ci: Add workflow to upload dependencies to ASWF Conan registry and use them in CI

.github/workflows/conan.yml

@@ -13,7 +13,6 @@ on:
 
 env:
   SKIP_DEPS_CACHE: 'false'
-
   ROCKY_QT6_MODULES: 'debug_info qt3d qt5compat qtcharts qtconnectivity qtdatavis3d qtgrpc qthttpserver qtimageformats qtlanguageserver qtlocation qtlottie qtmultimedia qtnetworkauth qtpdf qtpositioning qtquick3d qtquick3dphysics qtquickeffectmaker qtquicktimeline qtremoteobjects qtscxml qtsensors qtserialbus qtserialport qtshadertools qtspeech qtvirtualkeyboard qtwaylandcompositor qtwebchannel qtwebengine qtwebsockets qtwebview'
   ROCKY_QT6_ARCHIVES: 'icu qtbase qtdeclarative qtsvg qttools qttranslations qtwayland'
   MACOX_X86_64_QT6_MODULES: 'debug_info qt3d qt5compat qtcharts qtconnectivity qtdatavis3d qtgrpc qthttpserver qtimageformats qtlanguageserver qtlocation qtlottie qtmultimedia qtnetworkauth qtpdf qtpositioning qtquick3d qtquick3dphysics qtquickeffectmaker qtquicktimeline qtremoteobjects qtscxml qtsensors qtserialbus qtserialport qtshadertools qtspeech qtvirtualkeyboard qtwebchannel qtwebengine qtwebsockets qtwebview'
@@ -60,7 +59,8 @@ jobs:
             python-version: "3.11.8"
             vfx-platform: "CY2024"
             extra_repo: "powertools"
-
+            conan-profile: "x86_64_rocky8"
+
           - os: "ubuntu-latest"
             rocky-version: "9"
             image: "amd64/rockylinux:9"
@@ -71,6 +71,7 @@ jobs:
             python-version: "3.11.8"
             vfx-platform: "CY2024"
             extra_repo: "crb"
+            conan-profile: "x86_64_rocky9"
 
     steps:
       - name: Display disk space
@@ -311,6 +312,18 @@ jobs:
           echo "Conan home path: $CONAN_HOME_OUTPUT"
           echo "CONAN_HOME=$CONAN_HOME_OUTPUT" >> $GITHUB_ENV
 
+      - name: Add ASWF Conan remote
+        # Required so conan/profiles/common [replace_requires] can resolve
+        # openssl/*@openrv/vfx2024 from the ASWF JFrog Artifactory.
+        # Anonymous read; no credentials needed for install. Uses aswftesting
+        # (aswf-conan-dev) for now; swap to the 'aswf' production remote
+        # once binaries are promoted there.
+        # Rocky 8 currently has a prebuilt binary; other profiles will
+        # build from source via the CCI recipe exported under this user/channel.
+        run: |
+          $CONAN_EXECUTABLE remote remove aswftesting 2>/dev/null || true
+          $CONAN_EXECUTABLE remote add aswftesting https://linuxfoundation.jfrog.io/artifactory/api/conan/aswf-conan-dev --index 0
+
       - name: Export OpenRVCore recipe to Conan's cache
         if: ${{ matrix.vfx-platform == 'CY2024' }}
         run: |
@@ -319,6 +332,11 @@ jobs:
           $CONAN_EXECUTABLE export openrvcore-conanfile.py
 
       - name: Build OpenRV dependencies
+        # openexr (and every other dep covered by [replace_requires] in
+        # conan/profiles/common) now resolves to @openrv/vfx2024 and is
+        # pulled prebuilt from the ASWF remote on Rocky 8, built on the
+        # matching toolchain. The earlier Rocky 8-specific `--build=openexr/*`
+        # workaround is no longer needed.
         run: |
           # Rocky 8: force local rebuild of select packages whose Conan Center
           # prebuilts target a newer glibc / libstdc++ than Rocky 8 provides.
@@ -339,7 +357,7 @@ jobs:
 
       - name: Build OpenRV main executable
         run: |
-          $CONAN_EXECUTABLE build conanfile.py --build=missing -pr:a ./conan/profiles/x86_64_rocky8
+          $CONAN_EXECUTABLE build conanfile.py --build=missing -pr:a ./conan/profiles/${{ matrix.conan-profile }}
 
       - name: Tests
         run: |
@@ -492,6 +510,12 @@ jobs:
       - name: Set Conan Home Path
         run: echo "CONAN_HOME=$(/Users/runner/Library/Python/3.11/bin/conan config home)" >> $GITHUB_ENV
 
