Publish binary from main instead of discarding (#618 )

chore: improve findutils maintenance path (#687 )
fix: avoid panic on -fprintf with missing arguments (#698 )
2026-06-10 15:48:30 -07:00 · 2026-06-04 22:34:18 +02:00 · 2026-06-04 21:28:34 +02:00 · 2026-06-05 02:41:58 +08:00 · 2026-06-04 20:31:54 +02:00 · 2026-06-01 08:32:49 +02:00
45 changed files with 4852 additions and 2774 deletions
@@ -0,0 +1,15 @@
+name: Security audit
+
+on:
+  schedule:
+    - cron: "0 0 * * *"
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: rustsec/audit-check@v2
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
@@ -2,6 +2,9 @@ on: [push, pull_request]

 name: Basic CI

+env:
+  CARGO_INCREMENTAL: "0"
+
 jobs:
  check:
    name: cargo check
@@ -10,13 +13,7 @@ jobs:
      matrix:
        os: [ubuntu-latest, macOS-latest, windows-latest]
    steps:
-      - uses: actions/checkout@v4
-      - name: Install `rust` toolchain
-        run: |
-          ## Install `rust` toolchain
-          rustup toolchain install stable --no-self-update -c rustfmt --profile minimal
-          rustup default stable
-
+      - uses: actions/checkout@v6
      # For bindgen: https://github.com/rust-lang/rust-bindgen/issues/1797
      - uses: KyleMayes/install-llvm-action@v2
        if: matrix.os == 'windows-latest'
@@ -37,13 +34,7 @@ jobs:
      matrix:
        os: [ubuntu-latest, macOS-latest, windows-latest]
    steps:
-      - uses: actions/checkout@v4
-      - name: Install `rust` toolchain
-        run: |
-          ## Install `rust` toolchain
-          rustup toolchain install stable --no-self-update -c rustfmt --profile minimal
-          rustup default stable
-
+      - uses: actions/checkout@v6
      # For bindgen: https://github.com/rust-lang/rust-bindgen/issues/1797
      - uses: KyleMayes/install-llvm-action@v2
        if: matrix.os == 'windows-latest'
@@ -61,14 +52,7 @@ jobs:
    name: cargo fmt --all -- --check
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v4
-      - name: Install `rust` toolchain
-        run: |
-          ## Install `rust` toolchain
-          rustup toolchain install stable --no-self-update -c rustfmt --profile minimal
-          rustup default stable
-
-      - run: rustup component add rustfmt
+      - uses: actions/checkout@v6
      - name: cargo fmt
        run: |
          cargo fmt --all -- --check
@@ -77,15 +61,8 @@ jobs:
    name: cargo clippy -- -D warnings
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v4
-      - name: Install `rust` toolchain
-        run: |
-          ## Install `rust` toolchain
-          rustup toolchain install stable --no-self-update -c rustfmt --profile minimal
-          rustup default stable
-      - run: rustup component add clippy
-      - name: cargo clippy
-        run: |
+      - uses: actions/checkout@v6
+      - run: |
          cargo clippy --all-targets -- -D warnings

  grcov:
@@ -95,59 +72,29 @@ jobs:
      matrix:
        os:
          - ubuntu-latest
-        toolchain:
-          - nightly
        cargo_flags:
          - "--all-features"
    steps:
      - name: Checkout source code
-        uses: actions/checkout@v4
-
-      - name: Install `rust` toolchain
-        run: |
-          ## Install `rust` toolchain
-          rustup toolchain install nightly --no-self-update -c rustfmt --profile minimal
-          rustup default nightly
-
-      - name: "`grcov` ~ install"
-        run: cargo install grcov
-
-      - name: cargo test
-        run: |
-          cargo test --all --no-fail-fast ${{ matrix.cargo_flags }}
+        uses: actions/checkout@v6
+      - name: Install cargo-llvm-cov
+        uses: taiki-e/install-action@cargo-llvm-cov
+      - name: Generate code coverage
        env:
-          CARGO_INCREMENTAL: "0"
-          RUSTFLAGS: "-Zprofile -Ccodegen-units=1 -Copt-level=0 -Clink-dead-code -Coverflow-checks=off -Zpanic_abort_tests -Cpanic=abort -Cdebug-assertions=off"
-          RUSTDOCFLAGS: "-Zprofile -Ccodegen-units=1 -Copt-level=0 -Clink-dead-code -Coverflow-checks=off -Zpanic_abort_tests -Cpanic=abort -Cdebug-assertions=off"
-
-      - name: Generate coverage data
-        id: grcov
+          RUSTC_BOOTSTRAP: 1
        run: |
-          grcov target/debug/ \
-              --branch \
-              --llvm \
-              --source-dir . \
-              --output-path lcov.info \
-              --ignore-not-existing \
-              --excl-line "#\\[derive\\(" \
-              --excl-br-line "#\\[derive\\(" \
-              --excl-start "#\\[cfg\\(test\\)\\]" \
-              --excl-br-start "#\\[cfg\\(test\\)\\]" \
-              --commit-sha ${{ github.sha }} \
-              --service-job-id ${{ github.job }} \
-              --service-name "GitHub Actions" \
-              --service-number ${{ github.run_id }}
+          cargo llvm-cov --all-features --lcov --branch --output-path lcov.info
+
      - name: Upload coverage as artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          name: lcov.info
-          # path: ${{ steps.grcov.outputs.report }}
          path: lcov.info

      - name: Upload coverage to codecov.io
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@v6
        with:
-          token: ${{ secrets.CODECOV_TOKEN }}
-          # file: ${{ steps.grcov.outputs.report }}
-          file: lcov.info
+          files: lcov.info
          fail_ci_if_error: true
+        env:
+          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
@@ -18,7 +18,7 @@ jobs:

    steps:
      - name: List Annotations
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
        with:
          script: |
            let artifacts = await github.rest.actions.listWorkflowRunArtifacts({
@@ -46,7 +46,7 @@ jobs:
      - run: unzip comment.zip

      - name: Comment on PR
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
@@ -1,33 +1,41 @@
 on: [push, pull_request]

