Skip to content

Small fixes from #39–#41; uploads without tokens - #42

Closed
Tobias-Fischer wants to merge 36 commits into
mainfrom
small-fixes
Closed

Tobias-Fischer wants to merge 36 commits into
mainfrom
small-fixes

Conversation

@Tobias-Fischer

Copy link
Copy Markdown
Collaborator

Takes the parts of @tdejager's #39, #40 and #41 that fix real problems on main, kept small (see the review comments there), and removes the upload tokens.

From #39

  • automerge: decides by the label the PR has now, since labeled/unlabeled events can arrive out of order. It also refuses to turn on without the bot app or PAT, because a merge made with GITHUB_TOKEN doesn't start the build workflow. A per-PR concurrency group is added too.
  • Locked installs: CI uses locked: true instead of frozen, so a lock file that doesn't match pixi.toml fails up front.
  • Generation: one build-branch generation per distribution at a time (generate-<distro> concurrency group). Two quick merges no longer push build branches in parallel.
  • check-patches: now also checks shared/patch. As in vinca, a distribution's patches for a package replace the shared ones. Until now, ros2-swri-serial-util.patch was never checked.

From #40

  • rs check accepts build_number: 0 (what new-distro writes) and an empty migration list.
  • The pinning renders migrations: [].
  • update-pinning fails when render-pinning fails.

From #41 (import_distro.py)

  • With --distro, ros-<source>-* names are converted using the source distribution.
  • Optional files the old repository no longer has are removed on re-import.
  • ci.yaml is kept on re-import.

Uploads without tokens

  • prefix.dev uploads use trusted publishing (OIDC) only: the PREFIX_API_KEY handling is gone.
  • The anaconda.org upload is removed as well: no ANACONDA_API_TOKEN, also stripped from the generated workflows, so no token appears on the command line any more.
  • Distributions whose channel is still on anaconda.org (humble, jazzy) are read from there and upload to ROBOSTACK_UPLOAD_CHANNEL. Without it, the upload fails with a clear message.

Left out

Verified

  • rs check passes, and actionlint is clean.
  • A regenerated jazzy workflow has no token lines and keeps id-token: write.
  • Upload dry runs:
    • jazzy without the redirect fails with the message;
    • jazzy with the test channel uploads to tobias-fischer/robostack-distro-test;
    • lyrical uploads to robostack-lyrical.
  • Patch discovery layers the directories as vinca does, and lyrical's check now includes the shared patch.

Fixes #27, fixes #29, fixes #32, fixes #36. Part of #26, #31, #34, #38.

🤖 Generated with Claude Code

Tobias-Fischer and others added 30 commits October 6, 2026 19:10
distros/<distro>/ holds only what is specific to a distribution; shared/ holds
the rosdep mapping, pinning and tests; tools/robostack.py runs every task for a
distribution (pixi run rs <distro> <task>); CI builds only the distributions a PR
touches. Data copied from RoboStack/ros-{rolling,humble,lyrical,kilted} main and
ros-jazzy codex/cross-distro-sync.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ings

shared/vinca.yaml (common settings and the 72 packages every distribution
selects), shared/pkg_additional_info.yaml (36 entries) and
shared/dependencies.yaml (61 entries) hold what all distributions agree on;
distros/<d>/ keeps the rest. tools/robostack.py assembles distros/<d>/work/
from both and runs every task there; skip_existing, conda_index and the
snapshot paths are derived. The full linux-64 recipe sets of rolling, humble
and lyrical are byte-identical before and after.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…anches

- tools/maintenance.py: check (sanity checks, run in CI), update-snapshot and
  find-stale per distribution, update-pinning (shared conda-forge pinning) and
  new-distro; parse-command for @robostack-bot comments and command issues.
- .github/workflows/bot.yml + issue template: weekly snapshot/pinning PRs,
  commands on demand.
- Staged builds: ROBOSTACK_UPLOAD_CHANNEL redirects uploads to a (test)
  prefix.dev channel, 'none' (default outside RoboStack) skips them;
  PUSH_BUILD_BRANCHES enables pushing build branches outside RoboStack.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…round trip); check it

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… work/); refuse the fallback

Without ./.scripts/build_win.bat in its working directory vinca-gha silently
falls back to an outdated built-in Windows script (boa build); found by pushing
a test build branch.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Share vinca.yaml, pkg_additional_info.yaml and dependencies.yaml settings
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- tools/maintenance.py add-package PKG... [DISTRO...] [--preview]: adds the
  packages (normalising ros2-/ros-<distro>- names) to the selection of every
  given distribution that has them, in sorted position, in shared/vinca.yaml if
  that's all of them; generates the linux-64 recipes and lists what will be
  built and what is already published as a dependency.
- Package request issue form (anyone): the bot replies with a preview;
  @robostack-bot add-package by a maintainer opens the PR, which closes the issue.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…e, import tool

- main.yml pushes the staged build branches whenever the bot app (or GHA_PAT) is
  available, without an organisation check; the build workflows upload to each
  distribution's channel unless ROBOSTACK_UPLOAD_CHANNEL redirects them.
- robostack-bot add-package opens the PR for anyone (valid ROS package names
  only, at most 10 per request); the other commands stay with maintainers.
- tools/import_distro.py moves a distribution here from its own repository
  (re-importing lyrical reproduces distros/lyrical exactly).
- kilted keeps the pins its published packages were built with.
- README for users and maintainers, bug report template with a distribution field.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…resh plotjuggler Windows patch for 3.17.2

- humble: same fix as rolling/lyrical (windows.h min/max macros break
  rclcpp's duration.hpp/time.hpp in influx_component).
- jazzy: the old Windows patch targeted an older plotjuggler (its protobuf
  changes are upstream now); rebased rolling's 3.17.2 Windows patch (Qt link
  libraries, plotjuggler_base exports) onto jazzy's release.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…PI_KEY; don't build tl_expected/sophus under conda-forge names

