fix(boards): remove default SYS_AUTOSTART from generic autopilot boards

These are generic flight controller boards (not drone-specific
products), so they should not come with a pre-selected airframe like
every other PX4 board. Drop the SYS_AUTOSTART default, matching the
convention used across the rest of the tree.

Drone-specific products (bitcraze/crazyflie, atl/mantis-edu) retain
their default airframe.

.clang-tidy

@@ -105,6 +105,79 @@ Checks:          '*,
                   -readability-redundant-declaration,
                   -readability-static-accessed-through-instance,
                   -readability-static-definition-in-anonymous-namespace,
+                  -altera-struct-pack-align,
+                  -bugprone-easily-swappable-parameters,
+                  -concurrency-mt-unsafe,
+                  -cppcoreguidelines-avoid-const-or-ref-data-members,
+                  -cppcoreguidelines-macro-usage,
+                  -cppcoreguidelines-non-private-member-variables-in-classes,
+                  -hicpp-uppercase-literal-suffix,
+                  -llvm-qualified-auto,
+                  -misc-non-private-member-variables-in-classes,
+                  -misc-use-anonymous-namespace,
+                  -modernize-concat-nested-namespaces,
+                  -readability-const-return-type,
+                  -readability-identifier-length,
+                  -readability-isolate-declaration,
+                  -readability-qualified-auto,
+                  -readability-redundant-access-specifiers,
+                  -cppcoreguidelines-avoid-do-while,
+                  -misc-include-cleaner,
+                  -misc-const-correctness,
+                  -llvm-else-after-return,
+                  -readability-function-cognitive-complexity,
+                  -cppcoreguidelines-init-variables,
+                  -bugprone-reserved-identifier,
+                  -cert-dcl37-c,
+                  -cert-dcl51-cpp,
+                  -modernize-use-nodiscard,
+                  -misc-confusable-identifiers,
+                  -cert-err33-c,
+                  -readability-redundant-inline-specifier,
+                  -readability-uppercase-literal-suffix,
+                  -bugprone-narrowing-conversions,
+                  -cppcoreguidelines-narrowing-conversions,
+                  -bugprone-switch-missing-default-case,
+                  -cppcoreguidelines-avoid-goto,
+                  -hicpp-avoid-goto,
+                  -bugprone-branch-clone,
+                  -performance-enum-size,
+                  -readability-avoid-nested-conditional-operator,
+                  -cppcoreguidelines-prefer-member-initializer,
+                  -cppcoreguidelines-explicit-virtual-functions,
+                  -readability-convert-member-functions-to-static,
+                  -readability-make-member-function-const,
+                  -bugprone-implicit-widening-of-multiplication-result,
+                  -bugprone-multi-level-implicit-pointer-conversion,
+                  -bugprone-signed-char-misuse,
+                  -cppcoreguidelines-avoid-non-const-global-variables,
+                  -cppcoreguidelines-use-default-member-init,
+                  -hicpp-multiway-paths-covered,
+                  -hicpp-named-parameter,
+                  -misc-header-include-cycle,
+                  -misc-no-recursion,
+                  -performance-no-int-to-ptr,
+                  -readability-avoid-return-with-void-value,
+                  -readability-avoid-unconditional-preprocessor-if,
+                  -readability-delete-null-pointer,
+                  -readability-redundant-casting,
+                  -readability-redundant-member-init,
+                  -readability-reference-to-constructed-temporary,
+                  -readability-simplify-boolean-expr,
+                  -cert-msc32-c,
+                  -cert-msc33-c,
+                  -cert-msc51-cpp,
+                  -cert-str34-c,
+                  -cppcoreguidelines-macro-to-enum,
+                  -modernize-macro-to-enum,
+                  -abseil-string-find-str-contains,
+                  -bugprone-suspicious-include,
+                  -clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling,
+                  -clang-analyzer-optin.core.EnumCastOutOfRange,
+                  -modernize-type-traits,
+                  -misc-definitions-in-headers,
+                  -bugprone-casting-through-void,
+                  -readability-redundant-string-init,
                  '
 WarningsAsErrors: '*'
 CheckOptions:

.claude/settings.local.json

@@ -0,0 +1,45 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(git -C /Users/rroche/Work/Dronecode/PX4-Autopilot-ci-orchestrator commit -S -s -m \"$\\(cat <<''EOF''\nci-orchestrator: cache emscripten SDK in failsafe-sim job\n\nCache the _emscripten_sdk directory keyed on version 4.0.15 so\nsubsequent runs skip the git clone and install steps \\(~30s savings\non cache hit\\). The build step sources emsdk_env.sh unchanged.\nEOF\n\\)\")",
+      "WebFetch(domain:gist.github.com)",
+      "Bash(git -C /Users/rroche/Work/Dronecode/PX4-Autopilot-ci-orchestrator commit -S -s -m \"$\\(cat <<''EOF''\nci-orchestrator: upgrade SITL and ROS integration runners to 8cpu\n\nROS Integration Tests \\(31m\\) is the critical path bottleneck,\nfollowed by SITL Tests tailsitter \\(20m\\). Both spend significant\ntime compiling dependencies \\(xrce-dds, ROS2 libs, gazebo\\). Upgrade\nfrom 4cpu to 8cpu to parallelize compilation and reduce wall-clock.\nEOF\n\\)\")",
+      "Bash(git -C /Users/rroche/Work/Dronecode/PX4-Autopilot-ci-orchestrator commit -S -s -m \"$\\(cat <<''EOF''\nci-orchestrator: fix flash analysis comment alignment\n\nRemove extra indentation from code fences and bloaty output inside\nthe PR comment body so the column alignment renders correctly in\nGitHub markdown.\nEOF\n\\)\")",
+      "Bash(docker run:*)",
+      "Bash(docker rm:*)",
+      "Bash(git -C /Users/rroche/Work/Dronecode/PX4-Autopilot-ci-orchestrator commit -S -s -m \"$\\(cat <<''EOF''\nci-orchestrator: increase SITL test speed factor to 20x\n\nBump simulation speed factor from 10x to 20x for MAVSDK SITL tests.\nWith the 8cpu runners this should be sustainable and roughly halve\nthe 18min test execution phase.\nEOF\n\\)\")",
+      "Bash(docker exec:*)",
+      "Bash(git -C /Users/rroche/Work/Dronecode/PX4-Autopilot-ci-orchestrator commit -S -s -m \"$\\(cat <<''EOF''\nci-orchestrator: build Gazebo plugins in cache seed job\n\nAdd Gazebo Classic plugin build to the build-sitl cache seed job so\ndownstream SITL test jobs get ccache hits for both PX4 firmware and\nGazebo objects. Bump ccache max_size from 250M to 400M to fit both.\nEOF\n\\)\")",
+      "Bash(git -C /Users/rroche/Work/Dronecode/PX4-Autopilot-ci-orchestrator commit -S -s -m \"$\\(cat <<''EOF''\ndocs: update CI orchestrator docs for 4-tier architecture and caching\n\nUpdate documentation to reflect recent changes:\n- 5-tier to 4-tier restructure \\(old T3 merged into T2\\)\n- Add comprehensive caching strategy section covering ccache key\n  patterns, scopes, sizes, and the cache seed pattern\n- Document Emscripten SDK cache for failsafe-sim\n- Update runner types \\(8cpu for SITL/ROS, 16cpu for clang-tidy\\)\n- SITL tests now run at 20x speed factor\n- Remove CI summary job references\n- Update tier numbering throughout troubleshooting and best practices\nEOF\n\\)\")",
+      "Bash(docker build:*)",
+      "WebFetch(domain:raw.githubusercontent.com)",
+      "Bash(docker system prune:*)",
+      "WebSearch",
+      "WebFetch(domain:hub.docker.com)",
+      "WebFetch(domain:docs.px4.io)",
+      "WebFetch(domain:github.com)",
+      "Bash(find:*)",
+      "Bash(docker search:*)",
+      "Bash(docker images:*)",
+      "Bash(gh pr create --draft --title \"packaging: add PX4 SITL .deb package\" --body \"$\\(cat <<''EOF''\nSingle .deb package for PX4 SITL with Gazebo Harmonic resources. Installs to /opt/px4-sitl with a px4-sitl wrapper script symlinked to /usr/bin.\n\nChanges:\n- cmake/package.cmake: CPack config for px4-sitl .deb with minimal Gazebo runtime deps\n- platforms/posix/CMakeLists.txt: install targets for Gazebo models, worlds, plugins\n- Tools/packaging/px4-sitl.sh: launcher script \\(XDG dirs, gz_env.sh generation, dartsim symlink fix\\)\n- Tools/packaging/postinst, postrm: create/remove /usr/bin/px4-sitl symlink\n- .github/workflows/build_deb_package.yml: CI to build and validate the .deb\n- docs/en/packaging/px4_sitl_deb.md: usage and build docs\n\nTested with PX4_SIM_MODEL=gz_x500 and sihsim_quadx in Ubuntu 24.04 container.\nEOF\n\\)\")",
+      "Bash(gh gist create:*)",
+      "Bash(git commit -S -s -m \"$\\(cat <<''EOF''\npackaging: exclude legacy install rules from .deb builds\n\nGate legacy install rules behind if\\(NOT DPKG_PROGRAM\\) so they only\nrun for tarball/ROS workflows. Gate .deb install rules behind\nif\\(DPKG_PROGRAM\\) so they only run when building .deb packages.\n\nWithout this, both rule sets execute during .deb builds, triplicating\nfiles and pulling in the entire source tree \\(integrationtests, launch,\nTools, CMakeLists.txt, gazebo-classic models\\) into the package.\nEOF\n\\)\")",
+      "Bash(gh issue create:*)",
+      "Bash(git commit -S -s --amend -m \"$\\(cat <<''EOF''\npackaging: exclude legacy install rules from .deb builds\n\nMove find_program\\(DPKG_PROGRAM dpkg\\) into platforms/posix/CMakeLists.txt\nso it is available before the install rules are processed \\(package.cmake\nruns later\\). Gate both the top-level posix install block and the\nSITL-specific legacy install rules behind if\\(NOT DPKG_PROGRAM\\) so they\nonly run for tarball/ROS workflows.\n\nGate .deb install rules behind if\\(DPKG_PROGRAM\\) so they only run when\nbuilding .deb packages. Mark Gazebo resource installs as OPTIONAL so\nCPack does not fail when the gz submodule is not checked out.\n\nWithout this, both rule sets execute during .deb builds, triplicating\nfiles and pulling in the entire source tree \\(integrationtests, launch,\nTools, CMakeLists.txt, gazebo-classic models\\) into the package.\n\nSigned-off-by: Ramon Roche <mrpollo@gmail.com>\nEOF\n\\)\")",
+      "Bash(git commit:*)",
+      "Bash(kill:*)",
+      "WebFetch(domain:cmake.org)",
+      "Bash(gh run watch:*)",
+      "Bash(gh pr list:*)",
+      "Bash(gh pr checks:*)",
+      "WebFetch(domain:discuss.px4.io)",
+      "Bash(gh issue list:*)",
+      "Bash(pkill:*)",
+      "WebFetch(domain:runs-on.com)",
+      "Bash(gh release:*)",
+      "Bash(docker manifest:*)",
+      "Bash(gh pr:*)",
+      "Bash(GIT_EDITOR=true git cherry-pick --continue)"
+    ]
+  }
+}

.claude/skills/commit/SKILL.md

@@ -0,0 +1,28 @@
+---
+name: commit
+description: Create a conventional commit for PX4 changes
+disable-model-invocation: true
+argument-hint: "[optional: description of changes]"
+allowed-tools: Bash, Read, Glob, Grep
+---
+
+# PX4 Conventional Commit
+
+Create a git commit: `type(scope): description`
+
+**NEVER add Co-Authored-By lines. No Claude attribution in commits.**
+
+Follow [CONTRIBUTING.md](../../CONTRIBUTING.md) for full project conventions.
+
+## Steps
+
+1. **Read [CONTRIBUTING.md](../../CONTRIBUTING.md)** for commit message format, types, scopes, and conventions.
+2. Check branch (`git branch --show-current`). If on `main`, create a feature branch. Use `<username>/<description>` format where `<username>` comes from `gh api user --jq .login`. If unavailable, just use `<description>`.
+3. Run `git status` and `git diff --staged`. If nothing staged, ask what to stage.
+4. Follow the commit message convention from CONTRIBUTING.md: pick the correct **type** and **scope**, write a concise imperative description.
+5. Body (if needed): explain **why**, not what.
+6. Run `make format` or `./Tools/astyle/fix_code_style.sh <file>` on changed C/C++ files before committing.
+7. Check if GPG signing is available: `git config --get user.signingkey`. If set, use `git commit -S -s`. Otherwise, use `git commit -s`.
+8. Stage and commit. No `Co-Authored-By`.
+
+If the user provided arguments, use them as context: $ARGUMENTS

.claude/skills/pr/SKILL.md

@@ -0,0 +1,24 @@
+---
+name: pr
+description: Create a pull request with conventional commit title and description
+disable-model-invocation: true
+argument-hint: "[optional: target branch or description]"
+allowed-tools: Bash, Read, Glob, Grep
+---
+
+# PX4 Pull Request
+
+**No Claude attribution anywhere (no Co-Authored-By, no "Generated with Claude").**
+
+Follow [CONTRIBUTING.md](../../CONTRIBUTING.md) for full project conventions.
+
+## Steps
+
+1. Check branch. If on `main`, create a feature branch. Use `<username>/<description>` format where `<username>` comes from `gh api user --jq .login`. If unavailable, just use `<description>`.
+2. Gather context: `git status`, `git log --oneline main..HEAD`, `git diff main...HEAD --stat`, check if remote tracking branch exists.
+3. PR **title**: `type(scope): description` — under 72 chars, describes the overall change across all commits. This becomes the squash-merge commit message.
+4. PR **body**: brief summary + bullet points for key changes. No filler.
+5. Push with `-u` if needed, then `gh pr create`. Default base is `main` unless user says otherwise.
+6. Return the PR URL.
+
+If the user provided arguments, use them as context: $ARGUMENTS

.claude/skills/rebase-onto-main/SKILL.md

@@ -0,0 +1,73 @@
+---
+name: rebase-onto-main
+description: Rebase a branch onto main, handling squash-merged parent branches cleanly
+argument-hint: "[optional: branch name, defaults to current branch]"
+allowed-tools: Bash, Read, Glob, Grep, Agent
+---
+
+# Rebase Branch onto Main
+
+Rebase the current (or specified) branch onto `main`, correctly handling the case where the branch was built on top of another branch that has since been squash-merged into `main`.
+
+## Background
+
+When a parent branch is squash-merged, its individual commits become a single new commit on `main` with a different hash. A normal `git rebase main` will try to replay the parent's original commits, causing messy conflicts. The fix is to **cherry-pick only the commits unique to this branch** onto a fresh branch from `main`.
+
+## Steps
+
+1. **Identify the branch.** Use `$ARGUMENTS` if provided, otherwise use the current branch.
+
+2. **Fetch and update main:**
+   ```
+   git fetch origin main:main
+   ```
+
+3. **Find the merge base** between the branch and `main`:
+   ```
+   git merge-base <branch> main
+   ```
+
+4. **List all commits** on the branch since the merge base:
+   ```
+   git log --oneline <merge-base>..<branch>
+   ```
+
+5. **Identify which commits are unique to this branch** vs. inherited from a parent branch. Look for:
+   - Squash-merged commits on `main` that correspond to a group of commits at the bottom of the branch's history (check PR titles, commit message keywords).
+   - The boundary commit: the first commit that belongs to *this* branch's work, not the parent's.
+   - If ALL commits are unique (no parent branch), just do a normal `git rebase main` and skip the rest.
+
+6. **Create a fresh branch from `main`:**
+   ```
+   git checkout -b <branch>-rebase main
+   ```
+
+7. **Cherry-pick only the unique commits** (oldest first):
+   ```
+   git cherry-pick <first-unique-commit>^..<branch>
+   ```
+   The `A^..B` range means "from the parent of A through B inclusive."
+
+8. **Handle conflicts** if any arise during cherry-pick. Resolve and `git cherry-pick --continue`.
+
+9. **Replace the old branch:**
+   ```
+   git branch -m <branch> <branch>-old
+   git branch -m <branch>-rebase <branch>
+   ```
+
+10. **Verify** the result:
+    ```
+    git log --oneline main..<branch>
+    ```
+    Confirm only the expected commits are present.
+
+11. **Ask the user** before force-pushing. When approved:
+    ```
+    git push origin <branch> --force-with-lease
+    ```
+
+12. **Clean up** the old branch:
+    ```
+    git branch -D <branch>-old
+    ```

.claude/skills/review-pr/SKILL.md

@@ -0,0 +1,207 @@
+---
+name: review-pr
+description: Review a pull request with structured, domain-aware feedback
+argument-hint: "<PR number or URL>"
+allowed-tools: Bash, Read, Glob, Grep, Agent
+---
+
+# PX4 Pull Request Review
+
+Review a pull request with domain-aware checks based on which files are changed.
+
+**No Claude attribution anywhere.**
+
+## Steps
+
+1. **Fetch PR context.** Run these in parallel:
+   - `gh pr view <PR> --json number,title,body,baseRefName,headRefName,files,commits,reviewRequests,reviews,author`
+   - `gh pr checks <PR>` (exit code 8 means some checks are pending, this is normal, not an error)
+   - `gh pr diff <PR>` -- if this fails with HTTP 406 (300+ files), do NOT retry. Instead use `gh api repos/OWNER/REPO/pulls/NUMBER/files --paginate` to get the full file list in one call, then fetch patches for key infrastructure files individually and sample representative changes from each domain touched.
+   - `gh api repos/OWNER/REPO/pulls/NUMBER/comments --paginate --jq '.[] | {user: .user.login, body: .body, path: .path, created_at: .created_at}'` to get inline review comments
+   - `gh api repos/OWNER/REPO/issues/NUMBER/comments --paginate --jq '.[] | {user: .user.login, body: .body, created_at: .created_at}'` to get PR conversation comments
+
+   From the PR metadata, note:
+   - **Assigned reviewers**: who has been requested to review (from `reviewRequests`)
+   - **Existing reviews**: who has already reviewed and their verdict (from `reviews` -- approved, changes_requested, commented, dismissed)
+   - **PR comments and inline comments**: read all existing feedback to avoid duplicating points already raised by other reviewers, and to build on their discussion rather than ignoring it
+
+2. **Check CI status.** From the `gh pr checks` output in step 1, summarize pass/fail/pending. If there are failures, fetch logs with `gh run view <run-id> --log-failed`. Include CI status in the output.
+
+3. **Recommend merge strategy.** Analyze the commit history and recommend squash or rebase merge. This decision informs all subsequent commit hygiene feedback.
+
+   **Recommend rebase merge** when:
+   - Commits are atomic, each builds/works independently
+   - Each commit has a proper `type(scope): description` message
+   - The PR intentionally separates logical changes (e.g., refactor + feature, or one commit per module)
+   - The commit history tells a useful story that would be lost by squashing
+
+   **Recommend squash merge** when:
+   - There are WIP, fixup, or review-response commits
+   - Commit messages are messy or inconsistent
+   - The PR is a single logical change spread across multiple commits
+   - There are "oops" or "make format" commits mixed in
+
+   Include the recommendation in the output. If recommending rebase, flag any commits that break atomicity or have bad messages. If recommending squash, don't bother flagging individual commit messages (they'll be discarded) but ensure the PR title is correct since it becomes the squash commit message.
+
+4. **Check conventional commit title.** Verify the PR title follows `type(scope): description` per CONTRIBUTING.md. The PR title becomes the commit message on squash-merge, so it must be accurate and descriptive. Verify the scope matches the primary area of changed files. If the PR introduces breaking changes, the title must include `!` before the colon. If rebase merge was recommended in step 3, also scan individual commit messages for anti-patterns: vague messages ("fix", "update"), missing type prefix, review-response noise ("apply suggestions from code review", "do make format"), or WIP markers. Flag these for rewording.
+
+5. **Identify domains touched.** Classify changed files into domains based on paths (a PR may touch multiple):
+   - **Estimation**: `src/modules/ekf2/`, `src/lib/wind_estimator/`, `src/lib/world_magnetic_model/`
+   - **Control**: `src/modules/mc_*control*/`, `src/modules/fw_*control*/`, `src/modules/flight_mode_manager/`, `src/lib/rate_control/`, `src/lib/npfg/`, `src/modules/vtol_att_control/`
+   - **Drivers/CAN**: `src/drivers/`, `src/modules/cyphal/`, `src/drivers/uavcan*/`
+   - **Simulation**: `src/modules/simulation/`, `Tools/simulation/`
+   - **System**: `src/modules/commander/`, `src/modules/logger/`, `src/systemcmds/`, `platforms/`, `src/modules/dataman/`
+   - **Board Addition**: `boards/{manufacturer}/{board}/` (new directories only, not modifications to existing boards)
+   - **CI/Build**: `.github/`, `CMakeLists.txt`, `Makefile`, `cmake/`, `Tools/`, `Kconfig`
+   - **Messages/Protocol**: `msg/`, `src/modules/mavlink/`, `src/modules/uxrce_dds_client/`
+
+6. **Apply core checks** (always):
+   - **Correctness**: logic errors, off-by-ones, unhandled edge cases
+   - **Type safety**: int16 overflow, float/double promotion, unsigned subtraction, use `uint64_t` for absolute time
+   - **Initialization**: uninitialized variables, missing default construction
+   - **Buffer safety**: unchecked array access, stack allocation of large buffers, snprintf bounds
+   - **Magic numbers**: every numeric literal needs a named constant or justification
+   - **Framework reuse**: use PX4_ERR/WARN/INFO, existing libraries (AlphaFilter, SlewRate, RateControl), MAVLink constants from the library
+   - **Naming**: accurate, no unjustified abbreviations, current terminology (GPS -> GNSS for new code)
+   - **Unnecessary complexity**: can code be removed instead of added? Is there a simpler pattern?
+   - **Test coverage**: new features should include unit or integration tests; bug fixes should include regression tests where practical. When automated testing is infeasible (hardware-specific), require a flight log link from https://logs.px4.io or bench test evidence.
+   - **PR hygiene**: focused scope, no unrelated formatting, no stale submodule changes. Commits should be atomic and independently revertable. Multiple WIP or review-response commits should be squashed. Clean, logical commits will be preserved individually on main via rebase merge. **Do NOT assume PRs are squash-merged. Both squash and rebase merge are enabled; merge commits are disabled.** Verify the PR targets `main` unless it is a backport or release-specific fix.
+   - **Formatting**: `make format` / `make check_format` (astyle) for C/C++ files; `clang-tidy` clean. Python files checked with `mypy` and `flake8`. PRs failing CI format or lint checks will not be merged.
+   - **Coding style**: C/C++ must follow the [PX4 coding style](https://docs.px4.io/main/en/contribute/code.html)
+   - **Necessity**: challenge every addition with "Why?" Is this actually needed or just copied? Can we change a default instead of adding runtime detection?
+   - **Root cause vs symptom**: is this fixing the real problem or masking it?
+   - **Ecosystem impact**: what does this change mean for QGC users, log analysis tools, and third-party integrations?
+   - **Sustainability**: who will maintain this? Does it create long-term burden?
+   - **Architecture fit**: does the code live in the module that naturally owns the data? Are there unnecessary cross-module dependencies?
+   - **End user impact**: will parameters confuse less-technical users? Are error messages actionable in QGC?
+
+7. **Apply domain checks** based on step 5:
+
+   **Estimation:**
+   - Singularities in aerospace math (euler angles near gimbal lock, sideslip at low airspeed)
+   - Aliasing from downsampling sensor data without filtering
+   - Kalman filter correctness (Joseph form, innovation variance, covariance symmetry)
+   - CPU cost on embedded targets (avoid unnecessary sqrt, limit fusion rate)
+   - Frame/coordinate system correctness (FRD vs NED, body vs earth)
+
+   **Control:**
+   - Phase margin: output filters consume margin for no benefit; prefer adjusting gyro/d-gyro cutoffs
+   - Circular dependencies: sensor data feeding back into its own control loop (e.g., throttle-based airspeed in TECS)
+   - NaN propagation in flight-critical math; check `PX4_ISFINITE` before magnitude checks
+   - Setpoint generation vs output-stage hacks: prefer proper setpoint smoothing over controller output filtering
+   - Yaw control edge cases: heading lock, drift, setpoint propagation
+   - Flight task inheritance chain: correct base class for the desired behavior
+   - Control allocation: actuator function ordering, motor index mapping
+
+   **Drivers/CAN:**
+   - CAN bus devices behave differently from serial/SPI; check driver assumptions
+   - ESC index mapping: telemetry index != channel when motors are disabled
+   - ESC hardware quirks: 4-in-1 ESCs may report current on only one channel
+   - device_id correctness and I2CSPIDriver patterns
+   - Time representation: prefer `hrt_abstime` over iteration counts
+
+   **Simulation:**
+   - Physics fidelity: noise models should match reality (GPS noise is not Gaussian)
+   - Keep gz_bridge generic; vehicle-specific logic belongs in plugins
+   - Prefer gz-transport over ROS2 dependencies when possible
+   - Wrench commands for physics correctness vs kinematic constraints
+   - Library generic/specific boundary: only base classes in common libs
+
+   **System:**
+   - Race conditions and concurrency: no partial fixes, demand complete solutions
+   - Semaphore/scheduling edge cases; understand RTOS guarantees
+   - State machine sequential-logic bugs (consecutive RTL, armed/disarmed alternation)
+   - uORB-driven scheduling (`SubscriptionCallback`), not extra threads
+   - param_set triggers auto-save; no redundant param_save_default
+   - Flash/memory efficiency: avoid `std::string` on embedded, minimize SubscriptionData usage
+   - Constructor initialization order matters
+
+   **CI/Build:**
+   - Pipeline race conditions (tag + branch push double-trigger, git describe correctness)
+   - Container image size (check layer bloat)
+   - Ubuntu LTS support policy (latest + one prior only)
+   - Build time impact
+   - CMake preferred over Makefiles
+
+   **Messages/Protocol:**
+   - Backwards compatibility: will this break QGC, post-flight tools, or uLog parsers?
+   - uORB: `timestamp` for publication metadata, `timestamp_sample` close to physical sample, include `device_id`
+   - Don't version messages unless strictly needed
+   - Parameter UX: will this confuse users in a GCS? Every new param is a configuration burden
+   - MAVLink: use library constants, don't implement custom stream rates
+
+   **Board Addition:**
+   - **Flight logs**: require a link to https://logs.px4.io demonstrating basic operation for the vehicle type (hover for multicopters, stable flight for fixed-wing, driving for rovers, etc.); short bench-only logs are insufficient
+   - **Documentation**: require a docs page in `docs/en/flight_controller/` with pinout, where-to-buy, connector types, version badge, and manufacturer-supported notice block
+   - **USB VID/PID**: must not reuse another manufacturer's Vendor ID; manufacturer must use their own
+   - **Board naming**: directory is `boards/{manufacturer}/{board}/`, both lowercase, hyphens for board name
+   - **Unique board_id**: registered in `boards/boards.json`, no collisions
+   - **Copied code cleanup**: check for leftover files, configs, or comments from the template board; "Is this real or leftover?"
+   - **RC configuration**: prefer `CONFIG_DRIVERS_COMMON_RC` over legacy `CONFIG_DRIVERS_RC_INPUT`
+   - **No board-specific custom modules**: reject copy-pasted drivers (e.g., custom heater) when existing infrastructure works
+   - **Bootloader**: expect a bootloader defconfig (`nuttx-config/bootloader/defconfig`) or explanation of shared bootloader
+   - **CI integration**: board must be added to CI compile workflows so it builds on every PR
+   - **Flash constraints**: verify enabled modules fit in flash; we are running low across all board targets
+   - **Port labels**: serial port labels must match what is physically printed on the board
+   - **Hardware availability**: for unknown manufacturers, verify the product exists and is purchasable (no vaporware)
+
+8. **Format output** as:
+   - **CI status**: pass/fail summary, link to failed runs if any
+   - **Merge strategy**: recommend squash or rebase merge with reasoning
+   - **Title check**: pass/fail with suggestion
+   - **Review status**: list assigned reviewers and any existing reviews (who approved, who requested changes, key points already raised). Note if your review would duplicate feedback already given.
+   - **Domains detected**: list which domain checks were applied
+   - **Summary**: one paragraph on what the PR does and whether the approach is sound
+   - **Issues**: numbered list, each with file:line, severity (blocker/warning/nit), and explanation. Skip issues already raised by other reviewers unless you have something to add.
+   - **Verdict**: approve, request changes, or needs discussion
+
+   After the structured output, also display a **draft PR comment** formatted using the PR comment formatting rules from step 9. This gives the user a preview of what would be posted.
+
+9. **Interactive dialog.** After displaying the review, present the user with these options:
+
+   Present options based on the verdict:
+
+   If verdict is **approve**:
+   ```
+   What would you like to do?
+   1. Chat about this PR (ask questions, explore code) [default]
+   2. Approve this PR and post the review comment
+   3. Adjust the review or draft (tell me what to change)
+   4. Done for now
+   ```
+
+   If verdict is **request changes**:
+   ```
+   What would you like to do?
+   1. Chat about this PR (ask questions, explore code) [default]
+   2. Request changes on this PR and post the review comment
+   3. Adjust the review or draft (tell me what to change)
+   4. Done for now
+   ```
+
+   If verdict is **needs discussion**:
+   ```
+   What would you like to do?
+   1. Chat about this PR (ask questions, explore code) [default]
+   2. Post the review as a comment (no approval or rejection)
+   3. Adjust the review or draft (tell me what to change)
+   4. Done for now
+   ```
+
+   Wait for the user to choose before proceeding. If they pick:
+   - **1 (chat)**: enter a free-form conversation about the PR. The user can ask about specific files, code paths, or decisions. When done, loop back to the options. This is the default if the user just presses enter.
+   - **2 (submit)**: use the draft PR comment already shown. Before posting, check if you have review permissions: run `gh api repos/OWNER/REPO/collaborators/$(gh api user --jq .login)/permission --jq .permission` -- if `admin` or `write`, submit as a formal review with `gh pr review <PR> --approve --body "..."` or `gh pr review <PR> --request-changes --body "..."` based on the verdict. If no write access, fall back to `gh pr comment <PR> --body "..."`. Always confirm with the user before posting.
+   - **3 (adjust)**: ask what to change, update the review and draft, then loop back to the options.
+   - **4 (done)**: stop.
+
+   **PR comment formatting rules** (for the draft):
+   When writing the GitHub comment, rewrite the review to sound like a human reviewer, not a structured report. Do NOT include the full skill output. Instead:
+   - Drop most meta-sections (CI status, title check, domains detected, severity labels) but keep the merge strategy recommendation (e.g., "I'd suggest a rebase merge here since the commits are clean and atomic" or "This should be squash-merged, the commit history is messy")
+   - Write conversationally: "Nice work on this. A few things I noticed:" not "Issues: 1. file:line (warning):"
+   - Lead with a brief take on the overall change (1-2 sentences)
+   - List only actionable feedback as natural review comments, not numbered checklists
+   - Skip nits unless they are particularly useful
+   - End with a clear stance: looks good to merge, needs a few changes, or let's discuss X
+   - Post with `gh pr comment <PR> --body "$(cat <<'EOF' ... EOF)"`. Do not post without explicit confirmation.
+
+If the user provided arguments, use them as context: $ARGUMENTS

