Release 2.70.3

.github/workflows/ci.yml

@@ -51,7 +51,8 @@ jobs:
       contents: write # for creating branch for pr
       pull-requests: write # unused (used in `codegen-automerge: true` case)
       security-events: write # for github/codeql-action/*
-    secrets: inherit
+    secrets:
+      PR_TOKEN_APP_PRIVATE_KEY: ${{ secrets.PR_TOKEN_APP_PRIVATE_KEY }}
 
   test:
     strategy:
@@ -99,7 +100,11 @@ jobs:
       - run: rm -- Cargo.toml
       - name: Generate tool list
         id: tool-list
-        run: tools/ci/tool-list.sh "${{ matrix.tool }}" "${{ matrix.os }}" "${{ matrix.bash }}" >>"${GITHUB_OUTPUT}"
+        run: tools/ci/tool-list.sh "${TOOL}" "${OS}" "${BASH}" >>"${GITHUB_OUTPUT}"
+        env:
+          TOOL: ${{ matrix.tool }}
+          OS: ${{ matrix.os }}
+          BASH: ${{ matrix.bash }}
       - run: |
           printf '%s\n' 'C:\msys64\mingw32\bin' >>"${GITHUB_PATH}"
           printf '%s\n' 'C:\msys64\usr\bin' >>"${GITHUB_PATH}"
@@ -264,7 +269,7 @@ jobs:
           sed -i /etc/yum.repos.d/*.repo -e 's!^mirrorlist!#mirrorlist!' \
             -e 's!^#baseurl=http://mirror.centos.org/!baseurl=https://vault.centos.org/!'
           sed -i 's/enabled=1/enabled=0/' /etc/yum/pluginconf.d/fastestmirror.conf
-          if [[ "${{ matrix.container }}" == "centos:6" ]]; then
+          if [[ "${CONTAINER}" == "centos:6" ]]; then
             # CentOS 6's curl (7.19.7) has no curl has no --proto/--tlsv1.2.
             yum install -y gcc openssl-devel
             curl -fsSL --retry 10 https://curl.se/download/curl-7.34.0.tar.gz | tar xzf -
@@ -278,13 +283,17 @@ jobs:
               https://vault.ius.io/el6/x86_64/packages/p/perl-Git18-1.8.5.5-4.ius.el6.noarch.rpm \
               https://vault.ius.io/el6/x86_64/packages/g/git18-1.8.5.5-4.ius.el6.x86_64.rpm
           fi
+        env:
+          CONTAINER: ${{ matrix.container }}
         if: startsWith(matrix.container, 'centos')
       - uses: taiki-e/checkout-action@v1
       # cross attempts to install rust-src when Cargo.toml is available even if `cross --version`
       - run: rm -- Cargo.toml
       - name: Generate tool list
         id: tool-list
-        run: tools/ci/tool-list.sh "" "${{ matrix.container }}" >>"${GITHUB_OUTPUT}"
+        run: tools/ci/tool-list.sh "" "${CONTAINER}" >>"${GITHUB_OUTPUT}"
+        env:
+          CONTAINER: ${{ matrix.container }}
       # remove bash installed by checkout-action
       - run: apk --no-cache del bash
         shell: sh

.github/workflows/manifest.yml

@@ -37,7 +37,8 @@ jobs:
     permissions:
       contents: write # for creating branch for pr
       pull-requests: write # for gh pr review --approve
-    secrets: inherit
+    secrets:
+      PR_TOKEN_APP_PRIVATE_KEY: ${{ secrets.PR_TOKEN_APP_PRIVATE_KEY }}
     with:
       script: tools/manifest.sh
       commit-script: tools/ci/manifest.sh

.github/workflows/release.yml

@@ -26,6 +26,10 @@ defaults:
   run:
     shell: bash --noprofile --norc -CeEuxo pipefail {0}
 
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
+
 jobs:
   prepare:
     if: github.repository_owner == 'taiki-e' && inputs.target == 'install-action'
@@ -435,7 +439,8 @@ jobs:
       contents: write # for taiki-e/create-gh-release-action
       id-token: write # for rust-lang/crates-io-auth-action
       attestations: write # unused (used when options for uploading binaries are set)
-    secrets: inherit
+    secrets:
+      PUSH_TOKEN: ${{ secrets.PUSH_TOKEN }}
     with:
       version: ${{ inputs.version }}
       tag-prefix: install-action-manifest-schema-

.github/zizmor.yml

@@ -2,7 +2,7 @@
 # https://docs.zizmor.sh/configuration/
 
 rules:
-  secrets-inherit: { disable: true }
+  anonymous-definition: { disable: true }
   unpinned-uses:
     config:
       policies:

CHANGELOG.md

@@ -10,6 +10,22 @@ Note: In this file, do not use the hard wrap in the middle of a sentence for com
 
