ci: pre-install ros-apt-source before setup-ros

ros-tooling/setup-ros@v0.7 (0.7.19) resolves the ros-apt-source version
with an unauthenticated api.github.com 'releases/latest' call. That call
hits the per-IP unauthenticated GitHub API rate limit shared across
GitHub-hosted runners; when it is exhausted the version is empty, the
action builds a .../download//ros2-apt-source_..._all.deb URL, gets a 404,
and ROS never installs (jobs die with 'colcon: command not found',
exit 127) - intermittently, independent of the change under test.

Add a local composite action that installs the ros-apt-source package
first (authenticated version lookup with a pinned fallback, no per-IP
limit). With the ROS 2 apt repo already configured, setup-ros's
isRosAptSourcePackageInstalled check passes and it skips the fragile
fetch. Applied before every setup-ros step in ci.yml, quality.yml, and
opcua-plugin.yml.

Author: bburda

.github/actions/ros-apt-source/action.yml

@@ -0,0 +1,55 @@
+name: Pre-install ROS 2 apt source
+description: >
+  Installs the ros-apt-source package up front so ros-tooling/setup-ros skips its
+  own unauthenticated api.github.com "releases/latest" lookup. That lookup is
+  subject to the per-IP unauthenticated GitHub API rate limit, which is shared
+  across all GitHub-hosted runners; when it is exhausted the call returns no
+  version, setup-ros builds a .../download//ros2-apt-source_..._all.deb URL, gets
+  a 404, and the whole job fails ("colcon: command not found", exit 127). By
+  configuring the ROS 2 apt repo first, setup-ros's isRosAptSourcePackageInstalled
+  check passes and it never performs the fragile fetch.
+
+runs:
+  using: composite
+  steps:
+    - name: Install ros-apt-source (skip setup-ros's rate-limited fetch)
+      shell: bash
+      env:
+        # Authenticated API requests use the per-repo limit (~1000/h), not the
+        # per-IP unauthenticated limit that setup-ros trips over.
+        GH_TOKEN: ${{ github.token }}
+      run: |
+        set -euo pipefail
+
+        SUDO=""
+        if [ "$(id -u)" -ne 0 ]; then SUDO="sudo"; fi
+
+        # Minimal container images may lack curl / CA certificates.
+        if ! command -v curl >/dev/null 2>&1; then
+          $SUDO apt-get update
+          $SUDO apt-get install -y --no-install-recommends curl ca-certificates
+        fi
+
+        codename="$(. /etc/os-release && echo "${UBUNTU_CODENAME:-${VERSION_CODENAME}}")"
+
+        # Resolve the latest ros-apt-source release via an AUTHENTICATED call, then
+        # fall back to a known-good pin so the step is deterministic even if the
+        # API is briefly unreachable.
+        version=""
+        if [ -n "${GH_TOKEN:-}" ]; then
+          version="$(curl -fsSL -H "Authorization: Bearer ${GH_TOKEN}" \
+            "https://api.github.com/repos/ros-infrastructure/ros-apt-source/releases/latest" \
+            | grep -F '"tag_name"' | head -n1 | awk -F'"' '{print $4}' || true)"
+        fi
+        if [ -z "${version}" ]; then
+          version="1.2.0"
+        fi
+
+        deb="ros2-apt-source_${version}.${codename}_all.deb"
+        url="https://github.com/ros-infrastructure/ros-apt-source/releases/download/${version}/${deb}"
+
+        echo "Installing ${deb} (ros-apt-source ${version}, ${codename})"
+        curl --fail --location --retry 5 --retry-delay 3 -o "/tmp/${deb}" "${url}"
+        $SUDO dpkg -i "/tmp/${deb}"
+        rm -f "/tmp/${deb}"
+        $SUDO apt-get update

.github/workflows/ci.yml

@@ -33,6 +33,9 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
+      - name: Pre-install ROS 2 apt source
+        uses: ./.github/actions/ros-apt-source
+
       - name: Set up ROS 2 ${{ matrix.ros_distro }}
         uses: ros-tooling/setup-ros@v0.7
         with:
@@ -130,6 +133,9 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
+      - name: Pre-install ROS 2 apt source
+        uses: ./.github/actions/ros-apt-source
+
       - name: Set up ROS 2 Jazzy
         uses: ros-tooling/setup-ros@v0.7
         with:
@@ -196,6 +202,9 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
+      - name: Pre-install ROS 2 apt source
+        uses: ./.github/actions/ros-apt-source
+
       - name: Set up ROS 2 Jazzy
         uses: ros-tooling/setup-ros@v0.7
         with:
@@ -263,6 +272,9 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
+      - name: Pre-install ROS 2 apt source
+        uses: ./.github/actions/ros-apt-source
+
       - name: Set up ROS 2 Jazzy
         uses: ros-tooling/setup-ros@v0.7
         with:

.github/workflows/opcua-plugin.yml

@@ -61,6 +61,9 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
+      - name: Pre-install ROS 2 apt source
+        uses: ./.github/actions/ros-apt-source
+
       - name: Set up ROS 2 ${{ matrix.ros_distro }}
         uses: ros-tooling/setup-ros@v0.7
         with:

.github/workflows/quality.yml

@@ -32,6 +32,9 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
+      - name: Pre-install ROS 2 apt source
+        uses: ./.github/actions/ros-apt-source
+
       - name: Set up ROS 2 Jazzy
         uses: ros-tooling/setup-ros@v0.7
         with:
@@ -102,6 +105,9 @@ jobs:
       - name: Fix git safe directory
         run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
+      - name: Pre-install ROS 2 apt source
+        uses: ./.github/actions/ros-apt-source
+
       - name: Set up ROS 2 Jazzy
         uses: ros-tooling/setup-ros@v0.7
         with:
@@ -241,6 +247,9 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
+      - name: Pre-install ROS 2 apt source
+        uses: ./.github/actions/ros-apt-source
+
       - name: Set up ROS 2 Jazzy
         uses: ros-tooling/setup-ros@v0.7
         with:
@@ -349,6 +358,9 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
+      - name: Pre-install ROS 2 apt source
+        uses: ./.github/actions/ros-apt-source
+
       - name: Set up ROS 2 Jazzy
         uses: ros-tooling/setup-ros@v0.7
         with: