Add fallback input option to ensure that fallback is not used

[taiki-e]

Add an option to prevent accidentally installing tools that use fallback for installation.

- uses: taiki-e/install-action@v2
  with:
    tool: <tool>
    # Possible values:
    # - none: disable all fallback
    # - cargo-binstall (default): cargo-binstall (includes quickinstall)
    fallback: none

We could add an option to use cargo-binstall without quickinstall in the future if someone actually wants to use that.

Related discussion: #514

cc @jayvdb

[NobodyXu]

I'd suggest INPUT_STRATEGIES and pass it directly to cargo-binstall.

User can specify crate-meta-data for trying to download it from official maintainer, quick-install from third-party quickinstall, compile for from source.

If empty, then disable cargo-binstall

https://github.com/cargo-bins/cargo-binstall/blob/48ee0b0e3e646f7f0cfb2428f46dbcd32afe979b/crates/bin/src/args.rs#L418

[jayvdb]

getting approval for cargo-binstall would be worth attempting IMO if its cargo-quickinstall was disabled.
i.e. trying to explain to my cyber-security team that we're using install-action which falls back to cargo-binstall which falls back to cargo-quickinstall is too hard, and it is that cargo-quickinstall stage which becomes "oh its just grabbing some binary from somewhere on the internet, but they are good people running it, trust them". The fall back to cargo-binstall is explainable if it is "it fetches from github releases or it builds from source 100%"

[NobodyXu]

That's good to hear, disabling quickinstall is pretty easy, you just need to pass --strategies crate-meta-data,compile and it will only use the prebuilt from the official repository specified in Cargo.toml on https://crates.io , or fallback to cargo-install.

--strategies compile would then be equivalent to launching cargo-install, though cargo-binstall would launch multiple cargo-install for each crate to compile them in parallel, with a jobserver to limit parallelism.

[taiki-e]

IMO, for a reviewer who is not familiar with the details of cargo-binstall's API but needs to review code that uses this action, something like strategies: ''/strategies: crate-meta-data,compile is not at all clear at first glance. (compared to something like fallback: none/fallback: binstall-first-party)

[NobodyXu]

That's true, maybe we can pass --disable-strategies instead.

--disable-strategies quick-install is equivalent to --strategies crate-meta-data,compile, and it's much more straight forward for people just wanting to disable quickinstall.

[taiki-e]

Considering there is a proposal to add a non-cargo-binstall fallback (#526) too, I think this option is good as is. We can discuss how to pass additional flags to cargo-binstall in another issue.