+      - name: Add ASWF Conan remote
+        # See conan.yml Rocky step of the same name for rationale.
+        run: |
+          /Users/runner/Library/Python/3.11/bin/conan remote remove aswftesting 2>/dev/null || true
+          /Users/runner/Library/Python/3.11/bin/conan remote add aswftesting https://linuxfoundation.jfrog.io/artifactory/api/conan/aswf-conan-dev --index 0
+
       - name: Export OpenRVCore recipe
         if: ${{ matrix.vfx-platform == 'CY2024' }}
         run: |
@@ -737,6 +761,14 @@ jobs:
           cat ~/.bash_profile | tail -5
         shell: msys2 {0}
 
+      - name: Add ASWF Conan remote
+        # See conan.yml Rocky step of the same name for rationale.
+        run: |
+          source ~/.bash_profile
+          conan remote remove aswftesting 2>/dev/null || true
+          conan remote add aswftesting https://linuxfoundation.jfrog.io/artifactory/api/conan/aswf-conan-dev --index 0
+        shell: msys2 {0}
+
       - name: Export OpenRVCore recipe
         if: ${{ matrix.vfx-platform == 'CY2024' }}
         run: |
@@ -763,12 +795,12 @@ jobs:
       - name: Build and install OpenRV dependencies
         run: |
           source ~/.bash_profile
-          conan install conanfile.py --build=missing -pr:a ./conan/profiles/x86_64_windows
+          conan install conanfile.py --build=missing -pr:a ./conan/profiles/x86_64_windows -c tools.microsoft.bash:path=C:/msys64/usr/bin/bash.exe -c tools.microsoft.bash:subsystem=msys2
         shell: msys2 {0}
-          
+
       - name: Build OpenRV main executable
         run: |
-          conan build conanfile.py --build=missing -pr:a ./conan/profiles/x86_64_windows
+          conan build conanfile.py --build=missing -pr:a ./conan/profiles/x86_64_windows -c tools.microsoft.bash:path=C:/msys64/usr/bin/bash.exe -c tools.microsoft.bash:subsystem=msys2
         shell: msys2 {0}
 
       - name: Tests

.pre-commit-config.yaml

@@ -25,5 +25,22 @@ repos:
         args: [--fix]
         description: "Lint and auto-fix markdown files"
 
+  - repo: local
+    hooks:
+      - id: conan-packages-yml-schema
+        name: validate conan/packages.yml schema
+        entry: python3 conan/scripts/validate_packages_yml.py
+        language: python
+        files: ^conan/packages\.yml$
+        additional_dependencies: ['pyyaml']
+        pass_filenames: false
+      - id: conan-profile-sync
+        name: conan profiles/common in sync with packages.yml
+        entry: python3 conan/scripts/gen_profile_common.py --check
+        language: python
+        files: ^conan/packages\.yml$
+        additional_dependencies: ['pyyaml']
+        pass_filenames: false
+
 ci:
   autofix_prs: false

