ci(matrix): split Python into supported 3.11-3.15 and non-blocking KTLO 3.8-3.10 (#1633)

[JarryShaw]

Please follow the guide below

• You will be asked some questions, please read them carefully and answer honestly

• Put an x into all the boxes [ ] relevant to your pull request (like that [x])

• Use Preview tab to see how your pull request will actually look like

• Searched for similar pull requests

• Followed the coding style (make pylint, make mypy, make isort)

• make test passes, and a test case covers the change

• Added a changelog entry under docs/source/changelog/ and regenerated CHANGELOG.md, if the change is user-visible — N/A — centralised in docs(changelog): shared 1.5.0 changelog — long-lived, merges last (#610, #616, #617, #618, #620) #657

What is the purpose of your pull request?

Tick the commit type your subject line carries.

• fix — corrects a defect
• feat — adds a feature
• perf — changes performance, not behaviour
• refactor — changes neither behaviour nor performance
• test — tests only
• docs — documentation only
• ci — workflows or build tooling
• release — bumps the version or rolls up a distribution
• chore — anything else

---

Description of your pull request and other information

Tiers. 3.11-3.15 now blocks in every matrix: unit tests, compatibility, conda and PyPI. Compat's schedule-only 3.15 job is gone. The KTLO tier is 3.10 (and pypy3.10) wherever it ran, plus 3.8/3.9 in test, integration and compat, which run on ubuntu-24.04. A KTLO leg never blocks. Jobs read through one needs.<job>.result (test, integration, pypcap-parity, pypi) keep a KTLO failure inside step-level continue-on-error: ${{ matrix.ktlo == true }} (unit-tests.yml:74-89). Compat uses the job-level form (python-compatibility.yml:39-61), and engine-tests runs its 3.10 cell as a separate step (unit-tests.yml:873). Every KTLO leg's name ends in (KTLO). 3.8/3.9 are not in engine-tests or pypcap-parity: both run on ubuntu-latest, which has no setup-python 26.04 build of either, and neither job was measured on them.

Release. PyPI completeness now counts only the 7 supported files (create-release.yml:256,285). Each KTLO leg records its outcome (:690), and Release status reports it as a notice (:1013). There is no conda 3.10 leg, because soupsieve==3.0.3 needs Python >=3.11.5. On conda 3.15, base keeps its own Python (:872, cron-conda.yml:288): setup-miniconda installs python-version into base, and conda has no py315 build.

Measured. python.org's release-cycle data lists 3.10 as end-of-life since 2026-10-01 and 3.15 at bugfix since 2026-10-09. In setup-python's manifest, the last Ubuntu with a build is 24.04 for 3.8 and 3.9, 22.04 for 3.7 and 20.04 for 3.6. On 3.8 and 3.9, .[test,DPKT,crypto,NGAP] installs and pcapkit imports. tests/corekit and tests/utilities gave 11 failures in 698 on 3.8 and 7 on 3.9, against 0 on 3.10 and 3.15. 3.6 and 3.7 are left out: 3.7 fails import pcapkit with a SyntaxError (corekit/io.py:103), and 3.6 has no setuptools>=61. Neither can install pytest>=8. In Docker, python=3.15 into base failed with "Conda cannot remove itself", and conda build --python 3.15 with base left alone built and imported pypcapkit-1.5.0b9-py315_0.

The classifiers list 3.11-3.15 only, since a version classifier claims support and KTLO does not. requires-python stays >=3.6, <4.

Ruleset 23497679, for the owner. No job emits Compat Python 3.10 any more (that leg is now Compat Python 3.10 (KTLO)), so this PR cannot meet the ruleset as it stands. Safe order: merge it with the owner bypass, then make ONE ruleset edit that removes Compat Python 3.10 and adds Compat Python 3.15. Adding 3.15 before the merge strands every other open PR, because their base does not emit that job.

New tests/project/test_python_matrix_tiers_1633.py has 17 tests. Against origin/main's workflows, pyproject.toml and util/ci_timing.py, 15 of them fail (pytest: 50 failed, counting subtests). Two read prose against the matrices: the leg counts in workflows.rst:247-250, and a denylist of retired claims (3.10 as CI's floor, 3.15 as allowed to fail, e.g. the benchmark's 3.15 note). All pass here, as do 21 regression files and the benchmark's TestPinsFile.

Closes #1633

[JarryShaw]

Verdict: GOOD TO GO at c7401aad0. Sonnet cross-review, two rounds; round 1 asked only for stale prose. I re-ran the new test myself: 17 OK, and 49 failures plus 1 error against origin/main's workflows, pyproject.toml and util/ci_timing.py. It merges cleanly with #1642, #1644 and #1641's next head.

Two things are yours to decide:

1. Ruleset. Compat Python 3.10 is now Compat Python 3.10 (KTLO), so this PR stays blocked until you merge it with bypass. Then remove Compat Python 3.10 and add Compat Python 3.15 in one edit.
2. Conda 3.10 is not built at all, rather than built as a non-blocking leg. The soupsieve==3.0.3 pin needs Python >= 3.11.5, so that leg could only fail. If you want it kept as KTLO anyway, that is a one-line matrix change.

Advisory, not blocking: a KTLO leg can still fail its job by hitting the job-level timeout. 3.15 conda and a full 3.15 test run are not verified locally.

[github-actions]

Coverage: 89.67% (unit tier, Python 3.14, 1f3f723bb, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	3	20	3	95.16%
pcapkit/const	18858	954	2366	868	91.06%
pcapkit/corekit	2366	67	760	35	96.48%
pcapkit/dumpkit	275	3	100	3	98.40%
pcapkit/foundation	2884	145	1010	35	94.14%
pcapkit/interface	138	7	52	5	93.68%
pcapkit/protocols	17166	226	4580	191	98.06%
pcapkit/toolkit	1046	166	386	5	82.61%
pcapkit/utilities	494	4	146	4	98.75%
pcapkit/vendor	4409	2342	1006	157	43.25%

Per-file detail: the coverage-html artifact of this run.

[JarryShaw]

Not ready yet. The 3.15 legs are blocking now, and they fail on two tests that the schedule-only leg had hidden:

• Python 3.15: a dir() pin that expects __cached__ (test(const): the lazy apptype dir() pin includes __cached__, which Python 3.15 does not set #1648).
• Integration Python 3.15: DecimalTimestamp loses orig_len when copied (fix(toolkit): a copied or unpickled DecimalTimestamp loses orig_len on Python 3.15 #1647).

Both are being fixed separately. This PR's own change is unaffected.

[JarryShaw]

The red 3.15 legs here predate their fixes, which are now on main as #1653 (1c5efaff9) and 9df91d4ae. I merged this PR into current main in a scratch tree, with fixtures generated, and ran:

• the two tests that failed on 3.15: test_const_apptype_lazy_1538_unit (14 passed) and test_engine_pcap_trace_runtime (13 passed);
• test_dpkt_timestamp_copy_1647_unit (4 passed);
• this PR's test_python_matrix_tiers_1633 (17 passed on 3.14).

All green on 3.15.0 and 3.14, and the merge is clean. With #1633 settled as option 1, this is ready for your bypass merge, followed by the one ruleset edit.

[JarryShaw]

Verdict: GOOD TO GO at 1f3f723bb. It is your merge of main into c7401aad0. Its tree is b0ceef616, the same tree I tested above: the 3.15 tests pass, and so does test_python_matrix_tiers_1633. Ready for your bypass merge, then the one ruleset edit.