[JarryShaw]

• Searched for similar pull requests
• Followed the coding style (make pylint, make mypy, make isort)
• make test passes, and a test case covers the change
• Added a changelog entry — N/A — centralised in docs(changelog): shared 1.5.0 changelog — long-lived, merges last (#610, #616, #617, #618, #620) #657

What is the purpose of your pull request?

• ci — workflows or build tooling

---

Description of your pull request and other information

#2030 PR 3. Stacked on #2033, so review only the top commit. Draft: cron-conda also runs on workflow_run after pushes, so its push mode depends on the open "warned" question on #2030.

• cron-python-versions.yml, scheduled only: detect writes a report from plan.json. The report lists tier moves, regenerated files, ruleset edits, notes, audit and PR outcome. A discussion job posts it in scheduled mode to cron-python-versions: Python version update report. That job holds only contents: read and discussions: write, and it does not wait for pr, which waits on environment approval.
• cron-conda.yml: conda-update reports pin notices and warnings, changed files and the pushed build. The discussion job adds the tag and upload results. It uses ci: post CI reports to a Discussions thread per job (#2030) #2033's event-to-mode mapping and gate-failure path, posting to cron-conda: conda distribution update report. Refresh the platform pins now tees its output under pipefail, and a test pins that a failing refresh still fails the step.
• deploy-pages, project-status and codeql-analysis are not wired. They produce no report a thread adds to.

Pins fail on #2033's workflows (46 failed) and pass here (25 passed). Every file naming these workflows or reading workflows.rst gives 900 passed.

Open: in push mode an overdue pin warning would post on every verified main push until it is renewed.

[JarryShaw]

GOOD TO GO at 4720eb4c1 (Sonnet cross-review). The open item is the #2030 "warned" rule, which reaches only cron-conda's push mode.

• Only the discussion jobs gain write scopes.
• Refresh's exit status is unchanged against a stand-in that exits 1. pipefail is what stops tee from masking it.
• cron-conda's gating matches ci: post CI reports to a Discussions thread per job (#2030) #2033's, and nothing consumes this workflow.
• cron-python-versions reads plan.json through a quoted heredoc and env, and does not wait for pr.
• The edited pins only tighten.

[github-actions]

Coverage: 91.54% (unit tier, Python 3.15, 885a65ead, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	4	20	2	95.16%
pcapkit/const	19599	881	2618	867	92.11%
pcapkit/corekit	2567	71	816	37	96.57%
pcapkit/dumpkit	282	3	102	3	98.44%
pcapkit/foundation	2930	23	1022	25	98.79%
pcapkit/interface	138	4	52	3	96.32%
pcapkit/protocols	17436	219	4582	185	98.15%
pcapkit/toolkit	872	36	298	10	95.21%
pcapkit/utilities	529	7	160	5	98.26%
pcapkit/vendor	4431	1995	1018	167	51.73%

Per-file detail: the coverage-html artifact of this run.

[JarryShaw]

Rebased onto #2033's new head as a15bad87b. range-diff shows only context lines moved, from #2031's new util/pip_install.py row; this PR's own hunks are unchanged. Still stacked on #2033 and still a draft pending #2030.

[JarryShaw]

Rebased onto #2033's new head: a15bad87b → 0b49669c3. I resolved the conflict with #2035 in cron-conda.yml's Refresh the platform pins comment by keeping both sentences, #2028's and #2030's. range-diff: no other change besides context lines. The tests that read cron-conda.yml and cron-python-versions.yml: 631 passed. Still a draft until #2033 lands.

[JarryShaw]

Rebase only, no new changes: 0b49669c3 → a967bea0c, moved onto main after #2033 merged. No conflicts, and the patch-id is identical. This PR is still a draft; I'll undraft it once its CI is green.

[JarryShaw]

Rebased onto main after #2034 merged: a967bea0c → 885a65ead. #2034's apt_packages.py row conflicted with this PR's edit to the discussion_report.py row in workflows.rst's scripts table. I kept both. The code patch-id is identical (outside docs/), and the tests that read workflows.rst or discussion_report pass (378). This is still a draft; I'll undraft it once its CI is green.

[JarryShaw]

ready for review?

[JarryShaw]

Yes. 885a65ead has a GOOD TO GO verdict and CI green: 57 checks, 0 failing. Only the Required checks passed roll-up was still queued. I am moving it out of draft now. The local ordering check is still queued behind #2049 and #2050, and I will post the result when it lands.

[JarryShaw]

Ordering check on 885a65ead: the project leg (util/run_unittest_leg.py project) ran 1830 tests, OK (71 skipped). CI: 59 checks green, 0 failing. KTLO 3.8, 3.9 and 3.10 legs: 0 failing tests. Ready to merge.