Release 2.5.6

.github/workflows/ci.yml

@@ -160,7 +160,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 60
     permissions:
-      contents: write # TODO test
+      contents: write
       pull-requests: write
     steps:
       - uses: actions/checkout@v3

.github/workflows/release.yml

@@ -1,8 +1,7 @@
 name: Release
 
 permissions:
-  # TODO: once `releases: write` is supported, use it instead.
-  contents: write
+  contents: read
 
 on:
   push:
@@ -18,6 +17,8 @@ jobs:
     if: github.repository_owner == 'taiki-e'
     runs-on: ubuntu-latest
     timeout-minutes: 60
+    permissions:
+      contents: write
     steps:
       - uses: actions/checkout@v3
         with:

CHANGELOG.md

@@ -10,6 +10,26 @@ Note: In this file, do not use the hard wrap in the middle of a sentence for com
 
 ## [Unreleased]
 
+## [2.5.6] - 2023-03-10
+
+- Update `wasmtime@latest` to 6.0.1.
+
+## [2.5.5] - 2023-03-08
+
+- Update `protoc@latest` to 3.22.1.
+
+- Update `mdbook@latest` to 0.4.28.
+
+## [2.5.4] - 2023-02-28
+
+- Update `cargo-llvm-cov@latest` to 0.5.11.
+
+- Update `cargo-hack@latest` to 0.5.28.
+
+## [2.5.3] - 2023-02-28
+
+- Update `cargo-no-dev-deps@latest` to 0.2.2.
+
 ## [2.5.2] - 2023-02-27
 
 - Update `cargo-tarpaulin@latest` to 0.25.1.
@@ -645,7 +665,11 @@ Note: This release is considered a breaking change because installing on version
 
 Initial release
 
-[Unreleased]: https://github.com/taiki-e/install-action/compare/v2.5.2...HEAD
+[Unreleased]: https://github.com/taiki-e/install-action/compare/v2.5.6...HEAD
+[2.5.6]: https://github.com/taiki-e/install-action/compare/v2.5.5...v2.5.6
+[2.5.5]: https://github.com/taiki-e/install-action/compare/v2.5.4...v2.5.5
+[2.5.4]: https://github.com/taiki-e/install-action/compare/v2.5.3...v2.5.4
+[2.5.3]: https://github.com/taiki-e/install-action/compare/v2.5.2...v2.5.3
 [2.5.2]: https://github.com/taiki-e/install-action/compare/v2.5.1...v2.5.2
 [2.5.1]: https://github.com/taiki-e/install-action/compare/v2.5.0...v2.5.1
 [2.5.0]: https://github.com/taiki-e/install-action/compare/v2.4.4...v2.5.0

manifests/cargo-hack.json

@@ -1,10 +1,36 @@
 {
   "template": null,
   "latest": {
-    "version": "0.5.27"
+    "version": "0.5.28"
   },
   "0.5": {
-    "version": "0.5.27"
+    "version": "0.5.28"
+  },
+  "0.5.28": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/taiki-e/cargo-hack/releases/download/v0.5.28/cargo-hack-x86_64-unknown-linux-musl.tar.gz",
+      "checksum": "87fb6dbb3e8272ec912f85b80366d0c4784fbcf0fe4e5981bf442efaf29dfe48"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/taiki-e/cargo-hack/releases/download/v0.5.28/cargo-hack-x86_64-apple-darwin.tar.gz",
+      "checksum": "e926dbb2921544835c5e38cd4e3ac3ef5be4b4ab752528f45d805b652df11ee4"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/taiki-e/cargo-hack/releases/download/v0.5.28/cargo-hack-x86_64-pc-windows-msvc.zip",
+      "checksum": "fb3df062d00fa8b7efa42e7a87ff997bd74fab2d83f1a476532b991b86065052"
+    },
+    "aarch64_linux_musl": {
+      "url": "https://github.com/taiki-e/cargo-hack/releases/download/v0.5.28/cargo-hack-aarch64-unknown-linux-musl.tar.gz",
+      "checksum": "788308e4504a2676d97847fcc3993f47e8c93c4b43b46b8566b7b18cef01093f"
+    },
+    "aarch64_macos": {
+      "url": "https://github.com/taiki-e/cargo-hack/releases/download/v0.5.28/cargo-hack-aarch64-apple-darwin.tar.gz",
+      "checksum": "47c3390818b5f434a4697aeff0f71f4f69b7e7c2df946b74cce45e2bb0fc8dfd"
+    },
+    "aarch64_windows": {
+      "url": "https://github.com/taiki-e/cargo-hack/releases/download/v0.5.28/cargo-hack-aarch64-pc-windows-msvc.tar.gz",
+      "checksum": "c38da73a61a3600aed98d4ee00bce0c64bca4b4e2200112f55011872d420ead5"
+    }
   },
   "0.5.27": {
     "x86_64_linux_musl": {