.dockerignore

@@ -0,0 +1 @@
+build/

.github/actions/build-deb/action.yml

@@ -0,0 +1,115 @@
+name: Build PX4 .deb Package
+description: Build PX4 SITL, run cpack, validate the .deb, and upload artifact
+
+inputs:
+  target:
+    description: 'Build target: default or sih'
+    required: true
+  artifact-name:
+    description: Name for the uploaded artifact
+    required: true
+  ccache-key-prefix:
+    description: Prefix for ccache cache keys
+    default: deb-ccache
+  ccache-max-size:
+    description: Maximum ccache size
+    default: 400M
+
+runs:
+  using: composite
+  steps:
+    - name: Restore ccache
+      id: ccache-restore
+      uses: actions/cache/restore@v5
+      with:
+        path: ~/.ccache
+        key: ${{ inputs.ccache-key-prefix }}-${{ github.ref_name }}-${{ github.sha }}
+        restore-keys: |
+          ${{ inputs.ccache-key-prefix }}-${{ github.ref_name }}-
+          ${{ inputs.ccache-key-prefix }}-${{ github.base_ref || 'main' }}-
+          ${{ inputs.ccache-key-prefix }}-
+
+    - name: Configure ccache
+      shell: bash
+      run: |
+        mkdir -p ~/.ccache
+        echo "base_dir = ${GITHUB_WORKSPACE}" > ~/.ccache/ccache.conf
+        echo "compression = true" >> ~/.ccache/ccache.conf
+        echo "compression_level = 6" >> ~/.ccache/ccache.conf
+        echo "max_size = ${{ inputs.ccache-max-size }}" >> ~/.ccache/ccache.conf
+        echo "hash_dir = false" >> ~/.ccache/ccache.conf
+        echo "compiler_check = content" >> ~/.ccache/ccache.conf
+        ccache -s
+        ccache -z
+
+    - name: Build PX4 SITL
+      shell: bash
+      run: make px4_sitl_${{ inputs.target }}
+
+    - name: ccache stats
+      if: always()
+      shell: bash
+      run: ccache -s
+
+    - name: Save ccache
+      uses: actions/cache/save@v5
+      if: always()
+      with:
+        path: ~/.ccache
+        key: ${{ inputs.ccache-key-prefix }}-${{ github.ref_name }}-${{ github.sha }}
+
+    - name: Build .deb package
+      shell: bash
+      run: |
+        cd build/px4_sitl_${{ inputs.target }}
+        cpack -G DEB
+
+    - name: Print package info and contents
+      shell: bash
+      run: |
+        cd build/px4_sitl_${{ inputs.target }}
+        echo "--- Package info ---"
+        dpkg-deb -I *.deb
+        echo "--- Package contents ---"
+        dpkg-deb -c *.deb
+
+    - name: Validate sih package
+      if: inputs.target == 'sih'
+      shell: bash
+      run: |
+        cd build/px4_sitl_sih
+        echo "--- Verify NO Gazebo resources ---"
+        ! dpkg-deb -c px4_*.deb | grep share/gz > /dev/null && echo "PASS: no Gazebo" || { echo "FAIL: Gazebo found"; exit 1; }
+        echo "--- Install test ---"
+        dpkg -i px4_*.deb
+        test -x /opt/px4/bin/px4 || { echo "FAIL: px4 binary not found"; exit 1; }
+        test -L /usr/bin/px4 || { echo "FAIL: symlink not created"; exit 1; }
+        test ! -d /opt/px4/share/gz || { echo "FAIL: Gazebo dir should not exist"; exit 1; }
+        echo "--- Smoke test ---"
+        /opt/px4/bin/px4 -h
+        echo "PASS: sih package validation successful"
+
+    - name: Validate gazebo package
+      if: inputs.target == 'default'
+      shell: bash
+      run: |
+        cd build/px4_sitl_default
+        echo "--- Verify Gazebo resources in package ---"
+        dpkg-deb -c px4-gazebo_*.deb | grep share/gz/models > /dev/null || { echo "FAIL: models missing"; exit 1; }
+        dpkg-deb -c px4-gazebo_*.deb | grep share/gz/worlds > /dev/null || { echo "FAIL: worlds missing"; exit 1; }
+        echo "--- Install test ---"
+        dpkg -i px4-gazebo_*.deb
+        test -x /opt/px4-gazebo/bin/px4 || { echo "FAIL: px4 binary not found"; exit 1; }
+        test -x /opt/px4-gazebo/bin/px4-gazebo || { echo "FAIL: wrapper not found"; exit 1; }
+        test -L /usr/bin/px4-gazebo || { echo "FAIL: symlink not created"; exit 1; }
+        test -d /opt/px4-gazebo/share/gz/models || { echo "FAIL: Gazebo models not installed"; exit 1; }
+        echo "--- Smoke test ---"
+        /opt/px4-gazebo/bin/px4 -h
+        echo "PASS: gazebo package validation successful"
+
+    - name: Upload .deb artifacts
+      uses: actions/upload-artifact@v7
+      with:
+        name: ${{ inputs.artifact-name }}
+        path: build/px4_sitl_${{ inputs.target }}/*.deb
+        if-no-files-found: error

.github/actions/build-gazebo-sitl/action.yml

@@ -0,0 +1,21 @@
+name: Build Gazebo Classic SITL
+description: Build PX4 firmware and Gazebo Classic plugins with ccache stats
+
+runs:
+  using: composite
+  steps:
+    - name: Build - PX4 Firmware (SITL)
+      shell: bash
+      run: make px4_sitl_default
+
+    - name: Cache - Stats after PX4 Firmware
+      shell: bash
+      run: ccache -s
+
+    - name: Build - Gazebo Classic Plugins
+      shell: bash
+      run: make px4_sitl_default sitl_gazebo-classic
+
+    - name: Cache - Stats after Gazebo Plugins
+      shell: bash
+      run: ccache -s

.github/actions/save-ccache/action.yml

@@ -0,0 +1,22 @@
+name: Save ccache
+description: Print ccache stats and save to cache
+
+inputs:
+  cache-primary-key:
+    description: Primary cache key from setup-ccache output
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Cache - Stats
+      if: always()
+      shell: bash
+      run: ccache -s
+
+    - name: Cache - Save ccache
+      if: always()
+      uses: actions/cache/save@v5
+      with:
+        path: ~/.ccache
+        key: ${{ inputs.cache-primary-key }}

.github/actions/setup-ccache/action.yml

@@ -0,0 +1,56 @@
+name: Setup ccache
+description: Restore ccache from cache and configure ccache.conf
+
+inputs:
+  cache-key-prefix:
+    description: Cache key prefix (e.g. ccache-sitl)
+    required: true
+  max-size:
+    description: Max ccache size (e.g. 300M)
+    required: false
+    default: '300M'
+  base-dir:
+    description: ccache base_dir value
+    required: false
+    default: '${GITHUB_WORKSPACE}'
+  install-ccache:
+    description: Install ccache via apt before configuring
+    required: false
+    default: 'false'
+
+outputs:
+  cache-primary-key:
+    description: Primary cache key (pass to save-ccache)
+    value: ${{ steps.restore.outputs.cache-primary-key }}
+
+runs:
+  using: composite
+  steps:
+    - name: Cache - Install ccache
+      if: inputs.install-ccache == 'true'
+      shell: bash
+      run: apt-get update && apt-get install -y ccache
+
+    - name: Cache - Restore ccache
+      id: restore
+      uses: actions/cache/restore@v5
+      with:
+        path: ~/.ccache
+        key: ${{ inputs.cache-key-prefix }}-${{ github.ref_name }}-${{ github.sha }}
+        restore-keys: |
+          ${{ inputs.cache-key-prefix }}-${{ github.ref_name }}-
+          ${{ inputs.cache-key-prefix }}-${{ github.base_ref || 'main' }}-
+          ${{ inputs.cache-key-prefix }}-
+
+    - name: Cache - Configure ccache
+      shell: bash
+      run: |
+        mkdir -p ~/.ccache
+        echo "base_dir = ${{ inputs.base-dir }}" > ~/.ccache/ccache.conf
+        echo "compression = true" >> ~/.ccache/ccache.conf
+        echo "compression_level = 6" >> ~/.ccache/ccache.conf
+        echo "max_size = ${{ inputs.max-size }}" >> ~/.ccache/ccache.conf
+        echo "hash_dir = false" >> ~/.ccache/ccache.conf
+        echo "compiler_check = content" >> ~/.ccache/ccache.conf
+        ccache -s
+        ccache -z

.github/instructions/board-addition.instructions.md

@@ -0,0 +1,21 @@
+---
+applyTo: "boards/**"
+---
+
+# Board Addition Review Guidelines
+
+In addition to the core code review guidelines, when reviewing new board additions:
+
+- **Flight logs**: require a link to https://logs.px4.io demonstrating basic operation for the vehicle type (hover for multicopters, stable flight for fixed-wing, driving for rovers, etc.); short bench-only logs are insufficient
+- **Documentation**: require a docs page in `docs/en/flight_controller/` with pinout, where-to-buy, connector types, version badge, and manufacturer-supported notice block
+- **USB VID/PID**: must not reuse another manufacturer's Vendor ID; manufacturer must use their own
+- **Board naming**: directory is `boards/{manufacturer}/{board}/`, both lowercase, hyphens for board name
+- **Unique board_id**: registered in `boards/boards.json`, no collisions
+- **Copied code cleanup**: check for leftover files, configs, or comments from the template board. Ask "Is this real or leftover?"
+- **RC configuration**: prefer `CONFIG_DRIVERS_COMMON_RC` over legacy `CONFIG_DRIVERS_RC_INPUT`
+- **No board-specific custom modules**: reject copy-pasted drivers (e.g., custom heater) when existing infrastructure works
+- **Bootloader**: expect a bootloader defconfig (`nuttx-config/bootloader/defconfig`) or explanation of shared bootloader
+- **CI integration**: board must be added to CI compile workflows so it builds on every PR
+- **Flash constraints**: verify enabled modules fit in flash; we are running low across all board targets
+- **Port labels**: serial port labels must match what is physically printed on the board
+- **Hardware availability**: for unknown manufacturers, verify the product exists and is purchasable (no vaporware)

.github/instructions/ci-build.instructions.md

@@ -0,0 +1,13 @@
+---
+applyTo: ".github/**,cmake/**,Makefile,CMakeLists.txt,Tools/**,**/Kconfig"
+---
+
+# CI/Build Review Guidelines
+
+In addition to the core code review guidelines:
+
+- Check for pipeline race conditions (tag + branch push double-trigger, git describe correctness)
+- Container image size: check for layer bloat
+- Ubuntu LTS support policy: only latest + one prior LTS version
+- Consider build time impact of changes
+- Prefer CMake over Makefiles

.github/instructions/code-review.instructions.md

@@ -0,0 +1,32 @@
+---
+applyTo: "src/**,boards/**,platforms/**,msg/**,cmake/**,Makefile,CMakeLists.txt,Tools/**,.github/**"
+---
+
+# PX4 Code Review Guidelines
+
+## Conventions
+
+- PR titles must follow conventional commits: `type(scope): description` (see CONTRIBUTING.md)
+- Types: `feat`, `fix`, `docs`, `style`, `refactor`, `perf`, `test`, `build`, `ci`, `chore`, `revert`
+- Scope should match the primary area of changed files
+- Append `!` before the colon for breaking changes
+- Both squash merge and rebase merge are enabled; merge commits are disabled
+- Commits should be atomic and independently revertable
+- WIP or review-response commits should be squashed before merge
+
+## Core Checks (always apply)
+
+- **Correctness**: logic errors, off-by-ones, unhandled edge cases
+- **Type safety**: int16 overflow, float/double promotion, unsigned subtraction, use `uint64_t` for absolute time
+- **Initialization**: uninitialized variables, missing default construction
+- **Buffer safety**: unchecked array access, stack allocation of large buffers, snprintf bounds
+- **Magic numbers**: every numeric literal needs a named constant or justification
+- **Framework reuse**: use PX4_ERR/WARN/INFO, existing libraries (AlphaFilter, SlewRate, RateControl), MAVLink constants from the library
+- **Naming**: accurate, no unjustified abbreviations, current terminology (GPS -> GNSS for new code)
+- **Unnecessary complexity**: can code be removed instead of added? Is there a simpler pattern?
+- **Test coverage**: new features should include unit or integration tests; bug fixes should include regression tests where practical
+- **Formatting**: `make format` / `make check_format` (astyle) for C/C++ files; `clang-tidy` clean
+- **Coding style**: C/C++ must follow the PX4 coding style (https://docs.px4.io/main/en/contribute/code.html)
+- **Necessity**: challenge every addition. Is this actually needed or just copied?
+- **Architecture fit**: does the code live in the module that naturally owns the data? No unnecessary cross-module dependencies
+- **Ecosystem impact**: consider QGC users, log analysis tools, and third-party integrations

.github/instructions/control.instructions.md

@@ -0,0 +1,15 @@
+---
+applyTo: "src/modules/mc_*control*/**,src/modules/fw_*control*/**,src/modules/flight_mode_manager/**,src/lib/rate_control/**,src/lib/npfg/**,src/modules/vtol_att_control/**"
+---
+
+# Control Review Guidelines
+
+In addition to the core code review guidelines:
+
+- Phase margin: output filters consume margin for no benefit; prefer adjusting gyro/d-gyro cutoffs
+- Check for circular dependencies: sensor data feeding back into its own control loop (e.g., throttle-based airspeed in TECS)
+- NaN propagation in flight-critical math; check `PX4_ISFINITE` before magnitude checks
+- Prefer proper setpoint smoothing over controller output filtering (setpoint generation vs output-stage hacks)
+- Check yaw control edge cases: heading lock, drift, setpoint propagation
+- Verify flight task inheritance chain uses the correct base class for desired behavior
+- Control allocation: verify actuator function ordering and motor index mapping

.github/instructions/docs.en.instructions.md

@@ -21,8 +21,10 @@ applyTo: "docs/en/**"
   - Do not apply bold or italic styling inside a heading.
 - **Formatting:** 
   - **Bold:** Only for UI elements (buttons, menu items).
-  - **Italics (Emphasis):** For tool names (e.g., *QGroundControl*).
   - **Inline Code:** Use backticks for file paths, parameters, and CLI commands (e.g., `prettier`).
+    Backticks are optional for hyperlinked CLI commands and tool names.
+  - **Italics (Emphasis):** Use for application names (e.g., *QGroundControl*).
+    Emphasis is optional for hyperlinked applications.
 - **Structure:** End every line at the end of a sentence (Semantic Line Breaks).
 
 ## Linking & Navigation

.github/instructions/drivers.instructions.md

@@ -0,0 +1,13 @@
+---
+applyTo: "src/drivers/**,src/modules/cyphal/**"
+---
+
+# Drivers/CAN Review Guidelines
+
+In addition to the core code review guidelines:
+
+- CAN bus devices behave differently from serial/SPI; check driver assumptions
+- ESC index mapping: telemetry index != channel when motors are disabled
+- ESC hardware quirks: 4-in-1 ESCs may report current on only one channel
+- Verify device_id correctness and I2CSPIDriver patterns
+- Time representation: prefer `hrt_abstime` over iteration counts

.github/instructions/estimation.instructions.md

@@ -0,0 +1,13 @@
+---
+applyTo: "src/modules/ekf2/**,src/lib/wind_estimator/**,src/lib/world_magnetic_model/**"
+---
+
+# Estimation Review Guidelines
+
+In addition to the core code review guidelines:
+
+- Check for singularities in aerospace math (euler angles near gimbal lock, sideslip at low airspeed)
+- Flag aliasing from downsampling sensor data without proper filtering
+- Verify Kalman filter correctness (Joseph form, innovation variance, covariance symmetry)
+- Consider CPU cost on embedded targets (avoid unnecessary sqrt, limit fusion rate)
+- Verify frame/coordinate system correctness (FRD vs NED, body vs earth frame)

.github/instructions/messages.instructions.md

@@ -0,0 +1,13 @@
+---
+applyTo: "msg/**,src/modules/mavlink/**,src/modules/uxrce_dds_client/**"
+---
+
+# Messages/Protocol Review Guidelines
+
+In addition to the core code review guidelines:
+
+- Backwards compatibility: will this break QGC, post-flight tools, or uLog parsers?
+- uORB: `timestamp` for publication metadata, `timestamp_sample` close to physical sample, include `device_id`
+- Don't version messages unless strictly needed
+- Parameter UX: will this confuse users in a GCS? Every new param is a configuration burden
+- MAVLink: use library constants, don't implement custom stream rates

.github/instructions/simulation.instructions.md

@@ -0,0 +1,13 @@
+---
+applyTo: "src/modules/simulation/**,Tools/simulation/**"
+---
+
+# Simulation Review Guidelines
+
+In addition to the core code review guidelines:
+
+- Physics fidelity: noise models should match reality (GPS noise is not Gaussian)
+- Keep gz_bridge generic; vehicle-specific logic belongs in plugins
+- Prefer gz-transport over ROS2 dependencies when possible
+- Use wrench commands for physics correctness vs kinematic constraints
+- Library generic/specific boundary: only base classes in common libs

.github/instructions/system.instructions.md

@@ -0,0 +1,15 @@
+---
+applyTo: "src/modules/commander/**,src/modules/logger/**,src/systemcmds/**,platforms/**,src/modules/dataman/**"
+---
+
+# System Review Guidelines
+
+In addition to the core code review guidelines:
+
+- Race conditions and concurrency: no partial fixes, demand complete solutions
+- Semaphore/scheduling edge cases; understand RTOS guarantees
+- State machine sequential-logic bugs (consecutive RTL, armed/disarmed alternation)
+- Use uORB-driven scheduling (`SubscriptionCallback`), not extra threads
+- `param_set` triggers auto-save; no redundant `param_save_default`
+- Flash/memory efficiency: avoid `std::string` on embedded, minimize SubscriptionData usage
+- Constructor initialization order matters

.github/workflows/build_all_targets.yml

@@ -2,6 +2,37 @@
 # - If you want to keep the tests running in GitHub Actions you need to uncomment the "runs-on: ubuntu-latest" lines
 #   and comment the "runs-on: [runs-on,runner=..." lines.
 # - If you would like to duplicate this setup try setting up "RunsOn" on your own AWS account try https://runs-on.com
+#
+# ===================================================================================
+# RELEASE UPLOAD LOGIC
+# ===================================================================================
+# This workflow handles building firmware and uploading to S3 + GitHub Releases.
+#
+# S3 Bucket Structure (s3://px4-travis/Firmware/):
+#   - master/          <- Latest main branch build (for QGC compatibility)
+#   - stable/          <- Latest stable release, controlled by 'stable' branch
+#   - beta/            <- Latest pre-release, controlled by 'beta' branch
+#   - vX.Y.Z/          <- Archived stable release
+#   - vX.Y.Z-beta1/    <- Archived pre-release
+#
+# Trigger Behavior:
+#   - Tag v1.16.1        -> Upload to: v1.16.1/ only (versioned archive)
+#   - Tag v1.17.0-beta1  -> Upload to: v1.17.0-beta1/ only (versioned archive)
+#   - Branch main        -> Upload to: master/ (for QGC compatibility)
+#   - Branch stable      -> Upload to: stable/ (QGC stable firmware)
+#   - Branch beta        -> Upload to: beta/ (QGC beta firmware)
+#   - Branch release/**  -> Build only, no S3 upload (CI validation)
+#   - Pull requests      -> Build only, no S3 upload (CI validation)
+#
+# GitHub Releases:
+#   - All version tags create a draft GitHub Release
+#   - Pre-releases (alpha/beta/rc suffixes) are automatically marked as such
+#
+# IMPORTANT: Version tags do NOT upload to stable/ or beta/. Only the
+# corresponding branch pushes control those directories. This prevents
+# pre-release tags from accidentally overwriting stable firmware (#26340)
+# and avoids race conditions between tag and branch builds.
+# ===================================================================================
 
 name: Build all targets
 
@@ -29,6 +60,7 @@ concurrency:
 permissions:
   contents: write
   actions: read
+  packages: read
 
 jobs:
   group_targets:
@@ -40,10 +72,10 @@ jobs:
       timestamp: ${{ steps.set-timestamp.outputs.timestamp }}
       branchname: ${{ steps.set-branch.outputs.branchname }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Cache Python pip
-        uses: actions/cache@v4
+        uses: actions/cache@v5
         with:
           path: ~/.cache/pip
           key: ${{ runner.os }}-pip-${{ hashFiles('**./Tools/setup/requirements.txt') }}
@@ -94,13 +126,15 @@ jobs:
       fail-fast: false
     container:
       image: ${{ matrix.container }}
+      credentials:
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
     steps:
       - uses: runs-on/action@v2
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
-
-      - name: Git ownership workaround
+      - name: Configure Git Safe Directory
         run: git config --system --add safe.directory '*'
 
       # ccache key breakdown:
@@ -109,7 +143,7 @@ jobs:
       # ccache-<linux>-<x64>-<nuttx-0>-
       - name: Cache Restore from Key
         id: cc_restore
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v5
         with:
           path: ~/.ccache
           key: ${{ format('ccache-{0}-{1}-{2}', runner.os, matrix.runner, matrix.group) }}
@@ -141,7 +175,7 @@ jobs:
           ./Tools/ci/package_build_artifacts.sh
 
       - name: Upload Build Artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: px4_${{matrix.group}}_build_artifacts
           path: artifacts/
@@ -154,11 +188,18 @@ jobs:
 
       - name: Cache Save
         if: always()
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@v5
         with:
           path: ~/.ccache
           key: ${{ steps.cc_restore.outputs.cache-primary-key }}
 
+  # ===========================================================================
+  # ARTIFACT UPLOAD JOB
+  # ===========================================================================
+  # Uploads build artifacts to S3 and creates GitHub Releases.
+  # Runs for version tags (v*), main, stable, and beta branch pushes.
+  # See header comments for full upload logic documentation.
+  # ===========================================================================
   artifacts:
     name: Upload Artifacts
     # runs-on: ubuntu-latest
@@ -169,7 +210,7 @@ jobs:
       uploadlocation: ${{ steps.upload-location.outputs.uploadlocation }}
     steps:
       - name: Download Artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           path: artifacts/
           merge-multiple: true
@@ -177,31 +218,31 @@ jobs:
       - name: Choose Upload Location
         id: upload-location
         run: |
-          # Determine upload location based on branch or tag with the following considerations:
-          # Destination: AWS S3 bucket px4-travis in folder Firmware/
-          # - If branch is main -> upload to master/
-          #   - Older versions of QGC are hardocded to look for master/
-          # - If branch is stable or beta -> upload to stable/ or beta/
-          # - If a tag vX.Y.Z -> upload to vX.Y.Z/
-          #   - Also update stable/ to point to the same version
-          #.  - Older versions of QGC are hardocded to look for stable/
-          # - If a pull request -> do not upload
           set -euo pipefail
 
           ref="${GITHUB_REF}"
           branch=${{ needs.group_targets.outputs.branchname  }}
           location="$branch"
+          is_prerelease="false"
 
+          # Main branch uploads to "master" for QGC backward compatibility
           if [[ "$branch" == "main" ]]; then
             location="master"
           fi
 
+          # Version tags: upload to versioned directory (e.g., v1.16.1/)
           if [[ "$ref" == refs/tags/v[0-9]* ]]; then
             tag="${ref#refs/tags/}"
             location="$tag"
+
+            # Pre-release tags contain -alpha, -beta, or -rc suffix
+            if [[ "$tag" =~ -(alpha|beta|rc) ]]; then
+              is_prerelease="true"
+            fi
           fi
 
           echo "uploadlocation=$location" >> $GITHUB_OUTPUT
+          echo "is_prerelease=$is_prerelease" >> $GITHUB_OUTPUT
 
       - name: Uploading Artifacts to S3 [${{ steps.upload-location.outputs.uploadlocation }}]
         uses: jakejarvis/s3-sync-action@master
@@ -215,28 +256,16 @@ jobs:
           SOURCE_DIR: artifacts/
           DEST_DIR: Firmware/${{ steps.upload-location.outputs.uploadlocation }}/
 
-      # if we are uploading artifacts to a versioned folder
-      # we should also update the stable folder in the s3 bucket
-      - name: Uploading Artifacts to S3 [stable]
-        uses: jakejarvis/s3-sync-action@master
-        if: startsWith(github.ref, 'refs/tags/v')
-        with:
-          args: --acl public-read
-        env:
-          AWS_S3_BUCKET: 'px4-travis'
-          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          AWS_REGION: 'us-west-1'
-          SOURCE_DIR: artifacts/
-          DEST_DIR: Firmware/stable/
-
-      # if build is a release triggered by a versioned tag then create a github release
-      # and upload the build artifacts. A draft release is created so that the release
-      # can be reviewed before publishing
+      # Create a draft GitHub Release for all version tags
+      # Pre-releases are automatically marked as such
       - name: Upload Artifacts to GitHub Release
         uses: softprops/action-gh-release@v2
         if: startsWith(github.ref, 'refs/tags/v')
         with:
           draft: true
-          files: artifacts/*.px4
+          prerelease: ${{ steps.upload-location.outputs.is_prerelease == 'true' }}
+          files: |
+            artifacts/*.px4
+            artifacts/*.deb
+            artifacts/**/*.sbom.spdx.json
           name: ${{ steps.upload-location.outputs.uploadlocation }}

.github/workflows/build_deb_package.yml

@@ -0,0 +1,218 @@
+name: SITL Packages and Containers
+
+on:
+  push:
+    tags: ['v*']
+  pull_request:
+    paths:
+      - 'cmake/package.cmake'
+      - 'platforms/posix/CMakeLists.txt'
+      - 'Tools/packaging/**'
+      - 'boards/px4/sitl/sih.px4board'
+      - '.github/workflows/build_deb_package.yml'
+      - '.github/actions/build-deb/**'
+  workflow_dispatch:
+    inputs:
+      deploy_containers:
+        description: 'Push container images to registry'
+        required: false
+        type: boolean
+        default: false
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+
+  # ---------------------------------------------------------------------------
+  # Setup: extract version and determine whether to push containers
+  # ---------------------------------------------------------------------------
+  setup:
+    name: Setup
+    runs-on: [runs-on,"runner=1cpu-linux-x64","image=ubuntu24-full-x64","run-id=${{ github.run_id }}",extras=s3-cache,spot=false]
+    outputs:
+      px4_version: ${{ steps.version.outputs.px4_version }}
+      should_push: ${{ steps.push.outputs.should_push }}
+    steps:
+      - uses: runs-on/action@v2
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+
+      - name: Set PX4 version
+        id: version
+        run: echo "px4_version=$(git describe --tags --match 'v[0-9]*')" >> $GITHUB_OUTPUT
+
+      - name: Check if we should push containers
+        id: push
+        run: |
+          if [[ "${{ startsWith(github.ref, 'refs/tags/') }}" == "true" ]] || \
+             [[ "${{ github.event_name }}" == "workflow_dispatch" && "${{ github.event.inputs.deploy_containers }}" == "true" ]]; then
+            echo "should_push=true" >> $GITHUB_OUTPUT
+          else
+            echo "should_push=false" >> $GITHUB_OUTPUT
+          fi
+
+  # ---------------------------------------------------------------------------
+  # Build .deb packages (all distros, arches, targets)
+  # ---------------------------------------------------------------------------
+  build-deb:
+    name: "Build .deb (${{ matrix.target }}/${{ matrix.codename }}/${{ matrix.arch }})"
+    needs: setup
+    runs-on: [runs-on,"runner=4cpu-linux-${{ matrix.runner }}","image=ubuntu24-full-${{ matrix.runner }}","run-id=${{ github.run_id }}",extras=s3-cache,spot=false]
+    container:
+      image: ${{ matrix.container }}
+      volumes:
+        - /github/workspace:/github/workspace
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { codename: noble,  arch: amd64, runner: x64,   container: "ubuntu:24.04", target: default, setup_flags: "" }
+          - { codename: noble,  arch: arm64, runner: arm64, container: "ubuntu:24.04", target: default, setup_flags: "" }
+          - { codename: jammy,  arch: amd64, runner: x64,   container: "ubuntu:22.04", target: default, setup_flags: "" }
+          - { codename: jammy,  arch: arm64, runner: arm64, container: "ubuntu:22.04", target: default, setup_flags: "" }
+          - { codename: noble,  arch: amd64, runner: x64,   container: "ubuntu:24.04", target: sih, setup_flags: "--no-sim-tools" }
+          - { codename: noble,  arch: arm64, runner: arm64, container: "ubuntu:24.04", target: sih, setup_flags: "--no-sim-tools" }
+          - { codename: jammy,  arch: amd64, runner: x64,   container: "ubuntu:22.04", target: sih, setup_flags: "--no-sim-tools" }
+          - { codename: jammy,  arch: arm64, runner: arm64, container: "ubuntu:22.04", target: sih, setup_flags: "--no-sim-tools" }
+    env:
+      RUNS_IN_DOCKER: true
+    steps:
+      - uses: runs-on/action@v2
+
+      - name: Fix git in container
+        run: |
+          apt-get update && apt-get install -y git
+          git config --global --add safe.directory $(realpath .)
+
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+
+      - name: Use AWS regional apt mirror
+        if: startsWith(runner.name, 'runs-on--')
+        run: ./Tools/ci/use_aws_apt_mirror.sh
+
+      - name: Cache apt packages
+        uses: actions/cache@v5
+        with:
+          path: /var/cache/apt/archives
+          key: apt-${{ matrix.target }}-${{ matrix.codename }}-${{ matrix.arch }}-${{ hashFiles('Tools/setup/ubuntu.sh') }}
+          restore-keys: apt-${{ matrix.target }}-${{ matrix.codename }}-${{ matrix.arch }}-
+
+      - name: Install dependencies
+        run: ./Tools/setup/ubuntu.sh --no-nuttx ${{ matrix.setup_flags }}
+
+      - name: Build and package .deb
+        uses: ./.github/actions/build-deb
+        with:
+          target: ${{ matrix.target }}
+          artifact-name: px4-sitl-debs-${{ matrix.target }}-${{ matrix.codename }}-${{ matrix.arch }}
+          ccache-key-prefix: deb-ccache-${{ matrix.target }}-${{ matrix.codename }}-${{ matrix.arch }}
+
+  # ---------------------------------------------------------------------------
+  # Build Docker images from Noble .debs
+  # ---------------------------------------------------------------------------
+  build-docker:
+    name: "Build Image (${{ matrix.image }}/${{ matrix.arch }})"
+    needs: [setup, build-deb]
+    runs-on: [runs-on,"runner=4cpu-linux-${{ matrix.runner }}","image=ubuntu24-full-${{ matrix.runner }}","run-id=${{ github.run_id }}",extras=s3-cache,spot=false]
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - { image: sih,    repo: px4-sitl,        target: sih,     arch: amd64, runner: x64,   platform: "linux/amd64", dockerfile: Dockerfile.sih }
+          - { image: sih,    repo: px4-sitl,        target: sih,     arch: arm64, runner: arm64, platform: "linux/arm64", dockerfile: Dockerfile.sih }
+          - { image: gazebo, repo: px4-sitl-gazebo, target: default, arch: amd64, runner: x64,   platform: "linux/amd64", dockerfile: Dockerfile.gazebo }
+          - { image: gazebo, repo: px4-sitl-gazebo, target: default, arch: arm64, runner: arm64, platform: "linux/arm64", dockerfile: Dockerfile.gazebo }
+    steps:
+      - uses: runs-on/action@v2
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 1
+
+      - name: Download Noble .deb artifact
+        uses: actions/download-artifact@v8
+        with:
+          name: px4-sitl-debs-${{ matrix.target }}-noble-${{ matrix.arch }}
+          path: docker-context
+
+      - name: Prepare build context
+        run: cp Tools/packaging/px4-entrypoint.sh docker-context/
+
+      - name: Login to registries
+        if: needs.setup.outputs.should_push == 'true'
+        run: |
+          echo "${{ secrets.DOCKERHUB_TOKEN }}" | docker login -u "${{ secrets.DOCKERHUB_USERNAME }}" --password-stdin
+          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+        with:
+          driver: docker-container
+          platforms: ${{ matrix.platform }}
+
+      - name: Build and push container image
+        uses: docker/build-push-action@v7
+        with:
+          context: docker-context
+          file: Tools/packaging/${{ matrix.dockerfile }}
+          tags: |
+            px4io/${{ matrix.repo }}:${{ needs.setup.outputs.px4_version }}-${{ matrix.arch }}
+            px4io/${{ matrix.repo }}:latest-${{ matrix.arch }}
+            ghcr.io/px4/${{ matrix.repo }}:${{ needs.setup.outputs.px4_version }}-${{ matrix.arch }}
+            ghcr.io/px4/${{ matrix.repo }}:latest-${{ matrix.arch }}
+          platforms: ${{ matrix.platform }}
+          load: false
+          push: ${{ needs.setup.outputs.should_push == 'true' }}
+          provenance: false
+          cache-from: type=gha,scope=sitl-${{ matrix.image }}-${{ matrix.arch }}
+          cache-to: type=gha,mode=max,scope=sitl-${{ matrix.image }}-${{ matrix.arch }}
+
+  # ---------------------------------------------------------------------------
+  # Deploy: create multi-arch manifests and push to registries
+  # ---------------------------------------------------------------------------
+  deploy:
+    name: "Deploy (${{ matrix.image }})"
+    needs: [setup, build-docker]
+    if: needs.setup.outputs.should_push == 'true'
+    runs-on: [runs-on,"runner=1cpu-linux-x64","image=ubuntu24-full-x64","run-id=${{ github.run_id }}",extras=s3-cache,spot=false]
+    strategy:
+      matrix:
+        include:
+          - { image: sih,    repo: px4-sitl }
+          - { image: gazebo, repo: px4-sitl-gazebo }
+    steps:
+      - uses: runs-on/action@v2
+
+      - name: Login to registries
+        run: |
+          echo "${{ secrets.DOCKERHUB_TOKEN }}" | docker login -u "${{ secrets.DOCKERHUB_USERNAME }}" --password-stdin
+          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
+
+      - name: Create and push multi-arch manifests
+        run: |
+          VERSION="${{ needs.setup.outputs.px4_version }}"
+
+          for REGISTRY in px4io ghcr.io/px4; do
+            IMAGE="${REGISTRY}/${{ matrix.repo }}"
+
+            for TAG in ${VERSION} latest; do
+              docker manifest create ${IMAGE}:${TAG} \
+                --amend ${IMAGE}:${TAG}-arm64 \
+                --amend ${IMAGE}:${TAG}-amd64
+
+              docker manifest annotate ${IMAGE}:${TAG} ${IMAGE}:${TAG}-arm64 --arch arm64
+              docker manifest annotate ${IMAGE}:${TAG} ${IMAGE}:${TAG}-amd64 --arch amd64
+
+              docker manifest push ${IMAGE}:${TAG}
+            done
+          done

