Add manifest for cargo-nextest

2025-12-27 01:54:13 -05:00 · 2024-06-08 17:38:41 +09:00
parent 762078b2b9
commit 5a6e4c785f
10 changed files with 1153 additions and 57 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,9 @@ Note: In this file, do not use the hard wrap in the middle of a sentence for com

 ## [Unreleased]

+- `cargo-nextest` installation no longer use `cargo-binstall`.
+  This improves security, performance, robustness of installation. See [#487](https://github.com/taiki-e/install-action/issues/487) for more.
+
 ## [2.37.0] - 2024-06-08

 - Support `rclone` ([#511](https://github.com/taiki-e/install-action/pull/511), thanks @jayvdb)
--- a/TOOLS.md
+++ b/TOOLS.md
@@ -23,6 +23,7 @@ If a tool not included in the list below is specified, this action uses [cargo-b
 | [**cargo-machete**](https://github.com/bnjbvr/cargo-machete) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/bnjbvr/cargo-machete/releases) | Linux, macOS, Windows | [MIT](https://github.com/bnjbvr/cargo-machete/blob/main/LICENSE.md) |
 | [**cargo-make**](https://github.com/sagiegurari/cargo-make) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/sagiegurari/cargo-make/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/sagiegurari/cargo-make/blob/master/LICENSE) |
 | [**cargo-minimal-versions**](https://github.com/taiki-e/cargo-minimal-versions) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/taiki-e/cargo-minimal-versions/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/taiki-e/cargo-minimal-versions/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/taiki-e/cargo-minimal-versions/blob/main/LICENSE-MIT) |
+| [**cargo-nextest**](https://github.com/nextest-rs/nextest) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/nextest-rs/nextest/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/nextest-rs/nextest/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/nextest-rs/nextest/blob/main/LICENSE-MIT) |
 | [**cargo-no-dev-deps**](https://github.com/taiki-e/cargo-no-dev-deps) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/taiki-e/cargo-no-dev-deps/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/taiki-e/cargo-no-dev-deps/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/taiki-e/cargo-no-dev-deps/blob/main/LICENSE-MIT) |
 | [**cargo-rdme**](https://github.com/orium/cargo-rdme) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/orium/cargo-rdme/releases) | Linux, macOS, Windows | [MPL-2.0](https://github.com/orium/cargo-rdme/blob/main/LICENSE.md) |
 | [**cargo-semver-checks**](https://github.com/obi1kenobi/cargo-semver-checks) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/obi1kenobi/cargo-semver-checks/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/obi1kenobi/cargo-semver-checks/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/obi1kenobi/cargo-semver-checks/blob/main/LICENSE-MIT) |
@@ -43,7 +44,6 @@ If a tool not included in the list below is specified, this action uses [cargo-b
 | [**just**](https://github.com/casey/just) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/casey/just/releases) | Linux, macOS, Windows | [CC0-1.0](https://github.com/casey/just/blob/master/LICENSE) |
 | [**mdbook**](https://github.com/rust-lang/mdBook) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/rust-lang/mdBook/releases) | Linux, macOS, Windows | [MPL-2.0](https://github.com/rust-lang/mdBook/blob/master/LICENSE) |
 | [**mdbook-linkcheck**](https://github.com/Michael-F-Bryan/mdbook-linkcheck) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/Michael-F-Bryan/mdbook-linkcheck/releases) | Linux, macOS, Windows | [MIT](https://github.com/Michael-F-Bryan/mdbook-linkcheck/blob/master/LICENSE) |
-| [**nextest**](https://nexte.st/) (alias: `cargo-nextest`)| `$CARGO_HOME/bin` | `cargo-binstall` | Linux, macOS, Windows | [Apache-2.0](https://github.com/nextest-rs/nextest/blob/HEAD/LICENSE-APACHE) OR [MIT](https://github.com/nextest-rs/nextest/blob/HEAD/LICENSE-MIT) |
 | [**osv-scanner**](https://github.com/google/osv-scanner) | `/usr/local/bin` | [GitHub Releases](https://github.com/google/osv-scanner/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/google/osv-scanner/blob/main/LICENSE) |
 | [**parse-changelog**](https://github.com/taiki-e/parse-changelog) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/taiki-e/parse-changelog/releases) | Linux, macOS, Windows | [Apache-2.0](https://github.com/taiki-e/parse-changelog/blob/main/LICENSE-APACHE) OR [MIT](https://github.com/taiki-e/parse-changelog/blob/main/LICENSE-MIT) |
 | [**protoc**](https://github.com/protocolbuffers/protobuf) | `/usr/local/bin` | [GitHub Releases](https://github.com/protocolbuffers/protobuf/releases) | Linux, macOS, Windows | [BSD-3-Clause](https://github.com/protocolbuffers/protobuf/blob/HEAD/LICENSE) |
--- a/main.sh
+++ b/main.sh
@@ -197,7 +197,29 @@ read_manifest() {
