[WIP] Add cloner support to newton model builder in SDP

.github/actions/docker-build/action.yml

@@ -52,13 +52,18 @@ runs:
           local dockerfile_path="$4"
           local context_path="$5"
 
+          # Skip build if image already exists locally (e.g. built by a prior job on the same runner)
+          if docker image inspect "$image_tag" > /dev/null 2>&1; then
+            echo "Image $image_tag already exists locally, skipping build."
+            return 0
+          fi
+
           echo "Building Docker image: $image_tag"
           echo "Using Dockerfile: $dockerfile_path"
           echo "Build context: $context_path"
 
           # Build Docker image
           docker buildx build --progress=plain --platform linux/amd64 \
-            -t isaac-lab-dev \
             -t $image_tag \
             --build-arg ISAACSIM_BASE_IMAGE_ARG="$isaacsim_base_image" \
             --build-arg ISAACSIM_VERSION_ARG="$isaacsim_version" \
@@ -71,7 +76,8 @@ runs:
             --load $context_path
 
           echo "✅ Docker image built successfully: $image_tag"
-          docker images | grep isaac-lab-dev
+          echo "Current local Docker images:"
+          docker images
         }
 
         # Call the function with provided parameters

.github/actions/ecr-build-push-pull/README.md

@@ -0,0 +1,24 @@
+# ecr-build-push-pull
+
+Builds a Docker image and pushes it to ECR, or pulls it if the tag already exists.
+ECR is also used as the BuildKit layer cache.
+
+## Usage
+
+```yaml
+- uses: ./.github/actions/ecr-build-push-pull
+  with:
+    image-tag: ${{ env.DOCKER_IMAGE_TAG }}
+    isaacsim-base-image: nvcr.io/nvidia/isaac-sim
+    isaacsim-version: 6.0.0
+    dockerfile-path: docker/Dockerfile.base
+    cache-tag: cache-base
+    ecr-url: (optional, complete url for ECR storage)
+```
+
+## ECR URL resolution order
+
+1. `ecr-url` input
+2. `ECR_CACHE_URL` environment variable on the runner
+3. SSM parameter `/github-runner/<instance-id>/ecr-cache-url`
+4. If none resolve, ECR is skipped and the image is built locally