manifests/cargo-llvm-cov.json

@@ -17,10 +17,27 @@
     }
   },
   "latest": {
-    "version": "0.5.10"
+    "version": "0.5.11"
   },
   "0.5": {
-    "version": "0.5.10"
+    "version": "0.5.11"
+  },
+  "0.5.11": {
+    "x86_64_linux_musl": {
+      "checksum": "3bd355e29b8e29d0b42f0c95ec487cd8e00ffa419ba65b83968740a641a46c1e"
+    },
+    "x86_64_macos": {
+      "checksum": "fe0e54836a367697a1b475440af2e7438e56caf6e548b88faa88edc221a515f7"
+    },
+    "x86_64_windows": {
+      "checksum": "528202a08b47ca579722db1949da2362a7f03fe0ea84a45d6679dc73d33603e9"
+    },
+    "aarch64_linux_musl": {
+      "checksum": "479f51fac713151f73ee0ab5d7cb1155646cde17903dfd7c526cd51253e99a4c"
+    },
+    "aarch64_macos": {
+      "checksum": "276d8fa70299ec9ae014cab905cdbd614d6bddfa6abcc414492091585dd55ab5"
+    }
   },
   "0.5.10": {
     "x86_64_linux_musl": {

manifests/cargo-no-dev-deps.json

@@ -20,10 +20,30 @@
     }
   },
   "latest": {
-    "version": "0.2.1"
+    "version": "0.2.2"
   },
   "0.2": {
-    "version": "0.2.1"
+    "version": "0.2.2"
+  },
+  "0.2.2": {
+    "x86_64_linux_musl": {
+      "checksum": "06871d1243c12568ec1df16d1fe663413b86ac4b9993f208e8b683a9d6fb2c95"
+    },
+    "x86_64_macos": {
+      "checksum": "cd0570a4f415b30d31f48b12c8ccc1f3d197c9b552177a6402519cbcadde178b"
+    },
+    "x86_64_windows": {
+      "checksum": "88cd59cb5d1983778ade830346ab9901d1843ec9a3b098191f465cf31a9e6c47"
+    },
+    "aarch64_linux_musl": {
+      "checksum": "c9abe175390970139bf2afbc0fabab414c6b9549dee4216514513ce03643a8b7"
+    },
+    "aarch64_macos": {
+      "checksum": "10514a7ef5bfc29e6bfe2ffbb7130f80f30b7a2d63faadd2f5bddb36ec66d922"
+    },
+    "aarch64_windows": {
+      "checksum": "daa55434f81cc7711bef1f0f938540647bcde18458f429a0d03ccde617ff7144"
+    }
   },
   "0.2.1": {
     "x86_64_linux_musl": {

manifests/mdbook.json

@@ -17,10 +17,24 @@
     }
   },
   "latest": {
-    "version": "0.4.27"
+    "version": "0.4.28"
   },
   "0.4": {
-    "version": "0.4.27"
+    "version": "0.4.28"
+  },
+  "0.4.28": {
+    "x86_64_linux_musl": {
+      "checksum": "84e3a4982c19e19b1d058af30b8835097109f520cb6c2e9e03413a896c9787aa"
+    },
+    "x86_64_macos": {
+      "checksum": "46605497fac2a379a02fa7287c0e4601a0cdfa2f913a4f1a06d820d91c0c310e"
+    },
+    "x86_64_windows": {
+      "checksum": "996bc212502e51da1d69090134d13cf51ff21e478be9b7e2aeb1d330c7865e35"
+    },
+    "aarch64_linux_musl": {
+      "checksum": "86b01509773e4011a9372de2932ceb0fdd52063153c7a673f63eeacf16c8426b"
+    }
   },
   "0.4.27": {
     "x86_64_linux_musl": {