        exact_version="${version}"
    else
        manifest=$(call_jq -r ".\"${exact_version}\"" "${manifest_dir}/${tool}.json")
+        if [[ "${rust_crate}" != "null" ]]; then
+            # TODO: don't hardcode tool name and use 'immediate_yank_reflection' field in base manifest.
+            case "${tool}" in
+                cargo-nextest | nextest)
+                    crate_info=$(retry curl --proto '=https' --tlsv1.2 -fsSL --retry 10 "https://crates.io/api/v1/crates/${rust_crate}")
+                    while true; do
+                        yanked=$(jq <<<"${crate_info}" -r ".versions[] | select(.num == \"${exact_version}\") | .yanked")
+                        if [[ "${yanked}" != "true" ]]; then
+                            break
+                        fi
+                        previous_stable_version=$(jq <<<"${manifest}" -r '.previous_stable_version')
+                        if [[ "${previous_stable_version}" == "null" ]]; then
+                            break
+                        fi
+                        info "${tool}@${exact_version} is yanked; downgrade to ${previous_stable_version}"
+                        exact_version="${previous_stable_version}"
+                        manifest=$(jq -r ".\"${exact_version}\"" "${manifest_dir}/${tool}.json")
+                    done
+                    ;;
+            esac
+        fi
    fi
+
    case "${host_os}" in
        linux)
            # Static-linked binaries compiled for linux-musl will also work on linux-gnu systems and are
@@ -212,6 +234,21 @@ read_manifest() {
                # TODO: However, a warning may make sense.
                host_platform="${host_arch}_linux_gnu"
                download_info=$(call_jq <<<"${manifest}" -r ".${host_platform}")
+            elif [[ "${host_env}" == "gnu" ]]; then
+                # TODO: don't hardcode tool name and use 'prefer_linux_gnu' field in base manifest.
+                case "${tool}" in
+                    cargo-nextest | nextest)
+                        # TODO: don't hardcode required glibc version
+                        required_glibc_version=2.27
+                        higher_glibc_version=$(sort <<<"${required_glibc_version}"$'\n'"${host_glibc_version}" -Vu | tail -1)
+                        if [[ "${higher_glibc_version}" == "${host_glibc_version}" ]]; then
+                            # musl build of nextest is slow, so use glibc build if host_env is gnu.
+                            # https://github.com/taiki-e/install-action/issues/13
+                            host_platform="${host_arch}_linux_gnu"
+                            download_info=$(jq <<<"${manifest}" -r ".${host_platform}")
+                        fi
+                        ;;
+                esac
            fi
            ;;
        macos | windows)
@@ -408,6 +445,13 @@ exe=""
 case "$(uname -s)" in
    Linux)
        host_os=linux
+        ldd_version=$(ldd --version 2>&1 || true)
+        if grep <<<"${ldd_version}" -q 'musl'; then
+            host_env="musl"
+        else
+            host_env="gnu"
+            host_glibc_version=$(grep <<<"${ldd_version}" -E "GLIBC|GNU libc" | sed "s/.* //g")
+        fi
        if grep -q '^ID_LIKE=' /etc/os-release; then
            base_distro=$(grep '^ID_LIKE=' /etc/os-release | cut -d= -f2)
            case "${base_distro}" in
--- a/manifests/cargo-nextest.json
+++ b/manifests/cargo-nextest.json
--- a/tools/ci/tool-list.sh
+++ b/tools/ci/tool-list.sh
@@ -131,9 +131,9 @@ case "${host_os}" in
 esac
 # cargo-watch/watchexec-cli is supported by cargo-binstall (through quickinstall)
 case "${version}" in
-    latest) tools+=(cargo-watch watchexec-cli nextest) ;;
-    major.minor.patch) tools+=(cargo-watch@8.1.1 watchexec-cli@1.20.5 nextest@0.9.57) ;;
-    major.minor) tools+=(cargo-watch@8.1 watchexec-cli@1.20 nextest@0.9) ;;
+    latest) tools+=(cargo-watch watchexec-cli) ;;
+    major.minor.patch) tools+=(cargo-watch@8.1.1 watchexec-cli@1.20.5) ;;
+    major.minor) tools+=(cargo-watch@8.1 watchexec-cli@1.20) ;;
    major) tools+=(cargo-watch@8 watchexec-cli@1) ;;
    *) exit 1 ;;
 esac
--- a/tools/codegen/base/cargo-nextest.json
+++ b/tools/codegen/base/cargo-nextest.json
@@ -0,0 +1,17 @@
+{
+  "repository": "https://github.com/nextest-rs/nextest",
+  "tag_prefix": "cargo-nextest-",
+  "rust_crate": "${package}",
+  "asset_name": "${package}-${version}-${rust_target}.tar.gz",
+  "prefer_linux_gnu": true,
+  "immediate_yank_reflection": true,
+  "platform": {
+    "x86_64_linux_gnu": {},
+    "x86_64_linux_musl": {},
+    "x86_64_macos": {
+      "asset_name": "${package}-${version}-universal-apple-darwin.tar.gz"
+    },
+    "x86_64_windows": {},
+    "aarch64_linux_gnu": {}
+  }
+}
--- a/tools/codegen/src/lib.rs
+++ b/tools/codegen/src/lib.rs
@@ -180,6 +180,8 @@ pub enum ManifestRef {

