ci(lint): make all three isort lines clean and repin lint.yml's counts

[JarryShaw]

Fixes #757.
Fixes #753.

Please follow the guide below

• Searched for similar pull requests (none address ci: make isort is red on main (pcapkit/protocols/schema/schema.py) #757 or ci(lint): the workflow's recorded analyser counts have drifted (mypy 115/39 vs 112/38) #753)
• Followed the coding style (make pylint, make mypy, make isort)
• make test passes, and a test case covers the change — ran tests/project/: 127 passed, 489 subtests, under coverage run -m pytest
• Changelog entry — N/A, changelog centralised in docs(changelog): shared 1.5.0 changelog — long-lived, merges last (#610, #616, #617, #618, #620) #657

Commit type

• ci — workflows or build tooling

Description

#757 — make isort is three invocations; all three are now clean, not just the one reaching schema.py. The issue's own repro used isort's 79-column default instead of the Makefile's real 100 (documented in CONTRIBUTING.md as deliberately different from pylint's 120 — not a config bug), which is why it flagged the wrong line. Fixed on this head: schema.py's warnings import (collapse to one line), examples/generators/dispatch.py (blank line after two function-local import blocks), examples/generators/options.py (import ipaddress moved above the pcapkit... block, one scapy.all import reordered — order only, confirmed via ast/py_compile and a targeted test batch, no behaviour change; three test modules load options.py by path — test_option_generator_tcp_base_unit.py, test_option_coverage_runtime.py, test_option_roundtrip_unit.py — and dispatch.py:20 and the 1.5.0 changelog both name it directly). tests/project/test_isort_clean.py now covers all three Makefile lines as separate subTests, not just one.

#753 — re-measured at 932cb48d1: bandit unchanged (8); mypy 112/38 (was 115/39); vermin 106 files (was 105 — already 106 at 73f09aecb too, so three of the four had drifted by the time #753 was filed, not two). pylint's E/W/C (90/4765/542, file-scoped — both exclude one Command-line-attributed message each, matching pylint's own messageTypeCount) are pinned; its R and total are not — repeated runs at the identical commit gave R 645–680, entirely from non-deterministic R0401 cyclic-import ordering, so a single number would not reproduce. The "Promotion order" prose's narrowed --enable=E,F figure is corrected to a real, file-scoped run of that invocation: 87 errors (36 unsubscriptable-object, 31 no-member). Each header line is pinned to the commit it was measured at.

Known and deferred: #766 (the new test's skip is invisible to tests/_dependency_gates.py's guard; fixing it needs files owned by the live #755 worker); #767 (pylint.extensions.emptystring doesn't exist in the installed pylint, so that --load-plugins= entry fails every run and compare-to-empty-string has never actually been enabled).

Pre-existing nit, not fixed here: PYLINT_FLAGS disables/loads five things pylint no longer has, not three — old-division/no-absolute-import/input-builtin (→ R0022), eq-without-hash (→ W0012), and the dead plugin above (→ E0013, #767) — all attributed to Command line rather than a file.

breaking does not apply to either half.

[JarryShaw]

Cross-review verdict: NEEDS CHANGES (opus; authored by a different model). Six findings routed to the branch; a seventh is filed separately as #766 because its fix needs files a live PR owns.

The blocking one, which I verified independently: make isort is still red after this PR, so it cannot close #757 as written. make isort is three invocations, and Makefile:127 is red on this head and on main:

ERROR: examples/generators/dispatch.py  Imports are incorrectly sorted and/or formatted.
ERROR: examples/generators/options.py   Imports are incorrectly sorted and/or formatted.

Those two files are unchanged since #757 was filed, so they were already red then. A contributor running make isort on a clean checkout still gets two files rewritten — the exact harm #757 describes. The new test covers Makefile:125 only, while its docstring claims make isort generally.

The rest: lint.yml:43-44 reports the full run's E figures as the narrowed --enable=E,F run's (real: 88 errors, unsubscriptable-object 36, not 91/39); "two of the four had already drifted" undercounts — vermin was 107 at 73f09aecb, so three had; and pylint's R and total are not reproducible — four identical runs on the identical tree gave R 662/647/647/645 and totals 6061/6046/6046/6044, with only R0401 cyclic-import moving, while lint.yml's own counting pipeline at :200 yields 662 against the header's 659. Pinning a figure that re-running at the pinned commit does not reproduce defeats the purpose of pinning.

Confirmed sound: bandit, mypy and vermin re-measure exactly; the 496→506 move is #754's (+12/−2 = +10, verified); mypy's unused-ignore 24/112 and pylint's W breakdown are exact; the -l100 diagnosis of why #757's own repro fired is correct, and no isort config exists anywhere in the tree to contradict it.