.github/workflows/checks.yml

@@ -12,48 +12,88 @@ on:
     paths-ignore:
       - 'docs/**'
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
-  build:
-    runs-on: ubuntu-latest
+  gate_checks:
+    name: Gate Checks [${{ matrix.check }}]
+    runs-on: [runs-on,runner=2cpu-linux-x64,image=ubuntu24-full-x64,"run-id=${{ github.run_id }}",spot=false,extras=s3-cache]
+    container:
+      image: ghcr.io/px4/px4-dev:v1.17.0-rc2
     strategy:
-      fail-fast: false
+      fail-fast: true
       matrix:
         check: [
           "check_format",
           "check_newlines",
-          "tests",
-          "tests_coverage",
-          "px4_fmu-v2_default stack_check",
           "validate_module_configs",
           "shellcheck_all",
-          "NO_NINJA_BUILD=1 px4_fmu-v5_default",
-          "NO_NINJA_BUILD=1 px4_sitl_default",
-          "px4_sitl_allyes",
           "module_documentation",
         ]
     steps:
-      - uses: actions/checkout@v4
+      - uses: runs-on/action@v2
+      - uses: actions/checkout@v6
         with:
-          fetch-depth: 0
+          fetch-depth: 1
+      - name: Configure Git Safe Directory
+        run: git config --system --add safe.directory '*'
 
       - name: Building [${{ matrix.check }}]
-        uses: addnab/docker-run-action@v3
-        with:
-          image: px4io/px4-dev:v1.16.0-rc1-258-g0369abd556
-          options: -v ${{ github.workspace }}:/workspace
-          run: |
-            cd /workspace
-            git config --global --add safe.directory /workspace
-            make ${{ matrix.check }}
+        env:
+          PX4_SBOM_DISABLE: 1
+        run: make ${{ matrix.check }}
 
-      - name: Uploading Coverage to Codecov.io
-        if: contains(matrix.check, 'coverage')
-        uses: codecov/codecov-action@v1
+  tests:
+    name: Unit Tests
+    runs-on: [runs-on,runner=8cpu-linux-x64,image=ubuntu24-full-x64,"run-id=${{ github.run_id }}",spot=false,extras=s3-cache]
+    container:
+      image: ghcr.io/px4/px4-dev:v1.17.0-rc2
+    permissions:
+      contents: write
+    env:
+      GIT_COMMITTER_EMAIL: bot@px4.io
+      GIT_COMMITTER_NAME: PX4BuildBot
+    steps:
+      - uses: runs-on/action@v2
+      - uses: actions/checkout@v6
         with:
-          token: ${{ secrets.CODECOV_TOKEN }}
-          flags: unittests
-          file: coverage/lcov.info
+          fetch-depth: 1
+      - name: Configure Git Safe Directory
+        run: git config --system --add safe.directory '*'
+
+      - uses: ./.github/actions/setup-ccache
+        id: ccache
+        with:
+          cache-key-prefix: ccache-sitl
+          max-size: 300M
+
+      - name: Build and run unit tests
+        env:
+          PX4_SBOM_DISABLE: 1
+        run: make tests
+
+      - uses: ./.github/actions/save-ccache
+        if: always()
+        with:
+          cache-primary-key: ${{ steps.ccache.outputs.cache-primary-key }}
+
+      - name: Auto-update EKF change indication baselines
+        if: github.event_name == 'push'
+        uses: stefanzweifel/git-auto-commit-action@v7
+        with:
+          file_pattern: 'src/modules/ekf2/test/change_indication/*.csv'
+          commit_user_name: ${{ env.GIT_COMMITTER_NAME }}
+          commit_user_email: ${{ env.GIT_COMMITTER_EMAIL }}
+          commit_message: |
+            [AUTO COMMIT] update EKF change indication
+
+            See .github/workflows/checks.yml for more details
+
+      - name: Check for EKF functional changes
+        run: git diff --exit-code
+        working-directory: src/modules/ekf2/test/change_indication

.github/workflows/clang-tidy.yml

@@ -1,4 +1,4 @@
-name: Clang Tidy
+name: Static Analysis
 
 on:
   push:
@@ -11,20 +11,86 @@ on:
       - '**'
     paths-ignore:
       - 'docs/**'
+
+permissions:
+  contents: read
+
 jobs:
-  build:
-    runs-on: ubuntu-latest
+  clang_tidy:
+    name: Clang-Tidy
+    runs-on: [runs-on, runner=16cpu-linux-x64, "run-id=${{ github.run_id }}", "extras=s3-cache"]
+    container:
+      image: ghcr.io/px4/px4-dev:v1.17.0-rc2
+    permissions:
+      contents: read
+      pull-requests: read
     steps:
-    - uses: actions/checkout@v4
+    - uses: runs-on/action@v2
+    - uses: actions/checkout@v6
       with:
         fetch-depth: 0
+        fetch-tags: true
+    - name: Configure Git Safe Directory
+      run: git config --system --add safe.directory '*'
 
-    - name: Testing (clang-tidy)
-      uses: addnab/docker-run-action@v3
+    - uses: ./.github/actions/setup-ccache
+      id: ccache
       with:
-        image: px4io/px4-dev-clang:2021-09-08
-        options: -v ${{ github.workspace }}:/workspace
-        run: |
-          cd /workspace
-          git config --global --add safe.directory /workspace
-          make clang-tidy
+        cache-key-prefix: ccache-clang-tidy
+        max-size: 150M
+
+    - name: Build - px4_sitl_default (Clang)
+      run: make -j16 px4_sitl_default-clang
+
+    - name: Run Clang-Tidy Analysis
+      id: clang_tidy
+      run: |
+        if [ "${{ github.event_name }}" != "pull_request" ]; then
+          make -j$(nproc) clang-tidy
+        else
+          python3 Tools/ci/run-clang-tidy-pr.py origin/${{ github.base_ref }}
+        fi
+
+    # On PRs, also produce a `pr-review` artifact for the PR Review Poster
+    # workflow to consume. clang-tidy-diff-18 emits a unified fixes.yml that
+    # the producer script translates into line-anchored review comments.
+    # Running this inside the same container as the build means there is no
+    # workspace-path rewriting and no cross-runner artifact handoff.
+    - name: Export clang-tidy fixes for PR review
+      if: always() && github.event_name == 'pull_request'
+      run: |
+        mkdir -p pr-review
+        git diff -U0 origin/${{ github.base_ref }}...HEAD \
+          | clang-tidy-diff-18.py -p1 \
+              -path build/px4_sitl_default-clang \
+              -export-fixes pr-review/fixes.yml \
+              -j0 || true
+
+    - name: Build pr-review artifact
+      if: always() && github.event_name == 'pull_request'
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      run: |
+        python3 Tools/ci/clang-tidy-fixes-to-review.py \
+          --fixes pr-review/fixes.yml \
+          --repo-root "$GITHUB_WORKSPACE" \
+          --repo "$GITHUB_REPOSITORY" \
+          --pr-number "${{ github.event.pull_request.number }}" \
+          --commit-sha "${{ github.event.pull_request.head.sha }}" \
+          --out-dir pr-review \
+          --event REQUEST_CHANGES
+
+    - name: Upload pr-review artifact
+      if: always() && github.event_name == 'pull_request'
+      uses: actions/upload-artifact@v7
+      with:
+        name: pr-review
+        path: |
+          pr-review/manifest.json
+          pr-review/comments.json
+        retention-days: 1
+
+    - uses: ./.github/actions/save-ccache
+      if: always()
+      with:
+        cache-primary-key: ${{ steps.ccache.outputs.cache-primary-key }}

.github/workflows/commit_checks.yml

@@ -0,0 +1,148 @@
+name: Commit Quality
+
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened]
+
+permissions:
+  contents: read
+  pull-requests: write
+  issues: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  PR_NUMBER: ${{ github.event.pull_request.number }}
+  IS_FORK: ${{ github.event.pull_request.head.repo.full_name != github.repository }}
+
+jobs:
+  pr-title:
+    name: PR Title
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          sparse-checkout: Tools/ci
+          fetch-depth: 1
+
+      - name: Check PR title
+        id: check
+        run: |
+          python3 Tools/ci/check_pr_title.py "${{ github.event.pull_request.title }}" --markdown-file comment.md && rc=0 || rc=$?
+          echo "exit_code=$rc" >> "$GITHUB_OUTPUT"
+
+      - name: Post or clear comment
+        if: env.IS_FORK == 'false'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          if [ "${{ steps.check.outputs.exit_code }}" != "0" ]; then
+            python3 Tools/ci/pr_comment.py --marker pr-title --pr "$PR_NUMBER" --result fail < comment.md
+          else
+            python3 Tools/ci/pr_comment.py --marker pr-title --pr "$PR_NUMBER" --result pass
+          fi
+
+      - name: Result
+        if: steps.check.outputs.exit_code != '0'
+        run: |
+          echo "::error::PR title does not follow conventional commits format. See the PR comment for details."
+          exit 1
+
+  commit-messages:
+    name: Commit Messages
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          sparse-checkout: Tools/ci
+          fetch-depth: 1
+
+      - name: Check commit messages
+        id: check
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh api \
+            "repos/${{ github.repository }}/pulls/${PR_NUMBER}/commits?per_page=100" \
+            | python3 Tools/ci/check_commit_messages.py --markdown-file comment.md && rc=0 || rc=$?
+          echo "exit_code=$rc" >> "$GITHUB_OUTPUT"
+          # Check for warnings (non-empty markdown on exit 0)
+          if [ "$rc" -eq 0 ] && [ -s comment.md ]; then
+            echo "has_warnings=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "has_warnings=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Post or clear comment
+        if: env.IS_FORK == 'false'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          if [ "${{ steps.check.outputs.exit_code }}" != "0" ]; then
+            python3 Tools/ci/pr_comment.py --marker commit-msgs --pr "$PR_NUMBER" --result fail < comment.md
+          elif [ "${{ steps.check.outputs.has_warnings }}" == "true" ]; then
+            python3 Tools/ci/pr_comment.py --marker commit-msgs --pr "$PR_NUMBER" --result warn < comment.md
+          else
+            python3 Tools/ci/pr_comment.py --marker commit-msgs --pr "$PR_NUMBER" --result pass
+          fi
+
+      - name: Result
+        if: steps.check.outputs.exit_code != '0'
+        run: |
+          echo "::error::Commit message errors found. See the PR comment for details."
+          exit 1
+
+  pr-body:
+    name: PR Description
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        if: env.IS_FORK == 'false'
+        uses: actions/checkout@v6
+        with:
+          sparse-checkout: Tools/ci
+          fetch-depth: 1
+
+      - name: Check PR body
+        id: check
+        env:
+          PR_BODY: ${{ github.event.pull_request.body }}
+        run: |
+          message=""
+          if [ -z "$PR_BODY" ]; then
+            message="PR description is empty. Please add a summary of the changes."
+            echo "::warning::PR description is empty."
+          else
+            cleaned=$(echo "$PR_BODY" | sed 's/<!--.*-->//g' | tr -d '[:space:]')
+            if [ -z "$cleaned" ]; then
+              message="PR description contains only template comments. Please fill in the details."
+              echo "::warning::PR description contains only template comments."
+            fi
+          fi
+          echo "message=$message" >> "$GITHUB_OUTPUT"
+
+      - name: Post or clear comment
+        if: env.IS_FORK == 'false'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          if [ -n "${{ steps.check.outputs.message }}" ]; then
+            printf '%s\n' \
+              "## PR Description (advisory)" \
+              "" \
+              "This is **not blocking**, but your PR description appears to be empty or incomplete." \
+              "" \
+              "${{ steps.check.outputs.message }}" \
+              "" \
+              "A good PR description helps reviewers understand what changed and why." \
+              "" \
+              "---" \
+              "*This comment will be automatically removed once the issue is resolved.*" \
+            | python3 Tools/ci/pr_comment.py --marker pr-body --pr "$PR_NUMBER" --result warn
+          else
+            python3 Tools/ci/pr_comment.py --marker pr-body --pr "$PR_NUMBER" --result pass
+          fi

.github/workflows/compile_macos.yml

@@ -19,49 +19,49 @@ concurrency:
 jobs:
   build:
     runs-on: macos-latest
-    strategy:
-      matrix:
-        config: [
-          px4_fmu-v5_default,
-          px4_sitl
-          ]
     steps:
     - name: install Python 3.10
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@v6
       with:
         python-version: "3.10"
 
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
+
+    - name: Cache - Restore Homebrew Packages
+      uses: actions/cache@v5
+      with:
+        path: ~/Library/Caches/Homebrew/downloads
+        key: macos-homebrew-${{ runner.arch }}-${{ hashFiles('Tools/setup/macos.sh') }}
+        restore-keys: |
+          macos-homebrew-${{ runner.arch }}-
+
+    - name: Cache - Restore pip Packages
+      uses: actions/cache@v5
+      with:
+        path: ~/Library/Caches/pip
+        key: macos-pip-${{ runner.arch }}-${{ hashFiles('Tools/setup/requirements.txt') }}
+        restore-keys: |
+          macos-pip-${{ runner.arch }}-
 
     - name: setup
-      run: |
-        ./Tools/setup/macos.sh
+      run: ./Tools/setup/macos.sh
 
-    - name: Prepare ccache timestamp
-      id: ccache_cache_timestamp
-      shell: cmake -P {0}
-      run: |
-        string(TIMESTAMP current_date "%Y-%m-%d-%H;%M;%S" UTC)
-        message("::set-output name=timestamp::${current_date}")
-    - name: ccache cache files
-      uses: actions/cache@v4
+    - uses: ./.github/actions/setup-ccache
+      id: ccache
       with:
-        path: ~/.ccache
-        key: macos_${{matrix.config}}-ccache-${{steps.ccache_cache_timestamp.outputs.timestamp}}
-        restore-keys: macos_${{matrix.config}}-ccache-
-    - name: setup ccache
-      run: |
-          mkdir -p ~/.ccache
-          echo "base_dir = ${GITHUB_WORKSPACE}" > ~/.ccache/ccache.conf
-          echo "compression = true" >> ~/.ccache/ccache.conf
-          echo "compression_level = 6" >> ~/.ccache/ccache.conf
-          echo "max_size = 40M" >> ~/.ccache/ccache.conf
-          echo "hash_dir = false" >> ~/.ccache/ccache.conf
-          ccache -s
-          ccache -z
+        cache-key-prefix: ccache-macos
+        max-size: 200M
 
-    - name: make ${{matrix.config}}
-      run: |
-          ccache -z
-          make ${{matrix.config}}
-          ccache -s
+    - name: Build px4_sitl
+      run: make px4_sitl
+
+    - name: Cache - Stats after px4_sitl
+      run: ccache -s
+
+    - name: Build px4_fmu-v5_default
+      run: make px4_fmu-v5_default
+
+    - uses: ./.github/actions/save-ccache
+      if: always()
+      with:
+        cache-primary-key: ${{ steps.ccache.outputs.cache-primary-key }}

.github/workflows/compile_ubuntu.yml

@@ -29,12 +29,13 @@ jobs:
       fail-fast: false
       matrix:
         version: ['ubuntu:22.04', 'ubuntu:24.04']
-    runs-on: [runs-on,runner=4cpu-linux-x64,"image=ubuntu24-full-x64","run-id=${{ github.run_id }}",spot=false]
+    runs-on: [runs-on,runner=4cpu-linux-x64,"image=ubuntu24-full-x64","run-id=${{ github.run_id }}",spot=false,extras=s3-cache]
     container:
       image: ${{ matrix.version }}
       volumes:
         - /github/workspace:/github/workspace
     steps:
+      - uses: runs-on/action@v2
 
       - name: Fix git in container
         run: |
@@ -47,11 +48,25 @@ jobs:
           apt update && apt install git -y
           git config --global --add safe.directory $(realpath .)
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
-      - name: Install Deps, Build, and Make Quick Check
-        run: |
-          # we need to install dependencies and build on the same step
-          # given the stateless nature of docker images
-          ./Tools/setup/ubuntu.sh
-          make quick_check
+      - name: Use AWS regional apt mirror
+        if: startsWith(runner.name, 'runs-on--')
+        run: ./Tools/ci/use_aws_apt_mirror.sh
+
+      - name: Install Deps
+        run: ./Tools/setup/ubuntu.sh
+
+      - uses: ./.github/actions/setup-ccache
+        id: ccache
+        with:
+          cache-key-prefix: ccache-ubuntu-${{ matrix.version }}
+          max-size: 200M
+
+      - name: Make Quick Check
+        run: make quick_check
+
+      - uses: ./.github/actions/save-ccache
+        if: always()
+        with:
+          cache-primary-key: ${{ steps.ccache.outputs.cache-primary-key }}

.github/workflows/dev_container.yml

@@ -24,6 +24,11 @@ on:
         description: 'Container tag (e.g. v1.16.0)'
         required: true
         type: string
+      build_ref:
+        description: 'Git ref to build from (branch, tag, or SHA). Leave empty to build from the dispatch ref.'
+        required: false
+        type: string
+        default: ''
       deploy_to_registry:
         description: 'Whether to push built images to the registry'
         required: false
@@ -45,12 +50,12 @@ jobs:
       meta_tags: ${{ steps.meta.outputs.tags }}
       meta_labels: ${{ steps.meta.outputs.labels }}
     steps:
-      - uses: runs-on/action@v1
-      - uses: actions/checkout@v4
+      - uses: runs-on/action@v2
+      - uses: actions/checkout@v6
         with:
-          fetch-tags: true
-          submodules: false
+          ref: ${{ github.event.inputs.build_ref || github.ref }}
           fetch-depth: 0
+          fetch-tags: true
 
       # If manual dispatch, take the user‐provided input
       - name: Set PX4 Tag Version
@@ -64,7 +69,7 @@ jobs:
 
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
         with:
           images: |
             ghcr.io/PX4/px4-dev
@@ -89,22 +94,22 @@ jobs:
             runner: x64
     runs-on: [runs-on,"runner=4cpu-linux-${{ matrix.runner }}","image=ubuntu24-full-${{ matrix.runner }}","run-id=${{ github.run_id }}",extras=s3-cache,spot=false]
     steps:
-      - uses: runs-on/action@v1
-      - uses: actions/checkout@v4
+      - uses: runs-on/action@v2
+      - uses: actions/checkout@v6
         with:
-          fetch-tags: true
-          submodules: false
+          ref: ${{ github.event.inputs.build_ref || github.ref }}
           fetch-depth: 0
+          fetch-tags: true
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         if: ${{ startsWith(github.ref, 'refs/tags/') || (github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_to_registry) }}
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         if: ${{ startsWith(github.ref, 'refs/tags/') || (github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_to_registry) }}
         with:
           registry: ghcr.io
@@ -112,13 +117,13 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
         with:
           driver: docker-container
           platforms: ${{ matrix.platform }}
 
       - name: Build and Load Container Image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         id: docker
         with:
           context: Tools/setup
@@ -130,8 +135,8 @@ jobs:
           load: false
           push: ${{ startsWith(github.ref, 'refs/tags/') || (github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_to_registry) }}
           provenance: false
-          cache-from: type=gha,version=1,scope=${{ matrix.arch }}
-          cache-to: type=gha,version=1,mode=max,scope=${{ matrix.arch }}
+          cache-from: type=gha,scope=${{ matrix.arch }}
+          cache-to: type=gha,mode=max,scope=${{ matrix.arch }},ignore-error=true
 
   deploy:
     name: Deploy To Registry
@@ -140,23 +145,26 @@ jobs:
       packages: write
     runs-on: [runs-on,"runner=4cpu-linux-x64","image=ubuntu24-full-x64","run-id=${{ github.run_id }}",extras=s3-cache,spot=false]
     needs: [build, setup]
-    if: ${{ startsWith(github.ref, 'refs/tags/') || (github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_to_registry) }}
+    if: |
+      !cancelled() &&
+      needs.setup.result == 'success' &&
+      (startsWith(github.ref, 'refs/tags/') || (github.event_name == 'workflow_dispatch' && github.event.inputs.deploy_to_registry == 'true'))
     steps:
-      - uses: runs-on/action@v1
-      - uses: actions/checkout@v4
+      - uses: runs-on/action@v2
+      - uses: actions/checkout@v6
         with:
-          fetch-tags: true
-          submodules: false
+          ref: ${{ github.event.inputs.build_ref || github.ref }}
           fetch-depth: 0
+          fetch-tags: true
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -164,10 +172,10 @@ jobs:
 
       - name: Verify Images Exist Before Creating Manifest
         run: |
-          docker manifest inspect px4io/px4-dev:${{ needs.setup.outputs.px4_version }}-arm64 || echo "⚠️ Warning: No ARM64 image found!"
-          docker manifest inspect px4io/px4-dev:${{ needs.setup.outputs.px4_version }}-amd64 || echo "⚠️ Warning: No AMD64 image found!"
-          docker manifest inspect ghcr.io/px4/px4-dev:${{ needs.setup.outputs.px4_version }}-arm64 || echo "⚠️ Warning: No ARM64 image found!"
-          docker manifest inspect ghcr.io/px4/px4-dev:${{ needs.setup.outputs.px4_version }}-amd64 || echo "⚠️ Warning: No AMD64 image found!"
+          docker manifest inspect px4io/px4-dev:${{ needs.setup.outputs.px4_version }}-arm64
+          docker manifest inspect px4io/px4-dev:${{ needs.setup.outputs.px4_version }}-amd64
+          docker manifest inspect ghcr.io/px4/px4-dev:${{ needs.setup.outputs.px4_version }}-arm64
+          docker manifest inspect ghcr.io/px4/px4-dev:${{ needs.setup.outputs.px4_version }}-amd64
 
