Updated smoke tests

.github/actions/apt-bootstrap/action.yml

@@ -30,12 +30,23 @@ inputs:
     description: Install packages with --no-install-recommends when set to true.
     required: false
     default: "false"
+  update_timeout_seconds:
+    description: Maximum seconds to allow each apt-get update attempt before retrying.
+    required: false
+    default: "600"
+  install_timeout_seconds:
+    description: Maximum seconds to allow each apt-get install attempt before retrying.
+    required: false
+    default: "1800"
 
 runs:
   using: composite
   steps:
     - name: Harden apt update and install
       shell: bash
+      env:
+        APT_UPDATE_TIMEOUT_SECONDS: ${{ inputs.update_timeout_seconds }}
+        APT_INSTALL_TIMEOUT_SECONDS: ${{ inputs.install_timeout_seconds }}
       run: |
         set -euo pipefail
         bash "${{ github.action_path }}/bootstrap.sh" \

.github/actions/apt-bootstrap/bootstrap.sh

@@ -8,6 +8,8 @@ INITIAL_BACKOFF_SECONDS=5
 QUIET=false
 UPDATE_ONLY=false
 NO_INSTALL_RECOMMENDS=false
+APT_UPDATE_TIMEOUT_SECONDS="${APT_UPDATE_TIMEOUT_SECONDS:-600}"
+APT_INSTALL_TIMEOUT_SECONDS="${APT_INSTALL_TIMEOUT_SECONDS:-1800}"
 
 while [[ $# -gt 0 ]]; do
   case "$1" in
@@ -50,6 +52,10 @@ apt_update() {
   sudo apt-get clean
   sudo rm -rf /var/lib/apt/lists/*
   local cmd=(
+    timeout
+    --signal=TERM
+    --kill-after=60s
+    "${APT_UPDATE_TIMEOUT_SECONDS}s"
     sudo apt-get
     -o Acquire::Retries=3
     -o Acquire::http::No-Cache=true
@@ -91,6 +97,10 @@ fi
 
 read -r -a package_array <<< "$FULL_PACKAGES"
 install_cmd=(
+  timeout
+  --signal=TERM
+  --kill-after=60s
+  "${APT_INSTALL_TIMEOUT_SECONDS}s"
   sudo env
   DEBIAN_FRONTEND=noninteractive
   APT_LISTCHANGES_FRONTEND=none

.github/actions/generic-source-regression-check/action.yml

@@ -20,6 +20,10 @@ inputs:
     description: Manually pinned upstream tag/ref to clone for the next stable candidate
     required: false
     default: ""
+  pypi_package:
+    description: Optional PyPI distribution name to use for next-version resolution when the runnable artifact is published on PyPI.
+    required: false
+    default: ""
   limited_cpu_probe:
     description: Optional bounded Arm64 CPU/source/import/help proof script to run after the candidate source resolves.
     required: false
@@ -80,6 +84,7 @@ runs:
         LANE_KIND="${{ inputs.lane_kind }}"
         OVERRIDE_VERSION="${{ inputs.next_version_override }}"
         OVERRIDE_TAG="${{ inputs.candidate_tag_override }}"
+        PYPI_PACKAGE="${{ inputs.pypi_package }}"
         LIMITED_CPU_PROBE="${INPUT_LIMITED_CPU_PROBE:-}"
         LIMITED_CPU_DESCRIPTION="${INPUT_LIMITED_CPU_DESCRIPTION:-A bounded CPU-side proof completed on the Arm64 runner. This is not a full specialized runtime validation.}"
         DEFER_ON_LIMITED_CPU_PROBE_FAILURE="${INPUT_DEFER_ON_LIMITED_CPU_PROBE_FAILURE:-false}"
@@ -154,6 +159,69 @@ runs:
           STATUS_KIND="FOUND_OVERRIDE"
           LATEST_VERSION="$OVERRIDE_VERSION"
           CANDIDATE_TAG="$OVERRIDE_TAG"
+        elif [ -n "$PYPI_PACKAGE" ]; then
+          PIP_INDEX_OUTPUT=$(python3 -m pip index versions "$PYPI_PACKAGE" --only-binary=:all: 2>/tmp/pypi-index-error.log || true)
+          PYPI_RESULT=$(PIP_INDEX_OUTPUT="$PIP_INDEX_OUTPUT" python3 - "$CURRENT" "$PYPI_PACKAGE" <<'PY'
+        import os
+        import re
+        import sys
+
+        current = sys.argv[1].strip()
+        package = sys.argv[2].strip()
+        output = os.environ.get("PIP_INDEX_OUTPUT", "")
+        pre_re = re.compile(r"(?:alpha|beta|rc|preview|pre|nightly|dev)", re.I)
+
+        def normalize(value: str):
+            value = value.strip().lstrip("vV")
+            if pre_re.search(value):
+                return None
+            if not re.match(r"^\d+(?:[._-]\d+)*$", value):
+                return None
+            display = value
+            parts = tuple(int(x) for x in re.split(r"[._-]", value))
+            return parts, display
+
+        match = re.search(r"Available versions:\s*(.+)", output)
+        versions = []
+        if match:
+            versions = [item.strip() for item in match.group(1).split(",") if item.strip()]
+        else:
+            # Older pip output may only print the current latest as "package (version)".
+            latest_match = re.search(rf"^{re.escape(package)}\s+\(([^)]+)\)", output, re.M | re.I)
+            if latest_match:
+                versions = [latest_match.group(1).strip()]
+
+        current_norm = normalize(current)
+        parsed = []
+        for version in versions:
+            norm = normalize(version)
+            if norm is not None:
+                parsed.append(norm)
+
+        if not parsed:
+            print("UNRESOLVED\t\t")
+            raise SystemExit(0)
+
+        parsed.sort(key=lambda item: item[0])
+        latest = parsed[-1]
+
+        if current_norm is None:
+            print(f"METADATA_REVIEW\t{latest[1]}\t{latest[1]}")
+            raise SystemExit(0)
+
+        newer = [item for item in parsed if item[0] > current_norm[0]]
+        if not newer:
+            print(f"NONE\t{current_norm[1]}\t{current}")
+            raise SystemExit(0)
+
+        candidate = newer[-1]
+        print(f"FOUND_PYPI\t{candidate[1]}\t{candidate[1]}")
+        PY
+          )
+
+          STATUS_KIND=$(printf '%s' "$PYPI_RESULT" | awk -F '\t' '{print $1}')
+          LATEST_VERSION=$(printf '%s' "$PYPI_RESULT" | awk -F '\t' '{print $2}')
+          CANDIDATE_TAG=$(printf '%s' "$PYPI_RESULT" | awk -F '\t' '{print $3}')
         else
           mapfile -t RAW_TAGS < <(git ls-remote --tags --refs "https://github.com/${REPO}.git" 2>/dev/null | awk '{print $2}' | sed 's#refs/tags/##')
 
