Enable mgpu in FrameView classes

.github/PULL_REQUEST_TEMPLATE.md

@@ -47,7 +47,7 @@ To upload images to a PR -- simply drag and drop an image while in edit mode and
 - [ ] I have made corresponding changes to the documentation
 - [ ] My changes generate no new warnings
 - [ ] I have added tests that prove my fix is effective or that my feature works
-- [ ] I have updated the changelog and the corresponding version in the extension's `config/extension.toml` file
+- [ ] I have added a changelog fragment under `source/<pkg>/changelog.d/` for every touched package (do **not** edit `CHANGELOG.rst` or bump `extension.toml` — CI handles that)
 - [ ] I have added my name to the `CONTRIBUTORS.md` or my name already exists there
 
 <!--

.github/actions/run-tests/action.yml

@@ -85,6 +85,7 @@ runs:
           local logs_pid=""
           local wait_pid=""
           local docker_wait_file="/tmp/.docker_exit_${container_name}"
+          local docker_runtime_dir=""
 
           # Kill the container immediately if the runner is cancelled.
           # The GitHub Actions runner can deliver HUP, INT, or TERM on cancellation
@@ -94,6 +95,7 @@ runs:
                 docker kill '${container_name}' 2>/dev/null || true; \
                 docker rm -f '${container_name}' 2>/dev/null || true; \
                 rm -f '${docker_wait_file}'; \
+                if [ -n \"\$docker_runtime_dir\" ]; then rm -rf \"\$docker_runtime_dir\" 2>/dev/null || true; fi; \
                 if [ -n \"\$logs_pid\" ]; then kill \"\$logs_pid\" 2>/dev/null || true; fi; \
                 if [ -n \"\$wait_pid\" ]; then kill \"\$wait_pid\" 2>/dev/null || true; fi; \
                 exit 130" HUP INT TERM
@@ -180,16 +182,56 @@ runs:
             docker_env_vars="$docker_env_vars -e TEST_EXTRA_PIP_PACKAGES"
           fi
 
-          echo "Docker environment variables: '$docker_env_vars'"
-
           # Volume mount for deps-cache-hit mode: bind-mount the checked-out
           # source code over /workspace/isaaclab instead of baking it into the image.
           docker_volume_args=""
+          docker_user_args=""
           if [ -n "$volume_mount_source" ]; then
-            docker_volume_args="-v ${volume_mount_source}:/workspace/isaaclab"
+            host_uid="$(id -u)"
+            host_gid="$(id -g)"
+            host_user="$(id -un)"
+            # Kit writes generated cache, config, data, and log files outside
+            # the Isaac Lab source tree. Provide writable runtime storage for
+            # host-uid test runs, mirroring the compose/singularity mounts.
+            docker_runtime_dir="$(mktemp -d "${RUNNER_TEMP:-/tmp}/isaaclab-docker-runtime.XXXXXX")"
+            mkdir -p \
+              "${docker_runtime_dir}/home/.cache" \
+              "${docker_runtime_dir}/home/.local/share/ov/data" \
+              "${docker_runtime_dir}/home/.local/share/ov/pkg" \
+              "${docker_runtime_dir}/home/.nv/ComputeCache" \
+              "${docker_runtime_dir}/home/.nvidia-omniverse/config" \
+              "${docker_runtime_dir}/home/.nvidia-omniverse/logs" \
+              "${docker_runtime_dir}/home/Documents/Kit/shared" \
+              "${docker_runtime_dir}/isaac-sim/kit/cache" \
+              "${docker_runtime_dir}/isaac-sim/kit/data" \
+              "${docker_runtime_dir}/isaac-sim/kit/logs" \
+              "${docker_runtime_dir}/isaac-sim/cache" \
+              "${docker_runtime_dir}/isaac-sim/computecache" \
+              "${docker_runtime_dir}/isaac-sim/config" \
+              "${docker_runtime_dir}/isaac-sim/data" \
+              "${docker_runtime_dir}/isaac-sim/logs" \
+              "${docker_runtime_dir}/isaac-sim/pkg"
+            docker_volume_args="\
+              -v ${volume_mount_source}:/workspace/isaaclab:rw \
+              -v ${docker_runtime_dir}/home:/tmp/isaaclab-ci-home:rw \
+              -v ${docker_runtime_dir}/isaac-sim/kit/cache:/isaac-sim/kit/cache:rw \
+              -v ${docker_runtime_dir}/isaac-sim/kit/data:/isaac-sim/kit/data:rw \
+              -v ${docker_runtime_dir}/isaac-sim/kit/logs:/isaac-sim/kit/logs:rw \
+              -v ${docker_runtime_dir}/isaac-sim/cache:/isaac-sim/.cache:rw \
+              -v ${docker_runtime_dir}/isaac-sim/computecache:/isaac-sim/.nv/ComputeCache:rw \
+              -v ${docker_runtime_dir}/isaac-sim/config:/isaac-sim/.nvidia-omniverse/config:rw \
+              -v ${docker_runtime_dir}/isaac-sim/data:/isaac-sim/.local/share/ov/data:rw \
+              -v ${docker_runtime_dir}/isaac-sim/logs:/isaac-sim/.nvidia-omniverse/logs:rw \
+              -v ${docker_runtime_dir}/isaac-sim/pkg:/isaac-sim/.local/share/ov/pkg:rw"
+            docker_user_args="--user ${host_uid}:${host_gid}"
+            docker_env_vars="$docker_env_vars -e HOME=/tmp/isaaclab-ci-home -e XDG_CACHE_HOME=/tmp/isaaclab-ci-home/.cache -e XDG_DATA_HOME=/tmp/isaaclab-ci-home/.local/share -e USER=${host_user} -e LOGNAME=${host_user}"
             echo "🔵 Volume-mounting ${volume_mount_source} >> /workspace/isaaclab"
+            echo "🔵 Mounting writable Docker runtime storage from ${docker_runtime_dir}"
+            echo "🔵 Running volume-mounted container as host uid:gid ${host_uid}:${host_gid} (${host_user})"
           fi
 
