From 5f8663c1116386db20117b324c1de003673f7c9c Mon Sep 17 00:00:00 2001 From: Zack Maril Date: Tue, 25 Aug 2026 13:46:46 -0400 Subject: [PATCH 1/3] Stop the token documentation from breaking the manifest The `token` input's description explained itself with a live expression: `${{ github.token }}` is enough GitHub evaluates every expression it finds in a manifest, descriptions included, and `github` is not a context it provides where inputs are processed. So the action stopped loading: action.yml (Line: 77, Col: 18): Unrecognized named-value: 'github' Failed to load PowderworksCode/straitjacket/main/action.yml For a consumer on `@main` that is worse than a finding -- the job fails before its first step, with an error naming a line in this repository. The example now names `github.token` without the braces, and says why it cannot have them. Nothing here caught it because nothing here loads the manifest. `install-smoke` is the only workflow that does `uses: ./`, and it runs on `workflow_call` and `workflow_dispatch`, so the manifest was first exercised by whoever depended on it. CI now checks out and uses the action on every change, with findings and unused markers not failing the job: what is being proved is that the manifest loads, the install works, and the scan runs. Same argument the publish dry run already makes, applied to the other file no cargo command reads. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01361quprG7tUgaVFKAmKtJZ --- .github/workflows/ci.yml | 20 ++++++++++++++++++++ action.yml | 8 ++++++-- 2 files changed, 26 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a08ee22..3f324e7 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -38,3 +38,23 @@ jobs: # is first exercised by the tag that publishes, which is the one moment # a mistake cannot be taken back. - run: scripts/publish.sh --dry-run + + # The action manifest is loaded by GitHub, not by cargo, so nothing above + # would notice a mistake in it. Until this job existed, `action.yml` was + # first exercised by whoever depended on it -- and a manifest that does not + # parse fails their build before a single step of ours runs, with an error + # naming a line in this repository. Same argument as the publish dry run. + # + # Findings are not the point here and do not fail the job: what is being + # proved is that the manifest loads, the install works, and the scan runs. + action: + name: action + runs-on: ubuntu-latest + timeout-minutes: 10 + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + - uses: ./ + with: + token: ${{ github.token }} + fail-on-findings: "false" + fail-on-unused-markers: "false" diff --git a/action.yml b/action.yml index ce4ad28..d47cd28 100644 --- a/action.yml +++ b/action.yml @@ -78,8 +78,12 @@ inputs: Token used to read the release. Worth setting even for a public release: GitHub allows 60 unauthenticated API requests an hour per address and CI runners share addresses, so without one this eventually fails to install - at all. `${{ github.token }}` is enough; it needs no access to the - Straitjacket repository while that repository is public. + at all. The workflow's own `github.token` is enough; it needs no access + to the Straitjacket repository while that repository is public. (Written + here without the expression braces on purpose: GitHub evaluates every + expression it finds in this file, including the ones inside a + description, and refuses to load an action that names a context it does + not provide there.) required: false default: "" From 53945fa6ae28909fc79012716cb5dcbdc0015bef Mon Sep 17 00:00:00 2001 From: Zack Maril Date: Tue, 25 Aug 2026 14:06:58 -0400 Subject: [PATCH 2/3] Release 0.1.2 The manifest fix above is only useful once it is released, since the point of the release is that consumers can stop tracking `main`. The `Unreleased` section becomes 0.1.2 as it stands: the install failures that motivated all of this, plus the site, the rule manifest, and the documentation that had drifted. The README's examples move to `@v0.1.2`. They already recommended pinning; they were recommending a version that predates every fix in this entry. