Release 2.10.0

Closes #131

.github/.cspell/project-dictionary.txt

@@ -17,6 +17,7 @@ quickinstall
 rockylinux
 shellcheck
 shfmt
+syft
 udeps
 wasmtime
 watchexec

.github/workflows/ci.yml

@@ -44,19 +44,19 @@ jobs:
         tool:
           # cargo-watch/watchexec-cli is supported by cargo-binstall (through quickinstall)
           # TODO: valgrind installation sometime hangs.
-          - cargo-hack,cargo-llvm-cov,cargo-minimal-versions,cargo-no-dev-deps,parse-changelog,cargo-udeps,cargo-valgrind,cargo-deny,cross,dprint,just,nextest,protoc,shellcheck,shfmt,wasm-pack,wasmtime,mdbook,mdbook-linkcheck,cargo-watch,grcov,watchexec-cli,cargo-tarpaulin,zola
+          - cargo-hack,cargo-llvm-cov,cargo-minimal-versions,cargo-no-dev-deps,parse-changelog,cargo-udeps,cargo-valgrind,cargo-deny,cross,dprint,just,nextest,protoc,shellcheck,shfmt,wasm-pack,wasmtime,mdbook,mdbook-linkcheck,cargo-watch,grcov,watchexec-cli,cargo-tarpaulin,zola,syft
         include:
           # Note: Specifying the version of valgrind and cargo-binstall is not supported.
           - os: ubuntu-20.04
-            tool: cargo-hack@0.5.24,cargo-llvm-cov@0.5.3,cargo-minimal-versions@0.1.8,cargo-no-dev-deps@0.1.0,parse-changelog@0.5.2,cargo-udeps@0.1.35,cargo-valgrind@2.1.0,cargo-deny@0.13.5,cross@0.2.4,dprint@0.34.1,just@1.9.0,nextest@0.9.11,protoc@3.21.12,shellcheck@0.9.0,shfmt@3.6.0,wasm-pack@0.10.3,wasmtime@4.0.0,mdbook@0.4.25,mdbook-linkcheck@0.7.7,cargo-watch@8.1.1,grcov@0.8.13,watchexec-cli@1.20.5,cargo-tarpaulin@0.25.0,zola@0.16.1
+            tool: cargo-hack@0.5.24,cargo-llvm-cov@0.5.3,cargo-minimal-versions@0.1.8,cargo-no-dev-deps@0.1.0,parse-changelog@0.5.2,cargo-udeps@0.1.35,cargo-valgrind@2.1.0,cargo-deny@0.13.5,cross@0.2.4,dprint@0.34.1,just@1.9.0,nextest@0.9.11,protoc@3.21.12,shellcheck@0.9.0,shfmt@3.6.0,wasm-pack@0.10.3,wasmtime@4.0.0,mdbook@0.4.25,mdbook-linkcheck@0.7.7,cargo-watch@8.1.1,grcov@0.8.13,watchexec-cli@1.20.5,cargo-tarpaulin@0.25.0,zola@0.16.1,syft@0.83.0
           - os: ubuntu-20.04
-            tool: cargo-hack@0.5,cargo-llvm-cov@0.5,cargo-minimal-versions@0.1,cargo-no-dev-deps@0.1,parse-changelog@0.5,cargo-udeps@0.1,cargo-valgrind@2.1,cargo-deny@0.13,cross@0.2,dprint@0.34,just@1.9,nextest@0.9,protoc@3.21,shellcheck@0.9,shfmt@3.5,wasm-pack@0.10,wasmtime@6.0,mdbook@0.4,mdbook-linkcheck@0.7,cargo-watch@8.1,grcov@0.8,watchexec-cli@1.20,cargo-tarpaulin@0.25,zola@0.16
