[wikki26]

Summary

Adds the H-CI-1 ROS 2 Jazzy baseline CI image and GitHub Actions workflow for validation and authorized GHCR publication. Current update (29 Oct 2026): rebased in substance by merging the latest main into the feature branch and addressing Alex's 22 Oct review, at head 19266a51a84210b01e4486ac2cdb637bbb5cb8b7.

Changes

• Pinned ros:jazzy-ros-base by digest, installed platform/ROS build dependencies, and set RMW_IMPLEMENTATION=rmw_cyclonedds_cpp.
• Added ros-jazzy-twist-mux to support the planned velocity arbitration stack.
• Retained ros-jazzy-camera-ros for a confirmed current dependency: openamr-platform-sw/ros2/src/openamrobot_perception/package.xml declares <exec_depend>camera_ros</exec_depend>, and launch/camera.launch.py invokes the IMX708 camera_ros/camera_node for the existing robot. This does not assert that the 2.0 Gemini 336L/Orbbec driver is implemented or validated.
• Excluded legacy ros-jazzy-rplidar-ros; S3 sllidar_ros2 is a source-managed manifest/install dependency (see manifest PR Update README with sponsorship tiers and links #18), not hardware-qualified by this image.
• Split the workflow into Validate CI image (fork-safe PR, only contents: read, never publishes) and Publish CI image (only push to main or explicit workflow_dispatch from main; scoped packages: write).
• Preserved full commit-SHA action pins. Publishing records the run ID and image digest in the job summary.

Validation and evidence

• Previous GitHub-hosted PR Docker build: run 38466258795 passed on the earlier implementation.
• New head CI image build: run 40878548704 — passed; the Publish CI image job was correctly skipped for this pull request.
• New head repository quality and ROS verifier: run 40878548792 — passed for quality/test, ros-verifier-smoke, and repository-quality / repository-quality. The optional repository-quality / quality/test reusable job is skipped on this repository, not evidence of platform test execution.
• Previous platform workspace: 7/7 packages built using the candidate image; reported local clean build 24.8 s on linux/amd64. This is build evidence, not a passing platform test suite.
• Manifest PR #13 merged 27 October, pinning candidate ghcr.io/openamrobot/ci-ros2-jazzy@sha256:1653d4bdadce9999a48f73315e2da7aa667d3777579a97b0f1c12146667892d2 originally published from the feature branch.

Integration Gate — remaining work

• Pull-request-safe hosted Docker build path, without GHCR credentials.
• Job-scoped permissions; main-only GHCR publish rule.
• Immutable base-image/action pins; CycloneDDS default.
• Legacy RPLIDAR package excluded; twist_mux added; camera_ros exception supported by actual package.xml dependency.
• New-head Docker build and repository-quality conclusions recorded green.
• Review and approval of this change by code owners.
• DCO status corrected 31 Oct: the current-head DCO check is SUCCESS with output “Commit sign-off was manually approved.” No history rewrite was performed. Mohamed's 29 Oct approval confirms the manual remediation.
• After merge: first automated publish from main, record run ID and new digest, then update the manifest image pin and platform-sw devcontainer to the new canonical digest.

Related work / acceptance boundary

• platform-sw #57 owns actual VS Code devcontainer startup, a passing cold contributor build/test gate and the under-10-minute measurement. Per Alex's 22 October review, those do not block merge of this image PR; they remain open and must not be claimed complete.
• platform-sw issue #50: micro_ros_agent rosdep resolution on Noble; the previous platform build succeeding does not resolve installation coverage.
• manifest #18: source-pinned Jazzy drivers; hardware/Jetson acceptance remains out of scope.
• No real-robot hardware, camera integration, release-image or end-to-end safety claims are made here.

Safety impact

Changes a CI image and its publish/validation permissions only; no runtime motion, E-stop or physical robot behavior is modified. twist_mux being available in the image does not establish that command arbitration is correctly integrated.

AI assistance and provenance

ChatGPT assisted with the workflow/Dockerfile changes and review evidence. GitHub commits carry DCO sign-off; contributor agreement and project review checks remain authoritative.

[cla-assistant]

All committers have signed the CLA.

[cla-assistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[panthera-momagdii]

Direction is good, but H-CI-1 is not complete yet against the work-package acceptance you shared.

