From 7da03b9e0fe70bf8ce72a156a2fe51213dac98e4 Mon Sep 17 00:00:00 2001 From: Zack Maril Date: Tue, 25 Aug 2026 14:28:28 -0400 Subject: [PATCH] Release 0.1.3: pass our own rules The v0.1.2 release failed its smoke test. Not the install -- that worked on both platforms -- but the scan that follows it, which runs straitjacket over this repository with findings fatal, and found three: site/wrangler.toml:11:1 [no-comments] site/wrangler.toml:21:1 [no-comments] site/wrangler.toml:22:1 [no-comments] A header one line past the ten it is allowed, and two more beside the setting they described. The reasoning is worth keeping, so it is folded into the header rather than deleted, and `run_worker_first` is explained where the header explains everything else about this file. The `action` job added yesterday ran the same scan and passed, because I had it ignore findings -- the manifest was what I wanted proved. So the first thing to notice was the release, after the tag was pushed and the release published. It fails on findings now. A check that catches this has to run where it can still be fixed. v0.1.2 stays as it is. Its archives are built, published, and install correctly; only the crates.io step was skipped, which 0.1.3 does. Moving a tag people can already install from is worse than spending a version. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01361quprG7tUgaVFKAmKtJZ --- .github/workflows/ci.yml | 8 ++++---- CHANGELOG.md | 16 +++++++++++++++- Cargo.lock | 2 +- Cargo.toml | 2 +- README.md | 10 +++++----- site/content/rules.json | 2 +- site/wrangler.toml | 23 ++++++++++------------- 7 files changed, 37 insertions(+), 26 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 3f324e7..35b0efb 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -45,8 +45,10 @@ jobs: # parse fails their build before a single step of ours runs, with an error # naming a line in this repository. Same argument as the publish dry run. # - # Findings are not the point here and do not fail the job: what is being - # proved is that the manifest loads, the install works, and the scan runs. + # It fails on findings, because the release smoke test does, and a finding + # that only surfaces there surfaces after the tag is pushed -- which is + # exactly what happened to v0.1.2. This job is the same scan, run early + # enough to be fixable. action: name: action runs-on: ubuntu-latest @@ -56,5 +58,3 @@ jobs: - uses: ./ with: token: ${{ github.token }} - fail-on-findings: "false" - fail-on-unused-markers: "false" diff --git a/CHANGELOG.md b/CHANGELOG.md index 291081a..cf4f640 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,19 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). ## [Unreleased] +## [0.1.3] - 2026-08-25 + +### Fixed + +- Straitjacket passes its own `no-comments` rule again. `site/wrangler.toml` + explained itself in three lines the rule does not allow -- one past the ten + the file header gets, and two more down beside the setting they described. + The reasoning is intact, folded into the header. +- The `action` CI job fails on findings. It did not, so the first thing to + notice the above was the release smoke test, after the tag was pushed and + after the release was published. The check that catches a finding has to run + where a finding can still be fixed. + ## [0.1.2] - 2026-08-25 ### Fixed @@ -104,7 +117,8 @@ prebuilt archives for Linux (`x86_64`, `aarch64`, static musl) and macOS `[facts]`, `[effects]` or `[errors]` section is rejected with an error naming the rules that went away. -[Unreleased]: https://github.com/PowderworksCode/straitjacket/compare/v0.1.2...HEAD +[Unreleased]: https://github.com/PowderworksCode/straitjacket/compare/v0.1.3...HEAD +[0.1.3]: https://github.com/PowderworksCode/straitjacket/compare/v0.1.2...v0.1.3 [0.1.2]: https://github.com/PowderworksCode/straitjacket/compare/v0.1.1...v0.1.2 [0.1.1]: https://github.com/PowderworksCode/straitjacket/compare/v0.1.0...v0.1.1 [0.1.0]: https://github.com/PowderworksCode/straitjacket/releases/tag/v0.1.0 