manifests/protoc.json

@@ -1,13 +1,35 @@
 {
   "template": null,
   "latest": {
-    "version": "3.22.0"
+    "version": "3.22.1"
   },
   "3": {
-    "version": "3.22.0"
+    "version": "3.22.1"
   },
   "3.22": {
-    "version": "3.22.0"
+    "version": "3.22.1"
+  },
+  "3.22.1": {
+    "x86_64_linux_gnu": {
+      "url": "https://github.com/protocolbuffers/protobuf/releases/download/v22.1/protoc-22.1-linux-x86_64.zip",
+      "checksum": "3c830b09192a8c40c599856eb184c89ee5029d7dab9df8ec6d3d6741dcb94b93"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/protocolbuffers/protobuf/releases/download/v22.1/protoc-22.1-osx-x86_64.zip",
+      "checksum": "3cc8d30d8bffc63bb2b8b0aea0d6a126acb4f69d4c720c142f7de6b9f4f562c6"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/protocolbuffers/protobuf/releases/download/v22.1/protoc-22.1-win64.zip",
+      "checksum": "359a390f6124c067026e212995e402d2e6fcd525d07e3b69d1d81cb06b5690f2"
+    },
+    "aarch64_linux_gnu": {
+      "url": "https://github.com/protocolbuffers/protobuf/releases/download/v22.1/protoc-22.1-linux-aarch_64.zip",
+      "checksum": "204e23069dc59bda1df5d66425c12373be39d71946fa378c3d7af44abbd651e9"
+    },
+    "aarch64_macos": {
+      "url": "https://github.com/protocolbuffers/protobuf/releases/download/v22.1/protoc-22.1-osx-aarch_64.zip",
+      "checksum": "213e82e423baf44bad1eef99cf3e21d52ce1ac2942e3bbd25a63b1f737cf6ec6"
+    }
   },
   "3.22.0": {
     "x86_64_linux_gnu": {

manifests/wasmtime.json

@@ -22,13 +22,30 @@
     }
   },
   "latest": {
-    "version": "6.0.0"
+    "version": "6.0.1"
   },
   "6": {
-    "version": "6.0.0"
+    "version": "6.0.1"
   },
   "6.0": {
-    "version": "6.0.0"
+    "version": "6.0.1"
+  },
+  "6.0.1": {
+    "x86_64_linux_gnu": {
+      "checksum": "9fdc5f4cd679d77c42f6333793cd66ecca45347e4cbbeaf06cb0300f27ac5119"
+    },
+    "x86_64_macos": {
+      "checksum": "b9a3fff59995da204649123872126f08d4719c339be58a22f59768087e87c4e5"
+    },
+    "x86_64_windows": {
+      "checksum": "366b6a598165c3e20b99ba32f1aad1c6373f1f52104ce2e5decafc9e1cba73ec"
+    },
+    "aarch64_linux_gnu": {
+      "checksum": "dc6e69b1a90e2a35ea3d89284e3a1898df8d6dc4ea55c6fec3ae7e35b752a0fc"
+    },
+    "aarch64_macos": {
+      "checksum": "00e738f78448ae41f99f7c2c648277ef56a725198e33486191f2c0772bcd7ae1"
+    }
   },
   "6.0.0": {
     "x86_64_linux_gnu": {