 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct Manifest {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub previous_stable_version: Option<Version>,
    #[serde(flatten)]
    pub download_info: BTreeMap<HostPlatform, ManifestDownloadInfo>,
 }
@@ -229,8 +231,15 @@ pub struct BaseManifest {
    pub signing: Option<Signing>,
    #[serde(default)]
    pub broken: Vec<semver::Version>,
-    pub platform: BTreeMap<HostPlatform, BaseManifestPlatformInfo>,
    pub version_range: Option<String>,
+    /// Use glibc build if host_env is gnu.
+    #[serde(default)]
+    pub prefer_linux_gnu: bool,
+    /// Check that the version is yanked not only when updating the manifest,
+    /// but also when running the action.
+    #[serde(default)]
+    pub immediate_yank_reflection: bool,
+    pub platform: BTreeMap<HostPlatform, BaseManifestPlatformInfo>,
 }
 impl BaseManifest {
    /// Validate the manifest.
--- a/tools/codegen/src/main.rs
+++ b/tools/codegen/src/main.rs
@@ -405,15 +405,17 @@ fn main() -> Result<()> {
        }
        // compact manifest
        // TODO: do this before download binaries
-        if download_info.contains_key(&HostPlatform::x86_64_linux_gnu)
-            && download_info.contains_key(&HostPlatform::x86_64_linux_musl)
-        {
-            download_info.remove(&HostPlatform::x86_64_linux_gnu);
-        }
-        if download_info.contains_key(&HostPlatform::aarch64_linux_gnu)
-            && download_info.contains_key(&HostPlatform::aarch64_linux_musl)
-        {
-            download_info.remove(&HostPlatform::aarch64_linux_gnu);
+        if !base_info.prefer_linux_gnu {
+            if download_info.contains_key(&HostPlatform::x86_64_linux_gnu)
+                && download_info.contains_key(&HostPlatform::x86_64_linux_musl)
+            {
+                download_info.remove(&HostPlatform::x86_64_linux_gnu);
+            }
+            if download_info.contains_key(&HostPlatform::aarch64_linux_gnu)
+                && download_info.contains_key(&HostPlatform::aarch64_linux_musl)
+            {
+                download_info.remove(&HostPlatform::aarch64_linux_gnu);
+            }
        }
        if download_info.contains_key(&HostPlatform::x86_64_macos)
            && download_info.contains_key(&HostPlatform::aarch64_macos)
@@ -427,7 +429,22 @@ fn main() -> Result<()> {
        if semver_version.pre.is_empty() {
            semver_versions.insert(semver_version.clone());
        }
-        manifests.map.insert(reverse_semver, ManifestRef::Real(Manifest { download_info }));
+        manifests.map.insert(
+            reverse_semver,
+            ManifestRef::Real(Manifest { previous_stable_version: None, download_info }),
+        );
+    }
+    if base_info.immediate_yank_reflection {
+        let mut prev: Option<&Version> = None;
+        for (Reverse(v), m) in manifests.map.iter_mut().rev() {
+            let ManifestRef::Real(m) = m else { continue };
+            if base_info.rust_crate.is_some() {
+                m.previous_stable_version = prev.cloned();
+            } else {
+                m.previous_stable_version = None;
+            }
+            prev = Some(v);
+        }
    }
    if has_build_metadata {
        eprintln!(
@@ -494,15 +511,17 @@ fn main() -> Result<()> {
        if latest_manifest.download_info.contains_key(&p) {
            continue;
        }
-        if p == HostPlatform::x86_64_linux_gnu
-            && latest_manifest.download_info.contains_key(&HostPlatform::x86_64_linux_musl)
-        {
-            continue;
-        }
-        if p == HostPlatform::aarch64_linux_gnu
-            && latest_manifest.download_info.contains_key(&HostPlatform::aarch64_linux_musl)
-        {
-            continue;
+        if !base_info.prefer_linux_gnu {
+            if p == HostPlatform::x86_64_linux_gnu
+                && latest_manifest.download_info.contains_key(&HostPlatform::x86_64_linux_musl)
+            {
+                continue;
+            }
+            if p == HostPlatform::aarch64_linux_gnu
+                && latest_manifest.download_info.contains_key(&HostPlatform::aarch64_linux_musl)
+            {
+                continue;
+            }
        }
        bail!(
            "platform list in base manifest for {package} contains {p:?}, \
--- a/tools/codegen/src/tools-markdown.rs
+++ b/tools/codegen/src/tools-markdown.rs
@@ -46,31 +46,18 @@ fn main() -> Result<()> {
        fs::read_dir(manifest_dir.clone()).unwrap().map(|r| r.unwrap()).collect();
    paths.sort_by_key(fs_err::DirEntry::path);