conan/packages.yml

@@ -0,0 +1,157 @@
+# OpenRV Conan dependencies - single source of truth for the Conan build path.
+#
+# Consumed by:
+#   - .github/workflows/conan-upload-deps.yml  (CI upload)
+#   - openrvcore-conanfile.py requirements()   (reads versions + options at runtime)
+#   - conan/scripts/gen_profile_common.py      (generates profiles/common replace_requires)
+#
+# Year-specific deps (from CY2025.cmake) use channel "vfx2025";
+# year-independent deps (from CYCOMMON.cmake) use channel "common".
+#
+# Fields:
+#   name         - Conan package name (matches CCI recipe folder).
+#   version      - Pinned version; must be listed in CCI config.yml.
+#   channel      - Conan channel: "vfx2025" for year-specific deps,
+#                  "common" for year-independent deps.
+#   cci_folder   - Subfolder under recipes/<name>/ in conan-center-index.
+#                  Most are "all"; a few like openssl use "3.x.x".
+#   options      - Map of Conan option -> value. Passed as -o flags on
+#                  conan install. Pattern strings like "foo/*:shared" match
+#                  the install --requires ref.
+#   windows_only - Optional. If true, the dep is skipped at build time on
+#                  non-Windows platforms (openrvcore-conanfile.py and
+#                  conan_install_target.py). Recipes are still exported on
+#                  all platforms so that replace_requires can always resolve.
+
+deps:
+  - name: zlib
+    version: "1.3.2"
+    channel: common
+    cci_folder: all
+    options:
+      "zlib/*:shared": "True"
+
+  - name: libatomic_ops
+    version: "7.10.0"
+    channel: common
+    cci_folder: all
+    options:
+      "libatomic_ops/*:shared": "False"
+
+  - name: libwebp
+    # openrvcore-conanfile.py:69 pins 1.2.1 because libwebp >=1.3.0 adds
+    # sharpyuv and causes issues with OIIO. CCI rotated 1.2.1 out; 1.2.4
+    # is the closest available that remains pre-1.3.0.
+    version: "1.2.4"
+    channel: common
+    cci_folder: all
+    options:
+      "libwebp/*:shared": "False"
+
+  - name: dav1d
+    version: "1.5.3"
+    channel: common
+    cci_folder: all
+    options:
+      "dav1d/*:shared": "True"
+
+  - name: libjpeg-turbo
+    # 2.1.4 rotated out of CCI; 2.1.5 is the closest 2.1.x available.
+    # Avoiding 3.x to prevent ABI surprises against libraw/openjph.
+    version: "2.1.5"
+    channel: common
+    cci_folder: all
+    options:
+      "libjpeg-turbo/*:shared": "True"
+
+  - name: boost
+    version: "1.85.0"
+    channel: vfx2025
+    cci_folder: all
+    options:
+      "boost/*:shared": "True"
+      "boost/*:extra_b2_flags": "-d+0 -s NO_LZMA=1"
+
+  - name: imath
+    version: "3.1.12"
+    channel: vfx2025
+    cci_folder: all
+    source_url: "https://github.com/AcademySoftwareFoundation/Imath/archive/refs/tags/v3.1.12.tar.gz"
+    source_sha256: "8a1bc258f3149b5729c2f4f8ffd337c0e57f09096e4ba9784329f40c4a9035da"
+    options:
+      "imath/*:shared": "True"
+
+  - name: libdeflate
+    version: "1.25"
+    channel: common
+    cci_folder: all
+    options:
+      "libdeflate/*:shared": "True"
+
+  - name: openexr
+    version: "3.3.6"
+    channel: vfx2025
+    cci_folder: "3.x"
+    source_url: "https://github.com/AcademySoftwareFoundation/openexr/archive/refs/tags/v3.3.6.tar.gz"
+    source_sha256: "2e3c14c0fd47938819cab0a1d9e0a6dc3d276cdec556745eb7521f6add4deed9"
+    options:
+      "openexr/*:shared": "True"
+
+  - name: libpng
+    # 1.6.55 rotated; 1.6.58 is a patch bump within 1.6.x.
+    version: "1.6.58"
+    channel: common
+    cci_folder: all
+    options:
+      "libpng/*:shared": "True"
+
+  - name: openjpeg
+    version: "2.5.4"
+    channel: common
+    cci_folder: all
+    options:
+      "openjpeg/*:shared": "True"
+
+  - name: libraw
+    # 0.21.1 rotated; 0.21.2 is a patch bump within 0.21.x.
+    # 0.21.5b has a beta suffix, avoided.
+    version: "0.21.2"
+    channel: common
+    cci_folder: all
+    options:
+      "libraw/*:shared": "True"
+      "libraw/*:with_jpeg": "libjpeg-turbo"
+      "libraw/*:with_jasper": "False"
+
+  - name: openjph
+    # 0.26.3 rotated; 0.27.0 is the only remaining version in CCI.
+    # Minor bump; validate CMake target name compatibility.
+    version: "0.27.0"
+    channel: common
+    cci_folder: all
+    options:
+      "openjph/*:shared": "True"
+      "openjph/*:with_tiff": "False"
+
+  - name: openssl
+    # Used to override the openssl version pulled in transitively by ffmpeg.
+    # Not used directly by OpenRV at runtime.
+    version: "3.6.2"
+    channel: vfx2025
+    cci_folder: "3.x.x"
+    options:
+      "openssl/*:shared": "True"
+      "openssl/*:no_zlib": "True"
+
+  - name: pcre2
+    version: "10.44"
+    channel: common
+    cci_folder: all
+    windows_only: true
+    options:
+      "pcre2/*:shared": "True"
+      "pcre2/*:with_zlib": "False"
+      "pcre2/*:with_bzip2": "False"
+      "pcre2/*:support_jit": "False"
+      "pcre2/*:build_pcre2_16": "False"
+      "pcre2/*:build_pcre2_32": "False"

conan/profiles/common

@@ -1,5 +1,34 @@
-# Common settings shared across all OpenRV profiles
+# Common settings shared across all OpenRV profiles.
+#
+# Redirect every OpenRV-managed dependency to prebuilt binaries published
+# on the ASWF Conan remote (aswf-conan-dev for testing, aswf-conan for
+# production). Year-specific deps (CY2025.cmake) use @openrv/vfx2025;
+# year-independent deps (CYCOMMON.cmake) use @openrv/common. Consumers
+# must have one of those remotes
+# configured before running `conan install`. The versions below track
+# conan/packages.yml, which is the single source of truth for what the
+# conan-upload-deps.yml workflow builds and uploads.
+#
+# With RV_DEPS_*_VERSION_MATCH=MINIMUM set in openrvcore-conanfile.py, these
+# refs may be newer than what the conanfile pins; CMake's find_package will
+# still accept them. replace_requires runs before force=True, so the bare
+# version pins in the conanfile effectively become cosmetic for anything
+# covered here.
 
