Release 2.67.2

CHANGELOG.md

@@ -10,6 +10,16 @@ Note: In this file, do not use the hard wrap in the middle of a sentence for com
 
 ## [Unreleased]
 
+## [2.67.2] - 2026-01-21
+
+- Update `wasmtime@latest` to 41.0.0.
+
+- Update `git-cliff@latest` to 2.12.0.
+
+## [2.67.1] - 2026-01-20
+
+- Update `wasm-pack@latest` to 0.14.0.
+
 ## [2.67.0] - 2026-01-20
 
 - Support `cargo-neat`. ([#1404](https://github.com/taiki-e/install-action/pull/1404), thanks @killzoner)
@@ -5397,7 +5407,9 @@ Note: This release is considered a breaking change because installing on version
 
 Initial release
 
-[Unreleased]: https://github.com/taiki-e/install-action/compare/v2.67.0...HEAD
+[Unreleased]: https://github.com/taiki-e/install-action/compare/v2.67.2...HEAD
+[2.67.2]: https://github.com/taiki-e/install-action/compare/v2.67.1...v2.67.2
+[2.67.1]: https://github.com/taiki-e/install-action/compare/v2.67.0...v2.67.1
 [2.67.0]: https://github.com/taiki-e/install-action/compare/v2.66.7...v2.67.0
 [2.66.7]: https://github.com/taiki-e/install-action/compare/v2.66.6...v2.66.7
 [2.66.6]: https://github.com/taiki-e/install-action/compare/v2.66.5...v2.66.6

TOOLS.md

@@ -88,7 +88,7 @@ See the [Supported tools section in README.md](README.md#supported-tools) for ho
 | [**wait-for-them**](https://github.com/shenek/wait-for-them) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/shenek/wait-for-them/releases) | Linux, macOS, Windows | [GPL-3.0](https://github.com/shenek/wait-for-them/blob/v0.4.0/Cargo.toml#L7) |
 | [**wash**](https://github.com/wasmCloud/wasmCloud) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/wasmCloud/wasmCloud/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/wasmCloud/wasmCloud/blob/main/LICENSE) |
 | [**wasm-bindgen**](https://github.com/wasm-bindgen/wasm-bindgen) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/wasm-bindgen/wasm-bindgen/releases) | Linux, macOS, Windows | [MIT](https://github.com/wasm-bindgen/wasm-bindgen/blob/main/LICENSE-MIT) OR [Apache-2.0](https://github.com/wasm-bindgen/wasm-bindgen/blob/main/LICENSE-APACHE) |
-| [**wasm-pack**](https://github.com/rustwasm/wasm-pack) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/rustwasm/wasm-pack/releases) | Linux, macOS, Windows | [MIT](https://github.com/rustwasm/wasm-pack/blob/master/LICENSE-MIT) OR [Apache-2.0](https://github.com/rustwasm/wasm-pack/blob/master/LICENSE-APACHE) |
+| [**wasm-pack**](https://github.com/drager/wasm-pack) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/drager/wasm-pack/releases) | Linux, macOS, Windows | [MIT](https://github.com/drager/wasm-pack/blob/master/LICENSE-MIT) OR [Apache-2.0](https://github.com/drager/wasm-pack/blob/master/LICENSE-APACHE) |
 | [**wasmtime**](https://github.com/bytecodealliance/wasmtime) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/bytecodealliance/wasmtime/releases) | Linux, macOS, Windows | [Apache-2.0 WITH LLVM-exception](https://github.com/bytecodealliance/wasmtime/blob/main/LICENSE) |
 | [**xbuild**](https://github.com/rust-mobile/xbuild) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/rust-mobile/xbuild/releases) | Linux, macOS, Windows | [Apache-2.0 OR MIT](https://github.com/rust-mobile/xbuild/blob/v0.2.0/xbuild/Cargo.toml#L7) |
 | [**xh**](https://github.com/ducaale/xh) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/ducaale/xh/releases) | Linux, macOS, Windows | [MIT](https://github.com/ducaale/xh/blob/master/LICENSE) |

