[JarryShaw]

• Searched for similar pull requests
• Followed the coding style (make pylint, make mypy, make isort)
• make test passes, and a test case covers the change
• Added a changelog entry — N/A — centralised in docs(changelog): shared 1.5.0 changelog — long-lived, merges last (#610, #616, #617, #618, #620) #657

What is the purpose of your pull request?

• ci — changes to CI configuration files and scripts

---

Description of your pull request and other information

This applies #1967's inline rule to two migrations that are already merged. The rule moves shell into util/ only when it is duplicated or has real logic. The audit and the approval are on #1967.

• apt seed steps (engine-tests and pypcap-parity): the 3-line set -eu / sudo cp / echo body is back inline, matching 657be8dc8^ exactly. apt_packages.py drops seed; plan, install and collect stay.
• vendor_update: the gh api + case body is back. The whole job, comment included, matches 61bb4ba66^. util/release_vendor_update.py is deleted. The job no longer checks out util/, so it is back to actions: read alone.
• Behaviour: unchanged. Neither script gained anything after its migration.
• Tests: the script tests are replaced, not just deleted. They now run each step's own run: body under bash with stand-ins, over the same cases, and pin the job's permissions. 22 test files pass, and actionlint 1.7.12 is clean.
• Docs: the workflows.rst scripts intro now states the rule, and the table rows are updated.

Overlap: #2089 also edits create-release.yml, the scripts table and the SCRIPTS tuple in test_actions_helper_2047.py, so whichever merges second gets a small rebase.

[JarryShaw]

GOOD TO GO at 9cfd04045 (Sonnet review).

• Restored verbatim: a PyYAML compare shows the three seed steps match 657be8dc8^ and the whole vendor_update job matches 61bb4ba66^, ids, ifs and permissions included. Nothing else in either workflow changed.
• Nothing to carry back: since migration, seed() only gained a helper rename, and release_vendor_update.py was never touched again.
• Permissions: the single step's gh api …/jobs call needs only actions: read, and GH_TOKEN is still passed.
• Tests: they read each run: body from the workflow at test time. Divergences planted in the inline bodies failed 3, 3 and 1 tests.
• Nits, no change: the unit-tests.yml comment "one copy and a count" means the step's single cp plus its count, which is accurate. "A few plain commands" in workflows.rst is not a count.
• UNVERIFIED until a release run: whether actions: read is enough rests on the job being identical to its working pre-migration form.

[github-actions]

Coverage: 91.54% (unit tier, Python 3.15, 1a4226695, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	4	20	2	95.16%
pcapkit/const	19599	880	2618	866	92.12%
pcapkit/corekit	2565	71	812	37	96.56%
pcapkit/dumpkit	282	3	102	3	98.44%
pcapkit/foundation	2930	23	1022	25	98.79%
pcapkit/interface	138	4	52	3	96.32%
pcapkit/protocols	17414	219	4574	185	98.14%
pcapkit/toolkit	869	36	298	10	95.20%
pcapkit/utilities	473	7	136	5	98.03%
pcapkit/vendor	4432	1988	1018	167	51.87%

Per-file detail: the coverage-html artifact of this run.

[JarryShaw]

Ready to merge at 9cfd04045.

• Review: the Sonnet review is GOOD TO GO.
• CI: every blocking check passed (Required checks passed SUCCESS), and the 3.8–3.10 KTLO legs carry no warnings.
• Ordering: the tests/project plain-unittest ordering leg ran on it, 2097 tests with 0 failures.
• Base: the head is on current main (403117c98).
• Merge order: this PR and ci(release): move the conda legs' shell into util/ scripts (#1967) #2089 both edit create-release.yml, the scripts table and test_actions_helper_2047.py. Whichever merges second needs a rebase, and I'll post it with a note.

[JarryShaw]

Rebased onto main (afc286d3f), moving the head from 9cfd04045 to 1a4226695. #2089 had merged first, so tests/project/test_actions_helper_2047.py conflicted.

• Resolution: the SCRIPTS tuple takes main's list, which adds release_conda, minus release_vendor_update. It stays sorted, and its RUNS keys still equal SCRIPTS.
• Rest of the patch: the patch-id outside that file is unchanged (feca6bb7d490 both sides). create-release.yml and workflows.rst auto-merged, and no release_vendor_update or apt_packages.py seed reference is left.
• Tests on the rebased tree: 11 affected files pass, including the helper, apt, release-status, vendor-update, release-gates and release-conda tests.
• Old head's CI: green on every blocking check, with no KTLO warnings, and its project ordering leg was 2097/0. A short delta review is running on the new head.

[JarryShaw]

GOOD TO GO at 1a4226695 (Sonnet delta review of the rebase).

• What changed: the range-diff shows only the SCRIPTS tuple differs. The create-release.yml and workflows.rst diffs against main hold only this PR's changes, and ci(release): move the conda legs' shell into util/ scripts (#1967) #2089's conda changes are intact.
• Leftovers: git grep finds no release_vendor_update anywhere. SCRIPTS is sorted, its RUNS keys match, and every name exists under util/. test_actions_helper_2047 passes (28 tests).

Once its CI is green, I'll post the ready note.

[JarryShaw]

Ready to merge at 1a4226695.

• Review: the Sonnet delta review of the rebase is GOOD TO GO.
• CI: every blocking check passed (Required checks passed SUCCESS). The 3.8–3.10 KTLO legs carry no warnings.
• Ordering: the tests/project plain-unittest ordering leg passed on the rebased head: 2114 tests, 0 failures.
• Base: the head is on current main (afc286d3f).