+          echo "Docker environment variables: '$docker_env_vars'"
+
           # Run tests in a detached container and follow logs.  Running detached
           # means the container lifecycle is independent of the shell - if the
           # runner kills this step on cancellation, the `if: always()` cleanup
@@ -206,6 +248,7 @@ runs:
             --ulimit nofile=65536:65536 \
             --ulimit nproc=4096:4096 \
             $docker_volume_args \
+            $docker_user_args \
             $docker_env_vars \
             $image_tag \
             -c "
@@ -214,9 +257,19 @@ runs:
               mkdir -p tests
               rm _isaac_sim || true
               ln -s /isaac-sim _isaac_sim
+              # Allow OmniHub to start in the test container. Some base images
+              # set this detect-only flag, which makes cold asset downloads
+              # fall back to slow repeated retries.
+              unset HUB__ARGS__DETECT_ONLY
               if [ -n \"\${TEST_EXTRA_PIP_PACKAGES:-}\" ]; then
                 echo \"Installing extra pip packages: \${TEST_EXTRA_PIP_PACKAGES}\"
                 ./isaaclab.sh -p -m pip install \${TEST_EXTRA_PIP_PACKAGES}
+                case \" \${TEST_EXTRA_PIP_PACKAGES} \" in
+                  *\" leapp\"*)
+                    echo \"Resolved LEAPP package:\"
+                    ./isaaclab.sh -p -m pip show leapp || true
+                    ;;
+                esac
               fi
               echo 'Starting pytest with path: $test_path'
               ./isaaclab.sh -p -m pytest --ignore=tools/conftest.py --ignore=source/isaaclab/test/install_ci $test_path $pytest_options -v --junitxml=tests/$result_file
@@ -308,6 +361,9 @@ runs:
           # Clean up container
           echo "🔵 Cleaning up Docker container..."
           docker rm $container_name 2>/dev/null || echo "🟠 Container cleanup failed, but continuing..."
+          if [ -n "$docker_runtime_dir" ]; then
+            rm -rf "$docker_runtime_dir" || echo "🟠 Docker runtime storage cleanup failed, but continuing..."
+          fi
 
           return $DOCKER_EXIT
         }

.github/workflows/build.yaml

@@ -101,17 +101,17 @@ jobs:
           $'^\\.github/workflows/config\\.yaml$\tBase image config'
           $'^\\.github/actions/\tCI actions'
         )
-        triggered_jobs="Docker build + all test-* matrix jobs"
+        triggered_jobs="Docker build + non-root verify jobs + all test-* matrix jobs"
 
