[JarryShaw]

• Searched for similar pull requests
• Followed the coding style
• make test passes, and a test case covers the change (narrow selections; see below)
• Changelog entry: N/A — centralised in docs(changelog): shared 1.5.0 changelog — long-lived, merges last (#610, #616, #617, #618, #620) #657

What is the purpose of your pull request?

• ci — workflows or build tooling

---

Description

Part of #2060, per the owner's ruling there (option 1). A manual Conda Update run is build-only, and scheduled runs upload only after util/conda_vendor.py regenerates a different recipe. So 1.5.0b14's missing win-64 and osx-64 files cannot reach Anaconda (#2140).

• publish input. workflow_dispatch takes a boolean publish (default false). A new mode job ("Conda run mode") is the only reader. Its publishes output is true on a schedule, on a push workflow_run, and on a publish dispatch of main. Any other ref is refused with ::error.
• The guards read publishes. Every former github.event_name != 'workflow_dispatch' guard now reads it: push, tag, upload, release steps, both environments, the repository-maintenance group and discussion. If mode is skipped or fails, the output is unset and nothing publishes.
• Forced bump. "Decide whether to bump" sets bump=true on a publish dispatch even when Verify Changed files saw nothing. Bump Version, Commit Changes and Push Changes then run unchanged. CONDA_CHANGED (Push Changes' pushed) unlocks conda-tag and every conda-dist leg.
• A forced bump that is not pushed warns. If main moves, or the build is already on main, Push Changes emits a ::warning saying nothing was published and to re-dispatch with publish. The run report goes to status=warning. Unforced notices are byte-identical.
• Build-only dispatch unchanged, apart from one extra ~5 s mode job.
• Tests. New tests/project/test_conda_publish_dispatch_2060.py, plus pins updated in eight workflow-reading tests. The 22 cron-conda.yml-reading files plus the tier guard: 709 passed. Against origin/main's workflow they give 54 failed (the new file alone: 37 of 44; the round-2 tests fail 10 against 4b14236cf). Docs-reading tests: 492 passed. actionlint 1.7.12 on cron-conda.yml: clean.

[JarryShaw]

GOOD TO GO at 4b14236cf (Sonnet review). A small follow-up amend is coming.

• A plain dispatch still never pushes, tags, uploads, posts or enters an environment. Every such guard reads needs.mode.outputs.publishes == 'true', and the != 'true' branches are reachable only after mode succeeds with publishes=false.
• A publish dispatch on main reaches the forced bump, Push Changes, CONDA_CHANGED, conda-tag, all three upload steps, the release steps and discussion. Any other ref fails at mode, so nothing downstream runs.
• Schedule and push workflow_run are unchanged. A PR-triggered workflow_run still skips. head is identical across the three callers. inputs.publish goes through env:.
• Tests: 497 passed. The new file fails 39 of 46 against origin/main. actionlint is clean.
• Being fixed in the amend: when main moves under a publish run, Push Changes' "left to the next Conda Update" notice is wrong, because the next run won't force a bump. The amend makes it a warning to re-dispatch, and words the docs' "build-only" line as the default.

[JarryShaw]

GOOD TO GO at 6f5747a0b (Sonnet re-review of the round-2 amend).

• With publish off, the three Push Changes notices are byte-identical to before. The new ::warning branches fire only when forced is true, which only a publish dispatch sets.
• forced is written on every path of "Decide whether to bump". If that step never ran, the value is empty and the old behaviour applies.
• The report's new status=warning cannot fire on a forced bump that did publish, since COMMIT is set beside pushed=true. Status is unchanged for every other event.
• The "Build already on main" remedy is accurate: another publishing run pushed N+1, so dispatch again only if that run's upload failed.
• Tests: 209 passed. The new file fails 10 of 38 on 4b14236cf. actionlint is clean.

[github-actions]

Coverage: 91.55% (unit tier, Python 3.15, 6f5747a0b, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	4	20	2	95.16%
pcapkit/const	19599	880	2618	866	92.12%
pcapkit/corekit	2589	75	816	37	96.48%
pcapkit/dumpkit	282	3	102	3	98.44%
pcapkit/foundation	2971	23	1036	25	98.80%
pcapkit/interface	138	4	52	3	96.32%
pcapkit/protocols	17418	219	4574	185	98.14%
pcapkit/toolkit	869	36	298	10	95.20%
pcapkit/utilities	504	7	146	5	98.15%
pcapkit/vendor	4432	1988	1018	167	51.87%

Per-file detail: the coverage-html artifact of this run.

[JarryShaw]

Ready to merge at 6f5747a0b.

• Review: Sonnet GOOD TO GO on round 1 (4b14236cf) and on the round-2 amend.
• CI: 58 CheckRuns passed, 0 failed, 0 running. Required checks passed is SUCCESS. The KTLO legs show no warnings.
• Ordering: tests/project on this PR merged into main (9717c861d) passes the plain unittest ordering leg: 2286 tests, 0 failures, 0 errors.
• actionlint 1.7.12: clean.
• After merge: dispatch Conda Update on main with publish ticked. That run bumps the build and uploads 1.5.0b14 for every platform, including win-64 (Conda: bring back the Windows (win-64) package, in two phases #2060) and osx-64 (release: 1.5.0b14 has no osx-64 conda files, so Create Release warns it is unfinished on every released-elsewhere run #2140).