ci(util): fetch with requests and poll memory with psutil in the scripts (#1894)

[JarryShaw]

Please follow the guide below

• You will be asked some questions, please read them carefully and answer honestly

• Put an x into all the boxes [ ] relevant to your pull request (like that [x])

• Use Preview tab to see how your pull request will actually look like

• Searched for similar pull requests

• Followed the coding style (make pylint, make mypy, make isort)

• make test passes, and a test case covers the change. Narrow runs only, listed below.

• Added a changelog entry under docs/source/changelog/ and regenerated CHANGELOG.md, if the change is user-visible: N/A — centralised in docs(changelog): shared 1.5.0 changelog — long-lived, merges last (#610, #616, #617, #618, #620) #657

What is the purpose of your pull request?

Tick the commit type your subject line carries.

• fix — corrects a defect
• feat — adds a feature
• perf — changes performance, not behaviour
• refactor — changes neither behaviour nor performance
• test — tests only
• docs — documentation only
• ci — workflows or build tooling
• release — bumps the version or rolls up a distribution
• chore — anything else

These follow the owner's requests on #1885.

• requests: used by util/ci_timing.py, util/update_python_versions.py and examples/generators/pcapng.py. The pcapng generator keeps its retry, Retry-After and offline fallback. A test against loopback servers shows ci_timing.py still keeps the token off a redirect to another host.
• markdown-it-py: parse_images() reads the runner-images README table with it, so an escaped pipe stays in its cell.
• lxml: parse_junit() and the PDML read in util/pyshark_encap_map.py use it, through a parser that resolves no entities and makes no network access. There is no ElementTree fallback, and the tests that parse skip on GraalPy, which has no lxml wheel.
• psutil: util/vendor_test_gate.py samples the test run's process group with it, and falls back to ps on PyPy and GraalPy, which have no psutil wheel.
• Installs: the test extra gains these three packages. ci-timing.yml installs requests and lxml, and the detect job installs requests and markdown-it-py. update_python_versions.py publish still runs on a bare python3.
• Tests: each changed behaviour has a test that fails on the old code. tests/project and the tier guard pass.

Closes #1894

[JarryShaw]

Verdict: NEEDS CHANGES at fcbaf91c2. The one required change is a prose fix: a test docstring counts code items ("the same three errors"), and so does a module docstring ("the two binaries"). Both are being reworded. A Sonnet cross-review found no functional problems:

• Every job that loads a changed script installs what it imports. publish ran to completion on a bare python3 with requests, markdown-it-py, lxml and psutil blocked.
• The lxml parser resists every attack it tried: XXE in text or in an attribute, out-of-band parameter entities, a network DTD, billion laughs, malformed input and 5000-deep nesting. Nothing was read or fetched, and the JUnit output matches main's.
• psutil and ps report the same group memory. An access-denied member makes the sample unknown, and the memory-cap kill works with and without psutil.
• parse_images() returns the same images as before on the saved and the live runner-images README.
• The retry, Retry-After, 404 and redirect-token behaviour is unchanged against real local servers.
• The new tests fail on main. tests/project and the tier guard pass.

[JarryShaw]

Verdict: GOOD TO GO at 3549e071d. The amend changes only docstrings. With docstrings stripped, the ASTs of the three files match the previous head's.

The counts are gone: "three errors" in test_python_versions_update_1660.py, "the two binaries" in test_pyshark_encap_map.py, and "both of which" in util/ci_timing.py. A Sonnet scan of every added docstring and comment line found no other count of code items.

The three touched test files pass. Every functional finding from the review of fcbaf91c2 still holds.

[JarryShaw]

Verdict: GOOD TO GO at 3a7a1cd51. Since 3549e071d, the PR has changed in four ways:

• Pipfile: psutil, lxml and markdown-it-py are in [dev-packages], with the test extra's markers.
• CodeQL: the XXE canary is renamed from secret to canary. CodeQL now passes, and the PR has no open alerts.
• dev extra: the additions are reverted, since process.rst reserves dev for what the toolchain must resolve for pcapkit/.
• New test: tests/project/test_script_dependencies_1894.py keeps the test extra and the Pipfile in step.

Sonnet re-reviews checked each amend:

• the renamed tests' ASTs match apart from the identifier;
• pyproject.toml now differs from main only in the test extra;
• the new test fails against main's Pipfile;
• the touched test files, tests/project and the tier guard pass.

[github-actions]

Coverage: 90.07% (unit tier, Python 3.15, 3a7a1cd51, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	2	20	2	96.77%
pcapkit/const	19595	881	2618	867	92.11%
pcapkit/corekit	2504	70	792	36	96.54%
pcapkit/dumpkit	276	3	100	3	98.40%
pcapkit/foundation	2916	164	1016	34	93.59%
pcapkit/interface	138	7	52	5	93.68%
pcapkit/protocols	17411	224	4580	189	98.10%
pcapkit/toolkit	872	177	298	8	77.18%
pcapkit/utilities	522	2	158	4	99.12%
pcapkit/vendor	4431	2341	1018	156	43.64%

Per-file detail: the coverage-html artifact of this run.