 name: External-testsuites
-
+env:
+  CARGO_INCREMENTAL: "0"
 jobs:
  gnu-tests:
+    permissions:
+      actions: read
+      contents: write # Publish binaries instead of discarding
+
    name: Run GNU findutils tests
    runs-on: ubuntu-latest
    steps:
      - name: Checkout findutils
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
          path: findutils
      - name: Checkout GNU findutils
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
          repository: gnu-mirror-unofficial/findutils
          path: findutils.gnu
          ref: 5768a03ddfb5e18b1682e339d6cdd24ff721c510
-          submodules: true
-      - name: Install `rust` toolchain
+          submodules: false
+
+      - name: Override submodule URL and initialize submodules
+        # Use github instead of upstream git server
        run: |
-          ## Install `rust` toolchain
-          rustup toolchain install stable --no-self-update -c rustfmt --profile minimal
-          rustup default stable
+          git submodule sync --recursive
+          git config submodule.gnulib.url https://github.com/coreutils/gnulib.git
+          git submodule update --init --recursive --depth 1
+        working-directory: findutils.gnu
      - name: Install dependencies
        shell: bash
        run: |
          # Enable sources & install dependencies
-          sudo find /etc/apt/sources.list* -type f -exec sed -i 'p; s/^deb /deb-src /' '{}' +
+          sudo sed -i 's/^Types: deb$/Types: deb deb-src/' /etc/apt/sources.list.d/ubuntu.sources
          sudo apt-get update
          sudo apt-get build-dep findutils
      - name: Run GNU tests
@@ -35,11 +43,27 @@ jobs:
        run: |
          cd findutils
          bash util/build-gnu.sh ||:
+          install --strip -Dm755 target/release/{find,xargs} -t findutils-x86_64-unknown-linux-gnu
+          ZSTD_CLEVEL=19 tar --zstd -caf ../findutils-x86_64-unknown-linux-gnu.tar.zst findutils-x86_64-unknown-linux-gnu
+      - name: Publish latest commit
+        uses: softprops/action-gh-release@v2
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        with:
+          tag_name: latest-commit
+          body: |
+            commit: ${{ github.sha }}
+          draft: false
+          prerelease: true
+          files: |
+            findutils-x86_64-unknown-linux-gnu.tar.zst
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Extract testing info
        shell: bash
        run: |
+
      - name: Upload gnu-test-report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          name: gnu-test-report
          path: |
@@ -47,28 +71,47 @@ jobs:
            findutils.gnu/xargs/testsuite/*.log
            findutils.gnu/tests/**/*.log
      - name: Upload gnu-result
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          name: gnu-result
          path: gnu-result.json
-      - name: Download the result
-        uses: dawidd6/action-download-artifact@v6
+      - name: Download artifacts (gnu-result and gnu-test-report)
+        uses: actions/github-script@v9
        with:
-          workflow: compat.yml
-          workflow_conclusion: completed
-          name: gnu-result
-          repo: uutils/findutils
-          branch: main
-          path: dl
-      - name: Download the log
-        uses: dawidd6/action-download-artifact@v6
-        with:
-          workflow: compat.yml
-          workflow_conclusion: completed
-          name: gnu-test-report
-          repo: uutils/findutils
-          branch: main
-          path: dl
+          script: |
+            let fs = require('fs');
+            fs.mkdirSync('${{ github.workspace }}/dl', { recursive: true });
+
+            async function downloadArtifact(artifactName) {
+              // List all artifacts from the workflow run
+              let artifacts = await github.rest.actions.listWorkflowRunArtifacts({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                run_id: ${{ github.run_id }},
+              });
+
+              // Find the specified artifact
+              let matchArtifact = artifacts.data.artifacts.find((artifact) => artifact.name === artifactName);
+              if (!matchArtifact) {
+                throw new Error(`Artifact "${artifactName}" not found.`);
+              }
+
+              // Download the artifact
+              let download = await github.rest.actions.downloadArtifact({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                artifact_id: matchArtifact.id,
+                archive_format: 'zip',
+              });
+
+              // Save the artifact to a file
+              fs.writeFileSync(`${{ github.workspace }}/dl/${artifactName}.zip`, Buffer.from(download.data));
+            }
+
+            // Download the required artifacts
+            await downloadArtifact("gnu-result");
+            await downloadArtifact("gnu-test-report");
+
      - name: Compare failing tests against master
        shell: bash
        run: |
@@ -76,6 +119,8 @@ jobs:
      - name: Compare against main results
        shell: bash
        run: |
+          unzip dl/gnu-result.zip -d dl/
+          unzip dl/gnu-test-report.zip -d dl/
          mv dl/gnu-result.json latest-gnu-result.json
          python findutils/util/compare_gnu_result.py

@@ -84,60 +129,74 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout findutils
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
          path: findutils
      - name: Checkout BFS
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
          repository: tavianator/bfs
          path: bfs
          ref: "4.0"
-      - name: Install `rust` toolchain
-        run: |
-          ## Install `rust` toolchain
-          rustup toolchain install stable --no-self-update -c rustfmt --profile minimal
-          rustup default stable
      - name: Install dependencies
        shell: bash
        run: |
          # Enable sources & install dependencies
-          sudo find /etc/apt/sources.list* -type f -exec sed -i 'p; s/^deb /deb-src /' '{}' +
+          sudo sed -i 's/^Types: deb$/Types: deb deb-src/' /etc/apt/sources.list.d/ubuntu.sources
          sudo apt-get update
          sudo apt-get build-dep bfs
      - name: Run BFS tests
        shell: bash
        run: |
          cd findutils
+          export CARGO_INCREMENTAL=0
          bash util/build-bfs.sh ||:
      - name: Upload bfs-test-report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          name: bfs-test-report
          path: bfs/tests.log
      - name: Upload bfs-result
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          name: bfs-result
          path: bfs-result.json
-      - name: Download the result
-        uses: dawidd6/action-download-artifact@v6
+      - name: Download artifacts (gnu-result and bfs-test-report)
+        uses: actions/github-script@v9
        with:
-          workflow: compat.yml
-          workflow_conclusion: completed
-          name: bfs-result
-          repo: uutils/findutils
-          branch: main
-          path: dl
-      - name: Download the log
-        uses: dawidd6/action-download-artifact@v6
-        with:
-          workflow: compat.yml
-          workflow_conclusion: completed
-          name: bfs-test-report
-          repo: uutils/findutils
-          branch: main
-          path: dl
+          script: |
+            let fs = require('fs');
+            fs.mkdirSync('${{ github.workspace }}/dl', { recursive: true });
+
+            async function downloadArtifact(artifactName) {
+              // List all artifacts from the workflow run
+              let artifacts = await github.rest.actions.listWorkflowRunArtifacts({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                run_id: ${{ github.run_id }},
+              });
+
+              // Find the specified artifact
+              let matchArtifact = artifacts.data.artifacts.find((artifact) => artifact.name === artifactName);
+              if (!matchArtifact) {
+                throw new Error(`Artifact "${artifactName}" not found.`);
+              }
+
+              // Download the artifact
+              let download = await github.rest.actions.downloadArtifact({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                artifact_id: matchArtifact.id,
+                archive_format: 'zip',
+              });
+
+              // Save the artifact to a file
+              fs.writeFileSync(`${{ github.workspace }}/dl/${artifactName}.zip`, Buffer.from(download.data));
+            }
+
+            // Download the required artifacts
+            await downloadArtifact("bfs-result");
+            await downloadArtifact("bfs-test-report");
      - name: Compare failing tests against main
        shell: bash
        run: |
@@ -145,6 +204,8 @@ jobs:
      - name: Compare against main results
        shell: bash
        run: |
+          unzip dl/bfs-result.zip -d dl/
+          unzip dl/bfs-test-report.zip -d dl/
          mv dl/bfs-result.json latest-bfs-result.json
          python findutils/util/compare_bfs_result.py

@@ -156,8 +217,8 @@ jobs:

    steps:
      - name: List Annotations
-        uses: actions/github-script@v7
-        
+        uses: actions/github-script@v9
+
        with:
          script: |
            let runs = await github.rest.checks.listForRef({
@@ -177,7 +238,7 @@ jobs:
                repo: context.repo.repo,
                check_run_id: result.id
              });
-              
+
              run.data.forEach(data => {
                annotations.data.push({
                  run: result.name,
@@ -187,14 +248,14 @@ jobs:
            }

            // Remove duplicate items.
-            annotations.data = annotations.data.filter((value, index, self) => 
+            annotations.data = annotations.data.filter((value, index, self) =>
              self.findIndex(v => v.annotation.message === value.annotation.message) === index);

            let fs = require('fs');
            fs.writeFileSync('${{ github.workspace }}/annotations.json', JSON.stringify(annotations));

      - name: Upload annotations
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          name: comment
-          path: annotations.json
+          path: annotations.json
@@ -1,20 +1,21 @@
-# Copyright 2022-2023, axodotdev
+# This file was autogenerated by dist: https://opensource.axo.dev/cargo-dist/
+#
+# Copyright 2022-2024, axodotdev
 # SPDX-License-Identifier: MIT or Apache-2.0
 #
 # CI that:
 #
 # * checks for a Git Tag that looks like a release
-# * builds artifacts with cargo-dist (archives, installers, hashes)
+# * builds artifacts with dist (archives, installers, hashes)
 # * uploads those artifacts to temporary workflow zip
-# * on success, uploads the artifacts to a Github Release
+# * on success, uploads the artifacts to a GitHub Release
 #
-# Note that the Github Release will be created with a generated
+# Note that the GitHub Release will be created with a generated
 # title/body based on your changelogs.

