[pull] develop from isaac-sim:develop

.github/ISSUE_TEMPLATE/bug.md

@@ -31,7 +31,7 @@ Describe the characteristic of your environment:
 
 <!-- Please complete the following description. -->
 - Commit: [e.g. 8f3b9ca]
-- Isaac Sim Version: [e.g. 5.0, this can be obtained by `cat ${ISAACSIM_PATH}/VERSION`]
+- Isaac Sim Version: [e.g. 6.1, this can be obtained by `cat ${ISAACSIM_PATH}/VERSION`]
 - OS: [e.g. Ubuntu 22.04]
 - GPU: [e.g. RTX 5090]
 - CUDA: [e.g. 12.8]

.github/ISSUE_TEMPLATE/proposal.md

@@ -27,7 +27,7 @@ Describe the versions where you are observing the missing feature in:
 
 <!-- Please complete the following description. -->
 - Isaac Lab Version: [e.g. 3.0.0]
-- Isaac Sim Version: [e.g. 6.0, this can be obtained by `cat ${ISAACSIM_PATH}/VERSION`]
+- Isaac Sim Version: [e.g. 6.1, this can be obtained by `cat ${ISAACSIM_PATH}/VERSION`]
 
 ### Additional context
 

.github/ISSUE_TEMPLATE/question.md

@@ -18,4 +18,4 @@ Describe the versions that you are currently using:
 
 <!-- Please complete the following description. -->
 - Isaac Lab Version: [e.g. 3.0.0]
-- Isaac Sim Version: [e.g. 6.0, this can be obtained by `cat ${ISAACSIM_PATH}/VERSION`]
+- Isaac Sim Version: [e.g. 6.1, this can be obtained by `cat ${ISAACSIM_PATH}/VERSION`]

.github/actions/_lib/compute-deps-hash/action.yml

@@ -50,6 +50,7 @@ runs:
           .dockerignore
           docker/docker-compose.yaml
           docker/scripts/install_carb_env_shim.sh
+          docker/scripts/install_git_lfs.sh
           docker/utils/volume_mounts.py
           isaaclab.sh
           environment.yml
@@ -62,16 +63,61 @@ runs:
         deps_manifest_pattern='(setup\.py|pyproject\.toml|setup\.cfg|extension\.toml|requirements[^/]*\.txt|uv\.lock)$'
 
         # Resolve the actual base image digest so a new push of a mutable tag
-        # (e.g. latest-develop) invalidates the deps cache automatically.
-        base_image_digest=$(docker buildx imagetools inspect \
-          "${ISAACSIM_BASE_IMAGE}:${ISAACSIM_VERSION}" \
-          --format '{{json .Manifest.Digest}}' 2>/dev/null | tr -d '"' || true)
-        if [ -n "${base_image_digest}" ]; then
-          base_image_uniq_id="${ISAACSIM_BASE_IMAGE}:${ISAACSIM_VERSION}:${base_image_digest}"
-        else
-          echo "🟠 Could not resolve base image digest, falling back to tag string"
-          base_image_uniq_id="${ISAACSIM_BASE_IMAGE}:${ISAACSIM_VERSION}"
-        fi
+        # (e.g. latest-develop) invalidates the deps cache. A tag that already
+        # carries a digest is its own identity, so it is used directly.
+        case "${ISAACSIM_VERSION}" in
+          *@sha256:*)
+            base_image_digest="${ISAACSIM_VERSION##*@}"
+            if ! printf '%s' "${base_image_digest}" | grep -Eq '^sha256:[0-9a-f]{64}$'; then
+              echo "::error::Base image tag ${ISAACSIM_VERSION} carries a malformed digest pin."
+              exit 1
+            fi
+            echo "🔵 Base image tag is digest-pinned; using it as the cache identity"
+            ;;
+          *)
+            # Reading the manifest can fail transiently, so retry. Failing hard
+            # afterwards is deliberate: falling back to the tag string drops the
+            # digest from the cache key and hides an unreadable manifest until a
+            # later, far less obvious build error. stderr is kept off stdout so
+            # a warning can never be concatenated into the digest.
+            base_image_digest=""
+            inspect_err="$(mktemp)"
+            attempts=5
+            attempt=1
+            while [ "${attempt}" -le "${attempts}" ]; do
+              inspect_out=$(docker buildx imagetools inspect \
+                "${ISAACSIM_BASE_IMAGE}:${ISAACSIM_VERSION}" \
+                --format '{{json .Manifest.Digest}}' 2>"${inspect_err}" || true)
+              candidate=$(printf '%s' "${inspect_out}" | tr -d '"')
+              # A digest is exactly sha256: plus 64 hex characters. Anything
+              # looser lets stray stdout into the cache key, and a stable
+              # diagnostic string would then stop a changed base image from
+              # invalidating it.
+              if printf '%s' "${candidate}" | grep -Eq '^sha256:[0-9a-f]{64}$'; then
+                base_image_digest="${candidate}"
+                break
+              fi
+              echo "🟠 Base image manifest read attempt ${attempt}/${attempts} failed: $(tr '\n' ' ' < "${inspect_err}")"
+              # An authorization refusal will not clear on its own, so stop
+              # retrying and report it as the configuration error it is.
+              if grep -Eqi 'denied|unauthorized|forbidden|insufficient_scope|401|403' "${inspect_err}"; then
+                echo "::error::${ISAACSIM_BASE_IMAGE}:${ISAACSIM_VERSION} cannot be read with the credentials available to this job."
+                rm -f "${inspect_err}"
+                exit 1
+              fi
+              if [ "${attempt}" -lt "${attempts}" ]; then
+                sleep $((attempt * 5))
+              fi
+              attempt=$((attempt + 1))
+            done
+            rm -f "${inspect_err}"
+            if [ -z "${base_image_digest}" ]; then
+              echo "::error::Cannot read the manifest for ${ISAACSIM_BASE_IMAGE}:${ISAACSIM_VERSION} after ${attempts} attempts (see the attempt logs above)."
+              exit 1
+            fi
+            ;;
+        esac
+        base_image_uniq_id="${ISAACSIM_BASE_IMAGE}:${ISAACSIM_VERSION}:${base_image_digest}"
 