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01361quprG7tUgaVFKAmKtJZ --- CHANGELOG.md | 10 +++++++++- Cargo.lock | 2 +- Cargo.toml | 2 +- README.md | 10 +++++----- 4 files changed, 16 insertions(+), 8 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index ee44feb..291081a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,8 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). ## [Unreleased] +## [0.1.2] - 2026-08-25 + ### Fixed - `install.sh` reported a refused request as a repository with no releases. The @@ -21,6 +23,11 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). happen and a scan that found something are both a red job ending in `exit code 1`; the action now annotates the first as an installation failure, and points at the `token` input when rate limiting is the cause. +- `action.yml` loads again. The `token` input's description explained itself + with a live `${{ github.token }}`, and GitHub evaluates every expression it + finds in a manifest, descriptions included -- so the sentence documenting the + token stopped the action loading for everyone on `@main`. CI now uses the + action on every change, because nothing else here reads that file. ### Added @@ -97,6 +104,7 @@ prebuilt archives for Linux (`x86_64`, `aarch64`, static musl) and macOS `[facts]`, `[effects]` or `[errors]` section is rejected with an error naming the rules that went away. -[Unreleased]: https://github.com/PowderworksCode/straitjacket/compare/v0.1.1...HEAD +[Unreleased]: https://github.com/PowderworksCode/straitjacket/compare/v0.1.2...HEAD +[0.1.2]: https://github.com/PowderworksCode/straitjacket/compare/v0.1.1...v0.1.2 [0.1.1]: https://github.com/PowderworksCode/straitjacket/compare/v0.1.0...v0.1.1 [0.1.0]: https://github.com/PowderworksCode/straitjacket/releases/tag/v0.1.0 diff --git a/Cargo.lock b/Cargo.lock index 48febdb..2f30e0e 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -436,7 +436,7 @@ dependencies = [ [[package]] name = "straitjacket" -version = "0.1.1" +version = "0.1.2" dependencies = [ "anyhow", "clap", diff --git a/Cargo.toml b/Cargo.toml index 94abc29..93a7060 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "straitjacket" -version = "0.1.1" +version = "0.1.2" edition = "2024" description = "A fast, deterministic scanner that flags the weird code and text LLMs produce." license = "MIT" diff --git a/README.md b/README.md index 254e015..c0e735c 100644 --- a/README.md +++ b/README.md @@ -67,7 +67,7 @@ cargo install straitjacket ## GitHub Actions ```yaml -- uses: PowderworksCode/straitjacket@v0.1.1 +- uses: PowderworksCode/straitjacket@v0.1.2 ``` That installs Straitjacket and scans the checked-out repository, failing the @@ -81,7 +81,7 @@ permissions: steps: - uses: actions/checkout@v5 - - uses: PowderworksCode/straitjacket@v0.1.1 + - uses: PowderworksCode/straitjacket@v0.1.2 with: sarif-file: straitjacket.sarif fail-on-findings: "false" @@ -95,7 +95,7 @@ YAML rather than by assembling an argument string: | input | default | meaning | | --- | --- | --- | -| `version` | `latest` | Release tag to install, such as `v0.1.1`. | +| `version` | `latest` | Release tag to install, such as `v0.1.2`. | | `paths` | `.` | Files or directories to scan. | | `only` | none | Run only these rules. | | `skip` | none | Disable these rules. | @@ -116,14 +116,14 @@ YAML rather than by assembling an argument string: these mean the same thing: ```yaml -- uses: PowderworksCode/straitjacket@v0.1.1 +- uses: PowderworksCode/straitjacket@v0.1.2 with: paths: src tests only: color,emoji ``` ```yaml -- uses: PowderworksCode/straitjacket@v0.1.1 +- uses: PowderworksCode/straitjacket@v0.1.2 with: paths: | src From 4f5c054a655695334b9c6df8b55dce551ab7f642 Mon Sep 17 00:00:00 2001 From: Zack Maril Date: Tue, 25 Aug 2026 14:09:09 -0400 Subject: [PATCH 3/3] Re-export the rule manifest for 0.1.2 It carries the crate version, so a version bump makes it stale. --- site/content/rules.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/site/content/rules.json b/site/content/rules.json index bf3e0ac..7b480d9 100644 --- a/site/content/rules.json +++ b/site/content/rules.json @@ -1,6 +1,6 @@ { "schema": "straitjacket.rules/1", - "version": "0.1.1", + "version": "0.1.2", "rules": [ { "id": "color",