 name: Release
-
 permissions:
-  contents: write
+  "contents": "write"

 # This task will run whenever you push a git tag that looks like a version
 # like "1.0.0", "v0.1.0-prerelease.1", "my-app/0.1.0", "releases/v1.0.0", etc.
@@ -23,30 +24,30 @@ permissions:
 # must be a Cargo-style SemVer Version (must have at least major.minor.patch).
 #
 # If PACKAGE_NAME is specified, then the announcement will be for that
-# package (erroring out if it doesn't have the given version or isn't cargo-dist-able).
+# package (erroring out if it doesn't have the given version or isn't dist-able).
 #
 # If PACKAGE_NAME isn't specified, then the announcement will be for all
-# (cargo-dist-able) packages in the workspace with that version (this mode is
+# (dist-able) packages in the workspace with that version (this mode is
 # intended for workspaces with only one dist-able package, or with all dist-able
 # packages versioned/released in lockstep).
 #
 # If you push multiple tags at once, separate instances of this workflow will
-# spin up, creating an independent announcement for each one. However Github
+# spin up, creating an independent announcement for each one. However, GitHub
 # will hard limit this to 3 tags per commit, as it will assume more tags is a
 # mistake.
 #
 # If there's a prerelease-style suffix to the version, then the release(s)
 # will be marked as a prerelease.
 on:
+  pull_request:
  push:
    tags:
      - '**[0-9]+.[0-9]+.[0-9]+*'
-  pull_request:

 jobs:
-  # Run 'cargo dist plan' (or host) to determine what tasks we need to do
+  # Run 'dist plan' (or host) to determine what tasks we need to do
  plan:
-    runs-on: ubuntu-latest
+    runs-on: "ubuntu-latest"
    outputs:
      val: ${{ steps.plan.outputs.manifest }}
      tag: ${{ !github.event.pull_request && github.ref_name || '' }}
@@ -55,14 +56,19 @@ jobs:
    env:
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
        with:
          submodules: recursive
-      - name: Install cargo-dist
+      - name: Install dist
        # we specify bash to get pipefail; it guards against the `curl` command
        # failing. otherwise `sh` won't catch that `curl` returned non-0
        shell: bash
-        run: "curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.12.0/cargo-dist-installer.sh | sh"
+        run: "curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.28.0/cargo-dist-installer.sh | sh"
+      - name: Cache dist
+        uses: actions/upload-artifact@v7
+        with:
+          name: cargo-dist-cache
+          path: ~/.cargo/bin/dist
      # sure would be cool if github gave us proper conditionals...
      # so here's a doubly-nested ternary-via-truthiness to try to provide the best possible
      # functionality based on whether this is a pull_request, and whether it's from a fork.
@@ -70,12 +76,12 @@ jobs:
      # but also really annoying to build CI around when it needs secrets to work right.)
      - id: plan
        run: |
-          cargo dist ${{ (!github.event.pull_request && format('host --steps=create --tag={0}', github.ref_name)) || 'plan' }} --output-format=json > plan-dist-manifest.json
-          echo "cargo dist ran successfully"
+          dist ${{ (!github.event.pull_request && format('host --steps=create --tag={0}', github.ref_name)) || 'plan' }} --output-format=json > plan-dist-manifest.json
+          echo "dist ran successfully"
          cat plan-dist-manifest.json
          echo "manifest=$(jq -c "." plan-dist-manifest.json)" >> "$GITHUB_OUTPUT"
      - name: "Upload dist-manifest.json"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          name: artifacts-plan-dist-manifest
          path: plan-dist-manifest.json
@@ -89,31 +95,41 @@ jobs:
    if: ${{ fromJson(needs.plan.outputs.val).ci.github.artifacts_matrix.include != null && (needs.plan.outputs.publishing == 'true' || fromJson(needs.plan.outputs.val).ci.github.pr_run_mode == 'upload') }}
    strategy:
      fail-fast: false
-      # Target platforms/runners are computed by cargo-dist in create-release.
+      # Target platforms/runners are computed by dist in create-release.
      # Each member of the matrix has the following arguments:
      #
      # - runner: the github runner
-      # - dist-args: cli flags to pass to cargo dist
-      # - install-dist: expression to run to install cargo-dist on the runner
+      # - dist-args: cli flags to pass to dist
+      # - install-dist: expression to run to install dist on the runner
      #
      # Typically there will be:
      # - 1 "global" task that builds universal installers
      # - N "local" tasks that build each platform's binaries and platform-specific installers
      matrix: ${{ fromJson(needs.plan.outputs.val).ci.github.artifacts_matrix }}
    runs-on: ${{ matrix.runner }}
+    container: ${{ matrix.container && matrix.container.image || null }}
    env:
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      BUILD_MANIFEST_NAME: target/distrib/${{ join(matrix.targets, '-') }}-dist-manifest.json
    steps:
-      - uses: actions/checkout@v4
+      - name: enable windows longpaths
+        run: |
+          git config --global core.longpaths true
+      - uses: actions/checkout@v6
        with:
          submodules: recursive
-      - uses: swatinem/rust-cache@v2
-      - name: Install cargo-dist
-        run: ${{ matrix.install_dist }}
+      - name: Install Rust non-interactively if not already installed
+        if: ${{ matrix.container }}
+        run: |
+          if ! command -v cargo > /dev/null 2>&1; then
+            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
+            echo "$HOME/.cargo/bin" >> $GITHUB_PATH
+          fi
+      - name: Install dist
+        run: ${{ matrix.install_dist.run }}
      # Get the dist-manifest
      - name: Fetch local artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
        with:
          pattern: artifacts-*
          path: target/distrib/
@@ -124,8 +140,8 @@ jobs:
      - name: Build artifacts
        run: |
          # Actually do builds and make zips and whatnot
-          cargo dist build ${{ needs.plan.outputs.tag-flag }} --print=linkage --output-format=json ${{ matrix.dist_args }} > dist-manifest.json
-          echo "cargo dist ran successfully"
+          dist build ${{ needs.plan.outputs.tag-flag }} --print=linkage --output-format=json ${{ matrix.dist_args }} > dist-manifest.json
+          echo "dist ran successfully"
      - id: cargo-dist
        name: Post-build
        # We force bash here just because github makes it really hard to get values up
@@ -135,12 +151,12 @@ jobs:
        run: |
          # Parse out what we just built and upload it to scratch storage
          echo "paths<<EOF" >> "$GITHUB_OUTPUT"
-          jq --raw-output ".artifacts[]?.path | select( . != null )" dist-manifest.json >> "$GITHUB_OUTPUT"
+          dist print-upload-files-from-manifest --manifest dist-manifest.json >> "$GITHUB_OUTPUT"
          echo "EOF" >> "$GITHUB_OUTPUT"

          cp dist-manifest.json "$BUILD_MANIFEST_NAME"
      - name: "Upload artifacts"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          name: artifacts-build-local-${{ join(matrix.targets, '_') }}
          path: |
@@ -152,20 +168,23 @@ jobs:
    needs:
      - plan
      - build-local-artifacts
-    runs-on: "ubuntu-20.04"
+    runs-on: "ubuntu-latest"
    env:
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      BUILD_MANIFEST_NAME: target/distrib/global-dist-manifest.json
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
        with:
          submodules: recursive
-      - name: Install cargo-dist
-        shell: bash
-        run: "curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.12.0/cargo-dist-installer.sh | sh"
+      - name: Install cached dist
+        uses: actions/download-artifact@v8
+        with:
+          name: cargo-dist-cache
+          path: ~/.cargo/bin/
+      - run: chmod +x ~/.cargo/bin/dist
      # Get all the local artifacts for the global tasks to use (for e.g. checksums)
      - name: Fetch local artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
        with:
          pattern: artifacts-*
          path: target/distrib/
@@ -173,17 +192,17 @@ jobs:
      - id: cargo-dist
        shell: bash
        run: |
-          cargo dist build ${{ needs.plan.outputs.tag-flag }} --output-format=json "--artifacts=global" > dist-manifest.json
-          echo "cargo dist ran successfully"
+          dist build ${{ needs.plan.outputs.tag-flag }} --output-format=json "--artifacts=global" > dist-manifest.json
+          echo "dist ran successfully"