manifests/git-cliff.json

@@ -28,10 +28,39 @@
   },
   "license_markdown": "[MIT](https://github.com/orhun/git-cliff/blob/main/LICENSE-MIT) OR [Apache-2.0](https://github.com/orhun/git-cliff/blob/main/LICENSE-APACHE)",
   "latest": {
-    "version": "2.11.0"
+    "version": "2.12.0"
   },
   "2": {
-    "version": "2.11.0"
+    "version": "2.12.0"
+  },
+  "2.12": {
+    "version": "2.12.0"
+  },
+  "2.12.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE584A87B0D102",
+      "checksum": "c89a7bc55f3c51f391938aa3fa560125109695c1930d927879daea68dd786420"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE584B06F4090C",
+      "checksum": "fd4bce35ea8a6f3af6ac4891073781ca24c654c36c83c865bc30bab332c05a14"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE584B48CF7607",
+      "checksum": "f2b8c692d9488c3313d7786e2099976151c10fd8f76580b12d045bb9683a8379"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE584A7D7A223B",
+      "checksum": "a2d262b389aed349e0564aaaa38a44015c98a951048923b086d6cf732f6dbbaf"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE584AC9142FD2",
+      "checksum": "2ae72a0061bee98d0e375f2ea8e0f4b23b4915ac2e37fa45a705066de49b43a0"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE584B0D85A19E",
+      "checksum": "faa97e8a741a853eea0e826207211c59727a7f90218c26c56bb6c8c4038ac058"
+    }
   },
   "2.11": {
     "version": "2.11.0"

manifests/wasm-pack.json

@@ -2,25 +2,46 @@
   "rust_crate": "wasm-pack",
   "template": {
     "x86_64_linux_musl": {
-      "url": "https://github.com/rustwasm/wasm-pack/releases/download/v${version}/wasm-pack-v${version}-x86_64-unknown-linux-musl.tar.gz",
+      "url": "https://github.com/drager/wasm-pack/releases/download/v${version}/wasm-pack-v${version}-x86_64-unknown-linux-musl.tar.gz",
       "bin": "wasm-pack-v${version}-x86_64-unknown-linux-musl/wasm-pack"
     },
     "x86_64_macos": {
-      "url": "https://github.com/rustwasm/wasm-pack/releases/download/v${version}/wasm-pack-v${version}-x86_64-apple-darwin.tar.gz",
+      "url": "https://github.com/drager/wasm-pack/releases/download/v${version}/wasm-pack-v${version}-x86_64-apple-darwin.tar.gz",
       "bin": "wasm-pack-v${version}-x86_64-apple-darwin/wasm-pack"
     },
     "x86_64_windows": {
-      "url": "https://github.com/rustwasm/wasm-pack/releases/download/v${version}/wasm-pack-v${version}-x86_64-pc-windows-msvc.tar.gz",
+      "url": "https://github.com/drager/wasm-pack/releases/download/v${version}/wasm-pack-v${version}-x86_64-pc-windows-msvc.tar.gz",
       "bin": "wasm-pack-v${version}-x86_64-pc-windows-msvc/wasm-pack.exe"
     },
     "aarch64_linux_musl": {
-      "url": "https://github.com/rustwasm/wasm-pack/releases/download/v${version}/wasm-pack-v${version}-aarch64-unknown-linux-musl.tar.gz",
+      "url": "https://github.com/drager/wasm-pack/releases/download/v${version}/wasm-pack-v${version}-aarch64-unknown-linux-musl.tar.gz",
       "bin": "wasm-pack-v${version}-aarch64-unknown-linux-musl/wasm-pack"
     }
   },
-  "license_markdown": "[MIT](https://github.com/rustwasm/wasm-pack/blob/master/LICENSE-MIT) OR [Apache-2.0](https://github.com/rustwasm/wasm-pack/blob/master/LICENSE-APACHE)",
+  "license_markdown": "[MIT](https://github.com/drager/wasm-pack/blob/master/LICENSE-MIT) OR [Apache-2.0](https://github.com/drager/wasm-pack/blob/master/LICENSE-APACHE)",
   "latest": {
-    "version": "0.13.1"
+    "version": "0.14.0"
+  },
+  "0.14": {
+    "version": "0.14.0"
+  },
+  "0.14.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE580F1B5D53B6",
+      "checksum": "278a8d668085821f4d1a637bd864f1713f872b0ae3a118c77562a308c0abfe8d"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE580F1DC36326",
+      "checksum": "46b66072ee9912b53f83841aecb04479a60e0705f7bb8b6681b377a07a512a23"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE580F1C970AA5",
+      "checksum": "d484c8e8bcd9e8c30097fbac78b52dd159598f99d11e43a50f5d143b67c721f1"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE580F1BE0E3B5",
+      "checksum": "5941c7b05060440ff37ee50fe9009a408e63fa5ba607a3b0736f5a887ec5f2ca"
+    }
   },
   "0.13": {
     "version": "0.13.1"