 ## [Unreleased]
 
+## [2.70.3] - 2026-03-31
+
+- Update `wasm-bindgen@latest` to 0.2.116.
+
+- Update `cargo-insta@latest` to 1.47.2.
+
+- Update `tombi@latest` to 0.9.12.
+
+- Update `biome@latest` to 2.4.10.
+
+## [2.70.2] - 2026-03-30
+
+- Update `vacuum@latest` to 0.25.3.
+
+- Update `tombi@latest` to 0.9.11.
+
 ## [2.70.1] - 2026-03-29
 
 - Update `cargo-insta@latest` to 1.47.1.
@@ -6065,7 +6081,9 @@ Note: This release is considered a breaking change because installing on version
 
 Initial release
 
-[Unreleased]: https://github.com/taiki-e/install-action/compare/v2.70.1...HEAD
+[Unreleased]: https://github.com/taiki-e/install-action/compare/v2.70.3...HEAD
+[2.70.3]: https://github.com/taiki-e/install-action/compare/v2.70.2...v2.70.3
+[2.70.2]: https://github.com/taiki-e/install-action/compare/v2.70.1...v2.70.2
 [2.70.1]: https://github.com/taiki-e/install-action/compare/v2.70.0...v2.70.1
 [2.70.0]: https://github.com/taiki-e/install-action/compare/v2.69.14...v2.70.0
 [2.69.14]: https://github.com/taiki-e/install-action/compare/v2.69.13...v2.69.14

manifests/biome.json

@@ -3,13 +3,51 @@
   "template": null,
   "license_markdown": "[Apache-2.0](https://github.com/biomejs/biome/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/biomejs/biome/blob/main/LICENSE-MIT)",
   "latest": {
-    "version": "2.4.9"
+    "version": "2.4.10"
   },
   "2": {
-    "version": "2.4.9"
+    "version": "2.4.10"
   },
   "2.4": {
-    "version": "2.4.9"
+    "version": "2.4.10"
+  },
+  "2.4.10": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/biomejs/biome/releases/download/%40biomejs/biome%402.4.10/biome-linux-x64-musl",
+      "etag": "0x8DE8E7705F6C243",
+      "hash": "897a1eb7be2bcc6dfa596f4c786014f82fd60615c7a2726241eb0bafc228f82c",
+      "bin": "biome"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/biomejs/biome/releases/download/%40biomejs/biome%402.4.10/biome-darwin-x64",
+      "etag": "0x8DE8E7705A3CF6D",
+      "hash": "8269b5ef30bbc1fcf0cff5695bdc3733d417744ae638df70e7dabc3b82590fca",
+      "bin": "biome"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/biomejs/biome/releases/download/%40biomejs/biome%402.4.10/biome-win32-x64.exe",
+      "etag": "0x8DE8E77063F8765",
+      "hash": "a2bdc915914114c09a6f38ea092af2e450953bf3ace76bc143f2ab4d5a17b238",
+      "bin": "biome.exe"
+    },
+    "aarch64_linux_musl": {
+      "url": "https://github.com/biomejs/biome/releases/download/%40biomejs/biome%402.4.10/biome-linux-arm64-musl",
+      "etag": "0x8DE8E7705851F43",
+      "hash": "dfabcbc165bd077464244fe2f73eceb7148219566a3ad94ddf7510e663675045",
+      "bin": "biome"
+    },
+    "aarch64_macos": {
+      "url": "https://github.com/biomejs/biome/releases/download/%40biomejs/biome%402.4.10/biome-darwin-arm64",
+      "etag": "0x8DE8E7705839A5F",
+      "hash": "c6782336dff872beec7d34e1b801c533bd296b5dcf2a30d3cf6335bca975e984",
+      "bin": "biome"
+    },
+    "aarch64_windows": {
+      "url": "https://github.com/biomejs/biome/releases/download/%40biomejs/biome%402.4.10/biome-win32-arm64.exe",
+      "etag": "0x8DE8E77061B8612",
+      "hash": "4285a020237cdb93e6c42cf8af12b3bb2614ecccaeec283dc89f4e092577a3b7",
+      "bin": "biome.exe"
+    }
   },
   "2.4.9": {
     "x86_64_linux_musl": {