diff --git a/Cargo.lock b/Cargo.lock index 2f30e0e..10e1558 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -436,7 +436,7 @@ dependencies = [ [[package]] name = "straitjacket" -version = "0.1.2" +version = "0.1.3" dependencies = [ "anyhow", "clap", diff --git a/Cargo.toml b/Cargo.toml index 93a7060..218a6c5 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "straitjacket" -version = "0.1.2" +version = "0.1.3" edition = "2024" description = "A fast, deterministic scanner that flags the weird code and text LLMs produce." license = "MIT" diff --git a/README.md b/README.md index c0e735c..bab26f3 100644 --- a/README.md +++ b/README.md @@ -67,7 +67,7 @@ cargo install straitjacket ## GitHub Actions ```yaml -- uses: PowderworksCode/straitjacket@v0.1.2 +- uses: PowderworksCode/straitjacket@v0.1.3 ``` That installs Straitjacket and scans the checked-out repository, failing the @@ -81,7 +81,7 @@ permissions: steps: - uses: actions/checkout@v5 - - uses: PowderworksCode/straitjacket@v0.1.2 + - uses: PowderworksCode/straitjacket@v0.1.3 with: sarif-file: straitjacket.sarif fail-on-findings: "false" @@ -95,7 +95,7 @@ YAML rather than by assembling an argument string: | input | default | meaning | | --- | --- | --- | -| `version` | `latest` | Release tag to install, such as `v0.1.2`. | +| `version` | `latest` | Release tag to install, such as `v0.1.3`. | | `paths` | `.` | Files or directories to scan. | | `only` | none | Run only these rules. | | `skip` | none | Disable these rules. | @@ -116,14 +116,14 @@ YAML rather than by assembling an argument string: these mean the same thing: ```yaml -- uses: PowderworksCode/straitjacket@v0.1.2 +- uses: PowderworksCode/straitjacket@v0.1.3 with: paths: src tests only: color,emoji ``` ```yaml -- uses: PowderworksCode/straitjacket@v0.1.2 +- uses: PowderworksCode/straitjacket@v0.1.3 with: paths: | src diff --git a/site/content/rules.json b/site/content/rules.json index 7b480d9..2331f57 100644 --- a/site/content/rules.json +++ b/site/content/rules.json @@ -1,6 +1,6 @@ { "schema": "straitjacket.rules/1", - "version": "0.1.2", + "version": "0.1.3", "rules": [ { "id": "color", diff --git a/site/wrangler.toml b/site/wrangler.toml index 576e053..e4753d5 100644 --- a/site/wrangler.toml +++ b/site/wrangler.toml @@ -1,14 +1,13 @@ -# Cloudflare Workers config for the straitjacket docs site. -# -# The site is a Next.js static export (`output: 'export'` -> ./out), deployed -# as a Worker over static assets. The worker exists for one job: when an agent -# asks for a docs page with `Accept: text/markdown`, it serves that page's -# markdown twin (the /llms.mdx/... assets) instead of the HTML. Everything -# else passes straight through to the assets, untouched. -# -# Workers Build settings — root directory `site`, build `bun run build`, deploy -# `bun run deploy`. Both go through package.json so wrangler comes from the -# lockfile; `npx wrangler` would fetch whatever is newest at deploy time. +# Cloudflare Workers config for the straitjacket docs site: a Next.js static +# export (`output: 'export'` -> ./out) served as a Worker over static assets. +# The worker exists for one job -- when an agent asks for a docs page with +# `Accept: text/markdown`, it serves that page's markdown twin (the +# /llms.mdx/... assets) instead of the HTML -- which is why `run_worker_first` +# below lists only /docs: every other path is served from assets without +# invoking the worker at all. Workers Build settings are root directory +# `site`, build `bun run build`, deploy `bun run deploy`; both go through +# package.json so wrangler comes from the lockfile, where `npx wrangler` +# would fetch whatever is newest at deploy time. name = "straitjacket" main = "worker.ts" compatibility_date = "2026-07-01" @@ -18,6 +17,4 @@ directory = "./out" not_found_handling = "404-page" binding = "ASSETS" -# Only docs pages can negotiate; every other path is served from assets -# without invoking the worker at all. run_worker_first = ["/docs", "/docs/*"]