         render_table() {
           local files="$1" entry regex desc count sample
           echo "| Pattern | What it covers | Matched files |"
           echo "|---|---|---|"
           for entry in "${patterns[@]}"; do
             IFS=$'\t' read -r regex desc <<< "$entry"
-            count=$(printf '%s\n' "$files" | grep -cE "$regex" || true)
+            count=$(grep -cE "$regex" <<< "$files" || true)
             if [ "$count" -gt 0 ]; then
-              sample=$(printf '%s\n' "$files" | grep -E "$regex" | head -3 | paste -sd ', ' -)
+              sample=$(grep -m 3 -E "$regex" <<< "$files" | paste -sd ', ' -)
               [ "$count" -gt 3 ] && sample="$sample (and $((count - 3)) more)"
               echo "| \`$regex\` | $desc | $sample |"
             else
@@ -124,7 +124,7 @@ jobs:
           local files="$1" entry regex
           for entry in "${patterns[@]}"; do
             IFS=$'\t' read -r regex _ <<< "$entry"
-            if printf '%s\n' "$files" | grep -qE "$regex"; then
+            if grep -qE "$regex" <<< "$files"; then
               return 0
             fi
           done
@@ -215,6 +215,51 @@ jobs:
         dockerfile-path: docker/Dockerfile.base
         cache-tag: cache-base
 
+  verify-base-non-root:
+    name: verify-base-non-root
+    runs-on: [self-hosted, gpu]
+    timeout-minutes: 30
+    needs: [build, config]
+    if: needs.build.result == 'success'
+    steps:
+    - name: Checkout Code
+      uses: actions/checkout@v6
+      with:
+        fetch-depth: 1
+        lfs: true
+
+    - name: Pull Base Docker image
+      uses: ./.github/actions/ecr-build-push-pull
+      with:
+        image-tag: ${{ env.CI_IMAGE_TAG }}
+        isaacsim-base-image: ${{ needs.config.outputs.isaacsim_image_name }}
+        isaacsim-version: ${{ needs.config.outputs.isaacsim_image_tag }}
+        dockerfile-path: docker/Dockerfile.base
+        cache-tag: cache-base
+
+    - name: Run Dockerfile non-root regression test
+      shell: bash
+      run: |
+        set -euo pipefail
+        docker run --rm \
+          -v "$PWD":/workspace/isaaclab \
+          --entrypoint bash \
+          "${{ env.CI_IMAGE_TAG }}" \
+          -lc 'cd /workspace/isaaclab && /isaac-sim/python.sh -m pytest docker/test/test_dockerfile_nonroot.py -q'
+
+    - name: Verify Base runtime user is non-root
+      shell: bash
+      run: |
+        set -euo pipefail
+        runtime_identity="$(docker run --rm --entrypoint bash "${{ env.CI_IMAGE_TAG }}" \
+          -lc 'printf "%s %s %s\n" "$(id -u)" "$(id -g)" "$(id -un 2>/dev/null || true)"')"
+        read -r runtime_uid runtime_gid runtime_user <<< "${runtime_identity}"
+        echo "Base runtime identity: uid=${runtime_uid} gid=${runtime_gid} user=${runtime_user}"
+        if [ "${runtime_uid}" = "0" ]; then
+          echo "::error::Base Docker image must not run as root by default."
+          exit 1
+        fi
+
   build-curobo:
     name: Build cuRobo Docker Image
     runs-on: [self-hosted, gpu]
@@ -235,6 +280,51 @@ jobs:
         isaacsim-version: ${{ needs.config.outputs.isaacsim_image_tag }}
         dockerfile-path: docker/Dockerfile.curobo
         cache-tag: cache-curobo
+
+  verify-curobo-non-root:
+    name: verify-curobo-non-root
+    runs-on: [self-hosted, gpu]
+    timeout-minutes: 30
+    needs: [build-curobo, config]
+    if: needs.build-curobo.result == 'success'
+    steps:
+    - name: Checkout Code
+      uses: actions/checkout@v6
+      with:
+        fetch-depth: 1
+        lfs: true
+
+    - name: Pull cuRobo Docker image
+      uses: ./.github/actions/ecr-build-push-pull
+      with:
+        image-tag: ${{ env.CI_IMAGE_TAG }}-curobo
+        isaacsim-base-image: ${{ needs.config.outputs.isaacsim_image_name }}
+        isaacsim-version: ${{ needs.config.outputs.isaacsim_image_tag }}
+        dockerfile-path: docker/Dockerfile.curobo
+        cache-tag: cache-curobo
+
+    - name: Run Dockerfile non-root regression test
+      shell: bash
+      run: |
+        set -euo pipefail
+        docker run --rm \
+          -v "$PWD":/workspace/isaaclab \
+          --entrypoint bash \
+          "${{ env.CI_IMAGE_TAG }}-curobo" \
+          -lc 'cd /workspace/isaaclab && /isaac-sim/python.sh -m pytest docker/test/test_dockerfile_nonroot.py -q'
+
+    - name: Verify cuRobo runtime user is non-root
+      shell: bash
+      run: |
+        set -euo pipefail
+        runtime_identity="$(docker run --rm --entrypoint bash "${{ env.CI_IMAGE_TAG }}-curobo" \
+          -lc 'printf "%s %s %s\n" "$(id -u)" "$(id -g)" "$(id -un 2>/dev/null || true)"')"
+        read -r runtime_uid runtime_gid runtime_user <<< "${runtime_identity}"
+        echo "cuRobo runtime identity: uid=${runtime_uid} gid=${runtime_gid} user=${runtime_user}"
+        if [ "${runtime_uid}" = "0" ]; then
+          echo "::error::cuRobo Docker image must not run as root by default."
+          exit 1
+        fi
   #endregion
 