+            tool: cargo-hack@0.5,cargo-llvm-cov@0.5,cargo-minimal-versions@0.1,cargo-no-dev-deps@0.1,parse-changelog@0.5,cargo-udeps@0.1,cargo-valgrind@2.1,cargo-deny@0.13,cross@0.2,dprint@0.34,just@1.9,nextest@0.9,protoc@3.21,shellcheck@0.9,shfmt@3.5,wasm-pack@0.10,wasmtime@6.0,mdbook@0.4,mdbook-linkcheck@0.7,cargo-watch@8.1,grcov@0.8,watchexec-cli@1.20,cargo-tarpaulin@0.25,zola@0.16,syft@0.83
           - os: ubuntu-20.04
             tool: cargo-valgrind@2, just@1,protoc@3 , shfmt@3 ,wasmtime@7,cargo-watch@8,watchexec-cli@1
           - os: macos-11
-            tool: cargo-hack,cargo-llvm-cov,cargo-minimal-versions,cargo-no-dev-deps,parse-changelog,cargo-udeps,cargo-valgrind,cargo-deny,cross,dprint,just,nextest,protoc,shellcheck,shfmt,wasm-pack,wasmtime,mdbook,mdbook-linkcheck,cargo-watch,grcov,watchexec-cli,cargo-tarpaulin,zola
+            tool: cargo-hack,cargo-llvm-cov,cargo-minimal-versions,cargo-no-dev-deps,parse-changelog,cargo-udeps,cargo-valgrind,cargo-deny,cross,dprint,just,nextest,protoc,shellcheck,shfmt,wasm-pack,wasmtime,mdbook,mdbook-linkcheck,cargo-watch,grcov,watchexec-cli,cargo-tarpaulin,zola,syft
           - os: windows-2019
-            tool: cargo-hack,cargo-llvm-cov,cargo-minimal-versions,cargo-no-dev-deps,parse-changelog,cargo-udeps,cargo-valgrind,cargo-deny,cross,dprint,just,nextest,protoc,shellcheck,shfmt,wasm-pack,wasmtime,mdbook,mdbook-linkcheck,cargo-watch,grcov,watchexec-cli,cargo-tarpaulin,zola
+            tool: cargo-hack,cargo-llvm-cov,cargo-minimal-versions,cargo-no-dev-deps,parse-changelog,cargo-udeps,cargo-valgrind,cargo-deny,cross,dprint,just,nextest,protoc,shellcheck,shfmt,wasm-pack,wasmtime,mdbook,mdbook-linkcheck,cargo-watch,grcov,watchexec-cli,cargo-tarpaulin,zola,syft
     runs-on: ${{ matrix.os }}
     timeout-minutes: 60
     steps:
@@ -104,25 +104,25 @@ jobs:
           - fedora:latest # glibc 2.36 (as of fedora 37)
         tool:
           # valgrind: installing snap to container is difficult...
-          - cargo-hack,cargo-llvm-cov,cargo-minimal-versions,cargo-no-dev-deps,parse-changelog,cargo-udeps,cargo-valgrind,cargo-deny,cross,dprint,just,nextest,protoc,shellcheck,shfmt,wasm-pack,wasmtime,mdbook,mdbook-linkcheck,cargo-watch,grcov,watchexec-cli,cargo-tarpaulin,zola
+          - cargo-hack,cargo-llvm-cov,cargo-minimal-versions,cargo-no-dev-deps,parse-changelog,cargo-udeps,cargo-valgrind,cargo-deny,cross,dprint,just,nextest,protoc,shellcheck,shfmt,wasm-pack,wasmtime,mdbook,mdbook-linkcheck,cargo-watch,grcov,watchexec-cli,cargo-tarpaulin,zola,syft
         include:
