Release 2.68.24

.github/workflows/ci.yml

@@ -134,7 +134,7 @@ jobs:
         if: startsWith(matrix.os, 'windows')
       - name: Test cmd
         run: just --version & shfmt --version & protoc --version
-        shell: cmd
+        shell: cmd # zizmor: ignore[misfeature] used for compatibility testing
         if: startsWith(matrix.os, 'windows')
       # We use the version output to check the version of cargo-binstall, but they
       # several times change the version output format in the past so we need to

.github/zizmor.yml

@@ -10,7 +10,3 @@ rules:
       policies:
         taiki-e/*: any
         '*': ref-pin
-  misfeature:
-    ignore:
-      # We use `shell: cmd` to test compatibility.
-      - ci.yml

.gitignore

@@ -1,5 +1,6 @@
 target
 Cargo.lock
+mutants.out*
 tmp
 
 # For platform and editor specific settings, it is recommended to add to

CHANGELOG.md

@@ -10,6 +10,26 @@ Note: In this file, do not use the hard wrap in the middle of a sentence for com
 
 ## [Unreleased]
 
+## [2.68.24] - 2026-03-08
+
+- Avoid triggering [zizmor ref-confusion](https://docs.zizmor.sh/audits/#ref-confusion) when using this action in form of `uses: taiki-e/install-action@v2` or `uses: taiki-e/install-action@<tool_name>`.
+
+## [2.68.23] - 2026-03-08
+
+- Update `zizmor@latest` to 1.23.0.
+
+- Update `tombi@latest` to 0.9.3.
+
+- Update `mise@latest` to 2026.3.5.
+
+## [2.68.22] - 2026-03-07
+
+- Update `release-plz@latest` to 0.3.157.
+
+- Update `cargo-binstall@latest` to 1.17.7.
+
+- Update `mise@latest` to 2026.3.4.
+
 ## [2.68.21] - 2026-03-07
 
 - Update `tombi@latest` to 0.9.2.
@@ -5819,7 +5839,10 @@ Note: This release is considered a breaking change because installing on version
 
 Initial release
 
-[Unreleased]: https://github.com/taiki-e/install-action/compare/v2.68.21...HEAD
+[Unreleased]: https://github.com/taiki-e/install-action/compare/v2.68.24...HEAD
+[2.68.24]: https://github.com/taiki-e/install-action/compare/v2.68.23...v2.68.24
+[2.68.23]: https://github.com/taiki-e/install-action/compare/v2.68.22...v2.68.23
+[2.68.22]: https://github.com/taiki-e/install-action/compare/v2.68.21...v2.68.22
 [2.68.21]: https://github.com/taiki-e/install-action/compare/v2.68.20...v2.68.21
 [2.68.20]: https://github.com/taiki-e/install-action/compare/v2.68.19...v2.68.20
 [2.68.19]: https://github.com/taiki-e/install-action/compare/v2.68.18...v2.68.19

manifests/cargo-binstall.json

@@ -22,32 +22,32 @@
   },
   "license_markdown": "[GPL-3.0](https://github.com/cargo-bins/cargo-binstall/blob/HEAD/crates/bin/LICENSE)",
   "latest": {
-    "version": "1.17.6"
+    "version": "1.17.7"
   },
-  "1.17.6": {
+  "1.17.7": {
     "x86_64_linux_musl": {
-      "etag": "0x8DE76914734AF09",
-      "checksum": "f926d96e9f0822ded35c4ac2071ce190bd1311565695c49c45e295de0d685aaa"
+      "etag": "0x8DE7C5AC0E4497E",
+      "checksum": "29b5ecfb6e03c2511a617c77d312b06df0c54717644fbfda3d465ec8240532f0"
     },
     "x86_64_macos": {
-      "etag": "0x8DE76914C772699",
-      "checksum": "cd07fd79e2848b13b994e3f83fa5377b631625b847f0734219f2706feb518258"
+      "etag": "0x8DE7C5AC5E5BC1B",
+      "checksum": "aa7174fb938e668dea4b4c3d22fe6cefed97642cc3a7a419ba96d63d63fd729b"
     },
     "x86_64_windows": {
-      "etag": "0x8DE76914A9E394D",
-      "checksum": "5fcbddde2d415704d2432bbe606a5767ddaf1ef4ee2c16b7828f8be2ed1e5a5c"
+      "etag": "0x8DE7C5AC441ACDB",
+      "checksum": "c5cb2444ee04480502a8ac73d96abd9f97af8300ec04ea1c1f2a9e959c02e4d6"
     },
     "aarch64_linux_musl": {
-      "etag": "0x8DE769153455E94",
-      "checksum": "e5f2c4b79b10370dff707b86a14e7a0ad399c5dc5853824e933432910741992c"
+      "etag": "0x8DE7C5ACC95E091",
+      "checksum": "b0658b0a7f0959bc1dbb4ab665931c31c7dd1109ff01cb8772af17dfdc52a9af"
     },
     "aarch64_macos": {
-      "etag": "0x8DE769158DCE9A8",
-      "checksum": "101447fa30a723ca8e1a13cec11bb1350b7179331b2aa7054d27bef7a3e19021"
+      "etag": "0x8DE7C5AD2545078",
+      "checksum": "1ad3c0c56fa3970634cce5009ed0ce61b943515f9115f8e480fd0e41d8d89085"
     },
     "aarch64_windows": {
-      "etag": "0x8DE769156F36CE7",
-      "checksum": "5faf2e24e91bba98d7020fc96a59b309dbd4ea3d2cd9c0fec3360d73f32ef712"
+      "etag": "0x8DE7C5AD068DA1E",
+      "checksum": "e876543c9aad23968d1123c0d959309937894bbfd267bb0878109fb253217878"
     }
   }
 }