Please close these before approval:

1. The new image workflow only runs on push to main / manual dispatch, so this PR has no hosted Docker build validation. Add a PR build-only path (no GHCR push) so a broken Dockerfile cannot merge green.
2. After the publish path is proven, record/pin the produced image digest in the manifest.
3. Use that same pinned image for contributor development through a devcontainer, and show a contributor can open it and reach a working build.
4. Add evidence for the cold pull-request software gate staying within the 10-minute budget.
5. The image currently installs ros-jazzy-rplidar-ros, while the current 2.0 S3 path is moving to sllidar_ros2 from the pinned source manifest. Please either document why the legacy package is still intentionally needed in the baseline image or align the image with the current driver path.

Repository-quality and CLA are green, but they do not validate the container build/publish path itself. Re-request review once the hosted image build and H-CI-1 acceptance evidence are present.

[panthera-momagdii]

Direction is good, but H-CI-1 is not complete yet against the stated acceptance criteria.

Please close these before approval:

1. The image workflow only runs on push to main / manual dispatch, so this PR has no hosted Docker build validation. Add a pull-request build-only path (no GHCR push) so a broken Dockerfile cannot merge green.
2. After the publish path is proven, record and pin the produced image digest in the manifest.
3. Use the same pinned image for contributor development through a devcontainer and show that a contributor can open it and reach a working build.
4. Add evidence that a cold pull-request software gate stays within the 10-minute budget.
5. The image currently installs ros-jazzy-rplidar-ros, while the current 2.0 S3 path is moving to sllidar_ros2 from the pinned source manifest. Either document why the legacy package is intentionally kept in the baseline image or align the image with the current driver path.

Repository-quality and CLA are green, but they do not validate the container build/publish path itself. Re-request review once the hosted image build and H-CI-1 acceptance evidence are present.

[wikki26]

Hi @panthera-momagdii,

I've pushed the latest H-CI-1 updates and wanted to share the validation status against your review feedback.

Completed:

• GitHub-hosted PR Docker image build passes without publishing to GHCR.
• Repository quality and ROS verifier checks pass on commit a1f6193.
• The baseline image has been published to GHCR and pinned by digest in manifest PR Fix image link in README.md #13 and platform devcontainer PR Update org profile README for OpenAMRobot 2.0 #57.
• The platform ROS 2 workspace successfully builds all 7 packages locally using the pinned image.
• Removed the legacy ros-jazzy-rplidar-ros dependency and documented the LiDAR driver policy.

Validation:

• [Docker image build — passed](https://github.com/openAMRobot/.github/actions/runs/38466258795)
• [Repository quality — passed](https://github.com/openAMRobot/.github/actions/runs/38466259003)
• [Manifest PR #13](ci: pin ROS 2 Jazzy candidate image by digest openamrobot-manifest#13)
• [Devcontainer PR #57](ci: add digest-pinned ROS 2 Jazzy devcontainer openamr-platform-sw#57)

Still pending:

• Verification of the automated GHCR publishing path.
• Actual VS Code devcontainer startup validation.
• Cold contributor PR software build/test gate timing.
• sllidar_ros2 source integration and hardware compatibility validation.

Could you review the latest changes and let me know if any further adjustments are needed for H-CI-1 acceptance?

Thanks!

[panthera-momagdii]

Reviewed the current two-file image/workflow change at a1f619307557ad3a0680065127df7e027d47dd83.

Review basis: openAMRobot/.github, branch h-ci-1-baseline-image, head a1f6193, base 539da19. Expected outcome: acknowledge the image-build follow-up and distinguish the evidence now present from the remaining H-CI-1 acceptance work.

The current change addresses the PR-safe build path, immutable ROS base-image pin, and removal of the legacy ros-jazzy-rplidar-ros package from this image. PR events build without logging into or pushing to GHCR; publishing is separated into the intended main/manual-candidate paths. Action references are pinned. The current image-build run passed.

The candidate is also pinned in manifest #13, and platform-sw #57 demonstrates that it can be pulled and build the seven packages. That is useful integration evidence, but #57's subsequent test failure remains open; the successful build does not make its full gate pass.

The remaining H-CI-1 evidence is still:

• a successful run of the automated GHCR publication path, with the resulting digest;
• an actual VS Code devcontainer startup using that pinned image;
• the complete passing cold gate with its measured duration against the agreed under-10-minute target.

Please attach those run/startup records and keep the PR description aligned with the evidence available. The S3 sllidar integration remains a separate follow-up as documented.

No new blocking source finding in this image-build delta. This follow-up acknowledges the progress; the existing H-CI-1 acceptance review remains incomplete until the outstanding evidence is supplied.

