From 54670efd644d7b3c15eb372b7b502d22d0d2544b Mon Sep 17 00:00:00 2001 From: gavanderhoorn Date: Fri, 3 Jul 2026 19:04:48 +0200 Subject: [PATCH 1/6] distro: introduce raw URL formatters Refactor GitHub formatting code and add GitLab formatter. --- vinca/distro.py | 38 ++++++++++++++++++++++++++++++++++++-- 1 file changed, 36 insertions(+), 2 deletions(-) diff --git a/vinca/distro.py b/vinca/distro.py index 84fcade..44baff9 100644 --- a/vinca/distro.py +++ b/vinca/distro.py @@ -187,8 +187,6 @@ def get_python_version(self): def get_package_names(self): return self._distro.release_packages.keys() - # Based on https://github.com/ros-infrastructure/rosdistro/blob/fad8d9f647631945847cb18bc1d1f43008d7a282/src/rosdistro/manifest_provider/github.py#L51C1-L69C29 - # But with the option to specify the name of the package.xml file in case the repo uses a non-standard name def get_package_xml_for_additional_package(self, pkg_info): # Build raw GitHub URL for package.xml raw_url_base = pkg_info.get("url") @@ -215,3 +213,39 @@ def get_package_xml_for_additional_package(self, pkg_info): return xml_content except Exception as e: raise RuntimeError(f"Failed to fetch package.xml from {raw_url}: {e}") + + # Based on https://github.com/ros-infrastructure/rosdistro/blob/fad8d9f647631945847cb18bc1d1f43008d7a282/src/rosdistro/manifest_provider/github.py#L51C1-L69C29 + # But with the option to specify the name of the package.xml file in case the repo uses a non-standard name + def _construct_raw_url_github(self, pkg_info): + # Build raw GitHub URL for package.xml + raw_url_base = pkg_info.get("url") + if raw_url_base.endswith(".git"): + raw_url_base = raw_url_base[:-4] + if "github.com" not in raw_url_base: + raise RuntimeError(f"Cannot handle non-GitHub URL: {raw_url_base}") + # Extract owner/repo + owner_repo = raw_url_base.split("github.com/")[-1] + # Use rev if available, otherwise fallback to tag + ref = pkg_info.get("rev") or pkg_info.get("tag") + xml_name = pkg_info.get("package_xml_name", "package.xml") + additional_folder = pkg_info.get("additional_folder", "") + if additional_folder != "": + additional_folder = additional_folder + "/" + raw_url = f"https://raw.githubusercontent.com/{owner_repo}/{ref}/{additional_folder}{xml_name}" + return raw_url + + # format (checked against GitLab 19.x): https://gitlab.com//-/raw// + def _construct_raw_url_gitlab(self, pkg_info): + raw_url_base = pkg_info.get("url") + if raw_url_base.endswith(".git"): + raw_url_base = raw_url_base[:-4] + if "gitlab.com" not in raw_url_base: + raise RuntimeError(f"Cannot handle non-GitLab URL: {raw_url_base}") + # Use rev if available, otherwise fallback to tag + ref = pkg_info.get("rev") or pkg_info.get("tag") + xml_name = pkg_info.get("package_xml_name", "package.xml") + additional_folder = pkg_info.get("additional_folder", "") + if additional_folder != "": + additional_folder = additional_folder + "/" + raw_url = f"{raw_url_base}/-/raw/{ref}/{additional_folder}{xml_name}" + return raw_url From a0087a6a1460984215d9f9b4426d1084316d744e Mon Sep 17 00:00:00 2001 From: gavanderhoorn Date: Fri, 3 Jul 2026 19:06:29 +0200 Subject: [PATCH 2/6] distro: add manifest download helper Return either cached version or attempt download and return result. --- vinca/distro.py | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/vinca/distro.py b/vinca/distro.py index 44baff9..1dc63b5 100644 --- a/vinca/distro.py +++ b/vinca/distro.py @@ -214,6 +214,17 @@ def get_package_xml_for_additional_package(self, pkg_info): except Exception as e: raise RuntimeError(f"Failed to fetch package.xml from {raw_url}: {e}") + def _download_raw_pkg_xml_or_cached(self, url): + if url in self._additional_xml_cache: + return self._additional_xml_cache[url] + try: + with urllib.request.urlopen(url) as resp: + xml_content = resp.read().decode("utf-8") + self._additional_xml_cache[url] = xml_content + return xml_content + except Exception as e: + raise RuntimeError(f"Failed to fetch package.xml from {url}: {e}") + # Based on https://github.com/ros-infrastructure/rosdistro/blob/fad8d9f647631945847cb18bc1d1f43008d7a282/src/rosdistro/manifest_provider/github.py#L51C1-L69C29 # But with the option to specify the name of the package.xml file in case the repo uses a non-standard name def _construct_raw_url_github(self, pkg_info): From 2619905e65d022507cf92c9fe796864c83f580b9 Mon Sep 17 