[JarryShaw]

• Searched for similar pull requests
• Followed the coding style (make pylint, make mypy, make isort)
• make test passes, and a test case covers the change
• Changelog entry: N/A — centralised in docs(changelog): shared 1.5.0 changelog — long-lived, merges last (#610, #616, #617, #618, #620) #657

What is the purpose of your pull request?

• ci — workflows or build tooling

---

Description of your pull request and other information

The owner is moving three secrets out of the repository level and into environments:

• ANACONDA_TOKEN into anaconda;
• the PYPCAPKIT token and PYPCAPKIT_ACTIONS_DEPLOY_KEY into conda-tag.

create-release.yml already names these environments, but the cron jobs don't, so they would lose the secrets. This change names them:

• Conda Update conda-update, conda-tag → conda-tag; conda-dist → anaconda
• Vendor Update vendor-update → conda-tag

Test. The new tests/project/test_secret_environments_1968.py asserts that every job reading one of the three secrets names its environment. It fails without the workflow edit (4 SUBFAILED) and passes with it.

Docs. workflows.rst now lists the cron jobs and no longer cites create-release.yml by line; the matching RELEASE_CITATIONS pins are removed.

Deployment records. Each run of these jobs now records a deployment. environment: {name: …, deployment: false} would avoid that while keeping secret access (see GitHub's "Using environments without deployments"). Say if you'd prefer it.

Merge this before moving the secrets. An environment secret takes precedence over a repository secret of the same name. Add the secrets to the environments first, then delete the repository copies.

Part of #1968.

[JarryShaw]

GOOD TO GO at 7f0c4f250. A Sonnet review checked every secrets. read under .github: each job reading the three secrets now names the matching environment, and no secrets: inherit or reusable-workflow path reads them. anaconda and conda-tag have no protection rules and no branch policy, so the crons are not held. The new test fails without the workflow edit (4 failed) and passes with it. Every create-release.yml environment the dropped citation pins covered is still asserted elsewhere.

[github-actions]

Coverage: 91.52% (unit tier, Python 3.15, 7f0c4f250, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	4	20	2	95.16%
pcapkit/const	19597	881	2618	867	92.11%
pcapkit/corekit	2540	71	808	37	96.54%
pcapkit/dumpkit	276	3	100	3	98.40%
pcapkit/foundation	2918	23	1016	25	98.78%
pcapkit/interface	138	4	52	3	96.32%
pcapkit/protocols	17450	226	4598	191	98.09%
pcapkit/toolkit	872	36	298	10	95.21%
pcapkit/utilities	522	2	158	4	99.12%
pcapkit/vendor	4431	1995	1018	167	51.73%

Per-file detail: the coverage-html artifact of this run.