[workspace] Use stable URLs for GitHub downloads where possible (Robo…

…tLocomotion#17344)

tools/workspace/github.bzl

@@ -25,10 +25,7 @@ def github_archive(
             labels when referring to this archive from BUILD files.
         repository: required GitHub repository name in the form
             organization/project.
-        commit: required commit is the git hash to download. (When the git
-            project is also a git submodule in CMake, this should be kept in
-            sync with the git submodule commit used there.) This can also be a
-            tag.
+        commit: required commit is the tag name or git commit sha to download.
         commit_pin: optional boolean, set to True iff the archive should remain
             at the same version indefinitely, eschewing automated upgrades to
             newer versions.
@@ -212,7 +209,11 @@ def github_download_and_extract(
             version indefinitely, eschewing automated upgrades to newer
             versions.
     """
-    urls = _urls(repository, commit, mirrors)
+    urls = _urls(
+        repository = repository,
+        commit = commit,
+        mirrors = mirrors,
+    )
 
     repository_ctx.download_and_extract(
         urls,
@@ -272,7 +273,49 @@ def _strip_prefix(repository, commit, extra_strip_prefix):
         result += "/" + extra_strip_prefix
     return result
 
-def _urls(repository, commit, mirrors):
+def _is_commit_sha(commit):
+    """Returns true iff the commit is a hexadecimal string of length 40."""
+    return len(commit) == 40 and all([
+        ch.isdigit() or (ch >= "a" and ch <= "f")
+        for ch in commit.elems()
+    ])
+
+def _format_url(*, pattern, repository, commit):
+    """Given a URL pattern for github.com or a Drake-specific mirror,
+    substitutes in the given repository and commit (tag or git sha).
+
+    The URL pattern accepts the following substitutions:
+
+    The {repository} is always substituted with `repository`.
+    The {commit} is always substituted with `commit`.
+    If `commit` refers to a git tag, then {tag_name} will be substituted.
+    If `commit` refers to a git branch, then {branch_name} will be substituted.
+    If `commit` refers to a git sha, then {commit_sha} will be substituted.
+
+    Patterns that contain a substitution which does not apply to the given
+    `commit` (e.g., {commit_sha} when `commit` is a tag) will return None.
+    The pattern must contain exactly one of {commit}, {tag_name},
+    {branch_name}, or {commit_sha}.
+    """
+    is_commit_sha = _is_commit_sha(commit)
+    is_tag = not is_commit_sha
+    substitutions = {
+        "repository": repository,
+        "commit": commit,
+        "tag_name": commit if is_tag else None,
+        "commit_sha": commit if is_commit_sha else None,
+    }
+    for name, value in substitutions.items():
+        if value == None:
+            needle = "{" + name + "}"
+            if needle in pattern:
+                # If the pattern uses a substitution that we do not have,
+                # report that to our caller as "None"; don't return a URL
+                # string with a literal "None" in it!
+                return None
+    return pattern.format(**substitutions)
+
+def _urls(*, repository, commit, mirrors):
     """Compute the urls from which an archive of the provided GitHub
     repository and commit may be downloaded.
 
@@ -282,10 +325,16 @@ def _urls(repository, commit, mirrors):
         mirrors: dictionary of mirrors, see mirrors.bzl in this directory for
             an example.
     """
-    return [
-        x.format(
+    result_with_nulls = [
+        _format_url(
+            pattern = x,
             repository = repository,
             commit = commit,
         )
         for x in mirrors.get("github")
     ]
+    return [
+        url
+        for url in result_with_nulls
+        if url != None
+    ]

tools/workspace/ibex/repository.bzl

@@ -11,9 +11,9 @@ def ibex_repository(
         # files if necessary).
         repository = "dreal-deps/ibex-lib",
         # As discussed in #15872, we need ibex < 2.8.7 for CLP support.
-        commit = "ibex-2.8.6_4",
+        commit = "115e12323529d524786c1a744f5ffce04f4783b5",  # ibex-2.8.6_4
         commit_pin = True,
-        sha256 = "172f2cf8ced69bd2e30be448170655878735af7d0bf6d2fef44b14215c8b1a49",  # noqa
+        sha256 = "3cc12cfffc24d9dff8dbe8c7ef48ebbae14bc8b2548a9ff778c5582ca7adf70c",  # noqa
         build_file = "@drake//tools/workspace/ibex:package.BUILD.bazel",
         mirrors = mirrors,
         patches = [

tools/workspace/mirrors.bzl

@@ -33,7 +33,10 @@ DEFAULT_MIRRORS = {
         "https://s3.amazonaws.com/drake-packages/doxygen/{archive}",
     ],
     "github": [
-        "https://github.com/{repository}/archive/{commit}.tar.gz",
+        # For github.com, we choose a pattern based on the kind of commit.
+        "https://github.com/{repository}/archive/refs/tags/{tag_name}.tar.gz",  # noqa
+        "https://github.com/{repository}/archive/{commit_sha}.tar.gz",
+        # For Drake's mirrors, we use a single pattern no matter the commit.
         "https://drake-mirror.csail.mit.edu/github/{repository}/{commit}.tar.gz",  # noqa
         "https://s3.amazonaws.com/drake-mirror/github/{repository}/{commit}.tar.gz",  # noqa
     ],