test(project-status): guard container/services options and working-directory against expressions (#1077)

[JarryShaw]

• Searched for similar pull requests
• Followed the coding style (make pylint, make mypy, make isort) — not run; pycodestyle and pylint E/W on the file show nothing new
• make test passes, and a test case covers the change — tests/project passes (379 passed, 1 skipped); full suite not run
• Added a changelog entry — N/A — centralised in docs(changelog): shared 1.5.0 changelog — long-lived, merges last (#610, #616, #617, #618, #620) #657

What is the purpose of your pull request?

• test — tests only

---

Description of your pull request and other information

The project-status.yml guard now rejects ${{ }} under jobs.<id>.container.options, jobs.<id>.services.<id>.options and working-directory (step and defaults.run), as well as run:/shell:. It matches by path suffix rather than last key, because options and working-directory are also legal env: names, and env: is the safe channel. The workflow itself does not change.

Tests: one rejected and one literal fixture per key, plus an env: options: case that must pass. All are cross-checked against yaml.safe_load (ran, PyYAML 6.0.3). With the guard reverted, the five new positive subtests fail (the expression in options:/working-directory: went unseen). The scan() docstrings no longer claim PyYAML is in no extra (see #1078).

Closes #1077

[JarryShaw]

Cross-review verdict on 623ee367f: GOOD TO GO (ran on Sonnet; author Opus)

• Coverage. 19 constructed workflows went through guard_trips. All of these trip:

  • block-style container.options and services.<id>.options;
  • their flow-style forms, which fail closed as UnsupportedYAML;
  • step working-directory and workflow- or job-level defaults.run.working-directory;
  • a quoted 'options': key.

  These do not trip: with: inputs named working-directory, and env: names options at step, job or container level.

• Fail-without-fix. Reverting only the expression_spliced call sites makes the 5 new positive subtests fail.

• Real workflows. The YAML agreement holds on all 11 fixtures. No real workflow trips; both existing working-directory: uses are literals.

• Tests. tests/project: 379 passed, 1 skipped.

• External check (mine). GitHub's context-availability table allows github, inputs and other contexts in steps.working-directory and jobs.<id>.defaults.run, and in the container/services mappings. So these are real expression sites.

• Out of test(project-status): extend the injection guard to container.options, services options and working-directory #1077's scope, not flagged: container: ${{ … }} as a plain image string, and image:/volumes: keys.

[github-actions]

Coverage: 88.74% (unit tier, Python 3.14, 623ee367f, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	4	20	4	93.55%
pcapkit/const	18757	1035	2342	846	90.23%
pcapkit/corekit	1874	91	578	22	94.33%
pcapkit/dumpkit	136	0	40	0	100.00%
pcapkit/foundation	2422	143	842	34	92.62%
pcapkit/interface	112	7	40	5	92.11%
pcapkit/protocols	15653	187	3942	162	98.19%
pcapkit/toolkit	487	71	144	3	84.15%
pcapkit/utilities	429	4	122	4	98.55%
pcapkit/vendor	4409	2359	1006	158	42.84%

Per-file detail: the coverage-html artifact of this run.