[hakuturu583]

Description

The ros2 role resolves the latest ros-apt-source release through api.github.com with no credentials (ansible/roles/ros2/tasks/main.yaml). Anonymous requests are allowed 60 an hour per source address, and GitHub-hosted runners share their egress addresses, so when that pool is busy the call fails and takes the whole play with it:

TASK [autoware.dev_env.ros2 : Get latest release information of ros-apt-source package] ***
fatal: [localhost]: FAILED! => "message":"API rate limit exceeded for 172.190.119.101.
  (But here's the good news: Authenticated requests get a higher rate limit. ...)"

It is intermittent, which makes it worse than a hard break: the same branch fails and passes on consecutive pushes, on PRs that change nothing near ansible/. On #7390, four pushes of nearly the same tree gave two failures and two passes, and each failure cost a full re-run.

• Send a token when there is one. A new role input, ros2_github_token, defaults to $GITHUB_TOKEN and is sent as an Authorization: Bearer header when non-empty. A workflow's GITHUB_TOKEN is allowed 1000 requests an hour for the repository, a PAT 5000.
• Pass it from the two workflows that run the playbook, health-check-ansible and regenerate-lockfiles. (health-check-ansible-artifacts runs --tags artifacts, so the ros2 role never runs there.)
• Nothing changes without a token. A developer's machine and the Docker builds send the request anonymously exactly as before, and -e ros2_github_token= forces that back for an environment whose GITHUB_TOKEN is expired — which would otherwise fail with 401 rather than fall back. That trade is why the token is a documented role input rather than an implicit environment read.
• Retry three times. This covers a transient network error or a 5xx. It does not rescue a spent rate limit, which only resets on the hour; the token is what keeps that from happening.

The task is deliberately not no_log, so that a 401 or 403 stays readable. -v, which both workflows use, does not print module arguments; -vvv does.

How was this PR tested?

On Ubuntu 22.04.5 with ansible-core 2.17.14, running the real role against the real endpoint.

The limit the request actually gets, read back from the response header:

GITHUB_TOKEN	header sent	x-ratelimit-limit	status
unset	no	60	200
set (PAT)	yes	5000	200
set but empty string	no	60	200
-e ros2_github_token= with a token in the environment	no	60	200

So the 60-an-hour pool that CI keeps exhausting is exactly what the unauthenticated path still gets, and a token moves off it.

The role end to end (import_role on autoware.dev_env.ros2, use_locked_versions=false), in all three conditions — token unset, token set, token overridden empty: the release lookup, "Extract latest version" (1.3.0), the codename shell task and get_url of ros2-apt-source_1.3.0.jammy_all.deb all succeeded, leaving a 4.4 KB .deb at /tmp/ros2-apt-source.deb. Only the final apt task failed, on sudo: a password is required on the test host, which is below this change.

A stale token is a hard failure, by design: with GITHUB_TOKEN=ghp_invalid... the task retries three times and fails with 401 Bad credentials, rather than silently falling back to the anonymous limit. Documented in the role defaults, with the -e ros2_github_token= escape hatch.

Token leakage: ran the task with a sentinel token at both verbosity levels and grepped the output — -v 0 hits, -vvv 4 hits. Both workflows use -v, and Actions masks secrets.GITHUB_TOKEN besides.

ansible-lint ansible/ passes (0 failures, 89 files, profile production), and prettier was run on the README.

Not covered

• Exhausting the limit on purpose to watch a real CI run recover. The table above shows the limit the request is granted, which is the mechanism; the failure itself is in feat(ansible): add carla role to install CARLA 1.0 or the nightly build #7390's history.
• regenerate-lockfiles is workflow_dispatch-only, so its env change is untested here beyond being the same two lines as the other workflow.

---

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-04T09:18:09.713702Z	46950fa	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

Thank you for contributing to the Autoware project!

🚧 If your pull request is in progress, switch it to draft mode.

Please ensure:

• You've checked our contribution guidelines.
• Your PR follows our pull request guidelines.
• All required CI checks pass before marking the PR ready for review.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 46950fa6fc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Remove the generated Ansible Galaxy cache from the commit

This adds an installed ansible.posix cache containing 218 files and 26,467 lines, including upstream tests, CI configuration, and installation metadata. ansible/galaxy.yml already declares this dependency, and neither modified workflow is configured to use the checked-in cache, so this creates a second dependency source tree that can drift from the version actually installed while unnecessarily expanding every checkout. Remove the generated .ansible/ tree and ignore that directory to prevent subsequent tooling runs from reintroducing it.

Useful? React with 👍 / 👎.