.github/actions/ecr-build-push-pull/action.yml

@@ -0,0 +1,195 @@
+# Copyright (c) 2022-2026, The Isaac Lab Project Developers (https://github.com/isaac-sim/IsaacLab/blob/main/CONTRIBUTORS.md).
+# All rights reserved.
+#
+# SPDX-License-Identifier: BSD-3-Clause
+
+name: 'ECR Build-Push-Pull'
+description: >
+  Builds a Docker image and pushes it to ECR, using ECR as the layer cache.
+  If the image already exists in ECR (same tag), pulls it instead of building.
+  Drop-in replacement for docker-build/action.yml with ECR-backed caching.
+
+inputs:
+  image-tag:
+    description: 'Tag for the Docker image (e.g. my-image:latest).'
+    required: true
+  isaacsim-base-image:
+    description: 'IsaacSim base image (passed as ISAACSIM_BASE_IMAGE_ARG build-arg).'
+    required: true
+  isaacsim-version:
+    description: 'IsaacSim version (passed as ISAACSIM_VERSION_ARG build-arg).'
+    required: true
+  dockerfile-path:
+    description: 'Path to Dockerfile, relative to the repository root'
+    default: 'docker/Dockerfile.base'
+    required: false
+  ecr-url:
+    description: >
+      ECR repository URL (e.g. "123456789.dkr.ecr.us-west-2.amazonaws.com/my-repo").
+      Resolved in the following order:
+      1. ecr-url input, if provided.
+      2. ECR_CACHE_URL environment variable on the runner.
+      3. SSM parameter /github-runner/<instance-id>/ecr-cache-url.
+      4. If still empty, ECR cache is skipped and the image is built locally.
+    required: false
+    default: ''
+  cache-tag:
+    description: Tag used for the ECR layer cache image (e.g. "cache-base", "cache-curobo").
+    required: false
+    default: 'cache'
+
+runs:
+  using: composite
+  steps:
+    - name: ECR Build, Push, Pull
+      shell: bash
+      env:
+        INPUT_ECR_URL: ${{ inputs.ecr-url }}
+      run: |
+        IMAGE_TAG="${{ inputs.image-tag }}"
+
+        # Prefer explicit input; fall back to ECR_CACHE_URL env var; then SSM
+
+        ECR_URL="${INPUT_ECR_URL:-}"
+
+        if [ -z "${ECR_URL}" ]; then
+          echo "🟢 ecr-url input not set, trying ECR_CACHE_URL env var..."
+          ECR_URL="${ECR_CACHE_URL:-}"
+          if [ -n "${ECR_URL}" ]; then
+            echo "🟢 Using ECR_CACHE_URL env var: ${ECR_URL}"
+          fi
+        fi
+
+        if [ -z "${ECR_URL}" ]; then
+          echo "🟢 ECR_CACHE_URL env var not set, trying SSM..."
+
+          IMDS_TOKEN=$(curl -sf -X PUT "http://169.254.169.254/latest/api/token" \
+            -H "X-aws-ec2-metadata-token-ttl-seconds: 21600") || true
+          INSTANCE_ID=$(curl -sf -H "X-aws-ec2-metadata-token: ${IMDS_TOKEN}" \
+            "http://169.254.169.254/latest/meta-data/instance-id") || true
+          INSTANCE_REGION=$(curl -sf -H "X-aws-ec2-metadata-token: ${IMDS_TOKEN}" \
+            "http://169.254.169.254/latest/meta-data/placement/region") || true
+
+          if [ -n "${INSTANCE_ID}" ]; then
+            ECR_URL=$(aws ssm get-parameter \
+              --name "/github-runner/${INSTANCE_ID}/ecr-cache-url" \
+              --region "${INSTANCE_REGION}" \
+              --query 'Parameter.Value' --output text 2>/dev/null) || ECR_URL=""
+            if [ -n "${ECR_URL}" ]; then
+              echo "🟢 Resolved ECR URL from SSM (/github-runner/${INSTANCE_ID}/ecr-cache-url): ${ECR_URL}"
+            else
+              echo "🟢 SSM parameter not found for instance ${INSTANCE_ID}"
+            fi
+          else
+            echo "🟢 Not running on EC2 or Instance Metadata Service is unavailable, skipping SSM lookup"
+          fi
+        fi
+
+        if [ -z "${ECR_URL}" ]; then
+          echo "🟠 ECR URL cannot be resolved. Building locally."
+        else
+          # Derive registry host and AWS region from the URL
+          REGISTRY=$(echo "${ECR_URL}" | cut -d'/' -f1)
+          AWS_REGION=$(echo "${REGISTRY}" | sed 's/.*\.dkr\.ecr\.\(.*\)\.amazonaws\.com/\1/')
+
+          # Validate ECR URL
+          if [ "${AWS_REGION}" = "${REGISTRY}" ]; then
+            echo "🔴 Invalid ECR URL — cannot extract AWS region: ${ECR_URL}"
+            echo "🔴 Expected format: <account-id>.dkr.ecr.<region>.amazonaws.com/<repo>"
+            exit 1
+          fi
+
+          # Derive ECR image tag by slugifying the local image-tag
+          # (colons/slashes not valid in ECR tags)
+          ECR_TAG=$(echo "${IMAGE_TAG}" | tr ':/' '--')
+          ECR_IMAGE="${ECR_URL}:${ECR_TAG}"
+          CACHE_IMAGE="${ECR_URL}:${{ inputs.cache-tag }}"
+
+          # The runner's credential store is broken ("not implemented"), so use a temp config dir
+          # with credsStore disabled. Copy existing ~/.docker/config.json first to preserve other
+          # registry auths (e.g. nvcr.io), then strip credsStore/credHelpers.