@@ -247,6 +315,14 @@ runs:
               "Automatic next-version resolution needs manual review and runtime validation is not automated" \
               "The baseline version ${CURRENT} does not parse cleanly for automatic ordering, while ${REPO} exposes newer stable-looking tags such as ${LATEST_VERSION}. This workflow also does not install and execute the package on Arm64."
             ;;
+          FOUND_PYPI)
+            run_limited_cpu_probe "${LATEST_VERSION}" "${CANDIDATE_TAG}" || \
+              emit_runtime_not_automated \
+                "${LATEST_VERSION}" \
+                "${LATEST_VERSION}" \
+                "Next PyPI release resolved, but runtime validation is not automated" \
+                "Baseline ${CURRENT} passed bounded checks. PyPI resolved ${PYPI_PACKAGE} candidate ${LATEST_VERSION}, but this workflow does not have a package-specific runtime probe configured."
+            ;;
           FOUND_OVERRIDE)
             rm -rf next-src
             if git clone --depth 1 --branch "$CANDIDATE_TAG" "https://github.com/${REPO}.git" next-src >/dev/null 2>&1; then

.github/workflows/test-activemq.yml

@@ -1,6 +1,7 @@
 name: Test ActiveMQ on Arm64
 
 on:
+  workflow_dispatch:
   workflow_call:
     outputs:
       contract_version:
@@ -113,14 +114,10 @@ jobs:
       - name: Install ActiveMQ
         id: install
         run: |
-          set -e
+          set -euo pipefail
           echo "Installing ActiveMQ from Ubuntu packages..."
 
-          sudo apt-get update
-          # Install Java + ActiveMQ (classic)
-          sudo DEBIAN_FRONTEND=noninteractive apt-get install -y \
-            default-jre-headless \
-            activemq
+          bash .github/actions/apt-bootstrap/bootstrap.sh --packages "default-jre-headless activemq"
 
           # Find activemq binary
           ACTIVEMQ_BIN=$(command -v activemq || dpkg -L activemq | grep '/bin/activemq$' | head -1 || true)
@@ -377,4 +374,3 @@ jobs:
           echo "3. Check 'activemq --help' output: ${{ steps.test3.outputs.status || 'skipped' }}" >> $GITHUB_STEP_SUMMARY
           echo "4. Check Java dependency: ${{ steps.test4.outputs.status || 'skipped' }}" >> $GITHUB_STEP_SUMMARY
           echo "5. Check ActiveMQ has configuration files under /etc: ${{ steps.test5.outputs.status || 'skipped' }}" >> $GITHUB_STEP_SUMMARY
-

.github/workflows/test-java-openjdk.yml

@@ -142,10 +142,10 @@ jobs:
       - name: Install Java/OpenJDK
         id: install
         run: |
+          set -euo pipefail
           echo "Installing OpenJDK 17..."
 
