Merge branch 'upstream/openpilot/master' into sync-20260211

# Conflicts:
#	.github/workflows/auto_pr_review.yaml
#	.github/workflows/tests.yaml
#	opendbc_repo
#	panda
#	selfdrive/pandad/pandad.py
#	selfdrive/test/process_replay/test_processes.py

.github/workflows/jenkins-pr-trigger.yaml

@@ -5,7 +5,44 @@ on:
     types: [created, edited]
 
 jobs:
-  # TODO: gc old branches in a separate job in this workflow
+  cleanup-branches:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Delete stale Jenkins branches
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const cutoff = Date.now() - 24 * 60 * 60 * 1000;
+            const prefixes = ['tmp-jenkins', '__jenkins'];
+
+            for await (const response of github.paginate.iterator(github.rest.repos.listBranches, {
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              per_page: 100,
+            })) {
+              for (const branch of response.data) {
+                if (!prefixes.some(p => branch.name.startsWith(p))) continue;
+
+                const { data: commit } = await github.rest.repos.getCommit({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  ref: branch.commit.sha,
+                });
+
+                const commitDate = new Date(commit.commit.committer.date).getTime();
+                if (commitDate < cutoff) {
+                  console.log(`Deleting branch: ${branch.name} (last commit: ${commit.commit.committer.date})`);
+                  await github.rest.git.deleteRef({
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    ref: `heads/${branch.name}`,
+                  });
+                }
+              }
+            }
+
   scan-comments:
     runs-on: ubuntu-latest
     if: ${{ github.event.issue.pull_request }}

.github/workflows/repo-maintenance.yaml

@@ -21,7 +21,7 @@ jobs:
         run: |
           ${{ env.RUN }} "python3 selfdrive/ui/update_translations.py --vanish"
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@9153d834b60caba6d51c9b9510b087acf9f33f83
+        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0
         with:
           author: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
           commit-message: "Update translations"
@@ -48,6 +48,12 @@ jobs:
         python3 -m ensurepip --upgrade
         pip3 install uv
         uv lock --upgrade
+    - name: uv pip tree
+      id: pip_tree
+      run: |
+        echo 'PIP_TREE<<EOF' >> $GITHUB_OUTPUT
+        uv pip tree >> $GITHUB_OUTPUT
+        echo 'EOF' >> $GITHUB_OUTPUT
     - name: bump submodules
       run: |
         git config --global --add safe.directory '*'
@@ -61,7 +67,7 @@ jobs:
         python selfdrive/car/docs.py
         git add docs/CARS.md
     - name: Create Pull Request
-      uses: peter-evans/create-pull-request@9153d834b60caba6d51c9b9510b087acf9f33f83
+      uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0
       with:
         author: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
         token: ${{ github.repository == 'commaai/openpilot' && secrets.ACTIONS_CREATE_PR_PAT || secrets.GITHUB_TOKEN }}
@@ -70,5 +76,10 @@ jobs:
         branch: auto-package-updates
         base: master
         delete-branch: true
-        body: 'Automatic PR from repo-maintenance -> package_updates'
+        body: |
+          Automatic PR from repo-maintenance -> package_updates
+
+          ```
+          ${{ steps.pip_tree.outputs.PIP_TREE }}
+          ```
         labels: bot

.github/workflows/tests.yaml

@@ -20,8 +20,6 @@ concurrency:
 env:
   PYTHONWARNINGS: error
   BASE_IMAGE: sunnypilot-base
-  AZURE_TOKEN: ${{ secrets.AZURE_COMMADATACI_OPENPILOTCI_TOKEN }}
-
   DOCKER_LOGIN: docker login ghcr.io -u ${{ github.actor }} -p ${{ secrets.GITHUB_TOKEN }}
   BUILD: release/ci/docker_build_sp.sh base
 