tools/tidy.sh

@@ -14,7 +14,7 @@ trap 's=$?; echo >&2 "$0: Error on line "${LINENO}": ${BASH_COMMAND}"; exit ${s}
 # - shfmt
 # - shellcheck
 # - npm
-# - jq and yq (if this repository uses bors)
+# - jq and yq
 # - rustup (if Rust code exists)
 # - clang-format (if C/C++ code exists)
 #
@@ -95,19 +95,32 @@ if [[ -n "$(git ls-files '*.yml')$(git ls-files '*.js')$(git ls-files '*.json')"
     else
         warn "'npm' is not installed"
     fi
-    if [[ -e .github/workflows/ci.yml ]] && grep -q '# tidy:needs' .github/workflows/ci.yml && ! grep -Eq '# *needs: \[' .github/workflows/ci.yml; then
+    # Check GitHub workflows.
+    if [[ -d .github/workflows ]]; then
         if type -P jq &>/dev/null && type -P yq &>/dev/null; then
-            # shellcheck disable=SC2207
-            jobs_actual=($(yq '.jobs' .github/workflows/ci.yml | jq -r 'keys_unsorted[]'))
-            unset 'jobs_actual[${#jobs_actual[@]}-1]'
-            # shellcheck disable=SC2207
-            jobs_expected=($(yq -r '.jobs."ci-success".needs[]' .github/workflows/ci.yml))
-            if [[ "${jobs_actual[*]}" != "${jobs_expected[*]+"${jobs_expected[*]}"}" ]]; then
-                printf -v jobs '%s, ' "${jobs_actual[@]}"
-                sed -i "s/needs: \[.*\] # tidy:needs/needs: [${jobs%, }] # tidy:needs/" .github/workflows/ci.yml
-                check_diff .github/workflows/ci.yml
-                warn "please update 'needs' section in 'ci-success' job"
-            fi
+            for workflow in .github/workflows/*.yml; do
+                # The top-level permissions must be weak as they are referenced by all jobs.
+                permissions=$(yq '.permissions' "${workflow}" | jq -c)
+                case "${permissions}" in
+                    '{"contents":"read"}' | '{"contents":"none"}' | '{}') ;;
+                    null) warn "${workflow}: top level permissions not found; it must be 'contents: read' or weaker permissions" ;;
+                    *) warn "${workflow}: only 'contents: read' and weaker permissions are allowed at top level; if you want to use stronger permissions, please set job-level permissions" ;;
+                esac
+                # Make sure the 'needs' section is not out of date.
+                if grep -q '# tidy:needs' "${workflow}" && ! grep -Eq '# *needs: \[' "${workflow}"; then
+                    # shellcheck disable=SC2207
+                    jobs_actual=($(yq '.jobs' "${workflow}" | jq -r 'keys_unsorted[]'))
+                    unset 'jobs_actual[${#jobs_actual[@]}-1]'
+                    # shellcheck disable=SC2207
+                    jobs_expected=($(yq -r '.jobs."ci-success".needs[]' "${workflow}"))
+                    if [[ "${jobs_actual[*]}" != "${jobs_expected[*]+"${jobs_expected[*]}"}" ]]; then
+                        printf -v jobs '%s, ' "${jobs_actual[@]}"
+                        sed -i "s/needs: \[.*\] # tidy:needs/needs: [${jobs%, }] # tidy:needs/" "${workflow}"
+                        check_diff "${workflow}"
+                        warn "${workflow}: please update 'needs' section in 'ci-success' job"
+                    fi
+                fi
+            done
         else
             warn "'jq' or 'yq' is not installed"
         fi
@@ -157,30 +170,28 @@ if [[ -f .cspell.json ]]; then
                     dependencies+=$(jq <<<"${metadata}" ".packages[] | select(.id == ${id})" | jq -r '.dependencies[].name')
                 done
             done
-            words=''
             # shellcheck disable=SC2001
-            for word in $(sed <<<"${dependencies}" 's/[0-9_-]/\n/g' | LC_ALL=C sort -f -u | (grep -E '.{4,}' || true)); do
-                # Skip if the word is contained in other dictionaries.
-                if ! npx cspell trace "${word}" 2>/dev/null | (grep -v -E '/(project-dictionary|rust-dependencies)\.txt' || true) | grep -Eq "^${word} \* [0-9A-Za-z_-]+\* "; then
-                    words+=$'\n'
-                    words+="${word}"
-                fi
-            done
+            dependencies=$(sed <<<"${dependencies}" 's/[0-9_-]/\n/g' | LC_ALL=C sort -f -u)
+            config_old=$(<.cspell.json)
+            config_new=$(grep <<<"${config_old}" -v ' *//' | jq 'del(.dictionaries[] | select(index("organization-dictionary") | not))' | jq 'del(.dictionaryDefinitions[] | select(.name == "organization-dictionary" | not))')
+            echo "${config_new}" >.cspell.json
+            words=$(npx <<<"${dependencies}" cspell stdin --no-progress --no-summary --words-only --unique || true)
+            echo "${config_old}" >.cspell.json
         fi
         cat >.github/.cspell/rust-dependencies.txt <<EOF
 // This file is @generated by $(basename "$0").
 // It is not intended for manual editing.
 EOF
         if [[ -n "${words:-}" ]]; then
-            echo "${words}" >>.github/.cspell/rust-dependencies.txt
+            echo $'\n'"${words}" >>.github/.cspell/rust-dependencies.txt
         fi
         check_diff .github/.cspell/rust-dependencies.txt
         if ! grep -Eq "^\.github/\.cspell/rust-dependencies.txt linguist-generated" .gitattributes; then
             echo "warning: you may want to mark .github/.cspell/rust-dependencies.txt linguist-generated"
         fi
 
-        echo "+ npx cspell --no-progress \$(git ls-files)"
-        npx cspell --no-progress $(git ls-files)
+        echo "+ npx cspell --no-progress --no-summary \$(git ls-files)"
+        npx cspell --no-progress --no-summary $(git ls-files)
 
         for dictionary in .github/.cspell/*.txt; do
             if [[ "${dictionary}" == .github/.cspell/project-dictionary.txt ]]; then