This repository provides a comprehensive continuous integration (CI) solution for ROS (Robot Operating System) projects. It automates the process of setting up a ROS environment, building code, running tests, and performing additional checks (such as code formatting, static analysis, and ABI compatibility) across multiple CI platforms including Travis CI, GitLab CI, GitHub Actions, and Bitbucket Pipelines. The system is designed to be highly configurable, supporting a wide range of ROS distributions from legacy versions to the latest releases, and isolates builds using Docker by default to ensure consistency across different environments. The architecture is modular, with clear separation of concerns: entry points for each CI system delegate to a central orchestration script (ci_main.sh), which in turn relies on specialized modules for environment setup, ROS configuration, workspace management, and various build systems (catkin_make, catkin_tools, colcon, etc.). Notable for their reusability and craftsmanship are the utility library (src/util.sh), which provides robust logging, error handling, and timing functions, and the Docker isolation layer (src/isolation/docker.sh), which handles the complexities of running CI jobs in containers including volume mounting, credential forwarding, and container lifecycle management. The project demonstrates strong engineering practices through its maintainability, active support for both ROS1 and ROS2, and adaptability to various CI systems. It has been widely adopted in the ROS community, as evidenced by its usage in numerous repositories. Technical debt is kept low through regular updates to support new ROS distributions and CI platforms, and the codebase avoids common pitfalls in shell scripting by using well-structured functions and consistent error handling.
Safety is a commercial CLI tool for software supply chain security, primarily scanning Python (and limited npm) dependencies for known vulnerabilities. It operates as a multi-command CLI built with Click and Typer, offering commands such as `scan`, `check`, `auth`, `firewall`, `init`, and `codebase`. The architecture is modular: a core scanning engine (`safety/scan/`) discovers dependency files (requirements.txt, pyproject.toml, Pipfile.lock, etc.), resolves packages, and matches them against a proprietary vulnerability database fetched from the Safety platform. Results are formatted via a pluggable formatter system (JSON, HTML, screen, text, SPDX) and can be uploaded to the platform for reporting. The tool also includes a firewall mode that intercepts pip/poetry/uv/npm install commands to block malicious packages in real time, using shell aliases (Unix) or registry/autorun (Windows). Authentication is multi-modal: OAuth2 (browser-based), API keys, and machine tokens, with a complex enrollment flow for enterprise MDM. An internal event bus (`safety/events/event_bus/bus.py`) provides async telemetry and audit trail emission, used throughout auth, init, and scan workflows. The codebase demonstrates strong engineering practices: layered configuration resolution (CLI > env > config file > default), a command wrapper pattern for package managers, and a policy file system (YAML) for ignoring vulnerabilities by severity, CVSS score, or expiration. However, there is notable technical drift: the legacy `check` and `license` commands are deprecated but still present, typing is incomplete in several modules, and the Windows firewall interceptor relies on fragile registry manipulation. The test suite is extensive but heavily mocks external services, making integration tests brittle. External dependencies include `httpx`, `authlib`, `tenacity`, `rich`, `pydantic`, `dparse`, `packaging`, `certifi`, `filelock`, and the proprietary `safety-schemas` package. The tool is distributed as a PyPI package and as a GitHub Action, with CI/CD pipelines building platform-specific binaries via PyInstaller and PyApp. Overall, Safety is a mature, feature-rich security tool with a well-architected core, though some areas show signs of rapid feature growth and legacy debt.