   #region test jobs
@@ -603,6 +693,49 @@ jobs:
         filter-pattern: "isaaclab_tasks"
         include-files: "test_environments_training.py"
         container-name: isaac-lab-environments-training-test
+
+  test-rendering-correctness:
+    name: "rendering-correctness"
+    runs-on: [self-hosted, gpu]
+    timeout-minutes: 120
+    continue-on-error: true
+    needs: [build, config]
+    if: needs.build.result == 'success'
+    steps:
+    - uses: actions/checkout@v6
+      with:
+        fetch-depth: 1
+        lfs: true
+    - uses: ./.github/actions/run-package-tests
+      with:
+        image-tag: ${{ env.CI_IMAGE_TAG }}
+        isaacsim-base-image: ${{ needs.config.outputs.isaacsim_image_name }}
+        isaacsim-version: ${{ needs.config.outputs.isaacsim_image_tag }}
+        filter-pattern: "isaaclab_tasks"
+        include-files: "test_rendering_cartpole.py,test_rendering_dexsuite_kuka.py,test_rendering_registered_tasks.py,test_rendering_shadow_hand.py"
+        container-name: isaac-lab-rendering-correctness-test
+
+  test-rendering-correctness-kitless:
+    name: "rendering-correctness-kitless"
+    runs-on: [self-hosted, gpu]
+    timeout-minutes: 120
+    continue-on-error: true
+    needs: [build, config]
+    if: needs.build.result == 'success'
+    steps:
+    - uses: actions/checkout@v6
+      with:
+        fetch-depth: 1
+        lfs: true
+    - uses: ./.github/actions/run-package-tests
+      with:
+        image-tag: ${{ env.CI_IMAGE_TAG }}
+        isaacsim-base-image: ${{ needs.config.outputs.isaacsim_image_name }}
+        isaacsim-version: ${{ needs.config.outputs.isaacsim_image_tag }}
+        filter-pattern: "isaaclab_tasks"
+        extra-pip-packages: "ovrtx"
+        include-files: "test_rendering_cartpole_kitless.py,test_rendering_dexsuite_kuka_kitless.py,test_rendering_shadow_hand_kitless.py"
+        container-name: isaac-lab-rendering-correctness-kitless-test
   #endregion
 
 #region disabled quarantined tests

.github/workflows/config.yaml

@@ -6,5 +6,5 @@
 # Shared image config for CI workflows. Loaded by the `config` job in each
 # workflow via yq and exposed as job outputs (see e.g. .github/workflows/build.yaml).
 isaacsim_image_name: nvcr.io/nvidian/isaac-sim
-isaacsim_image_tag: latest-develop
+isaacsim_image_tag: latest-develop@sha256:0dd49a1121b297dc85eee7777a9c528318683dbe03b29fd01f2059ac1b099301
 isaaclab_image_name: nvcr.io/nvidian/isaac-lab

