Fix the manifest, and release 0.1.2

[zmaril]

The action does not load at all right now. Every repository on @main — cratebank, immersion, langbank — fails before its first step:

##[error]PowderworksCode/straitjacket/main/action.yml (Line: 77, Col: 18): Unrecognized named-value: 'github'
##[error]Failed to load PowderworksCode/straitjacket/main/action.yml

The cause

The token input's description explained itself with a live expression:

  token:
    description: >-
      … `${{ github.token }}` is enough; …

GitHub evaluates every ${{ }} in a manifest — including inside a description — and github is not a context it provides where inputs are processed. The sentence explaining the token is what stops the action loading.

It now names github.token without the braces, with a comment saying why it cannot have them. No other expression in the file sits outside runs: and outputs:.

Why nothing caught it

action.yml is loaded by GitHub and read by no cargo command, so gate cannot see it. install-smoke is the only workflow that does uses: ./, and it runs on workflow_call and workflow_dispatch — so nothing on a pull request loads the manifest, and it was first exercised by a consumer.

That is the failure shape the CI file already argues against one job up:

The publish path runs on every change, uploading nothing. Otherwise it is first exercised by the tag that publishes, which is the one moment a mistake cannot be taken back.

CI now checks out and uses the action on every change, with fail-on-findings: false and fail-on-unused-markers: false. Findings are not the point; what is proved is that the manifest loads, the install works, and the scan runs. The action job here is the verification — only GitHub can validate a manifest. It passed:

Run ./
straitjacket: installed v0.1.1 to …/straitjacket-bin/straitjacket
straitjacket: using config …/straitjacket.toml
straitjacket: 3 error(s), 0 warning(s) across 91 file(s); 105 suppressed

Against current main that job dies at "Set up job".

And a release

A fix to the manifest only helps once consumers can stop tracking main, which means a tag. Unreleased becomes 0.1.2 as it stands — the install failures that motivated all of this, plus the site, the rule manifest, and the documentation that had drifted. The README's examples move to @v0.1.2; they already recommended pinning, to a version that predates every fix in the entry.

cargo fmt, clippy -D warnings, 53 tests, and scripts/publish.sh --dry-run all pass locally on 0.1.2.

After this merges: tag v0.1.2, then pin cratebank (and immersion and langbank, which are broken the same way) to it.

🤖 Generated with Claude Code

https://claude.ai/code/session_01361quprG7tUgaVFKAmKtJZ