manifests/mise.json

@@ -28,13 +28,65 @@
   },
   "license_markdown": "[MIT](https://github.com/jdx/mise/blob/main/LICENSE)",
   "latest": {
-    "version": "2026.3.3"
+    "version": "2026.3.5"
   },
   "2026": {
-    "version": "2026.3.3"
+    "version": "2026.3.5"
   },
   "2026.3": {
-    "version": "2026.3.3"
+    "version": "2026.3.5"
+  },
+  "2026.3.5": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE7CA8EF4B602D",
+      "checksum": "eae3d01230d11cf73a6cfae3433514b5a80e117a73f9e385a467ac8d7430629e"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE7CA8F1A3768C",
+      "checksum": "7897a373cded573fc8ed68d35b2d18db31b76d567e1361e44aac93175a240a6e"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE7CA8F26FA50B",
+      "checksum": "deb8a94e079d4b8de0d6fd747e685ca8f68d3f06f20dc6686772134e0ab456bd"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE7CA8EB5AECC7",
+      "checksum": "fd18ceb54f19cacaa5615fd70f959c3569fe7446e398faced6bbca3b9c13d2de"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE7CA8F0C250FF",
+      "checksum": "f6f009e9f547abe4ee949fbf362944228fd64c0849c76bc9139a4b805b157776"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE7CA8F21FE2E7",
+      "checksum": "1fffc0d662f52e3c1473f95cb6a47cd0bc2c6447634f8079254fe68d083700d7"
+    }
+  },
+  "2026.3.4": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE7C188379B605",
+      "checksum": "4ac29e1b2e5a18541b15b7ebbacab17a1ca2fcb545aad8196698a898733e54d8"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE7C1885B9F300",
+      "checksum": "44694b3c2e6cbeb4d58eadf4c3398b90e33d4882da0a75ce9ade41480e701785"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE7C188658405A",
+      "checksum": "dc0afcbdc2272e77748a2d367cee4d426222dcd4000272637aa24f1e33a2bb1b"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE7C1880571C1D",
+      "checksum": "4f66b2573b4073698ebcfa76e471495c9e707671d340620c9aeb5674d7886c90"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE7C1884EB2F21",
+      "checksum": "f37de4f1df579999386be130c07d8de39580010dbd1f62b587797049d47d0e2b"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE7C1886460550",
+      "checksum": "f4b46054e86a1dc4568d8df5ebc6d8eeb950b57326db0868d98696a73ef363de"
+    }
   },
   "2026.3.3": {
     "x86_64_linux_musl": {

manifests/release-plz.json

@@ -22,10 +22,32 @@
   },
   "license_markdown": "[MIT](https://github.com/release-plz/release-plz/blob/main/LICENSE-MIT) OR [Apache-2.0](https://github.com/release-plz/release-plz/blob/main/LICENSE-APACHE)",
   "latest": {
-    "version": "0.3.156"
+    "version": "0.3.157"
   },
   "0.3": {
-    "version": "0.3.156"
+    "version": "0.3.157"
+  },
+  "0.3.157": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE7C66775120BE",
+      "checksum": "2fc44a3c68e6bf4eaf761926c6c3b2971d6eaef8ffd2420640ac2f2f22e12c51"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE7C6709348B53",
+      "checksum": "02594d6e5a62849c89547209e6a47e9565e0b53764e0875d0c5399259570bb11"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE7C668E8EEC6A",
+      "checksum": "5192ffa6562175b35054cd6c80fc04acc37fde82e523bf897000fed259021b83"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE7C6668C6C892",
+      "checksum": "0006b843fd25e11b4aec073a6feb5e9b1be27702863504bef1432c39b795b52c"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE7C6737D27ABE",
+      "checksum": "b7c028b5066b8ecdfed822373b92ee9ec1a43e2b5175e96406b017ed61706d1d"
+    }
   },
   "0.3.156": {
     "x86_64_linux_musl": {