           # glibc < 2.31
           # zola don't provide prebuilt binaries for musl or old glibc host.
           - container: ubuntu:18.04 # glibc 2.27
-            tool: cargo-hack,cargo-llvm-cov,cargo-minimal-versions,cargo-no-dev-deps,parse-changelog,cargo-udeps,cargo-valgrind,cargo-deny,cross,dprint,just,nextest,protoc,shellcheck,shfmt,wasm-pack,wasmtime,mdbook,mdbook-linkcheck,cargo-watch,grcov,watchexec-cli,cargo-tarpaulin
+            tool: cargo-hack,cargo-llvm-cov,cargo-minimal-versions,cargo-no-dev-deps,parse-changelog,cargo-udeps,cargo-valgrind,cargo-deny,cross,dprint,just,nextest,protoc,shellcheck,shfmt,wasm-pack,wasmtime,mdbook,mdbook-linkcheck,cargo-watch,grcov,watchexec-cli,cargo-tarpaulin,syft
           - container: debian:10-slim # glibc 2.28
-            tool: cargo-hack,cargo-llvm-cov,cargo-minimal-versions,cargo-no-dev-deps,parse-changelog,cargo-udeps,cargo-valgrind,cargo-deny,cross,dprint,just,nextest,protoc,shellcheck,shfmt,wasm-pack,wasmtime,mdbook,mdbook-linkcheck,cargo-watch,grcov,watchexec-cli,cargo-tarpaulin
+            tool: cargo-hack,cargo-llvm-cov,cargo-minimal-versions,cargo-no-dev-deps,parse-changelog,cargo-udeps,cargo-valgrind,cargo-deny,cross,dprint,just,nextest,protoc,shellcheck,shfmt,wasm-pack,wasmtime,mdbook,mdbook-linkcheck,cargo-watch,grcov,watchexec-cli,cargo-tarpaulin,syft
           - container: rockylinux:8 # glibc 2.28
-            tool: cargo-hack,cargo-llvm-cov,cargo-minimal-versions,cargo-no-dev-deps,parse-changelog,cargo-udeps,cargo-valgrind,cargo-deny,cross,dprint,just,nextest,protoc,shellcheck,shfmt,wasm-pack,wasmtime,mdbook,mdbook-linkcheck,cargo-watch,grcov,watchexec-cli,cargo-tarpaulin
+            tool: cargo-hack,cargo-llvm-cov,cargo-minimal-versions,cargo-no-dev-deps,parse-changelog,cargo-udeps,cargo-valgrind,cargo-deny,cross,dprint,just,nextest,protoc,shellcheck,shfmt,wasm-pack,wasmtime,mdbook,mdbook-linkcheck,cargo-watch,grcov,watchexec-cli,cargo-tarpaulin,syft
           - container: rockylinux:8-minimal # glibc 2.28
-            tool: cargo-hack,cargo-llvm-cov,cargo-minimal-versions,cargo-no-dev-deps,parse-changelog,cargo-udeps,cargo-valgrind,cargo-deny,cross,dprint,just,nextest,protoc,shellcheck,shfmt,wasm-pack,wasmtime,mdbook,mdbook-linkcheck,cargo-watch,grcov,watchexec-cli,cargo-tarpaulin
+            tool: cargo-hack,cargo-llvm-cov,cargo-minimal-versions,cargo-no-dev-deps,parse-changelog,cargo-udeps,cargo-valgrind,cargo-deny,cross,dprint,just,nextest,protoc,shellcheck,shfmt,wasm-pack,wasmtime,mdbook,mdbook-linkcheck,cargo-watch,grcov,watchexec-cli,cargo-tarpaulin,syft
           # glibc < 2.27 or musl
           - container: centos:7 # glibc 2.17
             # protoc,valgrind,wasmtime,mdbook-linkcheck,cargo-watch,zola don't provide prebuilt binaries for musl or old glibc host.
-            tool: cargo-hack,cargo-llvm-cov,cargo-minimal-versions,cargo-no-dev-deps,parse-changelog,cargo-udeps,cargo-valgrind,cargo-deny,cross,dprint,just,nextest,shellcheck,shfmt,wasm-pack,mdbook,cargo-binstall,grcov,watchexec-cli,cargo-tarpaulin
+            tool: cargo-hack,cargo-llvm-cov,cargo-minimal-versions,cargo-no-dev-deps,parse-changelog,cargo-udeps,cargo-valgrind,cargo-deny,cross,dprint,just,nextest,shellcheck,shfmt,wasm-pack,mdbook,cargo-binstall,grcov,watchexec-cli,cargo-tarpaulin,syft
           - container: alpine:latest # musl 1.2.3 (as of alpine 3.17)
             # protoc,valgrind,wasmtime,mdbook-linkcheck,cargo-watch,zola don't provide prebuilt binaries for musl host.
-            tool: cargo-hack,cargo-llvm-cov,cargo-minimal-versions,cargo-no-dev-deps,parse-changelog,cargo-udeps,cargo-valgrind,cargo-deny,cross,dprint,just,nextest,shellcheck,shfmt,wasm-pack,mdbook,cargo-binstall,grcov,watchexec-cli,cargo-tarpaulin
+            tool: cargo-hack,cargo-llvm-cov,cargo-minimal-versions,cargo-no-dev-deps,parse-changelog,cargo-udeps,cargo-valgrind,cargo-deny,cross,dprint,just,nextest,shellcheck,shfmt,wasm-pack,mdbook,cargo-binstall,grcov,watchexec-cli,cargo-tarpaulin,syft
     runs-on: ubuntu-latest
     timeout-minutes: 60
     container: ${{ matrix.container }}

CHANGELOG.md

@@ -10,6 +10,18 @@ Note: In this file, do not use the hard wrap in the middle of a sentence for com
 
 ## [Unreleased]
 
+## [2.10.0] - 2023-06-10
+
+- Support `syft`. ([#135](https://github.com/taiki-e/install-action/pull/135), thanks @FirelightFlagboy)
+
+## [2.9.4] - 2023-06-08
+
+- Update `parse-changelog@latest` to 0.5.4.
