Onboard IsaacLab skills for NVCARPS / Isaac Skills catalog - #7879
matthewtrepte wants to merge 29 commits into
Conversation
|
| echo "reachable=true" >> "$GITHUB_OUTPUT" | ||
| else | ||
| echo "reachable=false" >> "$GITHUB_OUTPUT" | ||
| echo "::warning::urm.nvidia.com unreachable — runner is not on the NVIDIA internal network; SkillEvaluator steps will be skipped" |
There was a problem hiding this comment.
Validation gate silently skips
When the selected self-hosted runner cannot resolve the internal registry, this step only emits a warning. The installation and all subsequent SkillEvaluator steps are then skipped, so the job succeeds without running any Tier 1/2A/2B/3 validation. A runner networking or labeling problem therefore silently disables the new CI gate instead of blocking the affected PR.
| @@ -1 +1 @@ | |||
| ../../skills/user/setup-troubleshooting No newline at end of file | |||
| ../../skills/_internal/setup-troubleshooting No newline at end of file | |||
There was a problem hiding this comment.
Relocation leaves broken links
This alias now targets the relocated _internal skill, but related source-of-truth documentation still points to removed skills/user/* and skills/developer/* paths. The setup, migration, and contribution pages therefore contain broken links and direct maintainers to obsolete locations. Please update those references as part of the move.
Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!
There was a problem hiding this comment.
Isaac Lab Review Bot
The catalog-style skill layout, discovery aliases, documentation links, validator extensions, and PR-scoped SkillEvaluator integration are broadly coherent. One CI health-check issue should be corrected: skillevaluator doctor cannot inspect the inference credential because that secret is not provided to its step.
- Design and architecture: The
skills/userversusskills/_internalsplit and PR-scoped SkillEvaluator workflow are consistent with the catalog boundary. The overall structure is sound, but the workflow’s diagnostic stage should receive the same inference credential as the validation stage so it can meaningfully verify the configured service access. - API: The existing skill names exposed through discovery aliases are preserved while repository paths and cross-references are updated. The validator’s new
licenseandmetadata.authorrequirements are scoped to user-facing skills, with no accepted API compatibility concern. - Implementation: The nested-frontmatter and JSON evaluation validation changes are supported by focused tests. In
.github/workflows/skills-check.yml, addNVIDIA_INFERENCE_KEY: ${{ secrets.NVIDIA_INFERENCE_API_KEY }}to the install/doctor step; otherwiseskillevaluator doctorcannot observe the credential it is expected to diagnose and will produce an uninformative warning.
Minor fixes needed. Posted 1 actionable finding inline.
Automated review; human maintainers own approval decisions.
| python3 -m pip install --upgrade pip | ||
| python3 -m pip install "skillevaluator==${SKILLEVALUATOR_VERSION}" -i https://urm.nvidia.com/artifactory/api/pypi/nv-shared-pypi/simple | ||
| skillevaluator --version | ||
| skillevaluator doctor || echo "::warning::skillevaluator doctor reported issues — check NVIDIA_INFERENCE_KEY and network access" |
There was a problem hiding this comment.
🔵 Suggestion · Implementation — doctor step lacks the key it validates
skillevaluator doctor runs inside the install step, whose env: block only sets SKILLEVALUATOR_VERSION. NVIDIA_INFERENCE_KEY is first defined two steps later, so the doctor check can never observe the credential and will permanently emit the "check NVIDIA_INFERENCE_KEY" warning, making this health check uninformative. Add NVIDIA_INFERENCE_KEY: ${{ secrets.NVIDIA_INFERENCE_API_KEY }} to this step's env.
|
run-ci |
- Add `license: BSD-3-Clause` and `metadata.author` to all 17 user SKILL.md files - Move `skills/developer/` → `skills/_internal/` (dev-only, not published externally) - Update `.agents/skills/` symlinks to point to `_internal/` for the four internal skills - Add `evals/evals.json` for all 17 user-facing skills (positive + negative eval cases) - Update `tools/skills/cli.py` to support `_internal/` audience, require `license` and `metadata.author` fields, and validate `evals/evals.json` alongside `evaluations.md`
These skills are time-limited or maintainer-focused rather than general user-facing: install/troubleshooting are one-time onboarding tasks that stale quickly, and the 2x→3x migration guide has a finite lifespan.
These skills are useful to any Isaac Lab contributor, not just internal maintainers. Added evals/evals.json for each and fixed the broken relative link in pr-workflow that pointed to the old _internal/ path.