       - name: Create and Push Multi-Arch Manifest for Docker Hub
         run: |

.github/workflows/docs-orchestrator.yml

@@ -0,0 +1,430 @@
+# Docs - Orchestrator
+#
+# Trigger paths:
+#   push (main, release/**)  → metadata-regen → build-site → deploy-aws
+#   pull_request              → detect-changes → pr-metadata-regen → link-check → build-site (if docs/source changed)
+#   workflow_dispatch         → metadata-regen → build-site → deploy-aws
+#
+# Container jobs (pr-metadata-regen, metadata-regen) run in px4-dev image and
+# require safe.directory + fetch-depth: 0 for git operations.
+
+name: Docs - Orchestrator
+
+on:
+  push:
+    branches:
+      - "main"
+      - "release/**"
+    paths:
+      - "docs/**"
+      - "src/**"
+      - "msg/**"
+      - "ROMFS/**"
+      - "Tools/module_config/**"
+      - ".github/workflows/docs-orchestrator.yml"
+  pull_request:
+    paths:
+      - "docs/**"
+      - ".github/workflows/docs-orchestrator.yml"
+  workflow_dispatch:
+
+concurrency:
+  group: docs-orchestrator-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  # =============================================================================
+  # Detect Changes (PR only)
+  # =============================================================================
+  detect-changes:
+    name: "T1: Detect Changes"
+    if: github.event_name == 'pull_request'
+    permissions:
+      contents: read
+    runs-on: ubuntu-latest
+    outputs:
+      source_changed: ${{ steps.changes.outputs.source }}
+      docs_changed: ${{ steps.changes.outputs.docs }}
+    steps:
+      - uses: actions/checkout@v6
+      - uses: dorny/paths-filter@v4
+        id: changes
+        with:
+          filters: |
+            source:
+              - 'src/**'
+              - 'msg/**'
+              - 'ROMFS/**'
+              - 'Tools/module_config/**'
+            docs:
+              - 'docs/**'
+
+  # =============================================================================
+  # PR Metadata Regen (conditional - only when PR touches source files)
+  # =============================================================================
+  pr-metadata-regen:
+    name: "T2: PR Metadata"
+    needs: [detect-changes]
+    if: github.event_name == 'pull_request' && needs.detect-changes.outputs.source_changed == 'true'
+    permissions:
+      contents: read
+    runs-on: [runs-on,runner=4cpu-linux-x64,image=ubuntu24-full-x64,"run-id=${{ github.run_id }}",spot=false,extras=s3-cache]
+    container:
+      image: ghcr.io/px4/px4-dev:v1.17.0-rc2
+    steps:
+      - uses: runs-on/action@v2
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          submodules: recursive
+      - name: Configure Git Safe Directory
+        run: git config --system --add safe.directory '*'
+
+      - name: Cache Restore - ccache
+        id: cache-ccache
+        uses: actions/cache/restore@v5
+        with:
+          path: ~/.ccache
+          key: ccache-docs-metadata-${{ github.sha }}
+          restore-keys: |
+            ccache-docs-metadata-
+
+      - name: Setup ccache
+        run: |
+          mkdir -p ~/.ccache
+          echo "max_size = 1G" > ~/.ccache/ccache.conf
+
+      - name: Build px4_sitl_default
+        run: |
+          make px4_sitl_default
+        env:
+          CCACHE_DIR: ~/.ccache
+
+      - name: Cache Save - ccache
+        uses: actions/cache/save@v5
+        if: always()
+        with:
+          path: ~/.ccache
+          key: ccache-docs-metadata-${{ github.sha }}
+
+      - name: Generate and sync metadata
+        run: Tools/ci/metadata_sync.sh --generate --sync parameters airframes modules msg_docs failsafe_web
+        env:
+          CCACHE_DIR: ~/.ccache
+
+      - name: Upload metadata artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: pr-metadata
+          path: docs/
+          retention-days: 1
+
+  # =============================================================================
+  # Push Metadata Regen (main/release branches)
+  # =============================================================================
+  metadata-regen:
+    name: "T2: Metadata Sync"
+    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
+    permissions:
+      contents: write
+    runs-on: [runs-on,runner=4cpu-linux-x64,image=ubuntu24-full-x64,"run-id=${{ github.run_id }}",spot=false,extras=s3-cache]
+    container:
+      image: ghcr.io/px4/px4-dev:v1.17.0-rc2
+    steps:
+      - uses: runs-on/action@v2
+
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          submodules: recursive
+          token: ${{ secrets.PX4BUILTBOT_PERSONAL_ACCESS_TOKEN }}
+
+      - name: Git ownership workaround
+        run: git config --system --add safe.directory '*'
+
+      - name: Cache Restore - ccache
+        id: cache-ccache
+        uses: actions/cache/restore@v5
+        with:
+          path: ~/.ccache
+          key: ccache-docs-metadata-${{ github.sha }}
+          restore-keys: |
+            ccache-docs-metadata-
+
+      - name: Setup ccache
+        run: |
+          mkdir -p ~/.ccache
+          echo "max_size = 1G" > ~/.ccache/ccache.conf
+
+      - name: Build px4_sitl_default
+        run: |
+          make px4_sitl_default
+        env:
+          CCACHE_DIR: ~/.ccache
+
+      - name: Cache Save - ccache
+        uses: actions/cache/save@v5
+        if: always()
+        with:
+          path: ~/.ccache
+          key: ccache-docs-metadata-${{ github.sha }}
+
+      - name: Generate and sync metadata
+        run: Tools/ci/metadata_sync.sh --generate --sync parameters airframes modules msg_docs failsafe_web
+        env:
+          CCACHE_DIR: ~/.ccache
+
+      - name: Install Node.js and Yarn
+        run: |
+          curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
+          apt-get install -y nodejs
+          corepack enable
+
+      - name: Format markdown with Prettier
+        run: |
+          cd docs
+          yarn install --frozen-lockfile
+          yarn prettier --write "en/**/*.md"
+
+      - name: Commit and push changes
+        run: |
+          git config --global user.name "${{ secrets.PX4BUILDBOT_USER }}"
+          git config --global user.email "${{ secrets.PX4BUILDBOT_EMAIL }}"
+          git add docs/
+          if git diff --staged --quiet; then
+            echo "No changes to commit"
+          else
+            git commit -m "docs: auto-sync metadata [skip ci]
+
+            Co-Authored-By: PX4 BuildBot <${{ secrets.PX4BUILDBOT_EMAIL }}>"
+            git push
+          fi
+
+  # =============================================================================
+  # Link Check
+  # =============================================================================
+  link-check:
+    name: "T2: Link Check"
+    needs: [detect-changes, pr-metadata-regen]
+    if: always() && (github.event_name == 'pull_request')
+    permissions:
+      contents: read
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0
+
+      - name: Download metadata artifact
+        if: needs.pr-metadata-regen.result == 'success'
+        uses: actions/download-artifact@v8
+        with:
+          name: pr-metadata
+          path: docs/
+
+      - name: Get changed doc files
+        id: changed-files
+        uses: tj-actions/changed-files@v47
+        with:
+          json: true
+          write_output_files: true
+          output_dir: ./logs
+          base_sha: ${{ github.event.pull_request.base.sha }}
+          sha: ${{ github.event.pull_request.head.sha }}
+          files: |
+            docs/en/**/*.md
+
+      - name: Save changed files list
+        run: |
+          mv ./logs/all_changed_files.json ./logs/prFiles.json
+          echo "Changed files:"
+          cat ./logs/prFiles.json
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: 20
+
+      - name: Run filtered link checker (changed files)
+        run: |
+          npm -g install markdown_link_checker_sc@0.0.138
+          if [ "$(jq length ./logs/prFiles.json)" -gt 0 ]; then
+            markdown_link_checker_sc \
+              -r "$GITHUB_WORKSPACE" \
+              -d docs \
+              -e en \
+              -f ./logs/prFiles.json \
+              -i assets \
+              -u docs.px4.io/main/ \
+              > ./logs/filtered-link-check-results.md || true
+          fi
+          if [ ! -s ./logs/filtered-link-check-results.md ]; then
+            echo "No broken links found in changed files." > ./logs/filtered-link-check-results.md
+          fi
+          cat ./logs/filtered-link-check-results.md
+
+      - name: Run full link checker
+        run: |
+          markdown_link_checker_sc \
+            -r "$GITHUB_WORKSPACE" \
+            -d docs \
+            -e en \
+            -i assets \
+            -u docs.px4.io/main/ \
+            > ./logs/link-check-results.md || true
+          cat ./logs/link-check-results.md
+
+      - name: Prepare pr-comment artifact
+        id: prepare-pr-comment
+        run: |
+          if [ ! -s ./logs/filtered-link-check-results.md ]; then
+            echo "No link-check results file; skipping pr-comment artifact."
+            echo "prepared=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          mkdir -p pr-comment
+          cp ./logs/filtered-link-check-results.md pr-comment/body.md
+          cat > pr-comment/manifest.json <<EOF
+          {
+            "pr_number": ${{ github.event.pull_request.number }},
+            "marker": "<!-- pr-comment-poster:docs-link-check -->",
+            "mode": "upsert"
+          }
+          EOF
+          echo "prepared=true" >> "$GITHUB_OUTPUT"
+
+      - name: Upload pr-comment artifact
+        if: steps.prepare-pr-comment.outputs.prepared == 'true'
+        uses: actions/upload-artifact@v7
+        with:
+          name: pr-comment
+          path: pr-comment/
+          retention-days: 1
+
+      - name: Upload link check results
+        uses: actions/upload-artifact@v7
+        with:
+          name: link-check-results
+          path: logs/
+          retention-days: 7
+
+  # =============================================================================
+  # Build Site
+  # =============================================================================
+  build-site:
+    name: "T3: Build Site"
+    needs: [detect-changes, pr-metadata-regen, metadata-regen, link-check]
+    if: >-
+      always() &&
+      (needs.metadata-regen.result == 'success' || needs.metadata-regen.result == 'skipped') &&
+      (needs.link-check.result == 'success' || needs.link-check.result == 'skipped') &&
+      (github.event_name != 'pull_request' || needs.detect-changes.outputs.docs_changed == 'true' || needs.detect-changes.outputs.source_changed == 'true')
+    permissions:
+      contents: read
+    runs-on: [runs-on,runner=4cpu-linux-x64,image=ubuntu24-full-x64,"run-id=${{ github.run_id }}",spot=false,extras=s3-cache]
+    outputs:
+      branchname: ${{ steps.set-branch.outputs.branchname }}
+      releaseversion: ${{ steps.set-version.outputs.releaseversion }}
+    steps:
+      - uses: runs-on/action@v2
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
+
+      - name: Download metadata artifact (PR)
+        if: github.event_name == 'pull_request' && needs.pr-metadata-regen.result == 'success'
+        uses: actions/download-artifact@v8
+        with:
+          name: pr-metadata
+          path: docs/
+
+      - id: set-branch
+        run: echo "branchname=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}" >> $GITHUB_OUTPUT
+
+      - id: set-version
+        run: |
+          branch="${{ steps.set-branch.outputs.branchname }}"
+          if [[ "$branch" == "main" ]]; then
+            version="main"
+          elif [[ "$branch" =~ ^release/ ]]; then
+            version="v${branch#release/}"
+          elif [[ "${{ github.event_name }}" == "pull_request" ]]; then
+            version="main"
+          else
+            echo "::error::Unsupported branch for docs deploy: $branch (expected main or release/*)"
+            exit 1
+          fi
+          echo "releaseversion=$version" >> $GITHUB_OUTPUT
+
+      - name: Setup Node
+        uses: actions/setup-node@v6
+        with:
+          node-version: 20
+          cache: npm
+          cache-dependency-path: ./docs/yarn.lock
+
+      - name: Install dependencies
+        run: yarn install --frozen-lockfile --cwd ./docs
+
+      - name: Build with VitePress
+        working-directory: ./docs
+        env:
+          BRANCH_NAME: ${{ steps.set-version.outputs.releaseversion }}
+        run: |
+          npm run docs:build_ubuntu
+          touch .vitepress/dist/.nojekyll
+          npm run docs:sitemap
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: px4_docs_build
+          path: docs/.vitepress/dist/
+          retention-days: 1
+
+  # =============================================================================
+  # Deploy to AWS (push + workflow_dispatch)
+  # =============================================================================
+  deploy-aws:
+    name: "T4: Deploy"
+    needs: [metadata-regen, build-site]
+    if: >-
+      always() &&
+      needs.metadata-regen.result == 'success' &&
+      needs.build-site.result == 'success' &&
+      (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
+    permissions:
+      id-token: write
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download Artifact
+        uses: actions/download-artifact@v8
+        with:
+          name: px4_docs_build
+          path: ~/_book
+
+      - name: Configure AWS from OIDC
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
+          aws-region: us-west-2
+
+      - name: Sanity check AWS credentials
+        run: aws sts get-caller-identity
+
+      - name: Upload HTML with short cache
+        run: |
+          aws s3 sync ~/_book/ s3://px4-docs/${{ needs.build-site.outputs.releaseversion }}/ \
+            --delete \
+            --exclude "*" --include "*.html" \
+            --cache-control "public, max-age=60"
+
+      - name: Upload assets with long cache
+        run: |
+          aws s3 sync ~/_book/ s3://px4-docs/${{ needs.build-site.outputs.releaseversion }}/ \
+            --delete \
+            --exclude "*.html" \
+            --cache-control "public, max-age=86400, immutable"

.github/workflows/docs_crowdin_download.yml

@@ -22,7 +22,7 @@ jobs:
         lc: [ko, uk, zh-CN] # Target languages https://developer.crowdin.com/language-codes/
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Debug Environment Variables
         run: |
           echo "CROWDIN_PROJECT_ID: ${{ secrets.CROWDIN_DOCS_PROJECT_ID }}"
@@ -34,13 +34,13 @@ jobs:
           upload_sources: false
           upload_translations: false
           download_translations: true
-          commit_message: New Crowdin translations - ${{ matrix.lc }}
+          commit_message: 'docs(i18n): PX4 guide translations (Crowdin) - ${{ matrix.lc }}'
           localization_branch_name: l10n_crowdin_docs_translations_${{ matrix.lc }}
           crowdin_branch_name: main
           create_pull_request: true
           pull_request_base_branch_name: 'main'
-          pull_request_title: New PX4 guide translations (Crowdin) - ${{ matrix.lc }}
-          pull_request_body: 'New PX4 guide Crowdin translations by [Crowdin GH Action](https://github.com/crowdin/github-action) for ${{ matrix.lc }}'
+          pull_request_title: 'docs(i18n): PX4 guide translations (Crowdin) - ${{ matrix.lc }}'
+          pull_request_body: 'docs(i18n): PX4 guide Crowdin translations by [Crowdin GH Action](https://github.com/crowdin/github-action) for ${{ matrix.lc }}'
           pull_request_labels: 'Documentation 📑'
           pull_request_reviewers: hamishwillee
           download_language: ${{ matrix.lc }}

.github/workflows/docs_crowdin_upload.yml

@@ -24,7 +24,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: crowdin push
         uses: crowdin/github-action@v2
         with:

.github/workflows/docs_deploy.yml

@@ -22,12 +22,11 @@ jobs:
   build:
     runs-on: [runs-on,runner=4cpu-linux-x64,image=ubuntu24-full-x64,"run-id=${{ github.run_id }}",extras=s3-cache,spot=false]
     steps:
-      - uses: runs-on/action@v1
-      - name: Checkout
-        uses: actions/checkout@v4
+      - uses: runs-on/action@v2
+      - uses: actions/checkout@v6
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: 20
           cache: npm
@@ -46,7 +45,7 @@ jobs:
 
       - name: Upload artifact
         if: ${{ github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.merged) || github.event_name == 'workflow_dispatch' }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: px4_docs_build
           path: docs/.vitepress/dist/
@@ -59,7 +58,7 @@ jobs:
 
     steps:
       - name: Download Artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           name: px4_docs_build
           path: ~/_book

.github/workflows/docs_deploy_aws.yml

@@ -1,116 +0,0 @@
-name: Docs - Deploy PX4 User Guide to AWS
-
-on:
-  push:
-    branches:
-      - "main"
-      - "release/**"
-    paths:
-      - "docs/en/**"
-      - "docs/zh/**"
-      - "docs/uk/**"
-      - "docs/ko/**"
-  pull_request:
-    paths:
-      - "docs/en/**"
-      - "docs/zh/**"
-      - "docs/uk/**"
-      - "docs/ko/**"
-
-  workflow_dispatch:
-
-permissions:
-  contents: read
-  actions: read
-  id-token: write # for AWS OIDC
-
-concurrency:
-  group: docs-deploy
-  cancel-in-progress: false
-
-jobs:
-  build:
-    runs-on: [runs-on,runner=4cpu-linux-x64,image=ubuntu24-full-x64,"run-id=${{ github.run_id }}",spot=false,extras=s3-cache]
-    outputs:
-      branchname: ${{ steps.set-branch.outputs.branchname }}
-      releaseversion: ${{ steps.set-version.outputs.releaseversion }}
-    steps:
-      - uses: runs-on/action@v1
-
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - id: set-branch
-        run: echo "branchname=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}" >> $GITHUB_OUTPUT
-
-      - id: set-version
-        run: |
-          branch="${{ steps.set-branch.outputs.branchname }}"
-          if [[ "$branch" == "main" ]]; then
-            version="main"
-          else
-            version="v${branch#release/}"
-          fi
-          echo "releaseversion=$version" >> $GITHUB_OUTPUT
-
-      - name: Setup Node
-        uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: npm
-          cache-dependency-path: ./docs/yarn.lock
-
-      - name: Install dependencies
-        run: yarn install --frozen-lockfile --cwd ./docs
-
-      - name: Build with VitePress
-        working-directory: ./docs
-        env:
-          BRANCH_NAME: ${{ steps.set-version.outputs.releaseversion }}
-        run: |
-          npm run docs:build_ubuntu
-          touch .vitepress/dist/.nojekyll
-          npm run docs:sitemap
-
-      - name: Upload artifact
-        if: ${{ github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.merged) || github.event_name == 'workflow_dispatch' }}
-        uses: actions/upload-artifact@v4
-        with:
-          name: px4_docs_build
-          path: docs/.vitepress/dist/
-          retention-days: 1
-
-  deploy:
-    if: ${{ github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.merged) || github.event_name == 'workflow_dispatch' }}
-    needs: build
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Download Artifact
-        uses: actions/download-artifact@v4
-        with:
-          name: px4_docs_build
-          path: ~/_book
-
-      - name: Configure AWS from OIDC
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
-          aws-region: us-west-2
-
-      - name: Sanity check AWS credentials
-        run: aws sts get-caller-identity
-
-      - name: Upload HTML with short cache
-        run: |
-          aws s3 sync ~/_book/ s3://px4-docs/${{ needs.build.outputs.releaseversion }}/ \
-            --delete \
-            --exclude "*" --include "*.html" \
-            --cache-control "public, max-age=60"
-
-      - name: Upload assets with long cache
-        run: |
-          aws s3 sync ~/_book/ s3://px4-docs/${{ needs.build.outputs.releaseversion }}/ \
-            --delete \
-            --exclude "*.html" \
-            --cache-control "public, max-age=86400, immutable"

.github/workflows/docs_flaw_checker.yml

@@ -1,85 +0,0 @@
-name: Docs - Check for flaws in PX4 Guide Source
-# So far:
-  # Modifications of translations files
-  # Broken internal links
-
-on:
-  pull_request_target:
-    types: [opened, edited, synchronize]
-    paths:
-      - 'docs/en/**'
-
-jobs:
-  check_flaws:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-
-      - name: Install Node.js
-        uses: actions/setup-node@v3
-        with:
-          node-version: '18'
-
-      - name: Create logs directory
-        run: |
-          mkdir logs
-
-      - name: Get changed english doc files
-        id: get_changed_markdown_english
-        uses: tj-actions/changed-files@v46.0.5
-        with:
-          json: true
-          base_sha: "${{ github.event.pull_request.base.sha }}"
-          sha: "${{ github.event.pull_request.head.sha }}"
-          # Below are used to output files to a directory. May use in flaw checker.
-          # write_output_files: true
-          # output_dir: "./logs"
-          files: |
-            docs/en/**/*.md
-
-      - name: Save JSON file containing files to link check
-        run: |
-          echo "$ALL_CHANGED_FILES"
-          # echo "$ALL_CHANGED_FILES" > ./logs/prFiles.json
-          echo "$ALL_CHANGED_FILES" | sed 's/\\//g' | jq '.' > ./logs/prFiles.json
-        env:
-          ALL_CHANGED_FILES: ${{ steps.get_changed_markdown_english.outputs.all_changed_files }}
-
-      - name: Run link checker
-        id: link-check
-        run: |
-          npm -g install markdown_link_checker_sc@0.0.138
-          markdown_link_checker_sc \
-            -r "$GITHUB_WORKSPACE" \
-            -d docs \
-            -e en \
-            -f ./logs/prFiles.json \
-            -i assets \
-            -u docs.px4.io/main/ \
-            > ./logs/errorsFilteredByPrPages.md
-          mkdir -p ./pr
-          cp ./logs/errorsFilteredByPrPages.md ./pr/errorsFilteredByPrPages.md
-
-      - name: Read errorsFilteredByPrPages.md file
-        id: read-errors-by-page
-        uses: juliangruber/read-file-action@v1
-        with:
-          path: ./logs/errorsFilteredByPrPages.md
-
-      - name: Echo Errors by Page
-        run: echo "$ERRORS"
-        env:
-          ERRORS: ${{ steps.read-errors-by-page.outputs.content }}
-
-      - name: Save PR number
-        run: echo "$PR_NUMBER" > ./pr/pr_number
-        env:
-          PR_NUMBER: ${{ github.event.number }}
-
-      - uses: actions/upload-artifact@v4
-        with:
-          name: pr_number
-          path: pr/

.github/workflows/docs_pr_comment.yml

@@ -1,111 +0,0 @@
-name: Docs - Comment Workflow
-on:
-  workflow_run:
-    workflows: ["Docs - Check for flaws in PX4 Guide Source"]
-    types:
-      - completed
-
-jobs:
-  comment:
-    permissions:
-      pull-requests: write # for marocchino/sticky-pull-request-comment
-    name: Comments
-    runs-on: ubuntu-latest
-    steps:
-      - name: 'Download PR artifact'
-        uses: actions/github-script@v6
-        with:
-          script: |
-            let allArtifacts = await github.rest.actions.listWorkflowRunArtifacts({
-               owner: context.repo.owner,
-               repo: context.repo.repo,
-               run_id: context.payload.workflow_run.id,
-            });
-            let matchArtifact = allArtifacts.data.artifacts.filter((artifact) => {
-              return artifact.name == "pr_number"
-            })[0];
-            let download = await github.rest.actions.downloadArtifact({
-               owner: context.repo.owner,
-               repo: context.repo.repo,
-               artifact_id: matchArtifact.id,
-               archive_format: 'zip',
-            });
-            let fs = require('fs');
-            fs.writeFileSync(`${process.env.GITHUB_WORKSPACE}/pr_number.zip`, Buffer.from(download.data));
-
-      - name: 'Unzip artifact'
-        run: unzip pr_number.zip
-
-      # Doesn't work across workflows
-      #- name: Get artifacts from flaw checker workflow
-      #  uses: actions/download-artifact@v3
-      #  with:
-      #    name: logs_and_errors
-      #    #path: ./logs
-
-      - name: Read errorsFilteredByPrPages.md file
-        id: read-errors-by-page
-        uses: juliangruber/read-file-action@v1
-        with:
-          path: ./errorsFilteredByPrPages.md
-
-      - name: Read PR number
-        id: read-error-pr-number
-        uses: juliangruber/read-file-action@v1
-        with:
-          path: ./pr_number
-
-      - name: File detail info
-        run: |
-          echo "$ERRORS"
-          echo "$PRNUM"
-        env:
-          ERRORS: ${{ steps.read-errors-by-page.outputs.content }}
-          PRNUM: ${{ steps.read-error-pr-number.outputs.content }}
-
-      - name: Create or update comment
-        id: comment_to_pr
-        uses: marocchino/sticky-pull-request-comment@v2
-        with:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          recreate: true
-          number: ${{ steps.read-error-pr-number.outputs.content }}
-          header: flaws
-          message: ${{ steps.read-errors-by-page.outputs.content || 'No flaws found' }}
-
-      #- name: Dump GitHub context
-      #  env:
-      #    GITHUB_CONTEXT: ${{ toJSON(github) }}
-      #  run: echo "$GITHUB_CONTEXT"
-
-      # Would like to do this, but it doesn't work (for me).
-      # Moving to time-based, or triggering on workflow
-      #- name: Wait for artifacts upload to succeed
-      #  uses: lewagon/wait-on-check-action@v1.3.1
-      #  with:
-      #    ref: ${{ github.ref }}
-      #    check-name: 'Archive production artifacts'
-      #    repo-token: ${{ secrets.GITHUB_TOKEN }}
-      #    wait-interval: 80
-
-      # Not needed for now - trying to trigger off the workflow
-      #- name: Sleep for 80 seconds
-      #  run: sleep 80s
-      #  shell: bash
-      #- name: Find Comment
-      #  uses: peter-evans/find-comment@v2
-      #  id: fc
-      #  with:
-      #    issue-number: ${{ steps.read-error-pr-number.outputs.content }}
-      #    comment-author: 'github-actions[bot]'
-      #    body-includes: Flaws (may be none)
-
-      #- name: Create or update comment
-      #  uses: peter-evans/create-or-update-comment@v3
-      #  with:
-      #    comment-id: ${{ steps.fc.outputs.comment-id }}
-      #    issue-number: ${{ steps.read-error-pr-number.outputs.content }}
-      #    body: |
-      #      Flaws (may be none)
-      #      ${{ steps.read-errors-by-page.outputs.content }}
-      #    edit-mode: replace

.github/workflows/ekf_functional_change_indicator.yml

@@ -1,35 +0,0 @@
-name: EKF Change Indicator
-
-on:
-  pull_request:
-    branches:
-      - '**'
-    paths-ignore:
-      - 'docs/**'
-
-# If two events are triggered within a short time in the same PR, cancel the run of the oldest event
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
-
-jobs:
-  unit_tests:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v4
-      with:
-        fetch-depth: 0
-
-    - name: main test
-      uses: addnab/docker-run-action@v3
-      with:
-        image: px4io/px4-dev:v1.16.0-rc1-258-g0369abd556
-        options: -v ${{ github.workspace }}:/workspace
-        run: |
-          cd /workspace
-          git config --global --add safe.directory /workspace
-          make tests TESTFILTER=EKF
-
-    - name: Check if there is a functional change
-      run: git diff --exit-code
-      working-directory: src/modules/ekf2/test/change_indication

.github/workflows/ekf_update_change_indicator.yml

@@ -1,47 +0,0 @@
-name: EKF Update Change Indicator
-
-on:
-  push:
-    paths-ignore:
-      - 'docs/**'
-
-jobs:
-  unit_tests:
-    runs-on: ubuntu-latest
-    env:
-      GIT_COMMITTER_EMAIL: bot@px4.io
-      GIT_COMMITTER_NAME: PX4BuildBot
-    steps:
-    - uses: actions/checkout@v4
-      with:
-        fetch-depth: 0
-
-    - name: main test
-      uses: addnab/docker-run-action@v3
-      with:
-        image: px4io/px4-dev:v1.16.0-rc1-258-g0369abd556
-        options: -v ${{ github.workspace }}:/workspace
-        run: |
-          cd /workspace
-          git config --global --add safe.directory /workspace
-          make tests TESTFILTER=EKF
-
-    - name: Check if there exists diff and save result in variable
-      id: diff-check
-      run: echo "CHANGE_INDICATED=$(git diff --exit-code --output=/dev/null || echo $?)" >> $GITHUB_OUTPUT
-      working-directory: src/modules/ekf2/test/change_indication
-
-    - name: auto-commit any changes to change indication
-      uses: stefanzweifel/git-auto-commit-action@v4
-      with:
-        file_pattern: 'src/modules/ekf2/test/change_indication/*.csv'
-        commit_user_name: ${GIT_COMMITTER_NAME}
-        commit_user_email: ${GIT_COMMITTER_EMAIL}
-        commit_message: |
-          '[AUTO COMMIT] update change indication'
-
-          See .github/workflopws/ekf_update_change_indicator.yml for more details
-
-    - name: if there is a functional change, fail check
-      if: ${{ steps.diff-check.outputs.CHANGE_INDICATED }}
-      run: exit 1

.github/workflows/failsafe_sim.yml

@@ -18,7 +18,7 @@ concurrency:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: [runs-on,runner=4cpu-linux-x64,image=ubuntu24-full-x64,"run-id=${{ github.run_id }}",spot=false,extras=s3-cache]
     defaults:
       run:
         shell: bash
@@ -29,22 +29,30 @@ jobs:
           "failsafe_web",
         ]
     container:
-      image: px4io/px4-dev:v1.16.0-rc1-258-g0369abd556
+      image: ghcr.io/px4/px4-dev:v1.17.0-rc2
       options: --privileged --ulimit core=-1 --security-opt seccomp=unconfined
     steps:
+      - uses: runs-on/action@v2
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - name: Configure Git Safe Directory
+        run: git config --system --add safe.directory '*'
+
       - name: Install Node v20.18.0
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: 20.18.0
 
-      - uses: actions/checkout@v4
+      - name: Cache - Restore Emscripten SDK
+        id: cache-emsdk
+        uses: actions/cache@v5
         with:
-          fetch-depth: 0
-
-      - name: Git ownership workaround
-        run: git config --system --add safe.directory '*'
+          path: _emscripten_sdk
+          key: emsdk-4.0.15
 
       - name: Install empscripten
+        if: steps.cache-emsdk.outputs.cache-hit != 'true'
         run: |
           git clone https://github.com/emscripten-core/emsdk.git _emscripten_sdk
           cd _emscripten_sdk

.github/workflows/flash_analysis.yml

@@ -24,9 +24,9 @@ env:
 jobs:
   analyze_flash:
     name: Analyzing ${{ matrix.target }}
-    runs-on: [runs-on,runner=4cpu-linux-x64,image=ubuntu24-full-x64,"run-id=${{ github.run_id }}",spot=false]
+    runs-on: [runs-on,runner=4cpu-linux-x64,image=ubuntu24-full-x64,"run-id=${{ github.run_id }}",spot=false,extras=s3-cache]
     container:
-      image: px4io/px4-dev:v1.16.0-rc1-258-g0369abd556
+      image: ghcr.io/px4/px4-dev:v1.17.0-rc2
     strategy:
       matrix:
         target: [px4_fmu-v5x, px4_fmu-v6x]
@@ -36,25 +36,58 @@ jobs:
       px4_fmu-v6x-bloaty-output: ${{ steps.gen-output.outputs.px4_fmu-v6x-bloaty-output }}
       px4_fmu-v6x-bloaty-summary-map: ${{ steps.gen-output.outputs.px4_fmu-v6x-bloaty-summary-map }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: runs-on/action@v2
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
           submodules: recursive
-
-      - name: Git ownership workaround
+      - name: Configure Git Safe Directory
         run: git config --system --add safe.directory '*'
 
+      - name: Cache - Restore ccache (current)
+        id: cache_current
+        uses: actions/cache/restore@v5
+        with:
+          path: ~/.ccache
+          key: ccache-flash-${{ matrix.target }}-current-${{ github.ref_name }}-${{ github.sha }}
+          restore-keys: |
+            ccache-flash-${{ matrix.target }}-current-${{ github.ref_name }}-
+            ccache-flash-${{ matrix.target }}-current-
+
+      - name: Cache - Configure ccache
+        run: |
+          mkdir -p ~/.ccache
+          echo "base_dir = ${GITHUB_WORKSPACE}" > ~/.ccache/ccache.conf
+          echo "compression = true" >> ~/.ccache/ccache.conf
+          echo "compression_level = 6" >> ~/.ccache/ccache.conf
+          echo "max_size = 200M" >> ~/.ccache/ccache.conf
+          echo "hash_dir = false" >> ~/.ccache/ccache.conf
+          echo "compiler_check = content" >> ~/.ccache/ccache.conf
+          ccache -s
+          ccache -z
+
       - name: Build Target
         run: make ${{ matrix.target }}_flash-analysis
 
       - name: Store the ELF with the change
         run: cp ./build/**/*.elf ./with-change.elf
 
+      - name: Cache - Stats after Current Build
+        run: ccache -s
+
+      - name: Cache - Save ccache (current)
+        if: always()
+        uses: actions/cache/save@v5
+        with:
+          path: ~/.ccache
+          key: ${{ steps.cache_current.outputs.cache-primary-key }}
+
       - name: Clean previous build
         run: |
           make clean
           make distclean
           make submodulesclean
+          ccache -C
 
       - name: If it's a PR checkout the base branch
         if: ${{ github.event.pull_request }}
@@ -68,12 +101,34 @@ jobs:
       - name: Update submodules
         run: make submodulesupdate
 
+      - name: Cache - Restore ccache (baseline)
+        id: cache_baseline
+        uses: actions/cache/restore@v5
+        with:
+          path: ~/.ccache
+          key: ccache-flash-${{ matrix.target }}-baseline-${{ github.sha }}
+          restore-keys: |
+            ccache-flash-${{ matrix.target }}-baseline-
+
+      - name: Cache - Reset ccache stats
+        run: ccache -z
+
       - name: Build
         run: make ${{ matrix.target }}_flash-analysis
 
       - name: Store the ELF before the change
         run: cp ./build/**/*.elf ./before-change.elf
 
+      - name: Cache - Stats after Baseline Build
+        run: ccache -s
+
+      - name: Cache - Save ccache (baseline)
+        if: always()
+        uses: actions/cache/save@v5
+        with:
+          path: ~/.ccache
+          key: ${{ steps.cache_baseline.outputs.cache-primary-key }}
+
       - name: bloaty-action
         uses: PX4/bloaty-action@v1.0.0
         id: bloaty-step
@@ -93,9 +148,6 @@ jobs:
           echo '${{ steps.bloaty-step.outputs.bloaty-summary-map }}' >> $GITHUB_OUTPUT
           echo "$EOF" >> $GITHUB_OUTPUT
 
-  # TODO:
-  # This part of the workflow is causing errors for forks. We should find a way to fix this and enable it again for forks.
-  # Track this issue https://github.com/PX4/PX4-Autopilot/issues/24408
   post_pr_comment:
     name: Publish Results
     runs-on: [runs-on,runner=1cpu-linux-x64,image=ubuntu24-full-x64,"run-id=${{ github.run_id }}"]
@@ -105,22 +157,22 @@ jobs:
       V5X-SUMMARY-MAP-PERC: ${{ fromJSON(fromJSON(needs.analyze_flash.outputs.px4_fmu-v5x-bloaty-summary-map).vm-percentage) }}
       V6X-SUMMARY-MAP-ABS: ${{ fromJSON(fromJSON(needs.analyze_flash.outputs.px4_fmu-v6x-bloaty-summary-map).vm-absolute) }}
       V6X-SUMMARY-MAP-PERC: ${{ fromJSON(fromJSON(needs.analyze_flash.outputs.px4_fmu-v6x-bloaty-summary-map).vm-percentage) }}
-    if: github.event.pull_request && github.event.pull_request.head.repo.full_name == github.repository
+    if: github.event.pull_request
     steps:
       - name: Find Comment
-        uses: peter-evans/find-comment@v3
+        uses: peter-evans/find-comment@v4
         id: fc
         with:
           issue-number: ${{ github.event.pull_request.number }}
           comment-author: 'github-actions[bot]'
-          body-includes: FLASH Analysis
+          body-includes: '<!-- pr-comment-poster:flash-analysis -->'
 