+
+## [2.9.3] - 2023-06-05
+
+- Update `cargo-udeps@latest` to 0.1.40.
+
 ## [2.9.2] - 2023-06-03
 
 - Update `just@latest` to 1.14.0.
@@ -837,7 +849,10 @@ Note: This release is considered a breaking change because installing on version
 
 Initial release
 
-[Unreleased]: https://github.com/taiki-e/install-action/compare/v2.9.2...HEAD
+[Unreleased]: https://github.com/taiki-e/install-action/compare/v2.10.0...HEAD
+[2.10.0]: https://github.com/taiki-e/install-action/compare/v2.9.4...v2.10.0
+[2.9.4]: https://github.com/taiki-e/install-action/compare/v2.9.3...v2.9.4
+[2.9.3]: https://github.com/taiki-e/install-action/compare/v2.9.2...v2.9.3
 [2.9.2]: https://github.com/taiki-e/install-action/compare/v2.9.1...v2.9.2
 [2.9.1]: https://github.com/taiki-e/install-action/compare/v2.9.0...v2.9.1
 [2.9.0]: https://github.com/taiki-e/install-action/compare/v2.8.8...v2.9.0

DEVELOPMENT.md

@@ -14,6 +14,13 @@ See JSON files in `tools/codegen/base` directory for examples of the manifest.
 ./tools/manifest.sh <tool>
 ```
 
+> If you're having problem with github api rate limit, you can use your GITHUB_TOKEN to increase the rate limit.
+> If you have `Github CLI` installed (the command `gh`), you can:
+>
+> ```shell
+> GITHUB_TOKEN=$(gh auth status --show-token 2>&1 | sed -n 's/^.*Token: \(.*\)$/\1/p') ./tools/manifest.sh <tool>
+> ```
+
 3\. Add tool name to test matrix in `.github/workflows/ci.yml`.
 
-4\. Add tool name to table in "Supported tools" section in `README.md`.
+4\. Add tool name to the table in ["Supported tools" section in `README.md`](https://github.com/taiki-e/install-action#supported-tools).

README.md

@@ -9,6 +9,7 @@ GitHub Action for installing development tools (mainly from GitHub Releases).
   - [Inputs](#inputs)
   - [Example workflow](#example-workflow)
 - [Supported tools](#supported-tools)
+  - [Add support for new tool](#add-support-for-new-tool)
 - [Security](#security)
 - [Compatibility](#compatibility)
 - [Related Projects](#related-projects)
@@ -85,14 +86,14 @@ https://spdx.org/licenses
 | [**cargo-hack**](https://github.com/taiki-e/cargo-hack) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/taiki-e/cargo-hack/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/taiki-e/cargo-hack/blob/HEAD/LICENSE-APACHE) OR [MIT](https://github.com/taiki-e/cargo-hack/blob/HEAD/LICENSE-MIT) |
 | [**cargo-llvm-cov**](https://github.com/taiki-e/cargo-llvm-cov) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/taiki-e/cargo-llvm-cov/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/taiki-e/cargo-llvm-cov/blob/HEAD/LICENSE-APACHE) OR [MIT](https://github.com/taiki-e/cargo-llvm-cov/blob/HEAD/LICENSE-MIT) |
 | [**cargo-minimal-versions**](https://github.com/taiki-e/cargo-minimal-versions) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/taiki-e/cargo-minimal-versions/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/taiki-e/cargo-minimal-versions/blob/HEAD/LICENSE-APACHE) OR [MIT](https://github.com/taiki-e/cargo-minimal-versions/blob/HEAD/LICENSE-MIT) |
-| [**cargo-tarpaulin**](https://github.com/xd009642/tarpaulin) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/xd009642/tarpaulin/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/xd009642/tarpaulin/blob/develop/LICENSE-APACHE) OR [MIT](https://github.com/xd009642/tarpaulin/blob/develop/LICENSE-MIT) |
 | [**cargo-no-dev-deps**](https://github.com/taiki-e/cargo-no-dev-deps) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/taiki-e/cargo-no-dev-deps/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/taiki-e/cargo-no-dev-deps/blob/HEAD/LICENSE-APACHE) OR [MIT](https://github.com/taiki-e/cargo-no-dev-deps/blob/HEAD/LICENSE-MIT) |
+| [**cargo-tarpaulin**](https://github.com/xd009642/tarpaulin) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/xd009642/tarpaulin/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/xd009642/tarpaulin/blob/develop/LICENSE-APACHE) OR [MIT](https://github.com/xd009642/tarpaulin/blob/develop/LICENSE-MIT) |
