100 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Ramon Roche	e3480a1e37	chore(agents): add Codex instructions and skills ... Expose PX4 guidance and workflows to Codex while keeping root instructions concise and reusing tracked Claude workflows where possible. Assisted-by: Copilot:gpt-6-astra Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-09-07 10:51:49 -07:00
Ramon RocheandFarhang	51b9a86a7e	docs(dev_setup): refresh macOS environment page to match macos.sh (#28295) ... The macOS setup page has not been edited since 2026-04-20, while Tools/setup/macos.sh changed five times after that. The page still describes the px4-sim Homebrew formula, which has been a deprecated no-op in PX4/homebrew-px4 since 2026-04-20, and tells users to add simulation later with `brew install px4-sim`, which installs nothing. On Homebrew 6.0+ it does not even load, because the page never mentions the tap trust the script now performs. Stop enumerating the script's packages and taps in the page; that list is what went stale. Say what the script does in one sentence, point at macos.sh as the source of truth, and document only the user-facing behaviour: Gazebo, XQuartz and a JDK come with --sim-tools, that path needs sudo, taps are trusted for Homebrew 6, and the way to add simulation later is to re-run the script with --sim-tools. Drop the Python prerequisite; the script installs Python and creates the venv itself. Fix the pages it links to that contradict it: the simulation overview still marked Gazebo on Apple Silicon as unstable (pre-dates the 2026-04-20 fix), the supported-targets table claimed Gazebo Classic on macOS with nothing installing it, the jMAVSim page said Java must be installed manually on macOS, and the build troubleshooting page recommended ulimit 300 and running mac_set_ulimit.sh as a script (which cannot change the caller's shell limit). Assisted-by: Claude:claude-fable-5 Signed-off-by: Ramon Roche <mrpollo@gmail.com> Co-authored-by: Farhang <46557204+farhangnaderi@users.noreply.github.com>	2026-09-07 13:14:34 -04:00
Ramon Roche	6f93287fdd	ci(macos): rewrite gz tap pin refresh in Ruby under brew ruby ... The bash version spent most of its lines on plumbing: parsing a report back out of a per-commit `brew ruby` child, awk and herestrings for set logic, bash 3.2 workarounds, and a trap to restore the tap. The job itself is small and lives inside Homebrew anyway, so run the whole thing under Homebrew's Ruby and call its tap, formula and bottle APIs directly. One process instead of one Homebrew startup per candidate commit, the tap checkout restored by ensure, tarballs checked with Net::HTTP, and no second language embedded in a string. Formulary.clear_cache and Tap#clear_cache between checkouts keep each candidate's formulae fresh. GITHUB_OUTPUT still arrives because brew forwards GITHUB_* whenever CI is set. Same walk, same exemption for formulae unbottled at the pin, same outputs; verified to pick the same commit as the bash version. Assisted-by: Claude:claude-fable-5-1 Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-09-04 13:26:30 -07:00
Ramon Roche	2d6329fab2	ci(macos): brew update before macos.sh so both legs see current core ... The macOS runner images set HOMEBREW_NO_AUTO_UPDATE in their bashrc and carry a homebrew-core snapshot from image build time. Today the macos-15 image (20260828) installs protobuf 36.0 while macos-26 (20260707) still installs 35.1, so the two legs of this workflow cannot both be compatible with any single gz tap pin. The pin is refreshed against tap HEAD, which OSRF keeps consistent with current homebrew-core, so update core before installing. Dev machines already do this through brew's auto-update. Assisted-by: Claude:claude-fable-5-1 Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-09-04 13:26:30 -07:00
Ramon Roche	832f8ebac8	build(macos): bump gz tap pin to 43aee9cc6e02 ... homebrew-core moved to protobuf 36.0 and abseil 20260817.0, and the macos-15 runner image (20260828) now ships that snapshot. The gz bottles at the pinned commit c90f81ac were built against protobuf 35.1, so the gz_bridge build fails on every run since today with gz/msgs/details/discovery.pb.h:17:2: fatal error: "Protobuf C++ gencode is built with an incompatible version of" on main as well as on this PR. 43aee9cc is tap HEAD, where OSRF has rebuilt every gz-harmonic dependency for protobuf 36.0 and abseil 20260817.0 (the gz-msgs10 10.4.0_2 bottle's INSTALL_RECEIPT records both). Tools/ci/refresh_gz_tap_pin.sh picked this commit. Assisted-by: Claude:claude-fable-5-1 Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-09-04 13:26:30 -07:00
Ramon Roche	045f249929	ci(macos): move gz tap pin refresh into a script that checks bottles ... The weekly refresh workflow carried its logic inline, compared only the tap SHA against the pin, and duplicated the --sim-tools package list. `brew install --dry-run` never prints "from source", so its bottle check could not fire. Tools/ci/refresh_gz_tap_pin.sh now owns the job and the workflow calls it. It reads the osrf/simulation formulae from macos.sh, walks the tap from HEAD back to the pin, asks Homebrew at each commit whether every formula in the runtime closure has a bottle for the host, HEAD-requests each tarball, and rewrites the pin to the first commit that passes. Formulae with no bottle at the current pin (the gz-harmonic meta-formula, which OSRF never bottles) are not required. peter-evans/create-pull-request opens or updates the bot PR from the script's outputs, so an unmerged bump is refreshed instead of duplicated. The job runs on macos-15, the oldest macOS in compile_macos.yml, because Homebrew pours an older macOS bottle onto a newer one, not the reverse. Assisted-by: Claude:claude-fable-5-1 Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-09-04 13:26:30 -07:00
Ramon Roche	0161358033	chore(nuttx): bump NuttX to px4_firmware_nuttx-12.12.0+ tip ... Advance the NuttX submodule from 1db7c59 to the fork branch tip f07832f0 (px4_firmware_nuttx-12.12.0+), pulling in three backports: - FlexCAN: store the TX deadline only once the frame is sent - FlexCAN: assign MAXMB rather than OR-ing it in - STM32F412: set SRAM1_END to 256KiB (#407) The two FlexCAN backports are the apache/nuttx#19970 follow-ups the branch was missing; they land the corrected i.MX RT TX-abort behavior. Signed-off-by: Ramon Roche <mrpollo@gmail.com> Assisted-by: Claude:claude-fable-5-1	2026-09-03 12:31:07 -07:00
Ramon Roche	edcb4460a1	fix(uavcan): use PRIu32 for bitrate readback print on NuttX 12 ... The UAVCAN_BITRATE code merged via #28457 prints the driver's arbi_bitrate (uint32_t) with %u. On the NuttX 12.12 toolchain uint32_t is unsigned long, so -Werror=format fails every SocketCAN board (imxrt, s32k). Use PRIu32 for the uint32_t; kbps stays %u as it is a uint16_t promoted to int. Assisted-by: Claude:claude-fable-5 Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-09-03 12:31:07 -07:00
Ramon Roche	296c1e4297	chore(platforms): drop dead cdc_acm_check.cpp resurrected by rebase ... Main removed this file in f05739035e (#28185) when USB autostart moved into the cdcacm_autostart driver. The NuttX upgrade rebase brought back a NuttX 12 adaptation of it, but nothing references it in any build file, so it is 370 lines of dead code. Assisted-by: Claude:claude-fable-5 Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-09-03 12:31:07 -07:00
Ramon Roche	ccc62175e4	fix(boards): restore buffered stdio on fmu-v5x and PIX6 ... The upgrade defconfig sweep (04c00266e52) replaced CONFIG_STDIO_BUFFER_SIZE=256 with CONFIG_STDIO_DISABLE_BUFFERING=y on these two boards. On NuttX 12.12 that config hits an upstream regression (62c2b1abba): task_init_stream() only assigns fs_cookie/fs_oflags inside the buffered branch, so with unbuffered stdio every spawned task's stdout FILE is left zeroed and bound to fd 0. All printf output on the board is silently discarded, including the boot log and every shell command that prints via stdio; raw fd writes (top, dmesg) still work, which made this hard to spot. Verified on fmu-v5x hardware (fileno(stdout)==0 in spawned tasks, EACCES on flush over the MAVLink shell). Restoring buffered stdio returns these boards to their pre-upgrade configuration. The upstream fix apache/nuttx 2b1cf4238756 (post-12.12.0) should additionally be backported to px4_firmware_nuttx-12.12.0+ to cure the class for any unbuffered config. Assisted-by: Claude:claude-fable-5 Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-09-03 12:31:07 -07:00
Ramon Roche	49f45653ee	fix(mavlink_shell): bump nsh task stack to 4096 for NuttX 12 ... The nsh output path changed architecture in NuttX 12: nuttx-apps 95f32fd018 decoupled nshlib from FILE streams, so every output call now runs vdprintf() with the stream engine and full VFS write chain on the nsh task stack. On CONFIG_DEFAULT_SMALL boards the lib_get_tempbuffer() fallback additionally compiles to alloca() on the parse path. The hardcoded 2048 byte stack overflows, and because NuttX 12 keeps the TLS block at the stack base the failure is a silent mute shell rather than a hardfault. Verified on fmu-v5x hardware: shell dead at 2048, working at 4096. Mirrors the nshterm stack fix already on this branch (8a8f32699b7). Assisted-by: Claude:claude-fable-5 Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-09-03 12:31:07 -07:00
Ramon Roche	05e6780eaa	fix(version): derive NuttX version from the fork branch name ... NUTTX_GIT_TAG_STR was computed by taking the highest nuttx-X.Y.Z tag in the NuttX submodule, without checking that the tag is an ancestor of the checkout. The PX4/NuttX fork's tags were last synced in Oct 2022 and topped out at nuttx-11.0.0, so every build has reported NuttX 11.0.0 regardless of the actual kernel (ver all, AUTOPILOT_VERSION.os_sw_version, the ULog sys_os_ver_release field). With the nuttx-12.12.0 tag now pushed for the NuttX 12.12 upgrade (#26215), fresh clones of main would flip to misreporting 12.12.0 while still running the 10.3-era kernel. Resolve the version from the fork branch name recorded in .gitmodules (px4_firmware_nuttx-X.Y.Z+) instead, which is updated atomically with every kernel change, and fall back to git describe for checkouts that do not follow the fork convention. Output format is unchanged: vX.Y.Z, as consumed by version_tag_to_number(). Assisted-by: Claude:claude-fable-5 Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-09-01 14:58:48 -07:00
Ramon Roche	6db88017b8	ci(macos): key ccache per matrix OS ... Both legs of the macOS matrix built the same ccache key, since the prefix carried no OS component and setup-ccache appends only ref and sha. Two consequences, reproducible on every run: One leg always lost its save, reporting "Unable to reserve cache with key ccache-macos-<ref>-<sha>, another job may be creating this cache". The survivor then poisoned the other. compiler_check=content means ccache hashes the compiler binary, and macos-latest is now macOS 26 while macos-15 is macOS 15, so neither can reuse the other's objects. Measured on run 32291495373, same commit, after ccache -z: macos-latest hit 860/944 (91.10%) on px4_sitl while macos-15 managed 332/944 (35.17%), recompiling two thirds of what it should have had cached. The 200M budget was shared between both toolchains as well, and reported full, so they were also evicting each other. Assisted-by: Claude:claude-opus-5 Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-08-20 12:11:36 -07:00