manifests/wasmtime.json

@@ -36,7 +36,47 @@
   },
   "license_markdown": "[Apache-2.0 WITH LLVM-exception](https://github.com/bytecodealliance/wasmtime/blob/main/LICENSE)",
   "latest": {
-    "version": "40.0.2"
+    "version": "41.0.0"
+  },
+  "41": {
+    "version": "41.0.0"
+  },
+  "41.0": {
+    "version": "41.0.0"
+  },
+  "41.0.0": {
+    "x86_64_linux_gnu": {
+      "etag": "0x8DE584E1FDA5E04",
+      "checksum": "07b82a195dc3bda0be010f73d48778b43a209829e9912a4bcd46a8e3760d74e9"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE584E20298481",
+      "checksum": "ec91e9d4130fe1776bde8601c2dffde299dc59b4dbdad6f8f471bac04bd86094"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE584E215E116B",
+      "checksum": "78f4216dffdce4a8b2310bff6e019c1ea9d2935d72e4ccdb7cd7bcbc5907fd0a"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DE584E1D303EAF",
+      "checksum": "99d9dd1e314f60eb96256615685bc28f8669b613efcf162881abdf5ad646d35a"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE584E1D7B2431",
+      "checksum": "3f8520e697e9d2105fc8e5c77f03185a75629065d0b84c90b8e57e09adb029f1"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE584E1DC87807",
+      "checksum": "15528c688f54990d37e7d17479712a4d73314973e6d4b0658848535cc2283f91"
+    },
+    "riscv64_linux_gnu": {
+      "etag": "0x8DE584E1F2767AD",
+      "checksum": "422159384ab510ddcdf6324d43c36f55ffd8f1d7dae2a1c597a4e26aacb9b930"
+    },
+    "s390x_linux_gnu": {
+      "etag": "0x8DE584E1F3A8C0C",
+      "checksum": "5a984387f11f20ccdb97e2ec194cb716a7206a98e3a20760bfad5d3ccc8e38e0"
+    }
   },
   "40": {
     "version": "40.0.2"

tools/codegen/base/wasm-pack.json

@@ -1,5 +1,5 @@
 {
-  "repository": "https://github.com/rustwasm/wasm-pack",
+  "repository": "https://github.com/drager/wasm-pack",
   "tag_prefix": "v",
   "rust_crate": "${package}",
   "asset_name": "${package}-v${version}-${rust_target}.tar.gz",

tools/tidy.sh

@@ -1,6 +1,5 @@
 #!/usr/bin/env bash
 # SPDX-License-Identifier: Apache-2.0 OR MIT
-# shellcheck disable=SC2046
 set -CeEuo pipefail
 IFS=$'\n\t'
 trap -- 's=$?; printf >&2 "%s\n" "${0##*/}:${LINENO}: \`${BASH_COMMAND}\` exit with ${s}"; exit ${s}' ERR
@@ -14,7 +13,7 @@ cd -- "$(dirname -- "$0")"/..
 # - git 1.8+
 # - jq 1.6+
 # - npm (node 18+)
-# - python 3.6+ and pipx
+# - python 3.6+, pipx
 # - shfmt
 # - shellcheck
 # - zizmor
@@ -71,7 +70,7 @@ check_diff() {
     fi
   else
     local res
-    res=$(git --no-pager diff --exit-code --name-only "$@" || true)
+    res=$(git --no-pager diff --name-only "$@")
     if [[ -n "${res}" ]]; then
       warn "please commit changes made by formatter/generator if exists on the following files"
       print_fenced "${res}"$'\n'
@@ -116,7 +115,6 @@ check_alt() {
   fi
 }
 check_hidden() {
-  local res
   for file in "$@"; do
     check_alt ".${file}" "${file}" "$(LC_ALL=C comm -23 <(ls_files "*${file}") <(ls_files "*.${file}"))"
   done
@@ -125,6 +123,7 @@ sed_rhs_escape() {
   sed -E 's/\\/\\\\/g; s/\&/\\\&/g; s/\//\\\//g' <<<"$1"
 }
 