          # Parse out what we just built and upload it to scratch storage
          echo "paths<<EOF" >> "$GITHUB_OUTPUT"
-          jq --raw-output ".artifacts[]?.path | select( . != null )" dist-manifest.json >> "$GITHUB_OUTPUT"
+          jq --raw-output ".upload_files[]" dist-manifest.json >> "$GITHUB_OUTPUT"
          echo "EOF" >> "$GITHUB_OUTPUT"

          cp dist-manifest.json "$BUILD_MANIFEST_NAME"
      - name: "Upload artifacts"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          name: artifacts-build-global
          path: |
@@ -199,55 +218,42 @@ jobs:
    if: ${{ always() && needs.plan.outputs.publishing == 'true' && (needs.build-global-artifacts.result == 'skipped' || needs.build-global-artifacts.result == 'success') && (needs.build-local-artifacts.result == 'skipped' || needs.build-local-artifacts.result == 'success') }}
    env:
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    runs-on: "ubuntu-20.04"
+    runs-on: "ubuntu-latest"
    outputs:
      val: ${{ steps.host.outputs.manifest }}
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
        with:
          submodules: recursive
-      - name: Install cargo-dist
-        run: "curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.12.0/cargo-dist-installer.sh | sh"
+      - name: Install cached dist
+        uses: actions/download-artifact@v8
+        with:
+          name: cargo-dist-cache
+          path: ~/.cargo/bin/
+      - run: chmod +x ~/.cargo/bin/dist
      # Fetch artifacts from scratch-storage
      - name: Fetch artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
        with:
          pattern: artifacts-*
          path: target/distrib/
          merge-multiple: true
-      # This is a harmless no-op for Github Releases, hosting for that happens in "announce"
      - id: host
        shell: bash
        run: |
-          cargo dist host ${{ needs.plan.outputs.tag-flag }} --steps=upload --steps=release --output-format=json > dist-manifest.json
+          dist host ${{ needs.plan.outputs.tag-flag }} --steps=upload --steps=release --output-format=json > dist-manifest.json
          echo "artifacts uploaded and released successfully"
          cat dist-manifest.json
          echo "manifest=$(jq -c "." dist-manifest.json)" >> "$GITHUB_OUTPUT"
      - name: "Upload dist-manifest.json"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          # Overwrite the previous copy
          name: artifacts-dist-manifest
          path: dist-manifest.json
-
-  # Create a Github Release while uploading all files to it
-  announce:
-    needs:
-      - plan
-      - host
-    # use "always() && ..." to allow us to wait for all publish jobs while
-    # still allowing individual publish jobs to skip themselves (for prereleases).
-    # "host" however must run to completion, no skipping allowed!
-    if: ${{ always() && needs.host.result == 'success' }}
-    runs-on: "ubuntu-20.04"
-    env:
-      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          submodules: recursive
-      - name: "Download Github Artifacts"
-        uses: actions/download-artifact@v4
+      # Create a GitHub Release while uploading all files to it
+      - name: "Download GitHub Artifacts"
+        uses: actions/download-artifact@v8
        with:
          pattern: artifacts-*
          path: artifacts
@@ -256,11 +262,30 @@ jobs:
        run: |
          # Remove the granular manifests
          rm -f artifacts/*-dist-manifest.json
-      - name: Create Github Release
-        uses: ncipollo/release-action@v1
+      - name: Create GitHub Release
+        env:
+          PRERELEASE_FLAG: "${{ fromJson(steps.host.outputs.manifest).announcement_is_prerelease && '--prerelease' || '' }}"
+          ANNOUNCEMENT_TITLE: "${{ fromJson(steps.host.outputs.manifest).announcement_title }}"
+          ANNOUNCEMENT_BODY: "${{ fromJson(steps.host.outputs.manifest).announcement_github_body }}"
+          RELEASE_COMMIT: "${{ github.sha }}"
+        run: |
+          # Write and read notes from a file to avoid quoting breaking things
+          echo "$ANNOUNCEMENT_BODY" > $RUNNER_TEMP/notes.txt
+
+          gh release create "${{ needs.plan.outputs.tag }}" --target "$RELEASE_COMMIT" $PRERELEASE_FLAG --title "$ANNOUNCEMENT_TITLE" --notes-file "$RUNNER_TEMP/notes.txt" artifacts/*
+
+  announce:
+    needs:
+      - plan
+      - host
+    # use "always() && ..." to allow us to wait for all publish jobs while
+    # still allowing individual publish jobs to skip themselves (for prereleases).
+    # "host" however must run to completion, no skipping allowed!
+    if: ${{ always() && needs.host.result == 'success' }}
+    runs-on: "ubuntu-latest"
+    env:
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - uses: actions/checkout@v6
        with:
-          tag: ${{ needs.plan.outputs.tag }}
-          name: ${{ fromJson(needs.host.outputs.val).announcement_title }}
-          body: ${{ fromJson(needs.host.outputs.val).announcement_github_body }}
-          prerelease: ${{ fromJson(needs.host.outputs.val).announcement_is_prerelease }}
-          artifacts: "artifacts/*"
+          submodules: recursive
@@ -15,3 +15,5 @@ repos:
        pass_filenames: false
        types: [file, rust]
        language: system
+ci:
+  skip: [rust-linting, rust-clippy]
@@ -11,6 +11,8 @@ check out these documents:
 - Our community's [CODE_OF_CONDUCT.md](./CODE_OF_CONDUCT.md).
 - [DEVELOPMENT.md](./DEVELOPMENT.md) for setting up your development
  environment.
+- Our [Review Guidelines](https://uutils.github.io/reviews/) for what we expect
+  from a pull request and how reviews are done.

 Now follows a very important warning:

@@ -180,7 +182,7 @@ To ensure easy collaboration, we have guidelines for using Git and GitHub.
 ### Commit messages

 You can read this section in the Git book to learn how to write good commit
-messages: https://git-scm.com/book/ch5-2.html.
+messages: https://git-scm.com/book/en/v2/Distributed-Git-Contributing-to-a-Project.

 In addition, here are a few examples for a summary line when committing to
 uutils:
@@ -231,10 +233,6 @@ you contribute must at least compile without warnings for all platforms in the
 CI. However, you can use `#[cfg(...)]` attributes to create platform dependent
 features.