       - name: Set Build Time
         id: bt
         run: |
           echo "timestamp=$(date +'%Y-%m-%dT%H:%M:%S')" >> $GITHUB_OUTPUT
 
-      - name: Create or update comment
+      - name: Write pr-comment artifact
         # This can't be moved to the job-level conditions, as GH actions don't allow a job-level if condition to access the env.
         if: |
           steps.fc.outputs.comment-id != '' ||
@@ -128,27 +180,46 @@ jobs:
           env.V5X-SUMMARY-MAP-ABS <= fromJSON(env.MIN_FLASH_NEG_DIFF_FOR_COMMENT) ||
           env.V6X-SUMMARY-MAP-ABS >= fromJSON(env.MIN_FLASH_POS_DIFF_FOR_COMMENT) ||
           env.V6X-SUMMARY-MAP-ABS <= fromJSON(env.MIN_FLASH_NEG_DIFF_FOR_COMMENT)
-        uses: peter-evans/create-or-update-comment@v4
+        run: |
+          mkdir -p pr-comment
+          cat > pr-comment/manifest.json <<EOF
+          {
+            "pr_number": ${{ github.event.pull_request.number }},
+            "marker": "<!-- pr-comment-poster:flash-analysis -->",
+            "mode": "upsert"
+          }
+          EOF
+          cat > pr-comment/body.md <<'PR_COMMENT_BODY_EOF'
+          <!-- pr-comment-poster:flash-analysis -->
+          ## 🔎 FLASH Analysis
+          <details>
+          <summary>px4_fmu-v5x [Total VM Diff: ${{ env.V5X-SUMMARY-MAP-ABS }} byte (${{ env.V5X-SUMMARY-MAP-PERC}} %)]</summary>
+
+          ```
+          ${{ needs.analyze_flash.outputs.px4_fmu-v5x-bloaty-output }}
+          ```
+          </details>
+
+          <details>
+          <summary>px4_fmu-v6x [Total VM Diff: ${{ env.V6X-SUMMARY-MAP-ABS }} byte (${{ env.V6X-SUMMARY-MAP-PERC }} %)]</summary>
+
+          ```
+          ${{ needs.analyze_flash.outputs.px4_fmu-v6x-bloaty-output }}
+          ```
+          </details>
+
+          **Updated: _${{ steps.bt.outputs.timestamp }}_**
+          PR_COMMENT_BODY_EOF
+
+      - name: Upload pr-comment artifact
+        if: |
+          steps.fc.outputs.comment-id != '' ||
+          env.V5X-SUMMARY-MAP-ABS >= fromJSON(env.MIN_FLASH_POS_DIFF_FOR_COMMENT) ||
+          env.V5X-SUMMARY-MAP-ABS <= fromJSON(env.MIN_FLASH_NEG_DIFF_FOR_COMMENT) ||
+          env.V6X-SUMMARY-MAP-ABS >= fromJSON(env.MIN_FLASH_POS_DIFF_FOR_COMMENT) ||
+          env.V6X-SUMMARY-MAP-ABS <= fromJSON(env.MIN_FLASH_NEG_DIFF_FOR_COMMENT)
+        uses: actions/upload-artifact@v7
         with:
-          comment-id: ${{ steps.fc.outputs.comment-id }}
-          issue-number: ${{ github.event.pull_request.number }}
-          body: |
-            ## 🔎 FLASH Analysis
-            <details>
-              <summary>px4_fmu-v5x [Total VM Diff: ${{ env.V5X-SUMMARY-MAP-ABS }} byte (${{ env.V5X-SUMMARY-MAP-PERC}} %)]</summary>
-
-              ```
-              ${{ needs.analyze_flash.outputs.px4_fmu-v5x-bloaty-output }}
-              ```
-            </details>
-
-            <details>
-              <summary>px4_fmu-v6x [Total VM Diff: ${{ env.V6X-SUMMARY-MAP-ABS }} byte (${{ env.V6X-SUMMARY-MAP-PERC }} %)]</summary>
-
-              ```
-              ${{ needs.analyze_flash.outputs.px4_fmu-v6x-bloaty-output }}
-              ```
-            </details>
-
-            **Updated: _${{ steps.bt.outputs.timestamp }}_**
-          edit-mode: replace
+          name: pr-comment
+          path: pr-comment/
+          retention-days: 1

.github/workflows/fuzzing.yml

@@ -12,19 +12,24 @@ env:
 
 jobs:
   Fuzzing:
-    runs-on: ubuntu-latest
+    runs-on: [runs-on,runner=4cpu-linux-x64,image=ubuntu24-full-x64,"run-id=${{ github.run_id }}",spot=false,extras=s3-cache]
     container:
-      image: px4io/px4-dev:v1.16.0-rc2-4-gb67c65bfe6
+      image: ghcr.io/px4/px4-dev:v1.17.0-rc2
     steps:
-      - name: Install Dependencies
-        run: |
-          apt update && apt install -y clang
+      - uses: runs-on/action@v2
 
-      - name: Fix git in Container
-        run: |
-          git config --global --add safe.directory $(realpath .)
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 1
 
-      - uses: actions/checkout@v4
+      - name: Configure Git Safe Directory
+        run: git config --system --add safe.directory '*'
+
+      - uses: ./.github/actions/setup-ccache
+        id: ccache
+        with:
+          cache-key-prefix: ccache-sitl
+          max-size: 300M
 
       - name: Build and Run Fuzz Tests
         run: |
@@ -38,7 +43,11 @@ jobs:
             ./Tools/ci/run_fuzz_tests.sh $fuzz_binary 15m
           done
 
-      # Create a github issue in case of a failure
+      - uses: ./.github/actions/save-ccache
+        if: always()
+        with:
+          cache-primary-key: ${{ steps.ccache.outputs.cache-primary-key }}
+
       - name: Create Issue
         if: ${{ failure() }}
         uses: JasonEtco/create-an-issue@v2

.github/workflows/itcm_check.yml

@@ -22,9 +22,9 @@ concurrency:
 jobs:
   check_itcm:
     name: Checking ${{ matrix.target }}
-    runs-on: [runs-on,runner=4cpu-linux-x64,image=ubuntu24-full-x64,"run-id=${{ github.run_id }}",spot=false]
+    runs-on: [runs-on,runner=4cpu-linux-x64,image=ubuntu24-full-x64,"run-id=${{ github.run_id }}",spot=false,extras=s3-cache]
     container:
-      image: px4io/px4-dev:v1.16.0-rc1-258-g0369abd556
+      image: ghcr.io/px4/px4-dev:v1.17.0-rc2
     strategy:
       fail-fast: false
       matrix:
@@ -46,14 +46,19 @@ jobs:
               boards/nxp/mr-tropic/nuttx-config/scripts/itcm_functions_includes.ld
               boards/nxp/mr-tropic/nuttx-config/scripts/itcm_static_functions.ld
     steps:
-      - uses: actions/checkout@v4
+      - uses: runs-on/action@v2
+      - uses: actions/checkout@v6
         with:
-          fetch-depth: 0
-          submodules: recursive
-
-      - name: Git ownership workaround
+          fetch-depth: 1
+      - name: Configure Git Safe Directory
         run: git config --system --add safe.directory '*'
 
+      - uses: ./.github/actions/setup-ccache
+        id: ccache
+        with:
+          cache-key-prefix: ccache-itcm-${{ matrix.target }}
+          max-size: 200M
+
       - name: Build Target
         run: make ${{ matrix.target }}
 
@@ -65,3 +70,8 @@ jobs:
 
       - name: Execute the itcm-check
         run: python3 Tools/itcm_check.py --elf-file built.elf --script-files ${{ matrix.scripts }}
+
+      - uses: ./.github/actions/save-ccache
+        if: always()
+        with:
+          cache-primary-key: ${{ steps.ccache.outputs.cache-primary-key }}

.github/workflows/label.yml

@@ -16,6 +16,6 @@ jobs:
       pull-requests: write
 
     steps:
-    - uses: actions/labeler@v5
+    - uses: actions/labeler@v6
       with:
         repo-token: "${{ secrets.GITHUB_TOKEN }}"

.github/workflows/mavros_mission_tests.yml

@@ -1,43 +0,0 @@
-name: MAVROS Mission Tests
-
-on:
-  push:
-    branches:
-    - 'main'
-    paths-ignore:
-      - 'docs/**'
-  pull_request:
-    branches:
-      - '**'
-    paths-ignore:
-      - 'docs/**'
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        config:
-          - {vehicle: "iris",          mission: "MC_mission_box"}
-
-    steps:
-    - uses: actions/checkout@v4
-      with:
-        fetch-depth: 0
-
-    - name: Build SITL and Run Tests
-      uses: addnab/docker-run-action@v3
-      with:
-        image: px4io/px4-dev-ros-melodic:2021-09-08
-        options: -v ${{ github.workspace }}:/workspace
-        run: |
-          cd /workspace
-          git config --global --add safe.directory /workspace
-          make px4_sitl_default
-          make px4_sitl_default sitl_gazebo-classic
-          ./test/rostest_px4_run.sh mavros_posix_test_mission.test mission:=${{matrix.config.mission}} vehicle:=${{matrix.config.vehicle}}

.github/workflows/mavros_offboard_tests.yml

@@ -1,45 +0,0 @@
-name: MAVROS Offboard Tests
-
-on:
-  push:
-    branches:
-    - 'main'
-    paths-ignore:
-      - 'docs/**'
-  pull_request:
-    branches:
-      - '**'
-    paths-ignore:
-      - 'docs/**'
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    env:
-      ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true
-    strategy:
-      fail-fast: false
-      matrix:
-        config:
-          - {test_file: "mavros_posix_tests_offboard_posctl.test",    vehicle: "iris"}
-
-    steps:
-    - uses: actions/checkout@v4
-      with:
-        fetch-depth: 0
-
-    - name: Build PX4 and Run Tests
-      uses: addnab/docker-run-action@v3
-      with:
-        image: px4io/px4-dev-ros-melodic:2021-09-08
-        options: -v ${{ github.workspace }}:/workspace
-        run: |
-          cd /workspace
-          git config --global --add safe.directory /workspace
-          make px4_sitl_default
-          make px4_sitl_default sitl_gazebo-classic
-          ./test/rostest_px4_run.sh ${{matrix.config.test_file}} vehicle:=${{matrix.config.vehicle}}

.github/workflows/mavros_tests.yml

@@ -0,0 +1,73 @@
+name: MAVROS Tests
+
+on:
+  push:
+    branches:
+    - 'main'
+    paths-ignore:
+      - 'docs/**'
+  pull_request:
+    branches:
+      - '**'
+    paths-ignore:
+      - 'docs/**'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: "MAVROS ${{ matrix.config.name }}"
+    runs-on: [runs-on,runner=4cpu-linux-x64,image=ubuntu24-full-x64,"run-id=${{ github.run_id }}",spot=false,extras=s3-cache]
+    permissions:
+      contents: read
+    container:
+      image: px4io/px4-dev-ros-noetic:2021-09-08
+    env:
+      PX4_SBOM_DISABLE: 1
+    strategy:
+      fail-fast: false
+      matrix:
+        config:
+          - {name: "Mission", test_file: "mavros_posix_test_mission.test", params: "mission:=MC_mission_box vehicle:=iris"}
+          - {name: "Offboard", test_file: "mavros_posix_tests_offboard_posctl.test", params: "vehicle:=iris"}
+    steps:
+      - uses: runs-on/action@v2
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 1
+      - name: Configure Git Safe Directory
+        run: git config --system --add safe.directory '*'
+
+      - name: Setup - Install Python Test Dependencies
+        run: pip3 install -r Tools/setup/requirements.txt
+
+      - uses: ./.github/actions/setup-ccache
+        id: ccache
+        with:
+          cache-key-prefix: ccache-sitl-gazebo-classic
+          max-size: 350M
+
+      - uses: ./.github/actions/build-gazebo-sitl
+
+      - name: Test - MAVROS ${{ matrix.config.name }}
+        run: |
+          ./test/rostest_px4_run.sh \
+            ${{ matrix.config.test_file }} \
+            ${{ matrix.config.params }}
+        timeout-minutes: 10
+
+      - uses: ./.github/actions/save-ccache
+        if: always()
+        with:
+          cache-primary-key: ${{ steps.ccache.outputs.cache-primary-key }}
+
+      - name: Upload - Failed Test Logs
+        if: failure()
+        uses: actions/upload-artifact@v7
+        with:
+          name: failed-mavros-${{ matrix.config.name }}-logs.zip
+          path: |
+            logs/**/**/**/*.log
+            logs/**/**/**/*.ulg

.github/workflows/nuttx_env_config.yml

@@ -1,45 +0,0 @@
-name: Nuttx Target with extra env config
-
-on:
-  push:
-    branches:
-    - 'main'
-    paths-ignore:
-      - 'docs/**'
-  pull_request:
-    branches:
-      - '**'
-    paths-ignore:
-      - 'docs/**'
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        config: [
-          px4_fmu-v5_default,
-          ]
-
-    steps:
-    - uses: actions/checkout@v4
-      with:
-        fetch-depth: 0
-
-    - name: Build PX4 and Run Test [${{ matrix.config }}]
-      uses: addnab/docker-run-action@v3
-      with:
-        image: px4io/px4-dev:v1.16.0-rc1-258-g0369abd556
-        options: -v ${{ github.workspace }}:/workspace
-        run: |
-          cd /workspace
-          git config --global --add safe.directory /workspace
-          export PX4_EXTRA_NUTTX_CONFIG="CONFIG_NSH_LOGIN_PASSWORD=\"test\";CONFIG_NSH_CONSOLE_LOGIN=y"
-          echo "PX4_EXTRA_NUTTX_CONFIG: $PX4_EXTRA_NUTTX_CONFIG"
-          make ${{ matrix.config }} nuttx_context
-          echo "Check that the config option is set"
-          grep CONFIG_NSH_LOGIN_PASSWORD build/${{ matrix.config }}/NuttX/nuttx/.config

.github/workflows/pr-comment-poster.yml

@@ -0,0 +1,155 @@
+name: PR Comment Poster
+
+# Generic PR comment poster. Any analysis workflow (clang-tidy, flash_analysis,
+# fuzz coverage, SITL perf, etc.) can produce a `pr-comment` artifact and this
+# workflow will post or update a sticky PR comment with its contents. Designed
+# so that analysis jobs running on untrusted fork PRs can still get their
+# results posted back to the PR.
+#
+# ==============================================================================
+# SECURITY INVARIANTS
+# ==============================================================================
+# This workflow runs on `workflow_run` which means it runs in the BASE REPO
+# context with a WRITE token, even when the triggering PR comes from a fork.
+# That is the entire reason it exists, and also the reason it is a loaded
+# footgun. Anyone modifying this file MUST preserve the following invariants:
+#
+#   1. NEVER check out PR code. No `actions/checkout` with a ref. No git clone
+#      of a fork branch. No execution of scripts from the downloaded artifact.
+#      The ONLY things read from the artifact are `manifest.json` and `body.md`,
+#      and both are treated as opaque data (JSON parsed by the poster script
+#      and markdown posted verbatim via the GitHub API).
+#
+#   2. `pr_number` is validated to be a positive integer before use.
+#      `marker` is validated to be printable ASCII only before use. Validation
+#      happens inside Tools/ci/pr-comment-poster.py which is checked out from
+#      the base branch, not from the artifact.
+#
+#   3. The comment body is passed to the GitHub API as a JSON field, never
+#      interpolated into a shell command string.
+#
+#   4. This workflow file lives on the default branch. `workflow_run` only
+#      loads workflow files from the default branch, so a fork cannot modify
+#      THIS file as part of a PR. The fork CAN cause this workflow to fire
+#      by triggering a producer workflow that uploads a `pr-comment` artifact.
+#      That is intended.
+#
+#   5. The artifact-name filter (`pr-comment`) is the only gate on which
+#      workflow runs get processed. Any workflow in this repo that uploads
+#      an artifact named `pr-comment` is trusted to have written the
+#      manifest and body itself, NOT copied fork-controlled content into
+#      them. Producer workflows are responsible for that.
+#
+#   6. `actions/checkout@v6` below uses NO ref (so it pulls the base branch,
+#      the default-branch commit this workflow file was loaded from) AND uses
+#      sparse-checkout to materialize ONLY Tools/ci/pr-comment-poster.py and
+#      its stdlib-only helper module Tools/ci/_github_helpers.py. The rest of
+#      the repo never touches the workspace. This is safe: the only files the
+#      job executes are base-repo Python scripts that were reviewed through
+#      normal code review, never anything from the PR.
+#
+# ==============================================================================
+# ARTIFACT CONTRACT
+# ==============================================================================
+# Producers upload an artifact named exactly `pr-comment` containing:
+#
+#   manifest.json:
+#     {
+#       "pr_number": 12345,                                      // required, int > 0
+#       "marker": "<!-- pr-comment-poster:flash-analysis -->",   // required, printable ASCII
+#       "mode": "upsert"                                         // optional, default "upsert"
+#     }
+#
+#   body.md: the markdown content of the comment. Posted verbatim.
+#
+# The `marker` string is used to find an existing comment to update. It MUST
+# be unique per producer (e.g. include the producer name). If no existing
+# comment contains the marker, a new one is created. If the marker is found
+# in an existing comment, that comment is edited in place.
+#
+# Producers MUST write `pr_number` from their own workflow context
+# (`github.event.pull_request.number`) and MUST NOT read it from any
+# fork-controlled source.
+
+on:
+  workflow_run:
+    # Producers that may upload a `pr-comment` artifact. When a new producer
+    # is wired up, add its workflow name here. Runs of workflows not in this
+    # list will never trigger the poster. Every run of a listed workflow will
+    # trigger the poster, which will no-op if no `pr-comment` artifact exists.
+    workflows:
+      - "FLASH usage analysis"
+      - "Docs - Orchestrator"
+    types:
+      - completed
+
+permissions:
+  pull-requests: write
+  actions: read
+  contents: read
+
+jobs:
+  post:
+    name: Post PR Comment
+    runs-on: ubuntu-latest
+    # Only run for pull_request producer runs. Push-to-main and other
+    # non-PR triggers would have no comment to post, and silently no-oping
+    # inside the script made it look like the poster was broken. Gating at
+    # the job level surfaces those as a clean "Skipped" in the UI instead.
+    if: >-
+      github.event.workflow_run.conclusion != 'cancelled'
+      && github.event.workflow_run.event == 'pull_request'
+    steps:
+      # Checkout runs first so the poster script is available AND so that
+      # actions/checkout@v6's default clean step does not delete the artifact
+      # zip that the next step writes into the workspace. Sparse-checkout
+      # restricts the materialized tree to just the poster script.
+      - name: Checkout poster script only
+        uses: actions/checkout@v6
+        with:
+          sparse-checkout: |
+            Tools/ci/pr-comment-poster.py
+            Tools/ci/_github_helpers.py
+          sparse-checkout-cone-mode: false
+
+      - name: Download pr-comment artifact
+        id: download
+        uses: actions/github-script@v9
+        with:
+          script: |
+            const artifacts = await github.rest.actions.listWorkflowRunArtifacts({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              run_id: context.payload.workflow_run.id,
+            });
+            const match = artifacts.data.artifacts.find(a => a.name === 'pr-comment');
+            if (!match) {
+              core.info('No pr-comment artifact on this run; nothing to post.');
+              core.setOutput('found', 'false');
+              return;
+            }
+            const download = await github.rest.actions.downloadArtifact({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              artifact_id: match.id,
+              archive_format: 'zip',
+            });
+            const fs = require('fs');
+            fs.writeFileSync('pr-comment.zip', Buffer.from(download.data));
+            core.setOutput('found', 'true');
+
+      - name: Unpack artifact
+        if: steps.download.outputs.found == 'true'
+        run: |
+          mkdir -p pr-comment
+          unzip -q pr-comment.zip -d pr-comment
+
+      - name: Validate artifact
+        if: steps.download.outputs.found == 'true'
+        run: python3 Tools/ci/pr-comment-poster.py validate pr-comment
+
+      - name: Upsert sticky comment
+        if: steps.download.outputs.found == 'true'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: python3 Tools/ci/pr-comment-poster.py post pr-comment

.github/workflows/pr-review-poster.yml

@@ -0,0 +1,177 @@
+name: PR Review Poster
+
+# Generic PR review-comment poster. Sibling of "PR Comment Poster": that
+# workflow posts sticky issue-style comments, this one posts line-anchored
+# review comments on the "Files changed" tab. Any analysis workflow that
+# wants to flag specific lines can produce a `pr-review` artifact and this
+# workflow will dismiss any stale matching review and post a fresh one.
+# Designed so analysis jobs running on untrusted fork PRs can still get
+# their inline annotations posted back to the PR.
+#
+# ==============================================================================
+# SECURITY INVARIANTS
+# ==============================================================================
+# This workflow runs on `workflow_run` which means it runs in the BASE REPO
+# context with a WRITE token, even when the triggering PR comes from a fork.
+# That is the entire reason it exists, and also the reason it is a loaded
+# footgun. Anyone modifying this file MUST preserve the following invariants:
+#
+#   1. NEVER check out PR code. No `actions/checkout` with a ref. No git clone
+#      of a fork branch. No execution of scripts from the downloaded artifact.
+#      The ONLY things read from the artifact are `manifest.json` and
+#      `comments.json`, and both are treated as opaque data (JSON parsed by
+#      the poster script and the comment fields posted via the GitHub API).
+#
+#   2. `pr_number` is validated to be a positive integer before use.
+#      `marker` is validated to be printable ASCII only before use.
+#      `commit_sha` is validated to be 40 lowercase hex characters.
+#      `event` is validated against an allowlist of `COMMENT` and
+#      `REQUEST_CHANGES`. `APPROVE` is intentionally forbidden so a bot
+#      cannot approve a pull request. Validation happens inside
+#      Tools/ci/pr-review-poster.py which is checked out from the base
+#      branch, not from the artifact.
+#
+#   3. Comment bodies and the optional summary are passed to the GitHub API
+#      as JSON fields, never interpolated into a shell command string.
+#
+#   4. This workflow file lives on the default branch. `workflow_run` only
+#      loads workflow files from the default branch, so a fork cannot modify
+#      THIS file as part of a PR. The fork CAN cause this workflow to fire
+#      by triggering a producer workflow that uploads a `pr-review`
+#      artifact. That is intended.
+#
+#   5. The artifact-name filter (`pr-review`) is the only gate on which
+#      workflow runs get processed. Any workflow in this repo that uploads
+#      an artifact named `pr-review` is trusted to have written the
+#      manifest and comments itself, NOT copied fork-controlled content
+#      into them. Producer workflows are responsible for that.
+#
+#   6. `actions/checkout@v6` below uses NO ref (so it pulls the base branch,
+#      the default-branch commit this workflow file was loaded from) AND
+#      uses sparse-checkout to materialize ONLY
+#      Tools/ci/pr-review-poster.py and its stdlib-only helper module
+#      Tools/ci/_github_helpers.py. The rest of the repo never touches the
+#      workspace. This is safe: the only files the job executes are
+#      base-repo Python scripts that were reviewed through normal code
+#      review, never anything from the PR.
+#
+#   7. Stale-review dismissal is restricted to reviews whose AUTHOR is
+#      `github-actions[bot]` AND whose body contains the producer's
+#      marker. A fork PR cannot impersonate the bot login, and cannot
+#      inject the marker into a human reviewer's body without API
+#      access. Both filters together prevent the poster from ever
+#      dismissing a human review.
+#
+# ==============================================================================
+# ARTIFACT CONTRACT
+# ==============================================================================
+# Producers upload an artifact named exactly `pr-review` containing:
+#
+#   manifest.json:
+#     {
+#       "pr_number":  12345,                                      // required, int > 0
+#       "marker":     "<!-- pr-review-poster:clang-tidy -->",     // required, printable ASCII
+#       "event":      "REQUEST_CHANGES",                          // required, "COMMENT" | "REQUEST_CHANGES"
+#       "commit_sha": "0123456789abcdef0123456789abcdef01234567", // required, 40 hex chars
+#       "summary":    "Optional review summary text"              // optional
+#     }
+#
+#   comments.json: JSON array of line-anchored review comment objects:
+#     [
+#       {"path": "src/foo.cpp", "line": 42, "side": "RIGHT", "body": "..."},
+#       {"path": "src/bar.hpp", "start_line": 10, "line": 15,
+#        "side": "RIGHT", "start_side": "RIGHT", "body": "..."}
+#     ]
+#
+# The `marker` string is used to find an existing matching review to
+# dismiss before posting a new one. It MUST be unique per producer (e.g.
+# include the producer name).
+#
+# Producers MUST write `pr_number` and `commit_sha` from their own
+# workflow context (`github.event.pull_request.number` and
+# `github.event.pull_request.head.sha`) and MUST NOT read either from any
+# fork-controlled source.
+
+on:
+  workflow_run:
+    # Producers that may upload a `pr-review` artifact. When a new
+    # producer is wired up, add its workflow name here. Runs of workflows
+    # not in this list will never trigger the poster. Every run of a
+    # listed workflow will trigger the poster, which will no-op if no
+    # `pr-review` artifact exists.
+    workflows:
+      - "Static Analysis"
+    types:
+      - completed
+
+permissions:
+  pull-requests: write
+  actions: read
+  contents: read
+
+jobs:
+  post:
+    name: Post PR Review
+    runs-on: ubuntu-latest
+    # Only run for pull_request producer runs. Push-to-main and other
+    # non-PR triggers have no review to post, so gating at the job level
+    # surfaces those as a clean "Skipped" in the UI instead of a
+    # silent no-op buried inside the script.
+    if: >-
+      github.event.workflow_run.conclusion != 'cancelled'
+      && github.event.workflow_run.event == 'pull_request'
+    steps:
+      # Checkout runs first so the poster scripts are available AND so
+      # that actions/checkout@v6's default clean step does not delete the
+      # artifact zip that the next step writes into the workspace.
+      # Sparse-checkout restricts the materialized tree to just the
+      # poster script and its stdlib helper module.
+      - name: Checkout poster script only
+        uses: actions/checkout@v6
+        with:
+          sparse-checkout: |
+            Tools/ci/pr-review-poster.py
+            Tools/ci/_github_helpers.py
+          sparse-checkout-cone-mode: false
+
+      - name: Download pr-review artifact
+        id: download
+        uses: actions/github-script@v9
+        with:
+          script: |
+            const artifacts = await github.rest.actions.listWorkflowRunArtifacts({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              run_id: context.payload.workflow_run.id,
+            });
+            const match = artifacts.data.artifacts.find(a => a.name === 'pr-review');
+            if (!match) {
+              core.info('No pr-review artifact on this run; nothing to post.');
+              core.setOutput('found', 'false');
+              return;
+            }
+            const download = await github.rest.actions.downloadArtifact({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              artifact_id: match.id,
+              archive_format: 'zip',
+            });
+            const fs = require('fs');
+            fs.writeFileSync('pr-review.zip', Buffer.from(download.data));
+            core.setOutput('found', 'true');
+
+      - name: Unpack artifact
+        if: steps.download.outputs.found == 'true'
+        run: |
+          mkdir -p pr-review
+          unzip -q pr-review.zip -d pr-review
+
+      - name: Validate artifact
+        if: steps.download.outputs.found == 'true'
+        run: python3 Tools/ci/pr-review-poster.py validate pr-review
+
+      - name: Post PR review
+        if: steps.download.outputs.found == 'true'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: python3 Tools/ci/pr-review-poster.py post pr-review

.github/workflows/python_checks.yml

@@ -14,20 +14,23 @@ on:
 
 jobs:
   build:
-    runs-on: ubuntu-24.04
+    runs-on: [runs-on,runner=1cpu-linux-x64,image=ubuntu24-full-x64,"run-id=${{ github.run_id }}"]
     steps:
-    - uses: actions/checkout@v4
+    - uses: runs-on/action@v2
+    - uses: actions/checkout@v6
       with:
-        fetch-depth: 0
+        fetch-depth: 1
 
-    - name: Install Python3
-      run: sudo apt-get install python3 python3-setuptools python3-pip -y
+    - name: Setup Python
+      uses: actions/setup-python@v6
+      with:
+        python-version: "3.10"
 
     - name: Install tools
-      run: python3 -m pip install mypy types-requests flake8 --break-system-packages
+      run: pip install mypy types-requests flake8
 
     - name: Check MAVSDK test scripts with mypy
-      run: $HOME/.local/bin/mypy --strict test/mavsdk_tests/*.py
+      run: mypy --strict test/mavsdk_tests/*.py
 
     - name: Check MAVSDK test scripts with flake8
-      run: $HOME/.local/bin/flake8 test/mavsdk_tests/*.py
+      run: flake8 test/mavsdk_tests/*.py

.github/workflows/ros_integration_tests.yml

@@ -23,16 +23,18 @@ concurrency:
 
 jobs:
   build:
-    runs-on: [runs-on,runner=4cpu-linux-x64,image=ubuntu22-full-x64,"run-id=${{ github.run_id }}",spot=false]
+    runs-on: [runs-on,runner=8cpu-linux-x64,image=ubuntu24-full-x64,"run-id=${{ github.run_id }}",spot=false,extras=s3-cache]
     container:
       image: px4io/px4-dev-ros2-galactic:2021-09-08
       options: --privileged --ulimit core=-1 --security-opt seccomp=unconfined
+    env:
+      PX4_SBOM_DISABLE: 1
     steps:
-    - uses: actions/checkout@v4
+    - uses: runs-on/action@v2
+    - uses: actions/checkout@v6
       with:
-        fetch-depth: 0
-
-    - name: Git Ownership Workaround
+        fetch-depth: 1
+    - name: Configure Git Safe Directory
       run: git config --system --add safe.directory '*'
 
     - name: Update ROS Keys
@@ -45,30 +47,21 @@ jobs:
       run: |
         apt update && apt install -y gazebo11 libgazebo11-dev gstreamer1.0-plugins-bad gstreamer1.0-plugins-base gstreamer1.0-plugins-good gstreamer1.0-plugins-ugly libgstreamer-plugins-base1.0-dev
 
