netprotocols 2.7.0__tar.gz → 2.9.0__tar.gz

netprotocols-2.9.0/.flake8

@@ -0,0 +1,28 @@
+# flake8 runs only pydoclint here: `select` limits it to pydoclint's DOC
+# codes, and ruff covers everything else. Run it as `uv run flake8 src`.
+# The standard these settings enforce is CONTRIBUTING.md's "Docstrings
+# and comments" section.
+[flake8]
+select = DOC
+extend-ignore =
+    # DOC201: a function that returns a value needs no :returns: field.
+    DOC201,
+    # DOC402: a generator needs no :yields: field.
+    DOC402,
+    # DOC502: a :raises: field may name an exception that a callee raises.
+    DOC502,
+    # DOC503: the :raises: fields may differ from the body's own raise
+    # statements; DOC501 still requires a :raises: field when the body
+    # raises.
+    DOC503,
+
+# pydoclint's own options.
+style = sphinx
+# Docstrings carry no types: the signature's annotations hold them.
+arg-type-hints-in-docstring = False
+check-return-types = False
+check-yield-types = False
+# A docstring with no fields (:param:, :raises:, ...) is not checked.
+skip-checking-short-docstrings = True
+# Class attributes are not checked against the class docstring.
+check-class-attributes = False

{netprotocols-2.7.0 → netprotocols-2.9.0}/.github/ISSUE_TEMPLATE/config.yml

@@ -1,5 +1,4 @@
-# Freeform issues stay enabled (the roadmap and design discussions don't
-# fit a form); the templates just make the common cases structured.
+# Freeform issues are enabled alongside the issue templates.
 blank_issues_enabled: true
 contact_links:
   - name: Contributing guide

netprotocols-2.9.0/.github/dependabot.yml

@@ -0,0 +1,51 @@
+version: 2
+
+updates:
+  # --- Python tooling, managed by uv --------------------------------
+  #
+  # This project's dependencies are declared only as PEP 735
+  # [dependency-groups] in pyproject.toml (see uv.lock). The "uv"
+  # ecosystem parses [dependency-groups]; Dependabot's "pip" ecosystem
+  # does not.
+  - package-ecosystem: "uv"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "chore"
+    groups:
+      # The "dev" dependency-group's packages (pytest, mypy, ruff, etc.),
+      # updated together in one PR. Matched by package name: for the uv
+      # ecosystem, Dependabot's dependency-type classifier reports every
+      # dependency as "production" (dependabot/dependabot-core#13202),
+      # so a `dependency-type: development` group would be empty. A
+      # runtime dependency under [project.dependencies] is not in this
+      # list, and updates in a PR of its own.
+      dev-dependencies:
+        patterns:
+          - "hypothesis"
+          - "mypy"
+          - "pytest"
+          - "pytest-cov"
+          - "ruff"
+
+  # --- GitHub Actions -------------------------------------------------
+  #
+  # Keeps the SHA-pinned `uses:` references in .github/workflows current
+  # (Dependabot updates both the pinned SHA and its trailing `# vX.Y.Z`
+  # comment).
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "ci"
+    groups:
+      # github/codeql-action ships init, analyze, and upload-sarif as
+      # subdirectories of one repository, and Dependabot tracks each
+      # `uses:` path as its own dependency. init and analyze must run
+      # the same release: analyze refuses a config file written by a
+      # different init version. This group bumps all three in one PR.
+      codeql-action:
+        patterns:
+          - "github/codeql-action*"

{netprotocols-2.7.0 → netprotocols-2.9.0}/.github/pull_request_template.md

@@ -18,11 +18,14 @@ becomes the PR description.
 
 ## Verification
 
-<!-- Paste the QA-ladder output, or tick the boxes. All four gates run in CI. -->
+<!-- Paste the QA-ladder output, or tick the boxes. The first six boxes cover the seven checks CI runs; the CHANGELOG entry is checked in review. -->
 
 - [ ] `uv run ruff check` and `uv run ruff format --check` are clean
+- [ ] `uv run flake8 src` (pydoclint) is clean
 - [ ] `uv run mypy` is clean (strict)
 - [ ] `uv run pytest` passes locally (CI runs it on Python 3.12 / 3.13 / 3.14)
+- [ ] `python3 scripts/check_markers.py` is clean: no work markers
+- [ ] `uv run sphinx-build -W -n -b dummy docs <outdir>` is clean: every docstring cross-reference resolves
 - [ ] `CHANGELOG.md` has an entry under `## [Unreleased]`
 