-**Tip:** For Windows, Microsoft provides some images (VMWare, Hyper-V,
-VirtualBox and Parallels) for development:
-<https://developer.microsoft.com/windows/downloads/virtual-machines/>
-
 ## Licensing

 uutils is distributed under the terms of the MIT License; see the `LICENSE` file
@@ -1,6 +1,6 @@
 [package]
 name = "findutils"
-version = "0.7.0"
+version = "0.8.0"
 homepage = "https://github.com/uutils/findutils"
 repository = "https://github.com/uutils/findutils"
 edition = "2021"
@@ -10,24 +10,22 @@ description = "Rust implementation of GNU findutils"
 authors = ["uutils developers"]

 [dependencies]
-chrono = "0.4.38"
-clap = "4.5"
+argmax = "0.4.0"
+chrono = "0.4.44"
+clap = "4.6"
 faccess = "0.2.4"
+nix = { version = "0.31", features = ["fs", "user"] }
+onig = { version = "6.5", default-features = false }
+regex = "1.12"
+uucore = { version = "0.9.0", features = ["entries", "fs", "fsext", "mode"] }
 walkdir = "2.5"
-regex = "1.10"
-once_cell = "1.19"
-onig = { version = "6.4", default-features = false }
-uucore = { version = "0.0.27", features = ["entries", "fs", "fsext", "mode"] }
-nix = { version = "0.29", features = ["fs", "user"] }

 [dev-dependencies]
-assert_cmd = "2"
+ctor = "1.0"
 filetime = "0.2"
-nix = { version = "0.29", features = ["fs"] }
-predicates = "3"
-serial_test = "3.1"
+nix = { version = "0.31", features = ["fs"] }
 tempfile = "3"
-pretty_assertions = "1.4.0"
+uutests = "0.9.0"

 [[bin]]
 name = "find"
@@ -41,25 +39,26 @@ path = "src/xargs/main.rs"
 name = "testing-commandline"
 path = "src/testing/commandline/main.rs"

-# The profile that 'cargo dist' will build with
-[profile.dist]
-inherits = "release"
+[profile.release]
 lto = "thin"
+codegen-units = 1

-# Config for 'cargo dist'
-[workspace.metadata.dist]
-# The preferred cargo-dist version to use in CI (Cargo.toml SemVer syntax)
-cargo-dist-version = "0.12.0"
-# CI backends to support
-ci = ["github"]
-# The installers to generate for each app
-installers = []
-# Target platforms to build apps for (Rust target-triple syntax)
-targets = [
-    "aarch64-apple-darwin",
-    "x86_64-apple-darwin",
-    "x86_64-unknown-linux-gnu",
-    "x86_64-pc-windows-msvc",
-]
-# Publish jobs to run in CI
-pr-run-mode = "plan"
+[profile.release-fast]
+inherits = "release"
+panic = "abort"
+
+[lints.clippy]
+multiple_crate_versions = "allow"
+cargo_common_metadata = "allow"
+uninlined_format_args = "allow"
+missing_panics_doc = "allow"
+
+use_self = "warn"
+needless_pass_by_value = "warn"
+semicolon_if_nothing_returned = "warn"
+single_char_pattern = "warn"
+explicit_iter_loop = "warn"
+if_not_else = "warn"
+manual_let_else = "warn"
+# Disable for now, we have a few occurrences
+# panic = "warn"
@@ -20,8 +20,8 @@ bash util/build-gnu.sh tests/misc/help-version.sh

 ## Comparing with GNU

-![Evolution over time - GNU testsuite](https://github.com/uutils/findutils-tracking/blob/main/gnu-results.png?raw=true)
-![Evolution over time - BFS testsuite](https://github.com/uutils/findutils-tracking/blob/main/bfs-results.png?raw=true)
+![Evolution over time - GNU testsuite](https://github.com/uutils/findutils-tracking/blob/main/gnu-results.svg?raw=true)
+![Evolution over time - BFS testsuite](https://github.com/uutils/findutils-tracking/blob/main/bfs-results.svg?raw=true)

 ## Build/run with BFS

@@ -0,0 +1,44 @@
+# Security Policy
+
+## Supported Versions
+
+We provide security updates only for the latest released version of `uutils/findutils`.
+Older versions may not receive patches.
+If you are using a version packaged by your Linux distribution, please check with your distribution maintainers for their update policy.
+
+---
+
+## Reporting a Vulnerability
+
+**Do not open public GitHub issues for security vulnerabilities.**
+This prevents accidental disclosure before a fix is available.
+
+Instead, please use the following method:
+
+- **Email:** [sylvestre@debian.org](mailto:Sylvestre@debian.org)
+- **Encryption (optional):** You may encrypt your report using our PGP key:
+Fingerprint: B60D B599 4D39 BEC4 D1A9 5CCF 7E65 28DA 752F 1BE1
+---
+
+### What to Include in Your Report
+
+To help us investigate and resolve the issue quickly, please include as much detail as possible:
+
+- **Type of issue:** e.g. privilege escalation, information disclosure.
+- **Location in the source:** file path, commit hash, branch, or tag.
+- **Steps to reproduce:** exact commands, test cases, or scripts.
+- **Special configuration:** any flags, environment variables, or system setup required.
+- **Affected systems:** OS/distribution and version(s) where the issue occurs.
+- **Impact:** your assessment of the potential severity (DoS, RCE, data leak, etc.).
+
+---
+
+## Disclosure Policy
+
+We follow a **Coordinated Vulnerability Disclosure (CVD)** process:
+
+1. We will acknowledge receipt of your report within **10 days**.
+2. We will investigate, reproduce, and assess the issue.
+3. We will provide a timeline for developing and releasing a fix.
+4. Once a fix is available, we will publish a GitHub Security Advisory.
+5. You will be credited in the advisory unless you request anonymity.
@@ -0,0 +1,24 @@
+[workspace]
+members = ["cargo:."]
+
+# Config for 'dist'
+[dist]
+# The preferred dist version to use in CI (Cargo.toml SemVer syntax)
+cargo-dist-version = "0.28.0"
+# CI backends to support
+ci = "github"
+# The installers to generate for each app
+installers = ["shell"]
+# Target platforms to build apps for (Rust target-triple syntax)
+targets = ["aarch64-apple-darwin", "x86_64-apple-darwin", "x86_64-unknown-linux-gnu", "x86_64-pc-windows-msvc"]
+# Which actions to run on pull requests
+pr-run-mode = "plan"
+# Path that installers should place binaries in
+install-path = "CARGO_HOME"
+# Whether to install an updater program
+install-updater = false
+# Ignore out-of-date contents
+allow-dirty = ["ci"]
+
+[dist.github-custom-runners]
+x86_64-unknown-linux-gnu = "ubuntu-latest"
@@ -16,7 +16,7 @@ pub struct DeleteMatcher;

 impl DeleteMatcher {
    pub fn new() -> Self {
-        DeleteMatcher
+        Self
    }

    fn delete(&self, entry: &WalkEntry) -> io::Result<()> {
@@ -14,8 +14,8 @@ use super::{Matcher, MatcherIO, WalkEntry};
 pub struct EmptyMatcher;

 impl EmptyMatcher {
-    pub fn new() -> EmptyMatcher {
-        EmptyMatcher
+    pub fn new() -> Self {
+        Self
    }
 }

@@ -62,6 +62,8 @@ mod tests {
    use super::*;
    use crate::find::matchers::tests::get_dir_entry_for;
    use crate::find::tests::FakeDependencies;
+    #[cfg(unix)]
+    use std::os::unix::fs::PermissionsExt;