Ramon Roche	9d6a648a07	fix(kconfig): surface generator errors from loadconfig ... ensure_env() sent the child's stdout to DEVNULL to keep this process's stdout parseable, but the generator reports missing imports with print(), so that was exactly the output being discarded. What survived was a CalledProcessError whose message repeats the argv, and the argv carries every .msg path: 9901 bytes on one line, naming no cause and no remedy. Capture both streams and, on failure, exit with the child's own output. The message names the command that failed and its exit code rather than asserting what kind of failure it was, so it stays accurate whatever the child is or why it failed. Missing empy now reports 167 bytes: loadconfig: px_generate_zenoh_topic_files.py failed (exit 1) Failed to import em: No module named 'em' You may need to install it using: pip3 install --user empy stdout stays clean on success, so callers that parse it are unaffected. Smoke tested on Ubuntu 24.04, matching the runner base: happy path returns valid JSON for --group and --group --seeders; missing empy and missing pyros-genmsg each report the cause and remedy; an unrunnable generator reports the interpreter's own "can't open file"; a child exiting non-zero with no output reports "(no output)" rather than an empty message; and a preset ZENOH_KCONFIG_TOPICS still skips the generator entirely. Assisted-by: Claude:claude-opus-5 Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-08-20 12:11:15 -07:00
Ramon Roche	97c35057ce	ci(build-all): install only what the matrix generator needs ... The scan job is the one job in this workflow that runs outside the build container, so it installs its own Python dependencies. It was installing all 31 entries of requirements.txt to run a script that reaches four of them, and every one of the other 27 was a chance to fail: the job has died on packaging and on lxml, neither of which it imports. Drop the pip cache with it. Restoring it costs about as long as fetching four small wheels, and its key used hashFiles('**./Tools/setup/requirements.txt'), a glob that matches nothing. The hash was empty, so the key collapsed to "Linux-pip-", matched its own restore-key, and never saved again after the first write in April. Verified in a clean python:3.12-slim container: generate_board_targets_json.py exits 0 for both --group and --group --seeders with exactly these four installed. pyyaml and kconfiglib alone are not enough, since loadconfig.ensure_env() shells out to the zenoh generator, which needs empy and pyros-genmsg. Assisted-by: Claude:claude-opus-5 Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-08-20 12:11:15 -07:00
Ramon Roche	1fa6012d5d	fix(kconfig): fail when kconfig discards an assignment ... A .px4board line whose value does not fit its symbol's type is not an error to kconfiglib. It warns, drops the assignment, and leaves the symbol at its default, so the loaded config quietly differs from the file and no consumer downstream can tell. corvon 743v2 built with the wrong UAVCAN interface count this way, and the only trace was a warning in a job that exited 0. load_target_config() now compares kconf.warnings before and after the load and exits on any "assignment ignored", naming the file and quoting the warning. Checked against the whole tree: 293 targets load with none rejected, so this does not fail existing boards. Reintroducing the quoted value makes it exit 1 with the file path and the reason. Assisted-by: Claude:claude-opus-5 Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-08-20 12:10:30 -07:00
Ramon Roche	8f44f9f1d3	fix(boards/corvon): unquote BOARD_UAVCAN_INTERFACES ... BOARD_UAVCAN_INTERFACES is an int with a default of 2, so the quoted "1" was not a valid value. Kconfig discarded the assignment and fell back to the default, and 743v2 has been building with two interfaces on a board its own header describes as "CAN (FDCAN1) - single interface". The value reaches compiled code as -DUAVCAN_NUM_IFACES via config_uavcan_num_ifaces, where it sizes _can_status_pub_handles[] and makes the logger advertise two can_interface_status instances. The driver iterates the runtime interface count rather than this constant, so nothing polls absent hardware; the cost is a spare handle and a phantom log instance. Verified with kconfiglib: the value now resolves to 1, matching 743v1 and every other board that sets it. The board_config.h comment documented the quoted form, so it is corrected too rather than left to spread. Assisted-by: Claude:claude-opus-5 Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-08-20 12:10:30 -07:00
Ramon Roche	5da0142e1a	fix(tools): exclude docs from newline checks again (#28304)	2026-08-20 17:02:07 +10:00
Ramon Roche	6ed16e2748	build(macos): pin osrf/simulation tap under --ci ... When homebrew-core bumps a shared dependency, OSRF's bot bumps each gz formula's revision and deletes its bottle block within minutes of the upstream merge. The matching rebuild is a separate, unautomated step: across 2026 the gap ran 0.5 to 11 days, median 2.5, leaving gz unbottled roughly 18% of the time. In that window macos.sh compiles gz-sim8, gz-msgs10 and five others from source and the setup step goes from ~8min to 20-30min. The removal only edits the formula. The bottle tarballs are never deleted from OSRF's S3 bucket, so pinning to the last fully bottled revision keeps installs binary while upstream catches up. Gated behind a new --ci flag rather than applied unconditionally. Automation wants a reproducible, fast install; development machines want the current formulae and can absorb a source build, and should not have their tap left on a detached HEAD as a side effect of running the setup script. Only the gz tap is pinned. opencv@4, protobuf, gstreamer and the rest still track homebrew-core, so CI keeps catching upstream formula breakage on every PR, which is the reason --sim-tools runs there in the first place. Assisted-by: Claude:claude-opus-5 Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-08-19 13:10:10 -07:00
Ramon Roche	3f81372147	ci(itcm): bump px4-dev container and drop pip install ... The image now ships pyelftools, so the job no longer has to fetch it from PyPI on every run. That install was a recurring failure: 502s from files.pythonhosted.org killed 6 ITCM jobs in the last 30 days. Removing the step matters as much as the bump. Left in place it would still reach PyPI for the symforce line, which the check has never needed: Tools/itcm_check.py imports only elftools. Assisted-by: Claude:claude-opus-5 Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-08-18 17:04:21 -07:00
Ramon Roche	a7aecfb9fb	build(container): bake optional requirements into px4-dev image ... The Dockerfile only ever copied requirements.txt, so optional-requirements.txt was never installed into the image even though it sits in the build context. Every CI job needing pyelftools therefore fetched it from PyPI at job time and failed whenever files.pythonhosted.org returned 502s. symforce publishes no Linux aarch64 wheel and no sdist, so installing the file unguarded would break the linux/arm64 image build. Gate it with an environment marker so aarch64 installs pyelftools only. Assisted-by: Claude:claude-opus-5 Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-08-18 15:13:33 -07:00
Ramon Roche	d0487fc844	ci(build-all): seed ccache only for chip families with cold caches (#28278) ... * ci(build-all): seed ccache only for chip families with cold caches Measured across recent runs, the seeder stage contributes nothing in steady state: all 264 build-job cache restores in the 8 most recent successful runs came from group-level caches, zero from seeder caches, yet the stage gates the build matrix for ~3.4 min of every run's critical path and burns ~22 8cpu-runner-minutes warming caches nobody reads. Its fail-fast value is similarly thin: 2 of the last 40 failed runs failed at seed stage; the other 34 passed seeding and failed in the matrix anyway. Probe each family's ccache namespace in the RunsOn cache bucket from the group_targets job and emit only cold families into the seed matrix. Warm runs skip the stage entirely (the matrix starts right after the scan); a cold family still seeds first and gates the matrix, which is the one case the warmup pays for. The probe fails open: if the bucket env, the listing, or the assumed object layout is wrong, every family reads as cold and the workflow behaves exactly as before. Assisted-by: Claude:claude-fable-5 Signed-off-by: Ramon Roche <mrpollo@gmail.com> * ci(build-all): fail open when seeder probe output is unparseable The has_cold computation ran unguarded under bash -e: malformed probe output would fail the whole workflow instead of falling back to the full seeder matrix. Guard it so every failure path degrades to seeding everything, on RunsOn and on downstream forks without it alike. Assisted-by: Claude:claude-fable-5 Signed-off-by: Ramon Roche <mrpollo@gmail.com> * ci(build-all): move seeder probe logic into the helper script The probe step carried fail-open shell logic inline in the workflow. Move output writing, has_cold computation, and all fail-open handling into filter_cold_seeders.py; the workflow step is now a single script invocation. The script always exits zero and degrades every failure (missing bucket env, aws error, unparseable input) to the full seeder matrix. Assisted-by: Claude:claude-fable-5 Signed-off-by: Ramon Roche <mrpollo@gmail.com> * ci(build-all): probe the magic cache's real object layout The first probe guessed cache/{key} for the magic-cache object layout and read every family COLD, degrading to unconditional seeding. The real layout is cache/v1/{org}/{repo}/{ref}/{version-hash}/{cache-key}; the version hash is the actions/cache digest and not knowable a priori, so list the default-branch scope once (main-scope caches are visible to every ref) and match cache-key basenames. Verified locally against the live bucket: all 10 families read warm and the seed stage skips. Assisted-by: Claude:claude-fable-5 Signed-off-by: Ramon Roche <mrpollo@gmail.com> * ci(build-all): single-source ccache key roots in the matrix generator The ccache key convention was encoded three times: hand-assembled in the workflow's restore/save steps, again in the seeder's cache-key-prefix argument, and a third time in the probe script. Drift between them is silent thanks to the probe's fail-open design: a renamed key scheme would read every family COLD forever and quietly revert to unconditional seeding. Mint the namespace root once in generate_board_targets_json.py as cache_prefix on every group and seeder matrix entry, with seeders occupying the reserved 'seeder' group inside their family namespace. The workflow composes {cache_prefix}-{group}-{ref}-{sha} from matrix fields only, and the probe greps the root it is handed, knowing nothing of the format. Composed keys are byte-identical to the old scheme (asserted for all 33 groups and 10 seeders), so no cache is invalidated. Assisted-by: Claude:claude-fable-5 Signed-off-by: Ramon Roche <mrpollo@gmail.com> --------- Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-08-18 13:36:37 -07:00
Ramon Roche	7740117b17	ci(macos): enable --sim-tools on macos-latest and macos-15 to measure Gazebo bottle install time	2026-08-19 01:05:54 +09:00
Ramon Roche	f8e1d1a899	ci(build-all): drop per-job pynacl install, bump container to v1.18.0-beta2 ... The pynacl install step from #27237 was a stopgap until the build container shipped pynacl preinstalled. That happened in #27237 itself: it added pynacl to Tools/setup/requirements.txt, which dev_container.yml bakes into the image, so v1.18.0-beta1 and later already ship it. Only the v1.17.0-rc2 pin here kept the step alive: 30+ unpinned PyPI pulls per workflow run that already cost us a matrix job to PyPI 502s. Verified by building px4_fmu-v6x_secureboot locally in px4io/px4-dev:v1.18.0-beta2: the signing step runs against the baked-in pynacl with no pip install. The voxl2 container keeps its own pin and needs no fallback since only CONFIG_BOARD_SECUREBOOT targets (NuttX platform only) invoke the signing script. Expect one cold ccache run after merge: the new container's compilers invalidate all caches at once via compiler_check = content. Assisted-by: Claude:claude-fable-5 Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-08-18 09:44:18 +09:00