 | [**cargo-udeps**](https://github.com/est31/cargo-udeps) | `$CARGO_HOME/bin` | [GitHub Release](https://github.com/est31/cargo-udeps/releases) | Linux, macOS, Windows | [Apache-2.0 OR MIT](https://github.com/est31/cargo-udeps/blob/HEAD/LICENSE) |
 | [**cargo-valgrind**](https://github.com/jfrimmel/cargo-valgrind) | `$CARGO_HOME/bin` | [GitHub Release](https://github.com/jfrimmel/cargo-valgrind/releases) | Linux, macOS, Windows | [MIT](https://github.com/jfrimmel/cargo-valgrind/blob/HEAD/LICENSE-MIT) or [Apache-2.0](https://github.com/jfrimmel/cargo-valgrind/blob/HEAD/LICENSE-APACHE) |
 | [**cross**](https://github.com/cross-rs/cross) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/cross-rs/cross/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/cross-rs/cross/blob/HEAD/LICENSE-APACHE) OR [MIT](https://github.com/cross-rs/cross/blob/HEAD/LICENSE-MIT) |
+| [**dprint**](https://github.com/dprint/dprint) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/dprint/dprint/releases) | Linux, macOS, Windows | [MIT](https://github.com/dprint/dprint/blob/HEAD/LICENSE) |
 | [**grcov**](https://github.com/mozilla/grcov) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/mozilla/grcov/releases) | Linux, macOS, Windows | [MPL-2.0](https://github.com/mozilla/grcov/blob/HEAD/LICENSE-MPL-2.0) |
 | [**just**](https://github.com/casey/just) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/casey/just/releases) | Linux, macOS, Windows | [CC0-1.0](https://github.com/casey/just/blob/HEAD/LICENSE) |
-| [**dprint**](https://github.com/dprint/dprint) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/dprint/dprint/releases) | Linux, macOS, Windows | [MIT](https://github.com/dprint/dprint/blob/HEAD/LICENSE) |
 | [**mdbook-linkcheck**](https://github.com/Michael-F-Bryan/mdbook-linkcheck) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/Michael-F-Bryan/mdbook-linkcheck/releases) | Linux, macOS, Windows | [MIT](https://github.com/Michael-F-Bryan/mdbook-linkcheck/blob/HEAD/LICENSE) |
 | [**mdbook**](https://github.com/rust-lang/mdBook) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/rust-lang/mdBook/releases) | Linux, macOS, Windows | [MPL-2.0](https://github.com/rust-lang/mdBook/blob/HEAD/LICENSE) |
 | [**nextest**](https://github.com/nextest-rs/nextest) (alias: `cargo-nextest`) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/nextest-rs/nextest/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/nextest-rs/nextest/blob/HEAD/LICENSE-APACHE) OR [MIT](https://github.com/nextest-rs/nextest/blob/HEAD/LICENSE-MIT) |
@@ -100,6 +101,7 @@ https://spdx.org/licenses
 | [**protoc**](https://github.com/protocolbuffers/protobuf) | `$HOME/.install-action/bin` | [GitHub Releases](https://github.com/protocolbuffers/protobuf/releases) | Linux, macOS, Windows | [BSD-3-Clause](https://github.com/protocolbuffers/protobuf/blob/HEAD/LICENSE) |
 | [**shellcheck**](https://www.shellcheck.net) | `/usr/local/bin` | [GitHub Releases](https://github.com/koalaman/shellcheck/releases) | Linux, macOS, Windows | [GPL-3.0-or-later](https://github.com/koalaman/shellcheck/blob/HEAD/LICENSE) |
 | [**shfmt**](https://github.com/mvdan/sh) | `/usr/local/bin` | [GitHub Releases](https://github.com/mvdan/sh/releases) | Linux, macOS, Windows | [BSD-3-Clause](https://github.com/mvdan/sh/blob/HEAD/LICENSE) |
+| [**syft**](https://github.com/anchore/syft) | `/usr/local/bin` | [Github Releases](https://github.com/anchore/syft/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/anchore/syft/blob/main/LICENSE) |
 | [**valgrind**](https://valgrind.org) | `/snap/bin` | [snap](https://snapcraft.io/install/valgrind/ubuntu) | Linux | [GPL-2.0-or-later](https://valgrind.org/docs/manual/license.gpl.html) |