+          #
+          DOCKER_CONFIG_DIR=$(mktemp -d)
+          trap 'rm -rf "${DOCKER_CONFIG_DIR}"' EXIT
+          if [ -f "${HOME}/.docker/config.json" ]; then
+            python3 -c "import json; cfg=json.load(open('${HOME}/.docker/config.json')); cfg['credsStore']=''; cfg.pop('credHelpers',None); json.dump(cfg,open('${DOCKER_CONFIG_DIR}/config.json','w'))"
+          else
+            echo '{"credsStore":""}' > "${DOCKER_CONFIG_DIR}/config.json"
+          fi
+          #
+          # Export so all subsequent docker calls in this job inherit it
+          echo "DOCKER_CONFIG=${DOCKER_CONFIG_DIR}" >> "$GITHUB_ENV"
+          export DOCKER_CONFIG="${DOCKER_CONFIG_DIR}"
+
+          # Login to ECR registry with token provided by aws cli
+          echo "🟢 Logging into ECR registry..."
+          aws ecr get-login-password --region "${AWS_REGION}" | \
+            docker login --username AWS --password-stdin "${REGISTRY}"
+
+          # Try pulling the exact image from ECR to skip the build
+          echo "🟢 Checking for existing image ${ECR_IMAGE} in ECR..."
+          PULL_OUTPUT=$(docker pull "${ECR_IMAGE}" 2>&1) && {
+            echo "🟢 Image found in ECR, pulled: ${ECR_IMAGE}"
+            docker tag "${ECR_IMAGE}" "${IMAGE_TAG}"
+            echo "🟢 Tagged as: ${IMAGE_TAG} — skipping build."
+            exit 0
+          } || {
+            echo "🟠 Image can't be pulled from ECR, will build locally:"
+            echo -e "\e[90m${PULL_OUTPUT}\e[0m"
+          }
+        fi
+
+        # Log into nvcr.io so the Dockerfile can pull nvcr.io base images.
+        # Credential is written into the temp config dir when ECR is enabled,
+        # and into the default config when it is not.
+        if [ -n "${{ env.NGC_API_KEY }}" ]; then
+          echo "🟢 Logging into nvcr.io..."
+          docker login -u \$oauthtoken -p ${{ env.NGC_API_KEY }} nvcr.io
+        else
+          echo "🟠 NGC_API_KEY not set — skipping nvcr.io login (normal for fork PRs)"
+        fi
+
+        # Build the image
+
+        BUILD_ARGS=(
+          --progress=plain
+          --platform linux/amd64
+          -f "${{ inputs.dockerfile-path }}"
+          --build-arg "ISAACSIM_BASE_IMAGE_ARG=${{ inputs.isaacsim-base-image }}"
+          --build-arg "ISAACSIM_VERSION_ARG=${{ inputs.isaacsim-version }}"
+          --build-arg "ISAACSIM_ROOT_PATH_ARG=/isaac-sim"
+          --build-arg "ISAACLAB_PATH_ARG=/workspace/isaaclab"
+          --build-arg "DOCKER_USER_HOME_ARG=/root"
+          -t "${IMAGE_TAG}"
+        )
+
+        # Add ECR layer caching
+        if [ -n "${ECR_URL}" ]; then
+          BUILD_ARGS+=(
+            --cache-from "type=registry,ref=${CACHE_IMAGE}"
+            --cache-to "type=registry,ref=${CACHE_IMAGE},mode=max"
+            -t "${ECR_IMAGE}"
+          )
+        fi
+
+        # Set up buildx builder with docker-container driver (required for registry cache export).
+        BUILDER_NAME="ci-builder-${{ github.run_id }}-${{ github.job }}"
+
+        # Create builder (or fall back to reusing existing one on workflow re-runs)
+        docker buildx create --use --driver docker-container --name "${BUILDER_NAME}" \
+          || docker buildx use "${BUILDER_NAME}"
+
+        echo "🟢 Building ${IMAGE_TAG}..."
+        docker buildx build --load "${BUILD_ARGS[@]}" .
+
+        # Clean up builder
+        docker buildx rm "${BUILDER_NAME}" || true
+
+        echo "🟢 Build completed for ${IMAGE_TAG}, pushing to ECR..."
+
+        if [ -n "${ECR_URL}" ]; then
+          docker push "${ECR_IMAGE}"
+          echo "🟢 Pushed ${ECR_IMAGE} to ECR"
+        fi
+
+        echo "🟢 Image ${IMAGE_TAG} is ready!"

.github/actions/run-tests/action.yml

@@ -156,11 +156,11 @@ runs:
           # Copy test results with error handling
           echo "📋 Attempting to copy test results..."
           if docker cp $container_name:/workspace/isaaclab/tests/$result_file "$reports_dir/$result_file" 2>/dev/null; then
-            echo "✅ Test results copied successfully"
+            echo "✅ Test results copied successfully to $reports_dir/$result_file"
           else
             echo "❌ Failed to copy specific result file, trying to copy all test results..."
             if docker cp $container_name:/workspace/isaaclab/tests/ "$reports_dir/" 2>/dev/null; then
-              echo "✅ All test results copied successfully"
+              echo "✅ All test results copied successfully to $reports_dir/"
               # Look for any XML files and use the first one found
               if [ -f "$reports_dir/full_report.xml" ]; then
                 mv "$reports_dir/full_report.xml" "$reports_dir/$result_file"