ci(workflows): bump all action versions to latest majors

.claude/settings.local.json

@@ -0,0 +1,45 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(git -C /Users/rroche/Work/Dronecode/PX4-Autopilot-ci-orchestrator commit -S -s -m \"$\\(cat <<''EOF''\nci-orchestrator: cache emscripten SDK in failsafe-sim job\n\nCache the _emscripten_sdk directory keyed on version 4.0.15 so\nsubsequent runs skip the git clone and install steps \\(~30s savings\non cache hit\\). The build step sources emsdk_env.sh unchanged.\nEOF\n\\)\")",
+      "WebFetch(domain:gist.github.com)",
+      "Bash(git -C /Users/rroche/Work/Dronecode/PX4-Autopilot-ci-orchestrator commit -S -s -m \"$\\(cat <<''EOF''\nci-orchestrator: upgrade SITL and ROS integration runners to 8cpu\n\nROS Integration Tests \\(31m\\) is the critical path bottleneck,\nfollowed by SITL Tests tailsitter \\(20m\\). Both spend significant\ntime compiling dependencies \\(xrce-dds, ROS2 libs, gazebo\\). Upgrade\nfrom 4cpu to 8cpu to parallelize compilation and reduce wall-clock.\nEOF\n\\)\")",
+      "Bash(git -C /Users/rroche/Work/Dronecode/PX4-Autopilot-ci-orchestrator commit -S -s -m \"$\\(cat <<''EOF''\nci-orchestrator: fix flash analysis comment alignment\n\nRemove extra indentation from code fences and bloaty output inside\nthe PR comment body so the column alignment renders correctly in\nGitHub markdown.\nEOF\n\\)\")",
+      "Bash(docker run:*)",
+      "Bash(docker rm:*)",
+      "Bash(git -C /Users/rroche/Work/Dronecode/PX4-Autopilot-ci-orchestrator commit -S -s -m \"$\\(cat <<''EOF''\nci-orchestrator: increase SITL test speed factor to 20x\n\nBump simulation speed factor from 10x to 20x for MAVSDK SITL tests.\nWith the 8cpu runners this should be sustainable and roughly halve\nthe 18min test execution phase.\nEOF\n\\)\")",
+      "Bash(docker exec:*)",
+      "Bash(git -C /Users/rroche/Work/Dronecode/PX4-Autopilot-ci-orchestrator commit -S -s -m \"$\\(cat <<''EOF''\nci-orchestrator: build Gazebo plugins in cache seed job\n\nAdd Gazebo Classic plugin build to the build-sitl cache seed job so\ndownstream SITL test jobs get ccache hits for both PX4 firmware and\nGazebo objects. Bump ccache max_size from 250M to 400M to fit both.\nEOF\n\\)\")",
+      "Bash(git -C /Users/rroche/Work/Dronecode/PX4-Autopilot-ci-orchestrator commit -S -s -m \"$\\(cat <<''EOF''\ndocs: update CI orchestrator docs for 4-tier architecture and caching\n\nUpdate documentation to reflect recent changes:\n- 5-tier to 4-tier restructure \\(old T3 merged into T2\\)\n- Add comprehensive caching strategy section covering ccache key\n  patterns, scopes, sizes, and the cache seed pattern\n- Document Emscripten SDK cache for failsafe-sim\n- Update runner types \\(8cpu for SITL/ROS, 16cpu for clang-tidy\\)\n- SITL tests now run at 20x speed factor\n- Remove CI summary job references\n- Update tier numbering throughout troubleshooting and best practices\nEOF\n\\)\")",
+      "Bash(docker build:*)",
+      "WebFetch(domain:raw.githubusercontent.com)",
+      "Bash(docker system prune:*)",
+      "WebSearch",
+      "WebFetch(domain:hub.docker.com)",
+      "WebFetch(domain:docs.px4.io)",
+      "WebFetch(domain:github.com)",
+      "Bash(find:*)",
+      "Bash(docker search:*)",
+      "Bash(docker images:*)",
+      "Bash(gh pr create --draft --title \"packaging: add PX4 SITL .deb package\" --body \"$\\(cat <<''EOF''\nSingle .deb package for PX4 SITL with Gazebo Harmonic resources. Installs to /opt/px4-sitl with a px4-sitl wrapper script symlinked to /usr/bin.\n\nChanges:\n- cmake/package.cmake: CPack config for px4-sitl .deb with minimal Gazebo runtime deps\n- platforms/posix/CMakeLists.txt: install targets for Gazebo models, worlds, plugins\n- Tools/packaging/px4-sitl.sh: launcher script \\(XDG dirs, gz_env.sh generation, dartsim symlink fix\\)\n- Tools/packaging/postinst, postrm: create/remove /usr/bin/px4-sitl symlink\n- .github/workflows/build_deb_package.yml: CI to build and validate the .deb\n- docs/en/packaging/px4_sitl_deb.md: usage and build docs\n\nTested with PX4_SIM_MODEL=gz_x500 and sihsim_quadx in Ubuntu 24.04 container.\nEOF\n\\)\")",
+      "Bash(gh gist create:*)",
+      "Bash(git commit -S -s -m \"$\\(cat <<''EOF''\npackaging: exclude legacy install rules from .deb builds\n\nGate legacy install rules behind if\\(NOT DPKG_PROGRAM\\) so they only\nrun for tarball/ROS workflows. Gate .deb install rules behind\nif\\(DPKG_PROGRAM\\) so they only run when building .deb packages.\n\nWithout this, both rule sets execute during .deb builds, triplicating\nfiles and pulling in the entire source tree \\(integrationtests, launch,\nTools, CMakeLists.txt, gazebo-classic models\\) into the package.\nEOF\n\\)\")",
+      "Bash(gh issue create:*)",
+      "Bash(git commit -S -s --amend -m \"$\\(cat <<''EOF''\npackaging: exclude legacy install rules from .deb builds\n\nMove find_program\\(DPKG_PROGRAM dpkg\\) into platforms/posix/CMakeLists.txt\nso it is available before the install rules are processed \\(package.cmake\nruns later\\). Gate both the top-level posix install block and the\nSITL-specific legacy install rules behind if\\(NOT DPKG_PROGRAM\\) so they\nonly run for tarball/ROS workflows.\n\nGate .deb install rules behind if\\(DPKG_PROGRAM\\) so they only run when\nbuilding .deb packages. Mark Gazebo resource installs as OPTIONAL so\nCPack does not fail when the gz submodule is not checked out.\n\nWithout this, both rule sets execute during .deb builds, triplicating\nfiles and pulling in the entire source tree \\(integrationtests, launch,\nTools, CMakeLists.txt, gazebo-classic models\\) into the package.\n\nSigned-off-by: Ramon Roche <mrpollo@gmail.com>\nEOF\n\\)\")",
+      "Bash(git commit:*)",
+      "Bash(kill:*)",
+      "WebFetch(domain:cmake.org)",
+      "Bash(gh run watch:*)",
+      "Bash(gh pr list:*)",
+      "Bash(gh pr checks:*)",
+      "WebFetch(domain:discuss.px4.io)",
+      "Bash(gh issue list:*)",
+      "Bash(pkill:*)",
+      "WebFetch(domain:runs-on.com)",
+      "Bash(gh release:*)",
+      "Bash(docker manifest:*)",
+      "Bash(gh pr:*)",
+      "Bash(GIT_EDITOR=true git cherry-pick --continue)"
+    ]
+  }
+}