+should_fail=''
 if [[ $# -gt 0 ]]; then
   cat <<EOF
 USAGE:
@@ -174,14 +173,19 @@ case "$(uname -s)" in
       done
     fi
     ;;
+  Haiku) ostype=haiku ;;
+  Minix) ostype=minix ;;
+  GNU) ostype=hurd ;;
+  AIX) ostype=aix ;;
+  HP-UX) ostype=hpux ;;
   MINGW* | MSYS* | CYGWIN* | Windows_NT)
     ostype=windows
     if type -P jq >/dev/null; then
       # https://github.com/jqlang/jq/issues/1854
-      _tmp=$(jq -r .a <<<'{}')
-      if [[ "${_tmp}" != 'null' ]]; then
-        _tmp=$(jq -b -r .a 2>/dev/null <<<'{}' || true)
-        if [[ "${_tmp}" == 'null' ]]; then
+      _tmp=$(jq -r .a <<<'{}' | wc -c)
+      if [[ "${_tmp}" != 5 ]]; then
+        _tmp=$({ jq -b -r .a 2>/dev/null <<<'{}' || true; } | wc -c)
+        if [[ "${_tmp}" == 5 ]]; then
           jq() { command jq -b "$@"; }
         else
           jq() { command jq "$@" | tr -d '\r'; }
@@ -195,7 +199,6 @@ case "$(uname -s)" in
 esac
 
 check_install git
-exclude_from_ls_files=()
 # - `find` lists symlinks. `! ( -name <dir> -prune )` means recursively ignore <dir>. `cut` removes the leading `./`.
 #   This can be replaced with `fd -H -t l`.
 # - `git submodule status` lists submodules. The first `cut` removes the first character indicates status ( |+|-).
@@ -204,6 +207,7 @@ find_prune=(\! \( -name .git -prune \))
 while IFS= read -r; do
   find_prune+=(\! \( -name "${REPLY}" -prune \))
 done < <(sed -E 's/#.*//g; s/^[ \t]+//g; s/\/[ \t]+$//g; /^$/d' .gitignore)
+exclude_from_ls_files=()
 while IFS=$'\n' read -r; do
   exclude_from_ls_files+=("${REPLY}")
 done < <({
@@ -227,12 +231,24 @@ ls_files() {
   fi
 }
 
