Merge branch 'develop' into dev/claude-pr-review

Author: pascal-roth

.github/actions/combine-results/action.yml

@@ -37,11 +37,6 @@ inputs:
     description: Tag used for the ECR layer cache image (e.g. "cache-base", "cache-curobo").
     required: false
     default: 'cache'
-  overlay-dockerfile-path:
-    description: 'Thin overlay Dockerfile applied on top of a deps cache hit.'
-    required: false
-    default: 'docker/Dockerfile.overlay'
-
 runs:
   using: composite
   steps:
@@ -67,15 +62,15 @@ runs:
         export DOCKER_CONFIG="${DOCKER_CONFIG_DIR}"
 
         if [ -n "${{ env.NGC_API_KEY }}" ]; then
-          echo "🟢 Logging into nvcr.io..."
+          echo "🔵 Logging into nvcr.io..."
           docker login -u \$oauthtoken -p ${{ env.NGC_API_KEY }} nvcr.io
         else
-          echo "🟠 NGC_API_KEY not set — skipping nvcr.io login (normal for fork PRs)"
+          echo "🟠 NGC_API_KEY not set - skipping nvcr.io login (normal for fork PRs)"
         fi
 
     ##### 2: Resolve ECR URL #####
 
-    # Tries: explicit input → ECR_CACHE_URL env var → SSM parameter on EC2.
+    # Tries: explicit input >> ECR_CACHE_URL env var >> SSM parameter on EC2.
     # Exports ECR_URL to GITHUB_ENV and sets output `available`.
 
     - name: Resolve ECR URL
@@ -87,13 +82,13 @@ runs:
         ECR_URL="${INPUT_ECR_URL:-}"
 
         if [ -z "${ECR_URL}" ]; then
-          echo "🟢 ecr-url input not set, trying ECR_CACHE_URL env var..."
+          echo "🔵 ecr-url input not set, trying ECR_CACHE_URL env var..."
           ECR_URL="${ECR_CACHE_URL:-}"
           [ -n "${ECR_URL}" ] && echo "🟢 Using ECR_CACHE_URL env var: ${ECR_URL}"
         fi
 
         if [ -z "${ECR_URL}" ]; then
-          echo "🟢 ECR_CACHE_URL env var not set, trying SSM..."
+          echo "🔵 ECR_CACHE_URL env var not set, trying SSM..."
           IMDS_TOKEN=$(curl -sf -X PUT "http://169.254.169.254/latest/api/token" \
             -H "X-aws-ec2-metadata-token-ttl-seconds: 21600") || true
           INSTANCE_ID=$(curl -sf -H "X-aws-ec2-metadata-token: ${IMDS_TOKEN}" \
@@ -109,10 +104,10 @@ runs:
             if [ -n "${ECR_URL}" ]; then
               echo "🟢 Resolved ECR URL from SSM (/github-runner/${INSTANCE_ID}/ecr-cache-url): ${ECR_URL}"
             else
-              echo "🟢 SSM parameter not found for instance ${INSTANCE_ID}"
+              echo "🔵 SSM parameter not found for instance ${INSTANCE_ID}"
             fi
           else
-            echo "🟢 Not running on EC2 or IMDS unavailable, skipping SSM lookup"
+            echo "🔵 Not running on EC2 or IMDS unavailable, skipping SSM lookup"
           fi
         fi
 
@@ -136,7 +131,7 @@ runs:
         AWS_REGION=$(echo "${REGISTRY}" | sed 's/.*\.dkr\.ecr\.\(.*\)\.amazonaws\.com/\1/')
 
         if [ "${AWS_REGION}" = "${REGISTRY}" ]; then
-          echo "🔴 Invalid ECR URL — cannot extract AWS region: ${ECR_URL}"
+          echo "🔴 Invalid ECR URL - cannot extract AWS region: ${ECR_URL}"
           echo "🔴 Expected format: <account-id>.dkr.ecr.<region>.amazonaws.com/<repo>"
           exit 1
         fi
@@ -148,39 +143,55 @@ runs:
         echo "ECR_IMAGE=${ECR_IMAGE}"     >> "$GITHUB_ENV"
         echo "CACHE_IMAGE=${CACHE_IMAGE}" >> "$GITHUB_ENV"
 
-        echo "🟢 Logging into ECR registry..."
+        echo "🔵 Logging into ECR registry..."
         aws ecr get-login-password --region "${AWS_REGION}" | \
           docker login --username AWS --password-stdin "${REGISTRY}"
 
-    ##### 4: Pull exact image from ECR #####
+    ##### 4: Check if exact image exists in ECR #####
 
-    # If the exact per-commit image already exists in ECR, pull and tag it locally.
-    # Sets output `hit: true` to skip all subsequent build/push steps.
+    # Lightweight manifest check - fetches only the image manifest (~KB),
+    # not the actual layers.  If the exact per-commit image already exists
+    # in ECR, sets output `hit: true` to skip all subsequent build/push steps.
 
