Vendor dependencies and resources for standalone builds

Keep official openpilot ancestry and dependency licenses. Store resources directly in Git, remove LFS setup requirements, and leave the downloadable big model outside the source tree.

.github/workflows/auto_pr_review.yaml

@@ -12,8 +12,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v7
-      with:
-        submodules: false
 
     # Label PRs
     - uses: actions/labeler@v6

.github/workflows/docs.yaml

@@ -15,11 +15,6 @@ concurrency:
   group: docs-tests-ci-run-${{ inputs.run_number }}-${{ github.event_name == 'push' && github.ref == 'refs/heads/master' && github.run_id || github.head_ref || github.ref }}-${{ github.workflow }}-${{ github.event_name }}
   cancel-in-progress: true
 
-env:
-  GIT_CONFIG_COUNT: 1
-  GIT_CONFIG_KEY_0: lfs.fetchexclude
-  GIT_CONFIG_VALUE_0: openpilot/selfdrive/modeld/models/big_driving_tinygrad.pkl
-
 jobs:
   docs:
     name: build docs

.github/workflows/jenkins-pr-trigger.yaml

@@ -82,7 +82,7 @@ jobs:
         git config --global user.name "github-actions[bot]"
         git config --global user.email "github-actions[bot]@users.noreply.github.com"
         git checkout -b tmp-jenkins-${{ github.event.issue.number }}
-        GIT_LFS_SKIP_PUSH=1 git push -f origin tmp-jenkins-${{ github.event.issue.number }}
+        git push -f origin tmp-jenkins-${{ github.event.issue.number }}
 
     - name: Delete trigger comment
       if: steps.check_comment.outputs.result == 'true' && always()

.github/workflows/release.yaml

@@ -4,11 +4,6 @@ on:
     - cron: '0 9 * * *'
   workflow_dispatch:
 
-env:
-  GIT_CONFIG_COUNT: 1
-  GIT_CONFIG_KEY_0: lfs.fetchexclude
-  GIT_CONFIG_VALUE_0: openpilot/selfdrive/modeld/models/big_driving_tinygrad.pkl
-
 jobs:
   build_masterci:
     name: build master-ci
@@ -29,12 +24,10 @@ jobs:
         check-regexp: ^((?!.*(build prebuilt|create badges).*).)*$
     - uses: actions/checkout@v4 # checkout version > v4 breaks nightly release script
       with:
-        submodules: true
         fetch-depth: 0
     - run: ./tools/op.sh setup
     - name: Push master-ci
       run: BRANCH=__nightly tools/release/build_stripped.sh
     - name: Push chestnut nightly
       run: |
-        git lfs pull --exclude=''
         INCLUDE_BIG_MODEL=1 BRANCH=__nightly-chestnut tools/release/build_stripped.sh

.github/workflows/repo-maintenance.yaml

@@ -9,9 +9,6 @@ on:
 
 env:
   PYTHONPATH: ${{ github.workspace }}
-  GIT_CONFIG_COUNT: 1
-  GIT_CONFIG_KEY_0: lfs.fetchexclude
-  GIT_CONFIG_VALUE_0: openpilot/selfdrive/modeld/models/big_driving_tinygrad.pkl
 
 jobs:
   package_updates:
@@ -22,8 +19,6 @@ jobs:
       (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch')
     steps:
     - uses: actions/checkout@v7
-      with:
-        submodules: true
     - run: ./tools/op.sh setup
     - name: uv lock
       run: uv lock --upgrade
@@ -47,10 +42,8 @@ jobs:
           | head -10 \
           | while IFS=$'\t' read size path; do echo "$size  ${path##*/}"; done >> $GITHUB_OUTPUT
         echo 'EOF' >> $GITHUB_OUTPUT
-    - name: bump submodules
-      run: |
-        git submodule update --remote
-        git add .
+    - name: Check tracked dependencies
+      run: python3 tools/vendor/check.py
     - name: update car docs
       run: |
         python openpilot/selfdrive/car/docs.py

.github/workflows/tests.yaml

@@ -4,6 +4,7 @@ on:
   push:
     branches:
       - master
+      - Domathon
   pull_request:
   workflow_dispatch:
   workflow_call:
@@ -20,11 +21,28 @@ concurrency:
 env:
   CI: 1
   PYTHONPATH: ${{ github.workspace }}
-  GIT_CONFIG_COUNT: 1
-  GIT_CONFIG_KEY_0: lfs.fetchexclude
-  GIT_CONFIG_VALUE_0: openpilot/selfdrive/modeld/models/big_driving_tinygrad.pkl
 
 jobs:
+  source_integrity:
+    name: source integrity
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+    steps:
+    - uses: actions/checkout@v7
+    - name: Validate tracked dependencies
+      run: python3 tools/vendor/check.py --revision HEAD
+    - name: Test dependency and packaging tools
+      run: |
+        python3 -m unittest discover -s tools/vendor/tests -v
+        python3 -m unittest discover -s tools/release/tests -v
+        python3 -m unittest discover -s openpilot/system/updated/tests -v
+    - name: Check setup and release shell syntax
+      run: |
+        for script in tools/op.sh tools/release/*.sh openpilot/selfdrive/test/setup_device_ci.sh; do
+          bash -n "$script"
+        done
+
   build_release:
     name: build release
     runs-on: ${{
@@ -38,14 +56,6 @@ jobs:
       PYTHONPATH: /tmp/releasepilot
     steps:
     - uses: actions/checkout@v7
-      with:
-        submodules: true
-    - name: Getting LFS files
-      uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60
-      with:
-        timeout_minutes: 2
-        max_attempts: 3
-        command: git lfs pull
     - name: Build devel
       timeout-minutes: 1
       run: TARGET_DIR=$STRIPPED_DIR tools/release/build_stripped.sh
@@ -58,10 +68,9 @@ jobs:
       timeout-minutes: 1
       working-directory: ${{ env.STRIPPED_DIR }}
       run: tools/release/check-dirty.sh
-    - name: Check submodules
-      if: github.repository == 'commaai/openpilot'
+    - name: Check tracked dependencies
       timeout-minutes: 3
-      run: tools/release/check-submodules.sh
+      run: python3 tools/vendor/check.py --revision HEAD
 
   build_mac:
     name: build macOS
@@ -125,7 +134,6 @@ jobs:
       run: scons
     - name: Run replay
       timeout-minutes: ${{ contains(runner.name, 'nsc') && 2 || 20 }}
-      continue-on-error: ${{ github.ref == 'refs/heads/master' }}
       run: openpilot/selfdrive/test/process_replay/test_processes.py -j$(nproc)
     - name: Print diff
       id: print-diff

.github/workflows/ui_preview.yaml

@@ -36,8 +36,6 @@ jobs:
       actions: read
     steps:
       - uses: actions/checkout@v7
-        with:
-          submodules: true
 
       - name: Waiting for ui generation to end
         uses: lewagon/wait-on-check-action@1d57e2c51a58d812d2765e036a028b6bdb5a6154