Ramon Roche	9e3f88f7ef	fix(ci): align voxl2 group chip family with its seeder cache key ... The voxl2 build group carried chip_family 'native' while its seeder carried 'voxl2', so the group restored/saved under ccache-native-x64-voxl2-0-* while the seeder saved under ccache-voxl2-x64-seeder-*. The restore-keys chain can never cross that namespace gap: the seeder's warm cache is discarded every run, and cold builds fall back to the SITL seeder cache (host gcc objects, zero possible hits against aarch64-linux-gnu-gcc or hexagon-clang). Present since #27050. Give the voxl2 group chip_family 'voxl2' so it shares the seeder's key namespace, drop the now-redundant voxl2 special-casing in seeder generation, and size the voxl2 cache at 800M since it holds objects for two toolchains (aarch64-gnu + hexagon-clang) and already sits near the 400M limit. Assisted-by: Claude:claude-fable-5 Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-08-18 08:24:06 +09:00
Ramon Roche	a2f1bb7c34	docs(contribute): add AI coding assistant policy ... Adopt a policy for AI-assisted contributions modeled on the Linux kernel's coding-assistants document: the human submitter is the author and accountable for every line, an AI tool never appears in authorship or Signed-off-by tags, licensing follows the LF Generative AI Policy, and disclosure via an Assisted-by trailer is required. Summarize the policy in CONTRIBUTING.md and add it to the docs sidebar. The commit and pr skills keep their disclosure and sign-off rules but do not link the policy: files loaded into every agent session are standing context, not rules applied on demand, so pointing at the policy from there invites agents to pull it in and biases unrelated work. Assisted-by: Claude:claude-opus-4-8[1m] Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-07-23 09:44:46 -07:00
Ramon Roche	882aaea5dc	docs(security): treat AI-assisted bug discovery as public ... Align with the Linux kernel security process: bugs found with AI assistance systematically surface across multiple researchers at the same time, so treat them as public and fix them in the open instead of through a private advisory. Reproducers stay private and are shared with maintainers on request. Reference: https://docs.kernel.org/process/security-bugs.html Assisted-by: Claude:claude-fable-5 Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-07-23 09:44:34 -07:00
Ramon Roche	e7b1d486e5	fix(vectornav): replace discard swap buffer with in-place memmove ... Shifting the remaining bytes with memmove and zeroing the tail is functionally equivalent to the copy-out/zero/copy-back sequence and removes the dynamic allocation entirely, along with the unchecked malloc return. Suggested-by: Beat Küng <beat@auterion.com> Assisted-by: Claude:claude-fable-5 Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-07-21 08:06:37 +02:00
Ramon Roche	e312313f77	fix(vectornav): free temporary buffer in libvnc VnSearcher_discardData ... The swap buffer in VnSearcher_discardData was malloc'd but never freed, leaking on every call. Reported by Martin Strunz. No VnSearcher_* symbol is referenced by the driver today, so the linker drops searcher.c entirely and no shipped firmware is affected. Fixed anyway so the leak cannot go live if the port autodetect API is ever used. Upstream vnproglib is frozen with no public repository, so the fix is carried in the vendored copy. Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-07-21 08:06:37 +02:00
Ramon Roche	eba76cbb69	fix(ci): restore board target matrix generation after zenoh Kconfig change ... Since b11e615810 src/modules/zenoh/Kconfig sources the generated topic catalog through ZENOH_KCONFIG_TOPICS, which only cmake exports, so every standalone Kconfig parse crashed and build_all_targets produced an empty build matrix on every run while the scan job still reported success. Add Tools/kconfig/loadconfig.py as the single entry point for parsing the Kconfig tree outside cmake: it generates the topic catalog exactly like cmake/kconfig.cmake and provides shared board/target enumeration and config loading. Port generate_board_targets_json.py (CI matrix) and updateconfig.py (make updateconfig) to it; both were independently broken and each reimplemented board scanning on its own. Harden the workflow so the next failure of this class is loud: run the generator as a standalone assignment, so bash -e fails the step (the previous echo "matrix=$(...)" form masked the exit code), and write the JSON outputs through the heredoc GITHUB_OUTPUT form. Matrix output verified byte-identical to the pre-b11e6158101 baseline in all three modes; updateconfig output verified identical against the same baseline. Assisted-by: Claude:claude-fable-5 Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-07-20 20:24:10 -04:00
Ramon Roche	9a446cce0c	fix(mavsdk_tests): use simulation time for sleeps in basics test ... Replace std::this_thread::sleep_for() with tester.sleep_for() to use simulation-aware sleep that accounts for speed factor under lockstep.	2026-07-17 10:51:42 -05:00
Ramon Roche	d5cfc0fd97	fix(mavsdk_tests): use simulation time for timeouts ... Replace 5 functions that used std::future::wait_for() (wall-clock time) with poll_condition_with_timeout() (simulation time). This prevents timeouts from expiring prematurely when running at high speed factors under lockstep. Affected functions: - wait_until_altitude() - wait_for_landed_state() - wait_for_flight_mode() - start_and_wait_for_mission_sequence() - wait_until_speed_lower_than() Also remove debug printf statements from start_checking_altitude().	2026-07-17 10:51:42 -05:00
Ramon Roche	1499238f1c	revert(fw_mode_manager): drop GUIDED_COURSE guard on course setpoints ... Reverts the hotfix from #27487. The navigator now guarantees the course field is NaN unless Course mode explicitly commands it, so PX4_ISFINITE(course) is again a sufficient trigger for course guidance. Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-07-17 17:50:25 +02:00
Ramon Roche	9f916e9811	fix(navigator): keep course setpoint NaN outside Course mode ... The reposition triplet was zero-initialized at boot and memset after consumption, and mission_item_to_position_setpoint() never wrote the course field, so a finite course (0.0, or stale after leaving Course mode) could leak into published position setpoints. Reset the reposition triplet with reset_position_setpoint() and clear course when converting mission items, so the field is only finite while Course mode commands it. Replaces the consumer-side clear from #27537 with a fix at the source. Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-07-17 17:50:25 +02:00
Ramon Roche	d448e3f5b0	ci(release): upload release assets sequentially to avoid rate limit ... Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-07-08 14:25:17 -07:00
Ramon Roche	f1bff926d1	docs(releases): promote VOXL 2 Debian packaging to major changes ... Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-07-08 14:07:30 -07:00
Ramon Roche	d68d7ad827	docs(releases): note VOXL 2 variant merge and Debian package in v1.18 ... Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-07-08 14:07:30 -07:00
Ramon Roche	fd13202851	docs(releases): v1.18 release notes (#27808) ... * docs(releases): fix malformed SIH wind PR link in v1.18 notes Signed-off-by: Ramon Roche <mrpollo@gmail.com> * docs(releases): draft v1.18 release notes Signed-off-by: Ramon Roche <mrpollo@gmail.com> * docs(releases): mark v1.18 beta and add changes merged since the draft Signed-off-by: Ramon Roche <mrpollo@gmail.com> * docs(releases): add v1.18 upgrade guide, hardware fixes, and section structure Signed-off-by: Ramon Roche <mrpollo@gmail.com> * docs(releases): resort v1.18 major changes Signed-off-by: Ramon Roche <mrpollo@gmail.com> * docs(releases): link sensor and peripheral docs pages in v1.18 notes Signed-off-by: Ramon Roche <mrpollo@gmail.com> * docs(releases): describe new boards and highlight serial passthrough in v1.18 notes Signed-off-by: Ramon Roche <mrpollo@gmail.com> * docs(releases): fold standalone sensors section into hardware and common Signed-off-by: Ramon Roche <mrpollo@gmail.com> * docs(releases): fill v1.18 ethernet section with networking fixes Signed-off-by: Ramon Roche <mrpollo@gmail.com> * docs(releases): merge ROS 2 and middleware sections with DDS and Zenoh subsections Signed-off-by: Ramon Roche <mrpollo@gmail.com> * docs(releases): group vehicle-type notes under vehicle-specific section Signed-off-by: Ramon Roche <mrpollo@gmail.com> * docs(releases): reorder v1.18 other-changes sections by topic group Signed-off-by: Ramon Roche <mrpollo@gmail.com> * docs(releases): drop other-changes wrapper heading in v1.18 notes Signed-off-by: Ramon Roche <mrpollo@gmail.com> * docs(releases): organize debug-logging subsections and add infrastructure section Signed-off-by: Ramon Roche <mrpollo@gmail.com> * docs(releases): fix main.md template wording and mark v1.18 beta in sidebar Signed-off-by: Ramon Roche <mrpollo@gmail.com> --------- Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-07-08 11:54:37 -07:00
Ramon Roche	1343ad17af	feat(boards): fmu-v5x bench tools to test variant ... Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-07-07 21:33:15 -07:00
Ramon Roche	ca47db5faa	refactor(bench): remove the Hawkeye viewer tee ... The --viewer path (tee MAVLink frames to UDP and enable the HIL_STATE_QUATERNION/HIL_ACTUATOR_CONTROLS streams so Hawkeye could render an SIH flight live) was never validated end to end: Hawkeye never actually rendered from it. Rather than ship an unproven feature, drop it. Removes px4bench.attach_viewer_tee (and its function-local socket use), the flight_mission --viewer/--viewer-port args, the viewer tee call and the stream-enable block, and the now-unused --board-dev arg that only fed those stream commands. The SIH flight logic, firmware gate, storage/serial tests, and the arming gate are unchanged. README and the bench testing docs page drop the Hawkeye section and all --viewer mentions. Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-07-07 21:33:15 -07:00
Ramon Roche	bf7dcb7229	fix(bench): confirm param committed and saved before reboot in persistence test ... The full-suite persistence check failed on hardware with 'after reboot SDLOG_UTC_OFFSET = 740 (expected 777)'. Firmware persistence is solid; this was a test race. A PARAM_SET propagates through the param system asynchronously, and phase_persistence ran 'param save' on the strength of the PARAM_VALUE echo alone. When save raced ahead of the commit it persisted the PRIOR value (740, the last value Phase 2 wrote). The echo was not even proof of the new value: wait_param_echo returned seen=[740, 777], a stale queued PARAM_VALUE from Phase 2 having slipped past drain_param_values. Make persistence deterministic with two gates instead of timing: 1. After setting the marker, read it back from the board until it reports MARKER_VALUE (read_until) before saving. This confirms the value is committed to RAM and trusts the board's read over any stale echo. 2. After 'param save', confirm the saved state with 'param show <name>' and require the '+' (saved) flag AND the marker value before rebooting (retry save once first). '*' means unsaved; the test never reboots on an unsaved marker. Flag columns per src/systemcmds/param/param.cpp:822 (x used, + saved, * unsaved, l locked). phase_set_readback now also trusts read_until over the echo, so the same stale-queued-echo does not fail it either; its pass criteria stay the readback match. Restores in phase_persistence and the final cleanup use read_until too. New shared helpers in px4bench.params: read_until(mav, name, expected, timeout) -> (ok, last_seen), and param_is_saved(shell, name) plus its parse_param_show() parser for the 'param show' saved flag and value. Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-07-07 21:33:15 -07:00