…ification - Fix tools/skills/cli.py: eval entries now report missing id/prompt/expected_skill by key membership instead of a broken truthy check that let missing fields pass; expected_skill still allows null for negative eval cases. Non-object eval entries are now flagged instead of silently skipped (and no longer count toward the minimum-entries check). Parser now tracks metadata: nesting so a mistaken top-level author: can be told apart from a correctly nested metadata.author:. - Replace unverified metadata.author email (isaaclab@nvidia.com, not used anywhere else in the repo) with the name-only Isaac Lab Team, matching the existing pyproject.toml/copyright-header convention. - Move coding-style and changelog-fragments to skills/_internal/ alongside pr-workflow -- these are IsaacLab's own contribution/release conventions, not general framework-usage skills for external consumers. - Remove stray untracked franka_panda_patched/ debug artifact from an unrelated investigation.
The prior commit's message described these fixes but the diff didn't include the file -- git add -A skills/ didn't stage it.
Replace the name-only Isaac Lab Team placeholder with the confirmed team alias, Isaac Lab Team <Isaac-Lab@exchange.nvidia.com>.
Cover the two review-bot findings and the author-nesting fix with dedicated tests: missing id/prompt/expected_skill detection, expected_skill: null allowed for negative eval cases, non-object eval entries rejected and excluded from the minimum-entries count, top-level author rejected, and _internal skills skip audience/status/owners but still require author. Also updates the test skill fixture to include the now-required license and metadata.author fields, which the existing test_validate_accepts_well_formed_user_skill test was missing.
Runs skillevaluator Tier 1/2A/2B/3 against skills/user/* changed by the PR, mirroring the proven pattern from Isaac/isaac's ci/gitlab_workflows/skills.yaml, adapted to GitHub Actions. This is the prerequisite validation gate from the isaac-skills onboarding steps (NVCARPS mirroring/publishing itself is a separate, later step).
Avoids provisioning a new secret: the repo already has NVIDIA_INFERENCE_API_KEY (added for backport-release-3.0.yml's conflict resolution), which maps to the NVIDIA_INFERENCE_KEY env var skillevaluator expects.
…a.author Upstream develop added issue-audit and issue-backlog-triage in skills/developer/. These developer-utility skills don't carry a public license or metadata.author because they're not destined for the Isaac Skills catalog, but the validator was gating on those fields for every non-internal skill. Changes: - Add "developer" back to AUDIENCES (upstream already has it). - Scope license and metadata.author requirements to audience=="user" only. - Gate _validate_user_evaluations on audience=="user" (same scoping). - Update test to reflect that internal skills no longer require metadata.author, and add a new test for developer skills.
Parser fixes (tools/skills/cli.py): - Clear current_map_key after processing a list item so a subsequent indented 'key: val' line is not silently absorbed as a dotted map entry (e.g. 'owners.stray' when 'stray: val' appeared after a list item). - Guard nested map key parsing against an empty key produced by ' : val' under a map-intro parent. - Remove the stray empty-list pre-write for map-intro keys (e.g. 'metadata:') that left data['metadata']=[] alongside 'metadata.author' dotted entries; the list branch creates the list on first item via setdefault. - Fix false-positive in evals.json field validation: use 'value is None or value == ""' instead of 'not entry.get(field)', which incorrectly flagged numeric id:0 as a missing field. CI fixes (.github/workflows/skills-check.yml): - Replace 'skillevaluator doctor || true' with a GitHub Actions warning so pre-flight configuration errors (missing key, network) surface as a named diagnostic instead of being silently swallowed. - Output skill directories newline-separated and consume them with 'while IFS= read -r' instead of word-splitting on a space-joined string, preventing silent path corruption for any directory name with spaces.
…ity flags
SkillEvaluator Tier 1 requires the directory name to equal the frontmatter
'name' field. All 13 user skill directories used short names while the
frontmatter used the full 'isaaclab-*' names, causing a schema failure on
every skill. Renamed all directories and updated:
- .agents/skills/ symlinks to point at the new paths
- Cross-skill relative links (../old-name/ → ../new-name/)
- Backtick paths in all markdown reference files
Also fixed two "Memory Poisoning: Reset state" keyword hits from the static
security scanner. The phrase "reset state" is standard RL environment
terminology but matches a prompt-injection guard looking for agent-memory
manipulation. Rephrased to "initial environment configuration / pose":
- skills/user/isaaclab-debugging-rl-training/reference.md
- skills/user/isaaclab-planning-manipulation-tasks/SKILL.md
- skills/user/isaaclab-randomizing-with-events/examples.md
Remaining Tier 1 security failures ("skillspector scan did not execute
reliably") are caused by the LLM-based semantic analyzers requiring
NVIDIA_INFERENCE_KEY, which is only available in CI. They are not content
issues and will resolve automatically when CI runs with the secret.