    #[test]
    fn empty_files() {
@@ -96,4 +98,73 @@ mod tests {
        let file_info = get_dir_entry_for(&temp_dir_path, subdir_name);
        assert!(!matcher.matches(&file_info, &mut deps.new_matcher_io()));
    }
+
+    #[test]
+    fn empty_file_vs_empty_directory() {
+        let empty_file_info = get_dir_entry_for("test_data/simple", "abbbc");
+
+        let temp_dir = Builder::new()
+            .prefix("empty_file_vs_empty_directory")
+            .tempdir()
+            .unwrap();
+        let temp_dir_path = temp_dir.path().to_string_lossy();
+        let subdir_name = "empty_subdir";
+        std::fs::create_dir(temp_dir.path().join(subdir_name)).unwrap();
+
+        let matcher = EmptyMatcher::new();
+        let deps = FakeDependencies::new();
+
+        // Both an empty file and an empty directory should match.
+        assert!(
+            matcher.matches(&empty_file_info, &mut deps.new_matcher_io()),
+            "empty file should match"
+        );
+        let empty_dir_info = get_dir_entry_for(&temp_dir_path, subdir_name);
+        assert!(
+            matcher.matches(&empty_dir_info, &mut deps.new_matcher_io()),
+            "empty directory should match"
+        );
+    }
+
+    #[test]
+    #[cfg(unix)]
+    fn non_readable_directory() {
+        let temp_dir = Builder::new()
+            .prefix("non_readable_directory")
+            .tempdir()
+            .unwrap();
+        let temp_dir_path = temp_dir.path().to_string_lossy();
+        let subdir_name = "unreadable";
+        std::fs::create_dir(temp_dir.path().join(subdir_name)).unwrap();
+
+        let mut perms = std::fs::metadata(temp_dir.path().join(subdir_name))
+            .unwrap()
+            .permissions();
+        perms.set_mode(0o000);
+        std::fs::set_permissions(temp_dir.path().join(subdir_name), perms).unwrap();
+
+        // If we can still read the directory, we're likely running as root.
+        if std::fs::read_dir(temp_dir.path().join(subdir_name)).is_ok() {
+            // Restore permissions before skipping.
+            let mut perms = std::fs::metadata(temp_dir.path().join(subdir_name))
+                .unwrap()
+                .permissions();
+            perms.set_mode(0o755);
+            std::fs::set_permissions(temp_dir.path().join(subdir_name), perms).unwrap();
+            return;
+        }
+
+        let matcher = EmptyMatcher::new();
+        let deps = FakeDependencies::new();
+
+        let file_info = get_dir_entry_for(&temp_dir_path, subdir_name);
+        assert!(!matcher.matches(&file_info, &mut deps.new_matcher_io()));
+
+        // Restore permissions so tempdir can be cleaned up.
+        let mut perms = std::fs::metadata(temp_dir.path().join(subdir_name))
+            .unwrap()
+            .permissions();
+        perms.set_mode(0o755);
+        std::fs::set_permissions(temp_dir.path().join(subdir_name), perms).unwrap();
+    }
 }
@@ -24,7 +24,7 @@ enum Entry {
 }

 /// File types.
-#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+#[derive(Clone, Copy, Debug, Eq, PartialEq, Hash)]
 pub enum FileType {
    Unknown,
    Fifo,
@@ -51,34 +51,34 @@ impl FileType {
 }

 impl From<fs::FileType> for FileType {
-    fn from(t: fs::FileType) -> FileType {
+    fn from(t: fs::FileType) -> Self {
        if t.is_dir() {
-            return FileType::Directory;
+            return Self::Directory;
        }
        if t.is_file() {
-            return FileType::Regular;
+            return Self::Regular;
        }
        if t.is_symlink() {
-            return FileType::Symlink;
+            return Self::Symlink;
        }

        #[cfg(unix)]
        {
            if t.is_fifo() {
-                return FileType::Fifo;
+                return Self::Fifo;
            }
            if t.is_char_device() {
-                return FileType::CharDevice;
+                return Self::CharDevice;
            }
            if t.is_block_device() {
-                return FileType::BlockDevice;
+                return Self::BlockDevice;
            }
            if t.is_socket() {
-                return FileType::Socket;
+                return Self::Socket;
            }
        }

-        FileType::Unknown
+        Self::Unknown
    }
 }

@@ -150,14 +150,14 @@ impl Display for WalkError {
 impl Error for WalkError {}

 impl From<io::Error> for WalkError {
-    fn from(e: io::Error) -> WalkError {
-        WalkError::from(&e)
+    fn from(e: io::Error) -> Self {
+        Self::from(&e)
    }
 }

 impl From<&io::Error> for WalkError {
-    fn from(e: &io::Error) -> WalkError {
-        WalkError {
+    fn from(e: &io::Error) -> Self {
+        Self {
            path: None,
            depth: None,
            raw: e.raw_os_error(),
@@ -166,14 +166,14 @@ impl From<&io::Error> for WalkError {
 }

 impl From<walkdir::Error> for WalkError {
-    fn from(e: walkdir::Error) -> WalkError {
-        WalkError::from(&e)
+    fn from(e: walkdir::Error) -> Self {
+        Self::from(&e)
    }
 }

 impl From<&walkdir::Error> for WalkError {
-    fn from(e: &walkdir::Error) -> WalkError {
-        WalkError {
+    fn from(e: &walkdir::Error) -> Self {
+        Self {
            path: e.path().map(|p| p.to_owned()),
            depth: Some(e.depth()),
            raw: e.io_error().and_then(|e| e.raw_os_error()),
@@ -182,15 +182,15 @@ impl From<&walkdir::Error> for WalkError {
 }

 impl From<WalkError> for io::Error {
-    fn from(e: WalkError) -> io::Error {
-        io::Error::from(&e)
+    fn from(e: WalkError) -> Self {
+        Self::from(&e)
    }
 }

 impl From<&WalkError> for io::Error {
-    fn from(e: &WalkError) -> io::Error {
+    fn from(e: &WalkError) -> Self {
        e.raw
-            .map(io::Error::from_raw_os_error)
+            .map(Self::from_raw_os_error)
            .unwrap_or_else(|| ErrorKind::Other.into())
    }
 }
@@ -221,7 +221,7 @@ impl WalkEntry {
    pub fn from_walkdir(
        result: walkdir::Result<DirEntry>,
        follow: Follow,
-    ) -> Result<WalkEntry, WalkError> {
+    ) -> Result<Self, WalkError> {
        let result = result.map_err(WalkError::from);

        match result {
@@ -242,7 +242,7 @@ impl WalkEntry {
                // Detect broken symlinks and replace them with explicit entries
                if let (Some(path), Some(depth)) = (e.path(), e.depth()) {
                    if let Ok(meta) = path.symlink_metadata() {
-                        return Ok(WalkEntry {
+                        return Ok(Self {
                            inner: Entry::Explicit(path.into(), depth),
                            follow: Follow::Never,
                            meta: Ok(meta).into(),
@@ -278,7 +278,7 @@ impl WalkEntry {
            Entry::Explicit(path, _) => {
                // Path::file_name() only works if the last component is normal
                path.components()
-                    .last()
+                    .next_back()
                    .map(|c| c.as_os_str())
                    .unwrap_or_else(|| path.as_os_str())
            }
@@ -4,6 +4,7 @@
 // license that can be found in the LICENSE file or at
 // https://opensource.org/licenses/MIT.

+use std::cell::RefCell;
 use std::error::Error;
 use std::ffi::OsString;
 use std::io::{stderr, Write};
@@ -21,6 +22,7 @@ pub struct SingleExecMatcher {
    executable: String,
    args: Vec<Arg>,
    exec_in_parent_dir: bool,
+    interactive: bool,
 }

 impl SingleExecMatcher {
@@ -28,6 +30,23 @@ impl SingleExecMatcher {
        executable: &str,
        args: &[&str],
        exec_in_parent_dir: bool,
+    ) -> Result<Self, Box<dyn Error>> {
+        Self::new_impl(executable, args, exec_in_parent_dir, false)
+    }
+
+    pub fn new_interactive(
+        executable: &str,
+        args: &[&str],
+        exec_in_parent_dir: bool,
+    ) -> Result<Self, Box<dyn Error>> {
+        Self::new_impl(executable, args, exec_in_parent_dir, true)
+    }
+
+    fn new_impl(
+        executable: &str,
+        args: &[&str],
+        exec_in_parent_dir: bool,
+        interactive: bool,
    ) -> Result<Self, Box<dyn Error>> {
        let transformed_args = args
            .iter()
@@ -46,13 +65,13 @@ impl SingleExecMatcher {
            executable: executable.to_string(),
            args: transformed_args,
            exec_in_parent_dir,
+            interactive,
        })
    }
 }

 impl Matcher for SingleExecMatcher {
-    fn matches(&self, file_info: &WalkEntry, _: &mut MatcherIO) -> bool {
-        let mut command = Command::new(&self.executable);
+    fn matches(&self, file_info: &WalkEntry, matcher_io: &mut MatcherIO) -> bool {
        let path_to_file = if self.exec_in_parent_dir {
            if let Some(f) = file_info.path().file_name() {
                Path::new(".").join(f)
@@ -63,6 +82,28 @@ impl Matcher for SingleExecMatcher {
            file_info.path().to_path_buf()
        };