+# Referred by both Rust and Markdown check.
+markdown_files=()
+while IFS=$'\n' read -r; do markdown_files+=("${REPLY}"); done < <(ls_files '*.md')
+if [[ ${TIDY_EXPECTED_MARKDOWN_FILE_COUNT:-${#markdown_files[@]}} -ne ${#markdown_files[@]} ]]; then
+  error "expected ${TIDY_EXPECTED_MARKDOWN_FILE_COUNT} of Markdown files, but found ${#markdown_files[@]}; consider updating TIDY_EXPECTED_MARKDOWN_FILE_COUNT env var"
+fi
+
 # Rust (if exists)
-if [[ -n "$(ls_files '*.rs')" ]]; then
+rust_files=()
+while IFS=$'\n' read -r; do rust_files+=("${REPLY}"); done < <(ls_files '*.rs')
+if [[ ${TIDY_EXPECTED_RUST_FILE_COUNT:-${#rust_files[@]}} -ne ${#rust_files[@]} ]]; then
+  error "expected ${TIDY_EXPECTED_RUST_FILE_COUNT} of Rust files, but found ${#rust_files[@]}; consider updating TIDY_EXPECTED_RUST_FILE_COUNT env var"
+fi
+if [[ ${#rust_files[@]} -gt 0 ]]; then
   info "checking Rust code style"
   check_config .rustfmt.toml "; consider adding with reference to https://github.com/taiki-e/cargo-hack/blob/HEAD/.rustfmt.toml"
   check_config .clippy.toml "; consider adding with reference to https://github.com/taiki-e/cargo-hack/blob/HEAD/.clippy.toml"
-  if check_install cargo jq python3 pipx; then
+  if check_install cargo jq pipx; then
     # `cargo fmt` cannot recognize files not included in the current workspace and modules
     # defined inside macros, so run rustfmt directly.
     # We need to use nightly rustfmt because we use the unstable formatting options of rustfmt.
@@ -242,16 +258,16 @@ if [[ -n "$(ls_files '*.rs')" ]]; then
         retry rustup component add rustfmt &>/dev/null
       fi
       info "running \`rustfmt \$(git ls-files '*.rs')\`"
-      rustfmt $(ls_files '*.rs')
+      rustfmt "${rust_files[@]}"
     else
       if type -P rustup >/dev/null; then
         retry rustup component add rustfmt --toolchain nightly &>/dev/null
       fi
       info "running \`rustfmt +nightly \$(git ls-files '*.rs')\`"
-      rustfmt +nightly $(ls_files '*.rs')
+      rustfmt +nightly "${rust_files[@]}"
     fi
-    check_diff $(ls_files '*.rs')
-    cast_without_turbofish=$(grep -Fn '.cast()' $(ls_files '*.rs') || true)
+    check_diff "${rust_files[@]}"
+    cast_without_turbofish=$(grep -Fn '.cast()' "${rust_files[@]}" || true)
     if [[ -n "${cast_without_turbofish}" ]]; then
       error "please replace \`.cast()\` with \`.cast::<type_name>()\`:"
       printf '%s\n' "${cast_without_turbofish}"
@@ -332,7 +348,7 @@ if [[ -n "$(ls_files '*.rs')" ]]; then
   fi
   # Sync markdown to rustdoc.
   first=1
-  for markdown in $(ls_files '*.md'); do
+  for markdown in "${markdown_files[@]}"; do
     markers=$(grep -En '^<!-- tidy:sync-markdown-to-rustdoc:(start[^ ]*|end) -->' "${markdown}" || true)
     # BSD wc's -l emits spaces before number.
     if [[ ! "$(LC_ALL=C wc -l <<<"${markers}")" =~ ^\ *2$ ]]; then
@@ -381,10 +397,11 @@ if [[ -n "$(ls_files '*.rs')" ]]; then
     fi
     new='<!-- tidy:sync-markdown-to-rustdoc:start -->'$'\a'
     empty_line_re='^ *$'
-    gfm_alert_re='^> {0,4}\[!.*\] *$'
+    gfm_alert_re='^ *> {0,4}\[!.*\] *$'
     rust_code_block_re='^ *```(rust|rs) *$'
     code_block_attr=''
     in_alert=''
+    leading_spaces=''
     first_line=1
     ignore=''
     while IFS='' read -rd$'\a' line; do
@@ -401,7 +418,7 @@ if [[ -n "$(ls_files '*.rs')" ]]; then
       elif [[ -n "${in_alert}" ]]; then
         if [[ "${line}" =~ ${empty_line_re} ]]; then
           in_alert=''
-          new+=$'\a'"</div>"$'\a'
+          new+=$'\a'"${leading_spaces}</div>"$'\a'
         fi
       elif [[ "${line}" =~ ${gfm_alert_re} ]]; then
         alert="${line#*[\!}"
@@ -418,8 +435,13 @@ if [[ -n "$(ls_files '*.rs')" ]]; then
             ;;
         esac
         in_alert=1
-        new+="<div class=\"rustdoc-alert rustdoc-alert-${alert_lower}\">"$'\a\a'
-        new+="> **${alert_sign} ${alert:0:1}${alert_lower:1}**"$'\a>\a'
+        leading_spaces="${line%%[^ ]*}"
+        # GitHub doesn't handle indented GFM alerts...
+        if [[ -n "${leading_spaces}" ]]; then
+          error "GitHub doesn't handle indented GFM alerts"
+        fi
+        new+="${leading_spaces}<div class=\"rustdoc-alert rustdoc-alert-${alert_lower}\">"$'\a\a'
+        new+="${leading_spaces}> **${alert_sign} ${alert:0:1}${alert_lower:1}**"$'\a'"${leading_spaces}>"$'\a'
         continue
       fi
       if [[ "${line}" =~ ${rust_code_block_re} ]]; then
@@ -459,15 +481,20 @@ check_hidden clippy.toml deny.toml rustfmt.toml
 
