ci: put two trivial util/ steps back inline (#1967)

.github/workflows/create-release.yml

@@ -136,34 +136,41 @@ jobs:
   # in that run's place, so the displaced run's release waits for the next run
   # on ``main``: the tip's own Vendor Update if the tip's Unit Tests run has not
   # completed yet, else the next push's or Saturday's.
-  #
-  # #1967: util/release_vendor_update.py holds the step's shell, so the job
-  # checks out util/ alone, for it and util/_actions.py, which is all
-  # ``contents: read`` is for.
   vendor_update:
     name: Triggering Vendor Update
     runs-on: ubuntu-latest
     if: ${{ github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success' }}
     timeout-minutes: 5
     permissions:
       actions: read
-      contents: read
     outputs:
       updated: ${{ steps.updated.outputs.updated }}
     steps:
-      - name: Checkout code
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          ref: ${{ github.sha }}
-          sparse-checkout: util
-          persist-credentials: false
-
       - name: Read whether its vendor-update job ran
         id: updated
         env:
           GH_TOKEN: ${{ github.token }}
           PCAPKIT_VENDOR_RUN_ID: ${{ github.event.workflow_run.id }}
-        run: python3 util/release_vendor_update.py
+        run: |
+          set -uo pipefail
+
+          if ! result="$(gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${PCAPKIT_VENDOR_RUN_ID}/jobs" \
+                           --paginate --jq '.jobs[] | select(.name == "vendor-update") | .conclusion')"; then
+            echo "::warning title=Vendor Update not read (#1748)::could not list the jobs of Vendor Update run ${PCAPKIT_VENDOR_RUN_ID}, so this run treats it as one that updated."
+            exit 0
+          fi
+          case "$result" in
+            success)
+              echo "updated=true" >> "$GITHUB_OUTPUT"
+              ;;
+            skipped)
+              echo "updated=false" >> "$GITHUB_OUTPUT"
+              echo "Vendor Update run ${PCAPKIT_VENDOR_RUN_ID} skipped vendor-update: its verdict did not cover the commit it checked out."
+              ;;
+            *)
+              echo "::warning title=Vendor Update not read (#1748)::Vendor Update run ${PCAPKIT_VENDOR_RUN_ID} reports vendor-update as '${result//$'\n'/ }', so this run treats it as one that updated."
+              ;;
+          esac
 
   version_check:
     name: Check Version

.github/workflows/unit-tests.yml

@@ -630,9 +630,10 @@ jobs:
       # bound. APT_PACKAGES, the job's env, is what both the plan and the
       # install read, so the key always describes the set installed.
       #
-      # The plan, seed, install and collect steps run util/apt_packages.py
-      # (#1967); its docstring says what each subcommand does. `pypcap-parity`
-      # runs the same steps; every body but the install's is identical to these.
+      # The plan, install and collect steps run util/apt_packages.py (#1967);
+      # its docstring says what each subcommand does. The seed step, one copy
+      # and a count, stays inline. `pypcap-parity` runs the same steps; every
+      # body but the install's is identical to these.
       - name: Plan this engine's system packages
         id: apt-plan
         if: env.APT_PACKAGES != ''
@@ -650,7 +651,10 @@ jobs:
 
       - name: Seed apt's archive with this engine's cached .deb files
         if: steps.apt-cache.outputs.cache-matched-key != ''
-        run: /usr/bin/python3 util/apt_packages.py seed
+        run: |
+          set -eu
+          sudo cp "$RUNNER_TEMP"/apt-debs/*.deb /var/cache/apt/archives/
+          echo "Seeded $(find "$RUNNER_TEMP/apt-debs" -name '*.deb' | wc -l) .deb files"
 
       - name: Install this engine's system packages
         timeout-minutes: 10
@@ -961,7 +965,10 @@ jobs:
         id: apt-seed
         if: steps.apt-cache.outputs.cache-matched-key != ''
         continue-on-error: ${{ matrix.ktlo == true }}
-        run: /usr/bin/python3 util/apt_packages.py seed
+        run: |
+          set -eu
+          sudo cp "$RUNNER_TEMP"/apt-debs/*.deb /var/cache/apt/archives/
+          echo "Seeded $(find "$RUNNER_TEMP/apt-debs" -name '*.deb' | wc -l) .deb files"
 