Ramon Roche	6e2ef3345f	fix(bench): reuse shell sessions and confirm prompts to stop leaking nsh tasks ... A hardware run exhausted the board's task/fd table after a few probe cycles: shell open failed while heartbeat still worked, and continued writes eventually stalled the link. Not a firmware hang, a resource leak the tooling drove. The firmware spawns a new nsh task plus two pipes (four fds) on the first SERIAL_CONTROL write of a session (Mavlink::get_shell) and only frees them when a SERIAL_CONTROL message arrives with the RESPOND flag cleared (Mavlink::close_shell). Two tooling bugs combined to leak them: - MavlinkShell.open() returned True on any buffered byte, including leftover output from a prior session, so it reported a live shell without one. It now confirms an actual 'nsh>' prompt or a completed echo-sentinel round-trip before returning True, keeping the same timeout-and-report-failure behavior. - open/close cycles reopened before the single flags=0 teardown was processed, spawning a second shell before the first was freed. close() now sends the flags=0 teardown and then briefly drains incoming SERIAL_CONTROL until quiet (bounded, never a hang) so the firmware runs close_shell before a caller can reopen. Lifecycle: every MavlinkShell user now opens one session, runs all its work on it, and closes it in a finally so no error path leaks a shell. The SIH flight and storage tests run all their probes on a single shell (shell_command_exists already takes an open shell); flight_mission no longer opens a throwaway probe shell separate from the flight session beyond the unavoidable reboot boundary in enter_sih. Folds in the sentinel fix (run() sends the echo sentinels on their own input line, because nsh aborts a ';' chain when a command fails, which previously lost the sentinel for a failing probe and read as a stall). Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-07-07 21:33:15 -07:00
Ramon Roche	83f68f709c	docs(bench): document the arming gate, storage tests, and capability report ... The flight test is now part of the default suite; both the bench README and the bench testing guide said it ran separately. Update the sequence description, the risk map and suite tables (storage_stress and flight_mission rows, serial_loopback for fixtures), the SIH sections (probe-and-skip, the typed 'arm' confirmation, --allow-arming for automation), the production section (--allow-arming on the line, serial_loopback with a jumper on the fixture), and the firmware gate --build description (bench capability report with variant and config line recommendations). Storage threshold defaults are justified where the flags are documented. Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-07-07 21:33:15 -07:00
Ramon Roche	2f54fd101f	feat(bench): add storage and serial loopback tests from existing system commands ... The firmware already ships sd_bench, sd_stress, and serial_test; the suite was not exploiting them. bench/storage_stress.py joins the default sequence before log_transfer (storage health first, then the test that depends on storage). It runs sd_bench with data verification and parses write/read throughput and fsync latency into named checks with generous FAIL floors (defaults justified in the README: 100 KB/s write, 200 KB/s read, 500 ms fsync; a working-but-slow card prints a WARNING instead of flapping), then sd_stress for file churn with a short default iteration count. Both phases probe-and-skip independently: a firmware without a command or a board without an SD card records SKIP with a warning, never FAIL. bench/serial_loopback.py is a standalone operator/fixture test for manufacturing: with a TX-RX loopback jumper installed on a chosen UART, serial_test transmits a known pattern and the session summary (rx/tx/rx err counts) plus pattern-error lines decide the verdict. Not in the default sequence because it needs a physical fixture. The firmware gate's --build path now prints a bench capability report from one shared table: after reading default.px4board plus the label overlay (labels merge both, cmake/kconfig.cmake:47-54) it lists whether the image will contain simulator_sih, sd_bench, sd_stress, and serial_test and which suite tests will run or skip. For anything missing it names a sibling variant that has it (exact --target) and the exact config line, and interactively offers to append the line to the local board config, stating that the edit is local and uncommitted. All four options are 'default n' in Kconfig, so the merged .px4board lines decide presence. Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-07-07 21:33:15 -07:00
Ramon Roche	af8bad97cc	feat(bench): include SIH flight in the default suite behind an arming gate ... The simulated flight is the only test that exercises commander, navigator, and land-detector flight logic on real NuttX scheduling; leaving it out of the default suite meant the most valuable coverage was routinely skipped. It now runs last in the sequence. Arming safety gets two explicit paths: on a TTY the operator sees a prominent warning that the flight controller WILL ARM (simulated flight, pwm_out_sim replaces the real outputs, board must be bare) and must type 'arm'; declining records a skip, not a failure. For automation and manufacturing lines --allow-arming bypasses the prompt, and a non-TTY run without it skips the flight with a warning naming the flag. Before touching any configuration the test probes the live firmware for the SIH module ('simulator_sih status'; NuttX nsh replies 'nsh: <cmd>: command not found', apps/nshlib/nsh_parse.c) and skips with a warning when the module is absent. Shared plumbing in px4bench: EXIT_SKIP (75) recorded as SKIP by the orchestrator, shell_command_exists() for probe-and-skip, and arming_gate() used by both the orchestrator flow and the standalone flight test. Config mutation by the flight test is expected; it restores the original airframe and SYS_HITL afterwards. Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-07-07 21:33:15 -07:00
Ramon Roche	d13a6e44f0	fix(bench): resolve board_id for labeled build targets ... --target px4_fmu-v6xrt_bench previously skipped the early board_id check because only bare vendor_model targets were known; a label selects a .px4board config within the same board, so strip it and resolve to the board dir. The uploader still enforces board_id against the bootloader at flash time. Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-07-07 21:33:15 -07:00
Ramon Roche	cabda5ade3	feat(boards): add 6XRT variant with SIH HITL ... Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-07-07 21:33:15 -07:00
Ramon Roche	dbb4212ff3	docs(test_and_ci): add hardware bench testing guide ... New page in Platform Testing and CI covering px4bench: why on-hardware verification exists alongside SITL and CI, the firmware traceability gate, the bench test inventory, the SIH hardware-in-the-loop flight test with Hawkeye, baseline comparison for upgrade regression and golden-unit workflows, production end-of-line usage, and CI integration. Linked from the section index and the sidebar. Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-07-07 21:33:15 -07:00
Ramon Roche	c16fb3bfed	feat(bench): add firmware gate so the suite knows what it is testing ... Today's runs executed against whatever firmware happened to be on the board (an old April build at first) and nothing checked. For a qualification tool that is unacceptable: before any test starts the suite now establishes, and can control, exactly which build it is testing. New px4bench/firmware.py: .px4 metadata parsing and validation (fields verified against Tools/px_mkfw.py and px4_uploader.py), board identity via ver all over the nsh shell, flashing through Tools/px4_uploader.py with streamed output and a hard timeout, HW-arch to build-target inference by enumerating boards/, an early wrong-board check against firmware.prototype board_id, and the named firmware_identity check (git-hash prefix match against the artifact). run_bench_suite.py preflight supports four firmware sources, all converging on the same flash + verify path: keep what is on the board (--any-firmware), flash a local file (--firmware), build the inferred target from this source tree (--build, --target, --build-timeout), or download a GitHub release artifact (--release TAG|latest, via gh; asset naming verified against the v1.17.0 release). --expect-hash verifies without flashing. Flags are mutually exclusive; with none given, a TTY gets an operator menu covering the same four sources, and automation exits with an error before touching the board. The detected identity is printed, written to firmware.json in the suite report dir, and stamped into every test's report dir via PX4BENCH_FIRMWARE_INFO. If the board's mavlink is wedged the uploader cannot soft-reboot it into the bootloader (hit live today); after repeated reboot attempts the gate prints an operator instruction to replug USB so the uploader catches the bootloader at power-on. sih/flight_mission.py gains a verify-only --expect-hash and stamps the firmware identity into its report dir; it never flashes. Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-07-07 21:33:15 -07:00
Ramon Roche	e6283bb374	docs(bench): motivate the suite by the hardware verification gap ... The README opened by framing the whole suite around one merged PR series. The value is general: CI never boots NuttX and SITL runs on a host OS, so defects in boot ordering, link lifecycle, storage, loop rates, and RTOS-only concurrency are invisible until a board is on a bench. Reword the introduction around that gap and the timeout-first design rule instead of the originating incident. Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-07-07 21:33:15 -07:00
Ramon Roche	9526efa4f6	refactor(bench): restructure suite into px4bench package with bench/ and sih/ split ... Turn the flat script pile into a standalone project so contributors can navigate and extend it: - px4bench/ shared library package: core primitives in __init__ (Reporter, connect, MavlinkShell, reboot/replug, viewer tee, mavlink status parsers, pymavlink add_message workaround) plus protocol modules params.py, missions.py, and ftp.py extracted from the tests. Zero helper duplication remains across scripts. - bench/ holds the real-firmware tests (boot_health, reboot_loop, usb_replug, link_forwarding, param_stress, mission_stress, log_transfer); sih/ holds the simulated flight (flight_mission), making the simulation/no-simulation boundary explicit. - pyproject.toml (px4bench 0.1.0, BSD-3-Clause, pymavlink/pyserial deps, pyulog extra) so pip install -e Tools/bench_test works; every script remains directly runnable without installation via a parent-dir path shim. - README rewritten contributor-first: architecture, per-test justification tied to the v1.18 risk areas, why pymavlink over MAVSDK, how to add a test, baseline workflow. - Consistent CLI surface (shared connection args; --report-dir replaces log_transfer's --outdir); decorative section banners removed. All hardware-learned behavior is preserved exactly: param echo drain and match-by-value, shell sentinel strip-all, the add_message workaround, explicit param save before reboot, mission clear before upload, RTL in MAV_FRAME_MISSION, and the post-flight ULog download. Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-07-07 21:33:15 -07:00
Ramon Roche	8d709a5e08	test(bench): add scripted SIH flight with live Hawkeye viewer tee ... sih_flight.py switches the board to a SIH airframe (SYS_HITL=2, physics on the FMU), flies takeoff, a 3-waypoint square, and RTL as an auto mission, asserting arming, takeoff, waypoint progression, landing, and auto-disarm with per-phase timeouts, then restores the original config. Covers the flight-logic paths the bench tests cannot reach; pwm_out_sim replaces real outputs so nothing is driven on the rails. --viewer tees every received MAVLink frame to UDP (frame per datagram, same framing as the SITL viewer channel) and enables the HIL_STATE_QUATERNION/HIL_ACTUATOR_CONTROLS streams on the board, so Hawkeye renders the flight live from a serial-connected board. Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-07-07 21:33:15 -07:00
Ramon Roche	676523f683	fix(bench): harden suite against real-board MAVLink message timing ... First hardware run (fmu-v6xrt over USB, macOS) surfaced three issues: - param_torture consumed PARAM_VALUE echoes positionally; one duplicate broadcast desynced every subsequent check. Drain stale messages before each set and match the echo against the expected value, reporting all observed values so a genuine wrong-echo bug remains visible. - the shell sentinel's second safety echo leaked into the next command's captured output; strip any sentinel line, not just the current one. - pymavlink 2.4.49 add_message() intermittently crashes with TypeError when the first message of an instanced type arrives with its instance field unset; wrap it defensively until fixed upstream. Full suite now passes 5/5 against fmu-v6xrt. Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-07-07 21:33:15 -07:00