[JarryShaw]

Re-review at e36e549f3: NEEDS CHANGES — two one-line prose defects. All six previous findings are fixed, and the blocking one is verified clear: all three make isort lines exit 0 with zero errors.

The two reformatted example files are genuinely inert, proven rather than asserted. dispatch.py is blank-line insertions only (AST identical, 719 non-blank lines both sides). options.py reorders statements so its AST differs by construction, but running _mh_option_overrides() from the old and new files side by side gives repr(old) == repr(new) → True over 13 keys; ipaddress is stdlib and already in sys.modules before the function-local import runs, and none of the three pcapkit.const.mh.* modules references it, so neither direction can be a cycle or a first import. The scapy.all reorder binds the same five objects with an identical opcode sequence.

1. A false file:line, in the test docstring and the PR description. Both say options.py is cited at CONTRIBUTING.md:110. It is not — line 110 is the docstring-policy bullet about _make_data on ProtocolBase, and CONTRIBUTING.md never mentions options.py, dispatch.py, generators or _frame anywhere. This one is my fault: I passed that citation to the author as established, and it was wrong. The substantive claim around it is true and verified; only the reference is bad. Real citations that would serve: examples/generators/dispatch.py:20, docs/source/changelog/1.5.0.rst:691 and :1169, and the four test modules that load the file by path.

2. E is pinned on the opposite convention from W. The header excludes W's one Command line message (4766 → 4765) but leaves E at 91, and there is a fifth non-file message which is class E: E0013 bad-plugin-value, because pylint.extensions.emptystring is missing from pylint 4.0.8. Under the same rule, file-scoped E is 90. pylint's own messageTypeCount agrees — error: 90, warning: 4765, refactor: 642, convention: 542 — and the paragraph's own arithmetic betrays the seam: 91 + 4765 + 542 + 645 is 6043, one short of the stated 6044 floor. The dead plugin is now #767.

The vermin dispute is resolved, against the reviewer. It retracted its own 107 as an off-by-one — its pattern matched vermin's Using detected config: …/vermin.ini banner as a flagged file. 106 is correct at both 73f09aecb and 932cb48d1, so vermin did not move across #754, and the header's wording is right. The conclusion is unchanged either way: recorded 105 against actual 106 still means three of the four had drifted.

Also verified: each of the three subTests fails independently when exactly one scope is broken, under both pytest and python -m unittest (FAILED (failures=1), not a passing parent), with the diagnostic naming the right Makefile line; tests/project/ is 127 passed / 489 subtests under both runners, and 486 → 489 is exactly the new test's 3 subtests.

[JarryShaw]

Final cross-review at fd732a18e: GOOD TO GO (opus, a different model from the author).

The one figure neither reviewer nor I had verified is correct. The narrowed --enable=E,F count of 87 was changed on the author's own initiative, not on instruction, and it holds under both readings of "narrowing": exactly one non-file E (E0013 bad-plugin-value) appears in each, so file-scoped narrowed E is 88 − 1 = 87, with unsubscriptable-object 36 and no-member 31 correctly left file-attributed.

All four figures now reconcile three ways:

	whole-run	non-file	pinned	pylint's own messageTypeCount
E	91	1 (E0013)	90	error: 90
W	4766	1 (W0012)	4765	warning: 4765
C	542	0	542	convention: 542
narrowed E	88	1 (E0013)	87	—

So one dead plugin (#767) had distorted three separate published figures. The arithmetic seam is closed too — the header now supplies both conventions, and all six previously-quoted totals reconcile exactly against 91 + 4766 + 542 + R for R ∈ {645, 647, 659, 662, 680}.

The citation count was three, not four. I had told the author "the four test modules that load options.py by path"; it found three and declined to write four on my word. Verified: of 11 modules calling spec_from_file_location, exactly three resolve that file. test_construction_keyword_check_unit.py mentions it only in prose — which is the same defect as the CONTRIBUTING.md:110 citation this round removed. Declining was right.

The merge test was not a formality. #764 rewrote pcapkit/const/reg/apptype/apptype.py and pcapkit/vendor/reg/apptype/apptype.py, both inside Makefile:125's recursive scope, which the widened test now checks. Green on the merge means the new test actually exercised main's new generated code and found it isort-clean. No conflicts, tests/project/ 127 passed / 489 subtests under both runners.

Two disclosed and accepted rather than fixed: E0013's pseudo-path is Command line or configuration file where the header says Command line — the operative claim ("rather than to a file") holds for all five and grep '^Command line' matches both, so the recipe still works. And the new test still skips on every CI leg, tracked as #766 and blocked on #755 — a real coverage gap, disclosed in the docstring rather than hidden.

One commit, unpublished, awaiting the owner.