 # C/C++/Protobuf (if exists)
 clang_format_ext=('*.c' '*.h' '*.cpp' '*.hpp' '*.proto')
-if [[ -n "$(ls_files "${clang_format_ext[@]}")" ]]; then
+clang_format_files=()
+while IFS=$'\n' read -r; do clang_format_files+=("${REPLY}"); done < <(ls_files "${clang_format_ext[@]}")
+if [[ ${TIDY_EXPECTED_CLANG_FORMAT_FILE_COUNT:-${#clang_format_files[@]}} -ne ${#clang_format_files[@]} ]]; then
+  error "expected ${TIDY_EXPECTED_CLANG_FORMAT_FILE_COUNT} of C/C++/Protobuf files, but found ${#clang_format_files[@]}; consider updating TIDY_EXPECTED_CLANG_FORMAT_FILE_COUNT env var"
+fi
+if [[ ${#clang_format_files[@]} -gt 0 ]]; then
   info "checking C/C++/Protobuf code style"
   check_config .clang-format
   if check_install clang-format; then
     IFS=' '
     info "running \`clang-format -i \$(git ls-files ${clang_format_ext[*]})\`"
     IFS=$'\n\t'
-    clang-format -i $(ls_files "${clang_format_ext[@]}")
-    check_diff $(ls_files "${clang_format_ext[@]}")
+    clang-format -i "${clang_format_files[@]}"
+    check_diff "${clang_format_files[@]}"
   fi
   printf '\n'
 else
@@ -480,15 +507,20 @@ check_alt '.hpp extension' 'other extensions' "$(ls_files '*.hh' '*.hp' '*.hxx'
 
 # YAML/HTML/CSS/JavaScript/JSON (if exists)
 prettier_ext=('*.css' '*.html' '*.js' '*.json' '*.yml' '*.yaml')
-if [[ -n "$(ls_files "${prettier_ext[@]}")" ]]; then
+prettier_files=()
+while IFS=$'\n' read -r; do prettier_files+=("${REPLY}"); done < <(ls_files "${prettier_ext[@]}")
+if [[ ${TIDY_EXPECTED_PRETTIER_FILE_COUNT:-${#prettier_files[@]}} -ne ${#prettier_files[@]} ]]; then
+  error "expected ${TIDY_EXPECTED_PRETTIER_FILE_COUNT} of YAML/HTML/CSS/JavaScript/JSON files, but found ${#prettier_files[@]}; consider updating TIDY_EXPECTED_PRETTIER_FILE_COUNT env var"
+fi
+if [[ ${#prettier_files[@]} -gt 0 ]]; then
   info "checking YAML/HTML/CSS/JavaScript/JSON code style"
   check_config .editorconfig
   if check_install npm; then
     IFS=' '
     info "running \`npx -y prettier -l -w \$(git ls-files ${prettier_ext[*]})\`"
     IFS=$'\n\t'
-    npx -y prettier -l -w $(ls_files "${prettier_ext[@]}")
-    check_diff $(ls_files "${prettier_ext[@]}")
+    npx -y prettier -l -w "${prettier_files[@]}"
+    check_diff "${prettier_files[@]}"
   fi
   printf '\n'
 else
@@ -499,13 +531,18 @@ check_alt '.editorconfig' 'other configs' "$(ls_files '*.prettierrc*' '*prettier
 check_alt '.yml extension' '.yaml extension' "$(ls_files '*.yaml' | { grep -Fv '.markdownlint-cli2.yaml' || true; })"
 
 # TOML (if exists)
+toml_files=()
+while IFS=$'\n' read -r; do toml_files+=("${REPLY}"); done < <(ls_files '*.toml')
+if [[ ${TIDY_EXPECTED_TOML_FILE_COUNT:-${#toml_files[@]}} -ne ${#toml_files[@]} ]]; then
+  error "expected ${TIDY_EXPECTED_TOML_FILE_COUNT} of TOML files, but found ${#toml_files[@]}; consider updating TIDY_EXPECTED_TOML_FILE_COUNT env var"
+fi
 if [[ -n "$(ls_files '*.toml' | { grep -Fv '.taplo.toml' || true; })" ]]; then
   info "checking TOML style"
   check_config .taplo.toml
   if check_install npm; then
     info "running \`npx -y @taplo/cli fmt \$(git ls-files '*.toml')\`"
-    RUST_LOG=warn npx -y @taplo/cli fmt $(ls_files '*.toml')
-    check_diff $(ls_files '*.toml')
+    RUST_LOG=warn npx -y @taplo/cli fmt "${toml_files[@]}"
+    check_diff "${toml_files[@]}"
   fi
   printf '\n'
 else
@@ -514,12 +551,12 @@ fi
 check_hidden taplo.toml
 