@@ -217,12 +215,13 @@ jobs:
       uses: actions/cache@v5
       with:
         path: .ci_cache/comma_download_cache
-        key: proc-replay-${{ hashFiles('selfdrive/test/process_replay/ref_commit', 'selfdrive/test/process_replay/test_processes.py') }}
+        key: proc-replay-${{ hashFiles('selfdrive/test/process_replay/test_processes.py') }}
     - name: Build openpilot
       run: |
         ${{ env.RUN }} "scons -j$(nproc)"
     - name: Run replay
       timeout-minutes: ${{ contains(runner.name, 'nsc') && (steps.dependency-cache.outputs.cache-hit == 'true') && ((steps.setup-step.outputs.duration < 18) && 1 || 2) || 20 }}
+      continue-on-error: ${{ github.ref == 'refs/heads/master' }}
       run: |
         ${{ env.RUN }} "selfdrive/test/process_replay/test_processes.py -j$(nproc) && \
                         chmod -R 777 /tmp/comma_download_cache"
@@ -236,10 +235,26 @@ jobs:
       with:
         name: process_replay_diff.txt
         path: selfdrive/test/process_replay/diff.txt
-    - name: Upload reference logs
-      if: false # TODO: move this to github instead of azure
+    - name: Checkout ci-artifacts
+      if: github.repository == 'commaai/openpilot' && github.ref == 'refs/heads/master'
+      uses: actions/checkout@v4
+      with:
+        repository: commaai/ci-artifacts
+        ssh-key: ${{ secrets.CI_ARTIFACTS_DEPLOY_KEY }}
+        path: ${{ github.workspace }}/ci-artifacts
+    - name: Push refs
+      if: github.repository == 'commaai/openpilot' && github.ref == 'refs/heads/master'
+      working-directory: ${{ github.workspace }}/ci-artifacts
       run: |
-        ${{ env.RUN }} "unset PYTHONWARNINGS && AZURE_TOKEN='$AZURE_TOKEN' python3 selfdrive/test/process_replay/test_processes.py -j$(nproc) --upload-only"
+        git checkout --orphan process-replay
+        git rm -rf .
+        git config user.name "GitHub Actions Bot"
+        git config user.email "<>"
+        cp ${{ github.workspace }}/selfdrive/test/process_replay/fakedata/*.zst .
+        echo "${{ github.sha }}" > ref_commit
+        git add .
+        git commit -m "process-replay refs for ${{ github.repository }}@${{ github.sha }}"
+        git push origin process-replay --force
     - name: Run regen
       if: false
       timeout-minutes: 4

.github/workflows/vendor_third_party.yaml

@@ -0,0 +1,51 @@
+name: vendor third_party
+
+on:
+  workflow_dispatch:
+
+jobs:
+  build:
+    if: github.ref != 'refs/heads/master'
+    strategy:
+      matrix:
+        os: [ubuntu-24.04, macos-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+    - uses: actions/checkout@v6
+      with:
+        submodules: true
+    - name: Build
+      run: third_party/build.sh
+    - name: Package artifacts
+      run: |
+        git add -A third_party/
+        git diff --cached --name-only -- third_party/ | tar -cf /tmp/third_party_build.tar -T -
+    - uses: actions/upload-artifact@v4
+      with:
+        name: third-party-${{ runner.os }}
+        path: /tmp/third_party_build.tar
+
+  commit:
+    needs: build
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+    steps:
+    - uses: actions/checkout@v6
+    - uses: actions/download-artifact@v4
+      with:
+        path: /tmp/artifacts
+    - name: Commit vendored libraries
+      run: |
+        for f in /tmp/artifacts/*/third_party_build.tar; do
+          tar xf "$f"
+        done
+        git add third_party/
+        if git diff --cached --quiet; then
+          echo "No changes to commit"
+          exit 0
+        fi
+        git config user.name "github-actions[bot]"
+        git config user.email "github-actions[bot]@users.noreply.github.com"
+        git commit -m "third_party: rebuild vendor libraries"
+        git push