Ramon Roche	2ca6f2b938	test(bench): add NuttX bench smoke-test suite for release qualification ... Semi-automated bench tests for qualifying v1.18 on real Pixhawk-class hardware after the TSAN/concurrency series (#27606, #27809, #27813). CI builds NuttX but never boots it, and the failure mode of this class of regression is a silent hang, not a crash: every operation here has a hard timeout and a timeout is reported as FAIL naming what stalled. Tests map to the reworked subsystems: boot_health (WorkQueue/uORB snapshot with baseline diffing), dual_link_forwarding (nested-send lock path under simultaneous two-link load), param_torture (set/readback and reboot persistence on SDLOG_UTC_OFFSET), mission_torture (dataman and the mission shared-state mutex, 220 items, link alternation), mavftp_log (logger on/off plus MAVFTP download and ULog verification), reboot_loop and the operator-assisted usb_replug (mavlink instance and RAM lifecycle across re-enumeration). run_bench_suite.py orchestrates the non-interactive tests with a per-test watchdog. Requires pymavlink/pyserial, pyulog optional. Nothing arms the vehicle. Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-07-07 21:33:15 -07:00
Ramon Roche	c890d9db0a	docs(test_cards): add MC_11 companion computer ROS 2 external mode ... Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-07-06 11:37:32 -07:00
3 people	f19c9f98c5	fix(tecs): prevent NaN propagation in pitch controller (#27749) ... * tecs: Prevent. NaN in pitch integrator Prevents NaN propagation into _pitch_integ_state when seb_rate.setpoint is non-finite (as seen when exiting FW velocity Offboard). Mirrors the existing throttle integrator finite check. Fixes #25906. * tecs: Harden the TECS pitch integrator against NaN contamination * fix(tecs): guard pitch output against non-finite SEB rate The integrator guard alone does not prevent the reported NaN lockup when the non-finite value originates on the energy/speed side: the feedforward and damping terms in _calcPitchControlOutput feed seb_rate straight into the pitch demand, bypassing the integrator. constrain() does not reject NaN, so the pitch setpoint latches NaN permanently and the aircraft becomes uncontrollable. Fall back to the (now guaranteed finite) integrator state when the uncorrected pitch setpoint is non-finite, and drop the stray trailing whitespace introduced by the previous commit. Signed-off-by: Ramon Roche <mrpollo@gmail.com> * test(tecs): regression test for NaN pitch integrator and output Drives TECSControl::update with a non-finite true airspeed setpoint, the same way seb_rate goes non-finite on the energy/speed side when exiting offboard velocity mode, and asserts the pitch integrator state and the pitch setpoint both stay finite, across a single bad frame and sustained non-finite input. Both assertions fail against unguarded TECS. Signed-off-by: Ramon Roche <mrpollo@gmail.com> * test(tecs): cover the corrupted-integrator-state safety reset Addresses review feedback on #27749: the existing tests inject a non-finite airspeed setpoint, which the integrator-input guard rejects before it can reach _pitch_integ_state, so the state-corruption reset branch in _calcPitchControlUpdate was never actually exercised. Add a FRIEND_TEST seam so the regression test can pre-corrupt _pitch_integ_state directly, then confirm a single update() call detects the non-finite state, resets it, and keeps the pitch setpoint finite. Verified the test fails against the code with the reset guard removed and passes with it in place. --------- Signed-off-by: Ramon Roche <mrpollo@gmail.com> Co-authored-by: Ryan Johnston <31726584+ryanjAA@users.noreply.github.com> Co-authored-by: Ryan Johnston <rjohnston@appliedaeronautics.com>	2026-07-03 11:58:33 -07:00
Ramon Roche	2f459921f6	docs: add official PX4 developer kits and manufacturer program ... Document the Official PX4 Developer Kit program: a new top-level Developer Kits section listing the certified kits (ModalAI Starling 2 Max, DroneBlocks DEXI 5, Holybro X500 v2), a new DEXI 5 page, and a manufacturer-facing page describing the program requirements, benefits, and eligibility. Restructure the hardware navigation so all certified kits live in one place instead of being split across Complete Vehicles and Kits, drop discontinued build guides from the sidebar (still linked from the kit build guides page), and group the manufacturer guides under a new Manufacturers section in Development > Hardware. Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-07-02 12:15:03 -07:00
Ramon Roche	230cfe33ee	fix(septentrio): bounds-check port name offset in detect_serial_port ... The serial port autodetect computed an offset relative to a ">" prompt without verifying that there were enough preceding bytes in the read buffer. When the prompt landed near the start of the buffer the size_t offset arithmetic underflowed and the subsequent copy read before the buffer. Replace the buffer_offset heuristic with a direct check that the prompt sits at least four bytes into the read buffer before computing the port name offset, and use signed pointer arithmetic on the address difference so the underflow is no longer reachable. Refs: GHSA-v78g-fxg8-gv3j Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-06-29 18:34:45 -07:00
Ramon Roche	d8a2aeb4ae	docs(hardware): expand USB VID/PID options in board support guide (#27771) ... List the VID/PID sourcing options in order of preference: buy your own from USB-IF, obtain a free pair from a community registry or chip-vendor program, or use the Dronecode VID. Add a note clarifying that Dronecode membership is not required to get a board supported in PX4. Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-06-30 08:42:13 +10:00
Ramon Roche	3db36cb022	ci(macos): trust PX4 brew taps for Homebrew 6.0 ... Homebrew 6.0 (2026-06-11) makes tap-trust mandatory and refuses to load formulae from untrusted third-party taps. This broke every macOS build: brew install aborted with "Refusing to load formula px4/px4/fastdds from untrusted tap px4/px4" before pouring any package, so ccache (and the rest of the toolchain) was never installed and setup-ccache failed with "ccache: command not found". Trust the three required taps non-interactively before installing from them. Guarded behind a brew trust capability check so older Homebrew, which has no trust gate, skips it. Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-06-25 13:23:29 -07:00
Ramon RocheandHamish Willee	19d669e542	docs(hardware): rewrite manufacturer board support guide (#27675) ... * docs(hardware): rewrite board support guide around real process The board support guide described a theoretical category-first process that no longer matches how board support actually happens. Manufacturers were left unsure of the concrete steps, leading to repeated email requests for guidance. Restructure the guide around the actual GitHub-driven flow: build your own firmware target, reserve a board ID via a PX4-Bootloader PR, provide a unique USB VID/PID, demonstrate flight with logs, and open the PR. Keep the support categories as a reference section that explains support responsibility rather than process. Spell out that QGroundControl uses the USB VID/PID to identify hardware, and warn that reusing another vendor's pair causes misidentification. Promote the ArduPilot board-ID alignment note and point it at the current hwdef location. Demote VER/REV ID to a clearly-deprecated edge case: explain the resistor/EEPROM mechanism and its original cross-vendor baseboard/FMU intent, note the ecosystem has deviated from it, and that Dronecode no longer offers standards validation. Update the Discord link to chat.dronecode.org. Signed-off-by: Ramon Roche <mrpollo@gmail.com> * docs(hardware): align porting guide with board support guide The porting guide's 'Officially Supported Hardware' section restated the board support process and contradicted the rewritten board support guide. It also told manufacturers to ship hardware to the dev team for port validation, a service Dronecode no longer offers. Replace that section with a short pointer to the board support guide, which is now the single source of truth for the support process, and keep only the high-level support benefits and maintenance expectations. The technical porting content (architecture, file layout, host OS config, RC UART wiring) is unchanged. Signed-off-by: Ramon Roche <mrpollo@gmail.com> * docs(hardware): make board support guide discoverable for manufacturers The board support guide was only reachable by navigating into the hardware integration section. A manufacturer browsing the user-facing autopilot pages, the exact audience, had no path to it, and one of those pages still stated the obsolete 4-month compatibility commitment. Add 'how to get your board supported' pointers from the manufacturer-supported and experimental autopilot pages, the flight controller index, and the development landing page. Remove the stale 4-month rule from the manufacturer-supported page. Strengthen the guide's opening paragraph so the phrases manufacturers actually search appear up front. Word the links to avoid conflating the guide (how to get a board supported) with the 'Manufacturer Supported' category (one of several support levels). Signed-off-by: Ramon Roche <mrpollo@gmail.com> * docs(docs): Minor tweaks --------- Signed-off-by: Ramon Roche <mrpollo@gmail.com> Co-authored-by: Hamish Willee <hamishwillee@gmail.com>	2026-06-17 18:11:37 +10:00
Ramon Roche	ed9bbf3470	docs(narinfc/h7): fix broken RC_INPUT link ... Remove broken anchor link to modules_driver.md#rc-input which does not exist. Use inline code formatting instead. Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-06-16 13:11:02 -07:00
Ramon Roche	ea22f5479e	docs(narinfc/h7): add flight controller documentation ... Add hardware documentation for the VOLOLAND NarinFC-H7 flight controller including pinouts, serial port mapping, PWM output groups, and analog inputs. Fix version badge to v1.17 and clarify RC_IN is wired directly to FMU via RC_INPUT driver. Based on work by @vololand and @hamishwillee from PR #26542. Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-06-16 13:11:02 -07:00
Ramon Roche	92fa89d7d7	ci(mavros): remove MAVROS integration test suite ... Coverage overlaps with mavsdk_tests on iris (mission + offboard posctl); MAVROS plugin behavior belongs to the MAVROS project. Drops the workflow, .test launchers, rostest_px4_run.sh, and the integrationtests/ python helpers. Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-05-14 10:40:14 -07:00
Ramon Roche	4d2996cb93	docs(releases): v1.17.0 release notes (#27225) ... * docs(releases): draft v1.17.0 release notes Drafts the v1.17.0 release notes based on commits in the release/1.16..release/1.17 diff, with every PR citation verified as an ancestor of release/1.17 and not shared with release/1.16. Major Changes leads with the experimental MC Neural Network Control mode and the on-device TFLM integration, the new Altitude Cruise mode for multicopters, FW Takeoff improvements, FW and Rover ROS 2 Control Interface setpoints, and the in-tree Zenoh middleware maturing toward rmw_zenoh compatibility. Hardware Support is reorganized into four sub-groups: New Flight Controllers, New Build Targets for Existing Hardware, New CAN Peripherals & Vehicle Platforms, and Existing Boards: Improvements. The Simulation section is split into Gazebo and SIH sub-groups. The ROS 2 / DDS section is split into uXRCE-DDS and Zenoh. Posted on main as a draft to give docs maintainers visibility and collect review feedback. Backport strategy to release/1.17 (alpha/beta banner variant vs the stable banner variant on main) is a follow-up discussion. Also fixes a long-anchor scroll-restoration bug in px4_ros2_control_interface.md by giving the FwLateralLongitudinal heading an explicit short anchor (#fw-lateral-longitudinal-setpoint), and updates the corresponding link in releases/main.md. Signed-off-by: Ramon Roche <mrpollo@gmail.com> * docs(releases): address review on v1.17.0 notes - Cross-link Altitude Cruise in the intro paragraph. - Reframe MC Neural Network Control as an experimental test path rather than first-class on-device inference; move it to the bottom of Major Changes. - Drop the redundant "opt-in" wording from the Zenoh Major Changes bullet. - Rewrite Upgrade Guide as a true upgrade procedure (actionable numbered steps with what to do and why) following the v1.14 release notes pattern instead of a flat parameter-delta list. - Add the missing PR reference for the extended MISSION_CURRENT entry (#25034, populating the MAVLink mavlink/mavlink#1869 fields). - Dedupe Safety / Commander against Common: failsafe takeover, Offboard-to-Position-without-RC, and motor-failure timeout checks are now listed only once in Common. Signed-off-by: Ramon Roche <mrpollo@gmail.com> --------- Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-05-13 10:59:28 -07:00