 ### New protocol or dispatch change — also:

netprotocols-2.9.0/.github/workflows/ci.yml

@@ -0,0 +1,195 @@
+name: CI
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+  # release.yml calls this workflow to run the same ladder against a
+  # tagged commit before publishing.
+  workflow_call:
+
+# A newer run for the same pull request (keyed on its number) or ref
+# cancels the older one. The group's prefix is the literal "ci", so it
+# never equals release.yml's own group when release.yml calls this
+# workflow.
+concurrency:
+  group: ci-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+# Every job only reads the checked-out tree.
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+        with:
+          python-version: "3.12"
+      - run: uv run ruff check
+      - run: uv run ruff format --check
+      # pydoclint, run as a flake8 plugin with the settings in .flake8.
+      - run: uv run flake8 src
+      # Fails on any work-marker word in tracked text (see
+      # scripts/check_markers.py). Offline.
+      - run: python3 scripts/check_markers.py
+      # Runs scripts/check_fixtures.py, stdlib-only, under the runner's
+      # python3 over tests/fixtures and over each subdirectory holding a
+      # tracked capture; fails if no capture is tracked or if any
+      # directory's run exits non-zero. tests/test_check_fixtures.py
+      # also runs it over every capture directory under each Python the
+      # test job's matrix names. It runs whether or not an earlier step
+      # failed.
+      - name: Check every committed capture with check_fixtures.py
+        if: ${{ !cancelled() }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          mapfile -t dirs < <(
+            git ls-files -- 'tests/fixtures/*.pcap' | xargs -n1 dirname | sort -u
+          )
+          if [ "${#dirs[@]}" -eq 0 ]; then
+            echo "::error::git ls-files found no capture under tests/fixtures."
+            exit 1
+          fi
+          for dir in "${dirs[@]}"; do
+            python3 scripts/check_fixtures.py "$dir"
+          done
+      # Renders every docstring in src/ through Sphinx autodoc
+      # (docs/conf.py) and fails on any warning, an unresolved
+      # cross-reference role included. Fetches the Python inventory from
+      # docs.python.org; the dummy builder writes no output.
+      - run: uv run --frozen sphinx-build -W -n -b dummy docs "$RUNNER_TEMP/sphinx"
+
+  typecheck:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+        with:
+          python-version: "3.12"
+      - run: uv run mypy
+
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.12", "3.13", "3.14"]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+        with:
+          python-version: ${{ matrix.python-version }}
+      # Also runs the doctests in src/: pyproject.toml's pytest
+      # addopts and testpaths include --doctest-modules and src.
+      - run: uv run --frozen pytest --cov=netprotocols --cov-report=term
+      # Runs every module that measures allocations with
+      # tests/conftest.py's allocation_peak while tracemalloc is already
+      # tracing from interpreter start.
+      - name: Allocation tests under PYTHONTRACEMALLOC=1
+        env:
+          PYTHONTRACEMALLOC: "1"
+        run: >-
+          uv run --frozen pytest -o addopts="" -q
+          tests/test_conftest.py tests/test_cdp.py tests/test_lldp.py
+          tests/test_sctp.py tests/test_stp.py
+
+  # Scans the dev dependency group (the only third-party code CI itself
+  # installs) for known vulnerabilities. --no-emit-project leaves out
+  # the `-e .` line for this package, which has no hash: pip-audit
+  # requires a hash on every requirement once any one carries a hash.
+  dependency-scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+        with:
+          python-version: "3.12"
+      - name: Export dev dependencies
+        run: >-
+          uv export --group dev --format requirements-txt --no-emit-project
+          -o requirements-dev.txt
+      - name: Audit dev dependencies for known vulnerabilities
+        run: >-
+          uv run --with pip-audit --no-project
+          pip-audit -r requirements-dev.txt
+
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+      - run: uv build
+      - run: uv run --isolated --no-project --with dist/*.whl python -c "import netprotocols; print(netprotocols.__version__)"
+      # Two back-to-back builds must emit byte-identical wheels: the step
+      # compares their sha256 and fails on any difference, such as an
+      # embedded timestamp or a change in archive member order.
+      - name: Verify the wheel build is reproducible
+        run: |
+          set -euo pipefail
+          uv build -o dist-repro-1
+          uv build -o dist-repro-2
+          hash1=$(sha256sum dist-repro-1/*.whl | cut -d ' ' -f1)
+          hash2=$(sha256sum dist-repro-2/*.whl | cut -d ' ' -f1)
+          echo "Build 1 sha256: $hash1"
+          echo "Build 2 sha256: $hash2"
+          if [ "$hash1" != "$hash2" ]; then
+            echo "::error::Wheel build is not reproducible: sha256 differs between two successive 'uv build' runs."
+            exit 1
+          fi
+          echo "Wheel build is reproducible."
+
+  # Checks the README's browser/WASM claim: boots a Pyodide runtime
+  # under Node (scripts/pyodide/run_in_pyodide.mjs) and decodes the
+  # whole real-capture corpus with the wheel this job builds.
+  # scripts/pyodide/check_in_pyodide.py describes the checks.
+  pyodide:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+        with:
+          python-version: "3.12"
+      - run: uv build
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: "22"
+      - run: npm ci
+        working-directory: scripts/pyodide
+      - run: >-
+          node scripts/pyodide/run_in_pyodide.mjs
+          "$GITHUB_WORKSPACE" scripts/pyodide/check_in_pyodide.py
+
+  # Blocking: fails when normalized decode throughput is more than 15%
+  # below the committed baseline. A failing measurement is repeated
+  # once, and the job fails only if the second fails too.
+  #
+  # Runs on the baseline's interpreter: normalization cancels how fast
+  # the machine is, not which CPython runs it (see the module docstring
+  # in scripts/benchmark.py). `--update-baseline` re-records the
+  # baseline.
+  benchmark:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+        with:
+          python-version: "3.12"
+      - name: Corpus decode throughput
+        shell: bash
+        run: |
+          # The step exits with the benchmark's own status, saved in
+          # $status before its output is copied to the step summary.
+          status=0
+          uv run --frozen --group bench python scripts/benchmark.py \
+            --check --threshold 15 --compare >benchmark.out 2>&1 || status=$?
+          {
+            echo '```'
+            cat benchmark.out
+            echo '```'
+          } >>"$GITHUB_STEP_SUMMARY"
+          cat benchmark.out
+          exit "$status"