         mapfile -t manifest_files < <(git ls-files | grep -E "${deps_manifest_pattern}" || true)
         file_hash=$(git ls-files -s "${deps_files[@]}" "${manifest_files[@]}" 2>/dev/null \

.github/actions/_lib/setup-docker-config/action.yml

@@ -7,37 +7,146 @@ name: 'Setup docker config'
 description: >
   Point DOCKER_CONFIG at a temp config with the credential helper disabled and
   log into nvcr.io. Shared by the docker-build and ecr-build-push-pull actions.
-  Idempotent: re-invoking it in the same job is a no-op, so callers (e.g.
-  ecr-build-push-pull delegating to docker-build) don't need to coordinate.
+  Idempotent: re-invoking it in the same job reuses the existing config, and a
+  base-image-ref already checked in this job is not probed again, so callers
+  (e.g. ecr-build-push-pull delegating to docker-build) don't need to coordinate.
   Reads NGC_API_KEY from the environment (optional; warns when missing).
+  When base-image-ref names an nvcr.io image that the configured credentials are
+  refused, falls back to anonymous access for that registry.
+
+inputs:
+  base-image-ref:
+    description: >
+      Optional "<image>:<tag>" that this job must be able to read. nvcr.io can
+      refuse a credential scoped to another organization a pull token for a
+      public repository instead of downgrading to anonymous, so when the
+      configured credentials are denied this image and anonymous access can read
+      it, the stored nvcr.io credential is dropped from the temp config. Only
+      nvcr.io refs are eligible; empty skips the check.
+    required: false
+    default: ''
 
 runs:
   using: composite
   steps:
     - shell: bash
+      env:
+        BASE_IMAGE_REF: ${{ inputs.base-image-ref }}
+        STRIP_HELPER: ${{ github.action_path }}/strip_registry_auth.py
       run: |
         # The runner's credential helper backend is broken ("not implemented")
         # and causes docker login calls to fail unless we point DOCKER_CONFIG at
         # a temp config with credsStore disabled. The value is written to
         # $GITHUB_ENV so subsequent steps in the job inherit it; a second
-        # invocation sees it already set and short-circuits.
+        # invocation reuses it and only re-runs the base-image check.
         if [ -n "${DOCKER_CONFIG:-}" ] && [ -f "${DOCKER_CONFIG}/config.json" ]; then
-          echo "🟢 Docker config already set up at ${DOCKER_CONFIG}, skipping"
+          echo "🟢 Docker config already set up at ${DOCKER_CONFIG}, keeping it"
+          DOCKER_CONFIG_DIR="${DOCKER_CONFIG}"
+        else
+          DOCKER_CONFIG_DIR=$(mktemp -d)
+          if [ -f "${HOME}/.docker/config.json" ]; then
+            python3 -c "import json; cfg=json.load(open('${HOME}/.docker/config.json')); cfg['credsStore']=''; cfg.pop('credHelpers',None); json.dump(cfg,open('${DOCKER_CONFIG_DIR}/config.json','w'))"
+          else
+            echo '{"credsStore":""}' > "${DOCKER_CONFIG_DIR}/config.json"
+          fi
+          export DOCKER_CONFIG="${DOCKER_CONFIG_DIR}"
+          echo "DOCKER_CONFIG=${DOCKER_CONFIG_DIR}" >> "$GITHUB_ENV"
+          # Mark this directory as ours, so a later invocation only ever edits a
+          # config this action created and never the runner's persistent one.
+          echo "SETUP_DOCKER_CONFIG_OWNED=${DOCKER_CONFIG_DIR}" >> "$GITHUB_ENV"
+          SETUP_DOCKER_CONFIG_OWNED="${DOCKER_CONFIG_DIR}"
+
+          if [ -n "${NGC_API_KEY:-}" ]; then
+            echo "🔵 Logging into nvcr.io..."
+            printf '%s' "${NGC_API_KEY}" | docker login -u '$oauthtoken' --password-stdin nvcr.io
+          else
+            echo "🟠 NGC_API_KEY not set - skipping nvcr.io login (normal for fork PRs)"
+          fi
+        fi
+
+        if [ -z "${BASE_IMAGE_REF:-}" ]; then
           exit 0
         fi
 
