[JarryShaw]

• Searched for similar pull requests
• Followed the coding style (make pylint, make mypy, make isort)
• make test passes, and a test case covers the change
• Added a changelog entry — N/A — centralised in docs(changelog): shared 1.5.0 changelog — long-lived, merges last (#610, #616, #617, #618, #620) #657

What is the purpose of your pull request?

• ci — workflows or build tooling

---

Description of your pull request and other information

#1967, per the owner's ruling. Stacked on #2037, so review only the top commit.

• Lint's actionlint step loses its continue-on-error, so a finding turns the Lint job red. It still exits with actionlint's own status, and the binary stays pinned by version and sha256.
• The step moves to the end of the job behind if: ${{ !cancelled() }}. A finding therefore cannot skip bandit, mypy, vermin or pylint, which stay advisory, and a failed setup does not skip actionlint.
• The step and header comments and workflows.rst now say it blocks. Every finding was fixed in ci: fix shellcheck findings and trim workflow comments (#1967) #2023, ci: fix shellcheck findings and trim comments in unit-tests.yml (#1967) #2037 and ci: trim comments in experimental.yml (#1967) #2038. The risk that remains is that the image's shellcheck version can drift.
• New TestItBlocks pins the change: no continue-on-error, no ||, an exit with actionlint's status, and no step after it that a finding could skip.

The pin fails on #2037's lint.yml (3 failed) and passes here (11 passed). actionlint 1.7.12 with the step's -ignore reports nothing on .github/workflows. The 48 files that read lint.yml or the contributing docs give 984 passed.

Note: Lint is not a required check in ruleset 23497679, so a red Lint does not hold a merge. That question is on #1967.

[JarryShaw]

GOOD TO GO at e7c1f521e (Sonnet cross-review).

• No continue-on-error, no || true, and the step exits with PIPESTATUS[0].
• The four advisory steps run before it and stay continue-on-error, so a finding skips nothing.
• The version and sha256 pin is unchanged.
• The pin fails on ci: fix shellcheck findings and trim comments in unit-tests.yml (#1967) #2037's lint.yml (3 failed).

Known risk, not blocking: a GitHub release-download outage would now also turn Lint red.

[github-actions]

Coverage: 91.54% (unit tier, Python 3.15, e54eeaad2, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	4	20	2	95.16%
pcapkit/const	19599	881	2618	867	92.11%
pcapkit/corekit	2567	71	816	37	96.57%
pcapkit/dumpkit	282	3	102	3	98.44%
pcapkit/foundation	2930	23	1022	25	98.79%
pcapkit/interface	138	4	52	3	96.32%
pcapkit/protocols	17436	219	4582	185	98.15%
pcapkit/toolkit	872	36	298	10	95.21%
pcapkit/utilities	529	7	160	5	98.26%
pcapkit/vendor	4431	1995	1018	167	51.73%

Per-file detail: the coverage-html artifact of this run.

[JarryShaw]

Ordering check on e7c1f521e: the project leg (util/run_unittest_leg.py project) ran 1762 tests, OK (71 skipped). CI: 63 checks green, 0 failing. KTLO 3.8, 3.9 and 3.10 legs: 0 failing tests. Ready to merge after #2037. Once it lands, I add Lint to the ruleset (#1967).

[JarryShaw]

Rebase only, no new changes: e7c1f521e → 113460382. This rebase has stacked on #2037, moved onto its new head. No conflicts, and the patch-id is identical.

CI on the previous head e7c1f521e: 63 checks green, 0 failing; the KTLO legs fail 0 tests. The GOOD TO GO verdict carries over. You can bypass checks and merge.

[JarryShaw]

Rebase only, no new changes: 113460382 → 5845cd429. This is stacked on #2037 and moved onto its new head. No conflicts, and the patch-id is identical.

The head e7c1f521e, with the same patch, was fully green, with 0 failing KTLO tests and an ordering leg of 1762 OK. The GOOD TO GO verdict carries over. You can bypass checks and merge after #2037.

[JarryShaw]

Rebase only, no new changes: 5845cd429 → 275f0cf88. It is stacked on #2037 and moved onto that PR's new head. There were no conflicts, and the patch-id is identical.

The head e7c1f521e carried the same patch and was fully green, with 0 failing KTLO tests and an ordering leg of 1762 OK. The GOOD TO GO verdict carries over. You can bypass checks and merge after #2037.

[JarryShaw]

Rebase only, no new changes: 275f0cf88 → e54eeaad2, moved onto main after #2037 merged. No conflicts, and the patch-id is identical. The diff is now this PR's own four files.

The head e7c1f521e carried the same patch and was fully green, with 0 failing KTLO tests and an ordering leg of 1762 OK. The GOOD TO GO verdict carries over. You can bypass checks and merge. Once it lands, I'll add Lint to the ruleset (#1967).