Release 2.68.25

.github/workflows/ci.yml

@@ -134,7 +134,7 @@ jobs:
         if: startsWith(matrix.os, 'windows')
       - name: Test cmd
         run: just --version & shfmt --version & protoc --version
-        shell: cmd
+        shell: cmd # zizmor: ignore[misfeature] used for compatibility testing
         if: startsWith(matrix.os, 'windows')
       # We use the version output to check the version of cargo-binstall, but they
       # several times change the version output format in the past so we need to

.github/zizmor.yml

@@ -3,14 +3,9 @@
 
 rules:
   dependabot-cooldown: { disable: true } # Useless unless hash-pin is forced by unpinned-uses.
-  ref-confusion: { disable: true } # TODO: Old GHA didn't work without this pattern in some cases, but does it seem to be fixed?
   secrets-inherit: { disable: true }
   unpinned-uses:
     config:
       policies:
         taiki-e/*: any
         '*': ref-pin
-  misfeature:
-    ignore:
-      # We use `shell: cmd` to test compatibility.
-      - ci.yml

.gitignore

@@ -1,5 +1,6 @@
 target
 Cargo.lock
+mutants.out*
 tmp
 
 # For platform and editor specific settings, it is recommended to add to

CHANGELOG.md

@@ -10,6 +10,18 @@ Note: In this file, do not use the hard wrap in the middle of a sentence for com
 
 ## [Unreleased]
 
+## [2.68.25] - 2026-03-08
+
+- Update `zizmor@latest` to 1.23.1.
+
+- Update `tombi@latest` to 0.9.4.
+
+- Update `cargo-semver-checks@latest` to 0.47.0.
+
+## [2.68.24] - 2026-03-08
+
+- Avoid triggering [zizmor ref-confusion](https://docs.zizmor.sh/audits/#ref-confusion) when using this action in form of `uses: taiki-e/install-action@v2` or `uses: taiki-e/install-action@<tool_name>`.
+
 ## [2.68.23] - 2026-03-08
 
 - Update `zizmor@latest` to 1.23.0.
@@ -5835,7 +5847,9 @@ Note: This release is considered a breaking change because installing on version
 
 Initial release
 
-[Unreleased]: https://github.com/taiki-e/install-action/compare/v2.68.23...HEAD
+[Unreleased]: https://github.com/taiki-e/install-action/compare/v2.68.25...HEAD
+[2.68.25]: https://github.com/taiki-e/install-action/compare/v2.68.24...v2.68.25
+[2.68.24]: https://github.com/taiki-e/install-action/compare/v2.68.23...v2.68.24
 [2.68.23]: https://github.com/taiki-e/install-action/compare/v2.68.22...v2.68.23
 [2.68.22]: https://github.com/taiki-e/install-action/compare/v2.68.21...v2.68.22
 [2.68.21]: https://github.com/taiki-e/install-action/compare/v2.68.20...v2.68.21

manifests/cargo-semver-checks.json

@@ -19,7 +19,32 @@
   },
   "license_markdown": "[Apache-2.0](https://github.com/obi1kenobi/cargo-semver-checks/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/obi1kenobi/cargo-semver-checks/blob/main/LICENSE-MIT)",
   "latest": {
-    "version": "0.46.0"
+    "version": "0.47.0"
+  },
+  "0.47": {
+    "version": "0.47.0"
+  },
+  "0.47.0": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE7D2FF09DA760",
+      "checksum": "daea6dfdebf9b15ce902a8af2fc6b9c2e86ddd49af17a9c5a656939289588f68"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE7D3013295950",
+      "checksum": "75cf29b645c9fc8cb2b47f8439d86174318c727ff091c17a58df41ec36f07bba"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE7D30737B42F1",
+      "checksum": "8bae283f1406f3be66eee1ac10ed28f8d1f97c98db807fea7eebc7a26610f14e"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE7D2FEDBFE1CE",
+      "checksum": "ba8efb38ec41cbbd88c5972d5ac62a4478493fe37e79390b94fd1196ce8fbd52"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE7D2FFFAC9D2A",
+      "checksum": "4faf600ae88129f7a3c748d31fcf2796c74a369c984969f6963c5648f1671966"
+    }
   },
   "0.46": {
     "version": "0.46.0"