manifests/cargo-insta.json

@@ -20,13 +20,31 @@
   },
   "license_markdown": "[Apache-2.0](https://github.com/mitsuhiko/insta/blob/master/LICENSE)",
   "latest": {
-    "version": "1.47.1"
+    "version": "1.47.2"
   },
   "1": {
-    "version": "1.47.1"
+    "version": "1.47.2"
   },
   "1.47": {
-    "version": "1.47.1"
+    "version": "1.47.2"
+  },
+  "1.47.2": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE8E9EE7357F8F",
+      "hash": "1c2a2e82200b430f6fa27b6d0ba0059573eae2f32b0b8aa54446184ab7b46ee7"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE8E9EE6D41E0F",
+      "hash": "62efa25c4e9f8182c16ae46f58bc3e9c8fdbe74aaf0409d3ed06909a70d128a5"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE8E9EE705F287",
+      "hash": "2f2ffcdda5608f78de53509bdd6a5feba185dad9490b5aad951c35bf8c37fa9e"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE8E9EE6D1FDA1",
+      "hash": "4876319b5201b875188351445b754db09f7674b506daa983634c95d6d44ca51e"
+    }
   },
   "1.47.1": {
     "x86_64_linux_musl": {

manifests/tombi.json

@@ -22,10 +22,62 @@
   },
   "license_markdown": "[MIT](https://github.com/tombi-toml/tombi/blob/main/LICENSE)",
   "latest": {
-    "version": "0.9.10"
+    "version": "0.9.12"
   },
   "0.9": {
-    "version": "0.9.10"
+    "version": "0.9.12"
+  },
+  "0.9.12": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE8E7577C157C6",
+      "hash": "79236f1175331e3d189e54103d12ed957eed53d4ccc0a0eb9299f30102c7dda1"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE8E7577BA0D09",
+      "hash": "9a1b1463135f88493500dc1abfea9777a6e2f4f980dcfbe7b150cc41f4ccb474"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE8E7577D14B62",
+      "hash": "f60bd33e0bddaaa4ca556d82229ff7a833119b63accfca14f62c0175a2f5b4d0"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE8E7577C413D4",
+      "hash": "e0d333c04d75980a6f28d1f476e8b2182e03f58c74cfbe0706e2249d1d666dc8"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE8E7578A33F60",
+      "hash": "98c6d08b6102ce0498208ef55d14861c197f131a42a9add020aa0d076636d166"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE8E7578703417",
+      "hash": "55b186788381c89ad1a18b8bf0c2ffe9cb0eb270efe1cab406edb845b3743a50"
+    }
+  },
+  "0.9.11": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE8D9EC510FD7C",
+      "hash": "a26165a20198b7af772c1abafebac31fe70ea76de438cdc14975d451ef9282a3"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE8D9EC4ABF6BC",
+      "hash": "80c70ef17dc76a0f997d8284911a178f90d4c3d04354eaa653b5dd3e15efff44"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE8D9EC53C498A",
+      "hash": "f073c5aa5cfdf291023207a58390a4593b7774ccd8a49d12fdefa2d859285f95"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE8D9EC4A89F22",
+      "hash": "1a4cdb63e5ab57d0eb12f170493a7902c3244572b6a3052ae894d06c082d4ddc"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE8D9EC4AC1DA5",
+      "hash": "1c3b3335f3feeda3f7676d90ffb6463ee2bca5a5393b1bbae76926e3fdb2b514"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE8D9EC4BA8C4E",
+      "hash": "85624e7e2f0bac43d8267c88a767afbb18ca338b72cf45c879046fc3a23a2e89"
+    }
   },
   "0.9.10": {
     "x86_64_linux_musl": {

manifests/vacuum.json

@@ -22,10 +22,36 @@
   },
   "license_markdown": "[MIT](https://github.com/daveshanley/vacuum/blob/main/LICENSE)",
   "latest": {
-    "version": "0.25.2"
+    "version": "0.25.3"
   },
   "0.25": {
-    "version": "0.25.2"
+    "version": "0.25.3"
+  },
+  "0.25.3": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE8DEA35C78445",
+      "hash": "dbcd9ea50b0ac74c181d905a1d162e2457f8bbc619d0f8e974ff3b38dcd23384"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE8DEA3675C50B",
+      "hash": "450964b9f2cbe9b63403bfe7b07cd2b3fb16eded4668c9e5749b9b469d288290"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE8DEA35DB442D",
+      "hash": "00a1a230fe2dbd45ee11e579d7d8d00daf83fa83a083fd66044514fdfd73e993"
+    },
+    "aarch64_linux_musl": {
+      "etag": "0x8DE8DEA35C7AB2A",
+      "hash": "a2db87faa3e04c2e0f8b5dd2c9162a33829eda0a1196ed49e3562a1a9434d3e0"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE8DEA367A7AB1",
+      "hash": "9ab96a00628c69c6aa4a62fcafb6d8cb8de792db94adb53c00344d19ff0c4af6"
+    },
+    "aarch64_windows": {
+      "etag": "0x8DE8DEA36512824",
+      "hash": "ed70ee1e9af46ba69c79b8d4bddea59c0bcc37613f92d12a77fe327f4832089d"
+    }
   },
   "0.25.2": {
     "x86_64_linux_musl": {