{netprotocols-2.7.0 → netprotocols-2.9.0}/.github/workflows/codeql.yml

@@ -1,21 +1,14 @@
 name: CodeQL
 
-# Advanced-setup workflow (a checked-in file) rather than GitHub's
-# built-in "default setup", so this analysis lives in version control
-# alongside the rest of this repository's CI (ci.yml, fuzz.yml,
-# release.yml, mutation.yml, scorecard.yml) and its action pins are
-# reviewable the same way theirs are. Default setup is configured
-# through repository settings instead of a file, so it isn't available
-# to author from here.
+# CodeQL advanced setup: the Python analysis is configured in this file.
 on:
   push:
     branches: [master]
   pull_request:
     branches: [master]
   schedule:
-    # Arbitrary; weekly on Sundays, clear of fuzz.yml's and mutation.yml's
-    # daily 03:00/04:00 UTC slots and scorecard.yml's own Sunday 05:00
-    # UTC slot.
+    # Weekly on Sundays at 06:00 UTC, clear of the other workflows'
+    # cron slots.
     - cron: "0 6 * * 0"
 
 permissions:
@@ -36,13 +29,9 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      # Python is interpreted, so there is nothing for autobuild (or a
-      # manual build step) to do: build-mode: none has CodeQL extract
-      # the database straight from source instead. This is the build
-      # mode the CodeQL Action's own docs recommend for interpreted
-      # languages, and it sidesteps the question of an autobuild step
-      # fitting this project's uv-based build at all.
-      - uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+      # build-mode: none extracts the database straight from source,
+      # with no build step.
+      - uses: github/codeql-action/init@1fc58d04a4d4374f921bdac573c3811c240f9c26 # v4.39.2
         with:
           languages: python
           build-mode: none
@@ -50,14 +39,12 @@ jobs:
       # analyze writes the SARIF without uploading it, the filter step
       # drops one query's results on two paths, and upload-sarif uploads
       # what is left. py/weak-sensitive-data-hashing flags the MD5 that
-      # RADIUS (#265) and STUN (#267) mandate, which their tests and
+      # RADIUS and STUN mandate, which their tests and
       # scripts/check_fixtures.py compute over published test secrets
-      # with usedforsecurity=False to verify captured traffic.
-      # The CodeQL config can't scope a query to paths: query-filters
-      # drops it everywhere, src/ included, and paths-ignore drops the
-      # paths from every query. So the filter removes only that query's
-      # results whose primary location is under tests/ or scripts/; the
-      # query still runs on src/, every other query on all three.
+      # with usedforsecurity=False to verify captured traffic. The
+      # filter removes only that query's results whose primary location
+      # is under tests/ or scripts/; the query still runs on src/, every
+      # other query on all three.
       #
       # upload: failure-only is the action's documented mode for a
       # workflow that post-processes the SARIF: analyze uploads nothing
@@ -80,7 +67,7 @@ jobs:
       # category. Setting one on either step alone would start a second
       # analysis next to the first.
       - id: analyze
-        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+        uses: github/codeql-action/analyze@1fc58d04a4d4374f921bdac573c3811c240f9c26 # v4.39.2
         with:
           upload: failure-only
 