-    - name: Prepare ccache timestamp
-      id: ccache_cache_timestamp
-      shell: cmake -P {0}
-      run: |
-        string(TIMESTAMP current_date "%Y-%m-%d-%H;%M;%S" UTC)
-        message("::set-output name=timestamp::${current_date}")
-    - name: ccache cache files
-      uses: actions/cache@v4
+    - uses: ./.github/actions/setup-ccache
+      id: ccache
       with:
-        path: ~/.ccache
-        key: ros_integration_tests-${{matrix.config.build_type}}-ccache-${{steps.ccache_cache_timestamp.outputs.timestamp}}
-        restore-keys: ros_integration_tests-${{matrix.config.build_type}}-ccache-
-    - name: setup ccache
-      run: |
-        mkdir -p ~/.ccache
-        echo "base_dir = ${GITHUB_WORKSPACE}" > ~/.ccache/ccache.conf
-        echo "compression = true" >> ~/.ccache/ccache.conf
-        echo "compression_level = 6" >> ~/.ccache/ccache.conf
-        echo "max_size = 300M" >> ~/.ccache/ccache.conf
-        echo "hash_dir = false" >> ~/.ccache/ccache.conf
-        ccache -s
-        ccache -z
+        cache-key-prefix: ccache-ros-integration
+        max-size: 400M
 
-    - name: Get and build micro-xrce-dds-agent
+    - name: Cache - Restore Micro-XRCE-DDS Agent
+      id: cache-xrce-agent
+      uses: actions/cache@v5
+      with:
+        path: /opt/Micro-XRCE-DDS-Agent
+        key: xrce-agent-v2.2.1-fastdds-2.8.2-galactic-2021-09-08
+
+    - name: Build - Micro-XRCE-DDS Agent (v2.2.1)
+      if: steps.cache-xrce-agent.outputs.cache-hit != 'true'
       run: |
         cd /opt
         git clone --recursive https://github.com/eProsima/Micro-XRCE-DDS-Agent.git
@@ -79,33 +72,45 @@ jobs:
         cd build
         cmake ..
         make -j2
-    - name: ccache post-run micro-xrce-dds-agent
-      run: ccache -s
 
-    - name: Get and build the ros2 interface library
+    - name: Cache - Restore PX4 ROS 2 Interface Library Workspace
+      id: cache-px4-ros2-ws
+      uses: actions/cache@v5
+      with:
+        path: /opt/px4_ws
+        # Bump 'v1' when the cached workspace layout changes in a way
+        # that is not captured by the message/service hash below.
+        key: px4-ros2-ws-v1-galactic-2021-09-08-${{ hashFiles('msg/*.msg', 'msg/versioned/*.msg', 'srv/*.srv') }}
+
+    - name: Build - PX4 ROS 2 Interface Library
+      if: steps.cache-px4-ros2-ws.outputs.cache-hit != 'true'
       shell: bash
       run: |
         PX4_DIR="$(pwd)"
         . /opt/ros/galactic/setup.bash
         mkdir -p /opt/px4_ws/src
         cd /opt/px4_ws/src
-        git clone --recursive https://github.com/Auterion/px4-ros2-interface-lib.git
+        # On a PR, target the branch we're merging into (main or release/X.Y).
+        # On a direct push, fall back to the branch we're running on.
+        BRANCH="${GITHUB_BASE_REF:-$GITHUB_REF_NAME}"
+        REPO_URL="https://github.com/Auterion/px4-ros2-interface-lib.git"
+        if git ls-remote --heads "$REPO_URL" "$BRANCH" | grep -q "$BRANCH"; then
+          echo "Cloning px4-ros2-interface-lib with matching branch: $BRANCH"
+          git clone --recursive --branch "$BRANCH" "$REPO_URL"
+        else
+          echo "Branch '$BRANCH' not found in px4-ros2-interface-lib, using default (main)"
+          git clone --recursive "$REPO_URL"
+        fi
+        # Ignore python packages due to compilation issue (can be enabled when updating ROS)
+        touch px4-ros2-interface-lib/px4_ros2_py/COLCON_IGNORE || true
+        touch px4-ros2-interface-lib/examples/python/COLCON_IGNORE || true
         cd ..
         # Copy messages to ROS workspace
         "${PX4_DIR}/Tools/copy_to_ros_ws.sh" "$(pwd)"
         rm -rf src/translation_node src/px4_msgs_old
         colcon build --symlink-install
-    - name: ccache post-run ros workspace
-      run: ccache -s
 
-    - name: Build PX4
-      run: make px4_sitl_default
-    - name: ccache post-run px4/firmware
-      run: ccache -s
-    - name: Build SITL Gazebo
-      run: make px4_sitl_default sitl_gazebo-classic
-    - name: ccache post-run sitl_gazebo-classic
-      run: ccache -s
+    - uses: ./.github/actions/build-gazebo-sitl
 
     - name: Core dump settings
       run: |
@@ -117,12 +122,17 @@ jobs:
       run: |
         . /opt/px4_ws/install/setup.bash
         /opt/Micro-XRCE-DDS-Agent/build/MicroXRCEAgent udp4 localhost -p 8888 -v 0 &
-        test/ros_test_runner.py --verbose --model iris --upload --force-color
+        test/ros_test_runner.py --verbose --model iris --force-color
       timeout-minutes: 45
 
+    - uses: ./.github/actions/save-ccache
+      if: always()
+      with:
+        cache-primary-key: ${{ steps.ccache.outputs.cache-primary-key }}
+
     - name: Upload failed logs
       if: failure()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@v7
       with:
         name: failed-logs.zip
         path: |

.github/workflows/ros_translation_node.yml

@@ -10,6 +10,9 @@ on:
       - '**'
     paths-ignore:
       - 'docs/**'
+permissions:
+  contents: read
+
 defaults:
   run:
     shell: bash
@@ -20,8 +23,8 @@ concurrency:
 
 jobs:
   build_and_test:
-    name: Build and test
-    runs-on: [runs-on,runner=4cpu-linux-x64,image=ubuntu24-full-x64,"run-id=${{ github.run_id }}",spot=false]
+    name: Build and test [${{ matrix.config.ros_version }}]
+    runs-on: [runs-on,runner=4cpu-linux-x64,image=ubuntu24-full-x64,"run-id=${{ github.run_id }}",spot=false,extras=s3-cache]
     strategy:
       fail-fast: false
       matrix:
@@ -29,33 +32,43 @@ jobs:
           - {ros_version: "humble", ubuntu: "jammy"}
           - {ros_version: "jazzy", ubuntu: "noble"}
     container:
-      image: rostooling/setup-ros-docker:ubuntu-${{ matrix.config.ubuntu }}-latest
+      image: ros:${{ matrix.config.ros_version }}-ros-base-${{ matrix.config.ubuntu }}
     steps:
-      - name: Setup ROS 2 (${{ matrix.config.ros_version }})
-        uses: ros-tooling/setup-ros@v0.7
-        with:
-          required-ros-distributions: ${{ matrix.config.ros_version }}
-      - name: Checkout repository
-        uses: actions/checkout@v4
+      - uses: runs-on/action@v2
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
-
-      # Workaround for https://github.com/actions/runner/issues/2033
-      - name: ownership workaround
+      - name: Configure Git Safe Directory
         run: git config --system --add safe.directory '*'
 
+      - uses: ./.github/actions/setup-ccache
+        id: ccache
+        with:
+          cache-key-prefix: ccache-ros-translation-${{ matrix.config.ros_version }}
+          max-size: 150M
+          base-dir: /ros_ws
+          install-ccache: 'true'
+
       - name: Check .msg file versioning
         if: github.event_name == 'pull_request'
         run: |
           ./Tools/ci/check_msg_versioning.sh ${{ github.event.pull_request.base.sha }} ${{github.event.pull_request.head.sha}}
 
-      - name: Build and test
+      - name: Build - Translation Node
         run: |
           ros_ws=/ros_ws
           mkdir -p $ros_ws/src
           ./Tools/copy_to_ros_ws.sh $ros_ws
           cd $ros_ws
           source /opt/ros/${{ matrix.config.ros_version }}/setup.sh
-          colcon build --cmake-args -DCMAKE_BUILD_TYPE=Release --symlink-install --event-handlers=console_cohesion+
-          source ./install/setup.sh
-          ./build/translation_node/translation_node_unit_tests
+          colcon build --cmake-args -DCMAKE_BUILD_TYPE=Release -DCMAKE_CXX_COMPILER_LAUNCHER=ccache -DCMAKE_C_COMPILER_LAUNCHER=ccache --symlink-install --event-handlers=console_cohesion+
+
+      - name: Test - Translation Node Unit Tests
+        run: |
+          source /ros_ws/install/setup.sh
+          /ros_ws/build/translation_node/translation_node_unit_tests
+
+      - uses: ./.github/actions/save-ccache
+        if: always()
+        with:
+          cache-primary-key: ${{ steps.ccache.outputs.cache-primary-key }}

.github/workflows/sbom_license_check.yml

@@ -0,0 +1,42 @@
+name: SBOM License Check
+
+on:
+  push:
+    branches:
+      - 'main'
+      - 'release/**'
+      - 'stable'
+    paths:
+      - '.gitmodules'
+      - 'Tools/ci/license-overrides.yaml'
+      - 'Tools/ci/generate_sbom.py'
+  pull_request:
+    branches:
+      - '**'
+    paths:
+      - '.gitmodules'
+      - 'Tools/ci/license-overrides.yaml'
+      - 'Tools/ci/generate_sbom.py'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  verify-licenses:
+    runs-on: ubuntu-24.04
+
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 1
+          submodules: false
+
+      - name: Install PyYAML
+        run: pip install pyyaml --break-system-packages
+
+      - name: Verify submodule licenses
+        run: python3 Tools/ci/generate_sbom.py --verify-licenses --source-dir .

.github/workflows/sbom_monthly_audit.yml

@@ -0,0 +1,132 @@
+name: SBOM Monthly Audit
+
+on:
+  schedule:
+    # First Monday of each month at 09:00 UTC
+    - cron: '0 9 1-7 * 1'
+  workflow_dispatch:
+    inputs:
+      branch:
+        description: 'Branch to audit (leave empty for current)'
+        required: false
+        type: string
+
+permissions:
+  contents: read
+  issues: write
+
+jobs:
+  audit:
+    runs-on: ubuntu-24.04
+
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.branch || github.ref }}
+          fetch-depth: 1
+          submodules: recursive
+
+      - name: Install PyYAML
+        run: pip install pyyaml --break-system-packages
+
+      - name: Run license verification
+        id: verify
+        continue-on-error: true
+        run: |
+          python3 Tools/ci/generate_sbom.py --verify-licenses --source-dir . 2>&1 | tee /tmp/sbom-verify.txt
+          echo "exit_code=$?" >> "$GITHUB_OUTPUT"
+
+      - name: Check for issues
+        id: check
+        run: |
+          if grep -q "<-- UNRESOLVED" /tmp/sbom-verify.txt; then
+            echo "has_issues=true" >> "$GITHUB_OUTPUT"
+            # Extract only genuinely unresolved license lines
+            grep "<-- UNRESOLVED" /tmp/sbom-verify.txt > /tmp/sbom-issues.txt || true
+            # Extract copyleft lines
+            sed -n '/Copyleft licenses detected/,/^$/p' /tmp/sbom-verify.txt > /tmp/sbom-copyleft.txt || true
+          else
+            echo "has_issues=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Create issue if problems found
+        if: steps.check.outputs.has_issues == 'true'
+        uses: actions/github-script@v9
+        with:
+          script: |
+            const fs = require('fs');
+
+            const fullOutput = fs.readFileSync('/tmp/sbom-verify.txt', 'utf8');
+            let issueLines = '';
+            try {
+              issueLines = fs.readFileSync('/tmp/sbom-issues.txt', 'utf8');
+            } catch (e) {
+              issueLines = 'No specific NOASSERTION lines captured.';
+            }
+            let copyleftLines = '';
+            try {
+              copyleftLines = fs.readFileSync('/tmp/sbom-copyleft.txt', 'utf8');
+            } catch (e) {
+              copyleftLines = '';
+            }
+
+            const date = new Date().toISOString().split('T')[0];
+            const branch = '${{ inputs.branch || github.ref_name }}';
+
+            // Check for existing open issue to avoid duplicates
+            const existing = await github.rest.issues.listForRepo({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              labels: 'sbom-audit',
+              state: 'open',
+            });
+
+            if (existing.data.length > 0) {
+              // Update existing issue with new findings
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: existing.data[0].number,
+                body: `## Monthly audit update (${date})\n\nIssues still present:\n\n\`\`\`\n${issueLines}\n\`\`\`\n${copyleftLines ? `\n### Copyleft warnings\n\`\`\`\n${copyleftLines}\n\`\`\`` : ''}`,
+              });
+              return;
+            }
+
+            await github.rest.issues.create({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              title: `chore(sbom): license audit found NOASSERTION entries on ${branch} (${date})`,
+              labels: ['sbom-audit'],
+              assignees: ['mrpollo'],
+              body: [
+                `## SBOM Monthly Audit -- ${branch} -- ${date}`,
+                '',
+                'The automated SBOM license audit found submodules with unresolved licenses.',
+                '',
+                '### NOASSERTION entries',
+                '',
+                '```',
+                issueLines,
+                '```',
+                '',
+                copyleftLines ? `### Copyleft warnings\n\n\`\`\`\n${copyleftLines}\n\`\`\`\n` : '',
+                '### How to fix',
+                '',
+                '1. Check the submodule repo for a LICENSE file',
+                '2. Add an override to `Tools/ci/license-overrides.yaml`',
+                '3. Run `python3 Tools/ci/generate_sbom.py --verify-licenses --source-dir .` to confirm',
+                '',
+                '### Full output',
+                '',
+                '<details>',
+                '<summary>Click to expand</summary>',
+                '',
+                '```',
+                fullOutput,
+                '```',
+                '',
+                '</details>',
+                '',
+                'cc @mrpollo',
+              ].join('\n'),
+            });

.github/workflows/sitl_tests.yml

@@ -24,7 +24,7 @@ concurrency:
 jobs:
   build:
     name: Testing PX4 ${{ matrix.config.model }}
-    runs-on: [runs-on,runner=4cpu-linux-x64,image=ubuntu22-full-x64,"run-id=${{ github.run_id }}",spot=false]
+    runs-on: [runs-on,runner=8cpu-linux-x64,image=ubuntu24-full-x64,"run-id=${{ github.run_id }}",spot=false,extras=s3-cache]
     container:
       image: px4io/px4-dev-simulation-focal:2021-09-08
       options: --privileged --ulimit core=-1 --security-opt seccomp=unconfined
@@ -33,54 +33,29 @@ jobs:
       matrix:
         config:
           - {model: "iris",          latitude:  "59.617693", longitude: "-151.145316", altitude:  "48", build_type: "RelWithDebInfo" } # Alaska
-          - {model: "tailsitter" ,   latitude:  "29.660316", longitude:  "-82.316658", altitude:  "30", build_type: "RelWithDebInfo" } # Florida
-          - {model: "standard_vtol", latitude:  "47.397742", longitude:    "8.545594", altitude: "488", build_type: "Coverage" } # Zurich
+          # VTOL/tailsitter disabled: persistent flaky CI failures (timeouts, erratic
+          # transitions). Re-enable once the test infrastructure is stabilized.
+          # - {model: "tailsitter" ,   latitude:  "29.660316", longitude:  "-82.316658", altitude:  "30", build_type: "RelWithDebInfo" } # Florida
+          # - {model: "standard_vtol", latitude:  "47.397742", longitude:    "8.545594", altitude: "488", build_type: "Coverage" } # Zurich
+    env:
+      PX4_CMAKE_BUILD_TYPE: ${{ matrix.config.build_type }}
+      PX4_SBOM_DISABLE: 1
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: runs-on/action@v2
+      - uses: actions/checkout@v6
         with:
-          fetch-depth: 0
-
-      - name: Git Ownership Workaround
+          fetch-depth: 1
+      - name: Configure Git Safe Directory
         run: git config --system --add safe.directory '*'
 
-      - id: set-timestamp
-        name: Set timestamp for cache
-        run: echo "::set-output name=timestamp::$(date +"%Y%m%d%H%M%S")"
-
-      - name: Cache Key Config
-        uses: actions/cache@v4
+      - uses: ./.github/actions/setup-ccache
+        id: ccache
         with:
-          path: ~/.ccache
-          key: sitl-ccache-${{ steps.set-timestamp.outputs.timestamp }}
-          restore-keys: sitl-ccache-${{ steps.set-timestamp.outputs.timestamp }}
+          cache-key-prefix: ccache-sitl-gazebo-classic
+          max-size: 350M
 
-      - name: Cache Conf Config
-        run: |
-            mkdir -p ~/.ccache
-            echo "base_dir = ${GITHUB_WORKSPACE}" > ~/.ccache/ccache.conf
-            echo "compression = true" >> ~/.ccache/ccache.conf
-            echo "compression_level = 6" >> ~/.ccache/ccache.conf
-            echo "max_size = 120M" >> ~/.ccache/ccache.conf
-            echo "hash_dir = false" >> ~/.ccache/ccache.conf
-            ccache -s
-            ccache -z
-
-      - name: Build PX4
-        env:
-          PX4_CMAKE_BUILD_TYPE: ${{matrix.config.build_type}}
-        run: make px4_sitl_default
-
-      - name: Cache Post-Run [px4_sitl_default]
-        run: ccache -s
-
-      - name: Build SITL Gazebo
-        env:
-          PX4_CMAKE_BUILD_TYPE: ${{matrix.config.build_type}}
-        run: make px4_sitl_default sitl_gazebo-classic
-
-      - name: Cache Post-Run [sitl_gazebo-classic]
-        run: ccache -s
+      - uses: ./.github/actions/build-gazebo-sitl
 
       - name: Download MAVSDK
         run: wget "https://github.com/mavlink/MAVSDK/releases/download/v$(cat test/mavsdk_tests/MAVSDK_VERSION)/libmavsdk-dev_$(cat test/mavsdk_tests/MAVSDK_VERSION)_ubuntu20.04_amd64.deb"
@@ -93,19 +68,19 @@ jobs:
           PX4_HOME_LAT: ${{matrix.config.latitude}}
           PX4_HOME_LON: ${{matrix.config.longitude}}
           PX4_HOME_ALT: ${{matrix.config.altitude}}
-          PX4_CMAKE_BUILD_TYPE: ${{matrix.config.build_type}}
         run: |
             export
             ulimit -a
 
       - name: Build PX4 / MAVSDK tests
         env:
-          PX4_CMAKE_BUILD_TYPE: ${{matrix.config.build_type}}
           DONT_RUN: 1
         run: make px4_sitl_default sitl_gazebo-classic mavsdk_tests
 
-      - name: Cache Post-Run [px4_sitl_default sitl_gazebo-classic mavsdk_tests]
-        run: ccache -s
+      - uses: ./.github/actions/save-ccache
+        if: always()
+        with:
+          cache-primary-key: ${{ steps.ccache.outputs.cache-primary-key }}
 
       - name: Core Dump Settings
         run: |
@@ -117,13 +92,12 @@ jobs:
           PX4_HOME_LAT: ${{matrix.config.latitude}}
           PX4_HOME_LON: ${{matrix.config.longitude}}
           PX4_HOME_ALT: ${{matrix.config.altitude}}
-          PX4_CMAKE_BUILD_TYPE: ${{matrix.config.build_type}}
         run: test/mavsdk_tests/mavsdk_test_runner.py --speed-factor 10 --abort-early --model ${{matrix.config.model}} test/mavsdk_tests/configs/sitl.json --verbose --force-color
         timeout-minutes: 45
 
       - name: Upload failed logs
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: failed-${{matrix.config.model}}-logs.zip
           path: |
@@ -137,7 +111,7 @@ jobs:
 
       - name: Upload PX4 coredump
         if: failure() && ${{ hashFiles('px4.core') != '' }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: coredump
           path: px4.core
@@ -154,7 +128,7 @@ jobs:
 
       - name: Upload Coverage Information to Codecov
         if: contains(matrix.config.build_type, 'Coverage')
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@v6
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           flags: mavsdk

.github/workflows/stale.yml

@@ -2,6 +2,7 @@ name: 'Handle stale issues and PRs'
 on:
   schedule:
     - cron: '30 1 * * *'
+  workflow_dispatch:
 
 jobs:
   stale:
@@ -9,7 +10,7 @@ jobs:
     steps:
       - uses: actions/stale@v10
         with:
-          operations-per-run: 250
+          operations-per-run: 1500
           days-before-stale: 90
           days-before-close: 30
           stale-issue-label: 'stale'

.github/workflows/sync_release_to_ros2_interface_lib.yml

@@ -0,0 +1,43 @@
+name: Sync release branch to px4-ros2-interface-lib
+
+on:
+  create:
+  workflow_dispatch:
+    inputs:
+      branch:
+        description: 'Release branch name (e.g. release/1.18)'
+        required: true
+        type: string
+
+permissions: {}
+
+jobs:
+  notify-interface-lib:
+    if: >-
+      github.repository == 'PX4/PX4-Autopilot' &&
+      (
+        (github.event_name == 'create' && github.ref_type == 'branch' && startsWith(github.ref_name, 'release/')) ||
+        github.event_name == 'workflow_dispatch'
+      )
+    runs-on: ubuntu-latest
+    steps:
+      - name: Determine branch name
+        id: params
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            BRANCH="${{ inputs.branch }}"
+          else
+            BRANCH="${{ github.ref_name }}"
+          fi
+          echo "branch=$BRANCH" >> "$GITHUB_OUTPUT"
+          echo "Dispatching for branch: $BRANCH"
+
+      - name: Dispatch release branch creation
+        run: |
+          BRANCH="${{ steps.params.outputs.branch }}"
+          curl -s -f -X POST \
+            -H "Authorization: token ${{ secrets.PX4BUILTBOT_PERSONAL_ACCESS_TOKEN }}" \
+            -H "Accept: application/vnd.github.v3+json" \
+            https://api.github.com/repos/Auterion/px4-ros2-interface-lib/dispatches \
+            -d "{\"event_type\":\"px4_release_branch\",\"client_payload\":{\"branch\":\"$BRANCH\"}}"
+          echo "Dispatched px4_release_branch event for $BRANCH"

.github/workflows/sync_to_px4_msgs.yml

@@ -20,7 +20,7 @@ jobs:
     runs-on: [runs-on,runner=4cpu-linux-x64,image=ubuntu22-full-x64,"run-id=${{ github.run_id }}",spot=false]
     steps:
       - name: Checkout PX4 repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup git credentials
         run: |

.github/workflows/tag_px4_msgs_from_px4_release_tag.yml

@@ -0,0 +1,135 @@
+name: Tag px4_msgs from PX4 release tags
+
+on:
+  push:
+    tags:
+      - 'v*.*.*'
+  workflow_dispatch:
+    inputs:
+      tag_name:
+        description: 'PX4 tag to propagate (example: v1.17.0)'
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  tag_px4_msgs:
+    if: github.repository == 'PX4/PX4-Autopilot'
+    runs-on: [runs-on,runner=4cpu-linux-x64,image=ubuntu22-full-x64,"run-id=${{ github.run_id }}",spot=false]
+    env:
+      TAG_NAME: ${{ github.event_name == 'workflow_dispatch' && inputs.tag_name || github.ref_name }}
+    steps:
+      - name: Checkout PX4 repo
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+
+      - name: Setup git credentials
+        run: |
+          git config --global user.name "${{ secrets.PX4BUILDBOT_USER }}"
+          git config --global user.email "${{ secrets.PX4BUILDBOT_EMAIL }}"
+
+      - name: Resolve release branch from tag
+        id: tag_info
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          if [[ ! "${TAG_NAME}" =~ ^v([0-9]+)\.([0-9]+)\.([0-9]+)$ ]]; then
+            echo "Tag format is not stable vX.Y.Z, skipping: ${TAG_NAME}"
+            echo "should_run=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          echo "should_run=true" >> "$GITHUB_OUTPUT"
+
+          major="${BASH_REMATCH[1]}"
+          minor="${BASH_REMATCH[2]}"
+          release_branch="release/${major}.${minor}"
+
+          git show-ref --verify --quiet "refs/heads/${release_branch}" || {
+            echo "PX4 branch ${release_branch} not found"
+            exit 1
+          }
+
+          tag_date="$(git for-each-ref --format='%(creatordate:iso8601)' "refs/tags/${TAG_NAME}")"
+          if [[ -z "${tag_date}" ]]; then
+            echo "Unable to resolve tag date for ${TAG_NAME}"
+            exit 1
+          fi
+
+          echo "release_branch=${release_branch}" >> "$GITHUB_OUTPUT"
+          echo "tag_date=${tag_date}" >> "$GITHUB_OUTPUT"
+
+      - name: Clone px4_msgs repo
+        if: steps.tag_info.outputs.should_run == 'true'
+        run: |
+          git clone https://${{ secrets.PX4BUILTBOT_PERSONAL_ACCESS_TOKEN }}@github.com/PX4/px4_msgs.git
+
+      - name: Checkout matching px4_msgs release branch
+        if: steps.tag_info.outputs.should_run == 'true'
+        shell: bash
+        run: |
+          set -euo pipefail
+          cd px4_msgs
+
+          release_branch="${{ steps.tag_info.outputs.release_branch }}"
+          if git show-ref --verify --quiet "refs/remotes/origin/${release_branch}"; then
+            git checkout -B "${release_branch}" "origin/${release_branch}"
+          else
+            echo "px4_msgs branch ${release_branch} does not exist"
+            exit 1
+          fi
+
+      - name: Verify msg and srv trees are identical
+        if: steps.tag_info.outputs.should_run == 'true'
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          release_branch="${{ steps.tag_info.outputs.release_branch }}"
+          git checkout "${release_branch}"
+
+          # Use the same synchronization logic as sync_to_px4_msgs.yml,
+          # then verify there are no changes in px4_msgs.
+          rm -f px4_msgs/msg/*.msg
+          rm -f px4_msgs/msg/versioned/*.msg
+          rm -f px4_msgs/srv/*.srv
+          rm -f px4_msgs/srv/versioned/*.srv
+          cp msg/*.msg px4_msgs/msg/
+          cp msg/versioned/*.msg px4_msgs/msg/ || true
+          cp srv/*.srv px4_msgs/srv/
+          cp srv/versioned/*.srv px4_msgs/srv/ || true
+
+          if ! git -C px4_msgs diff --exit-code -- msg srv; then
+            echo "Message/service definitions differ between PX4 ${release_branch} and px4_msgs ${release_branch}"
+            exit 1
+          fi
+
+      - name: Create and push tag in px4_msgs
+        if: steps.tag_info.outputs.should_run == 'true'
+        shell: bash
+        run: |
+          set -euo pipefail
+          cd px4_msgs
+
+          target="$(git rev-parse HEAD)"
+          existing_target="$(git rev-parse "refs/tags/${TAG_NAME}^{}" 2>/dev/null || true)"
+
+          if [[ -n "${existing_target}" ]]; then
+            if [[ "${existing_target}" == "${target}" ]]; then
+              echo "Tag ${TAG_NAME} already exists on ${target}; nothing to do"
+              exit 0
+            fi
+            echo "Tag ${TAG_NAME} already exists on ${existing_target}, expected ${target}"
+            exit 1
+          fi
+
+          GIT_COMMITTER_DATE="${{ steps.tag_info.outputs.tag_date }}" \
+            git tag -a "${TAG_NAME}" "${target}" \
+              -m "PX4 msgs and srvs definitions matching PX4 stable release ${TAG_NAME#v}"
+
+          git push origin "refs/tags/${TAG_NAME}"

.gitignore

@@ -109,3 +109,9 @@ src/systemcmds/topic_listener/listener_generated.cpp
 # colcon
 log/
 keys/
+
+# metadata
+_emscripten_sdk/
+
+# virtual Python environment
+.venv

.gitmodules

@@ -109,3 +109,9 @@
 [submodule "src/lib/rl_tools/rl_tools"]
 	path = src/lib/rl_tools/rl_tools
 	url = https://github.com/rl-tools/rl-tools.git
+[submodule "libmodal-json"]
+	path = boards/modalai/voxl2/src/lib/mpa/libmodal-json
+	url = https://gitlab.com/voxl-public/voxl-sdk/core-libs/libmodal-json.git
+[submodule "libmodal-pipe"]
+	path = boards/modalai/voxl2/src/lib/mpa/libmodal-pipe
+	url = https://gitlab.com/voxl-public/voxl-sdk/core-libs/libmodal-pipe.git

.vscode/cmake-variants.yaml

@@ -336,6 +336,11 @@ CONFIG:
       buildType: MinSizeRel
       settings:
         CONFIG: cuav_x25-evo_default
+    cuav_x25-super_default:
+      short: cuav_x25-super
+      buildType: MinSizeRel
+      settings:
+        CONFIG: cuav_x25-super_default
     cubepilot_cubeorange_test:
       short: cubepilot_cubeorange
       buildType: MinSizeRel

CITATION.cff

@@ -0,0 +1,27 @@
+cff-version: 1.2.0
+title: "PX4 Autopilot"
+message: "If you use PX4 in your research, please cite it using this metadata."
+type: software
+authors:
+  - family-names: Meier
+    given-names: Lorenz
+  - name: "The PX4 Contributors"
+repository-code: "https://github.com/PX4/PX4-Autopilot"
+url: "https://px4.io"
+abstract: >-
+  PX4 is an open-source autopilot stack for drones and
+  unmanned vehicles. It supports multirotors, fixed-wing,
+  VTOL, rovers, and many more platforms. PX4 runs on both
+  RTOS and POSIX-compatible operating systems.
+keywords:
+  - autopilot
+  - drone
+  - uav
+  - flight-controller
+  - robotics
+  - ros2
+license: BSD-3-Clause
+identifiers:
+  - type: doi
+    value: "10.5281/zenodo.595432"
+    description: "Zenodo concept DOI (resolves to latest version)"

CMakeLists.txt

@@ -229,6 +229,28 @@ endif()
 #
 project(px4 CXX C ASM)
 
+# Silence Apple ranlib "has no symbols" warnings. Several PX4 sources are
+# wrapped in #if defined(CONFIG_*) guards (e.g. platforms/common/i2c.cpp,
+# spi.cpp, board_common.c, pab_manifest.c, px4_log_history.cpp) and some
+# libraries carry a dummy.cpp placeholder, all of which legitimately produce
+# empty object files on POSIX/SITL. GNU ranlib ignores this; Apple's warns.
+#
+# The warning is actually emitted by `ar qc` (which implicitly builds a symbol
+# table), not by the standalone ranlib call. So we use `ar qcS` to skip the
+# implicit symbol table, then let CMAKE_*_ARCHIVE_FINISH run ranlib with the
+# -no_warning_for_no_symbols flag to add it quietly.
+if(APPLE)
+	set(CMAKE_C_ARCHIVE_CREATE    "<CMAKE_AR> qcS <TARGET> <LINK_FLAGS> <OBJECTS>")
+	set(CMAKE_CXX_ARCHIVE_CREATE  "<CMAKE_AR> qcS <TARGET> <LINK_FLAGS> <OBJECTS>")
+	set(CMAKE_ASM_ARCHIVE_CREATE  "<CMAKE_AR> qcS <TARGET> <LINK_FLAGS> <OBJECTS>")
+	set(CMAKE_C_ARCHIVE_APPEND    "<CMAKE_AR> qS  <TARGET> <LINK_FLAGS> <OBJECTS>")
+	set(CMAKE_CXX_ARCHIVE_APPEND  "<CMAKE_AR> qS  <TARGET> <LINK_FLAGS> <OBJECTS>")
+	set(CMAKE_ASM_ARCHIVE_APPEND  "<CMAKE_AR> qS  <TARGET> <LINK_FLAGS> <OBJECTS>")
+	set(CMAKE_C_ARCHIVE_FINISH    "<CMAKE_RANLIB> -no_warning_for_no_symbols -c <TARGET>")
+	set(CMAKE_CXX_ARCHIVE_FINISH  "<CMAKE_RANLIB> -no_warning_for_no_symbols -c <TARGET>")
+	set(CMAKE_ASM_ARCHIVE_FINISH  "<CMAKE_RANLIB> -no_warning_for_no_symbols -c <TARGET>")
+endif()
+
 # CMake build type (Debug Release RelWithDebInfo MinSizeRel Coverage)
 if(NOT CMAKE_BUILD_TYPE)
 	if(${PX4_PLATFORM} STREQUAL "nuttx")
@@ -240,8 +262,15 @@ if(NOT CMAKE_BUILD_TYPE)
 	set(CMAKE_BUILD_TYPE ${PX4_BUILD_TYPE} CACHE STRING "Build type" FORCE)
 endif()
 
+if(CONFIG_BOARD_SUPPORT_FORTIFIED_TOOLCHAIN)
+	set(PX4_DEBUG_OPT_LEVEL -Og)
+	message(STATUS "fortified toolchain support enabled: PX4_DEBUG_OPT_LEVEL=${PX4_DEBUG_OPT_LEVEL}")
+else()
+	set(PX4_DEBUG_OPT_LEVEL -O0)
+endif()
+
 if((CMAKE_BUILD_TYPE STREQUAL "Debug") OR (CMAKE_BUILD_TYPE STREQUAL "Coverage"))
-	set(MAX_CUSTOM_OPT_LEVEL -O0)
+	set(MAX_CUSTOM_OPT_LEVEL ${PX4_DEBUG_OPT_LEVEL})
 elseif(CMAKE_BUILD_TYPE MATCHES "Sanitizer")
 	set(MAX_CUSTOM_OPT_LEVEL -O1)
 elseif(CMAKE_BUILD_TYPE MATCHES "Release")
@@ -484,6 +513,7 @@ include(bloaty)
 
 include(metadata)
 include(package)
+include(sbom)
 
 # install python requirements using configured python
 add_custom_target(install_python_requirements

CODE_OF_CONDUCT.md

@@ -2,45 +2,82 @@
 
 ## Our Pledge
 
-In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to making participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, gender identity and expression, level of experience, nationality, personal appearance, race, religion, or sexual identity and orientation.
+We as members, contributors, and leaders pledge to make participation in our community a harassment-free experience for everyone, regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, caste, color, religion, or sexual identity and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming, diverse, inclusive, and healthy community.
 