The previous commit used overly broad rephrasing ("episode-start",
"initial environment pose/configuration") that replaced the canonical
IsaacLab term "reset" unnecessarily.
The security scanner flags the two-word phrase "reset state" as a
potential memory-poisoning keyword. Breaking that exact phrase is
sufficient; the word "reset" itself is fine.
Revised phrasing keeps "reset" and avoids only the two-word collocation:
- "Reset state for robot, object, and goal"
→ "Robot, object, and goal state after environment reset"
- "reset state, and observation coverage"
→ "state after reset, and observation coverage"
- "Reset state is physically valid"
→ "Environment configuration at reset is physically valid"
- "Reset State Randomization" / "reset state randomization"
→ "Reset-Mode Randomization" / "reset-mode randomization"
ruff format requires the three-line implicit string concatenation in test_validate_developer_skill_does_not_require_license_or_author to be written as a single string literal.
The NVIDIA internal Artifactory (urm.nvidia.com) is not accessible from the open-source self-hosted GPU runners. Add continue-on-error to the install step and guard downstream steps on install success, so the job emits a warning instead of failing when the package cannot be fetched. When a runner with internal network access picks up the job the full Tier 1/2A/2B/3 validation still runs and can block the PR.
Three issues flagged by greptile on PR isaac-sim#7878: 1. Docs linked to old skill directory names (pre-rename). Update 9 doc source files to use the new isaaclab-* paths: - prepare-assets-for-newton → isaaclab-preparing-assets-for-newton - migrate-from-isaac-gym → isaaclab-migrating-from-isaac-gym - domain-randomization-events → isaaclab-randomizing-with-events - create-environments → isaaclab-building-environments - plan-manipulation-tasks → isaaclab-planning-manipulation-tasks - train-rl-agents → isaaclab-training-rl-agents - debug-rl-training → isaaclab-debugging-rl-training - select-backends → isaaclab-selecting-backends - use-presets → isaaclab-using-presets - use-sensors-actuators → isaaclab-using-sensors-actuators 2. {"evals": null} caused a TypeError crash in the validator. data.get("evals", []) returns None when the key is present with a null value; iterating None raises TypeError before any diagnostic is emitted. Now validate that evals is a list before iterating and return a clear error if it is not. Added regression test. 3. validate-skills job ran untrusted PR code on self-hosted GPU runner without an explicit trust decision. Added environment: skillevaluator-review which requires maintainer approval in repo settings before execution.
Two issues found in PR CI: 1. Link checker 404s on absolute github.com/blob/develop/ URLs for the preparing-assets-for-newton skill — those paths don't exist on develop until this PR is merged. Convert to relative paths matching the style used by all other skill references in the docs. 2. Self-hosted GPU runner does not have gh CLI installed, so the "Determine touched skills" step fails with 'gh: command not found'. Replace the gh api call with Python stdlib urllib (always available since Python is used earlier in the job), preserving pagination.
The <<'PYEOF' heredoc inside a YAML run: block triggers the check-yaml pre-commit hook because YAML parsers interpret << as a merge key even inside block scalars. Extract the Python that fetches PR changed files into tools/skills/get_pr_files.py (stdlib only, no extra deps) and call it directly from the workflow step.
Two issues flagged by isaaclab-review-bot: 1. continue-on-error on the install step meant any failure (bad version pin, transient pip error, not just missing network) silently disabled the SkillEvaluator gate and left the job green. Replace with an explicit registry connectivity pre-check: if urm.nvidia.com is unreachable the install step is skipped (not errored), which propagates as 'skipped' to downstream steps; if the registry is reachable but installation fails for any other reason the job fails as expected. 2. actions/upload-artifact was the only action in the file not pinned to an immutable commit SHA. Pin to 043fb46d (v7) matching the SHA-pinning style of all sibling actions, particularly important since this step runs in the job that holds NVIDIA_INFERENCE_API_KEY.