ChatGPT-assisted source and hosted-evidence review; no local devcontainer startup or hardware execution.

[BotshareAI]

Good: digest-pinned base, actions pinned by SHA, a PR build without push, legacy rplidar package removed. Before merge:

Split the jobs: a build job with contents: read for pull_request, and a publish job with packages: write only for push to main or workflow_dispatch.
The publish condition hardcodes refs/heads/h-ci-1-baseline-image. That branch disappears after merge. Allow dispatch from main only.
Add ros-jazzy-twist-mux (command arbitration, ui #31). Remove ros-jazzy-camera-ros unless a package depends on it; the base camera is the Gemini 336L on the Orbbec driver.
Keep rmw_cyclonedds_cpp as default; it will be recorded as the project RMW in the register.
Provenance: the digest pinned in manifest #13 and platform-sw #57 (sha256:1653d4…) was published from the feature branch. After merge, publish from main, record the run ID and digest, then update #13 and #57 to it.

Devcontainer start-up and the 10-minute cold gate stay with platform-sw #57 and do not block this image PR. The branch is also 8 commits behind main.

[wikki26]

H-CI-1 update — technical review requested on head 19266a51a84210b01e4486ac2cdb637bbb5cb8b7.

• Merged current main into the branch; PR is 0 commits behind main and changes only .github/workflows/ci-image.yml and containers/ci/Dockerfile.
• Split PR-only read-only image validation from trusted main-only GHCR publishing; removed feature-branch dispatch. Added ros-jazzy-twist-mux; preserved rmw_cyclonedds_cpp.
• Retained ros-jazzy-camera-ros under the review's exception because the existing openamrobot_perception/package.xml explicitly has <exec_depend>camera_ros</exec_depend> and its IMX708 real-robot launch uses that package. The 2.0 Orbbec driver remains separate.
• New Docker image validation passed; the Publish CI image job skipped for the PR as intended.
• Repository quality, checker tests and ROS smoke passed.
• Separate DCO blocker: a pre-existing 13 Oct merge commit 574dfc8 lacks a sign-off. I have preserved published history rather than force-rewriting this branch. The DCO check remains action-required and needs author-led remediation.

Per Alex's 22 Oct guidance, the next canonical GHCR publish should happen after approval/merge from main. Record the new run ID and digest, then update the manifest pin (original #13 already merged) and platform-sw devcontainer #57. Actual VS Code startup and the <10-minute cold gate remain #57 acceptance work, not blockers for this PR.

@BotshareAI @panthera-momagdii: please re-review the code and publishing permission changes on this head. Thanks.

[wikki26]

H-CI-1 downstream evidence update (29 Oct 2026): image PR #41 is still at 19266a5 with the corrected PR/main publish boundary and passing hosted image build. Platform-sw devcontainer PR #57 now has new hosted evidence on its existing immutable candidate digest:

• Cold contributor gate run 40887032748: PASS, 8 workspace packages, 169 tests / 0 errors / 0 failures / 6 tracked skips; JUnit confirms 163 executed, mandatory navigation suites included. Hosted job time 89 s (13:59:20–14:00:49 UTC), under the 10-minute target; artifact.
• Dev Container CLI startup run 40887032744: PASS, devcontainer up, actual postCreateCommand, and devcontainer exec ROS smoke against .devcontainer/devcontainer.json; 56 s up/exec, 66 s hosted job; artifact. Graphical VS Code extension startup on a contributor workstation is still unverified.
• The source-lint and cross-repository message-dependency corrections are in passing platform-sw #101; Update org profile README for OpenAMRobot 2.0 #57 temporarily includes that branch as a merge parent and must land after #101.

This does not establish canonical main image provenance yet. To finish the image chain, please review/merge #41 after code-owner approval, then trigger its controlled publisher on main, record the new digest and replace the old sha256:1653d4… in the manifest and #57. No image was published from an unapproved branch and no hardware tests are claimed.

[panthera-momagdii]

Reviewed current head 19266a51a84210b01e4486ac2cdb637bbb5cb8b7. The workflow now separates read-only PR validation from main-only GHCR publication with scoped permissions; action and base-image references are immutable; twist_mux is included; legacy rplidar_ros is excluded; and retaining camera_ros is supported by the current platform package/launch dependency. The image build and repository-quality runs pass. The current DCO check is also green through recorded manual approval. Approved for the baseline image change. After merge, publish from main, record the new digest, then update the manifest/devcontainer pins as already documented. This does not claim hardware or full H-CI-1 acceptance.