ci: resolve config-audit findings and prune unused tooling

.github/actions/setup-python/action.yml

@@ -3,7 +3,7 @@ description: Setup Python with uv for fast dependency installation
 
 inputs:
   groups:
-    description: 'Dependency groups to install (comma-separated: scripts, precommit, test, ci, qt, coverage, dev, lsp, all)'
+    description: 'Dependency groups to install (comma-separated: scripts, precommit, test, ci, qt, coverage, dev, all)'
     required: false
     default: 'ci'
   python-version:

.github/dependabot.yml

@@ -28,18 +28,6 @@ updates:
       npm-all:
         patterns: ["*"]
 
-  - package-ecosystem: "npm"
-    directory: "/tools/lsp/vscode-extension"
-    schedule:
-      interval: "weekly"
-    commit-message:
-      prefix: "deps"
-      include: "scope"
-    open-pull-requests-limit: 3
-    groups:
-      vscode-ext-all:
-        patterns: ["*"]
-
   - package-ecosystem: "uv"
     directory: "/tools"
     schedule:

.github/labeler.yml

@@ -55,7 +55,6 @@ Video:
   - changed-files:
       - any-glob-to-any-file:
           - 'src/VideoManager/**'
-          - 'src/VideoReceiver/**'
 
 Translations:
   - changed-files:
@@ -69,7 +68,7 @@ MAVLink:
   - changed-files:
       - any-glob-to-any-file:
           - 'src/MAVLink/**'
-          - 'src/comm/**'
+          - 'src/Comms/**'
 
 Tools:
   - changed-files:

.github/renovate.json

@@ -5,19 +5,15 @@
     ":dependencyDashboard",
     ":semanticCommitTypeAll(chore)"
   ],
-  "git-submodules": {
-    "enabled": true
-  },
   "labels": [
     "dependencies"
   ],
   "ignorePaths": [
     ".github/workflows/**"
   ],
-  "description": "Manages npm, git-submodules, pip, pre-commit. GitHub Actions are handled by Dependabot (see dependabot.yml).",
+  "description": "Manages npm, pip, pre-commit. GitHub Actions are handled by Dependabot (see dependabot.yml).",
   "enabledManagers": [
     "npm",
-    "git-submodules",
     "pip_requirements",
     "pip_setup",
     "pep621",
@@ -29,16 +25,6 @@
       "matchUpdateTypes": ["patch"],
       "automerge": true
     },
-    {
-      "description": "Group all git submodule updates",
-      "groupName": "Git Submodules",
-      "matchManagers": [
-        "git-submodules"
-      ],
-      "schedule": [
-        "before 6am on monday"
-      ]
-    },
     {
       "description": "Group Node.js updates (docs)",
       "groupName": "Node.js Dependencies",

.github/runs-on.yml

@@ -1,5 +1,5 @@
-# RunsOn self-hosted runner pools. Not yet referenced by the workflows (they
-# still inline their runner specs); switch jobs to `runner=<pool>` after merge.
+# RunsOn self-hosted runner pools, referenced by the workflows via
+# `runs-on=<run_id>/runner=<pool>`. Edit a pool here to change every job that uses it.
 runners:
   linux-x64-builder:
     family: ["c8i.2xlarge"]

.github/scripts/android_boot_test.py

@@ -15,6 +15,7 @@
 
 from typing import TYPE_CHECKING
 
+from common.gh_actions import gh_error, gh_notice, gh_warning
 from common.proc import run_bytes
 
 if TYPE_CHECKING:
@@ -59,8 +60,8 @@ def install_with_retries(apk_path: Path, retries: int, retry_delay: int) -> bool
 
         stdout = _decode(result.stdout).strip()
         stderr = _decode(result.stderr).strip()
-        print(
-            f"::warning::adb install attempt {attempt}/{retries} failed."
+        gh_warning(
+            f"adb install attempt {attempt}/{retries} failed."
             f" stdout={stdout!r} stderr={stderr!r}"
         )
         if attempt < retries:
@@ -106,7 +107,7 @@ def print_log_group(content: str, pattern: re.Pattern[str], max_lines: int = 80)
 def print_gstreamer_log_group(content: str, max_lines: int = 120) -> None:
     matches = [line for line in content.splitlines() if _GSTREAMER_LOG_PATTERN.search(line)]
     if not matches:
-        print("::notice::No GStreamer-related logcat lines found")
+        gh_notice("No GStreamer-related logcat lines found")
         return
     print(f"::group::GStreamer logcat ({len(matches)} lines)")
     for line in matches[-max_lines:]:
@@ -196,9 +197,9 @@ def emit_failure(
     log_pattern: re.Pattern[str],
     notice: str | None = None,
 ) -> int:
-    print(f"::error::{message}")
+    gh_error(message)
     if notice:
-        print(f"::notice::{notice}")
+        gh_notice(notice)
     logcat_content = read_logcat()
     write_log(log_output, logcat_content)
     print_log_group(logcat_content, log_pattern)
@@ -468,8 +469,8 @@ def main() -> int:
         final_log_pattern = log_pattern
 