.github/workflows/daily-compatibility.yml

@@ -111,6 +111,7 @@ jobs:
         image-tag: ${{ env.DOCKER_IMAGE_TAG }}
         pytest-options: ""
         filter-pattern: "isaaclab_tasks"
+        extra-pip-packages: "ovrtx"
 
     - name: Copy All Test Results from IsaacLab Tasks Container
       run: |

.github/workflows/install-ci.yml

@@ -68,9 +68,9 @@ jobs:
             echo "|---|---|---|"
             for entry in "${patterns[@]}"; do
               IFS=$'\t' read -r regex desc <<< "$entry"
-              count=$(printf '%s\n' "$files" | grep -cE "$regex" || true)
+              count=$(grep -cE "$regex" <<< "$files" || true)
               if [ "$count" -gt 0 ]; then
-                sample=$(printf '%s\n' "$files" | grep -E "$regex" | head -3 | paste -sd ', ' -)
+                sample=$(grep -m 3 -E "$regex" <<< "$files" | paste -sd ', ' -)
                 [ "$count" -gt 3 ] && sample="$sample (and $((count - 3)) more)"
                 echo "| \`$regex\` | $desc | $sample |"
               else
@@ -83,7 +83,7 @@ jobs:
             local files="$1" entry regex
             for entry in "${patterns[@]}"; do
               IFS=$'\t' read -r regex _ <<< "$entry"
-              if printf '%s\n' "$files" | grep -qE "$regex"; then
+              if grep -qE "$regex" <<< "$files"; then
                 return 0
               fi
             done
@@ -132,24 +132,52 @@ jobs:
           fi
 
   install-tests:
-    name: Installation Tests
+    name: Installation Tests (uv)
     needs: [changes]
     if: needs.changes.outputs.run_install_tests == 'true'
     runs-on: [self-hosted, gpu]
     timeout-minutes: 90
     steps:
       - name: Checkout
         uses: actions/checkout@v6  # v6
-      - name: Run installation tests
+      - name: Run installation tests (uv)
         env:
           BASE_IMAGE: ${{ github.event_name == 'workflow_dispatch' && inputs.base_image || 'ubuntu:24.04' }}
           TEST_FILTER: ${{ github.event_name == 'workflow_dispatch' && inputs.test_filter || '' }}
         run: |
           RUNNER_ARGS="--base-image $BASE_IMAGE"
           RUNNER_ARGS="$RUNNER_ARGS --results-dir ${{ github.workspace }}/results"
           RUNNER_ARGS="$RUNNER_ARGS --gpu"
+          RUNNER_ARGS="$RUNNER_ARGS --no-cache"
 
-          PYTEST_EXTRA_ARGS=(-sv)
+          PYTEST_EXTRA_ARGS=(-sv -m uv)
+          if [ -n "$TEST_FILTER" ]; then
+            PYTEST_EXTRA_ARGS+=(-k "$TEST_FILTER")
+          fi
+
+          tools/run_install_ci.py docker $RUNNER_ARGS -- --tb=short "${PYTEST_EXTRA_ARGS[@]}"
+
+  install-tests-conda:
+    name: Installation Tests (conda)
+    needs: [changes]
+    if: needs.changes.outputs.run_install_tests == 'true'
+    runs-on: [self-hosted, gpu]
+    timeout-minutes: 150
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6  # v6
+      - name: Run installation tests (conda)
+        env:
+          BASE_IMAGE: ${{ github.event_name == 'workflow_dispatch' && inputs.base_image || 'ubuntu:24.04' }}
+          TEST_FILTER: ${{ github.event_name == 'workflow_dispatch' && inputs.test_filter || '' }}
+        run: |
+          RUNNER_ARGS="--base-image $BASE_IMAGE"
+          RUNNER_ARGS="$RUNNER_ARGS --results-dir ${{ github.workspace }}/results-conda"
+          RUNNER_ARGS="$RUNNER_ARGS --gpu"
+          RUNNER_ARGS="$RUNNER_ARGS --conda"
+          RUNNER_ARGS="$RUNNER_ARGS --no-cache"
+
+          PYTEST_EXTRA_ARGS=(-sv -m conda)
           if [ -n "$TEST_FILTER" ]; then
             PYTEST_EXTRA_ARGS+=(-k "$TEST_FILTER")
           fi