-    - name: Pull exact image from ECR
+    - name: Check exact image in ECR
       id: pull-exact
       if: steps.resolve-ecr.outputs.available == 'true'
       shell: bash
       run: |
-        echo "🟢 Trying to pull commit-tagged ${ECR_IMAGE} from ECR..."
-        if docker pull "${ECR_IMAGE}" 2>/dev/null; then
-          docker tag "${ECR_IMAGE}" "${{ inputs.image-tag }}"
-          echo "🟢 Commit-tagged image pulled, skipping build!"
+        echo "🔵 Checking if commit-tagged image exists in ECR >> ${ECR_IMAGE}"
+        if docker manifest inspect "${ECR_IMAGE}" >/dev/null 2>&1; then
+          echo "🟢 Commit-tagged image found in ECR, skipping build!"
           echo "hit=true" >> "$GITHUB_OUTPUT"
         else
           echo "🟠 Image ${ECR_IMAGE} not found in ECR, will try deps-cache strategy..."
         fi
 
-    ##### 5: Compute deps hash and try overlay #####
+    # Pull the image when the manifest check succeeded but the image is not
+    # available locally (test jobs need it for `docker run`).  Build jobs
+    # that only push to ECR will already have the image or don't need it.
+    - name: Pull exact image from ECR
+      if: steps.pull-exact.outputs.hit == 'true'
+      shell: bash
+      run: |
+        if docker image inspect "${{ inputs.image-tag }}" >/dev/null 2>&1; then
+          echo "🟢 Image already available locally, skipping pull"
+        else
+          echo "🔵 Pulling ${ECR_IMAGE} from ECR..."
+          docker pull "${ECR_IMAGE}"
+          docker tag "${ECR_IMAGE}" "${{ inputs.image-tag }}"
+          echo "🟢 Image pulled and tagged as ${{ inputs.image-tag }}"
+        fi
+
+    ##### 5: Check deps cache #####
 
     # Hashes installation-relevant files + the base image digest to produce a stable
-    # deps-<hash> ECR tag. If it exists, builds only the thin final-COPY overlay
-    # (seconds) instead of the full image (40-60 min).
+    # deps-<hash> ECR tag. If the image exists in ECR, the build job succeeds
+    # immediately and test jobs pull the deps image with a source volume mount.
 
     # Edit DEPS_FILES or DEPS_MANIFEST_PATTERN when install
     # inputs change (new packages, new manifests, etc.).
 
-    - name: Compute deps hash and try overlay
+    - name: Check deps cache
       id: deps-cache
       if: steps.resolve-ecr.outputs.available == 'true' && steps.pull-exact.outputs.hit != 'true'
       shell: bash
@@ -191,7 +202,6 @@ runs:
           "${{ inputs.dockerfile-path }}"
           isaaclab.sh
           environment.yml
-          tools
           source/isaaclab/isaaclab/cli
         )
         # Manifest files matched repo-wide via git ls-files.
@@ -209,36 +219,26 @@ runs:
           BASE_IMAGE_UNIQ_ID="${{ inputs.isaacsim-base-image }}:${{ inputs.isaacsim-version }}"
         fi
 
-        echo "🟢 Base image ID: ${BASE_IMAGE_UNIQ_ID}"
+        echo "🔵 Base image ID: ${BASE_IMAGE_UNIQ_ID}"
 