-        DOCKER_CONFIG_DIR=$(mktemp -d)
-        if [ -f "${HOME}/.docker/config.json" ]; then
-          python3 -c "import json; cfg=json.load(open('${HOME}/.docker/config.json')); cfg['credsStore']=''; cfg.pop('credHelpers',None); json.dump(cfg,open('${DOCKER_CONFIG_DIR}/config.json','w'))"
-        else
-          echo '{"credsStore":""}' > "${DOCKER_CONFIG_DIR}/config.json"
+        # ecr-build-push-pull delegates to docker-build, so this action can run
+        # twice in one job with the same ref. The probes are network calls with
+        # backoff, and the first run already settled the outcome, so a ref
+        # checked in this job is not probed again.
+        if [ "${SETUP_DOCKER_CONFIG_CHECKED_REF:-}" = "${BASE_IMAGE_REF}" ]; then
+          echo "🟢 ${BASE_IMAGE_REF} was already checked in this job, skipping"
+          exit 0
         fi
-        export DOCKER_CONFIG="${DOCKER_CONFIG_DIR}"
-        echo "DOCKER_CONFIG=${DOCKER_CONFIG_DIR}" >> "$GITHUB_ENV"
+        echo "SETUP_DOCKER_CONFIG_CHECKED_REF=${BASE_IMAGE_REF}" >> "$GITHUB_ENV"
 
-        if [ -n "${NGC_API_KEY:-}" ]; then
-          echo "🔵 Logging into nvcr.io..."
-          docker login -u '$oauthtoken' -p "${NGC_API_KEY}" nvcr.io
-        else
-          echo "🟠 NGC_API_KEY not set - skipping nvcr.io login (normal for fork PRs)"
+        # Scope: only nvcr.io shows the refuse-instead-of-downgrade behaviour.
+        # Other registries (Docker Hub in particular) must keep their
+        # credentials, which also serve as pull-rate-limit budget.
+        base_registry="$(printf '%s' "${BASE_IMAGE_REF%%/*}" | tr '[:upper:]' '[:lower:]')"
+        case "${BASE_IMAGE_REF}" in
+          */*) ;;
+          *) base_registry="" ;;
+        esac
+        case "${base_registry%%:*}" in
+          nvcr.io) ;;
+          *)
+            echo "🔵 ${BASE_IMAGE_REF} is not an nvcr.io image; leaving the docker config unchanged"
+            exit 0
+            ;;
+        esac
+
+        if [ "${SETUP_DOCKER_CONFIG_OWNED:-}" != "${DOCKER_CONFIG_DIR}" ]; then
+          echo "🔵 ${DOCKER_CONFIG_DIR} was not created by this action; leaving it unchanged"
+          exit 0
+        fi
+
+        # One transient error must not cost a working credential, so retry and
+        # keep stderr: only an authorization refusal justifies dropping it.
+        probe_err="$(mktemp)"
+        trap 'rm -f "${probe_err}"' EXIT
+        creds_denied=""
+        for attempt in 1 2 3; do
+          if docker buildx imagetools inspect "${BASE_IMAGE_REF}" >/dev/null 2>"${probe_err}"; then
+            echo "🟢 Configured credentials can read ${BASE_IMAGE_REF}"
+            exit 0
+          fi
+          if grep -Eqi 'denied|unauthorized|forbidden|insufficient_scope|401|403' "${probe_err}"; then
+            creds_denied="yes"
+            break
+          fi
+          echo "🟠 Base image read attempt ${attempt}/3 failed for a non-authorization reason: $(tr '\n' ' ' < "${probe_err}")"
+          [ "${attempt}" -lt 3 ] && sleep $((attempt * 5))
+        done
+
+        if [ -z "${creds_denied}" ]; then
+          echo "::warning::${BASE_IMAGE_REF} could not be read and the failure does not look like an authorization refusal; leaving the docker config unchanged"
+          exit 0
+        fi
+
+        anon_config_dir="$(mktemp -d)"
+        trap 'rm -f "${probe_err}"; rm -rf "${anon_config_dir}"' EXIT
+        echo '{"credsStore":"","auths":{}}' > "${anon_config_dir}/config.json"
+        # Retried like the credentialed probe above: a transient failure here
+        # would otherwise keep a credential already proven to be denied, and the
+        # build would then fail on the very pull this fallback exists to rescue.
+        anon_readable=""
+        for attempt in 1 2 3; do
+          if DOCKER_CONFIG="${anon_config_dir}" \
+            docker buildx imagetools inspect "${BASE_IMAGE_REF}" >/dev/null 2>"${probe_err}"; then
+            anon_readable="yes"
+            break
+          fi
+          echo "🟠 Anonymous read attempt ${attempt}/3 failed: $(tr '\n' ' ' < "${probe_err}")"
+          if [ "${attempt}" -lt 3 ]; then
+            sleep $((attempt * 5))
+          fi
+        done
+
+        if [ -z "${anon_readable}" ]; then
+          echo "::warning::${BASE_IMAGE_REF} is unreadable with the configured credentials and anonymously; leaving the docker config unchanged"
+          exit 0
+        fi
+
+        echo "🟠 Configured credentials cannot read ${BASE_IMAGE_REF}; using anonymous access for nvcr.io"
+        if ! python3 "${STRIP_HELPER}" "${DOCKER_CONFIG_DIR}/config.json" "${BASE_IMAGE_REF}"; then
+          echo "::warning::Could not drop the stored nvcr.io credential; the build may still fail to read ${BASE_IMAGE_REF}"
         fi