manifests/tombi.json

@@ -22,10 +22,36 @@
   },
   "license_markdown": "[MIT](https://github.com/tombi-toml/tombi/blob/main/LICENSE)",
   "latest": {
-    "version": "0.9.3"
+    "version": "0.9.4"
   },
   "0.9": {
-    "version": "0.9.3"
+    "version": "0.9.4"
+  },
+  "0.9.4": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE7D2E4981E647",
+      "checksum": "4bfb639f6d242a5cbf9b364c9bfd812ab2e1ea148aa93895e9d9593418b048af"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE7D2E498A8F1F",
+      "checksum": "746b0134d21a7ace029266e0c0fa2302b3b84206d16f6e400a39cc34cb24d705"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE7D2E4A1605EF",
+      "checksum": "a9df3f61e1d5768d33c97f8d111ec0d1f57880cc9c7d04a65966da3933450b8a"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE7D2E49820D2B",
+      "checksum": "51f267a6ec0d9bd937afe0f3a102a6a7d3e9ad15e8e985f63c69313c4bc9593d"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE7D2E498F6BAB",
+      "checksum": "7ab18edcbd50325fac023c3a78d361aad8a59313cb010f5fe06d3070b099ac74"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE7D2E49F2C701",
+      "checksum": "dcfc97f2046c0d3ca3be352d2eb82078fb11335687696ed1e84991efff33633c"
+    }
   },
   "0.9.3": {
     "x86_64_linux_musl": {

manifests/zizmor.json

@@ -19,13 +19,35 @@
   },
   "license_markdown": "[MIT](https://github.com/zizmorcore/zizmor/blob/main/LICENSE)",
   "latest": {
-    "version": "1.23.0"
+    "version": "1.23.1"
   },
   "1": {
-    "version": "1.23.0"
+    "version": "1.23.1"
   },
   "1.23": {
-    "version": "1.23.0"
+    "version": "1.23.1"
+  },
+  "1.23.1": {
+    "x86_64_linux_gnu": {
+      "etag": "0x8DE7D33CBBC35A2",
+      "checksum": "67a8df0a14352dd81882e14876653d097b99b0f4f6b6fe798edc0320cff27aff"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE7D33CBBCAA50",
+      "checksum": "89d5ed42081dd9d0433a10b7545fac42b35f1f030885c278b9712b32c66f2597"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE7D33CBB49D08",
+      "checksum": "33c2293ff02834720dd7cd8b47348aafb2e95a19bdc993c0ecaca9c804ade92a"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DE7D33CBAEFE16",
+      "checksum": "3725d7cd7102e4d70827186389f7d5930b6878232930d0a3eb058d7e5b47e658"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE7D33CBC38073",
+      "checksum": "2632561b974c69f952258c1ab4b7432d5c7f92e555704155c3ac28a2910bd717"
+    }
   },
   "1.23.0": {
     "x86_64_linux_gnu": {

tools/codegen/src/lib.rs

@@ -2,14 +2,11 @@
 
 #![allow(clippy::missing_panics_doc, clippy::too_long_first_doc_paragraph)]
 
-use std::{env, path::PathBuf};
+use std::{env, path::Path};
 
 pub use install_action_manifest_schema::*;
 
 #[must_use]
-pub fn workspace_root() -> PathBuf {
-    let mut dir = PathBuf::from(env!("CARGO_MANIFEST_DIR"));
-    dir.pop(); // codegen
-    dir.pop(); // tools
-    dir
+pub fn workspace_root() -> &'static Path {
+    Path::new(env!("CARGO_MANIFEST_DIR").strip_suffix("tools/codegen").unwrap())
 }

tools/codegen/src/main.rs

@@ -32,7 +32,7 @@ fn main() -> Result<()> {
     let version_req_given = version_req.is_some();
     let skip_existing_manifest_versions = std::env::var("SKIP_EXISTING_MANIFEST_VERSIONS").is_ok();
 
-    let workspace_root = &workspace_root();
+    let workspace_root = workspace_root();
     let manifest_path = &workspace_root.join("manifests").join(format!("{package}.json"));
     let download_cache_dir = &workspace_root.join("tools/codegen/tmp/cache").join(package);
     fs::create_dir_all(manifest_path.parent().unwrap())?;

tools/codegen/src/tools-markdown.rs

@@ -40,9 +40,9 @@ fn main() -> Result<()> {
 
     let workspace_root = workspace_root();
 
-    let mut manifest_dir = workspace_root.clone();
+    let mut manifest_dir = workspace_root.to_owned();
     manifest_dir.push("manifests");
-    let mut base_info_dir = workspace_root.clone();
+    let mut base_info_dir = workspace_root.to_owned();
     base_info_dir.push("tools");
     base_info_dir.push("codegen");
     base_info_dir.push("base");
@@ -112,7 +112,7 @@ fn main() -> Result<()> {
 
     tools.sort_by(|x, y| x.name.cmp(&y.name));
 