         if attempt < args.launch_retries:
-            print(
-                f"::warning::{final_error_message} on attempt "
+            gh_warning(
+                f"{final_error_message} on attempt "
                 f"{attempt}/{args.launch_retries}; retrying..."
             )
             time.sleep(2)
@@ -478,9 +479,9 @@ def main() -> int:
         final_logcat = read_logcat()
 
     write_log(args.log_output, final_logcat)
-    print(f"::error::{final_error_message}")
+    gh_error(final_error_message)
     if final_notice:
-        print(f"::notice::{final_notice}")
+        gh_notice(final_notice)
     print_log_group(final_logcat, final_log_pattern)
     print_gstreamer_log_group(final_logcat)
     return 1

.github/scripts/android_build_retry.py

@@ -9,14 +9,14 @@
 import argparse
 import json
 import re
-import sys
 from pathlib import Path
 
 from ci_bootstrap import ensure_tools_dir
 
 ensure_tools_dir(__file__)
 
 import cmake_helper
+from common.gh_actions import gh_error, gh_warning
 
 _TRUNCATION_RE = re.compile(
     r"Invalid json file: .*android-QGroundControl-deployment-settings\.json\. "
@@ -76,18 +76,15 @@ def main(argv: list[str] | None = None) -> int:
     retry_log = args.build_dir / args.retry_log_name
 
     if not log_path.is_file():
-        print(f"::error::Build failed and '{log_path}' is missing.", file=sys.stderr)
+        gh_error(f"Build failed and '{log_path}' is missing.")
         return 1
 
     if not detect_truncation(log_path):
-        print(
-            "::error::Initial build failed for a non-retriable reason; skipping retry.",
-            file=sys.stderr,
-        )
+        gh_error("Initial build failed for a non-retriable reason; skipping retry.")
         return 1
 
-    print(
-        "::warning::Detected truncated android deployment settings JSON. "
+    gh_warning(
+        "Detected truncated android deployment settings JSON. "
         "Retrying build with --parallel 1."
     )
     clean_settings_json(settings_path)

.github/scripts/android_collect_diagnostics.py

@@ -22,6 +22,7 @@
 
 ensure_tools_dir(__file__)
 
+from common.gh_actions import gh_warning
 from common.proc import run_captured
 
 ADB_TIMEOUT_SHORT = 20
@@ -52,7 +53,7 @@ def _copy_if_exists(src: Path, dst: Path) -> bool:
         shutil.copy2(src, dst)
         return True
     except OSError as e:
-        print(f"::warning::Failed to copy {src} -> {dst}: {e}")
+        gh_warning(f"Failed to copy {src} -> {dst}: {e}")
         return False
 
 

.github/scripts/android_sdk_helper.py

@@ -12,7 +12,7 @@
 
 ensure_tools_dir(__file__)
 
-from common.gh_actions import append_github_env
+from common.gh_actions import append_github_env, gh_error
 from common.net import run_with_retries
 
 
@@ -28,7 +28,7 @@ def _find_sdkmanager(sdk_root: str) -> str:
     )
     found = next((c for c in (default, *versioned) if c.is_file()), None)
     if found is None:
-        print(f"::error::sdkmanager.bat not found under {cmdline_tools}", file=sys.stderr)
+        gh_error(f"sdkmanager.bat not found under {cmdline_tools}")
         sys.exit(1)
     return str(found)
 
@@ -41,14 +41,14 @@ def main() -> None:
 
     sdk_root = os.environ.get("ANDROID_SDK_ROOT", "")
     if not sdk_root:
-        print("::error::ANDROID_SDK_ROOT not set", file=sys.stderr)
+        gh_error("ANDROID_SDK_ROOT not set")
         sys.exit(1)
 
     sdk_root_unix = sdk_root.replace("\\", "/")
     ndk_path = f"{sdk_root_unix}/ndk/{args.ndk_version}"
 
     if not Path(ndk_path).is_dir():
-        print(f"::error::NDK path not found: {ndk_path}", file=sys.stderr)
+        gh_error(f"NDK path not found: {ndk_path}")
         sys.exit(1)
 
     append_github_env(

.github/scripts/attest_helper.py

@@ -12,7 +12,7 @@
 
 ensure_tools_dir(__file__)
 
