Upload every distribution to robostack-<distro> on anaconda.org and prefix.dev

Instead of a mirror job (#54): the build uploads each package to anaconda.org (token
ANACONDA_API_TOKEN, --force) and then to prefix.dev (trusted publishing), both
robostack-<distro>; the builds read prefix.dev. Nothing goes to robostack-staging
anymore: humble's channel is robostack-humble, and rolling and lyrical get their
anaconda.org channels populated. channel_name and upload_target leave distro.yaml.
anaconda.org goes first so that prefix.dev, which decides what is built, never has a
package anaconda.org lacks; a rebuild replaces the anaconda.org file. The staging copy
stays for noetic only (RoboStack/ros-noetic still uploads to robostack-staging).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: Tobias-Fischer

.github/workflows/copy-staging-packages.yaml

@@ -1,6 +1,7 @@
-# humble and noetic upload to robostack-staging: copy their packages on to
-# robostack-humble / robostack-noetic (tools/copy_staging_packages.py). Moved here from
-# RoboStack/robostack.github.io. A job without its token secret is skipped.
+# noetic (RoboStack/ros-noetic) uploads to robostack-staging: copy its packages on to
+# robostack-noetic (tools/copy_staging_packages.py). Moved here from
+# RoboStack/robostack.github.io. The distributions of this repository upload to their
+# own channels directly (tools/robostack.py upload). Skipped without the token secret.
 name: Copy staging packages
 
 on:
@@ -18,7 +19,6 @@ jobs:
       matrix:
         include:
           - { distro: noetic, token: ROBOSTACK_NOETIC_ANACONDA_API_TOKEN }
-          - { distro: humble, token: ROBOSTACK_HUMBLE_ANACONDA_API_TOKEN }
     name: copy ${{ matrix.distro }}
     runs-on: ubuntu-latest
     steps:

.github/workflows/mirror-to-anaconda.yaml

@@ -6,10 +6,13 @@ the [RoboStack documentation](https://robostack.github.io/GettingStarted.html).
 
 | Distribution | Channel |
 |---|---|
-| rolling | [robostack-rolling](https://prefix.dev/channels/robostack-rolling) |
-| lyrical | [robostack-lyrical](https://prefix.dev/channels/robostack-lyrical) |
-| jazzy | [robostack-jazzy](https://anaconda.org/robostack-jazzy) |
-| humble | [robostack-staging](https://anaconda.org/robostack-staging) |
+| rolling | robostack-rolling ([prefix.dev](https://prefix.dev/channels/robostack-rolling), [anaconda.org](https://anaconda.org/robostack-rolling)) |
+| lyrical | robostack-lyrical ([prefix.dev](https://prefix.dev/channels/robostack-lyrical), [anaconda.org](https://anaconda.org/robostack-lyrical)) |
+| jazzy | robostack-jazzy ([prefix.dev](https://prefix.dev/channels/robostack-jazzy), [anaconda.org](https://anaconda.org/robostack-jazzy)) |
+| humble | robostack-humble ([prefix.dev](https://prefix.dev/channels/robostack-humble), [anaconda.org](https://anaconda.org/robostack-humble)) |
+
+Every distribution uploads the same packages to both: `-c robostack-<distro>` (anaconda.org)
+and `-c https://prefix.dev/robostack-<distro>` work alike.
 
