[JarryShaw]

• Searched for similar pull requests
• Followed the coding style (make pylint, make mypy, make isort)
• make test passes, and a test case covers the change
• Added a changelog entry — N/A — centralised in docs(changelog): shared 1.5.0 changelog — long-lived, merges last (#610, #616, #617, #618, #620) #657

What is the purpose of your pull request?

• ci — changes to CI configuration files and scripts

---

Description of your pull request and other information

Step 5 of #1967 (comment trim, job by job), for project-status.yml. Comments only; the file stays semantically identical, checked with yaml.safe_load against main.

• Cut: text that process.rst's "Milestones and the Project Board" section already says. That covers the built-in board workflows, the test that holds the table to the file, and the PROJECT_TOKEN setup; the header now points there instead.
• Moved: the reconcile-race note now sits beside the concurrency: key it explains.
• Kept in substance, some reworded: the security notes (the pull-request-target risk and the three rules), the workflow_dispatch trust argument, the cron backstop and its timing, permissions: {}, timeout-minutes, and the GitHub concurrency docs link.

No test pins this file's comment text. Every workflow-reading test in tests/project passes (775 passed), and pinned actionlint 1.7.12 exits 0 with Lint's ignore list.

[JarryShaw]

GOOD TO GO at f3835f07e (Sonnet cross-review). Every changed line is a comment: with comments stripped the file is byte-identical, and yaml.safe_load compares equal.

• Duplicates: each removed claim is in process.rst's "Milestones and the Project Board": the built-in workflows, the test holding the table to the file, and the PROJECT_TOKEN setup.
• Kept: the security reasoning and its three rules, the workflow_dispatch trust, the concurrency reasoning with its GitHub docs URL, the cron backstop with its ci: divide and simplify the workflows into scripts, shared heads and smaller files #1967 ref, permissions: {} and timeout-minutes.
• Citations: none removed.
• PR body: corrected to "kept in substance, some reworded" for the security notes, per the reviewer.

[JarryShaw]

Ready to merge at f3835f07e: the review is GOOD TO GO and CI is complete (56 passed, 0 failed). The ordering leg ran 1930 tests with 0 failures, and the 3.8–3.10 KTLO legs show 0 failing tests. The branch is two commits behind main (#2053 and #2058), and neither touches project-status.yml. I merged it into current main (c98541f84) in a scratch tree, and the project-status, actionlint and workflow-reader tests there give 164 passed.

[github-actions]

Coverage: 91.52% (unit tier, Python 3.15, f3835f07e, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	4	20	2	95.16%
pcapkit/const	19599	881	2618	867	92.11%
pcapkit/corekit	2565	71	812	37	96.56%
pcapkit/dumpkit	282	3	102	3	98.44%
pcapkit/foundation	2930	23	1022	25	98.79%
pcapkit/interface	138	4	52	3	96.32%
pcapkit/protocols	17414	219	4574	185	98.14%
pcapkit/toolkit	869	36	298	10	95.20%
pcapkit/utilities	473	7	136	5	98.03%
pcapkit/vendor	4431	1995	1018	167	51.73%

Per-file detail: the coverage-html artifact of this run.