PowderworksCode · zmaril · Aug 25, 2026 · Aug 25, 2026 · Aug 25, 2026 · Aug 25, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -38,3 +38,23 @@ jobs:
       # is first exercised by the tag that publishes, which is the one moment
       # a mistake cannot be taken back.
       - run: scripts/publish.sh --dry-run
+
+  # The action manifest is loaded by GitHub, not by cargo, so nothing above
+  # would notice a mistake in it. Until this job existed, `action.yml` was
+  # first exercised by whoever depended on it -- and a manifest that does not
+  # parse fails their build before a single step of ours runs, with an error
+  # naming a line in this repository. Same argument as the publish dry run.
+  #
+  # Findings are not the point here and do not fail the job: what is being
+  # proved is that the manifest loads, the install works, and the scan runs.
+  action:
+    name: action
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: ./
+        with:
+          token: ${{ github.token }}
+          fail-on-findings: "false"
+          fail-on-unused-markers: "false"
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -6,6 +6,8 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.1.2] - 2026-08-25
+
 ### Fixed
 
 - `install.sh` reported a refused request as a repository with no releases. The
@@ -21,6 +23,11 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
   happen and a scan that found something are both a red job ending in `exit
   code 1`; the action now annotates the first as an installation failure, and
   points at the `token` input when rate limiting is the cause.
+- `action.yml` loads again. The `token` input's description explained itself
+  with a live `${{ github.token }}`, and GitHub evaluates every expression it
+  finds in a manifest, descriptions included -- so the sentence documenting the
+  token stopped the action loading for everyone on `@main`. CI now uses the
+  action on every change, because nothing else here reads that file.
 
 ### Added
 
@@ -97,6 +104,7 @@ prebuilt archives for Linux (`x86_64`, `aarch64`, static musl) and macOS
   `[facts]`, `[effects]` or `[errors]` section is rejected with an error naming
   the rules that went away.
 
-[Unreleased]: https://github.com/PowderworksCode/straitjacket/compare/v0.1.1...HEAD
+[Unreleased]: https://github.com/PowderworksCode/straitjacket/compare/v0.1.2...HEAD
+[0.1.2]: https://github.com/PowderworksCode/straitjacket/compare/v0.1.1...v0.1.2
 [0.1.1]: https://github.com/PowderworksCode/straitjacket/compare/v0.1.0...v0.1.1
 [0.1.0]: https://github.com/PowderworksCode/straitjacket/releases/tag/v0.1.0
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "straitjacket"
-version = "0.1.1"
+version = "0.1.2"
 edition = "2024"
 description = "A fast, deterministic scanner that flags the weird code and text LLMs produce."
 license = "MIT"

diff --git a/README.md b/README.md
@@ -67,7 +67,7 @@ cargo install straitjacket
 ## GitHub Actions
 
 ```yaml
-- uses: PowderworksCode/straitjacket@v0.1.1
+- uses: PowderworksCode/straitjacket@v0.1.2
 ```
 
 That installs Straitjacket and scans the checked-out repository, failing the
@@ -81,7 +81,7 @@ permissions:
 
 steps:
   - uses: actions/checkout@v5
-  - uses: PowderworksCode/straitjacket@v0.1.1
+  - uses: PowderworksCode/straitjacket@v0.1.2
     with:
       sarif-file: straitjacket.sarif
       fail-on-findings: "false"
@@ -95,7 +95,7 @@ YAML rather than by assembling an argument string:
 
 | input | default | meaning |
 | --- | --- | --- |
-| `version` | `latest` | Release tag to install, such as `v0.1.1`. |
+| `version` | `latest` | Release tag to install, such as `v0.1.2`. |
 | `paths` | `.` | Files or directories to scan. |
 | `only` | none | Run only these rules. |
 | `skip` | none | Disable these rules. |
@@ -116,14 +116,14 @@ YAML rather than by assembling an argument string:
 these mean the same thing:
 
 ```yaml
-- uses: PowderworksCode/straitjacket@v0.1.1
+- uses: PowderworksCode/straitjacket@v0.1.2
   with:
     paths: src tests
     only: color,emoji
 ```
 
 ```yaml
-- uses: PowderworksCode/straitjacket@v0.1.1
+- uses: PowderworksCode/straitjacket@v0.1.2
   with:
     paths: |
       src

diff --git a/action.yml b/action.yml
@@ -78,8 +78,12 @@ inputs:
       Token used to read the release. Worth setting even for a public release:
       GitHub allows 60 unauthenticated API requests an hour per address and CI
       runners share addresses, so without one this eventually fails to install
-      at all. `${{ github.token }}` is enough; it needs no access to the
-      Straitjacket repository while that repository is public.
+      at all. The workflow's own `github.token` is enough; it needs no access
+      to the Straitjacket repository while that repository is public. (Written
+      here without the expression braces on purpose: GitHub evaluates every
+      expression it finds in this file, including the ones inside a
+      description, and refuses to load an action that names a context it does
+      not provide there.)
     required: false
     default: ""
 

diff --git a/site/content/rules.json b/site/content/rules.json
@@ -1,6 +1,6 @@
 {
   "schema": "straitjacket.rules/1",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "rules": [
     {
       "id": "color",