 | [**wasm-pack**](https://github.com/rustwasm/wasm-pack) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/rustwasm/wasm-pack/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/rustwasm/wasm-pack/blob/HEAD/LICENSE-APACHE) OR [MIT](https://github.com/rustwasm/wasm-pack/blob/HEAD/LICENSE-MIT) |
 | [**wasmtime**](https://github.com/bytecodealliance/wasmtime) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/bytecodealliance/wasmtime/releases) | Linux, macOS, Windows | [Apache-2.0 WITH LLVM-exception](https://github.com/bytecodealliance/wasmtime/blob/HEAD/LICENSE) |
@@ -109,7 +111,11 @@ If `$CARGO_HOME/bin` is not available, Rust-related binaries will be installed t
 If `$HOME/.cargo/bin` is not available, Rust-related binaries will be installed to `/usr/local/bin`.<br>
 If `/usr/local/bin` is not available, binaries will be installed to `$HOME/.install-action/bin`.<br>
 
-If a tool not included in the list above is specified, this action uses [cargo-binstall] as a fallback.
+**If a tool not included in the list above is specified, this action uses [cargo-binstall] as a fallback.**
+
+### Add support for new tool
+
+See the [development guide](DEVELOPMENT.md) for how to add support for new tool.
 
 ## Security
 

ci/manifest.sh

@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+# SPDX-License-Identifier: Apache-2.0 OR MIT
 set -euxo pipefail
 IFS=$'\n\t'
 cd "$(dirname "$0")"/..

main.sh

@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+# SPDX-License-Identifier: Apache-2.0 OR MIT
 set -euo pipefail
 IFS=$'\n\t'
 
@@ -397,7 +398,7 @@ case "$(uname -m)" in
         # https://github.com/cross-rs/cross/pull/1018
         # Does it seem only armv7l is supported?
         # https://github.com/actions/runner/blob/caec043085990710070108f375cd0aeab45e1017/src/Misc/externals.sh#L174
-        bail "32-bit ARM runner is not supported yet by this action"
+        bail "32-bit ARM runner is not supported yet by this action; if you need support for this platform, please submit an issue at <https://github.com/taiki-e/install-action>"
         ;;
     # GitHub Actions Runner supports Linux (x86_64, aarch64, arm), Windows (x86_64, aarch64),
     # and macOS (x86_64, aarch64).
@@ -441,7 +442,7 @@ for tool in "${tools[@]}"; do
             if [[ ! "${version}" =~ ^([1-9][0-9]*(\.[0-9]+(\.[0-9]+)?)?|0\.[1-9][0-9]*(\.[0-9]+)?|^0\.0\.[0-9]+)(-[0-9A-Za-z\.-]+)?(\+[0-9A-Za-z\.-]+)?$|^latest$ ]]; then
                 bail "install-action does not support semver operators: '${version}'"
             fi
-            bail "install-action v2 does not support semver pre-release and build-metadata; please submit an issue if you need these supports again: '${version}'"
+            bail "install-action v2 does not support semver pre-release and build-metadata: '${version}'; if you need these supports again, please submit an issue at <https://github.com/taiki-e/install-action>"
         fi
     else
         version="latest"

manifests/cargo-udeps.json

@@ -30,10 +30,30 @@
     }
   },
   "latest": {
-    "version": "0.1.39"
+    "version": "0.1.40"
   },
   "0.1": {
-    "version": "0.1.39"
+    "version": "0.1.40"
+  },
+  "0.1.40": {
+    "x86_64_linux_musl": {
+      "checksum": "6bb8bc63de21e47afb44e9b1fcc2f5444120a0658bfe7b2b64a0eb575667ee59"
+    },
+    "x86_64_macos": {
+      "checksum": "39ddc8f18f51d429f0a5adc0bdaa416532ba70e7dfd3d5200c5fcf8f981ea656"
+    },
+    "x86_64_windows": {
+      "checksum": "d532011810db834c7a3dfc580a6754a0204ffd146e0b29a62c508f6d89544d9f"
+    },
+    "aarch64_linux_musl": {
+      "checksum": "cebdbfee26548375c3f2000b6fae46ba80bff7cbfa33c8919525e3923b004f1e"
+    },
+    "aarch64_macos": {
+      "checksum": "6a022039c59cf273b9764bd74e991f423e03e80ddd0eaa25648207b622ab3547"
+    },
+    "aarch64_windows": {
+      "checksum": "6b29f3a9b0b710d9f9a2544f7bd101997845eff37836fa50edaa92fa3e5a6ad7"
