[CI] Skip the image invariants on a deps-cache hit and link _isaac_sim only in Kit images

.github/actions/ecr-build-push-pull/README.md

@@ -16,6 +16,12 @@ ECR is also used as the BuildKit layer cache.
     ecr-url: (optional, complete url for ECR storage)
 ```
 
+## Outputs
+
+- `built`: `'true'` when this run built the image, so it exists locally under `image-tag`.
+  An exact-tag hit pulls it as well; a deps-cache hit only creates the ECR tag unless
+  `pull-on-deps-hit` is set. Gate steps that need the image locally on this output.
+
 ## ECR URL resolution order
 
 1. `ecr-url` input

.github/actions/ecr-build-push-pull/action.yml

@@ -50,6 +50,15 @@ inputs:
       that only need the tag pushed.
     required: false
     default: 'false'
+outputs:
+  built:
+    description: >
+      'true' when this run built the image, so it exists locally under image-tag.
+      An exact-tag hit pulls it as well; a deps-cache hit only creates the ECR tag
+      unless pull-on-deps-hit is set, so steps that need the image locally should
+      check this output.
+    value: ${{ steps.pull-exact.outputs.hit != 'true' && steps.deps-cache.outputs.deps-cache-hit != 'true' }}
+
 runs:
   using: composite
   steps:

.github/actions/run-tests/run_tests.sh

@@ -320,8 +320,11 @@ run_tests() {
       set -e
       cd /workspace/isaaclab
       mkdir -p tests
-      rm _isaac_sim || true
-      ln -s /isaac-sim _isaac_sim
+      # The runtime mounts above create /isaac-sim in every image. Link it only where Kit
+      # lives there: in the kit-less image the link would read as a downloaded Isaac Sim,
+      # which isaaclab.sh refuses to combine with the image's VIRTUAL_ENV.
+      rm -f _isaac_sim
+      if [ -x /isaac-sim/python.sh ]; then ln -s /isaac-sim _isaac_sim; fi
       if [ -n \"\${WARP_CACHE_PATH:-}\" ]; then
         ./isaaclab.sh -p tools/verify_warp_cache.py
       fi

.github/workflows/build.yaml

@@ -208,6 +208,7 @@ jobs:
         enable-cache: true
 
     - name: Build and push to ECR
+      id: image
       uses: ./.github/actions/ecr-build-push-pull
       with:
         image-tag: ${{ needs.config.outputs.ci_image_tag }}
@@ -219,7 +220,10 @@ jobs:
     # #6329 aborts the pip install when it strands a prebundled package's __init__.py
     # (nvbugs 6343978: 14 Isaac Sim extensions fail to load). The images install with
     # ``uv sync``, which never runs that guard, so assert the same invariant on the image.
+    # Only a freshly built image is on this runner; a deps-cache hit reuses one that
+    # passed this check when it was built.
     - name: Verify image invariants
+      if: steps.image.outputs.built == 'true'
       shell: bash
       env:
         IMAGE_TAG: ${{ needs.config.outputs.ci_image_tag }}

docker/test/test_container_profiles.py

@@ -15,6 +15,7 @@
 from docker.utils import ContainerInterface, volume_mounts
 
 DOCKER_DIR = Path(__file__).resolve().parents[1]
+REPO_ROOT = DOCKER_DIR.parent
 
 
 @pytest.fixture
@@ -288,6 +289,20 @@ def test_kitless_compose_service_has_no_isaac_sim_mounts():
     assert all("/kit/" not in mount["target"].lower() for mount in mounts)
 
 
+def test_run_tests_links_isaac_sim_only_where_kit_is_installed():
+    """The kit-less image has no Kit under ``/isaac-sim``, which the runtime mounts create anyway.
+
+    Linking it as ``_isaac_sim`` there reads as a downloaded Isaac Sim, which ``isaaclab.sh``
+    refuses to combine with the image's ``VIRTUAL_ENV``.
+    """
+    script = (REPO_ROOT / ".github" / "actions" / "run-tests" / "run_tests.sh").read_text(encoding="utf-8")
+
+    link_lines = [line.strip() for line in script.splitlines() if "ln -s /isaac-sim _isaac_sim" in line]
+
+    assert link_lines
+    assert all("/isaac-sim/python.sh" in line for line in link_lines), link_lines
+
+
 def test_kitless_volume_key_resolves_owned_image_paths(monkeypatch: pytest.MonkeyPatch):
     """The explicit kit-less volume key resolves the paths prepared by its Dockerfile."""
     monkeypatch.setenv("DOCKER_ISAACLAB_PATH", "/workspace/isaaclab")