manifests/wasm-bindgen.json

@@ -44,10 +44,32 @@
   },
   "license_markdown": "[MIT](https://github.com/wasm-bindgen/wasm-bindgen/blob/main/LICENSE-MIT) OR [Apache-2.0](https://github.com/wasm-bindgen/wasm-bindgen/blob/main/LICENSE-APACHE)",
   "latest": {
-    "version": "0.2.115"
+    "version": "0.2.116"
   },
   "0.2": {
-    "version": "0.2.115"
+    "version": "0.2.116"
+  },
+  "0.2.116": {
+    "x86_64_linux_musl": {
+      "etag": "0x8DE8EBB3A19D512",
+      "hash": "f10d233eb87aaaed4a6a3af3d52ab9a3420ab35103c18fe2c6a69527bfbf7035"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DE8EBB3A196060",
+      "hash": "811350ef3e971a1a34b2a1bcf37de7fd9918f335179a016f7ea9cc1334127c3a"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DE8EBB39E62DFC",
+      "hash": "5316001ffb87739b41fe9f82804ea5e35e8ef6545687ffef2453120f479702e4"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DE8EBB3A270C9F",
+      "hash": "87627d66c72d43521a69dac489ba1cc2ab241c3281755a9f0e9f0e1a2c9ff3a6"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DE8EBB39FF65FE",
+      "hash": "f101dfe093f1e7462c4157a1db0f121f07883009b5159a1b6bd997cf7f4341a6"
+    }
   },
   "0.2.115": {
     "x86_64_linux_musl": {

tools/tidy.sh

@@ -86,11 +86,6 @@ check_config() {
 check_install() {
   for tool in "$@"; do
     if ! type -P "${tool}" >/dev/null; then
-      if [[ "${tool}" == 'python3' ]]; then
-        if type -P python >/dev/null; then
-          continue
-        fi
-      fi
       error "'${tool}' is required to run this check"
       return 1
     fi
@@ -132,10 +127,6 @@ EOF
   exit 1
 fi
 
-py_suffix=''
-if type -P python3 >/dev/null; then
-  py_suffix=3
-fi
 yq() { uvx yq "$@"; }
 tomlq() { uvx --from yq tomlq "$@"; }
 case "$(uname -s)" in
@@ -700,7 +691,7 @@ elif check_install shellcheck; then
     # Exclude SC2096 due to the way the temporary script is created.
     shellcheck_exclude=SC2096
     info "running \`shellcheck --exclude ${shellcheck_exclude}\` for scripts in \`\$(git ls-files '*Dockerfile*')\`"
-    if check_install jq python3 parse-dockerfile; then
+    if check_install jq parse-dockerfile; then
       shellcheck_for_dockerfile() {
         local text=$1
         local shell=$2
@@ -833,7 +824,7 @@ elif check_install shellcheck; then
     # Exclude SC2096 due to the way the temporary script is created.
     shellcheck_exclude=SC2086,SC2096,SC2129
     info "running \`shellcheck --exclude ${shellcheck_exclude}\` for scripts in .github/workflows/*.yml and **/action.yml"
-    if check_install jq python3 uv; then
+    if check_install jq uv; then
       shellcheck_for_gha() {
         local text=$1
         local shell=$2
@@ -846,16 +837,8 @@ elif check_install shellcheck; then
           *) return ;;
         esac
         text="#!/usr/bin/env ${shell%' {0}'}"$'\n'"${text}"
-        # Use python because sed doesn't support .*?.
-        text=$(
-          "python${py_suffix}" - <<EOF
-import re
-text = re.sub(r"\\\${{.*?}}", "\${__GHA_SYNTAX__}", r'''${text}''')
-print(text)
-EOF
-        )
         case "${ostype}" in
-          windows) text=${text//$'\r'/} ;; # Python print emits \r\n.
+          windows) text=${text//$'\r'/} ;; # Parse error on git bash/msys2 bash.
         esac
         local color=auto
         if [[ -t 1 ]] || [[ -n "${GITHUB_ACTIONS:-}" ]]; then
@@ -989,11 +972,11 @@ if [[ ${#zizmor_targets[@]} -gt 0 ]]; then
     warn "this check is skipped on NetBSD/OpenBSD/Dragonfly/illumos/Solaris due to installing zizmor is hard on these platform"
   elif check_install zizmor; then
     # zizmor can also be used via uvx, but old version will be installed if glibc version is old.
-    # Do not use `zizmor -q .` here because it also attempts to check submodules.
+    # Do not use `zizmor .` here because it also attempts to check submodules.
     IFS=' '
-    info "running \`zizmor -q ${zizmor_targets[*]}\`"
+    info "running \`zizmor -q --pedantic ${zizmor_targets[*]}\`"
     IFS=$'\n\t'
-    zizmor -q "${zizmor_targets[@]}"
+    zizmor -q --pedantic "${zizmor_targets[@]}"
   fi
 fi
 printf '\n'