Download SAM3 models at build time instead of vendoring them (v10.1)

[JWhitleyWork]

[written by AI]

Motivation

src/moveit_pro_sam3 is a submodule of PickNikRobotics/moveit_pro_sam3, which commits Meta's SAM 3 ONNX exports, so every clone of this workspace redistributes them. This PR stops that: the package moves in-tree and its build downloads the model from the upstream release instead.

Paired with the moveit_pro backport of the SAM License prompt: PickNikRobotics/moveit_pro#22703. The two PRs do not depend on each other to build or pass CI.

Brief description

• Replaces the submodule with an in-tree package taken from moveit_pro_sam3 main (d307e95) without the .onnx files or the LFS .gitattributes.
• CMakeLists.txt downloads the four *-q4f16.onnx assets from jamjamjon/assets release sam3 at configure time into build/moveit_pro_sam3/models, verifies each pinned SHA-256, renames them to the existing sam3_*.onnx names, and installs them to share/moveit_pro_sam3/models. A file already present with the right hash is not fetched again. A failed download or a hash mismatch stops the build with the URL, the cause, and the offline and decline options. -DSAM3_MODEL_URL=file:///<dir> builds offline.
• v10.1 only: models/model.yaml.in becomes the bundle manifest, which CMake fills with the pinned digests and writes beside the downloaded files. MoveIt Pro's loader (src/ml/src/model_bundle.cpp, resolvesOutsideBundle) follows symlinks and rejects artifacts that do not sit beside the manifest's real location, so installing model.yaml from src/ next to ONNX files from build/ would fail every load.
• The package .gitignore ignores COLCON_IGNORE (written by moveit_pro on a license decline) and *.onnx. Because the models live in the package's build directory, the CLI's decline, which deletes build/moveit_pro_sam3 and install/moveit_pro_sam3, also deletes the downloaded model.
• codespell is excluded from src/moveit_pro_sam3/models/LICENSE: its --write-changes rewrote "THEREFROM" in Meta's license text.

Needs review: download source

licensing-privacy-bot flagged the download source for sign-off (@davetcoleman). The four pinned digests match the release's own digests, and PickNik no longer distributes the weights. But:

• jamjamjon/assets is a personal account whose repository declares GPL-3.0, and the sam3 release (53 assets, empty body) includes no copy of the SAM License, which the license requires of redistributors. The old submodule redistributed these same files; this PR points users at that copy instead.
• If the release or account disappears, moveit_pro_sam3 stops building on every tag carrying this CMakeLists. The hash pin catches a replaced file, not a missing one.
• Alternatives, both outside this PR and both distribution again: a PickNik mirror of the four files with the SAM License beside them (set SAM3_MODEL_URL), or our own export from Meta's gated checkpoint.

Not addressed here: PickNikRobotics/moveit_pro_sam3 and earlier tags of this repository still serve the model files.

How it was tested

• Configured and installed the package outside ROS with a stub ament_cmake on CMake 4.2.3 and 3.22.6: file:// source, re-configure with no downloads, a corrupted file re-fetched, an unreachable URL (fails with the message above, no partial file left), and a hash mismatch (fails, no file kept).
• A real configure against GitHub downloaded all four files; sha256sum matches the pins.
• Simulated the moveit_pro workspace upgrade sequence (submodule deinit --all --force, checkout --recurse-submodules=no, submodule update --init --recursive) from a tag with the submodule to one with the in-tree package and back, with a declined user's COLCON_IGNORE present: both directions leave git status clean.
• pre-commit run -a passes; models/LICENSE is byte-identical to moveit_pro_sam3's copy.
• Not done: a colcon build and Objective run inside a MoveIt Pro container. CI's integration tests cover that, and they now download about 590 MB per run.

Agent checks

• code-reviewer: no required changes. Applied: INACTIVITY_TIMEOUT on the download so a stalled connection fails instead of hanging configure, and the error prints the status message rather than CMake's raw list.
• licensing-privacy-bot: privacy none; licensing review-needed item above.
• CodeRabbit CLI: removed set(CMAKE_INSTALL_MODE ABS_SYMLINK), which CMake only reads from the environment, so it never did anything. Not applied: a 900 s total download timeout, which the 277 MB and 288 MB assets can legitimately exceed on slow links; INACTIVITY_TIMEOUT already ends a stalled download.

🤖 Generated with Claude Code

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⚠️ This PR modifies 1 file(s) that also exist in PickNikRobotics/moveit_pro_empty_ws.

Consider whether the change should land upstream in moveit_pro_empty_ws first so downstream forks pick it up on the next sync.

Overlapping files

• .pre-commit-config.yaml

[github-actions]

MoveIt Pro Example WS - Objectives Integration Test Report

• lab_sim
  • ✅ jazzy: view HTML report — 33 passed
• hangar_sim
  • ✅ jazzy: view HTML report — 18 passed