 [replace_requires]
-openssl/*: openssl/3.5.0
-libjpeg/*: libjpeg-turbo/2.1.4
+zlib/*: zlib/1.3.2@openrv/common
+libatomic_ops/*: libatomic_ops/7.10.0@openrv/common
+libwebp/*: libwebp/1.2.4@openrv/common
+dav1d/*: dav1d/1.5.3@openrv/common
+libjpeg/*: libjpeg-turbo/2.1.5@openrv/common
+libjpeg-turbo/*: libjpeg-turbo/2.1.5@openrv/common
+boost/*: boost/1.85.0@openrv/vfx2025
+imath/*: imath/3.1.12@openrv/vfx2025
+libdeflate/*: libdeflate/1.25@openrv/common
+openexr/*: openexr/3.3.6@openrv/vfx2025
+libpng/*: libpng/1.6.58@openrv/common
+openjpeg/*: openjpeg/2.5.4@openrv/common
+libraw/*: libraw/0.21.2@openrv/common
+openjph/*: openjph/0.27.0@openrv/common
+openssl/*: openssl/3.6.2@openrv/vfx2025
+pcre2/*: pcre2/10.44@openrv/common

conan/profiles/x86_64_windows

@@ -14,6 +14,4 @@ os=Windows
 # Using Python from MSYS2 could lead to unnecessary builds of Python packages and the needs of more
 # MSYS2 packages.
 PATH=+(path){{ os.getenv("WIN_PYTHON_DIR", "/c/Python311") }}
-# Set ACLOCAL_PATH using the msys2 from Conan (MSYS_ROOT is set by msys2 tool_requires)
-# Using $$ to escape so variable is expanded at runtime, not generation time
-ACLOCAL_PATH=$$MSYS_ROOT/usr/share/aclocal
+ACLOCAL_PATH={{ os.getenv("ACLOCAL_PATH", "/c/msys64/usr/share/aclocal") }}

conan/scripts/_common.py

@@ -0,0 +1,60 @@
+"""Shared helpers for conan/scripts/*.
+
+Centralizes the few values that the conan/scripts/* tools all need:
+the repo root, the packages.yml path, the conan user namespace, and the
+windows_only filter rule. Keeping these in one place prevents the kind
+of silent drift that previously had two scripts each spelling out the
+same filter against different env signals.
+"""
+
+import os
+import sys
+from pathlib import Path
+
+try:
+    import yaml
+except ImportError:
+    print("error: pyyaml is required. Install with: pip install pyyaml", file=sys.stderr)
+    sys.exit(1)
+
+REPO_ROOT = Path(__file__).resolve().parents[2]
+PACKAGES_YML = REPO_ROOT / "conan" / "packages.yml"
+PROFILES_DIR = REPO_ROOT / "conan" / "profiles"
+
+CONAN_USER = "openrv"
+
+
+def conan_exec() -> str:
+    """Return the conan binary path (CONAN_EXEC env var, defaulting to "conan")."""
+    return os.environ.get("CONAN_EXEC", "conan")
+
+
+def load_packages() -> dict:
+    """Load and return the packages.yml document as a dict."""
+    pkgs = yaml.safe_load(PACKAGES_YML.read_text())
+    if not isinstance(pkgs, dict):
+        print(f"error: {PACKAGES_YML} is empty or not a mapping", file=sys.stderr)
+        sys.exit(1)
+    return pkgs
+
+
+def find_dep(pkgs: dict, name: str, version: str) -> dict | None:
+    """Find the dep entry in packages.yml matching the given name and version."""
+    for dep in pkgs["deps"]:
+        if dep["name"] == name and dep["version"] == version:
+            return dep
+    return None
+
+
+def is_active_dep(dep: dict, *, is_windows: bool) -> bool:
+    """Return True if `dep` should participate in the build on this platform.
+
+    A dep flagged windows_only is only active on Windows; everything else
+    is active everywhere. This is the single source of truth for the
+    filter. openrvcore-conanfile.py mirrors the same key check at recipe
+    parse time (it cannot import this module due to Conan's recipe
+    sandboxing), so any rule change here must be reflected there.
+    """
+    if dep.get("windows_only") and not is_windows:
+        return False
+    return True