v0.3.1 — Marketplace-ready Action metadata

A metadata-only patch. No behavior change — if you are on 0.3.0, nothing about scanning differs.

Fixed

GitHub Marketplace caps an Action's description at 125 characters and refuses the release when it is longer. Ours was 128, so publishing was rejected at the form:

Scan MCP servers and skill bundles for tool poisoning, secret leaks, and silent rug-pulls; enforc... — Description must be less than 125 characters.

Shortened to 114, keeping toolprint.lock — the distinctive part, and the package-lock.json analogy the whole tool is built on:

Scan MCP servers and skill bundles for tool poisoning, secret leaks, and silent rug-pulls; enforce toolprint.lock.

Why this needed its own release

Marketplace validates action.yml at the release tag, not on the default branch. A commit to main could not fix it, and moving the v0.3.0 tag was not an option — npm had already published from it with a provenance attestation.

Guard

action/metadata.test.mjs now checks the Marketplace rules that are otherwise invisible until publish time: the 125-character description cap and the required branding icon/color. It was verified to fail against the old 128-character string rather than assumed to work. The gotcha is also recorded in the release process in CONTRIBUTING.md.

Upgrading

Workflows pinned to @v1 pick this up automatically — the tag has moved.

- uses: jestatsio/toolprint@v1

Full changelog: https://github.com/jestatsio/toolprint/blob/main/CHANGELOG.md