.github/actions/save-ccache/action.yml

@@ -16,7 +16,7 @@ runs:
 
     - name: Cache - Save ccache
       if: always()
-      uses: actions/cache/save@v4
+      uses: actions/cache/save@v5
       with:
         path: ~/.ccache
         key: ${{ inputs.cache-primary-key }}

.github/actions/setup-ccache/action.yml

@@ -33,7 +33,7 @@ runs:
 
     - name: Cache - Restore ccache
       id: restore
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@v5
       with:
         path: ~/.ccache
         key: ${{ inputs.cache-key-prefix }}-${{ github.ref_name }}-${{ github.sha }}

.github/workflows/build_all_targets.yml

@@ -72,10 +72,10 @@ jobs:
       timestamp: ${{ steps.set-timestamp.outputs.timestamp }}
       branchname: ${{ steps.set-branch.outputs.branchname }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Cache Python pip
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/.cache/pip
           key: ${{ runner.os }}-pip-${{ hashFiles('**./Tools/setup/requirements.txt') }}
@@ -131,11 +131,10 @@ jobs:
         password: ${{ secrets.GITHUB_TOKEN }}
     steps:
       - uses: runs-on/action@v2
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
-
-      - name: Git ownership workaround
+      - name: Configure Git Safe Directory
         run: git config --system --add safe.directory '*'
 
       # ccache key breakdown:
@@ -144,7 +143,7 @@ jobs:
       # ccache-<linux>-<x64>-<nuttx-0>-
       - name: Cache Restore from Key
         id: cc_restore
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v5
         with:
           path: ~/.ccache
           key: ${{ format('ccache-{0}-{1}-{2}', runner.os, matrix.runner, matrix.group) }}
@@ -176,7 +175,7 @@ jobs:
           ./Tools/ci/package_build_artifacts.sh
 
       - name: Upload Build Artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: px4_${{matrix.group}}_build_artifacts
           path: artifacts/
@@ -189,7 +188,7 @@ jobs:
 
       - name: Cache Save
         if: always()
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@v5
         with:
           path: ~/.ccache
           key: ${{ steps.cc_restore.outputs.cache-primary-key }}
@@ -211,7 +210,7 @@ jobs:
       uploadlocation: ${{ steps.upload-location.outputs.uploadlocation }}
     steps:
       - name: Download Artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           path: artifacts/
           merge-multiple: true

