The Problem

The repository contains duplicated 6‑line shell blocks in docker/build.sh and docker/run.sh that violate the DRY principle and create a maintenance burden. Separately, several third‑party GitHub Actions are referenced only by version tag (e.g., @v1), meaning the actions running with repository secrets can change without notice – a known vector for credential leaks.

What This Does

Autoware is an open‑source ROS‑based stack for autonomous vehicles. The clone at https://github.com/moses-y/autoware provides:

  • Docker infrastructure – docker/Dockerfile, docker/Dockerfile.base, docker/docker-compose.yaml, docker/docker-compose.gpu.yaml and helper scripts docker/build.sh / docker/run.sh that spin up CPU or GPU builds.
  • Ansible provisioning – 141 files under ansible/ (roles, playbooks, galaxy requirements) that install system packages, CUDA toolkits, ROS 2 components, and configure the runtime environment.
  • CI/CD – 41 .github/workflow files orchestrating builds, tests, linting, and releases via GitHub Actions.
  • Tooling & dev containers – .devcontainer/* definitions for VS Code remote development, including CUDA‑enabled dev containers.

Key entry points for a new contributor are the shell scripts docker/build.sh and docker/run.sh (the actual build and start commands) and the top‑level docker-compose.yaml for orchestrating multi‑service stacks.

How It Is Wired

The static analysis measured 0 internal modules and 0 import edges across the 15 Shell files examined, indicating the repo is primarily orchestration‑driven rather than a tightly‑coupled code base. Execution flow:

  1. Build – Running docker/build.sh pulls base images, installs ROS 2, and tags the image.
  2. Run – docker/run.sh starts the container, mounts necessary volumes, and launches the Autoware node graph.
  3. Compose – docker/docker-compose.yaml (or docker-compose.gpu.yaml) wires together the built image, a ROS 2 master, and optional simulation tools.
  4. Ansible – Playbooks under ansible/playbooks/ (e.g., docker.yaml, universe.yaml) provision host packages and configure container runtimes; roles such as acados, ros2, and cuda install language‑specific dependencies.

The CI pipelines in .github/workflows/ invoke these scripts, push images, and run validation steps.

How To Use It

Setup

git clone https://github.com/moses-y/autoware   # <-- clone URL as provided
cd autoware
# optional: select environment file matching your OS release
source amd64.env     # or amd64_jazzy.env for Ubuntu Jazzy

Configuration

  • Environment variables are defined in amd64.env / amd64_jazzy.env (e.g., ROS_DISTRO, CUDA_VERSION).
  • Docker compose files read these vars; no additional secret files are committed (the analysis found no committed secrets).

Running it

# CPU‑only build and start
./docker/build.sh
./docker/run.sh

# GPU‑accelerated stack
docker compose -f docker/docker-compose.gpu.yaml up -d

CI integration – Pushes are gated by the workflow docker-build-and-push.yaml; see the health‑checks section below for required fixes.

Real‑World Use

A developer wanting to prototype a perception pipeline can clone the repo, run ./docker/build.sh to produce a container image, then ./docker/run.sh to launch Autoware with ROS 2 nodes for object detection and planning already wired. The GPU compose file adds CUDA‑enabled runtimes for faster inference, and the Ansible roles ensure host packages (e.g., nvidia-container-toolkit) are present without manual apt‑get steps.

Code Health & Issues

  • MEDIUM – Duplicated code: 2 repeated 6‑line blocks appear in docker/build.sh and docker/run.sh. Extract a shared helper function to avoid future divergence.
  • HIGH – Pin third‑party GitHub Actions: .github/workflows/ references autowarefoundation/autoware-github-actions/set-git-config@v1, step-security/changed-files@v46, autowarefoundation/autoware-github-actions/generate-changelog@v1, and docker/login-action@v3. Replace each @vN with the 40‑character commit SHA (keep the # vN comment) and let Dependabot bump the SHAs.
  • MEDIUM – Declare least‑privilege GITHUB_TOKEN: Three workflows (docker-build-and-push.yaml among others) have no permissions block, so the token inherits repository defaults that can push commits or mint releases. Add permissions: contents: read at the workflow level and widen per‑job as needed.
  • LOW – Set timeout‑minutes: The same workflow lacks timeout-minutes on jobs; a stuck step could run six hours, causing overlapping runs on the two‑hourly schedule. Add a realistic timeout-minutes (e.g., 150) to each job.

The Bottom Line

The repo is a well‑structured, ROS‑centric stack with solid Docker and Ansible tooling, but it suffers from duplicated shell logic and outdated Action version pins that expose secrets to potential drift. Teams comfortable with ROS 2 and containerised builds can adopt it immediately, provided they apply the security fixes and DRY the build/run scripts. It is best suited for organisations already invested in the Autoware ecosystem or those needing a modular, ansible‑driven CI pipeline for autonomous‑driving stacks.