Ramon Roche	6baef6ba88	ci(ros_integration_tests): restart XRCE-DDS Agent between tests ... Restart the Micro-XRCE-DDS Agent before each integration test so DDS graph state from a previous PX4 instance does not leak into the next test. The MicroXRCEAgent is started once per session, but PX4 reboots between tests. The Agent retains writer entries from the previous PX4, so when the new PX4 reconnects, count_publishers() in px4-ros2-interface-lib's waitForFMU returns >0 immediately against a stale entry. Phase 1 (discovery) returns instantly, then Phase 2 (heartbeat) times out waiting for a message on a subscription matched to a dead writer. This is why ModesTest.denyArming (first test) passes while every later ModesTest fails with "timeout while waiting for FMU heartbeat". Adds an optional pre_test_hook on test_runner.Tester so ROS-specific lifecycle stays out of the shared test_runner. The workflow stops starting the Agent externally; ros_test_runner.py owns the lifecycle. Refs #27328 Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-05-13 10:16:39 -07:00
Ramon Roche	3ae123f2b5	fix(ci): set GH_REPO so labeler works without checkout ... The auto-label step in pull_request_target runs without a repo checkout, so gh pr view/edit fail with 'not a git repository'. Setting GH_REPO points gh at the right repo without needing a checkout step. Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-04-28 15:39:02 -06:00
Ramon Roche	64a2463441	fix(mavlink): don't write empty signing key file on shutdown (#27222) ... Mavlink::request_stop() unconditionally called _sign_control.write_key_and_timestamp() on every instance shutdown, which created /fs/microsd/mavlink/mavlink-signing-key.bin filled with a zero key and zero timestamp on FCs that never enabled signing. The shutdown write is redundant: every signing state transition (KEY_ACCEPTED, SIGNING_DISABLED) already persists synchronously inside check_for_signing() before returning. The in-memory state is always flushed to disk at the moment it changes. Aggravated by mavlink_main.cpp:3334 calling request_stop() up to 1000 times in a tight loop while waiting for the thread to exit, plus the ~Mavlink() destructor path. Each call re-truncates and rewrites the phantom file. Reported by Jake Dahl on two separate flight controllers running mainline. Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-04-27 11:14:20 -08:00
Ramon Roche	7e6ccb3eb6	ci(sbom): check out submodules recursively in PR license check ... The PR-time SBOM license check was using `submodules: false`, so when generate_sbom.py ran the new submodule directory was empty. The script treats uninitialized submodules as `(not checked out) -> NOASSERTION (skipped)` rather than a failure, which let PR #27184 (adding PX4-OpticalFlow as a submodule) pass without ever inspecting the actual repo for a LICENSE file. The monthly audit then caught it (#27217) because it uses `submodules: recursive`. Switch the PR-time job to `submodules: recursive` so license issues are caught at PR time rather than on the next monthly audit. The job only runs when .gitmodules, license-overrides.yaml, or generate_sbom.py change, so the extra clone cost is bounded. Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-04-27 11:37:46 -06:00
Ramon Roche	bc080e3044	chore(sbom): bump PX4-OpticalFlow to commit with LICENSE file ... Bumps the submodule pointer to pick up the BSD-3-Clause LICENSE file added in PX4/PX4-OpticalFlow#20. Resolves the SBOM audit NOASSERTION finding without needing a manual override entry in Tools/ci/license-overrides.yaml. Fixes #27217 Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-04-27 11:37:02 -06:00
Ramon Roche	b911d4414e	build(sim): convert PX4-OpticalFlow to git submodule (#27184) ... Replace the ExternalProject_Add-based fetch of PX4/PX4-OpticalFlow with a proper git submodule at src/modules/simulation/gz_plugins/optical_flow/PX4-OpticalFlow, matching how every other external C++ dependency is integrated in PX4 (mavlink, gps/devices, Micro-XRCE-DDS-Client, libevents, heatshrink, etc.). The previous approach cloned the repo over the network on every clean build, pinned to GIT_TAG master (unreproducible), and had generated a string of follow-up PRs over the last year chasing ExternalProject quirks (install paths, macOS .dylib vs .so, permissions). The plugin now consumes the upstream OpticalFlow target directly via add_subdirectory and px4_add_git_submodule. The upstream repo predates PX4's strict warning policy, so the OpticalFlow and klt_feature_tracker targets get -Wno-error plus a few specific -Wno-* flags and -fvisibility=default to build cleanly inside the PX4 tree. Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-04-23 11:57:02 -08:00
Ramon Roche	540218857a	ci(clang-tidy): drop 'file not found' diagnostics from PR review ... These fire when clang-tidy analyzes a header whose including TU is not in the active compile_commands.json (e.g. board-specific NuttX headers against the SITL clang build), producing spurious line-anchored review comments on every new-board PR. Real missing includes are caught by the build_all_targets matrix, which fails the build loudly. Filter the class of finding at the producer so it never reaches the poster. Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-04-22 10:25:26 -07:00
Ramon Roche	947a456036	ci(dev_container): drop branch push trigger on release branches ... Pushes to stable/beta/release/** only move when a release is cut, and that release was already built by the matching v* tag push moments earlier. The subsequent branch push reruns the arm64+amd64 matrix (~8 min) to produce the identical image digest. Registry push is already gated on refs/tags/, so the second run is pure waste. Drop those branches from on.push; keep main (regular development pushes) and the v* tag trigger (the authoritative release trigger). workflow_dispatch remains available for manual rebuilds. Fixes #27170 Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-04-22 10:01:33 -07:00
Ramon Roche	1df16f39a8	ci(compile_ubuntu): only run on push to main ... compile_ubuntu.yml is a PR-focused Ubuntu container smoke check. On stable, beta, and release/** branches it duplicates build_all_targets.yml, which already covers those branches with the full board matrix and the S3 uploads. Drop stable, beta, and release/** from the push branch list so it matches the trigger pattern used by compile_macos.yml, checks.yml, and clang-tidy.yml. Fixes #27171 Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-04-22 10:01:07 -07:00
Ramon RocheandHamish Willee	3efdbe9fd3	docs(sim_sih): link Hawkeye visualizer, add stub page (#27159) ... * docs(sim_sih): link Hawkeye visualizer, add stub page Replaces jMAVSim display-only mode references in the SIH page with Hawkeye, which is purpose-built for this role and actively maintained. The 3D visualization section now covers the hawkeye command, the port alignment with SIH (UDP 19410), and links out to the full Hawkeye documentation. Adds a short sim_hawkeye/index.md stub covering what Hawkeye is, install on macOS and Linux, and basic SIH usage. Everything else (multi-vehicle, ULog replay, HUD modes, CLI reference) lives at px4.github.io/Hawkeye and is linked from the stub, so PX4 docs don't carry the maintenance burden of two parallel sources. Also updates the port reference table: UDP 19410 is now labeled "Hawkeye visualizer" instead of "jMAVSim display-only", and adds the page to SUMMARY.md nested under SIH Simulation. * docs(update): subedit --------- Co-authored-by: Hamish Willee <hamishwillee@gmail.com>	2026-04-22 16:19:56 +10:00
Ramon Roche	dcedef6168	build(sim): resolve SITL runtime deps via .deb Depends ... The px4-gazebo .deb already declares OpenCV and gstreamer core library deps via dpkg-shlibdeps, but Dockerfile.gazebo uses dpkg -x which bypasses resolution. Switch to apt install ./px4-gazebo_*.deb so Depends are resolved automatically. Add the 5 gstreamer plugin packages (plugins-base/good/bad/ugly/libav) to CPACK_DEBIAN_PACKAGE_DEPENDS since they're loaded at runtime via gst_element_factory_make() and cannot be detected by shlibdeps. Apply the same apt-install pattern to Dockerfile.sih so both images build consistently. Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-04-21 15:37:48 -07:00
Ramon Roche	9c2e634325	build(macos): make gz SITL work out-of-box after homebrew 4.5 ... The px4-sim / px4-sim-gazebo Homebrew meta-formulae can no longer pull their Gazebo dependency chain because Homebrew 4.5+ stopped auto-resolving cross-tap deps. PX4/homebrew-px4#104 already deprecated px4-dev into a no-op; #111 does the same for the sim formulae. This PR is the PX4-side counterpart: move the sim install into Tools/setup/macos.sh with an explicit package list and tap registration, mirroring the pattern already used for the toolchain block. Adds xquartz install on --sim-tools. Beyond install, three runtime and configure gaps kept make px4_sitl gz_x500 from working on a clean macOS: - gz-gui8 (pulled in by gz-sim8) links against Qt5, but Homebrew's qt@5 is keg-only so CMake cannot find it. Add a POSIX-scoped hint in platforms/posix/cmake/px4_impl_os.cmake that resolves brew --prefix qt@5 and appends it to CMAKE_PREFIX_PATH. No-ops on non-APPLE builds and respects a user-set Qt5_DIR. - On macOS, dyld does not search /opt/homebrew/lib by default. gobject-introspection typelibs reference libs by bare basename, causing gst-plugin-scanner to fail to load plugins and adding ~90s of timeout to Gazebo's cold start. Set DYLD_FALLBACK_LIBRARY_PATH to the Homebrew prefix lib dir in gz_env.sh so the bridge launch inherits it. Darwin-scoped, no effect on Linux or CI. - configure_file on gz_env.sh.in now uses @ONLY so shell ${VAR} references pass through untouched. Verified locally on macOS 26.4 / arm64 / Homebrew 5.1.7: configure clean, 1119/1119 targets compile and link, vehicle spawns in Gazebo Harmonic 8.11.0 with a single "Waiting for Gazebo world" wait (was ~18 before the dyld fix). Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-04-20 16:15:41 -07:00
Ramon Roche	67cb65f237	build(msg): disable SSL and Security in the host-side CycloneDDS build ... The nested CycloneDDS CMake invocation in msg/CMakeLists.txt exists only to produce the 'idlc' IDL compiler as a host-side code-gen tool. It does not need CycloneDDS's TLS transport or DDS Security features, but both default to ON in cyclonedds' upstream CMake. When ENABLE_SSL=AUTO (the default), cyclonedds finds the system OpenSSL and builds ddsi_ssl.c. On macos-latest the system OpenSSL is 3.x, which removed the deprecated SSL_get_peer_certificate() symbol used in our pinned cyclonedds revision (2023). The host build then fails at link time with: Undefined symbols for architecture arm64: "_SSL_get_peer_certificate", referenced from: _dds_report_tls_version in ddsi_ssl.c.o This broke every Zenoh-enabled board build on macOS (boards that select CONFIG_MODULES_ZENOH pull in LIB_CDRSTREAM, which is what triggers the nested build). v5 and v6x never hit it because they don't enable Zenoh. Passing -DENABLE_SSL=OFF -DENABLE_SECURITY=OFF skips compilation of ddsi_ssl.c and the security plugins entirely. idlc is unaffected (pure C code generation, no DDS runtime). Verified locally on macOS ARM64: clean distclean + make px4_fmu-v6xrt_default completes in 2090/2090 ninja steps, producing a 2.1 MB .px4 with 59% FLASH used. Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-04-20 16:12:32 -07:00