 ## Our Standards
 
-Examples of behavior that contributes to creating a positive environment include:
+Examples of behavior that contributes to a positive environment for our community include:
 
-* Using welcoming and inclusive language
-* Being respectful of differing viewpoints and experiences
-* Gracefully accepting constructive criticism
-* Focusing on what is best for the community
-* Showing empathy towards other community members
+* Demonstrating empathy and kindness toward other people
+* Being respectful of differing opinions, viewpoints, and experiences
+* Giving and gracefully accepting constructive feedback
+* Accepting responsibility and apologizing to those affected by our mistakes, and learning from the experience
+* Focusing on what is best not just for us as individuals, but for the overall community
 
-Examples of unacceptable behavior by participants include:
+Examples of unacceptable behavior include:
 
-* The use of sexualized language or imagery and unwelcome sexual attention or advances
-* Trolling, insulting/derogatory comments, and personal or political attacks
+* The use of sexualized language or imagery, and sexual attention or advances of any kind
+* Trolling, insulting or derogatory comments, and personal or political attacks
 * Public or private harassment
-* Publishing others' private information, such as a physical or electronic address, without explicit permission
+* Publishing others' private information, such as a physical or email address, without their explicit permission
 * Other conduct which could reasonably be considered inappropriate in a professional setting
 
-## Our Responsibilities
+## Enforcement Responsibilities
 
-Project maintainers are responsible for clarifying the standards of acceptable behavior and are expected to take appropriate and fair corrective action in response to any instances of unacceptable behavior.
+Community leaders are responsible for clarifying and enforcing our standards of acceptable behavior and will take appropriate and fair corrective action in response to any behavior that they deem inappropriate, threatening, offensive, or harmful.
 
-Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, or to ban temporarily or permanently any contributor for other behaviors that they deem inappropriate, threatening, offensive, or harmful.
+Community leaders have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, and will communicate reasons for moderation decisions when appropriate.
 
 ## Scope
 
-This Code of Conduct applies both within project spaces and in public spaces when an individual is representing the project or its community. Examples of representing a project or community include using an official project e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event. Representation of a project may be further defined and clarified by project maintainers.
+This Code of Conduct applies within all community spaces, and also applies when an individual is officially representing the community in public spaces. Examples of representing our community include using an official e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event.
 
 ## Enforcement
 
-Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team at lorenz@px4.io. The project team will review and investigate all complaints, and will respond in a way that it deems appropriate to the circumstances. The project team is obligated to maintain confidentiality with regard to the reporter of an incident. Further details of specific enforcement policies may be posted separately.
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the community leaders responsible for enforcement at coc@dronecode.org. All complaints will be reviewed and investigated promptly and fairly.
 
-Project maintainers who do not follow or enforce the Code of Conduct in good faith may face temporary or permanent repercussions as determined by other members of the project's leadership.
+All community leaders are obligated to respect the privacy and security of the reporter of any incident.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing clarity around the nature of the violation and an explanation of why the behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series of actions.
+
+**Consequence**: A warning with consequences for continued behavior. No interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, for a specified period of time. This includes avoiding interactions in community spaces as well as external channels like social media. Violating these terms may lead to a temporary or permanent ban.
+
+### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public communication with the community for a specified period of time. No public or private interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, is allowed during this period. Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community standards, including sustained inappropriate behavior, harassment of an individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within the community.
 
 ## Attribution
 
-This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4, available at [http://contributor-covenant.org/version/1/4][version]
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 2.1, available at [https://www.contributor-covenant.org/version/2/1/code_of_conduct.html][v2.1].
 
-[homepage]: http://contributor-covenant.org
-[version]: http://contributor-covenant.org/version/1/4/
+Community Impact Guidelines were inspired by [Mozilla's code of conduct enforcement ladder][Mozilla CoC].
+
+For answers to common questions about this code of conduct, see the FAQ at [https://www.contributor-covenant.org/faq][FAQ]. Translations are available at [https://www.contributor-covenant.org/translations][translations].
+
+[homepage]: https://www.contributor-covenant.org
+[v2.1]: https://www.contributor-covenant.org/version/2/1/code_of_conduct.html
+[Mozilla CoC]: https://github.com/mozilla/diversity
+[FAQ]: https://www.contributor-covenant.org/faq
+[translations]: https://www.contributor-covenant.org/translations

CONTRIBUTING.md

@@ -1,44 +1,170 @@
-# Contributing to PX4 Firmware
+# Contributing to PX4-Autopilot
 
-We follow the [Github flow](https://guides.github.com/introduction/flow/) development model.
+We follow the [GitHub flow](https://guides.github.com/introduction/flow/) development model.
 
-### Fork the project, then clone your repo
+## Fork the project, then clone your repo
 
-First [fork and clone](https://help.github.com/articles/fork-a-repo) the project project.
+First [fork and clone](https://help.github.com/articles/fork-a-repo) the project.
 
-### Create a feature branch
+## Create a feature branch
 
-*Always* branch off main for new features.
+Always branch off `main` for new features.
 
 ```
 git checkout -b mydescriptivebranchname
 ```
 
-### Edit and build the code
+## Edit and build the code
 
-The [developer guide](https://docs.px4.io/main/en/development/development.html) explains how to set up the development environment on Mac OS, Linux or Windows. Please take note of our [coding style](https://docs.px4.io/main/en/contribute/code.html) when editing files.
+The [developer guide](https://docs.px4.io/main/en/development/development.html) explains how to set up the development environment on Mac OS, Linux or Windows.
 
-### Commit your changes
+### Coding standards
 
-Always write descriptive commit messages and add a fixes or relates note to them with an [issue number](https://github.com/px4/Firmware/issues) (Github will link these then conveniently)
+All C/C++ code must follow the [PX4 coding style](https://docs.px4.io/main/en/contribute/code.html). Formatting is enforced by [astyle](http://astyle.sourceforge.net/) in CI (`make check_format`). Code quality checks run via [clang-tidy](https://clang.llvm.org/extra/clang-tidy/). Pull requests that fail either check will not be merged.
 
-**Example:**
+Python code is checked with [mypy](https://mypy-lang.org/) and [flake8](https://flake8.pycqa.org/).
+
+## Commit message convention
+
+PX4 uses [conventional commits](https://www.conventionalcommits.org/) for all commit messages and PR titles.
+
+### Format
 
 ```
-Change how the attitude controller works
-
-- Fixes rate feed forward
-- Allows a local body rate override
-
-Fixes issue #123
+type(scope): short description of the change
 ```
 
-### Test your changes
+| Part | Rule |
+|------|------|
+| **type** | Category of change (see types table below) |
+| **scope** | The module, driver, board, or area of PX4 affected |
+| **`!`** (optional) | Append before `:` to mark a breaking change |
+| **description** | What the change does, at least 5 characters, written in imperative form |
 
-Since we care about safety, we will regularly ask you for test results. Best is to do a test flight (or bench test where it applies) and upload the logfile from it (on the microSD card in the logs directory) to Google Drive or Dropbox and share the link.
+### Types
 
-### Push your changes
+| Type | Description |
+|------|-------------|
+| `feat` | A new feature |
+| `fix` | A bug fix |
+| `docs` | Documentation only changes |
+| `style` | Formatting, whitespace, no code change |
+| `refactor` | Code change that neither fixes a bug nor adds a feature |
+| `perf` | Performance improvement |
+| `test` | Adding or correcting tests |
+| `build` | Build system or external dependencies |
+| `ci` | CI configuration files and scripts |
+| `chore` | Other changes that don't modify src or test files |
+| `revert` | Reverts a previous commit |
 
-Push changes to your repo and send a [pull request](https://github.com/PX4/Firmware/compare/).
+### Scopes
+
+The scope identifies which part of PX4 is affected. Common scopes:
+
+| Scope | Area |
+|-------|------|
+| `ekf2` | Extended Kalman Filter (state estimation) |
+| `mavlink` | MAVLink messaging protocol |
+| `commander` | Commander and mode management |
+| `navigator` | Mission, RTL, Land, and other navigation modes |
+| `sensors` | Sensor drivers and processing |
+| `drivers` | Hardware drivers |
+| `boards/px4_fmu-v6x` | Board-specific changes (use the board name) |
+| `mc_att_control` | Multicopter attitude control |
+| `mc_pos_control` | Multicopter position control |
+| `fw_att_control` | Fixed-wing attitude control |
+| `vtol` | VTOL-specific logic |
+| `actuators` | Mixer and actuator output |
+| `battery` | Battery monitoring and estimation |
+| `logger` | On-board logging |
+| `param` | Parameter system |
+| `simulation` | SITL, Gazebo, SIH |
+| `ci` | Continuous integration and workflows |
+| `docs` | Documentation |
+| `build` | CMake, toolchain, build system |
+| `uorb` | Inter-module messaging |
+
+For changes spanning multiple subsystems, use the primary one affected. Look at the directory path of the files you changed to find the right scope: `src/modules/ekf2/` uses `ekf2`, `src/drivers/imu/` uses `drivers/imu`, `.github/workflows/` uses `ci`.
+
+### Breaking changes
+
+Append `!` before the colon to indicate a breaking change:
+
+```
+feat(ekf2)!: remove deprecated height fusion API
+```
+
+### Good commit messages
+
+```
+feat(ekf2): add height fusion timeout
+fix(mavlink): correct BATTERY_STATUS_V2 parsing
+refactor(navigator): simplify RTL altitude logic
+ci(workflows): migrate to reusable workflows
+docs(ekf2): update tuning guide
+feat(boards/px4_fmu-v6x)!: remove deprecated driver API
+perf(mc_rate_control): reduce loop latency
+```
+
+### Commits to avoid
+
+These will be flagged by CI and should be squashed or reworded before merging:
+
+```
+fix                                    # too vague, no type or scope
+update                                 # too vague, no type or scope
+ekf2: fix something                   # missing type prefix
+apply suggestions from code review     # squash into parent commit
+do make format                         # squash into parent commit
+WIP: trying something                  # not ready for main
+oops                                   # not descriptive
+```
+
+### PR titles
+
+The PR title follows the same `type(scope): description` format. This is enforced by CI and is especially important because the PR title becomes the commit message when a PR is squash-merged.
+
+### Merge policy
+
+Commits should be atomic and independently revertable. Squash at reviewer discretion for obvious cases (multiple WIP commits, messy review-response history). When your commits are clean and logical, they will be preserved as individual commits on `main`.
+
+### Cleaning up commits
+
+If CI flags your commit messages, you can fix them with an interactive rebase:
+
+```bash
+# Squash all commits into one:
+git rebase -i HEAD~N   # replace N with the number of commits
+# mark all commits except the first as 'squash' or 'fixup'
+# reword the remaining commit to follow the format
+git push --force-with-lease
+
+# Or reword specific commits:
+git rebase -i HEAD~N
+# mark the bad commits as 'reword'
+git push --force-with-lease
+```
+
+## Test your changes
+
+PX4 is safety-critical software. All contributions must include adequate testing where practical:
+
+- **New features** must include unit tests and/or integration tests that exercise the new functionality, where practical. Hardware-dependent changes that cannot be tested in SITL should include bench test or flight test evidence.
+- **Bug fixes** must include a regression test where practical. When automated testing is not feasible (hardware-specific issues, race conditions, etc.), provide a link to a flight log demonstrating the fix and the reproduction steps for the original bug.
+- **Reviewers** will verify that tests or test evidence exist before approving a pull request.
+
+### Types of tests
+
+| Test type | When to use | How to run |
+|-----------|-------------|------------|
+| **Unit tests** (gtest) | Module-level logic, math, parsing | `make tests` |
+| **SITL integration tests** (MAVSDK) | Flight behavior, failsafes, missions | `test/mavsdk_tests/` |
+| **Bench tests / flight logs** | Hardware-dependent changes | Upload logs to [Flight Review](https://logs.px4.io) |
+
+Since we care about safety, we will regularly ask you for test results. Best is to do a test flight (or bench test where it applies) and upload the log file from it (on the microSD card in the logs directory) to Google Drive or Dropbox and share the link.
+
+## Push your changes
+
+Push changes to your repo and send a [pull request](https://github.com/PX4/PX4-Autopilot/compare/).
 
 Make sure to provide some testing feedback and if possible the link to a flight log file. Upload flight log files to [Flight Review](http://logs.px4.io) and link the resulting report.

CTestConfig.cmake

@@ -1,15 +0,0 @@
-## This file should be placed in the root directory of your project.
-## Then modify the CMakeLists.txt file in the root directory of your
-## project to incorporate the testing dashboard.
-##
-## # The following are required to submit to the CDash dashboard:
-##   ENABLE_TESTING()
-##   INCLUDE(CTest)
-
-set(CTEST_PROJECT_NAME "PX4 Firmware")
-set(CTEST_NIGHTLY_START_TIME "00:00:00 EST")
-
-set(CTEST_DROP_METHOD "http")
-set(CTEST_DROP_SITE "my.cdash.org")
-set(CTEST_DROP_LOCATION "/submit.php?project=PX4+Firmware")
-set(CTEST_DROP_SITE_CDASH TRUE)

Jenkinsfile

@@ -101,6 +101,7 @@ pipeline {
             echo $0;
             git clone https://github.com/emscripten-core/emsdk.git _emscripten_sdk;
             cd _emscripten_sdk;
+            git checkout 4.0.15;
             ./emsdk install latest;
             ./emsdk activate latest;
             cd ..;

Kconfig

@@ -67,6 +67,16 @@ menu "Toolchain"
         help
             Enables Cmake Release for -O3 optimization
 
+    config BOARD_SUPPORT_FORTIFIED_TOOLCHAIN
+        bool "Fortified toolchain support"
+        default n
+        help
+            Enable compatibility with toolchains that define
+            _FORTIFY_SOURCE.
+
+            This switches PX4_DEBUG_OPT_LEVEL from -O0 to -Og. Keep this
+            disabled unless the fortified toolchain requires optimization.
+
     config BOARD_ROMFSROOT
         string "ROMFSROOT"
         default "px4fmu_common"
@@ -210,6 +220,10 @@ menu "examples"
 source "src/examples/Kconfig"
 endmenu
 
+menu "templates"
+source "src/templates/Kconfig"
+endmenu
+
 menu "platforms"
 depends on PLATFORM_QURT || PLATFORM_POSIX || PLATFORM_NUTTX
 source "platforms/Kconfig"

MAINTAINERS.md

@@ -1,9 +1,11 @@
 Maintainers
 ===========
 
-See [the documentation on Maintainers](https://docs.px4.io/main/en/contribute/maintainers.html) to learn about the role of the maintainers and the process to become one.
+PX4 is maintained by a group of contributors trusted to steward the project. All maintainers listed below are members of the @PX4/dev-team, have write access, and participate in maintainer decisions. We recognize two types: **Code Owners**, responsible for specific components, and **Reviewers**, who help across the project without a fixed component.
 
-**Active Maintainers**
+See [the documentation on Maintainers](https://docs.px4.io/main/en/contribute/maintainers) to learn about the role of the maintainers and the process to become one.
+
+**Code Owners**
 
 | Name                    | Sector | GitHub | Chat | email
 |-------------------------|--------|--------|------|----------------
@@ -23,6 +25,15 @@ See [the documentation on Maintainers](https://docs.px4.io/main/en/contribute/ma
 | Jacob Dahl | Simulation | [@dakejahl](https://github.com/dakejahl) | dakejahl | <dahl.jakejacob@gmail.com>
 
 
+**Reviewers**
+
+Reviewers help maintain PX4 across the project without ownership of a specific component.
+
+| Name | GitHub | Chat | email
+|------|--------|------|----------------------
+| Onur Ozkan | [@onur-ozkan](https://github.com/onur-ozkan) | onur_ozkan0126 | <onur@orkavian.com>
+
+
 **Documentation Maintainers**
 
 | Name | GitHub | Chat | email

Makefile

@@ -162,6 +162,12 @@ else
 
 endif
 
+# Prefer the interpreter from an active Python virtual environment.
+# Otherwise leave PYTHON_EXECUTABLE unset and let CMake resolve Python.
+ifneq ($(strip $(VIRTUAL_ENV)),)
+	PYTHON_EXECUTABLE ?= $(VIRTUAL_ENV)/bin/python
+endif
+
 # Pick up specific Python path if set
 ifdef PYTHON_EXECUTABLE
 	override CMAKE_ARGS += -DPYTHON_EXECUTABLE=${PYTHON_EXECUTABLE}
@@ -226,9 +232,22 @@ CONFIG_TARGETS_DEFAULT := $(patsubst %_default,%,$(filter %_default,$(ALL_CONFIG
 $(CONFIG_TARGETS_DEFAULT):
 	@$(call cmake-build,$@_default$(BUILD_DIR_SUFFIX))
 
+# Multi-processor boards: build all processor targets together
+# VOXL2 apps processor (default) depends on SLPI DSP being built first
+modalai_voxl2_default: modalai_voxl2_slpi
+modalai_voxl2: modalai_voxl2_slpi
+modalai_voxl2_deb: modalai_voxl2_slpi
+
 all_config_targets: $(ALL_CONFIG_TARGETS)
 all_default_targets: $(CONFIG_TARGETS_DEFAULT)
 
+# DEB package targets: builds _default config, then runs cpack.
+# Multi-processor boards (e.g. VOXL2) chain companion builds automatically
+# via existing cmake prerequisites.
+%_deb:
+	@$(call cmake-build,$(subst _deb,_default,$@)$(BUILD_DIR_SUFFIX))
+	@cd "$(SRC_DIR)/build/$(subst _deb,_default,$@)" && cpack -G DEB
+
 updateconfig:
 	@./Tools/kconfig/updateconfig.py
 
@@ -332,6 +351,7 @@ bootloaders_update: \
 	cuav_7-nano_bootloader \
 	cuav_fmu-v6x_bootloader \
 	cuav_x25-evo_bootloader \
+	cuav_x25-super_bootloader \
 	cubepilot_cubeorange_bootloader \
 	cubepilot_cubeorangeplus_bootloader \
 	hkust_nxt-dual_bootloader \
@@ -412,7 +432,7 @@ tests:
 	$(call cmake-build,px4_sitl_test)
 
 # work around lcov bug #316; remove once lcov is fixed (see https://github.com/linux-test-project/lcov/issues/316)
-LCOBUG = --ignore-errors mismatch
+LCOBUG = --ignore-errors mismatch,negative
 tests_coverage:
 	@$(MAKE) clean
 	@$(MAKE) --no-print-directory tests PX4_CMAKE_BUILD_TYPE=Coverage
@@ -492,13 +512,29 @@ px4_sitl_default-clang:
 	@cd "$(SRC_DIR)"/build/px4_sitl_default-clang && cmake "$(SRC_DIR)" $(CMAKE_ARGS) -G"$(PX4_CMAKE_GENERATOR)" -DCONFIG=px4_sitl_default -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++
 	@$(PX4_MAKE) -C "$(SRC_DIR)"/build/px4_sitl_default-clang
 
+# Paths to exclude from clang-tidy (auto-generated from .gitmodules + manual additions):
+# - All submodules (external code we consume, not edit)
+# - Test code (allowed looser style)
+# - Example code (educational, not production)
+# - Vendored third-party code (e.g., CMSIS_5)
+# - NuttX-only drivers excluded at CMake level (mcp_common); I2C-dependent libs excluded here (smbus)
+# - GPIO excluded here (NuttX platform headers)
+# - Emscripten failsafe web build: source path + Unity build path (failsafe_test.dir)
+#   because CMake Unity Builds merge sources into a generated .cxx under build/
+#
+# To add manual exclusions, append to CLANG_TIDY_EXCLUDE_EXTRA below.
+# Submodules are automatically excluded - no action needed when adding new ones.
+CLANG_TIDY_SUBMODULES := $(shell git config --file .gitmodules --get-regexp path | awk '{print $$2}' | tr '\n' '|' | sed 's/|$$//')
+CLANG_TIDY_EXCLUDE_EXTRA := src/systemcmds/tests|src/examples|src/modules/gyro_fft/CMSIS_5|src/lib/drivers/smbus|src/drivers/gpio|src/modules/commander/failsafe/emscripten|failsafe_test\.dir|\.pb\.cc
+CLANG_TIDY_EXCLUDE := $(CLANG_TIDY_SUBMODULES)|$(CLANG_TIDY_EXCLUDE_EXTRA)
+
 clang-tidy: px4_sitl_default-clang
-	@cd "$(SRC_DIR)"/build/px4_sitl_default-clang && "$(SRC_DIR)"/Tools/run-clang-tidy.py -header-filter=".*\.hpp" -j$(j_clang_tidy) -p .
+	@cd "$(SRC_DIR)"/build/px4_sitl_default-clang && "$(SRC_DIR)"/Tools/run-clang-tidy.py -header-filter=".*\.hpp" -j$(j_clang_tidy) -exclude="$(CLANG_TIDY_EXCLUDE)" -p .
 
 # to automatically fix a single check at a time, eg modernize-redundant-void-arg
 #  % run-clang-tidy-4.0.py -fix -j4 -checks=-\*,modernize-redundant-void-arg -p .
 clang-tidy-fix: px4_sitl_default-clang
-	@cd "$(SRC_DIR)"/build/px4_sitl_default-clang && "$(SRC_DIR)"/Tools/run-clang-tidy.py -header-filter=".*\.hpp" -j$(j_clang_tidy) -fix -p .
+	@cd "$(SRC_DIR)"/build/px4_sitl_default-clang && "$(SRC_DIR)"/Tools/run-clang-tidy.py -header-filter=".*\.hpp" -j$(j_clang_tidy) -exclude="$(CLANG_TIDY_EXCLUDE)" -fix -p .
 
 # TODO: Fix cppcheck errors then try --enable=warning,performance,portability,style,unusedFunction or --enable=all
 cppcheck: px4_sitl_default
@@ -518,7 +554,8 @@ validate_module_configs:
 	-not -path "$(SRC_DIR)/src/modules/zenoh/zenoh-pico/*" \
 	-not -path "$(SRC_DIR)/src/lib/events/libevents/*" \
 	-not -path "$(SRC_DIR)/src/lib/cdrstream/*" \
-	-not -path "$(SRC_DIR)/src/lib/crypto/libtommath/*" -print0 | \
+	-not -path "$(SRC_DIR)/src/lib/crypto/libtommath/*" \
+	-not -path "$(SRC_DIR)/src/lib/tensorflow_lite_micro/*" -print0 | \
 	xargs -0 "$(SRC_DIR)"/Tools/validate_yaml.py --schema-file "$(SRC_DIR)"/validation/module_schema.yaml
 
 # Cleanup
@@ -598,3 +635,10 @@ failsafe_web:
 run_failsafe_web_server: failsafe_web
 	@cd build/px4_sitl_default_failsafe_web && \
 		python3 -m http.server
+
+# Generate reference documentation for uORB messages
+.PHONY: msg_docs
+msg_docs:
+	$(call colorecho,'Generating uORB message reference docs')
+	@mkdir -p build/msg_docs
+	@./Tools/msg/generate_msg_docs.py -d build/msg_docs

README.md

@@ -1,62 +1,141 @@
-# PX4 Drone Autopilot
+<p align="center">
+  <a href="https://px4.io">
+    <img src="docs/assets/site/px4_logo.svg" alt="PX4 Autopilot" width="240">
+  </a>
+</p>
 
-[![Releases](https://img.shields.io/github/release/PX4/PX4-Autopilot.svg)](https://github.com/PX4/PX4-Autopilot/releases) [![DOI](https://zenodo.org/badge/22634/PX4/PX4-Autopilot.svg)](https://zenodo.org/badge/latestdoi/22634/PX4/PX4-Autopilot)
+<p align="center">
+  <em>The autopilot stack the industry builds on.</em>
+</p>
 
-[![Build Targets](https://github.com/PX4/PX4-Autopilot/actions/workflows/build_all_targets.yml/badge.svg?branch=main)](https://github.com/PX4/PX4-Autopilot/actions/workflows/build_all_targets.yml) [![SITL Tests](https://github.com/PX4/PX4-Autopilot/workflows/SITL%20Tests/badge.svg?branch=master)](https://github.com/PX4/PX4-Autopilot/actions?query=workflow%3A%22SITL+Tests%22)
+<p align="center">
+  <a href="https://github.com/PX4/PX4-Autopilot/releases"><img src="https://img.shields.io/github/release/PX4/PX4-Autopilot.svg" alt="Release"></a>
+  <a href="https://zenodo.org/badge/latestdoi/22634/PX4/PX4-Autopilot"><img src="https://zenodo.org/badge/22634/PX4/PX4-Autopilot.svg" alt="DOI"></a>
+  <a href="https://discord.gg/dronecode"><img src="https://img.shields.io/discord/1022170275984457759?label=discord&logo=discord&logoColor=white&color=5865F2" alt="Discord"></a>
+</p>
 
-[![Discord Shield](https://discordapp.com/api/guilds/1022170275984457759/widget.png?style=shield)](https://discord.gg/dronecode)
+<p align="center">
+  <a href="https://www.bestpractices.dev/projects/6520"><img src="https://www.bestpractices.dev/projects/6520/badge" alt="OpenSSF Best Practices"></a>
+  <a href="https://insights.linuxfoundation.org/project/px4"><img src="https://insights.linuxfoundation.org/api/badge/health-score?project=px4" alt="LFX Health Score"></a>
+  <a href="https://insights.linuxfoundation.org/project/px4"><img src="https://insights.linuxfoundation.org/api/badge/contributors?project=px4" alt="LFX Contributors"></a>
+  <a href="https://insights.linuxfoundation.org/project/px4"><img src="https://insights.linuxfoundation.org/api/badge/active-contributors?project=px4" alt="LFX Active Contributors"></a>
+</p>
 
-This repository holds the [PX4](http://px4.io) flight control solution for drones, with the main applications located in the [src/modules](https://github.com/PX4/PX4-Autopilot/tree/main/src/modules) directory. It also contains the PX4 Drone Middleware Platform, which provides drivers and middleware to run drones.
+---
 
-PX4 is highly portable, OS-independent and supports Linux, NuttX and MacOS out of the box.
+## About
 
-* Official Website: http://px4.io (License: BSD 3-clause, [LICENSE](https://github.com/PX4/PX4-Autopilot/blob/main/LICENSE))
-* [Supported airframes](https://docs.px4.io/main/en/airframes/airframe_reference.html) ([portfolio](https://px4.io/ecosystem/commercial-systems/)):
-  * [Multicopters](https://docs.px4.io/main/en/frames_multicopter/)
-  * [Fixed wing](https://docs.px4.io/main/en/frames_plane/)
-  * [VTOL](https://docs.px4.io/main/en/frames_vtol/)
-  * [Autogyro](https://docs.px4.io/main/en/frames_autogyro/)
-  * [Rover](https://docs.px4.io/main/en/frames_rover/)
-  * many more experimental types (Blimps, Boats, Submarines, High Altitude Balloons, Spacecraft, etc)
-* Releases: [Downloads](https://github.com/PX4/PX4-Autopilot/releases)
+PX4 is an open-source autopilot stack for drones and unmanned vehicles. It supports multirotors, fixed-wing, VTOL, rovers, and many more experimental platforms from racing quads to industrial survey aircraft. It runs on [NuttX](https://nuttx.apache.org/), Linux, and macOS. Licensed under [BSD 3-Clause](LICENSE).
 
-## Releases
+## Why PX4
 
-Release notes and supporting information for PX4 releases can be found on the [Developer Guide](https://docs.px4.io/main/en/releases/).
+**Modular architecture.** PX4 is built around [uORB](https://docs.px4.io/main/en/middleware/uorb.html), a [DDS](https://docs.px4.io/main/en/middleware/uxrce_dds.html)-compatible publish/subscribe middleware. Modules are fully parallelized and thread safe. You can build custom configurations and trim what you don't need.
 
-## Building a PX4 based drone, rover, boat or robot
+**Wide hardware support.** PX4 runs on a wide range of [autopilot boards](https://docs.px4.io/main/en/flight_controller/) and supports an extensive set of sensors, telemetry radios, and actuators through the [Pixhawk](https://pixhawk.org/) ecosystem.
 