-    let mut markdown_file = workspace_root.clone();
+    let mut markdown_file = workspace_root.to_owned();
     markdown_file.push("TOOLS.md");
 
     let mut file = BufWriter::new(fs::File::create(markdown_file).unwrap()); // Buffered because it is written many times.

tools/publish.sh

@@ -121,9 +121,9 @@ retry git push origin refs/heads/main
 retry git push origin refs/tags/"${tag}"
 
 major_version_tag="v${version%%.*}"
-git branch "${major_version_tag}"
+git branch "releases/${major_version_tag}"
 git tag -f "${major_version_tag}"
-refs=("refs/heads/${major_version_tag}" "+refs/tags/${major_version_tag}")
+refs=("refs/heads/releases/${major_version_tag}" "+refs/tags/${major_version_tag}")
 
 tools=()
 for tool in tools/codegen/base/*.json; do
@@ -142,8 +142,9 @@ tools+=(
 # Non-manifest-based tools.
 tools+=(valgrind)
 
+branches=()
 for tool in "${tools[@]}"; do
-  git checkout -b "${tool}"
+  git checkout -b "releases/${tool}"
   sed -E "${in_place[@]}" action.yml \
     -e "s/required: true/required: false/g" \
     -e "s/# default: #publish:tool/default: ${tool}/g"
@@ -151,11 +152,12 @@ for tool in "${tools[@]}"; do
   git commit -m "${tool}"
   git tag -f "${tool}"
   git checkout main
-  refs+=("+refs/heads/${tool}" "+refs/tags/${tool}")
+  refs+=("+refs/heads/releases/${tool}" "+refs/tags/${tool}")
+  branches+=("releases/${tool}")
 done
 retry git push origin --atomic "${refs[@]}"
-git branch -d "${major_version_tag}"
-git branch -D "${tools[@]}"
+git branch -d "releases/${major_version_tag}"
+git branch -D "${branches[@]}"
 
 schema_workspace=/tmp/workspace
 rm -rf -- "${schema_workspace}"

tools/tidy.sh

@@ -909,8 +909,21 @@ EOF
             JOB_DEFAULT_SHELL="${default_shell}"
           fi
           for step in $(jq -c '.steps[]' <<<"${job}"); do
+            uses=''
+            # https://github.com/vmactions: prepare, run
+            # https://github.com/cross-platform-actions/action: run, shell
+            # https://github.com/uraimo/run-on-arch-action: setup, install, run, shell
             prepare=''
-            eval "$(jq -r 'if .run then @sh "RUN=\(.run) shell=\(.shell)" else @sh "RUN=\(.with.run) prepare=\(.with.prepare) shell=\(.with.shell)" end' <<<"${step}")"
+            setup=''
+            install=''
+            eval "$(jq -r 'if .run then @sh "RUN=\(.run) shell=\(.shell)" else @sh "uses=\(.uses) FALLBACK=\(.with.fallback) RUN=\(.with.run) prepare=\(.with.prepare) setup=\(.with.setup) install=\(.with.install) shell=\(.with.shell)" end' <<<"${step}")"
+            if [[ "${uses}" == */install-action@* ]]; then
+              if [[ "${FALLBACK}" != 'none' ]]; then
+                error "'fallback: none' must be set for install-action (${name}.steps[${n}])"
+              fi
+              _=$((n++))
+              continue
+            fi
             if [[ "${RUN}" == 'null' ]]; then
               _=$((n++))
               continue
@@ -924,8 +937,14 @@ EOF
                 shell='sh'
               fi
             fi
-            shellcheck_for_gha "${RUN}" "${shell}" "${workflow_path} ${name}.steps[${n}].run"
-            shellcheck_for_gha "${prepare:-null}" 'sh' "${workflow_path} ${name}.steps[${n}].run"
+            if [[ -z "${uses}" ]]; then
+              shellcheck_for_gha "${RUN}" "${shell}" "${workflow_path} ${name}.steps[${n}].run"
+            else
+              shellcheck_for_gha "${RUN}" "${shell}" "${workflow_path} ${name}.steps[${n}].with.run"
+            fi
+            shellcheck_for_gha "${prepare:-null}" 'sh' "${workflow_path} ${name}.steps[${n}].with.prepare"
+            shellcheck_for_gha "${setup:-null}" "${shell}" "${workflow_path} ${name}.steps[${n}].with.setup"
+            shellcheck_for_gha "${install:-null}" "${shell}" "${workflow_path} ${name}.steps[${n}].with.install"
             _=$((n++))
           done
         done