ci(release): a push that releases nothing stays green when its version is tagged elsewhere (#1748)

[JarryShaw]

Please follow the guide below

• You will be asked some questions, please read them carefully and answer honestly

• Put an x into all the boxes [ ] relevant to your pull request (like that [x])

• Use Preview tab to see how your pull request will actually look like

• Searched for similar pull requests

• Followed the coding style (make pylint, make mypy, make isort)

• make test passes, and a test case covers the change. Narrow runs only, listed below.

• Added a changelog entry under docs/source/changelog/ and regenerated CHANGELOG.md, if the change is user-visible: N/A — centralised in docs(changelog): shared 1.5.0 changelog — long-lived, merges last (#610, #616, #617, #618, #620) #657

What is the purpose of your pull request?

Tick the commit type your subject line carries.

• fix — corrects a defect
• feat — adds a feature
• perf — changes performance, not behaviour
• refactor — changes neither behaviour nor performance
• test — tests only
• docs — documentation only
• ci — workflows or build tooling
• release — bumps the version or rolls up a distribution
• chore — anything else

---

Closes #1748. This implements option A plus the side-finding fix, as the owner chose. While v1.5.0b12 names 2025da5e5 and is unfinished, every push to main currently leaves 10 red conda checks.

• owner step in version_check: it resolves the version's tag exactly as fix(ci): Create Release tags main's tip at approval time, not the commit it was created for #1634's guard does. On a non-v* ref where the tag names another commit, the test gate, github, tag, pypi and conda skip. Release status then posts a ::notice (release complete) or a ::warning (unfinished, re-run the tagged commit's run) and stays green.
• Unchanged: real releases (a v* tag, or the first push of a new version) run as before. The fix(ci): Create Release tags main's tip at approval time, not the commit it was created for #1634 guard is byte-identical, and the fix(ci): a half-finished release leaves a v* tag that makes every retry skip silently #888 stranded-partial case still exits 1.
• Side finding: a new vendor_update job, with actions: read, reads the triggering run's vendor-update job. When that job was skipped ("not covered"), Create Release does nothing and stays green. If the job can't be read, the run proceeds as before.
• Known residual: a not-covered Vendor Update still joins main's concurrency group, so it can displace a pending real run. That release then waits for the next chain. This is documented and pinned in test_release_concurrency_1705.py.
• Tests: new and changed rows in test_release_gates (123), _1634 (80), _1705 and the new _1748; each new assertion fails on main. Docs: releasing.rst and workflows.rst.

[JarryShaw]

Verdict: GOOD TO GO at eb3ddaa58. A Sonnet cross-review tried to break it (author: Opus).

• Truth table, evaluated on both trees:
  • a v-tag release and the first push of a new version still run everything;
  • a later push skips the gate and all publishers, whether the release is complete or unfinished (the 1.5.0b12 shape);
  • an unset output falls through to the fix(ci): Create Release tags main's tip at approval time, not the commit it was created for #1634 guards.
• Guards hold: the fix(ci): a half-finished release leaves a v* tag that makes every retry skip silently #888 stranded-partial shapes still exit 1, and the fix(ci): Create Release tags main's tip at approval time, not the commit it was created for #1634 guard hashes identically on both trees.
• owner step, run against scratch remotes: lightweight and annotated tags are handled correctly, the remote-only tag is fetched, and a missing run sha fails loudly.
• vendor_update, checked against live runs: 38650191283 gives updated=false, 38650782750 gives true. Every path exits 0.
• Mutation checks: six of seven workflow mutations are caught by a semantic test. The gap is next: dropping !cancelled() from version_check.
• My own re-run in the PR's tree: release_gates (123), _1634 (80), _1748 (7), _1705 (5) and unit_tests_queue (38).
• Non-blocking: the concurrency residual described in the body. Also, !cancelled() on version_check has no semantic test, and without it a v-tag push would skip version_check.

[JarryShaw]

Verdict: GOOD TO GO at d20454483. A Sonnet check verified round 2 (author: Opus).

• Test-only change: test_release_gates.py gains VERSION_CHECK_CASCADE_ROWS, run through job_runs() with the needs: skip cascade. It asserts three cases: on a v* push with vendor_update skipped, version_check runs; with updated=false it skips; with updated unset it runs.
• Mutation: with !cancelled() && removed, the new tests fail (2 failed). The round-1 tests passed against the same mutant (123 passed), so the gap was real.
• My own re-run in the PR's tree: release_gates, 125 passed and 434 subtests.

[github-actions]

Coverage: 89.57% (unit tier, Python 3.15, d20454483, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	3	20	3	95.16%
pcapkit/const	18860	954	2368	868	91.06%
pcapkit/corekit	2457	69	780	35	96.54%
pcapkit/dumpkit	276	3	100	3	98.40%
pcapkit/foundation	2906	164	1016	34	93.57%
pcapkit/interface	138	7	52	5	93.68%
pcapkit/protocols	17174	225	4588	190	98.07%
pcapkit/toolkit	864	182	298	9	76.33%
pcapkit/utilities	512	2	158	4	99.10%
pcapkit/vendor	4417	2342	1010	157	43.38%

Per-file detail: the coverage-html artifact of this run.