         MANIFEST_FILES=$(git ls-files | grep -E "${DEPS_MANIFEST_PATTERN}" || true)
         FILE_HASH=$(git ls-files -s "${DEPS_FILES[@]}" ${MANIFEST_FILES} 2>/dev/null \
           | sha256sum | cut -c1-16)
         DEPS_HASH=$(printf '%s %s' "${FILE_HASH}" "${BASE_IMAGE_UNIQ_ID}" | sha256sum | cut -c1-16)
         DEPS_ECR_IMAGE="${ECR_URL}:deps-${DEPS_HASH}"
-        echo "🟢 Deps hash: ${DEPS_HASH}"
-        echo "🟢 Trying to pull deps image ${DEPS_ECR_IMAGE} from ECR..."
-
-        if docker pull "${DEPS_ECR_IMAGE}" 2>/dev/null; then
-          echo "🟢 Deps cache HIT!!! Building thin overlay (final COPY only)..."
-          OVERLAY_BUILDER="ci-builder-overlay-${{ github.run_id }}-${{ github.job }}"
-          docker buildx create --use --driver docker-container --name "${OVERLAY_BUILDER}" \
-            || docker buildx use "${OVERLAY_BUILDER}"
-          trap 'docker buildx rm "${OVERLAY_BUILDER}" || true' EXIT
-          docker buildx build \
-            --progress=plain \
-            --platform linux/amd64 \
-            -f "${{ inputs.overlay-dockerfile-path }}" \
-            --build-arg "DEPS_IMAGE=${DEPS_ECR_IMAGE}" \
-            --build-arg "ISAACLAB_PATH_ARG=/workspace/isaaclab" \
-            -t "${{ inputs.image-tag }}" \
-            --load \
-            .
-          echo "🟢 Overlay build complete!"
-          docker tag "${{ inputs.image-tag }}" "${ECR_IMAGE}"
-          echo "🟢 Pushing overlay image ${ECR_IMAGE} to ECR for future reuse..."
-          docker push "${ECR_IMAGE}"
-          echo "overlay-built=true" >> "$GITHUB_OUTPUT"
+        echo "🔵 Deps hash: ${DEPS_HASH}"
+        echo "🔵 Checking if deps image ${DEPS_ECR_IMAGE} exists in ECR..."
+
+        # Lightweight manifest check - fetches only the image manifest (~KB),
+        # not the actual layers, so this completes in seconds.
+        if docker manifest inspect "${DEPS_ECR_IMAGE}" >/dev/null 2>&1; then
+          echo "🟢 Deps cache HIT!!! Image exists in ECR: ${DEPS_ECR_IMAGE}"
+          # Create a commit-tagged alias pointing to the same manifest (registry-side,
+          # no layer download). Test jobs will pull this tag normally.
+          echo "🔵 Tagging as commit image ${ECR_IMAGE}..."
+          docker buildx imagetools create -t "${ECR_IMAGE}" "${DEPS_ECR_IMAGE}"
+          echo "🟢 Tagged ${ECR_IMAGE} >> ${DEPS_ECR_IMAGE}"
+          echo "deps-cache-hit=true" >> "$GITHUB_OUTPUT"
         else
           echo "🟠 Deps cache MISS 😿😿😿 (${DEPS_HASH}). Will build now. 🐢🐢🐢"
           echo "DEPS_ECR_IMAGE=${DEPS_ECR_IMAGE}" >> "$GITHUB_ENV"
@@ -247,11 +247,11 @@ runs:
 
     ##### 6: Full build #####
 
-    # Runs when neither the exact image nor the deps-overlay was available.
+    # Runs when neither the exact image nor the deps cache was available.
     # Uses ECR layer cache (--cache-from/--cache-to) when ECR is available.
 
     - name: Full build
-      if: steps.pull-exact.outputs.hit != 'true' && steps.deps-cache.outputs.overlay-built != 'true'
+      if: steps.pull-exact.outputs.hit != 'true' && steps.deps-cache.outputs.deps-cache-hit != 'true'
       shell: bash
       run: |
         BUILD_ARGS=(
@@ -278,7 +278,7 @@ runs:
           || docker buildx use "${BUILDER_NAME}"
         trap 'docker buildx rm "${BUILDER_NAME}" || true' EXIT
 
-        echo "🟢 Building ${{ inputs.image-tag }}..."
+        echo "🔵 Building ${{ inputs.image-tag }}..."
         docker buildx build --load "${BUILD_ARGS[@]}" .
 
     ##### 7: Push to ECR #####
@@ -290,10 +290,10 @@ runs:
       if: >
         steps.resolve-ecr.outputs.available == 'true' &&
         steps.pull-exact.outputs.hit != 'true' &&
-        steps.deps-cache.outputs.overlay-built != 'true'
+        steps.deps-cache.outputs.deps-cache-hit != 'true'
       shell: bash
       run: |
-        echo "🟢 Pushing ${ECR_IMAGE} to ECR..."
+        echo "🔵 Pushing ${ECR_IMAGE} to ECR..."
         docker push "${ECR_IMAGE}"
         echo "🟢 Pushed ${ECR_IMAGE}"
 
@@ -306,7 +306,7 @@ runs:
       if: env.PUSH_DEPS_IMAGE == 'true'
       shell: bash
       run: |
-        echo "🟢 Pushing deps image for future cache hits: ${DEPS_ECR_IMAGE}"
+        echo "🔵 Pushing deps image for future cache hits: ${DEPS_ECR_IMAGE}"
         docker tag "${{ inputs.image-tag }}" "${DEPS_ECR_IMAGE}"
         docker push "${DEPS_ECR_IMAGE}"