+        if self.interactive {
+            let rendered_args: Vec<String> = self
+                .args
+                .iter()
+                .map(|arg| match arg {
+                    Arg::LiteralArg(a) => a.to_string_lossy().into_owned(),
+                    Arg::FileArg(parts) => parts
+                        .join(path_to_file.as_os_str())
+                        .to_string_lossy()
+                        .into_owned(),
+                })
+                .collect();
+            let mut prompt_parts = vec![self.executable.clone()];
+            prompt_parts.extend(rendered_args);
+            let prompt = format!("< {} >? ", prompt_parts.join(" "));
+
+            if !matcher_io.confirm(&prompt) {
+                return false;
+            }
+        }
+
+        let mut command = Command::new(&self.executable);
        for arg in &self.args {
            match *arg {
                Arg::LiteralArg(ref a) => command.arg(a.as_os_str()),
@@ -97,6 +138,125 @@ impl Matcher for SingleExecMatcher {
    }
 }

+pub struct MultiExecMatcher {
+    executable: String,
+    args: Vec<OsString>,
+    exec_in_parent_dir: bool,
+    /// Command to build while matching.
+    command: RefCell<Option<argmax::Command>>,
+}
+
+impl MultiExecMatcher {
+    pub fn new(
+        executable: &str,
+        args: &[&str],
+        exec_in_parent_dir: bool,
+    ) -> Result<Self, Box<dyn Error>> {
+        let transformed_args = args.iter().map(OsString::from).collect();
+
+        Ok(Self {
+            executable: executable.to_string(),
+            args: transformed_args,
+            exec_in_parent_dir,
+            command: RefCell::new(None),
+        })
+    }
+
+    fn new_command(&self) -> argmax::Command {
+        let mut command = argmax::Command::new(&self.executable);
+        command.try_args(&self.args).unwrap();
+        command
+    }
+
+    fn run_command(&self, command: &mut argmax::Command, matcher_io: &mut MatcherIO) {
+        match command.status() {
+            Ok(status) => {
+                if !status.success() {
+                    matcher_io.set_exit_code(1);
+                }
+            }
+            Err(e) => {
+                writeln!(&mut stderr(), "Failed to run {}: {}", self.executable, e).unwrap();
+                matcher_io.set_exit_code(1);
+            }
+        }
+    }
+}
+
+impl Matcher for MultiExecMatcher {
+    fn matches(&self, file_info: &WalkEntry, matcher_io: &mut MatcherIO) -> bool {
+        let path_to_file = if self.exec_in_parent_dir {
+            if let Some(f) = file_info.path().file_name() {
+                Path::new(".").join(f)
+            } else {
+                Path::new(".").join(file_info.path())
+            }
+        } else {
+            file_info.path().to_path_buf()
+        };
+        let mut command = self.command.borrow_mut();
+        let command = command.get_or_insert_with(|| self.new_command());
+
+        // Build command, or dispatch it before when it is long enough.
+        if command.try_arg(&path_to_file).is_err() {
+            if self.exec_in_parent_dir {
+                match file_info.path().parent() {
+                    None => {
+                        // Root paths like "/" have no parent.  Run them from the root to match GNU find.
+                        command.current_dir(file_info.path());
+                    }
+                    Some(parent) if parent == Path::new("") => {
+                        // Paths like "foo" have a parent of "".  Avoid chdir("").
+                    }
+                    Some(parent) => {
+                        command.current_dir(parent);
+                    }
+                }
+            }
+            self.run_command(command, matcher_io);
+
+            // Reset command status.
+            *command = self.new_command();
+            if let Err(e) = command.try_arg(&path_to_file) {
+                writeln!(
+                    &mut stderr(),
+                    "Cannot fit a single argument {}: {}",
+                    &path_to_file.to_string_lossy(),
+                    e
+                )
+                .unwrap();
+                matcher_io.set_exit_code(1);
+            }
+        }
+        true
+    }
+
+    fn finished_dir(&self, dir: &Path, matcher_io: &mut MatcherIO) {
+        // Dispatch command for -execdir.
+        if self.exec_in_parent_dir {
+            let mut command = self.command.borrow_mut();
+            if let Some(mut command) = command.take() {
+                command.current_dir(Path::new(".").join(dir));
+                self.run_command(&mut command, matcher_io);
+            }
+        }
+    }
+
+    fn finished(&self, matcher_io: &mut MatcherIO) {
+        // Dispatch command for -exec.
+        if !self.exec_in_parent_dir {
+            let mut command = self.command.borrow_mut();
+            if let Some(mut command) = command.take() {
+                self.run_command(&mut command, matcher_io);
+            }
+        }
+    }
+
+    fn has_side_effects(&self) -> bool {
+        true
+    }
+}
+
 #[cfg(test)]
 /// No tests here, because we need to call out to an external executable. See
 /// `tests/exec_unit_tests.rs` instead.
@@ -3,6 +3,8 @@
 // For the full copyright and license information, please view the LICENSE
 // file that was distributed with this source code.
 use super::{Matcher, MatcherIO, WalkEntry};
+#[cfg(unix)]
+use uucore::error::UResult;

 /// The latest mapping from dev_id to fs_type, used for saving mount info reads
 #[cfg(unix)]
@@ -26,15 +28,12 @@ pub struct Cache {
 #[cfg(unix)]
 use std::{
    cell::RefCell,
-    error::Error,
    io::{stderr, Write},
    path::Path,
 };
+
 #[cfg(unix)]
-pub fn get_file_system_type(
-    path: &Path,
-    cache: &RefCell<Option<Cache>>,
-) -> Result<String, Box<dyn Error>> {
+pub fn get_file_system_type(path: &Path, cache: &RefCell<Option<Cache>>) -> UResult<String> {
    use std::os::unix::fs::MetadataExt;

    // use symlink_metadata (lstat under the hood) instead of metadata (stat) to make sure that it
@@ -51,13 +50,10 @@ pub fn get_file_system_type(
        }
    }

-    let fs_list = match uucore::fsext::read_fs_list() {
-        Ok(fs_list) => fs_list,
-        Err(err) => Err(err)?,
-    };
+    let fs_list = uucore::fsext::read_fs_list()?;
    let result = fs_list
        .into_iter()
-        .find(|fs| fs.dev_id == dev_id)
+        .rfind(|fs| fs.dev_id == dev_id)
        .map_or_else(String::new, |fs| fs.fs_type);

    // cache the latest query if not a match before
@@ -112,7 +112,7 @@ fn extract_bracket_expr(pattern: &str) -> Option<(String, &str)> {
 }

 /// Converts a POSIX glob into a POSIX Basic Regular Expression
-fn glob_to_regex(pattern: &str) -> String {
+fn glob_to_regex(pattern: &str) -> Option<String> {
    let mut regex = String::new();

    let mut chars = pattern.chars();
@@ -130,9 +130,9 @@ fn glob_to_regex(pattern: &str) -> String {
                    //     If pattern ends with an unescaped <backslash>, fnmatch() shall return a
                    //     non-zero value (indicating either no match or an error).
                    //
-                    // Most implementations return FNM_NOMATCH in this case, so return a regex that
+                    // Most implementations return FNM_NOMATCH in this case, so create a pattern that
                    // never matches.
-                    return "$.".to_string();
+                    return None;
                }
            }
            '[' => {
@@ -147,12 +147,12 @@ fn glob_to_regex(pattern: &str) -> String {
        }
    }