       - name: Install libpcap headers, a C toolchain, and tshark
         id: apt-install

docs/source/contributing/workflows.rst

@@ -1208,11 +1208,14 @@ without the script, and runs the script against a small limit.
 Workflow Scripts (`#1967 <https://github.com/JarryShaw/PyPCAPKit/issues/1967>`__)
 ---------------------------------------------------------------------------------
 
-Shell that several steps repeat lives in a :file:`util/` script, which the steps
-run, rather than in a composite action: a composite action's inner steps cannot
-take ``timeout-minutes``, so each calling step keeps its own, with its ``shell:``,
-``if:``, ``env:`` and ``continue-on-error``. Each script's docstring says what it
-does; each has tests under :file:`tests/project/` that run it.
+Shell that several steps repeat, or that has real logic -- branches, or a bug
+history a test should pin -- lives in a :file:`util/` script, which the steps run,
+rather than in a composite action: a composite action's inner steps cannot take
+``timeout-minutes``, so each calling step keeps its own, with its ``shell:``,
+``if:``, ``env:`` and ``continue-on-error``. A few plain commands stay inline even
+where repeated, as the apt seed steps do, since they read more easily than a call
+to a script. Each script's docstring says what it does; each has tests under
+:file:`tests/project/` that run it.
 
 .. list-table::
    :header-rows: 1
@@ -1266,10 +1269,12 @@ does; each has tests under :file:`tests/project/` that run it.
      - No.
    * - :file:`util/apt_packages.py`
      - The apt steps of ``unit-tests.yml``'s ``engine-tests`` and ``pypcap-parity``
-       (and so its KTLO twin): the plan, seed, install and collect steps, as
-       ``apt_packages.py plan``, ``seed``, ``install`` and ``collect``. The
-       ``actions/cache`` steps and the AppArmor step (`#2019
-       <https://github.com/JarryShaw/PyPCAPKit/issues/2019>`__) stay as they were.
+       (and so its KTLO twin): the plan, install and collect steps, as
+       ``apt_packages.py plan``, ``install`` and ``collect``. The
+       ``actions/cache`` steps, the seed steps (``Seed apt's archive with this
+       engine's cached .deb files`` and ``Seed apt's archive with the cached .deb
+       files``) and the AppArmor step (`#2019
+       <https://github.com/JarryShaw/PyPCAPKit/issues/2019>`__) stay inline.
      - No.
    * - :file:`util/_actions.py`
      - No step: it is imported by the scripts that share its annotations, step
@@ -1298,11 +1303,6 @@ does; each has tests under :file:`tests/project/` that run it.
        after a checkout of :file:`util/` alone (`#888
        <https://github.com/JarryShaw/PyPCAPKit/issues/888>`__).
      - No.
-   * - :file:`util/release_vendor_update.py`
-     - ``Read whether its vendor-update job ran`` in ``create-release.yml``'s
-       ``vendor_update``, on the image's ``python3`` after a checkout of
-       :file:`util/` alone (`#1748 <https://github.com/JarryShaw/PyPCAPKit/issues/1748>`__).
-     - No.
    * - :file:`util/release_tiers.py`
      - ``Read the released Python versions`` in ``create-release.yml``'s
        ``version_check``, on setup-python's ``python3`` (`#1660

tests/project/test_actions_helper_2047.py

@@ -46,7 +46,7 @@
 SCRIPTS = ('apt_packages', 'check_suite_report', 'ci_timing', 'classify_changes', 'codeql_report',
            'coverage_report', 'discussion_report', 'leg_summary', 'pip_install', 'project_status',
            'python_versions', 'regenerate_samples', 'release_conda', 'release_published', 'release_status',
-           'release_tags', 'release_tiers', 'release_upload', 'release_vendor_update', 'superseded',
+           'release_tags', 'release_tiers', 'release_upload', 'superseded',
            'update_python_versions', 'vendor_code_changed', 'vendor_test_gate', 'verdict_covers_checkout')
 #: The top-level modules the helper may import, each in Python 3.7's standard
 #: library: the running interpreter's :data:`sys.stdlib_module_names` would
@@ -72,7 +72,6 @@
     'release_tags': (['--help'], {}),
     'release_tiers': (['--help'], {}),
     'release_upload': (['--help'], {}),
-    'release_vendor_update': (['--help'], {}),
     'superseded': (['--help'], {}),
     'update_python_versions': (['--help'], {}),
     'vendor_code_changed': (['--help'], {}),