+    }
   },
   "0.1.39": {
     "x86_64_linux_musl": {

manifests/parse-changelog.json

@@ -23,10 +23,30 @@
     }
   },
   "latest": {
-    "version": "0.5.3"
+    "version": "0.5.4"
   },
   "0.5": {
-    "version": "0.5.3"
+    "version": "0.5.4"
+  },
+  "0.5.4": {
+    "x86_64_linux_musl": {
+      "checksum": "b2a430ebd0d23a3608258446d9f93162ca324fd2ca691ca3baa11625c9d7fec3"
+    },
+    "x86_64_macos": {
+      "checksum": "4476f9ce9de07ddba76f77e6260e3cbece3801654882c8161694d742f8f01a59"
+    },
+    "x86_64_windows": {
+      "checksum": "6cd753b60b3385e2fd3aef79bc9a6c954f01737e2380bdc06b2c55ef9d4b8c79"
+    },
+    "aarch64_linux_musl": {
+      "checksum": "73f85fdda5937ac3ee0fd3a4385998cc6a640736b3e73923b0afd061abb575be"
+    },
+    "aarch64_macos": {
+      "checksum": "164936f970d8ab870aa3355411db736994dbb86019630bf2818d0958d30768b5"
+    },
+    "aarch64_windows": {
+      "checksum": "b7c1c92c83fce15746c1d289fbf14b31b3f43a043e28b25638ae8ed7b1005ea0"
+    }
   },
   "0.5.3": {
     "x86_64_linux_musl": {

manifests/syft.json

@@ -0,0 +1,52 @@
+{
+  "template": {
+    "x86_64_linux_musl": {
+      "url": "https://github.com/anchore/syft/releases/download/v${version}/syft_${version}_linux_amd64.tar.gz",
+      "bin_dir": "/usr/local/bin",
+      "bin": "syft"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/anchore/syft/releases/download/v${version}/syft_${version}_darwin_amd64.tar.gz",
+      "bin_dir": "/usr/local/bin",
+      "bin": "syft"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/anchore/syft/releases/download/v${version}/syft_${version}_windows_amd64.zip",
+      "bin_dir": "/usr/local/bin",
+      "bin": "syft.exe"
+    },
+    "aarch64_linux_musl": {
+      "url": "https://github.com/anchore/syft/releases/download/v${version}/syft_${version}_linux_arm64.tar.gz",
+      "bin_dir": "/usr/local/bin",
+      "bin": "syft"
+    },
+    "aarch64_macos": {
+      "url": "https://github.com/anchore/syft/releases/download/v${version}/syft_${version}_darwin_arm64.tar.gz",
+      "bin_dir": "/usr/local/bin",
+      "bin": "syft"
+    }
+  },
+  "latest": {
+    "version": "0.83.0"
+  },
+  "0.83": {
+    "version": "0.83.0"
+  },
+  "0.83.0": {
+    "x86_64_linux_musl": {
+      "checksum": "694e97a454327403fb440544c41fefd83d37f88f43c4f9ae0b0d67a3562bd25c"
+    },
+    "x86_64_macos": {
+      "checksum": "211f34f2e52e842d3248bc3a72c07e534d0d7a8e40babaa7a2034a41a077b70e"
+    },
+    "x86_64_windows": {
+      "checksum": "9131f458fdbbc88fe1bd8df666721ecb95ff751d0ca3e2cffecfd5e021c65e97"
+    },
+    "aarch64_linux_musl": {
+      "checksum": "388fbea52598e44f8529e3432555c53e6e161211a83020d2b749c5d160baf593"
+    },
+    "aarch64_macos": {
+      "checksum": "4b93cf316aa30bddb53d2dcd82f4c9d0353b337677cbdf8a470749f9e98eec82"
+    }
+  }
+}

tools/.tidy-check-license-headers

@@ -0,0 +1 @@
+git ls-files '*.sh' # TODO: check more files

tools/codegen/base/syft.json

@@ -0,0 +1,24 @@
+{
+  "repository": "https://github.com/anchore/syft",
+  "tag_prefix": "v",
+  "bin_dir": "/usr/local/bin",
+  "bin": "${package}${exe}",
+  "version_range": ">= 0.83.0",
+  "platform": {
+    "x86_64_macos": {
+      "asset_name": "${package}_${version}_darwin_amd64.tar.gz"
+    },
+    "aarch64_macos": {
+      "asset_name": "${package}_${version}_darwin_arm64.tar.gz"
+    },
+    "x86_64_windows": {
+      "asset_name": "${package}_${version}_windows_amd64.zip"
+    },
+    "x86_64_linux_musl": {
+      "asset_name": "${package}_${version}_linux_amd64.tar.gz"
+    },
+    "aarch64_linux_musl": {
+      "asset_name": "${package}_${version}_linux_arm64.tar.gz"
+    }
+  }
+}

tools/manifest.sh

@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+# SPDX-License-Identifier: Apache-2.0 OR MIT
 set -euo pipefail
 IFS=$'\n\t'
 cd "$(dirname "$0")"/..