 # Markdown (if exists)
-if [[ -n "$(ls_files '*.md')" ]]; then
+if [[ ${#markdown_files[@]} -gt 0 ]]; then
   info "checking markdown style"
   check_config .markdownlint-cli2.yaml
   if check_install npm; then
     info "running \`npx -y markdownlint-cli2 \$(git ls-files '*.md')\`"
-    if ! npx -y markdownlint-cli2 $(ls_files '*.md'); then
+    if ! npx -y markdownlint-cli2 "${markdown_files[@]}"; then
       error "check failed; please resolve the above markdownlint error(s)"
     fi
   fi
@@ -580,6 +617,12 @@ if [[ -n "$(ls_files '*action.yml')" ]]; then
     fi
   done
 fi
+if [[ ${TIDY_EXPECTED_SHELL_FILE_COUNT:-${#shell_files[@]}} -ne ${#shell_files[@]} ]]; then
+  error "expected ${TIDY_EXPECTED_SHELL_FILE_COUNT} of shell script files, but found ${#shell_files[@]}; consider updating TIDY_EXPECTED_SHELL_FILE_COUNT env var"
+fi
+if [[ ${TIDY_EXPECTED_DOCKER_FILE_COUNT:-${#docker_files[@]}} -ne ${#docker_files[@]} ]]; then
+  error "expected ${TIDY_EXPECTED_DOCKER_FILE_COUNT} of dockerfiles, but found ${#docker_files[@]}; consider updating TIDY_EXPECTED_DOCKER_FILE_COUNT env var"
+fi
 # correctness
 res=$({ grep -En '(\[\[ .* ]]|(^|[^\$])\(\(.*\)\))( +#| *$)' "${bash_files[@]}" || true; } | { grep -Ev '^[^ ]+: *(#|//)' || true; } | LC_ALL=C sort)
 if [[ -n "${res}" ]]; then
@@ -917,6 +960,7 @@ if [[ ${#zizmor_targets[@]} -gt 0 ]]; then
   if [[ "${ostype}" =~ ^(netbsd|openbsd|dragonfly|illumos|solaris)$ ]] && [[ -n "${CI:-}" ]] && ! type -P zizmor >/dev/null; then
     warn "this check is skipped on NetBSD/OpenBSD/Dragonfly/illumos/Solaris due to installing zizmor is hard on these platform"
   elif check_install zizmor; then
+    # zizmor can also be used via pipx, but old version will be installed if glibc version is old.
     IFS=' '
     info "running \`zizmor -q ${zizmor_targets[*]}\`"
     IFS=$'\n\t'
@@ -931,7 +975,7 @@ check_alt '.sh extension' '*.bash extension' "$(ls_files '*.bash')"
 if [[ -f tools/.tidy-check-license-headers ]]; then
   info "checking license headers (experimental)"
   failed_files=''
-  for p in $(LC_ALL=C comm -12 <(eval $(<tools/.tidy-check-license-headers) | LC_ALL=C sort) <(ls_files | LC_ALL=C sort)); do
+  for p in $(LC_ALL=C comm -12 <(eval "$(<tools/.tidy-check-license-headers)" | LC_ALL=C sort) <(ls_files | LC_ALL=C sort)); do
     case "${p##*/}" in
       *.stderr | *.expanded.rs) continue ;; # generated files
       *.json) continue ;;                   # no comment support
@@ -973,7 +1017,7 @@ fi
 if [[ -f .cspell.json ]]; then
   info "spell checking"
   project_dictionary=.github/.cspell/project-dictionary.txt
-  if check_install npm jq python3 pipx; then
+  if check_install npm jq pipx; then
     has_rust=''
     if [[ -n "$(ls_files '*Cargo.toml')" ]]; then
       has_rust=1