-from common.gh_actions import write_github_output
+from common.gh_actions import gh_error, gh_warning, write_github_output
 
 
 def cmd_check(args: argparse.Namespace) -> None:
@@ -25,7 +25,7 @@ def cmd_check(args: argparse.Namespace) -> None:
         return
 
     if not subject.exists():
-        print(f"::warning::Artifact not found: {subject}")
+        gh_warning(f"Artifact not found: {subject}")
         write_github_output({"skip": "true"})
         return
 
@@ -49,7 +49,7 @@ def cmd_resolve_path(args: argparse.Namespace) -> None:
     path = args.override or args.default
     p = Path(path)
     if not p.exists():
-        print(f"::error::attest-and-upload: artifact not found at '{path}'")
+        gh_error(f"attest-and-upload: artifact not found at '{path}'")
         parent = p.parent
         if parent.is_dir():
             for entry in sorted(parent.iterdir()):

.github/scripts/aws_upload.py

@@ -21,32 +21,28 @@
 
 ensure_tools_dir(__file__)
 
-from common.gh_actions import write_github_output
+from common.gh_actions import gh_error, write_github_output
 from common.proc import run_captured
 
 
 def validate_credentials(role_arn: str, key_id: str, secret_key: str) -> None:
     """Ensure either OIDC role or static credentials are provided."""
     if not role_arn and (not key_id or not secret_key):
-        print(
-            "::error::Either aws_role_arn (OIDC) or both aws_key_id and "
-            "aws_secret_access_key (static credentials) must be provided",
-            file=sys.stderr,
+        gh_error(
+            "Either aws_role_arn (OIDC) or both aws_key_id and "
+            "aws_secret_access_key (static credentials) must be provided"
         )
         sys.exit(1)
 
 
 def validate_artifact(artifact_path: str, artifact_name: str) -> None:
     """Validate artifact exists and name is safe."""
     if not Path(artifact_path).is_file():
-        print(f"::error::Artifact not found: {artifact_path}", file=sys.stderr)
+        gh_error(f"Artifact not found: {artifact_path}")
         sys.exit(1)
 
     if re.search(r"[/\\]", artifact_name) or ".." in artifact_name:
-        print(
-            f"::error::Invalid artifact name (contains path separators or ..): {artifact_name}",
-            file=sys.stderr,
-        )
+        gh_error(f"Invalid artifact name (contains path separators or ..): {artifact_name}")
         sys.exit(1)
 
 
@@ -105,10 +101,7 @@ def cmd_upload_latest(args: argparse.Namespace) -> None:
 
 def cmd_invalidate(args: argparse.Namespace) -> None:
     if re.search(r"[/\\]", args.artifact_name) or ".." in args.artifact_name:
-        print(
-            f"::error::Invalid artifact name (contains path separators or ..): {args.artifact_name}",
-            file=sys.stderr,
-        )
+        gh_error(f"Invalid artifact name (contains path separators or ..): {args.artifact_name}")
         sys.exit(1)
     _run_aws(
         [

.github/scripts/ccache_helper.py

@@ -44,6 +44,7 @@
     write_step_summary,
 )
 from common.io import require_tar_data_filter
+from common.markdown import md_table
 from common.net import download_with_retry
 from common.proc import run_captured
 from common.tool_version import probe_version
@@ -436,21 +437,17 @@ def build_summary_markdown(stats: dict) -> str:
         )
     )
 
-    lines = [
-        "### CCache Statistics",
-        "",
-        "| Metric | Value |",
-        "|--------|-------|",
-        f"| Cache hits | {hits} / {total} ({pct}%) |",
-        f"| Direct hits | {direct} |",
-        f"| Preprocessed hits | {preprocessed} |",
-        f"| Misses | {misses} |",
-        f"| Cache size | {size_kib / 1024:.0f} MiB / {max_kib / 1048576:.1f} GiB ({size_pct}%) |",
-        f"| Cleanups (LRU evictions) | {cleanups} |",
+    rows = [
+        ["Cache hits", f"{hits} / {total} ({pct}%)"],
+        ["Direct hits", direct],
+        ["Preprocessed hits", preprocessed],
+        ["Misses", misses],
+        ["Cache size", f"{size_kib / 1024:.0f} MiB / {max_kib / 1048576:.1f} GiB ({size_pct}%)"],
+        ["Cleanups (LRU evictions)", cleanups],
     ]
     if errors:
-        lines.append(f"| ⚠ Errors | {errors} |")
-    return "\n".join(lines) + "\n"
+        rows.append(["⚠ Errors", errors])
+    return f"### CCache Statistics\n\n{md_table(['Metric', 'Value'], rows)}\n"
 
 
 def get_ccache_verbose_stats() -> str | None: