[JarryShaw]

• Searched for similar pull requests
• Followed the coding style (make pylint, make mypy, make isort)
• make test passes, and a test case covers the change
• Changelog entry: N/A — centralised in docs(changelog): shared 1.5.0 changelog — long-lived, merges last (#610, #616, #617, #618, #620) #657

What is the purpose of your pull request?

• ci — workflows or build tooling

---

Description of your pull request and other information

Step 2 of #1967 moves the repeated workflow shell into util/ scripts.

• util/leg_summary.py <ktlo|experimental> replaces the copies of the jq summary in the KTLO summary steps of unit-tests.yml (test, integration, pypcap-parity) and of python-compatibility.yml, and in experimental.yml's Experimental summary. It runs on the image's python3, not on the leg's interpreter.
• util/classify_changes.py replaces the copy of Classify the diff that the changes jobs of unit-tests.yml and experimental.yml both carried.
• util/coverage_report.py replaces Report coverage's data check, combine/report commands and summary table.

Behaviour changes:

• Both changes jobs now check out on every event, because the script lives in the tree.
• A KTLO leg whose checkout failed can no longer print its summary. It still ends green.

Tests: tests/project/test_workflow_scripts_1967.py runs each script end to end. The existing pins now exercise the scripts rather than the inline shell. Breaking any one script fails the new tests. All of tests/project passes.

Left for later steps:

• create-release.yml's pypi job keeps an inline KTLO summary. A test holds it identical to the script until ruling C moves it.
• The renumbered file.yml:N citations in workflows.rst and releasing.rst become step-name citations in step 6.

Part of #1967.

[github-actions]

Coverage: 91.52% (unit tier, Python 3.15, 4c3ce4b86, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	4	20	2	95.16%
pcapkit/const	19597	881	2618	867	92.11%
pcapkit/corekit	2540	71	808	37	96.54%
pcapkit/dumpkit	276	3	100	3	98.40%
pcapkit/foundation	2918	23	1016	25	98.78%
pcapkit/interface	138	4	52	3	96.32%
pcapkit/protocols	17450	226	4598	191	98.09%
pcapkit/toolkit	872	36	298	10	95.21%
pcapkit/utilities	522	2	158	4	99.12%
pcapkit/vendor	4431	1995	1018	167	51.73%

Per-file detail: the coverage-html artifact of this run.

[JarryShaw]

GOOD TO GO at a38196c0c. Two Sonnet reviews split the PR:

• Equivalence. classify_changes.py is a line-for-line copy of the inline block. Fed the same three-step input, old jq and leg_summary.py printed byte-identical annotations and job summaries. coverage_report.py keeps the ci(unit-tests): coverage combine can silently miss a worker's data file, under-reporting a PR's coverage #1387 check before combine, plus the same commands, exit code and 9-character sha. That last part was checked by reading the code, not by running it.
• Call sites. All twelve script-running steps have a checkout earlier in their job. Their if:, env:, shell: and continue-on-error are unchanged, and every runner is Ubuntu. The four pin files pass. Forcing code=false in the classifier fails two tests. The renumbered citations spot-checked correctly.

One finding dismissed: unit-tests.yml:367-384 in workflows.rst deliberately cites the KTLO-tier comment that explains the continue-on-error mechanism, and TestDocCitationsResolve pins that anchor. Step 6 converts these citations to names.

[JarryShaw]

Ready on its own, but it conflicts with #1993 in workflows.rst: #1993 drops the create-release.yml:N citations in the Deployment environment: list, and this PR renumbers them. Merge either one; I'll rebase the other.

[JarryShaw]

resolve conflicts

[JarryShaw]

Rebased onto main as 4c3ce4b86. The conflict was with my 279f3f0bd, which added the .. _Action Pins: target that this PR's new "Workflow Scripts" section sits above. Both are kept, and git range-diff shows the PR's own patch unchanged apart from that context, so the GOOD TO GO verdict carries over.

The workflows.rst-reading tests and the script pins pass (351 passed), and Action Pins_ still resolves. #1993 will need the same rebase after this lands.