@@ -95,6 +82,6 @@ jobs:
           SARIF_DIR: ${{ steps.analyze.outputs.sarif-output }}
         run: python3 scripts/filter_codeql_sarif.py "$SARIF_DIR"
 
-      - uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+      - uses: github/codeql-action/upload-sarif@1fc58d04a4d4374f921bdac573c3811c240f9c26 # v4.39.2
         with:
           sarif_file: ${{ steps.analyze.outputs.sarif-output }}

netprotocols-2.9.0/.github/workflows/docs-lint.yml

@@ -0,0 +1,62 @@
+name: Docs lint
+
+# Runs lycheeverse/lychee (a link checker) over the small set of
+# hand-maintained docs that carry the project's external claims and
+# cross-references: README.md, ARCHITECTURE.md, CONTRIBUTING.md,
+# CHANGELOG.md, and docs/CLAIMS.md. The pull_request trigger, filtered
+# to those paths, checks the links of a docs edit; the weekly schedule
+# checks the links of unchanged files, which can go dead.
+on:
+  pull_request:
+    branches: [master]
+    paths:
+      - "README.md"
+      - "ARCHITECTURE.md"
+      - "CONTRIBUTING.md"
+      - "CHANGELOG.md"
+      - "docs/CLAIMS.md"
+  schedule:
+    # Weekly on Mondays at 06:00 UTC, clear of the other workflows'
+    # cron slots.
+    - cron: "0 6 * * 1"
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  lychee:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      # lychee-action's `token` input defaults to `${{ github.token }}`,
+      # which it exports as GITHUB_TOKEN; lychee checks github.com links
+      # through the API with it, under the authenticated rate limit.
+      #
+      # --timeout/--max-retries/--retry-wait-time exceed lychee's own
+      # defaults (20s/3/1s), so a slow or briefly rate-limited external
+      # host does not fail the run.
+      #
+      # --exclude skips img.shields.io, which serves the README badges
+      # and intermittently rate-limits or times out under CI traffic. It
+      # is the only exclusion.
+      - name: Check links in the project's hand-maintained docs
+        uses: lycheeverse/lychee-action@e7477775783ea5526144ba13e8db5eec57747ce8 # v2.9.0
+        with:
+          args: >-
+            --no-progress
+            --verbose
+            --timeout 30
+            --max-retries 3
+            --retry-wait-time 10
+            --exclude '^https://img\.shields\.io'
+            README.md
+            ARCHITECTURE.md
+            CONTRIBUTING.md
+            CHANGELOG.md
+            docs/CLAIMS.md

netprotocols-2.9.0/.github/workflows/fuzz.yml

@@ -0,0 +1,82 @@
+name: Nightly fuzz
+
+on:
+  schedule:
+    # Daily at 03:00 UTC.
+    - cron: "0 3 * * *"
+  workflow_dispatch:
+
+# Keyed on the triggering event too, so the nightly cron can never
+# cancel a manually dispatched run on the same ref (the release
+# checklist in CONTRIBUTING.md relies on one) -- runs of the same kind
+# still supersede each other.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  # Runs the whole suite under tests/test_fuzz.py's "nightly" profile:
+  # 10,000 examples with a random seed each run (see tests/test_fuzz.py's
+  # module docstring), where the "netprotocols" profile CI uses runs
+  # the same 200 derandomized inputs every time. Python 3.12 only.
+  fuzz:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+        with:
+          python-version: "3.12"
+      # Keyed by run id with a prefix restore-key: restores the most
+      # recent run's Hypothesis example database and saves this run's as
+      # a new entry (actions/cache never overwrites an existing key), so
+      # the database accumulates from run to run.
+      - name: Restore accumulated Hypothesis examples
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: .hypothesis
+          key: hypothesis-nightly-${{ github.run_id }}
+          restore-keys: |
+            hypothesis-nightly-
+      - name: Run the full suite under the nightly fuzz profile
+        env:
+          HYPOTHESIS_PROFILE: nightly
+        run: uv run --frozen pytest
+      # On failure, uploads the example database, which holds the
+      # minimal counterexample.
+      - name: Upload the failing example database
+        if: failure()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: hypothesis-nightly-failure-${{ github.run_id }}
+          path: .hypothesis
+          retention-days: 30
+
+  # Coverage-guided fuzzing with Atheris: libFuzzer's mutation engine
+  # drives decode_frame, and HTTP.decode, which decode_frame never
+  # reaches (HTTP is not port-dispatched), through a harness of its
+  # own. Python 3.12 only.
+  atheris:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+        with:
+          python-version: "3.12"
+      - name: Run Atheris against decode_frame
+        run: |
+          uv run --frozen --with atheris \
+            python tests/fuzz/fuzz_decode_frame.py -max_total_time=300
+      - name: Run Atheris against HTTP.decode
+        run: |
+          uv run --frozen --with atheris \
+            python tests/fuzz/fuzz_http_decode.py -max_total_time=300
+      - name: Upload crash artifacts
+        if: failure()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: atheris-crash-${{ github.run_id }}
+          path: crash-*
+          retention-days: 30