 Packages are named `ros2-<package>`, e.g. `ros2-desktop` or `ros2-rclcpp`; the
 distribution comes from the channel. The older names keep working: for every package
@@ -60,7 +63,7 @@ tools/robostack.py         `pixi run rs ...`: every task, for one distribution o
 tools/maintenance.py       checks and robostack-bot commands
 tools/import_distro.py     (re)import a distribution from its own repository
 tools/*.py                 check_patches_clean_apply, check_dependency_compat, build_gap_report, ...
-tools/copy_staging_packages.py, mirror_to_anaconda.py   channel maintenance (workflows below)
+tools/copy_staging_packages.py   noetic's staging copy (see CI)
 .scripts/                  staged build scripts (build_unix.sh, build_win.bat)
 .github/workflows/         testpr.yaml, main.yaml (staged build branches), bot.yaml, channel maintenance
 .claude/skills/             procedures for agents (debug a build, patches, versions/rebuilds, package selection)
@@ -120,18 +123,19 @@ label doesn't start one by itself. Nothing has to be reset before merging.
   - Each selected distribution is built on all five platforms, with its own build cache. The `check` job runs `pixi run rs check`.
 - **After a merge** (`main.yaml`): for every changed distribution and platform, the job regenerates the recipes and the staged build workflow, and pushes them to `buildbranch_<distro>_<platform>`.
   - Each build branch carries its workflow as `.github/workflows/build.yaml`, which runs `.scripts/build_*.sh` in `distros/<distro>/work`.
-  - Those workflows build the packages and upload them to the distribution's channel.
+  - Those workflows build the packages and upload them to the distribution's channels, `robostack-<distro>` on anaconda.org and then on prefix.dev (`pixi run rs <distro> upload`). The builds read prefix.dev.
 - **Repository variables:**
   - `ROBOSTACK_UPLOAD_CHANNEL`: upload to this prefix.dev channel instead (for example a test channel), or `none` to build without uploading. Use the canonical reference: `<namespace>/<channel>` for a channel that isn't the namespace's primary one (e.g. `tobias-fischer/robostack-distro-test`).
-  - Upload credentials: prefix.dev channels use Repository Access (OIDC, no stored key). In the channel's *Settings > Repository Access*, authorize GitHub, this repository, workflow filename `build.yaml`, mode *Read/write*. There are no upload tokens: distributions whose channel is still on anaconda.org (`upload_target: anaconda`, read from there) can only upload to a prefix.dev channel set in `ROBOSTACK_UPLOAD_CHANNEL`.
+  - Upload credentials:
+    - prefix.dev channels use Repository Access (OIDC, no stored key). In the channel's *Settings > Repository Access*, authorize GitHub, this repository, workflow filename `build.yaml`, mode *Read/write*.
+    - anaconda.org has no trusted publishing: the secret `ANACONDA_API_TOKEN` is a token of an account that can upload to every `robostack-<distro>` channel there.
+    - With `ROBOSTACK_UPLOAD_CHANNEL` set, the uploads only go to that channel.
   - `ROBOSTACK_BOT_CLIENT_ID` (the App's Client ID, `Iv23…`) with the secret `ROBOSTACK_BOT_PRIVATE_KEY`: the robostack-bot GitHub App. It pushes the build branches (which contain workflow files) and opens bot PRs so that CI runs on them. `GHA_PAT` works as a fallback.
 
   The app needs repository permissions Contents, Pull requests, Issues and Workflows (read and write), with its webhook inactive.
 
 - **Channel maintenance:**
-  - `copy-staging-packages.yaml` (hourly): copies humble's and noetic's packages from `robostack-staging` on to `robostack-humble` / `robostack-noetic` (`anaconda copy`). Secrets `ROBOSTACK_HUMBLE_ANACONDA_API_TOKEN`, `ROBOSTACK_NOETIC_ANACONDA_API_TOKEN`.
-  - `mirror-to-anaconda.yaml` (started by hand for now, dry run by default): uploads what a prefix.dev channel has and its old anaconda.org channel doesn't (humble → `robostack-staging`, jazzy → `robostack-jazzy`). Secrets `ROBOSTACK_STAGING_ANACONDA_API_TOKEN`, `ROBOSTACK_JAZZY_ANACONDA_API_TOKEN`.
-  - A job without its secret is skipped.
+  - `copy-staging-packages.yaml` (hourly): noetic (RoboStack/ros-noetic) still uploads to `robostack-staging`; this copies its packages on to `robostack-noetic` (`anaconda copy`, secret `ROBOSTACK_NOETIC_ANACONDA_API_TOKEN`; skipped without it).
 