.github/workflows/build_deb_package.yml

@@ -42,9 +42,8 @@ jobs:
       - uses: runs-on/action@v2
       - uses: actions/checkout@v6
         with:
-          fetch-tags: true
-          submodules: false
           fetch-depth: 0
+          fetch-tags: true
 
       - name: Set PX4 version
         id: version
@@ -138,11 +137,10 @@ jobs:
       - uses: runs-on/action@v2
       - uses: actions/checkout@v6
         with:
-          submodules: false
           fetch-depth: 1
 
       - name: Download Noble .deb artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: px4-sitl-debs-${{ matrix.target }}-noble-${{ matrix.arch }}
           path: docker-context
@@ -157,13 +155,13 @@ jobs:
           echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           driver: docker-container
           platforms: ${{ matrix.platform }}
 
       - name: Build and push container image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: docker-context
           file: Tools/packaging/${{ matrix.dockerfile }}

.github/workflows/checks.yml

@@ -37,11 +37,9 @@ jobs:
         ]
     steps:
       - uses: runs-on/action@v2
-
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 1
-
       - name: Configure Git Safe Directory
         run: git config --system --add safe.directory '*'
 
@@ -57,11 +55,9 @@ jobs:
       image: ghcr.io/px4/px4-dev:v1.17.0-rc2
     steps:
       - uses: runs-on/action@v2
-
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 1
-
       - name: Configure Git Safe Directory
         run: git config --system --add safe.directory '*'
 

.github/workflows/clang-tidy.yml

@@ -30,7 +30,6 @@ jobs:
       with:
         fetch-depth: 0
         fetch-tags: true
-
     - name: Configure Git Safe Directory
       run: git config --system --add safe.directory '*'
 

.github/workflows/commit_checks.yml

@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           sparse-checkout: Tools/ci
           fetch-depth: 1
@@ -56,7 +56,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           sparse-checkout: Tools/ci
           fetch-depth: 1
@@ -102,7 +102,7 @@ jobs:
     steps:
       - name: Checkout
         if: env.IS_FORK == 'false'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           sparse-checkout: Tools/ci
           fetch-depth: 1

.github/workflows/compile_macos.yml

@@ -21,22 +21,22 @@ jobs:
     runs-on: macos-latest
     steps:
     - name: install Python 3.10
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
       with:
         python-version: "3.10"
 
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
 
     - name: Cache - Restore Homebrew Packages
-      uses: actions/cache@v4
+      uses: actions/cache@v5
       with:
         path: ~/Library/Caches/Homebrew/downloads
         key: macos-homebrew-${{ runner.arch }}-${{ hashFiles('Tools/setup/macos.sh') }}
         restore-keys: |
           macos-homebrew-${{ runner.arch }}-
 
     - name: Cache - Restore pip Packages
-      uses: actions/cache@v4
+      uses: actions/cache@v5
       with:
         path: ~/Library/Caches/pip
         key: macos-pip-${{ runner.arch }}-${{ hashFiles('Tools/setup/requirements.txt') }}

.github/workflows/compile_ubuntu.yml

@@ -48,7 +48,7 @@ jobs:
           apt update && apt install git -y
           git config --global --add safe.directory $(realpath .)
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Use AWS regional apt mirror
         if: startsWith(runner.name, 'runs-on--')

.github/workflows/dev_container.yml

@@ -51,12 +51,11 @@ jobs:
       meta_labels: ${{ steps.meta.outputs.labels }}
     steps:
       - uses: runs-on/action@v2
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           ref: ${{ github.event.inputs.build_ref || github.ref }}
-          fetch-tags: true
-          submodules: false
           fetch-depth: 0
+          fetch-tags: true
 
       # If manual dispatch, take the user‐provided input
       - name: Set PX4 Tag Version
@@ -96,12 +95,11 @@ jobs:
     runs-on: [runs-on,"runner=4cpu-linux-${{ matrix.runner }}","image=ubuntu24-full-${{ matrix.runner }}","run-id=${{ github.run_id }}",extras=s3-cache,spot=false]
     steps:
       - uses: runs-on/action@v2
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           ref: ${{ github.event.inputs.build_ref || github.ref }}
-          fetch-tags: true
-          submodules: false
           fetch-depth: 0
+          fetch-tags: true
 
       - name: Login to Docker Hub
         uses: docker/login-action@v4
@@ -153,12 +151,11 @@ jobs:
       (startsWith(github.ref, 'refs/tags/') || (github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_to_registry == 'true'))
     steps:
       - uses: runs-on/action@v2
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           ref: ${{ github.event.inputs.build_ref || github.ref }}
-          fetch-tags: true
-          submodules: false
           fetch-depth: 0
+          fetch-tags: true
 
       - name: Login to Docker Hub
         uses: docker/login-action@v4