-    regex
+    Some(regex)
 }

 /// An fnmatch()-style glob matcher.
 pub struct Pattern {
-    regex: Regex,
+    regex: Option<Regex>,
 }

 impl Pattern {
@@ -165,13 +165,13 @@ impl Pattern {
        };

        // As long as glob_to_regex() is correct, this should never fail
-        let regex = parse_bre(&glob_to_regex(pattern), options).unwrap();
+        let regex = glob_to_regex(pattern).map(|r| parse_bre(&r, options).unwrap());
        Self { regex }
    }

    /// Test if this pattern matches a string.
    pub fn matches(&self, string: &str) -> bool {
-        self.regex.is_match(string)
+        self.regex.as_ref().is_some_and(|r| r.is_match(string))
    }
 }

@@ -179,47 +179,52 @@ impl Pattern {
 mod tests {
    use super::*;

+    #[track_caller]
+    fn assert_glob_regex(glob: &str, regex: &str) {
+        assert_eq!(glob_to_regex(glob).as_deref(), Some(regex));
+    }
+
    #[test]
    fn literals() {
-        assert_eq!(glob_to_regex(r"foo.bar"), r"foo\.bar");
+        assert_glob_regex(r"foo.bar", r"foo\.bar");
    }

    #[test]
    fn regex_special() {
-        assert_eq!(glob_to_regex(r"^foo.bar$"), r"\^foo\.bar\$");
+        assert_glob_regex(r"^foo.bar$", r"\^foo\.bar\$");
    }

    #[test]
    fn wildcards() {
-        assert_eq!(glob_to_regex(r"foo?bar*baz"), r"foo.bar.*baz");
+        assert_glob_regex(r"foo?bar*baz", r"foo.bar.*baz");
    }

    #[test]
    fn escapes() {
-        assert_eq!(glob_to_regex(r"fo\o\?bar\*baz\\"), r"foo?bar\*baz\\");
-    }
-
-    #[test]
-    fn incomplete_escape() {
-        assert_eq!(glob_to_regex(r"foo\"), r"$.");
+        assert_glob_regex(r"fo\o\?bar\*baz\\", r"foo?bar\*baz\\");
    }

    #[test]
    fn valid_brackets() {
-        assert_eq!(glob_to_regex(r"foo[bar][!baz]"), r"foo[bar][^baz]");
+        assert_glob_regex(r"foo[bar][!baz]", r"foo[bar][^baz]");
    }

    #[test]
    fn complex_brackets() {
-        assert_eq!(
-            glob_to_regex(r"[!]!.*[\[.].][=]=][:space:]-]"),
-            r"[^]!.*[\[.].][=]=][:space:]-]"
+        assert_glob_regex(
+            r"[!]!.*[\[.].][=]=][:space:]-]",
+            r"[^]!.*[\[.].][=]=][:space:]-]",
        );
    }

    #[test]
    fn invalid_brackets() {
-        assert_eq!(glob_to_regex(r"foo[bar[!baz"), r"foo\[bar\[!baz");
+        assert_glob_regex(r"foo[bar[!baz", r"foo\[bar\[!baz");
+    }
+
+    #[test]
+    fn incomplete_escape() {
+        assert_eq!(glob_to_regex(r"foo\"), None);
    }

    #[test]
@@ -235,4 +240,9 @@ mod tests {

        assert!(!Pattern::new(r"foo*BAR", true).matches("BAR--foo"));
    }
+
+    #[test]
+    fn incomplete_escape_matches() {
+        assert!(!Pattern::new(r"foo\", false).matches("\n"));
+    }
 }
@@ -3,7 +3,7 @@
 // For the full copyright and license information, please view the LICENSE
 // file that was distributed with this source code.

-use super::{Matcher, MatcherIO, WalkEntry};
+use super::{ComparableValue, Matcher, MatcherIO, WalkEntry};

 #[cfg(unix)]
 use nix::unistd::Group;
@@ -11,63 +11,39 @@ use nix::unistd::Group;
 use std::os::unix::fs::MetadataExt;

 pub struct GroupMatcher {
-    gid: Option<u32>,
+    gid: ComparableValue,
 }

 impl GroupMatcher {
    #[cfg(unix)]
-    pub fn from_group_name(group: &str) -> GroupMatcher {
+    pub fn from_group_name(group: &str) -> Option<Self> {
        // get gid from group name
-        let Ok(group) = Group::from_name(group) else {
-            return GroupMatcher { gid: None };
-        };
-
-        let Some(group) = group else {
-            // This if branch is to determine whether a certain group exists in the system.
-            // If a certain group does not exist in the system,
-            // the result will need to be returned according to
-            // the flag bit of whether to invert the result.
-            return GroupMatcher { gid: None };
-        };
-
-        GroupMatcher {
-            gid: Some(group.gid.as_raw()),
-        }
+        let group = Group::from_name(group).ok()??;
+        let gid = group.gid.as_raw();
+        Some(Self::from_gid(gid))
    }

-    #[cfg(unix)]
-    pub fn from_gid(gid: u32) -> GroupMatcher {
-        GroupMatcher { gid: Some(gid) }
+    pub fn from_gid(gid: u32) -> Self {
+        Self::from_comparable(ComparableValue::EqualTo(gid as u64))
+    }
+
+    pub fn from_comparable(gid: ComparableValue) -> Self {
+        Self { gid }
    }

    #[cfg(windows)]
-    pub fn from_group_name(_group: &str) -> GroupMatcher {
-        GroupMatcher { gid: None }
-    }
-
-    #[cfg(windows)]
-    pub fn from_gid(_gid: u32) -> GroupMatcher {
-        GroupMatcher { gid: None }
-    }
-
-    pub fn gid(&self) -> &Option<u32> {
-        &self.gid
+    pub fn from_group_name(_group: &str) -> Option<Self> {
+        None
    }
 }

 impl Matcher for GroupMatcher {
    #[cfg(unix)]
    fn matches(&self, file_info: &WalkEntry, _: &mut MatcherIO) -> bool {
-        let Ok(metadata) = file_info.metadata() else {
-            return false;
-        };
-
-        let file_gid = metadata.gid();
-
-        // When matching the -group parameter in find/matcher/mod.rs,
-        // it has been judged that the group does not exist and an error is returned.
-        // So use unwarp() directly here.
-        self.gid.unwrap() == file_gid
+        match file_info.metadata() {
+            Ok(metadata) => self.gid.matches(metadata.gid().into()),
+            Err(_) => false,
+        }
    }

    #[cfg(windows)]
@@ -136,7 +112,8 @@ mod tests {
            .unwrap()
            .name;

-        let matcher = super::GroupMatcher::from_group_name(file_group.as_str());
+        let matcher =
+            super::GroupMatcher::from_group_name(file_group.as_str()).expect("group should exist");
        assert!(
            matcher.matches(&file_info, &mut matcher_io),
            "group should match"
@@ -146,18 +123,13 @@ mod tests {
        let time_string = Local::now().format("%Y%m%d%H%M%S").to_string();
        let matcher = GroupMatcher::from_group_name(time_string.as_str());
        assert!(
-            matcher.gid().is_none(),
+            matcher.is_none(),
            "group name {} should not exist",
            time_string
        );

        // Testing group id
        let matcher = GroupMatcher::from_gid(file_gid);
-        assert!(
-            matcher.gid().is_some(),
-            "group id {} should exist",
-            file_gid
-        );
        assert!(
            matcher.matches(&file_info, &mut matcher_io),
            "group id should match"
@@ -38,7 +38,7 @@ pub struct LinkNameMatcher {
 }

 impl LinkNameMatcher {
-    pub fn new(pattern_string: &str, caseless: bool) -> LinkNameMatcher {
+    pub fn new(pattern_string: &str, caseless: bool) -> Self {
        let pattern = Pattern::new(pattern_string, caseless);
        Self { pattern }
    }
--- a/Show More
+++ b/Show More