Ramon Roche	bfa66b514b	fix(tflm): vendor third-party deps to enable reproducible builds ... tflite-micro's Makefile fetches 5 third-party dependencies (flatbuffers, kissfft, gemmlowp, ruy, pigweed, plus CMSIS/CMSIS-NN for ARM targets) via wget and git clone at build time. This breaks reproducible builds: the build output depends on GitHub and pigweed.googlesource.com being reachable and serving the exact pinned archives, which is not guaranteed and has broken in the past when GitHub silently regenerated archive zips. Bump the tflite_micro submodule to the new px4/vendored-deps branch on PX4/tflite-micro, which commits the deps directly under tensorflow/lite/micro/tools/make/downloads/. Upstream's download scripts already no-op with "already exists, skipping the download" when the target directories are present, so no Makefile patches are needed. Drop the add_custom_command, build_tflm_native target, and the empty generate_cc_arrays.py shim from CMakeLists.txt. They existed solely to drive the (now-removed) make third_party_downloads invocation and to overwrite the submodule's generate_cc_arrays.py to keep that invocation quiet. With the download step gone, none of that machinery is needed, and the submodule stays clean after a build. Verified builds against the new submodule: - px4_sitl_neural (linux/amd64 devcontainer) - mro_pixracerpro_neural (linux/amd64 devcontainer) - px4_fmu-v6xrt_allyes (linux/amd64 and linux/arm64 devcontainers) Fixes #27054 Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-04-20 16:12:04 -07:00
Ramon Roche	a6d1822521	build(macos): inline homebrew deps in setup script, drop px4-dev meta-formula ... Homebrew 4.5 (April 2026) stopped auto-tapping cross-tap dependencies declared in formulae, as a security + performance change. The px4-dev meta-formula pulled in packages from osx-cross/arm, PX4/px4, and discoteq/discoteq, so 'brew install px4-dev' now aborts before any real work unless every tap has been added explicitly. On macos-latest CI runners the chain broke at the first unreachable dep (discoteq/discoteq/flock) and subsequent make steps failed with 'ccache: command not found'. Since Tools/setup/macos.sh is the canonical install path and already tapped osx-cross/arm and PX4/px4 before calling brew install, the simplest fix is to inline the package list and call brew install directly. The px4-dev meta-formula will be kept upstream as a deprecated no-op so older copies of macos.sh on long-lived branches and cached Docker images keep working. The inlined package list is the same set px4-dev depended on, minus the dead-weight flock dependency that hadn't been invoked in the PX4 build since the NuttX 9.1.x era. See the accompanying PX4/homebrew-px4 PR for formula changes. Docs updated to match: docs/en/dev_setup/dev_env_mac.md no longer names the px4-dev formula, describes the package list directly. Verified locally on macOS ARM64: - ./Tools/setup/macos.sh runs to completion with both taps and all 13 packages resolving correctly - make distclean && make px4_fmu-v6x_default builds successfully (1250/1250 ninja steps, 1930096 B FLASH used) Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-04-18 13:04:26 -07:00
3 people	62b3c9a063	fix(mavlink)!: align signing with MAVLink spec and fix performance regression (#26894) ... * fix(mavlink): align signing with MAVLink spec and fix performance regression Remove the non-standard MAV_SIGN_CFG parameter and align the signing implementation with the MAVLink specification. Key changes: - Remove MAV_SIGN_CFG parameter that conflicted with GCS implementations - Only enable signing when a valid key is present on the SD card - Accept SETUP_SIGNING on any link, not just USB - Reject SETUP_SIGNING while the vehicle is armed - Allow disabling signing via signed all-zero key SETUP_SIGNING message - Propagate key changes to all mavlink instances - Zero CPU/bandwidth overhead when signing is not active Fixes #26893 Signed-off-by: Ramon Roche <mrpollo@gmail.com> * Signing minor subedit --------- Signed-off-by: Ramon Roche <mrpollo@gmail.com> Co-authored-by: Hamish Willee <hamishwillee@gmail.com> Co-authored-by: Jacob Dahl <dahl.jakejacob@gmail.com>	2026-04-12 18:18:57 -08:00
Ramon Roche	1cf7d75525	fix(ci): lint test files on PRs without breaking push-to-main ... The pr-review-poster was flagging `gtest/gtest.h file not found` on any PR that added or modified a test file, because clang-tidy-diff-18.py ran against files that weren't in the compilation database. PR #27004 and PR #26233 both hit this. The root cause is that test TUs only enter compile_commands.json when BUILD_TESTING is ON, which the historical clang-tidy build does not enable. This PR fixes both halves of the problem: 1. Add a second make target `px4_sitl_default-clang-test` that configures a separate build dir with -DCMAKE_TESTING=ON. Test TUs land in its compile_commands.json with resolved gtest/fuzztest include paths. 2. Add an umbrella `clang-ci` target that depends on both `px4_sitl_default-clang` and `px4_sitl_default-clang-test` so the PR job prepares both build dirs with one make invocation. 3. On PR events the workflow uses `make clang-ci`, installs libclang-rt-18-dev (needed so fuzztest's FUZZTEST_FUZZING_MODE flags do not fail the abseil try_compile with a misleading "pthreads not found" error), and routes the clang-tidy-diff producer at the test-enabled build dir. 4. Push-to-main is left entirely alone: same single build dir, same `make px4_sitl_default-clang`, same `make clang-tidy`. Test files are not in that DB so run-clang-tidy.py keeps ignoring them exactly as before. This preserves green main while ~189 pre-existing clang-tidy issues in test files remain untouched; fixing those is out of scope for this change. 5. Replace the fragile `:!*/test/*` pathspec filter (which missed flat `*Test.cpp` files in module roots) with `Tools/ci/clang-tidy-diff-filter.py`, which reads the compilation database and drops any changed source file that is not a TU. Headers always pass through. Production code that happens to use test-like names (src/systemcmds/actuator_test, src/drivers/test_ppm, etc.) stays analyzed because those are real px4_add_module targets. Verified in the ghcr.io/px4/px4-dev:v1.17.0-rc2 container and on the real CI runner: - cmake configure with CMAKE_TESTING=ON succeeds after installing libclang-rt-18-dev (Found Threads: TRUE) - compile_commands.json grows from 1333 to 1521 TUs - Modifying HysteresisTest.cpp with a new `const char *p = NULL` correctly flags hicpp-use-nullptr and clang-diagnostic-unused-variable on the new line, while pre-existing issues on other lines of the same file stay suppressed by clang-tidy-diff-18.py's line filter ("Suppressed ... 1 due to line filter") - No gtest/gtest.h false positives - Push-to-main path unchanged, still green Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-04-11 10:03:51 -06:00
Ramon Roche	9dd434f441	ci(compile-ubuntu): replace quick_check with targeted SITL and NuttX builds ... Replace make quick_check with two explicit build targets: px4_sitl_default (validates native SITL toolchain) and px4_fmu-v5_default (validates NuttX cross-compile toolchain). quick_check built four targets: px4_sitl_test, px4_fmu-v5_default, tests, and check_format. The tests and check_format targets are redundant with checks.yml which already runs them on 8cpu RunsOn with ccache. The purpose of this workflow is to validate that PX4 builds from a fresh ubuntu.sh install on both Ubuntu 22.04 and 24.04, not to run tests or check formatting. Two targeted builds are sufficient. px4_fmu-v5_default is kept as the hardware target (same as quick_check) since it builds with the arm-none-eabi-gcc version that ubuntu.sh installs on both 22.04 and 24.04. Expected duration drop from 16-17 min to 6-8 min per matrix entry. Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-04-11 09:57:02 -06:00
Ramon Roche	958688f36d	fix(fuzzing): revert to old container image ... The v1.17.0-rc2 container's clang 18 + cmake 3.28 combination fails abseil's cmake try_compile tests for C++17 and pthreads. This breaks the fuzztest build which depends on abseil. Verified locally: - px4io/px4-dev:v1.16.0-rc2 + apt install clang: cmake configure passes - ghcr.io/px4/px4-dev:v1.17.0-rc2 (clang 18 pre-installed): cmake configure fails with "ABSL_INTERNAL_AT_LEAST_CXX17 - Failed" and "Could NOT find Threads" - apt install clang on v1.17.0-rc2 is a no-op (already installed) Revert to the old container image which has a working clang+cmake combination. The apt install clang step (already in the workflow) installs clang on the old container which doesn't ship it by default. Remove the explicit fetch-depth: 0 added in the previous fix attempt since the original workflow used the default depth (1) and it worked. Fixes #27060 Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-04-11 09:45:14 -06:00
Ramon Roche	c515f81298	fix(ci): stop pr-review-poster from spamming REQUEST_CHANGES on every push ... Branch protection rules block the GITHUB_TOKEN from dismissing reviews (HTTP 403), so every push added another undismissable REQUEST_CHANGES review. PR #27004 accumulated 12 identical blocking reviews. Switch to COMMENT-only reviews. Findings still show inline on the diff but don't create blocking reviews that require manual maintainer dismissal. The CI check status (pass/fail) gates merging, not the review state. Also enable CMAKE_TESTING=ON in the clang-tidy build so test files get proper include paths in compile_commands.json. Without this, clang-tidy-diff runs on test files from the PR diff but can't resolve gtest headers, producing false positives. Fixes #27004 Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-04-10 20:33:34 -06:00
Ramon Roche	c0a45cef70	ci(build-all): MCU-based groups, cache seeders, build infra overhaul (#27050) ... Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-04-10 18:49:53 -07:00
Ramon Roche	d52fbd9707	fix(ci): remove accidentally committed local settings file ... .claude/settings.local.json contains user-specific Claude Code permissions and should never be in the repo. Remove it and add a .gitignore entry to prevent it from being committed again. Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-04-10 15:58:34 -06:00
Ramon Roche	0e31dd560d	ci(fuzzing): migrate to RunsOn with ccache and bump container ... Migrate the fuzzing workflow from GitHub-hosted ubuntu-latest to RunsOn 4cpu with s3-cache. Bump the container from the stale px4io/px4-dev:v1.16.0-rc2 to ghcr.io/px4/px4-dev:v1.17.0-rc2. Wire setup-ccache / save-ccache with cache-key-prefix ccache-sitl and max-size 300M, sharing the SITL build cache with checks:tests. Both build px4_sitl_test/px4_sitl_default so the ccache contents overlap significantly. Drop the manual apt install clang step since the v1.17.0-rc2 container already ships clang. Replace the git config --global safe.directory workaround with --system to match the repo convention. Add runs-on/action@v2 for the S3 cache proxy. Add fetch-depth: 1 since the fuzzer doesn't need git history. Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-04-10 09:52:01 -06:00
Ramon Roche	ae47d69f50	ci(checks): merge EKF change indicators into tests job ... Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-04-10 08:42:40 -06:00
