[JarryShaw]

• Searched for similar pull requests
• Followed the coding style (make pylint, make mypy, make isort)
• make test passes, and a test case covers the change
• Changelog entry: N/A — centralised in docs(changelog): shared 1.5.0 changelog — long-lived, merges last (#610, #616, #617, #618, #620) #657

What is the purpose of your pull request?

• ci — workflows or build tooling

---

Description of your pull request and other information

Step 6 of #1967. Conda Update, Vendor Update and GitHub Pages each carried the same gate (unit-tests with gate-only unless the event is a pull request or a workflow_run) and the same verdict head. That head now lives once, in the new reusable cron-head.yml, which is workflow_call only and grants contents: read.

Each of the three replaces those two jobs with a head job ("Conda gate", "Vendor gate", "Docs gate"). Their acting jobs now read needs.head.result and needs.head.outputs.verified.

The following are unchanged:

• triggers, concurrency and repository-maintenance;
• environment: lines, deploy-key steps and per-job permissions;
• !cancelled() on every acting job;
• the vendor-update job name, which Create Release reads.

Not done: a single weekly gate. It would move publish times, because Pages runs at 02:00 and Vendor and Conda at 10:00. Each would also publish main's tip at gate time rather than at its own schedule. That needs a ruling, which I'll ask for on #1967.

Checks:

• New pins check that all three call one identical head, that nothing else calls it, and that it asks for no more than contents: read. Against the old layout, 13 of them fail.
• The related tests/project files pass.
• actionlint 1.7.12 is clean on the changed files.

Part of #1967.

[JarryShaw]

GOOD TO GO at 949779da9. A Sonnet review found the move a straight lift:

• Conditions: the gate's and verdict's if: match the old ones, and no caller still reads needs.verdict or needs.unit-tests.
• Outputs: verified maps through on.workflow_call.outputs. It is empty when verdict skips, which == 'true' already treats as false.
• Nesting and permissions: the chain is three levels deep, within GitHub's limit of ten. Every level holds contents: read, and the write permissions in deploy-pages sit outside the chain.
• Names: every consumer filters on unchanged workflow names or on vendor-update, which keeps its name.

I ran the files the review did not, all passing: test_release_reads_the_vendor_update_1748, test_superseded_runs_1938, test_conda_platform_pin_refresh_1851, test_vendor_comment_only_no_bump_1674, test_unit_tests_queue, and the docs-claims, changelog and isort pins.

Unverified: what needs.head.result reports when every inner job skipped. The docs don't say. Either skipped or success passes != 'failure'.

[JarryShaw]

GOOD TO GO at fc192dd87. Following the #1967 ruling, the crons now run eight hours apart on Saturdays: Pages at 02:00, Vendor at 10:00, Conda at 18:00.

A Sonnet delta review confirmed:

• Vendor and Conda use none of each other's output. They share only repository-maintenance.
• Create Release reads only the run that triggered it.
• Conda after Vendor is the safer order, given Check the GitHub release exists (fix(ci): Create Release tags main's tip at approval time, not the commit it was created for #1634).
• The new pin fails when Conda is moved back to 10:00.

fc192dd87 fixes the two comments the review found stale, in project-status.yml and ci-timing.yml. A repo-wide grep found nothing else. The workflow-reading tests pass, and actionlint is clean apart from main's existing concurrency.queue finding.

[github-actions]

Coverage: 91.54% (unit tier, Python 3.15, fc192dd87, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	4	20	2	95.16%
pcapkit/const	19597	881	2618	867	92.11%
pcapkit/corekit	2540	71	808	37	96.54%
pcapkit/dumpkit	276	3	100	3	98.40%
pcapkit/foundation	2929	23	1020	25	98.78%
pcapkit/interface	138	4	52	3	96.32%
pcapkit/protocols	17468	222	4600	187	98.13%
pcapkit/toolkit	872	36	298	10	95.21%
pcapkit/utilities	523	2	158	4	99.12%
pcapkit/vendor	4431	1995	1018	167	51.73%

Per-file detail: the coverage-html artifact of this run.