chore: adopt standard ROS 2 build-farm best practices

[TSC21]

Description

Brings px4_msgs up to the standard practices expected of ROS 2 packages on the build farm, and continues the Debian packaging work from #65 (cherry-picked, with @mrpollo's authorship preserved). No auto-generated *.msg / *.srv files are touched. History is kept to a small set of logical commits.

Packaging & build

• package.xml: version 1.17.0 (matches the PX4 release line / v1.17.0 tag, was a stale 2.0.1), url tags, SPDX BSD-3-Clause, ament_lint_auto test dep, element order fixed to the package-format-3 schema, active maintainers listed, and the unused ros_environment dependency dropped (it doesn't resolve on newer distros).
• CMakeLists.txt: CMake 3.8, C++17, rosidl_default_generators found before the interface deps (required by newer rosidl on Rolling/Kilted), and ament_lint_auto enabled under BUILD_TESTING (copyright linter skipped — generated definitions carry no headers).

Build-farm requirements

• CHANGELOG.rst in the catkin_pkg/bloom RST format, tracking the PX4 release line.
• scripts/generate_changelog.sh — regenerates CHANGELOG.rst from the tag history (dates from tags, contributors from git authors, summary from the msg/srv diff; --check/--in-place).
• scripts/generate_release_notes.sh — per-release notes from the message/service diff (added/removed/changed with field-level detail); wired into the release workflow.
• QUALITY_DECLARATION.md (REP-2004, Quality Level 3).

Community health

• CODE_OF_CONDUCT.md, SECURITY.md, GitHub issue forms + PR template, CODEOWNERS; refreshed README.md and CONTRIBUTING.md.

Debian packaging (continued from #65)

• Builder container parametrized by ROS_DISTRO, bloom-generate rosdebian + rosdep install, dropped the unneeded rmw_zenoh_cpp dep, CI-friendly (no interactive -it).
• Package (.deb) workflow builds .debs for every supported distro on amd64 + arm64 and attaches them to releases.

Release automation (full pipeline)

• Create GitHub release: publishes a release from upstream PX4 version bumps (vX.Y.Z tag or release/** bump), with notes from the message diff.
• The published release cascades into Package (.deb) and Release to rosdistro (bloom) (opens the ros/rosdistro PR via bloom-release).
• One-time maintainer setup (release repo + BLOOM_GITHUB_TOKEN / RELEASE_TOKEN secrets) is documented in CONTRIBUTING.md; workflows no-op gracefully until configured.

CI matrix

Standard ROS build-farm tooling (ros-tooling/setup-ros + action-ros-ci), off the EOL Foxy/Focal jobs:

• Ubuntu: Humble, Jazzy, Kilted, Rolling. setup-ros/action-ros-ci are wrapped with retries (3 attempts) plus an apt-lock prep step, so transient infra failures (ros-apt-source GitHub-API 404s, apt mirror hiccups, randomly incomplete installs) self-heal instead of needing manual re-runs.
• Windows: Jazzy (Python 3.11). Not retry-wrapped — wretry injects the GitHub context as an env var that exceeds the Windows length limit and breaks setup-ros. Humble/Rolling aren't built on Windows (their binaries need Python 3.8/3.12, incompatible with the 3.11 ros-tooling requires).
• macOS: Jazzy on Apple Silicon + Intel via RoboStack/conda-forge (ROS 2 no longer ships macOS binaries). ament_xmllint is skipped there (conda-forge libxml2 has no HTTP support to fetch the schema; it still runs on Ubuntu).
• Rolling is Ubuntu-only (no Windows/macOS ROS 2 packaging channel). Push/pull_request runs are deduplicated.

Linting (pre-commit)

A pre-commit job + .pre-commit-config.yaml covering: whitespace/EOL hygiene, shebang & executable-bit checks, XML/YAML/JSON syntax, GitHub Actions + Dependabot schema validation, shellcheck, codespell, markdownlint, and a build-farm gate that validates package.xml with catkin_pkg (the parser bloom uses) so a manifest that would fail to release is caught locally.

Related work

• Continues / supersedes ROS Package tooling and publishing #65.
• GitHub Releases v1.15.0…v1.17.0 were created (previously only tags existed), each with a detailed message-definition changelog.

Type of change

• Build / CI / packaging change
• Documentation update

Checklist

• My changes do not edit the auto-generated *.msg / *.srv definitions.
• I have read the CONTRIBUTING guide.
• I have updated the CHANGELOG.rst.
• actionlint + pre-commit pass locally; package.xml validates with catkin_pkg and the format-3 XSD.
• CI builds/tests on Ubuntu (Humble/Jazzy/Kilted/Rolling), Windows (Jazzy), macOS (Jazzy, arm64 + Intel).
• Commits are signed off (DCO) and follow Conventional Commits.

[TSC21]

@tfoote FYI

[beniaminopozzan]

Thanks for the PR @TSC21 !

while you fix the CI failure, could you also add ROS Lyrical to the target list please?

[TSC21]

Thanks for the PR @TSC21 !

while you fix the CI failure, could you also add ROS Lyrical to the target list please?

100%

[TSC21]

Hey @mrpollo @beniaminopozzan! The release automation is all wired up here, but it needs a couple of one-time things from a maintainer before it can actually push to the build farm:

1. Seed the bloom tracks for the current distros (humble, jazzy, kilted, rolling, lyrical) - basically one interactive bloom-release --new-track px4_msgs per distro. I archived the old px4_msgs2-release, so everything goes through px4_msgs-release now. That first run also opens the ros/rosdistro PR that adds the missing release: block.
2. Add two repo secrets: BLOOM_GITHUB_TOKEN (to push to px4_msgs-release + open the rosdistro PR) and RELEASE_TOKEN (a PAT so a published release actually triggers the downstream workflows).

@mrpollo, since you're the Dronecode maintainer you're probably the right person to run the seeding and add the secrets - happy to hand you the exact commands per distro. More details in CONTRIBUTING.md if needed. Thanks!

[TSC21]

@mrpollo @beniaminopozzan this should be good to merge. Just note my comment above. Thank you!

[beniaminopozzan]

Thanks @TSC21 !

I have a couple of comments on supported ROS version (Lyrical in particular) and che package build script.

---

Also, github action are flagging the usage of actions with node.js 20:

Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/checkout@v4, hendrikmuhs/ccache-action@v1, Wandalen/wretry.action@v3.8.0_js_action. Actions will be forced to run with Node.js 24 by default starting June 16th, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

[TSC21]

Thanks for the thorough review @beniaminopozzan! Went through all of it:

• Bumped checkout, setup-python, cache and ccache-action to their Node 24 versions to clear that deprecation warning. wretry and pre-commit don't have a Node 24 release yet, but GitHub will run those on Node 24 automatically once it flips the default.
• Added Lyrical to the .deb and bloom matrices (it already had a build/test job).
• Fixed the builder image (build-essential + cmake) and made packaging skip the tests.
• Answered your release questions inline and dropped a note in the README.

All pushed, let me know what you think!

[beniaminopozzan]

build dep works now, thanks!

---

Regarding the future changes (as kilted build is failing) could you not force-push them please? It makes harder to track the changes between reviews, thank 🙏🏻

[TSC21]

Regarding the future changes (as kilted build is failing) could you not force-push them please? It makes harder to track the changes between reviews, thank 🙏🏻

Yes, but in this case this is just flaky stuff happening in CI, not really something worth reviewing. The purpose of the force push is to keep the commit history clean.

[TSC21]

@beniaminopozzan this should be ready to go now

[beniaminopozzan]

Amazing, thanks @TSC21