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ing updates, fix linking the request

- update-rosdistro-snapshot and update-conda-forge-pinning bump build_number and the
  mutex minor version, drop per-package build numbers the new one catches up with, and
  (pinning) move plain mutex run_constraints to the new pins
- commands take several distributions or all; one job per distribution
- issue forms: no pre-filled title, multi-select distributions defaulting to all,
  add-package in the command form (anyone)
- fix the Link the request step (' #' started a YAML comment)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ci_config.py also matches plain (unprefixed) names, for packages vinca built under a
conda-forge name. Reset ci.yaml after merging.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ebuilds and package selection; fold long bot reports

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…brary/autoware_trajectory; distro-specific ros2cli test; drop a cancelled run's last package before caching

- parameter_traits and generate_parameter_library 0.7.6: use conda-forge's tl-expected
  (tl_expected is mapped to cpp-expected); autoware_trajectory takes humble's patch
- ros2cli test: only rolling's and lyrical's patches install a fish completion
- testpr: a cancelled build can package an empty build (seen on Windows); remove the
  newest artifact before saving the cache; evict jazzy's empty rmw_fastrtps_shared_cpp

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…umber from the channel; jazzy/humble/kilted robot_state_publisher test

- pyqt-builder 1.20 (conda-forge, 2026-10-07) defaults to sip ABI 12.20/13.13, which
  needs sip >=6.16; qt_gui_cpp keeps sip <6.16 and failed with a missing sip.h.in
- update-rosdistro-snapshot is no longer scheduled; its bump sets build_number to the
  highest build of the distribution's released packages + 1 and removes all
  per-package build numbers
- robot_state_publisher osx test: CycloneDDS 0.10 (humble, jazzy, kilted) doesn't know
  allow_multicast; use ROS_LOCALHOST_ONLY there as before

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ected patches for autoware_downsample_filters and pick_ik

- update-rosdistro-snapshot snapshots the distribution's latest sync tag in
  ros/rosdistro (e.g. jazzy/2026-10-05) instead of rosdistro master, which includes
  releases that are only in ros-testing; the sync is recorded as rosdistro_sync in
  distro.yaml and the PR links the rosdistro changes and the Discourse announcement
- the bot checks daily for new syncs (rs rosdistro-syncs) and opens or updates one PR
  per distribution; rolling (rosdistro_sync: manual) keeps reading master on request
- vinca from Tobias-Fischer/vinca feat/snapshot-rosdistro-ref (vinca-snapshot
  --rosdistro-ref) until it is merged upstream

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
All matrix jobs on a platform share the cache key, so they raced to save it
("Unable to reserve cache ... another job may be creating this cache").

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…/vinca#161)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…::tl_expected

conda-forge's libroboplan-core 0.7.0 build 3 links the system tl-expected
(open-planning/roboplan#369), so the bundled roboplan::tl_expected target is gone.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ted first

Carry open-planning/roboplan-ros#85 for jazzy, lyrical and rolling: conda-forge's
libroboplan-core 0.7.0 build 3 doesn't export roboplan::tl_expected.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…in rolling

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…#5)

Ready for RoboStack: production defaults, package requests from anyone, import tool
pixi's task shell re-parsed it, so an apostrophe in a package request broke the
plan step (issue #9).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
robostack-bot: pass the request text through the environment
…s2-* names, no kilted) (#8)

See #8 for the full description.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ect (#16)

See #16.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Tobias-Fischer and others added 6 commits October 9, 2026 15:06
)

prefix.dev's Repository Access (OIDC) matches a GitHub workflow by exact file
name. Each build branch only carries its own workflow, so one fixed name lets
a single authorized source cover every distribution and platform. README:
how to set it up, and the canonical <namespace>/<channel> upload reference.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
)

The build workflows pass PREFIX_API_KEY from the (now deleted) secret, so the
variable is set but empty; rattler-build then refuses --generate-attestation
("cannot be used with an API key").

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
)

With ROBOSTACK_UPLOAD_CHANNEL set (the test channel), the packages earlier
stages build are uploaded there, but rattler-build only searched the
distribution's release channel and conda-forge, so later stages failed to
resolve them (e.g. humble's yasmin_editor). Put that channel first; reruns
then also skip what is already uploaded.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
prefix.dev's sharded repodata, which rattler reads, lists a new upload a few
minutes after repodata.json does. A stage starting right after the previous
one uploaded then fails with "No candidates were found" for a package that
is on the channel (lyrical linux-64, plansys2_pddl_parser). build-ci now
retries that failure twice, 3 minutes apart; other failures aren't retried.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
From Tim's PRs (the parts that fix real problems on main):
- automerge goes by the label the PR has now (events can arrive out of order)
  and refuses to turn on without the bot token (a GITHUB_TOKEN merge doesn't
  start the build workflow)
- CI installs with locked: the lock file must match pixi.toml
- one build-branch generation per distribution at a time
- check-patches includes shared/patch (a distribution's patches for a
  package replace the shared ones, like in vinca)
- rs check accepts build_number 0 and an empty migration list; the pinning
  renders `migrations: []`; update-pinning fails when render-pinning does
- import_distro: names follow the source distribution with --distro, files
  the old repository no longer has are removed, ci.yaml is kept

Uploads use prefix.dev trusted publishing only: PREFIX_API_KEY and the
anaconda.org upload (ANACONDA_API_TOKEN, also stripped from the generated
workflows) are gone. Distributions whose channel is still on anaconda.org
are read from there and upload to ROBOSTACK_UPLOAD_CHANNEL.

Co-Authored-By: Tim de Jager <tdejager89@gmail.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

1 participant