 ### robostack-bot
 

README.md

@@ -1,7 +1,5 @@
 # Settings of ros-humble that differ from the other distributions
 # (everything else is shared, see the README).
-channel_name: robostack-staging
-upload_target: anaconda
 conda_forge_pinning_version: 2026.09.01.16.28.00
 conda_forge_migrations: [giflib6, go_macos, gstreamer128, hdf52, libboost190, pybind11_abi11, urdfdom6,
   vtk970]

distros/humble/distro.yaml

@@ -1,7 +1,5 @@
 # Settings of ros-jazzy that differ from the other distributions
 # (everything else is shared, see the README).
-channel_name: robostack-jazzy
-upload_target: anaconda
 conda_forge_pinning_version: 2026.09.01.16.28.00
 conda_forge_migrations: [giflib6, go_macos, gstreamer128, hdf52, libboost190, pybind11_abi11, urdfdom6,
   vtk970]

distros/jazzy/distro.yaml

@@ -1,7 +1,5 @@
 # Settings of ros-lyrical that differ from the other distributions
 # (everything else is shared, see the README).
-channel_name: robostack-lyrical
-upload_target: prefix
 conda_forge_pinning_version: 2026.10.09.13.11.31
 conda_forge_migrations: [elfutils0196, giflib6, go_macos, gsl28, gstreamer128, hdf52, libboost190, libhwloc2150, proj99, urdfdom6]
 pinning_overrides:

distros/lyrical/distro.yaml

@@ -1,7 +1,5 @@
 # Settings of ros-rolling that differ from the other distributions
 # (everything else is shared, see the README).
-channel_name: robostack-rolling
-upload_target: prefix
 conda_forge_pinning_version: 2026.09.01.16.28.00
 conda_forge_migrations: [giflib6, go_macos, gstreamer128, hdf52, libboost190, pybind11_abi11, urdfdom6,
   vtk970]

distros/rolling/distro.yaml

@@ -25,7 +25,7 @@ pyyaml = "*"
 # Some git repos need git-lfs, see https://github.com/RoboStack/ros-jazzy/issues/118
 git-lfs = "*"
 pytest = ">=9.1.1,<10"
-# copy_staging_packages.py and mirror_to_anaconda.py (channel maintenance)
+# tools/copy_staging_packages.py (noetic: robostack-staging -> robostack-noetic)
 anaconda-client = ">=1.14.1,<2"
 niquests = ">=3.21.2,<4"
 py-rattler = ">=0.27.1,<0.28"

pixi.toml

@@ -338,13 +338,9 @@ def channel_for(distro: str) -> list[str]:
     sys.path.insert(0, str(Path(__file__).parent))
     import robostack as rs
 
-    s = rs.settings(distro)
-    name = s.get("channel_name", f"robostack-{distro}")
     upload = os.environ.get("ROBOSTACK_UPLOAD_CHANNEL", "").strip()
     extra = [f"https://repo.prefix.dev/{upload}"] if upload and upload != "none" else []
-    if s.get("upload_target", "prefix") == "prefix":
-        return extra + [f"https://repo.prefix.dev/{name}"]
-    return extra + [f"https://conda.anaconda.org/{name}"]
+    return extra + [f"https://repo.prefix.dev/{rs.channel_name(distro)}"]
 
 
 def download(channel: str, platform: str, filename: str, dest: Path) -> Path:

tools/abi_check.py

@@ -1,8 +1,9 @@
 """Copy a distribution's packages from robostack-staging to robostack-<distro> (anaconda.org).
 
-humble and noetic upload to robostack-staging; this copies every package of the given
-distribution built after a cutoff date that robostack-<distro> doesn't have yet, with
-`anaconda copy` (the token is read from ANACONDA_API_TOKEN). Moved here from
+noetic uploads to robostack-staging (humble did, too, before it moved here); this
+copies every package of the given distribution built after a cutoff date that
+robostack-<distro> doesn't have yet, with `anaconda copy` (the token is read from
+ANACONDA_API_TOKEN). Moved here from
 RoboStack/robostack.github.io (scripts/copy-to-distro-specific-channel.py).
 """