Ramon Roche	a0e42f2032	ci(workflows): bump all action versions to latest majors ... Bump every GitHub Action in the repository to its latest major version, addressing the upcoming Node.js 20 deprecation. Several of the old versions (checkout v4, cache v4, setup-node v4, labeler v5) use the Node 20 runtime which GitHub is deprecating. The new versions use Node 22. - actions/checkout v4/v5 to v6 - actions/upload-artifact v4 to v7 - actions/download-artifact v4 to v8 - actions/cache, cache/restore, cache/save v4 to v5 - actions/setup-node v4 to v6 - actions/setup-python v5 to v6 - actions/github-script v7/v8 to v9 - actions/labeler v5 to v6 - peter-evans/find-comment v3 to v4 - dorny/paths-filter v3 to v4 - codecov/codecov-action v4 to v6 - docker/setup-buildx-action v3 to v4 - docker/build-push-action v6 to v7 - tj-actions/changed-files v46 to v47 Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-04-10 07:30:50 -06:00
Ramon Roche	0f15eea283	ci(mavros): merge mission+offboard into one workflow, migrate to noetic and Python 3 ... Consolidate mavros_mission_tests.yml and mavros_offboard_tests.yml into a single mavros_tests.yml with a matrix strategy. Switch from docker-in-docker with px4-dev-ros-melodic to a native container using px4-dev-ros-noetic, enabling ccache and composite actions (setup-ccache, build-gazebo-sitl, save-ccache). Migrate all five MAVROS Python test files from Python 2 to Python 3 (remove six/xrange, from __future__ imports, replace px4tools with pyulog for estimator analysis). Bump git-auto-commit-action from v4 to v7 in ekf_update_change_indicator.yml. Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-04-10 00:47:17 -06:00
Ramon Roche	5d5d9e399b	ci(workflows): wire ccache and caches across ci (#27036) ... Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-04-09 21:51:25 -07:00
Ramon Roche	a3ad956394	ci(stale): bump operations-per-run and add manual trigger ... The stale workflow was hitting its 250 operations-per-run cap every daily run, causing the "No more operations left! Exiting..." warning and leaving a growing backlog of stale-labeled items that were never being closed. GitHub API headroom is plentiful (250 ops uses ~1.6% of the 15k/hour bucket), so raising to 1500 drains the backlog without any rate-limit risk. Also adds workflow_dispatch so maintainers can trigger the workflow from the Actions tab or via gh workflow run stale.yml. Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-04-09 20:40:07 -06:00
Ramon Roche	a49cffb09f	ci(checks): trim matrix, ccache tests, modernize python_checks ... Port the checks.yml and python_checks.yml improvements from the CI orchestrator branch (mrpollo/ci_orchestration, PR #26257) without doing the full T1/T2 split. checks.yml: - Drop 5 matrix entries the orchestrator removed: tests_coverage, px4_fmu-v2_default stack_check, NO_NINJA_BUILD=1 px4_fmu-v5_default, NO_NINJA_BUILD=1 px4_sitl_default, px4_sitl_allyes. - Remove the codecov/codecov-action@v1 step (deprecated, only ran for the dropped tests_coverage entry). - Wire the setup-ccache / save-ccache composite actions around make tests (cache-key-prefix ccache-sitl, max-size 300M) so repeat runs reuse the SITL build tree. Matches the orchestrator basic-tests job 1:1. python_checks.yml: - Replace the apt-get install python3 + pip install --break-system-packages + hardcoded $HOME/.local/bin paths with actions/setup-python@v5 pinned to 3.10 and plain pip install. - Linters now run from PATH instead of $HOME/.local/bin. Stacks on top of mrpollo/ci-checkout-hygiene (#27032) which shipped fail-fast: true, fetch-depth: 1, and the safe.directory step extraction. Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-04-09 16:46:31 -06:00
Ramon Roche	8552465408	ci(workflows): shallow checkout and fail-fast in checks ... Port checkout hygiene from the CI orchestrator branch (mrpollo/ci_orchestration) to current workflows without merging the orchestrator itself. - checks.yml: enable fail-fast (99% success rate observed, cancel on first failure saves runner time), switch to fetch-depth 1, extract safe.directory to its own step - itcm_check.yml: fetch-depth 1, drop submodules: recursive (the Makefile bootstraps submodules as a prerequisite of board targets) - sitl_tests.yml, ros_integration_tests.yml, mavros_mission_tests.yml, mavros_offboard_tests.yml, python_checks.yml: fetch-depth 1 Each change matches the corresponding job in ci-orchestrator.yml on mrpollo/ci_orchestration 1:1. Workflows that legitimately need history (clang-tidy, flash_analysis, failsafe_sim, ros_translation_node, ekf_*_change_indicator, build_all_targets) are left alone. Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-04-09 15:57:34 -06:00
Ramon Roche	100d9c97fb	ci(workflows): remove nuttx_env_config ... Delete the nuttx_env_config workflow. It validated the PX4_EXTRA_NUTTX_CONFIG env var handling in platforms/nuttx/NuttX/CMakeLists.txt by building px4_fmu-v5_default with CONFIG_NSH_LOGIN_PASSWORD injected at configure time. The CI orchestrator rewrite (mrpollo/ci_orchestration, PR #26257) drops this workflow entirely. The cmake feature itself remains; only the CI gate is removed. Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-04-09 15:57:12 -06:00
Ramon Roche	5db3060c2a	ci(workflows): upgrade SITL and ROS integration runners to 8cpu ... Upgrade the RunsOn runner for sitl_tests and ros_integration_tests from 4cpu-linux-x64 / ubuntu22-full-x64 to 8cpu-linux-x64 / ubuntu24-full-x64 with extras=s3-cache. Matches the runner_medium spec used by the sitl-tests and ros-integration-tests jobs in the CI orchestrator branch (mrpollo/ci_orchestration). Both jobs are compile-heavy and benefit from the 2x core count. The ubuntu24 image and s3-cache extras align with the house style already used by clang-tidy, dev_container, docs_deploy, docs-orchestrator, and build_deb_package. No other changes (speed factor unchanged, container images unchanged). Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-04-09 15:57:00 -06:00
Ramon Roche	9e93fd753e	ci(pr-review-poster): add line-anchored review poster and migrate clang-tidy (#27028) ... * ci(pr-review-poster): add line-anchored review poster and migrate clang-tidy Adds a generic PR review-comment poster as a sibling of the issue-comment poster from #27021. Replaces platisd/clang-tidy-pr-comments@v1 in the Static Analysis workflow with an in-tree, fork-friendly producer + poster pair so fork PRs get inline clang-tidy annotations on the Files changed tab without trusting a third-party action with a write token. Architecture mirrors pr-comment-poster: a producer (clang-tidy.yml) runs inside the px4-dev container and writes a `pr-review` artifact containing manifest.json and a baked comments.json. A separate workflow_run-triggered poster runs on ubuntu-latest with the base-repo write token, validates the artifact, dismisses any stale matching review, and posts a fresh review on the target PR. The poster never checks out PR code and only ever reads two opaque JSON files from the artifact. Stale-review dismissal is restricted to reviews authored by github-actions[bot] AND whose body contains the producer's marker. A fork cannot impersonate the bot login or inject the marker into a human reviewer's body, so the poster can never dismiss a human review. APPROVE events are explicitly forbidden so a bot cannot approve a pull request. To avoid duplicating ~120 lines of HTTP plumbing between the two posters, the GitHub REST helpers (single-request, pagination, error handling) are extracted into Tools/ci/_github_helpers.py with a small GitHubClient class. The existing pr-comment-poster.py is refactored to use it; net change is roughly -80 lines on that script. The shared module is sparse-checked-out alongside each poster script and is stdlib only. The clang-tidy producer reuses MIT-licensed translation logic from platisd/clang-tidy-pr-comments (generate_review_comments, reorder_diagnostics, get_diff_line_ranges_per_file and helpers) under a preserved attribution header. The HTTP layer is rewritten on top of _github_helpers so the producer does not pull in `requests`. Conversation resolution (the GraphQL path) is intentionally dropped for v1. clang-tidy.yml now produces the pr-review artifact in the same job as the build, so the cross-runner compile_commands.json hand-off and workspace-path rewriting are no longer needed and the post_clang_tidy_comments job is removed. Signed-off-by: Ramon Roche <mrpollo@gmail.com> * ci(workflows): bump action versions to clear Node 20 deprecation GitHub has deprecated the Node 20 runtime for Actions as of September 16, 2026. Bump the pinned action versions in the three poster workflows to the latest majors, all of which run on Node 24: actions/checkout v4 -> v6 actions/github-script v7 -> v8 actions/upload-artifact v4 -> v7 No behavior changes on our side: upload-artifact v5/v6/v7 only added an optional direct-file-upload mode we do not use, and checkout v5/v6 are runtime-only bumps. The security-invariant comment headers in both poster workflows are updated to reference the new version so they stay accurate. Signed-off-by: Ramon Roche <mrpollo@gmail.com> * ci(pr-posters): skip job when producer was not a pull_request event Both poster workflows previously ran on every workflow_run completion of their listed producers and then silently no-oped inside the script when the triggering producer run was a push-to-main (or any other non-PR event). That made the UI ambiguous: the job was always green, never showed the reason it did nothing, and looked like a failure whenever someone clicked in looking for the comment that was never there. Gate the job at the workflow level on github.event.workflow_run.event == 'pull_request'. Non-PR producer runs now surface as a clean "Skipped" entry in the run list, which is self-explanatory and needs no in-script summary plumbing. Signed-off-by: Ramon Roche <mrpollo@gmail.com> --------- Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-04-09 10:54:29 -07:00
Ramon Roche	e8c19a2006	build(cmake): bump lockstep_scheduler minimum to 3.10 (#27017) ... CMake 3.27+ warns on cmake_minimum_required(VERSION < 3.10), and CMake 4.x will make it a hard error. Align the lockstep_scheduler subdir with the root CMakeLists.txt, which is already at 3.10. Signed-off-by: Ramon Roche <mrpollo@gmail.com>	2026-04-09 09:14:15 -08:00
Ramon RocheandHamish Willee	9adda29da2	docs(sim): add Try PX4 quick-start and pre-built packages reference (#26957) ... Adds documentation for the SITL containers and .deb packages introduced in #26495. The containers are now live on Docker Hub: [`px4io/px4-sitl:latest`](https://hub.docker.com/r/px4io/px4-sitl) and [`px4io/px4-sitl-gazebo:latest`](https://hub.docker.com/r/px4io/px4-sitl-gazebo). The main addition is a [Try PX4 Simulation](https://docs.px4.io/main/en/dev_setup/try_px4) page that leads with a single `docker run` command and gets someone flying in under a minute. It lives in Getting Started, right after Recommended Hardware/Setup, so it's one of the first things new users see. The existing `.deb` package reference has been moved from `packaging/px4_sitl_deb.md` to `simulation/px4_sitl.md` and expanded to cover both containers and `.deb` packages on one page. Sections are ordered by how people use them: what's available, install, configure, connect QGC/MAVSDK, connect ROS 2. Other changes: - README now has a "Try PX4" section with the docker one-liner above "Build from Source" - Landing page (`index.md`) reworked to lead with "Try PX4" before "For Developers" - Toolchain page (`dev_env.md`) gets a tip redirecting simulation-only users to pre-built packages - `getting_started.md` and `SUMMARY.md` updated with links to the new pages - Simulation index tip updated to mention containers alongside `.deb` packages The SIH container image is published as `px4io/px4-sitl` (renamed from `px4io/px4-sitl-sih`) so the default lightweight option carries the simplest name. The Gazebo image remains `px4io/px4-sitl-gazebo`. Also upgrades all GitHub Actions in the SITL workflow to Node.js 24 compatible versions (`actions/checkout@v6`, `actions/cache@v5`, `actions/upload-artifact@v7`, `actions/download-artifact@v8`, `docker/setup-buildx-action@v4`, `docker/build-push-action@v7`) to fix the Node.js 20 deprecation warning ahead of the June 2026 deadline. --------- Signed-off-by: Ramon Roche <mrpollo@gmail.com> Co-authored-by: Hamish Willee <hamishwillee@gmail.com>	2026-04-09 08:51:22 -07:00