[JarryShaw]

• Searched for similar pull requests
• Followed the coding style (make pylint, make mypy, make isort)
• make test passes, and a test case covers the change
• Added a changelog entry — N/A — centralised in docs(changelog): shared 1.5.0 changelog — long-lived, merges last (#610, #616, #617, #618, #620) #657

What is the purpose of your pull request?

• ci — changes to CI configuration files and scripts

---

Description of your pull request and other information

Part of #2047: util/update_python_versions.py now writes all its Actions output through util/_actions.py. Like #2063, the output is byte-identical.

• Removed: the script's own escape().
• Routed through the helper: annotations go through _actions.annotate, outputs through _actions.set_output, and the step summary through _actions.summary.
• Kept: the KeyError on an unknown note kind and the RuntimeError when $GITHUB_OUTPUT is unset or empty.
• Escaping: the helper now escapes whole messages, where the script escaped only some parts. The parts that weren't escaped before are sha256 hex, a \w+ trailer match, or an integer PR number, so none can contain % or a line break.
• Tests: the new TestTheWorkflowCommands drives main() with stubbed git/gh. It compares whole stdout, return codes, $GITHUB_OUTPUT and the step summary byte for byte, using inputs with %, \r\n, : and ,.
  • It passes on main and here.
  • Three planted divergences fail it: an unescaped title, a dropped blank line, and the missing $GITHUB_OUTPUT check.
• test_actions_helper_2047 lists the script.
• Results: the python-versions, helper, KTLO-guard, workflow-script and docs-claims tests all pass.

[JarryShaw]

GOOD TO GO at f07e499d8 (Sonnet cross-review). No input the script can produce gives different bytes:

• Escaping: the old escape() matches _actions.escape_data, and its title form matches escape_property. The previously unescaped parts are 16-hex fingerprints, a \w+ trailer and gh's PR number, and the branch is fixed at bot/python-versions. The reviewer also ran adversarial branch names, notes and an exception message containing %, line breaks and :, through old and new, and stdout was identical.
• Outputs and summary: $GITHUB_OUTPUT holds the same three single-line values, and the step summary is unchanged whether $GITHUB_STEP_SUMMARY is set, unset or empty.
• The new test: it passes on main's script as well as this one.
• One difference, an improvement: annotations are now flushed as they are written, so they reach the log in real time. git/gh output is captured, so nothing interleaves differently.

[github-actions]

Coverage: 91.52% (unit tier, Python 3.15, f07e499d8, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	4	20	2	95.16%
pcapkit/const	19599	881	2618	867	92.11%
pcapkit/corekit	2565	71	812	37	96.56%
pcapkit/dumpkit	282	3	102	3	98.44%
pcapkit/foundation	2930	23	1022	25	98.79%
pcapkit/interface	138	4	52	3	96.32%
pcapkit/protocols	17414	219	4574	185	98.14%
pcapkit/toolkit	869	36	298	10	95.20%
pcapkit/utilities	473	7	136	5	98.03%
pcapkit/vendor	4431	1995	1018	167	51.73%

Per-file detail: the coverage-html artifact of this run.

[JarryShaw]

Ready to merge at f07e499d8: the review is GOOD TO GO and CI is complete (56 passed, 0 failed). The ordering leg ran 1997 tests with 0 failures. The 3.8–3.10 KTLO legs show 0 failing tests, and the PR is based on current main (fd0d2e724). #2070 and #2071 also add to the SCRIPTS tuple, so whichever merges after this will need a small rebase, which I'll do.