From da3d8d7b101d1d3c9d0cf6114e52d0bc425fe13b Mon Sep 17 00:00:00 2001 From: Billy Okal Date: Thu, 20 Aug 2026 10:59:27 -0500 Subject: [PATCH 1/2] chore: drop the broken docs/agents/INDEX.md requirement from AGENTS.md (#68) The "Working on this codebase" section directed every task to first read docs/agents/INDEX.md, but docs/agents/ has never existed in this repo's history on any branch (git log --all --oneline -- docs/agents/ returns nothing). This gate blocked every task from being started per AGENTS.md's own instructions, so remove the dead requirement. (cherry picked from commit 60f23d9ae56a0cf0ca80f4a7dfe2b22e9f9d144e) --- AGENTS.md | 8 -------- 1 file changed, 8 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index ccfc122..e27278c 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -41,11 +41,3 @@ pre-commit run --all-files - Don't mutate the `isaac_autodata` conda env. No `pip install/uninstall`, `conda install/remove`, or version upgrades. If a dependency is missing, surface the exact command and let the user run it. - Don't re-run, modify, or work around `conda_installer.sh`. No env recreate/rename/delete, no channel or conda config changes. Installer issues get reported, not patched in-flight. - Don't change any existing design docs or diagrams in /docs, that is only for human created files. If you need to add any new diagrams or designs, add them to the /agentic_design directory. - -## Working on this codebase - -Dev work is phased and coordinated via `docs/agents/`. Before starting any task: - -1. Read `docs/agents/INDEX.md` — it names the active phase, sub-phase ownership, and reading order. -2. Load the sub-phase doc for the work you're doing, plus any contracts it depends on. -3. Any change that affects an interface signature or invariant must update its contract file in the same commit. From 0969a14fb19dec534b187fa2ba1379fe40148793 Mon Sep 17 00:00:00 2001 From: peterd-NV Date: Tue, 18 Aug 2026 14:05:59 -0700 Subject: [PATCH 2/2] Remove NGC login from CI/nightly and add isolated docker config (#66) * remove ngc login * add pip retry (cherry picked from commit eb66652b204038832a535eb52487830969e7b9fe) --- .github/workflows/ci.yml | 20 +++++++------------- .github/workflows/nightly.yml | 20 +++++++------------- docker/Dockerfile.isaac_autodata | 4 ++++ 3 files changed, 18 insertions(+), 26 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 396998e..694409d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -87,21 +87,15 @@ jobs: git lfs install --local git lfs pull - # Isaac Sim 6.0.1 on nvcr.io requires authenticated pull; anonymous - # access that worked for 6.0.0-dev2 is denied for this tag. - - name: Log in to NGC + - name: Run E2E tests + # The GPU runners are shared. Use an empty job-temporary Docker config so + # stale credentials cannot override anonymous access to the public base image, + # and this job cannot modify the runner's persistent Docker login. env: - NGC_API_KEY: ${{ secrets.NGC_API_KEY }} + DOCKER_CONFIG: ${{ runner.temp }}/isaac-autodata-docker run: | - if [ -z "${NGC_API_KEY}" ]; then - echo "NGC_API_KEY secret is empty; cannot pull nvcr.io/nvidia/isaac-sim" - exit 1 - fi - # $oauthtoken is the literal NGC username. - echo "${NGC_API_KEY}" | docker login nvcr.io -u '$oauthtoken' --password-stdin - - - name: Run E2E tests - run: ./scripts/ci/run_tests.sh + mkdir -p "${DOCKER_CONFIG}" + ./scripts/ci/run_tests.sh build_docs: name: Build docs diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index cd9040e..f652463 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -59,21 +59,15 @@ jobs: git lfs install --local git lfs pull - # Isaac Sim 6.0.1 on nvcr.io requires authenticated pull; anonymous - # access that worked for 6.0.0-dev2 is denied for this tag. - - name: Log in to NGC + - name: Run full E2E suite + # The GPU runners are shared. Use an empty job-temporary Docker config so + # stale credentials cannot override anonymous access to the public base image, + # and this job cannot modify the runner's persistent Docker login. env: - NGC_API_KEY: ${{ secrets.NGC_API_KEY }} + DOCKER_CONFIG: ${{ runner.temp }}/isaac-autodata-docker run: | - if [ -z "${NGC_API_KEY}" ]; then - echo "NGC_API_KEY secret is empty; cannot pull nvcr.io/nvidia/isaac-sim" - exit 1 - fi - # $oauthtoken is the literal NGC username. - echo "${NGC_API_KEY}" | docker login nvcr.io -u '$oauthtoken' --password-stdin - - - name: Run full E2E suite - run: ./scripts/ci/run_tests.sh + mkdir -p "${DOCKER_CONFIG}" + ./scripts/ci/run_tests.sh - name: Test results summary if: always() diff --git a/docker/Dockerfile.isaac_autodata b/docker/Dockerfile.isaac_autodata index 8a31bcb..7cb05e6 100644 --- a/docker/Dockerfile.isaac_autodata +++ b/docker/Dockerfile.isaac_autodata @@ -11,6 +11,10 @@ ENV WORKDIR=${WORKDIR} WORKDIR "${WORKDIR}" ENV TERM=xterm +# Tolerate transient package-index failures on shared CI runners. These settings +# are inherited by every pip invocation, including those run by isaaclab.sh. +ENV PIP_RETRIES=10 \ + PIP_DEFAULT_TIMEOUT=120 # Path to the (nested) Isaac Lab checkout inside the Arena submodule. ENV ISAACLAB_PATH=${WORKDIR}/submodules/IsaacLab-Arena/submodules/IsaacLab