netprotocols-2.9.0/.github/workflows/mutation.yml

@@ -0,0 +1,75 @@
+name: Nightly mutation testing
+
+on:
+  schedule:
+    # Daily at 04:00 UTC, an hour after fuzz.yml.
+    - cron: "0 4 * * *"
+  workflow_dispatch:
+
+# Keyed on the triggering event too, so the nightly cron can never
+# cancel a manually dispatched run on the same ref (the release
+# checklist in CONTRIBUTING.md relies on one) -- runs of the same kind
+# still supersede each other.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  # Python 3.12 only.
+  mutation:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+        with:
+          python-version: "3.12"
+      - name: Install the project with dev dependencies
+        run: uv sync --group dev --frozen
+      # only_mutate in pyproject.toml's [tool.mutmut] table limits
+      # mutation to four files: src/netprotocols/checksum.py, _tlv.py,
+      # layer7/dns.py and layer7/http.py. These positional filters
+      # narrow that below a file, which mutmut's config cannot: in
+      # dns.py they keep only the name-compression byte walk,
+      # _read_name and _labels, and leave out the record, RDATA and
+      # dataclass code; in http.py they keep the private module-level
+      # functions, the HTTP/1.1 grammar; checksum.py and _tlv.py are
+      # mutated whole. A comment in the same [tool.mutmut] table gives
+      # this command, and tests/test_workflows.py pins the filter set.
+      # The checkout holds no mutants/ directory, so mutmut generates
+      # every mutant, traces the configured test selection in full to
+      # map each function to the tests that call it, and checks every
+      # mutant the filters select.
+      - name: Run mutmut against the scoped targets
+        run: |
+          uv run --frozen mutmut run \
+            'netprotocols.checksum.*' \
+            'netprotocols._tlv.*' \
+            'netprotocols.layer7.dns.x__read_name*' \
+            'netprotocols.layer7.dns.x__labels*' \
+            'netprotocols.layer7.http.x__*'
+      # `mutmut run` exits 0 however many mutants survive, so it can
+      # never turn this job red on its own. This step is what does: it
+      # fails on any undetected mutant not in the triage record
+      # (scripts/mutmut_survivors.txt), on a stale entry there, and on
+      # a scoped file with no checked mutant at all.
+      - name: Fail on survivors outside the triage record
+        run: |
+          uv run --frozen mutmut results --all true > mutmut-results.txt
+          uv run --frozen python scripts/check_mutmut_survivors.py \
+            mutmut-results.txt
+      # On failure, uploads the status listing and the mutants
+      # directory, which holds mutmut's per-file results and its
+      # function-to-test map; a path that does not exist is skipped.
+      - name: Upload mutmut results on failure
+        if: failure()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: mutmut-nightly-failure-${{ github.run_id }}
+          path: |
+            mutmut-results.txt
+            mutants
+          if-no-files-found: ignore
+          retention-days: 30

{netprotocols-2.7.0 → netprotocols-2.9.0}/.github/workflows/pr-title-lint.yml

@@ -6,11 +6,7 @@ name: PR Title Lint
 # individual commit messages within a PR (see CONTRIBUTING.md); nothing
 # here checks or rewrites those.
 #
-# Runs on `pull_request` (not `pull_request_target`) so it only ever sees
-# the PR's own metadata with a read-only, non-elevated token — no need for
-# the elevated-permissions trigger the action's own docs suggest for
-# repos that also want its optional "[WIP]" title support, which this
-# repo doesn't use.
+# Runs on `pull_request`, with a read-only token.
 on:
   pull_request:
     branches: [master]