manifests/tombi.json

@@ -22,10 +22,36 @@
   },
   "license_markdown": "[MIT](https://github.com/tombi-toml/tombi/blob/main/LICENSE)",
   "latest": {
-    "version": "0.9.2"
+    "version": "0.9.3"
   },
   "0.9": {
-    "version": "0.9.2"
+    "version": "0.9.3"
+  },
+  "0.9.3": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE7CD825537A64",
+      "checksum": "9f17f6766f908d27294f22a928a498f49fb3957c206bfd7b73975de11761d096"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE7CD8255B39DE",
+      "checksum": "93610b36efe99f09ab3a109dad47327b569bdd2aedfd5ddba37d08ecb0d70489"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE7CD8255D5A57",
+      "checksum": "1d052e8e814252bfb85d0cddc9d6c39bfe5c8d8dce3c962e7ec575e355ddc6fb"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE7CD82547C7B2",
+      "checksum": "38b9352a7e06e1bf10f6de3b3247b35ef9e109134567677da30a44375bed7d5d"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE7CD825C01A0D",
+      "checksum": "385f61c90ef854f0b96fa525f2eedcfae705befaa74d2b99ae5c95013f0db4e5"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE7CD825ED1201",
+      "checksum": "76c80b423a2ded65a28810533f18ee60a924a1bb79a7426f1c12e3a08d83746e"
+    }
   },
   "0.9.2": {
     "x86_64_linux_musl": {

manifests/zizmor.json

@@ -19,10 +19,35 @@
   },
   "license_markdown": "[MIT](https://github.com/zizmorcore/zizmor/blob/main/LICENSE)",
   "latest": {
-    "version": "1.22.0"
+    "version": "1.23.0"
   },
   "1": {
-    "version": "1.22.0"
+    "version": "1.23.0"
+  },
+  "1.23": {
+    "version": "1.23.0"
+  },
+  "1.23.0": {
+    "x86_64_linux_gnu": {
+      "etag": "0x8DE7CDA7B7E46D6",
+      "checksum": "5c86c299a6f59e7b91e43fa6b3826add93edf3b1468d24775992604a5e41797b"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE7CDA7B7D369A",
+      "checksum": "791750aaa9948dfd75c8aa92d58577e20c91e434562347328c84572f8f94048b"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE7CDA7B7DAB4B",
+      "checksum": "7707de90a63a516b653a632d7348b1e089bf7f2c5daf90cc45cbc4661eb324a0"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DE7CDA7B8BF314",
+      "checksum": "e140f07a78e7c05ffc86273c4a4935cbe76bba24a322e0e6ee237a9c4662c65d"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE7CDA7B82D5A8",
+      "checksum": "2263ca6af1248539bfb2962a1966183709139e2e87bdf4023a913b06ebbde6c4"
+    }
   },
   "1.22": {
     "version": "1.22.0"

tools/codegen/src/lib.rs

@@ -2,14 +2,11 @@
 
 #![allow(clippy::missing_panics_doc, clippy::too_long_first_doc_paragraph)]
 
-use std::{env, path::PathBuf};
+use std::{env, path::Path};
 
 pub use install_action_manifest_schema::*;
 
 #[must_use]
-pub fn workspace_root() -> PathBuf {
-    let mut dir = PathBuf::from(env!("CARGO_MANIFEST_DIR"));
-    dir.pop(); // codegen
-    dir.pop(); // tools
-    dir
+pub fn workspace_root() -> &'static Path {
+    Path::new(env!("CARGO_MANIFEST_DIR").strip_suffix("tools/codegen").unwrap())
 }

tools/codegen/src/main.rs

@@ -32,7 +32,7 @@ fn main() -> Result<()> {
     let version_req_given = version_req.is_some();
     let skip_existing_manifest_versions = std::env::var("SKIP_EXISTING_MANIFEST_VERSIONS").is_ok();
 
-    let workspace_root = &workspace_root();
+    let workspace_root = workspace_root();
     let manifest_path = &workspace_root.join("manifests").join(format!("{package}.json"));
     let download_cache_dir = &workspace_root.join("tools/codegen/tmp/cache").join(package);
     fs::create_dir_all(manifest_path.parent().unwrap())?;

tools/codegen/src/tools-markdown.rs

@@ -40,9 +40,9 @@ fn main() -> Result<()> {
 
     let workspace_root = workspace_root();
 
-    let mut manifest_dir = workspace_root.clone();
+    let mut manifest_dir = workspace_root.to_owned();
     manifest_dir.push("manifests");
-    let mut base_info_dir = workspace_root.clone();
+    let mut base_info_dir = workspace_root.to_owned();
     base_info_dir.push("tools");
     base_info_dir.push("codegen");
     base_info_dir.push("base");
@@ -112,7 +112,7 @@ fn main() -> Result<()> {
 
     tools.sort_by(|x, y| x.name.cmp(&y.name));
 
