[JarryShaw]

• Searched for similar pull requests
• Followed the coding style (make pylint, make mypy, make isort)
• make test passes, and a test case covers the change
• Added a changelog entry — N/A — centralised in docs(changelog): shared 1.5.0 changelog — long-lived, merges last (#610, #616, #617, #618, #620) #657

What is the purpose of your pull request?

• ci — changes to CI configuration files and scripts

---

Description of your pull request and other information

The first batch of step 2's remainder in #1967: create-release.yml's repeated inline shell moves into util/. Only the run: lines change; every env:, if:, shell: and continue-on-error is untouched.

• util/release_tags.py check: replaces the three identical copies of Check the release tags name this run's commit in github, pypi and conda.
• util/release_tags.py owner: replaces Check which commit the version's tag names in version_check. It shares the same tag lookup, so the two can't read a tag differently.
• util/release_upload.py: replaces the two copies of Upload package to GitHub Release in pypi and conda.
• Script properties: both are standard library only, Python 3.7-parseable, and use _actions. Each job checks out the whole tree before the step, and a test pins that.
• Behaviour preserved:
  • Exit codes: a failing git/gh exits with its status, a signal as 128+N, a missing binary as 127, and an unset variable as 1.
  • Output: annotations are written unescaped, exactly as echo wrote them. $GITHUB_OUTPUT keys are the same, and output is flushed before every call.
  • Upload globbing: it splits like the shell's unquoted $pattern, including the no-match fallback.
  • The one dropped case: the old ${PCAPKIT_TAGS} also glob-expanded *?[. A tag is v or conda- plus a PEP 440 version, so it never contains those characters.
• Same output as the old shell: the new tests/project/test_release_scripts_1967.py embeds main's shell verbatim and runs it under bash -eo pipefail next to each script, using stand-in git/gh. It requires the same status, stdout, stderr, $GITHUB_OUTPUT and calls across 9 tag-check, 6 owner and 15 upload cases. A guard confirms those cases reach every exit path.
• Updated tests:
  • test_release_tags_the_run_sha_1634 runs the scripts.
  • test_release_gates' PUBLISHING_MARKERS now matches util/release_upload.py, so the environment gate still sees the upload.
  • test_actions_helper_2047 lists both scripts.
• Docs: workflows.rst gains both scripts' rows and a sentence on their interpreter.
• Results: the release, gate, helper and docs tests give 302 passed. Without the scripts, 64 tests fail.

[JarryShaw]

GOOD TO GO at 4ccea5ad6 (Sonnet cross-review).

• Workflow diff: a YAML-level diff of create-release.yml shows exactly six run: values changed. Every env:, if:, shell:, continue-on-error, permission, environment: and comment is identical.
• Checkout first: each job using a new script checks out github.sha in full before the step.
• Old vs new: the reviewer ran its own 49 cases of main's shell against the scripts (CRLF, empty input, unset variables, failing git/gh, extra gh columns, duplicate names, spaces and non-ASCII in filenames). Status, stdout, $GITHUB_OUTPUT and calls all match. Only the stderr wording differs on an unset variable.
• The equivalence test: it embeds main's shell byte for byte, and it went red under all six breakages the reviewer planted.
• Not reachable by the release: two glob edge cases differ, [^a] and a leading-. pattern. The workflow's patterns are dist/* and the conda output paths, so neither can fire.
• Unconfirmed: python3 on the macos-26-intel image before setup-python, though the job already relies on it on macos-latest.

[github-actions]

Coverage: 91.52% (unit tier, Python 3.15, 4ccea5ad6, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	4	20	2	95.16%
pcapkit/const	19599	881	2618	867	92.11%
pcapkit/corekit	2565	71	812	37	96.56%
pcapkit/dumpkit	282	3	102	3	98.44%
pcapkit/foundation	2930	23	1022	25	98.79%
pcapkit/interface	138	4	52	3	96.32%
pcapkit/protocols	17414	219	4574	185	98.14%
pcapkit/toolkit	869	36	298	10	95.20%
pcapkit/utilities	473	7	136	5	98.03%
pcapkit/vendor	4431	1995	1018	167	51.73%

Per-file detail: the coverage-html artifact of this run.

[JarryShaw]

Ready to merge at 4ccea5ad6: the review is GOOD TO GO and CI is complete (56 passed, 0 failed). The ordering leg ran 1966 tests with 0 failures. The 3.8–3.10 KTLO legs show 0 failing tests, and the PR is based on current main (c98541f84).

[JarryShaw]

Rebased onto main (d7581ebb1), 4ccea5ad6 → a16fe51d6, to resolve the conflict with #2063. The only conflict was SCRIPTS in test_actions_helper_2047, where both sides added names; the resolution keeps both (ci_timing and vendor_test_gate from #2063, release_tags and release_upload from here). git patch-id --stable is identical outside that file. On the rebased tree, the release, helper, workflow-script, KTLO-guard, actionlint and docs-claims tests all pass. The old head's CI was green (56 passed, 0 failed), with 0 KTLO failures. Only that test tuple changed, so you can bypass checks and merge.