tools/publish.sh

@@ -1,10 +1,11 @@
 #!/usr/bin/env bash
+# SPDX-License-Identifier: Apache-2.0 OR MIT
 set -euo pipefail
 IFS=$'\n\t'
 cd "$(dirname "$0")"/..
 
 # shellcheck disable=SC2154
-trap 's=$?; echo >&2 "$0: Error on line "${LINENO}": ${BASH_COMMAND}"; exit ${s}' ERR
+trap 's=$?; echo >&2 "$0: error on line "${LINENO}": ${BASH_COMMAND}"; exit ${s}' ERR
 
 # Publish a new release.
 #
@@ -98,7 +99,7 @@ for tool in tools/codegen/base/*.json; do
 done
 # Aliases
 tools+=(nextest)
-# Not manifest-base
+# Not manifest-based
 tools+=(valgrind)
 
 (

tools/tidy.sh

@@ -6,7 +6,7 @@ IFS=$'\n\t'
 cd "$(dirname "$0")"/..
 
 # shellcheck disable=SC2154
-trap 's=$?; echo >&2 "$0: Error on line "${LINENO}": ${BASH_COMMAND}"; exit ${s}' ERR
+trap 's=$?; echo >&2 "$0: error on line "${LINENO}": ${BASH_COMMAND}"; exit ${s}' ERR
 
 # USAGE:
 #    ./tools/tidy.sh
@@ -201,6 +201,44 @@ else
     warn "'shellcheck' is not installed"
 fi
 
+# License check
+# TODO: This check is still experimental and does not track all files that should be tracked.
+if [[ -f tools/.tidy-check-license-headers ]]; then
+    info "checking license headers (experimental)"
+    failed_files=''
+    for p in $(eval $(<tools/.tidy-check-license-headers)); do
+        # TODO: More file types?
+        case "$(basename "${p}")" in
+            *.sh) prefix=("# ") ;;
+            *.rs | *.c | *.h | *.cpp | *.hpp | *.s | *.S) prefix=("// " "/* ") ;;
+            *.ld | *.x) prefix=("/* ") ;;
+            *) error "unrecognized file type: ${p}" ;;
+        esac
+        # TODO: The exact line number is not actually important; it is important
+        # that it be part of the top-level comments of the file.
+        line="1"
+        case "${p}" in
+            *.sh) line="2" ;; # shebang
+        esac
+        header_found=''
+        for pre in "${prefix[@]}"; do
+            if [[ "$(grep -E -n "${pre}SPDX-License-Identifier: " "${p}")" == "${line}:${pre}SPDX-License-Identifier: "* ]]; then
+                header_found='1'
+                continue
+            fi
+        done
+        if [[ -z "${header_found}" ]]; then
+            failed_files+="${p}:${line}"$'\n'
+        fi
+    done
+    if [[ -n "${failed_files}" ]]; then
+        error "license-check failed: please add SPDX-License-Identifier to the following files"
+        echo "======================================="
+        echo -n "${failed_files}"
+        echo "======================================="
+    fi
+fi
+
 # Spell check (if config exists)
 if [[ -f .cspell.json ]]; then
     info "spell checking"