.github/actions/_lib/setup-docker-config/strip_registry_auth.py

@@ -0,0 +1,95 @@
+# Copyright (c) 2022-2026, The Isaac Lab Project Developers (https://github.com/isaac-sim/IsaacLab/blob/main/CONTRIBUTORS.md).
+# All rights reserved.
+#
+# SPDX-License-Identifier: BSD-3-Clause
+
+"""Drop the stored credential for one image's registry from a docker config.
+
+A registry can refuse a credential scoped to another organization a pull token
+for a public repository instead of downgrading the request to anonymous, which
+makes a public base image unreadable. Removing just that registry's entry lets
+the pull proceed anonymously while every other registry in the same config
+keeps working.
+
+Usage: strip_registry_auth.py <config.json> <image-ref>
+Exits 0 when a credential was dropped, 3 when nothing matched.
+"""
+
+from __future__ import annotations
+
+import json
+import sys
+
+# Docker Hub is stored under several spellings; treat them as one registry.
+_HUB_ALIASES = frozenset(
+    {
+        "docker.io",
+        "index.docker.io",
+        "registry-1.docker.io",
+    }
+)
+
+
+def registry_host(image_ref):
+    """Return the canonical registry host for a docker image reference."""
+    first = image_ref.split("/")[0]
+    if "/" in image_ref and ("." in first or ":" in first or first == "localhost"):
+        # A registry may carry a port, and hosts are case-insensitive.
+        host = first.lower().rsplit(":", 1)[0] if ":" in first else first.lower()
+    else:
+        # No registry component means Docker Hub.
+        host = "index.docker.io"
+    if host in _HUB_ALIASES:
+        return "index.docker.io"
+    return host
+
+
+def _normalize(auth_key):
+    """Reduce a config.json auths key to a comparable registry host."""
+    trimmed = auth_key.split("://", 1)[-1]
+    host = trimmed.split("/", 1)[0].lower()
+    if ":" in host:
+        host = host.rsplit(":", 1)[0]
+    if host in _HUB_ALIASES:
+        return "index.docker.io"
+    return host
+
+
+def main(argv):
+    config_path, image_ref = argv[1], argv[2]
+    target = registry_host(image_ref)
+
+    with open(config_path) as handle:
+        config = json.load(handle)
+
+    auths = config.get("auths") or {}
+    removed = sorted(key for key in auths if _normalize(key) == target)
+
+    # A credHelpers entry would re-supply the credential from an external helper
+    # even after its `auths` entry is gone, so the mapping for this registry is
+    # removed too. A credential held only by a global credsStore is outside this
+    # file, which is why the caller treats exit 3 as "nothing was dropped".
+    helpers = config.get("credHelpers") or {}
+    helper_keys = sorted(key for key in helpers if _normalize(key) == target)
+    for key in helper_keys:
+        del helpers[key]
+    if helper_keys:
+        config["credHelpers"] = helpers
+
+    if not removed and not helper_keys:
+        print(f"No stored credential for {target} was found in the docker config")
+        return 3
+
+    for key in removed:
+        del auths[key]
+    config["auths"] = auths
+    with open(config_path, "w") as handle:
+        json.dump(config, handle)
+
+    dropped = ", ".join(removed + helper_keys)
+    print(f"Dropped stored credential(s) for {target}: {dropped}")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv))