Take a test path for image verification, matching the sibling actions

run-tests and run-package-tests take a test-path and own the pytest
invocation; passing a whole shell command was a vocabulary of its own and
put the runner's uv incantation in the caller.

Author: hujc7

.github/actions/ecr-build-push-pull/README.md

@@ -18,15 +18,16 @@ ECR is also used as the BuildKit layer cache.
 
 ## Verifying a freshly built image
 
-Pass `verify-command` to assert against the image before it is published:
+Pass `verify-test-path` to assert against the image before it is published:
 
 ```yaml
-    verify-command: uv run --no-project --with pytest python -m pytest -q docker/test/test_image_invariants.py
+    verify-test-path: docker/test/test_image_invariants.py
 ```
 
-It runs only on a full build, with `IMAGE_TAG` and `IMAGE_DIGEST` exported. A failure fails the
-action with nothing pushed, so the next run rebuilds rather than serving the bad image from the
-deps cache. Exact-tag and deps-cache hits skip it: that image passed the command when it was built.
+The tests run only on a full build, with `IMAGE_TAG` and `IMAGE_DIGEST` set, so the caller's job
+needs `uv` (`astral-sh/setup-uv`). A failure fails the action with nothing pushed, so the next run
+rebuilds rather than serving the bad image from the deps cache. Exact-tag and deps-cache hits skip
+them: that image passed when it was built.
 
 ## ECR URL resolution order
 

.github/actions/ecr-build-push-pull/action.yml

@@ -37,14 +37,14 @@ inputs:
     description: Tag used for the ECR layer cache image (e.g. "cache-base", "cache-curobo").
     required: false
     default: 'cache'
-  verify-command:
+  verify-test-path:
     description: >
-      Command run against a freshly built image, before it is tagged or pushed, with IMAGE_TAG
-      and IMAGE_DIGEST exported. A failing command fails the action with nothing published, so
-      the next run rebuilds instead of inheriting the bad image from the cache.
+      Path to tests asserted against a freshly built image, before it is tagged or pushed. They
+      run with IMAGE_TAG and IMAGE_DIGEST set; a failure fails the action with nothing published,
+      so the next run rebuilds instead of inheriting the bad image from the cache.
 
-      Not run on an exact-tag or deps-cache hit: those serve an image that already passed this
-      command when it was built.
+      Not run on an exact-tag or deps-cache hit: those serve an image that already passed when it
+      was built.
     required: false
     default: ''
   pull-on-deps-hit:
@@ -257,18 +257,19 @@ runs:
     # rebuilding it, so anything published unverified stays unverified.
     - name: Verify freshly built image
       if: >
-        inputs.verify-command != '' &&
+        inputs.verify-test-path != '' &&
         steps.pull-exact.outputs.hit != 'true' &&
         steps.deps-cache.outputs.deps-cache-hit != 'true'
       shell: bash
       env:
         IMAGE_TAG: ${{ inputs.image-tag }}
-        VERIFY_COMMAND: ${{ inputs.verify-command }}
+        TEST_PATH: ${{ inputs.verify-test-path }}
       run: |
         set -euo pipefail
         IMAGE_DIGEST="$(docker image inspect --format '{{.Id}}' "${IMAGE_TAG}")"
         export IMAGE_DIGEST
-        bash -c "${VERIFY_COMMAND}"
+        uv run --no-project --with pytest \
+          python -m pytest -q "${TEST_PATH}"
 
     - name: Tag built image with ECR-prefixed name
       if: >

.github/workflows/build.yaml

@@ -218,7 +218,7 @@ jobs:
         isaacsim-version: ${{ needs.config.outputs.isaacsim_image_tag }}
         dockerfile-path: docker/Dockerfile.base
         cache-tag: cache-base
-        verify-command: uv run --no-project --with pytest python -m pytest -q docker/test/test_image_invariants.py
+        verify-test-path: docker/test/test_image_invariants.py
 
   build-curobo:
     name: Build cuRobo Docker Image

docker/test/test_container_profiles.py

@@ -303,7 +303,7 @@ def test_image_is_verified_before_it_is_published():
     assert names.index("Verify freshly built image") < names.index("Push to ECR") < names.index("Push deps tag")
 
     build = (REPO_ROOT / ".github" / "workflows" / "build.yaml").read_text(encoding="utf-8")
-    assert "verify-command: uv run" in build, "the base image job must hand its invariants to the action"
+    assert "verify-test-path: docker/test/test_image_invariants.py" in build, "the base job must ask for them"
 
 
 def test_run_tests_links_isaac_sim_only_where_kit_is_installed():