Without the secret, skillevaluator doctor cannot check inference-API access and emits an uninformative warning instead of a real diagnostic. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
NVIDIA/SkillEvaluator is Apache 2.0 on GitHub, so the validate-skills job no longer needs urm.nvidia.com or any NVIDIA-internal network access. - Remove urm.nvidia.com DNS pre-check and reachable-gate conditions - Install skillevaluator[tier2,security] from NVIDIA/SkillEvaluator@v0.1.0 - Drop --profile internal and --catalog-path (not in public API) - Drop --tier3 from validate (Tier 3 needs Docker+Harbor; run separately) - Rename run step to "Tier 1 / Tier 2A / Tier 2B" to match what actually runs Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
setup-troubleshooting moved from skills/user/ to skills/_internal/; update the two seealso links that still referenced the old location. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The public SkillEvaluator marks Security Scan (skillspector) and Secrets Detection (gitleaks) as incomplete when the tools are missing, which fails the job without any actionable findings. - Install gitleaks (public binary) so Secrets Detection actually runs - Skip the security check (skillspector is NVIDIA-internal, unavailable on public runners) via --checks, leaving all other Tier 1 checks active - Set NVIDIA_API_KEY (build.nvidia.com) from the repo's NVIDIA_INFERENCE_API_KEY secret so Tier 2 embedding calls have a key Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Self-hosted runners run as an unprivileged user; writing to /usr/local/bin fails with permission denied. Install to RUNNER_TEMP/bin and add to PATH. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
skillevaluator doctor imports from the harbor module (Tier 3 extra), which is not installed. Remove the call — it was advisory-only and was generating a noisy traceback that offered no actionable output. Tier 2A (context-optimization-check) and Tier 2B (similarity-check) both require an embedding API key (NVIDIA_API_KEY / OPENAI_API_KEY). Fork PRs cannot access parent-repo secrets, so the key is always empty on external contributor PRs. Demote these checks to warnings so Tier 1 failures remain the hard gate; Tier 2A/2B will become blocking once the key is available on the runner. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
setup-troubleshooting was moved from skills/user/ to skills/_internal/ but skills/README.md still listed the old user/ path. Update to the actual current location. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add `--external` to `validate` to pin the public-publication profile explicitly on every runner. - Upgrade install extra from `[tier2,security]` to `[tier2,security,tier3]` so the Tier 3 CLI is available. - Add advisory Tier 3 step: `skillevaluator tier3 evaluate --agents codex --env-mode docker --external`. Failures emit `::warning::` but do not block the job (no `--block-on-agent-eval`), matching the SkillEvaluator recommended CI pattern for initial adoption. - Driver: single `NVIDIA_API_KEY` with `SKILL_EVAL_LLM_PROVIDER=nv_build` routes the evaluator LLM and the codex agent through SkillEvaluator's NVIDIA Build compatibility bridge — no internal Harbor managed service required. Uses the repo's existing `NVIDIA_INFERENCE_API_KEY` secret. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
5fa7a05 to
39cd26d
Compare
skillevaluator tier3 evaluate does not accept --external (only the validate subcommand does). All 14 skills were silently skipped with a warning on the previous run. Remove the flag so Tier 3 actually executes the agent evaluation. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Summary
skills/user/isaaclab-*) and internal skills formatted for the Isaac Skills catalog (NVCARPS).agents/skills/and.claude/skillsdiscovery aliases for agent auto-discoveryskills-check.ymlCI gate running SkillEvaluator Tier 1/2A/2B/3 on every PR touchingskills/**tools/skills/cli.pylocal validator with 27 regression testsdeveloper-audience skills; scopeslicense/metadata.authortouser-audience onlySkills added
isaaclab-building-environmentsisaaclab-converting-direct-to-managerisaaclab-debugging-rl-trainingisaaclab-diagnosing-joint-posesisaaclab-migrating-from-isaac-gymisaaclab-planning-manipulation-tasksisaaclab-preparing-assets-for-newtonisaaclab-randomizing-with-eventsisaaclab-selecting-backendsisaaclab-training-multi-gpuisaaclab-training-rl-agentsisaaclab-using-presetsisaaclab-using-sensors-actuatorscoding-stylechangelog-fragmentspr-workflowinstallsetup-troubleshootingmigrate-2x-to-3xTest plan
python3 tools/skills/cli.py checkpasses all 23 skills locallytools/skills/test/)check-skillsjob passesvalidate-skillsjob passes (requires NVIDIA internal network for SkillEvaluator)