-The [PX4 User Guide](https://docs.px4.io/main/en/) explains how to assemble [supported vehicles](https://docs.px4.io/main/en/airframes/airframe_reference.html) and fly drones with PX4. See the [forum and chat](https://docs.px4.io/main/en/#getting-help) if you need help!
+**Developer friendly.** First-class support for [MAVLink](https://mavlink.io/) and [DDS / ROS 2](https://docs.px4.io/main/en/ros2/) integration. Comprehensive [SITL simulation](https://docs.px4.io/main/en/simulation/), hardware-in-the-loop testing, and [log analysis](https://docs.px4.io/main/en/log/flight_log_analysis.html) tools. An active developer community on [Discord](https://discord.gg/dronecode) and the [weekly dev call](https://docs.px4.io/main/en/contribute/).
 
+**Vendor neutral governance.** PX4 is hosted under the [Dronecode Foundation](https://www.dronecode.org/), part of the Linux Foundation. Business-friendly BSD-3 license. No single vendor controls the roadmap.
 
-## Changing Code and Contributing
+## Supported Vehicles
 
-This [Developer Guide](https://docs.px4.io/main/en/development/development.html) is for software developers who want to modify the flight stack and middleware (e.g. to add new flight modes), hardware integrators who want to support new flight controller boards and peripherals, and anyone who wants to get PX4 working on a new (unsupported) airframe/vehicle.
+<table>
+  <tr>
+    <td align="center">
+      <a href="https://docs.px4.io/main/en/frames_multicopter/">
+        <img src="docs/assets/airframes/types/QuadRotorX.svg" width="50" alt="Multicopter"><br>
+        <sub>Multicopter</sub>
+      </a>
+    </td>
+    <td align="center">
+      <a href="https://docs.px4.io/main/en/frames_plane/">
+        <img src="docs/assets/airframes/types/Plane.svg" width="50" alt="Fixed Wing"><br>
+        <sub>Fixed Wing</sub>
+      </a>
+    </td>
+    <td align="center">
+      <a href="https://docs.px4.io/main/en/frames_vtol/">
+        <img src="docs/assets/airframes/types/VTOLPlane.svg" width="50" alt="VTOL"><br>
+        <sub>VTOL</sub>
+      </a>
+    </td>
+    <td align="center">
+      <a href="https://docs.px4.io/main/en/frames_rover/">
+        <img src="docs/assets/airframes/types/Rover.svg" width="50" alt="Rover"><br>
+        <sub>Rover</sub>
+      </a>
+    </td>
+  </tr>
+</table>
 
-Developers should read the [Guide for Contributions](https://docs.px4.io/main/en/contribute/).
-See the [forum and chat](https://docs.px4.io/main/en/#getting-help) if you need help!
+<sub>…and many more: helicopters, autogyros, airships, submarines, boats, and other experimental platforms. These frames have basic support but are not part of the regular flight-test program. See the <a href="https://docs.px4.io/main/en/airframes/airframe_reference.html">full airframe reference</a>.</sub>
 
+## Try PX4
 
-## Weekly Dev Call
+Run PX4 in simulation with a single command. No build tools, no dependencies beyond Docker:
 
-The PX4 Dev Team syncs up on a [weekly dev call](https://docs.px4.io/main/en/contribute/).
+```bash
+docker run --rm -it -p 14550:14550/udp px4io/px4-sitl:latest
+```
 
-> **Note** The dev call is open to all interested developers (not just the core dev team). This is a great opportunity to meet the team and contribute to the ongoing development of the platform. It includes a QA session for newcomers. All regular calls are listed in the [Dronecode calendar](https://www.dronecode.org/calendar/).
+Open [QGroundControl](https://qgroundcontrol.com) and fly. See [PX4 Simulation Quickstart](../dev_setup/px4_simulation_quickstart.md) for more options.
 
+## Build from Source
 
-## Maintenance Team
+```bash
+git clone https://github.com/PX4/PX4-Autopilot.git --recursive
+cd PX4-Autopilot
+make px4_sitl
+```
 
-See the latest list of maintainers on [MAINTAINERS](MAINTAINERS.md) file at the root of the project.
+> [!NOTE]
+> See the [Development Guide](https://docs.px4.io/main/en/development/development.html) for toolchain setup and build options.
 
-For the latest stats on contributors please see the latest stats for the Dronecode ecosystem in our project dashboard under [LFX Insights](https://insights.lfx.linuxfoundation.org/foundation/dronecode). For information on how to update your profile and affiliations please see the following support link on how to [Complete Your LFX Profile](https://docs.linuxfoundation.org/lfx/my-profile/complete-your-lfx-profile). Dronecode publishes a yearly snapshot of contributions and achievements on its [website under the Reports section](https://dronecode.org).
+## Documentation & Resources
 
-## Supported Hardware
+| Resource | Description |
+| --- | --- |
+| [User Guide](https://docs.px4.io/main/en/) | Build, configure, and fly with PX4 |
+| [Developer Guide](https://docs.px4.io/main/en/development/development.html) | Modify the flight stack, add peripherals, port to new hardware |
+| [Airframe Reference](https://docs.px4.io/main/en/airframes/airframe_reference.html) | Full list of supported frames |
+| [Autopilot Hardware](https://docs.px4.io/main/en/flight_controller/) | Compatible flight controllers |
+| [Release Notes](https://docs.px4.io/main/en/releases/) | What's new in each release |
+| [Contribution Guide](https://docs.px4.io/main/en/contribute/) | How to contribute to PX4 |
 
-For the most up to date information, please visit [PX4 User Guide > Autopilot Hardware](https://docs.px4.io/main/en/flight_controller/).
+## Community
 
-## Project Governance
+- **Weekly Dev Call** — open to all developers ([Dronecode calendar](https://www.dronecode.org/calendar/))
+- **Discord** — [Join the Dronecode server](https://discord.gg/dronecode)
+- **Discussion Forum** — [PX4 Discuss](https://discuss.px4.io/)
+- **Maintainers** — see [`MAINTAINERS.md`](MAINTAINERS.md)
+- **Contributor Stats** — [LFX Insights](https://insights.lfx.linuxfoundation.org/foundation/dronecode)
 
-The PX4 Autopilot project including all of its trademarks is hosted under [Dronecode](https://www.dronecode.org/), part of the Linux Foundation.
+## Contributing
 
-<a href="https://www.dronecode.org/" style="padding:20px" ><img src="https://dronecode.org/wp-content/uploads/sites/24/2020/08/dronecode_logo_default-1.png" alt="Dronecode Logo" width="110px"/></a>
-<div style="padding:10px">&nbsp;</div>
+We welcome contributions of all kinds — bug reports, documentation, new features, and code reviews. Please read the [Contribution Guide](https://docs.px4.io/main/en/contribute/) to get started.
+
+## Citation
+
+If you use PX4 in academic work, please cite it. BibTeX:
+
+```bibtex
+@software{px4_autopilot,
+  author    = {Meier, Lorenz and {The PX4 Contributors}},
+  title     = {{PX4 Autopilot}},
+  publisher = {Zenodo},
+  doi       = {10.5281/zenodo.595432},
+  url       = {https://px4.io}
+}
+```
+
+The DOI above is a Zenodo concept DOI that always resolves to the latest release. For a version-pinned citation, see the [Zenodo record](https://doi.org/10.5281/zenodo.595432) or our [`CITATION.cff`](CITATION.cff).
+
+## Governance
+
+The PX4 Autopilot project is hosted by the [Dronecode Foundation](https://www.dronecode.org/), a [Linux Foundation](https://www.linuxfoundation.org/) Collaborative Project. Dronecode holds all PX4 trademarks and serves as the project's legal guardian, ensuring vendor-neutral stewardship — no single company owns the name or controls the roadmap. The source code is licensed under the [BSD 3-Clause](LICENSE) license, so you are free to use, modify, and distribute it in your own projects.
+
+<p align="center">
+  <a href="https://www.dronecode.org/">
+    <img src="docs/assets/site/dronecode_logo.svg" alt="Dronecode Logo" width="180">
+  </a>
+</p>

ROMFS/CMakeLists.txt

@@ -193,6 +193,7 @@ endif()
 # board custom init files
 set(OPTIONAL_BOARD_RC)
 list(APPEND OPTIONAL_BOARD_RC
+	rc.board_early
 	rc.board_defaults
 	rc.board_sensors
 	rc.board_extras

ROMFS/px4fmu_common/init.d-posix/airframes/10040_sihsim_quadx

@@ -34,6 +34,7 @@ param set-default PWM_MAIN_FUNC2 102
 param set-default PWM_MAIN_FUNC3 103
 param set-default PWM_MAIN_FUNC4 104
 
-param set-default EKF2_GPS_DELAY 0
+param set-default SENS_GPS0_DELAY 0
+param set-default SENS_GPS1_DELAY 0
 
 param set SIH_VEHICLE_TYPE 0

ROMFS/px4fmu_common/init.d-posix/airframes/10041_sihsim_airplane

@@ -44,7 +44,8 @@ param set-default PWM_MAIN_FUNC2 202
 param set-default PWM_MAIN_FUNC3 203
 param set-default PWM_MAIN_FUNC4 101
 
-param set-default EKF2_GPS_DELAY 0
+param set-default SENS_GPS0_DELAY 0
+param set-default SENS_GPS1_DELAY 0
 
 # Rate controllers
 param set-default FW_RR_P 0.0500

ROMFS/px4fmu_common/init.d-posix/airframes/10042_sihsim_xvert

@@ -11,7 +11,8 @@
 PX4_SIMULATOR=${PX4_SIMULATOR:=sihsim}
 PX4_SIM_MODEL=${PX4_SIM_MODEL:=xvert}
 
-param set-default EKF2_GPS_DELAY 0
+param set-default SENS_GPS0_DELAY 0
+param set-default SENS_GPS1_DELAY 0
 param set-default EKF2_FUSE_BETA 0 # side slip fusion is currently not supported for tailsitters
 
 param set-default SENS_EN_GPSSIM 1

ROMFS/px4fmu_common/init.d-posix/airframes/10043_sihsim_standard_vtol

@@ -27,7 +27,8 @@ param set-default SENS_EN_BAROSIM 1
 param set-default SENS_EN_MAGSIM 1
 param set-default SENS_EN_ARSPDSIM 1
 
-param set-default EKF2_GPS_DELAY 0
+param set-default SENS_GPS0_DELAY 0
+param set-default SENS_GPS1_DELAY 0
 
 param set-default VT_TYPE 2
 param set-default MPC_MAN_Y_MAX 60

ROMFS/px4fmu_common/init.d-posix/airframes/10044_sihsim_hex

@@ -18,6 +18,7 @@ param set-default SENS_EN_BAROSIM 1
 param set-default SENS_EN_MAGSIM 1
 
 param set SIH_VEHICLE_TYPE 4
+param set-default MAV_TYPE 13
 
 # Symmetric hexacopter X clockwise motor numbering
 param set-default CA_ROTOR_COUNT 6
@@ -44,4 +45,5 @@ param set-default PWM_MAIN_FUNC4 104
 param set-default PWM_MAIN_FUNC5 105
 param set-default PWM_MAIN_FUNC6 106
 
-param set-default EKF2_GPS_DELAY 0
+param set-default SENS_GPS0_DELAY 0
+param set-default SENS_GPS1_DELAY 0

ROMFS/px4fmu_common/init.d-posix/airframes/4003_gz_rc_cessna

@@ -44,8 +44,6 @@ param set-default FW_T_SINK_MIN 3
 
 param set-default FW_W_EN 1
 
-param set-default FD_ESCS_EN 0
-
 param set-default MIS_TAKEOFF_ALT 30
 
 param set-default NAV_ACC_RAD 15

ROMFS/px4fmu_common/init.d-posix/airframes/4004_gz_standard_vtol

@@ -101,6 +101,6 @@ param set-default NAV_ACC_RAD 5
 param set-default NAV_DLL_ACT 2
 
 param set-default VT_FWD_THRUST_EN 4
-param set-default VT_F_TRANS_THR 0.3
+param set-default VT_PITCH_MIN -5
+param set-default VT_F_TRANS_THR 1
 param set-default VT_TYPE 2
-param set-default FD_ESCS_EN 0

ROMFS/px4fmu_common/init.d-posix/airframes/4006_gz_px4vision

@@ -20,8 +20,8 @@ param set-default COM_DISARM_LAND 0.5
 # EKF2 parameters
 param set-default EKF2_DRAG_CTRL 1
 param set-default EKF2_IMU_POS_X 0.02
-param set-default EKF2_GPS_POS_X 0.055
-param set-default EKF2_GPS_POS_Z -0.15
+param set-default SENS_GPS0_OFFX 0.055
+param set-default SENS_GPS0_OFFZ -0.15
 param set-default EKF2_MIN_RNG 0.03
 param set-default EKF2_OF_CTRL 1
 param set-default EKF2_OF_POS_X 0.055

ROMFS/px4fmu_common/init.d-posix/airframes/60002_gz_uuv_bluerov2_heavy

@@ -26,7 +26,6 @@ param set-default SENS_EN_GPSSIM 1
 param set-default SENS_EN_BAROSIM 1
 param set-default SENS_EN_MAGSIM 1
 param set-default COM_ARM_CHK_ESCS 0  # We don't have ESCs
-param set-default FD_ESCS_EN 0 # We don't have ESCs - but maybe we need this later?
 
 # Set proper failsafes
 param set-default COM_ACT_FAIL_ACT 0
@@ -42,23 +41,21 @@ param set-default FD_FAIL_R 0
 param set-default CA_ROTOR_COUNT 8
 param set-default CA_R_REV 255
 
-param set-default CA_ROTOR0_AX -1
-param set-default CA_ROTOR0_AY 1
+param set-default CA_ROTOR0_AX 1
+param set-default CA_ROTOR0_AY -1
 param set-default CA_ROTOR0_AZ 0
 param set-default CA_ROTOR0_KM 0
 param set-default CA_ROTOR0_PX 0.14
 param set-default CA_ROTOR0_PY 0.10
 param set-default CA_ROTOR0_PZ 0.06
-#param set-default CA_ROTOR0_PZ 0.0
 
-param set-default CA_ROTOR1_AX -1
-param set-default CA_ROTOR1_AY -1
+param set-default CA_ROTOR1_AX 1
+param set-default CA_ROTOR1_AY 1
 param set-default CA_ROTOR1_AZ 0
 param set-default CA_ROTOR1_KM 0
 param set-default CA_ROTOR1_PX 0.14
 param set-default CA_ROTOR1_PY -0.10
 param set-default CA_ROTOR1_PZ 0.06
-#param set-default CA_ROTOR1_PZ 0.0
 
 param set-default CA_ROTOR2_AX 1
 param set-default CA_ROTOR2_AY 1
@@ -67,7 +64,6 @@ param set-default CA_ROTOR2_KM 0
 param set-default CA_ROTOR2_PX -0.14
 param set-default CA_ROTOR2_PY 0.10
 param set-default CA_ROTOR2_PZ 0.06
-#param set-default CA_ROTOR2_PZ 0.0
 
 param set-default CA_ROTOR3_AX 1
 param set-default CA_ROTOR3_AY -1
@@ -79,7 +75,7 @@ param set-default CA_ROTOR3_PZ 0.06
 
 param set-default CA_ROTOR4_AX 0
 param set-default CA_ROTOR4_AY 0
-param set-default CA_ROTOR4_AZ 1
+param set-default CA_ROTOR4_AZ -1
 param set-default CA_ROTOR4_KM 0
 param set-default CA_ROTOR4_PX 0.12
 param set-default CA_ROTOR4_PY 0.22
@@ -103,7 +99,7 @@ param set-default CA_ROTOR6_PZ 0
 
 param set-default CA_ROTOR7_AX 0
 param set-default CA_ROTOR7_AY 0
-param set-default CA_ROTOR7_AZ 1
+param set-default CA_ROTOR7_AZ -1
 param set-default CA_ROTOR7_KM 0
 param set-default CA_ROTOR7_PX -0.12
 param set-default CA_ROTOR7_PY -0.22

ROMFS/px4fmu_common/init.d-posix/airframes/70000_gz_atmos

@@ -28,7 +28,6 @@ param set-default SIM_GZ_EN 1
 
 param set-default SENS_EN_MAGSIM 1
 param set-default COM_ARM_CHK_ESCS 0  # We don't have ESCs
-param set-default FD_ESCS_EN 0
 
 param set-default CA_AIRFRAME 14
 param set-default MAV_TYPE 45

ROMFS/px4fmu_common/init.d-posix/airframes/70001_gz_atmos_dual

@@ -28,7 +28,6 @@ param set-default SIM_GZ_EN 1
 
 param set-default SENS_EN_MAGSIM 1
 param set-default COM_ARM_CHK_ESCS 0  # We don't have ESCs
-param set-default FD_ESCS_EN 0
 
 param set-default CA_AIRFRAME 14
 param set-default MAV_TYPE 45

ROMFS/px4fmu_common/init.d-posix/px4-rc.mavlinksim

@@ -2,7 +2,8 @@
 # shellcheck disable=SC2154
 
 # EKF2 specifics
-param set-default EKF2_GPS_DELAY 10
+param set-default SENS_GPS0_DELAY 10
+param set-default SENS_GPS1_DELAY 10
 param set-default EKF2_MULTI_IMU 3
 param set-default SENS_IMU_MODE 0
 

ROMFS/px4fmu_common/init.d-posix/rcS

@@ -119,10 +119,11 @@ else
 	param set SYS_AUTOCONFIG 1
 fi
 
-if param compare SYS_AUTOCONFIG 1
+# To trigger a parameter reset during boot SYS_AUTOCONFIG was set to 1 before
+if param greater SYS_AUTOCONFIG 0
 then
-	# Reset params except Airframe, RC calibration, sensor calibration, flight modes, total flight time, and next flight UUID.
-	param reset_all SYS_AUTOSTART RC* CAL_* COM_FLTMODE* LND_FLIGHT* TC_* COM_FLIGHT*
+	# Reset parameters except airframe, parameter version, sensor calibration, total flight time, flight UUID
+	param reset_all SYS_AUTOSTART SYS_PARAM_VER CAL_* LND_FLIGHT* TC_* COM_FLIGHT*
 	set AUTOCNF yes
 fi
 

ROMFS/px4fmu_common/init.d/CMakeLists.txt

@@ -123,3 +123,9 @@ if(CONFIG_MODULES_TEMPERATURE_COMPENSATION)
 		rc.thermal_cal
 	)
 endif()
+
+if(CONFIG_DRIVERS_VTXTABLE)
+	px4_add_romfs_files(
+		rc.vtxtable
+	)
+endif()

ROMFS/px4fmu_common/init.d/airframes/1101_rc_plane_sih.hil

@@ -14,6 +14,7 @@
 
 param set UAVCAN_ENABLE 0
 
+param set-default CA_AIRFRAME 1
 param set-default CA_ROTOR_COUNT 1
 param set-default CA_ROTOR0_PX 0.3
 
@@ -38,7 +39,6 @@ param set-default SYS_HITL 2
 # - without real battery
 param set-default CBRK_SUPPLY_CHK 894281
 
-param set SIH_T_MAX 6
 param set SIH_MASS 0.3
 param set SIH_IXX 0.00402
 param set SIH_IYY 0.0144
@@ -48,3 +48,21 @@ param set SIH_KDV 0.2
 
 param set SIH_VEHICLE_TYPE 1 	# sih as fixed wing
 param set RWTO_TKOFF 1  # enable takeoff from runway (as opposed to launched)
+
+# pusher propeller model with advance ratio, model from UIUC APC 8x6"
+param set SIH_F_T_MAX 6
+param set SIH_F_Q_MAX 0.03
+# if SIH_F_CT0 > 0, SIH_F_T_MAX and SIH_F_Q_MAX will be overridden
+param set SIH_F_CT0 0.131
+param set SIH_F_CT1 0.004
+param set SIH_F_CT2 -0.146
+param set SIH_F_CP0 0.0777
+param set SIH_F_CP1 0.0498
+param set SIH_F_CP2 -0.11
+param set SIH_F_DIA_INCH 8
+param set SIH_F_RPM_MAX 9000
+
+param set-default FW_AIRSPD_MIN 7
+param set-default FW_AIRSPD_TRIM 10
+param set-default FW_AIRSPD_MAX 12
+param set-default FW_PSP_OFF 0.5

ROMFS/px4fmu_common/init.d/airframes/1102_tailsitter_duo_sih.hil

@@ -28,6 +28,7 @@ param set-default VT_FW_DIFTHR_EN 1
 param set-default VT_FW_DIFTHR_S_Y 0.3
 param set-default MPC_MAN_Y_MAX 60
 param set-default MC_PITCH_P 5
+param set-default FW_PSP_OFF 5
 
 param set-default CA_AIRFRAME 4
 param set-default CA_ROTOR_COUNT 2
@@ -56,7 +57,6 @@ param set-default HIL_ACT_REV 32
 param set-default MAV_TYPE 19
 
 
-
 # set SYS_HITL to 2 to start the SIH and avoid sensors startup
 param set-default SYS_HITL 2
 
@@ -66,8 +66,9 @@ param set-default CBRK_SUPPLY_CHK 894281
 
 param set-default SENS_DPRES_OFF 0.001
 
-param set SIH_T_MAX 2.0
-param set SIH_Q_MAX 0.0165
+# tailsitter is equipped with two forward propellers
+param set SIH_F_T_MAX 2
+param set SIH_F_Q_MAX 0.0165
 param set SIH_MASS 0.2
 # IXX and IZZ are inverted from the thesis as the body frame is pitched by 90 deg
 param set SIH_IXX 0.00354
@@ -77,6 +78,19 @@ param set SIH_IXZ 0
 param set SIH_KDV 0.2
 param set SIH_L_ROLL 0.145
 
+# propeller diameter, rpm, and coeffs coming from the thesis
+# Modeling and control of a flying wing tailsitter unmanned aerial vehicle."
+# Chiappinelli, Romain, supervised by Nahon, Meyer, McGill University, Masters thesis, 2018.
+# if SIH_F_CT0 > 0, SIH_F_T_MAX and SIH_F_Q_MAX will be overridden
+param set SIH_F_CT0 0.1342
+param set SIH_F_CT1 -0.1196
+param set SIH_F_CT2 -0.1281
+param set SIH_F_CP0 0.0522
+param set SIH_F_CP1 -0.0146
+param set SIH_F_CP2 -0.0602
+param set SIH_F_DIA_INCH 5
+param set SIH_F_RPM_MAX 14000
+
 # sih as tailsitter
 param set SIH_VEHICLE_TYPE 2
 

ROMFS/px4fmu_common/init.d/airframes/1103_standard_vtol_sih.hil

@@ -56,6 +56,7 @@ param set-default CA_SV_CS2_TYPE 4  # rudder
 param set-default FW_AIRSPD_MIN 7
 param set-default FW_AIRSPD_TRIM 10
 param set-default FW_AIRSPD_MAX 12
+param set-default VT_FWD_THRUST_EN 1
 
 param set-default HIL_ACT_FUNC1 101
 param set-default HIL_ACT_FUNC2 102
@@ -77,6 +78,7 @@ param set-default CBRK_SUPPLY_CHK 894281
 
 param set-default SENS_DPRES_OFF 0.001
 
+# quadrotor propellers
 param set SIH_T_MAX 2.0
 param set SIH_Q_MAX 0.0165
 param set SIH_MASS 0.2
@@ -88,5 +90,18 @@ param set SIH_IXZ 0
 param set SIH_KDV 0.2
 param set SIH_L_ROLL 0.2
 
+# pusher propeller model with advance ratio, model from UIUC APC 8x6"
+param set SIH_F_T_MAX 6
+param set SIH_F_Q_MAX 0.03
+# if SIH_F_CT0 > 0, SIH_F_T_MAX and SIH_F_Q_MAX will be overridden
+param set SIH_F_CT0 0.131
+param set SIH_F_CT1 0.004
+param set SIH_F_CT2 -0.146
+param set SIH_F_CP0 0.0777
+param set SIH_F_CP1 0.0498
+param set SIH_F_CP2 -0.11
+param set SIH_F_DIA_INCH 8
+param set SIH_F_RPM_MAX 9000
+
 # sih as standard vtol
 param set SIH_VEHICLE_TYPE 3

ROMFS/px4fmu_common/init.d/airframes/1105_rc_hexa_x_sih.hil

@@ -0,0 +1,49 @@
+#!/bin/sh
+#
+# @name SIH Hexacopter X
+#
+# @type Simulation
+# @class Copter
+#
+# @maintainer Romain Chiappinelli <romain.chiap@gmail.com>
+#
+# @board px4_fmu-v2 exclude
+#
+
+. ${R}etc/init.d/rc.mc_defaults
+
+param set UAVCAN_ENABLE 0
+
+# set SYS_HITL to 2 to start the SIH and avoid sensors startup
+param set SYS_HITL 2
+
+# disable some checks to allow to fly:
+# - without real battery
+param set-default CBRK_SUPPLY_CHK 894281
+
+param set SIH_VEHICLE_TYPE 4
+
+# Symmetric hexacopter X clockwise motor numbering
+param set-default CA_ROTOR_COUNT 6
+param set-default CA_ROTOR0_PX 0.866
+param set-default CA_ROTOR0_PY 0.5
+param set-default CA_ROTOR1_PX 0
+param set-default CA_ROTOR1_PY 1
+param set-default CA_ROTOR1_KM -0.05
+param set-default CA_ROTOR2_PX -0.866
+param set-default CA_ROTOR2_PY 0.5
+param set-default CA_ROTOR3_PX -0.866
+param set-default CA_ROTOR3_PY -0.5
+param set-default CA_ROTOR3_KM -0.05
+param set-default CA_ROTOR4_PX 0
+param set-default CA_ROTOR4_PY -1
+param set-default CA_ROTOR5_PX 0.866
+param set-default CA_ROTOR5_PY -0.5
+param set-default CA_ROTOR5_KM -0.05
+
+param set-default HIL_ACT_FUNC1 101
+param set-default HIL_ACT_FUNC2 102
+param set-default HIL_ACT_FUNC3 103
+param set-default HIL_ACT_FUNC4 104
+param set-default HIL_ACT_FUNC5 105
+param set-default HIL_ACT_FUNC6 106

ROMFS/px4fmu_common/init.d/airframes/4016_holybro_px4vision

@@ -19,8 +19,8 @@ param set-default COM_DISARM_LAND 0.5
 # EKF2 parameters
 param set-default EKF2_DRAG_CTRL 1
 param set-default EKF2_IMU_POS_X 0.02
-param set-default EKF2_GPS_POS_X 0.055
-param set-default EKF2_GPS_POS_Z -0.15
+param set-default SENS_GPS0_OFFX 0.055
+param set-default SENS_GPS0_OFFZ -0.15
 param set-default EKF2_MIN_RNG 0.03
 param set-default EKF2_OF_CTRL 1
 param set-default EKF2_OF_POS_X 0.055

ROMFS/px4fmu_common/init.d/airframes/4020_holybro_px4vision_v1_5

@@ -19,8 +19,8 @@ param set-default COM_DISARM_LAND 0.5
 # EKF2 parameters
 param set-default EKF2_DRAG_CTRL 1
 param set-default EKF2_IMU_POS_X 0.02
-param set-default EKF2_GPS_POS_X 0.055
-param set-default EKF2_GPS_POS_Z -0.15
+param set-default SENS_GPS0_OFFX 0.055
+param set-default SENS_GPS0_OFFZ -0.15
 param set-default EKF2_MIN_RNG 0.03
 param set-default EKF2_OF_CTRL 1
 param set-default EKF2_OF_POS_X 0.055

ROMFS/px4fmu_common/init.d/airframes/4052_holybro_qav250

@@ -2,7 +2,7 @@
 #
 # @name HolyBro QAV250
 #
-# @url https://docs.px4.io/main/en/frames_multicopter/holybro_qav250_pixhawk4_mini.html
+# @url https://docs.px4.io/main/en/frames_multicopter/holybro_qav250_pixhawk4_mini
 #
 # @type Quadrotor x
 # @class Copter

ROMFS/px4fmu_common/init.d/airframes/4061_atl_mantis_edu

@@ -47,8 +47,9 @@ param set-default EKF2_BCOEF_Y 25.5
 
 param set-default EKF2_DRAG_CTRL 1
 
-param set-default EKF2_GPS_DELAY 100
-param set-default EKF2_GPS_POS_X 0.06
+param set-default SENS_GPS0_DELAY 100
+param set-default SENS_GPS1_DELAY 100
+param set-default SENS_GPS0_OFFX 0.06
 param set-default EKF2_GPS_V_NOISE 0.5
 
 param set-default EKF2_IMU_POS_X 0.06

ROMFS/px4fmu_common/init.d/airframes/50001_aion_robotics_r1_rover

@@ -2,7 +2,7 @@
 #
 # @name Aion Robotics R1 UGV
 #
-# @url https://docs.px4.io/main/en/complete_vehicles_rover/aion_r1.html
+# @url https://docs.px4.io/main/en/complete_vehicles_rover/aion_r1
 #
 # @type Rover
 # @class Rover

ROMFS/px4fmu_common/init.d/airframes/60002_uuv_bluerov2_heavy

@@ -22,6 +22,9 @@
 
 . ${R}etc/init.d/rc.uuv_defaults
 
+# Overwrite DDS AG IP to `192.168.0.1`
+param set-default UXRCE_DDS_AG_IP -1062731775
+
 # param set-default MAV_1_CONFIG 102
 
 param set-default BAT1_A_PER_V 37.8798

ROMFS/px4fmu_common/init.d/airframes/CMakeLists.txt

@@ -49,6 +49,7 @@ if(CONFIG_MODULES_SIMULATION_PWM_OUT_SIM)
 		1101_rc_plane_sih.hil
 		1102_tailsitter_duo_sih.hil
 		1103_standard_vtol_sih.hil
+		1105_rc_hexa_x_sih.hil
 	)
 	if(CONFIG_MODULES_ROVER_ACKERMANN)
 		px4_add_romfs_files(

ROMFS/px4fmu_common/init.d/rc.sensors

@@ -238,7 +238,7 @@ then
 fi
 
 # Start TMP102 temperature sensor
-if param compare SENS_EN_TMP102 1
+if param compare -s SENS_EN_TMP102 1
 then
 	tmp102 start -X
 fi

ROMFS/px4fmu_common/init.d/rc.uuv_defaults

@@ -10,9 +10,6 @@ set VEHICLE_TYPE uuv
 # MAV_TYPE_SUBMARINE 12
 param set-default MAV_TYPE 12
 
-# Set micro-dds-client to use ethernet and IP-address 192.168.0.1
-param set-default UXRCE_DDS_AG_IP -1062731775
-
 # Disable preflight disarm to not interfere with external launching
 param set-default COM_DISARM_PRFLT -1
 param set-default CBRK_SUPPLY_CHK 894281