-    let mut tools = vec![
-        MarkdownEntry {
-            name: "nextest".to_string(),
-            alias: "cargo-nextest".to_string().into(),
-            website: "https://nexte.st/".to_string(),
-            installed_to: InstalledTo::Cargo,
-            installed_from: InstalledFrom::Binstall,
-            platforms: Platforms::all(),
-            repository: "https://github.com/nextest-rs/nextest".to_string(),
-            license_markdown: "[Apache-2.0](https://github.com/nextest-rs/nextest/blob/HEAD/LICENSE-APACHE) OR [MIT](https://github.com/nextest-rs/nextest/blob/HEAD/LICENSE-MIT)".to_string()
-        },
-        MarkdownEntry {
-            name: "valgrind".to_string(),
-            alias: None,
-            website: "https://valgrind.org/".to_string(),
-            installed_to: InstalledTo::Snap,
-            installed_from: InstalledFrom::Snap,
-            platforms: Platforms {
-                linux: true,
-                ..Default::default()
-            },
-            repository: "https://sourceware.org/git/valgrind.git".to_string(),
-            license_markdown: "[GPL-2.0](https://sourceware.org/git/?p=valgrind.git;a=blob;f=COPYING;hb=HEAD)".to_string()
-        }
-    ];
+    let mut tools = vec![MarkdownEntry {
+        name: "valgrind".to_string(),
+        alias: None,
+        website: "https://valgrind.org/".to_string(),
+        installed_to: InstalledTo::Snap,
+        installed_from: InstalledFrom::Snap,
+        platforms: Platforms { linux: true, ..Default::default() },
+        repository: "https://sourceware.org/git/valgrind.git".to_string(),
+        license_markdown:
+            "[GPL-2.0](https://sourceware.org/git/?p=valgrind.git;a=blob;f=COPYING;hb=HEAD)"
+                .to_string(),
+    }];

    for path in paths {
        let file_name = path.file_name();
@@ -152,7 +139,6 @@ struct MarkdownEntry {

 #[derive(Debug, Eq, PartialEq)]
 enum InstalledFrom {
-    Binstall,
    GitHubRelease,
    Snap,
 }
@@ -163,11 +149,6 @@ struct Platforms {
    macos: bool,
    windows: bool,
 }
-impl Platforms {
-    fn all() -> Self {
-        Self { linux: true, macos: true, windows: true }
-    }
-}

 impl fmt::Display for Platforms {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
@@ -223,7 +204,6 @@ impl fmt::Display for MarkdownEntry {
                let markdown = format!("| [GitHub Releases]({}/releases) ", self.repository);
                f.write_str(&markdown)?;
            }
-            InstalledFrom::Binstall => f.write_str("| `cargo-binstall` ")?,
            InstalledFrom::Snap => {
                let markdown =
                    format!("| [snap](https://snapcraft.io/install/{}/ubuntu) ", self.name);
--- a/tools/publish.sh
+++ b/tools/publish.sh
@@ -102,8 +102,10 @@ tools=()
 for tool in tools/codegen/base/*.json; do
    tools+=("$(basename "${tool%.*}")")
 done
+# Alias
+tools+=(nextest)
 # Not manifest-based
-tools+=(valgrind nextest cargo-nextest)
+tools+=(valgrind)

 if [[ -n "${tags}" ]]; then
    # Create a release commit.