-          sudo apt-get update
-          if sudo apt-get install -y openjdk-17-jdk; then
+          if bash .github/actions/apt-bootstrap/bootstrap.sh --packages "openjdk-17-jdk"; then
             echo "OpenJDK installed successfully"
             echo "install_status=success" >> $GITHUB_OUTPUT
           else

.github/workflows/test-shap.yml

@@ -379,6 +379,7 @@ jobs:
           baseline_version: ${{ steps.version.outputs.version || env.BASELINE_VERSION }}
           github_repo: ${{ env.GITHUB_REPO }}
           lane_kind: ${{ env.LANE_KIND }}
+          pypi_package: shap
           limited_cpu_probe: |
             python -m venv next-venv
             . next-venv/bin/activate

.github/workflows/test-spacy.yml

@@ -79,6 +79,10 @@ jobs:
     permissions:
       contents: read
       actions: read
+    env:
+      SPACY_VERSION: "3.8.14"
+      NUMPY_CONSTRAINT: "numpy<2.0"
+      CLICK_CONSTRAINT: "click<9"
 
     outputs:
       contract_version: "2.0"
@@ -121,9 +125,14 @@ jobs:
           python3 -m venv venv
           source venv/bin/activate
           python -m pip install --upgrade pip
-          python -m pip install spacy
+          python -m pip install "$NUMPY_CONSTRAINT" "$CLICK_CONSTRAINT" "spacy==${SPACY_VERSION}"
+          python -m pip check
           echo "$PWD/venv/bin" >> "$GITHUB_PATH"
-          if python -c "import spacy" >/dev/null 2>&1; then
+          if python - <<'PY'
+          import spacy
+          print(f"spaCy import OK: {spacy.__version__}")
+          PY
+          then
             echo "install_status=success" >> "$GITHUB_OUTPUT"
           else
             echo "install_status=failed" >> "$GITHUB_OUTPUT"
@@ -142,7 +151,7 @@ jobs:
         continue-on-error: true
         run: |
           START_TIME=$(date +%s)
-          if python -c "import spacy" >/dev/null 2>&1; then
+          if python -c "import spacy; print('spaCy import OK')"; then
             echo "status=passed" >> "$GITHUB_OUTPUT"
           else
             echo "status=failed" >> "$GITHUB_OUTPUT"

.github/workflows/test-wireshark.yml

@@ -80,7 +80,7 @@ jobs:
   test-wireshark:
     runs-on: ubuntu-24.04-arm
     env:
-      WIRESHARK_VERSION: "4.6.3"
+      WIRESHARK_VERSION: "4.6.6"
 
     outputs:
       contract_version: "2.0"
@@ -123,38 +123,7 @@ jobs:
         id: install
         run: |
           set -euo pipefail
-          sudo apt-get update
-          sudo DEBIAN_FRONTEND=noninteractive apt-get install -y \
-            build-essential \
-            cmake \
-            ninja-build \
-            flex \
-            bison \
-            curl \
-            python3-dev \
-            qt6-base-dev \
-            qt6-tools-dev \
-            qt6-multimedia-dev \
-            libbrotli-dev \
-            libc-ares-dev \
-            libcap-dev \
-            libgcrypt20-dev \
-            libglib2.0-dev \
-            libgnutls28-dev \
-            libkrb5-dev \
-            liblua5.4-dev \
-            libmaxminddb-dev \
-            libminizip-dev \
-            libnghttp2-dev \
-            libnl-3-dev \
-            libnl-genl-3-dev \
-            libpcap-dev \
-            libsbc-dev \
-            libsnappy-dev \
-            libspeexdsp-dev \
-            libssh-gcrypt-dev \
-            libsystemd-dev \
-            libxml2-dev
+          bash .github/actions/apt-bootstrap/bootstrap.sh --packages "build-essential cmake ninja-build flex bison curl python3-dev qt6-base-dev qt6-tools-dev qt6-multimedia-dev libbrotli-dev libc-ares-dev libcap-dev libgcrypt20-dev libglib2.0-dev libgnutls28-dev libkrb5-dev liblua5.4-dev libmaxminddb-dev libminizip-dev libnghttp2-dev libnl-3-dev libnl-genl-3-dev libpcap-dev libsbc-dev libsnappy-dev libspeexdsp-dev libssh-gcrypt-dev libsystemd-dev libxml2-dev"
 
           BASE_DIR="${RUNNER_TEMP}/wireshark-current"
           rm -rf "$BASE_DIR"