00:00:00 2001 From: gavanderhoorn Date: Fri, 3 Jul 2026 19:08:24 +0200 Subject: [PATCH 3/6] distro: download GitHub raw URL using helpers --- vinca/distro.py | 28 ++++------------------------ 1 file changed, 4 insertions(+), 24 deletions(-) diff --git a/vinca/distro.py b/vinca/distro.py index 1dc63b5..4fa5cc7 100644 --- a/vinca/distro.py +++ b/vinca/distro.py @@ -188,31 +188,11 @@ def get_package_names(self): return self._distro.release_packages.keys() def get_package_xml_for_additional_package(self, pkg_info): - # Build raw GitHub URL for package.xml raw_url_base = pkg_info.get("url") - if raw_url_base.endswith(".git"): - raw_url_base = raw_url_base[:-4] - if "github.com" not in raw_url_base: - raise RuntimeError(f"Cannot handle non-GitHub URL: {raw_url_base}") - # Extract owner/repo - owner_repo = raw_url_base.split("github.com/")[-1] - # Use rev if available, otherwise fallback to tag - ref = pkg_info.get("rev") or pkg_info.get("tag") - xml_name = pkg_info.get("package_xml_name", "package.xml") - additional_folder = pkg_info.get("additional_folder", "") - if additional_folder != "": - additional_folder = additional_folder + "/" - raw_url = f"https://raw.githubusercontent.com/{owner_repo}/{ref}/{additional_folder}{xml_name}" - if raw_url in self._additional_xml_cache: - return self._additional_xml_cache[raw_url] - - try: - with urllib.request.urlopen(raw_url) as resp: - xml_content = resp.read().decode("utf-8") - self._additional_xml_cache[raw_url] = xml_content - return xml_content - except Exception as e: - raise RuntimeError(f"Failed to fetch package.xml from {raw_url}: {e}") + if "github.com" in raw_url_base: + raw_url = self._construct_raw_url_github(pkg_info) + return self._download_raw_pkg_xml_or_cached(url=raw_url) + raise RuntimeError(f"Cannot handle unknown repository hoster: {raw_url_base}") def _download_raw_pkg_xml_or_cached(self, url): if url in self._additional_xml_cache: From 430ee3b2d01ba6bcd6001fe9126af9e93326a5a6 Mon Sep 17 00:00:00 2001 From: gavanderhoorn Date: Fri, 3 Jul 2026 19:09:22 +0200 Subject: [PATCH 4/6] distro: support GitLab hosted pkgs and manifests --- vinca/distro.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/vinca/distro.py b/vinca/distro.py index 4fa5cc7..76020bc 100644 --- a/vinca/distro.py +++ b/vinca/distro.py @@ -192,6 +192,9 @@ def get_package_xml_for_additional_package(self, pkg_info): if "github.com" in raw_url_base: raw_url = self._construct_raw_url_github(pkg_info) return self._download_raw_pkg_xml_or_cached(url=raw_url) + if "gitlab.com" in raw_url_base: + raw_url = self._construct_raw_url_gitlab(pkg_info) + return self._download_raw_pkg_xml_or_cached(url=raw_url) raise RuntimeError(f"Cannot handle unknown repository hoster: {raw_url_base}") def _download_raw_pkg_xml_or_cached(self, url): From 1dc4739d99f451b09a72ccecc275b9f9a66c101f Mon Sep 17 00:00:00 2001 From: Tobias Fischer Date: Sat, 4 Jul 2026 20:07:36 +1000 Subject: [PATCH 5/6] Update GitHub Actions checkout and Pixi setup versions --- .github/workflows/ci.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a321cbe..8a87f87 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -15,10 +15,10 @@ jobs: fail-fast: false steps: - - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + - uses: actions/checkout@v7 - name: Setup Pixi - uses: prefix-dev/setup-pixi@28eb668aafebd9dede9d97c4ba1cd9989a4d0004 # v0.9.2 + uses: prefix-dev/setup-pixi@v0.10.0 with: pixi-version: latest cache: true From a35954cc7b8dca48b2b19cd42fa6b1fffa3f5542 Mon Sep 17 00:00:00 2001 From: Tobias Fischer Date: Sat, 4 Jul 2026 20:10:56 +1000 Subject: [PATCH 6/6] Delete .github/workflows/enforce-sha.yml --- .github/workflows/enforce-sha.yml | 17 ----------------- 1 file changed, 17 deletions(-) delete mode 100644 .github/workflows/enforce-sha.yml diff --git a/.github/workflows/enforce-sha.yml b/.github/workflows/enforce-sha.yml deleted file mode 100644 index 1273982..0000000 --- a/.github/workflows/enforce-sha.yml +++ /dev/null @@ -1,17 +0,0 @@ -on: - push: - branches: [ main, master ] - pull_request: - -name: Security - -permissions: read-all - -jobs: - ensure-pinned-actions: - runs-on: ubuntu-latest - steps: - - name: Checkout code - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5 - - name: Ensure SHA pinned actions - uses: zgosalvez/github-actions-ensure-sha-pinned-actions@9e9574ef04ea69da568d6249bd69539ccc704e74 # v4