "1.74.0"
-  },
-  "1.74": {
-    "version": "1.74.0"
+    "version": "1.73.5"
   },
   "1.74.0": {
     "x86_64_linux_musl": {

manifests/syft.json

@@ -35,13 +35,10 @@
     }
   },
   "latest": {
-    "version": "1.44.0"
+    "version": "1.43.0"
   },
   "1": {
-    "version": "1.44.0"
-  },
-  "1.44": {
-    "version": "1.44.0"
+    "version": "1.43.0"
   },
   "1.44.0": {
     "x86_64_linux_musl": {

manifests/tombi.json

@@ -7,42 +7,6 @@
   "0.10": {
     "version": "0.10.1"
   },
-  "0.10.2": {
-    "x86_64_linux_musl": {
-      "url": "https://github.com/tombi-toml/tombi/releases/download/v0.10.2/tombi-cli-0.10.2-x86_64-unknown-linux-musl.tar.gz",
-      "etag": "0x8DEA86927EBA7E7",
-      "hash": "c4268eaaea8a7eb23c8578b5d8976b2490e748670a3725db4f5e4352f9d3076c",
-      "bin": "tombi-cli-0.10.2-x86_64-unknown-linux-musl/tombi"
-    },
-    "x86_64_macos": {
-      "url": "https://github.com/tombi-toml/tombi/releases/download/v0.10.2/tombi-cli-0.10.2-x86_64-apple-darwin.tar.gz",
-      "etag": "0x8DEA86927DE9741",
-      "hash": "b3ed94dc4396f565728a7ccb08de466de13607b3f4e73741ab5a3d13571e46f7",
-      "bin": "tombi-cli-0.10.2-x86_64-apple-darwin/tombi"
-    },
-    "x86_64_windows": {
-      "url": "https://github.com/tombi-toml/tombi/releases/download/v0.10.2/tombi-cli-0.10.2-x86_64-pc-windows-msvc.zip",
-      "etag": "0x8DEA86927F5AEC2",
-      "hash": "8ecfb32d7fe90612a626a25500fa92a9b4e42dbad6a00f202849901a058dd6a7"
-    },
-    "aarch64_linux_musl": {
-      "url": "https://github.com/tombi-toml/tombi/releases/download/v0.10.2/tombi-cli-0.10.2-aarch64-unknown-linux-musl.tar.gz",
-      "etag": "0x8DEA869285CD610",
-      "hash": "9cb16ec45802bc84cb76bb955facb4f1c5de9bd36f349075765ed12d180ceccf",
-      "bin": "tombi-cli-0.10.2-aarch64-unknown-linux-musl/tombi"
-    },
-    "aarch64_macos": {
-      "url": "https://github.com/tombi-toml/tombi/releases/download/v0.10.2/tombi-cli-0.10.2-aarch64-apple-darwin.tar.gz",
-      "etag": "0x8DEA86927DA2F62",
-      "hash": "e456b5518923f1c3b3b136aa92c57aa9ffc6f27d8ce155af337509d3f5a3a619",
-      "bin": "tombi-cli-0.10.2-aarch64-apple-darwin/tombi"
-    },
-    "aarch64_windows": {
-      "url": "https://github.com/tombi-toml/tombi/releases/download/v0.10.2/tombi-cli-0.10.2-aarch64-pc-windows-msvc.zip",
-      "etag": "0x8DEA86927F2095A",
-      "hash": "532d25f214564bf685b2bfbd21cf2202c70ff4d8c66b0e449ca669bcffd9eba2"
-    }
-  },
   "0.10.1": {
     "x86_64_linux_musl": {
       "url": "https://github.com/tombi-toml/tombi/releases/download/v0.10.1/tombi-cli-0.10.1-x86_64-unknown-linux-musl.tar.gz",

tools/ci/tool-list.sh

@@ -191,11 +191,12 @@ fi
 # Not manifest-based
 case "${host_os}" in
   linux*)
+    # TODO: disable valgrind due to Canonical's incident.
     # Installing snap to container is difficult...
     # Specifying the version of valgrind is not supported.
-    if type -P snap >/dev/null && [[ "${version}" == "latest" ]]; then
-      tools+=(valgrind)
-    fi
+    # if type -P snap >/dev/null && [[ "${version}" == "latest" ]]; then
+    #   tools+=(valgrind)
+    # fi
     ;;
 esac
 # cargo-watch/watchexec-cli is supported by cargo-binstall (through quickinstall)

tools/tidy.sh

@@ -27,7 +27,7 @@ fi
 if [[ -n "${TIDY_DEV:-}" ]]; then
   image="ghcr.io/taiki-e/tidy:latest"
 else
-  image="ghcr.io/taiki-e/tidy@sha256:c78ba09aa420feddc57ca76fca38b1d4c998a0ede37f76378f12df15a826cf59"
+  image="ghcr.io/taiki-e/tidy@sha256:71def761a5585e83a2672c4051aee13cd886ad5571215aee52f193454bb3cdff"
 fi
 user="$(id -u):$(id -g)"
 workdir=$(pwd)