-    let mut markdown_file = workspace_root.clone();
+    let mut markdown_file = workspace_root.to_owned();
     markdown_file.push("TOOLS.md");
 
     let mut file = BufWriter::new(fs::File::create(markdown_file).unwrap()); // Buffered because it is written many times.

tools/publish.sh

@@ -121,9 +121,9 @@ retry git push origin refs/heads/main
 retry git push origin refs/tags/"${tag}"
 
 major_version_tag="v${version%%.*}"
-git branch "${major_version_tag}"
+git branch "releases/${major_version_tag}"
 git tag -f "${major_version_tag}"
-refs=("refs/heads/${major_version_tag}" "+refs/tags/${major_version_tag}")
+refs=("refs/heads/releases/${major_version_tag}" "+refs/tags/${major_version_tag}")
 
 tools=()
 for tool in tools/codegen/base/*.json; do
@@ -142,8 +142,9 @@ tools+=(
 # Non-manifest-based tools.
 tools+=(valgrind)
 
+branches=()
 for tool in "${tools[@]}"; do
-  git checkout -b "${tool}"
+  git checkout -b "releases/${tool}"
   sed -E "${in_place[@]}" action.yml \
     -e "s/required: true/required: false/g" \
     -e "s/# default: #publish:tool/default: ${tool}/g"
@@ -151,11 +152,12 @@ for tool in "${tools[@]}"; do
   git commit -m "${tool}"
   git tag -f "${tool}"
   git checkout main
-  refs+=("+refs/heads/${tool}" "+refs/tags/${tool}")
+  refs+=("+refs/heads/releases/${tool}" "+refs/tags/${tool}")
+  branches+=("releases/${tool}")
 done
 retry git push origin --atomic "${refs[@]}"
-git branch -d "${major_version_tag}"
-git branch -D "${tools[@]}"
+git branch -d "releases/${major_version_tag}"
+git branch -D "${branches[@]}"
 
 schema_workspace=/tmp/workspace
 rm -rf -- "${schema_workspace}"

tools/tidy.sh

@@ -909,8 +909,21 @@ EOF
             JOB_DEFAULT_SHELL="${default_shell}"
           fi
           for step in $(jq -c '.steps[]' <<<"${job}"); do
+            uses=''
+            # https://github.com/vmactions: prepare, run
+            # https://github.com/cross-platform-actions/action: run, shell
+            # https://github.com/uraimo/run-on-arch-action: setup, install, run, shell
             prepare=''
-            eval "$(jq -r 'if .run then @sh "RUN=\(.run) shell=\(.shell)" else @sh "RUN=\(.with.run) prepare=\(.with.prepare) shell=\(.with.shell)" end' <<<"${step}")"
+            setup=''
+            install=''
+            eval "$(jq -r 'if .run then @sh "RUN=\(.run) shell=\(.shell)" else @sh "uses=\(.uses) FALLBACK=\(.with.fallback) RUN=\(.with.run) prepare=\(.with.prepare) setup=\(.with.setup) install=\(.with.install) shell=\(.with.shell)" end' <<<"${step}")"
+            if [[ "${uses}" == */install-action@* ]]; then
+              if [[ "${FALLBACK}" != 'none' ]]; then
+                error "'fallback: none' must be set for install-action (${name}.steps[${n}])"
+              fi
+              _=$((n++))
+              continue
+            fi
             if [[ "${RUN}" == 'null' ]]; then
               _=$((n++))
               continue
@@ -924,8 +937,14 @@ EOF
                 shell='sh'
               fi
             fi
-            shellcheck_for_gha "${RUN}" "${shell}" "${workflow_path} ${name}.steps[${n}].run"
-            shellcheck_for_gha "${prepare:-null}" 'sh' "${workflow_path} ${name}.steps[${n}].run"
+            if [[ -z "${uses}" ]]; then
+              shellcheck_for_gha "${RUN}" "${shell}" "${workflow_path} ${name}.steps[${n}].run"
+            else
+              shellcheck_for_gha "${RUN}" "${shell}" "${workflow_path} ${name}.steps[${n}].with.run"
+            fi
+            shellcheck_for_gha "${prepare:-null}" 'sh' "${workflow_path} ${name}.steps[${n}].with.prepare"
+            shellcheck_for_gha "${setup:-null}" "${shell}" "${workflow_path} ${name}.steps[${n}].with.setup"
+            shellcheck_for_gha "${install:-null}" "${shell}" "${workflow_path} ${name}.steps[${n}].with.install"
             _=$((n++))
           done
         done