[CI] Publish the kit-less image from the nightly cron

[hujc7]

1. Summary

• Adds an image dimension to the nightly publish matrix so docker/Dockerfile.kitless is built and pushed alongside docker/Dockerfile.base.
• Both images share the isaaclab_image_name repository and are distinguished by a -kitless tag suffix, so no registry-side provisioning is required.
• Base image tags, platforms and build arguments are unchanged, verified by simulating every branch x image combination.
• One file, +30 / -8.

2. Background

The kit-less container landed on develop in #6355 — "[Newton] Add a kitless training container". That PR builds and validates the image in kitless-docker.yml, but publishing is owned by this workflow, which only ever built Dockerfile.base. As a result no kit-less image reaches the registry.

Scheduled workflows run only from the default branch, which is release/3.0.0-beta2 — every nightly since 2026-07-26 has run from it — so this change belongs here rather than on main.

3. Design

• CRON_BRANCHES is unchanged; the matrix cross-product is branch x image.
• The kit-less leg pins linux/amd64. ubuntu:24.04 is multi-arch and ovrtx ships an aarch64 wheel, but no arm64 GPU runner validates that build, so the published manifest is limited to the architecture CI exercises.
• A Dockerfile-existence guard lets a branch cut before an image was introduced skip it instead of failing the run. This is required because Dockerfile.kitless does not exist on this branch or on older releases.
• concurrency.group gains the image key. Without it the two legs share a group under cancel-in-progress: true and cancel each other.
• DOCKER_USER_HOME_ARG moves into the matrix (/root for base, /home/isaaclab for kit-less) so the published image matches its Compose profile. The ISAACSIM_* arguments stay inline because strategy.matrix cannot reference the steps context that supplies them.

4. Test plan

• Simulated the build step across develop, release/3.0.0-beta2 and main x both images with a stubbed docker; confirmed tags, platforms, Dockerfile and DOCKER_USER_HOME_ARG per leg, and that base output is identical to today.
• Verified main is still skipped by both legs, as before.
• uv run isaaclab -f on all files.
• First real publish is the next nightly run after merge.

[greptile-apps]

Greptile Summary

Adds kit-less image publication to the nightly container workflow.

• Expands the build matrix across branches and base/kit-less image variants.
• Uses image-specific Dockerfiles, tags, platforms, home-directory arguments, cache scopes, and concurrency groups.
• Gracefully skips image variants whose Dockerfile is absent from the checked-out branch.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete blocking or non-blocking defects identified in the changed workflow.

The matrix values produce valid per-image build commands, isolate concurrent and cached image variants, and intentionally skip branches that do not contain the selected Dockerfile.

Important Files Changed

Filename	Overview
.github/workflows/publish-images.yaml	Adds a branch-by-image publication matrix while preserving base-image behavior and isolating kit-less tags, platforms, caches, and concurrency.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Resolve nightly branches] --> B{Branch × image matrix}
    B --> C[Check out matrix branch]
    C --> D{Selected Dockerfile exists?}
    D -->|No| E[Skip image leg successfully]
    D -->|Yes| F[Generate image-specific tags]
    F --> G{Explicit platforms configured?}
    G -->|Yes| H[Use configured platforms]
    G -->|No| I[Detect base-image architectures]
    H --> J[Build and push image]
    I --> J

Loading

_{Reviews (1): Last reviewed commit: "Publish the kit-less image from the nigh..." | Re-trigger Greptile}

[isaaclab-review-bot]

Isaac Lab Review Bot

Reviewed the new branch-by-image publish matrix and traced base and kitless behavior through checkout, skip guards, tag generation, platform selection, caching, and push execution. Existing base image publication behavior is preserved while kitless images receive distinct suffixed tags.

• Design and architecture: The per-image matrix metadata is a coherent extension of the branch matrix. Including the image key in concurrency groups and cache scopes prevents cross-image cancellation and cache collisions. Missing Dockerfiles on older branches are handled after checkout by cleanly skipping the affected leg.
• API: No Python, CLI, or public package API changes are introduced. Existing base image tags remain unchanged, while kitless moving and immutable tags use a non-colliding -kitless suffix. No package changelog fragment is required for this CI-only change.
• Implementation: Tag construction, immutable-tag skip behavior, Dockerfile selection, per-image home arguments, and explicit amd64 platform selection for kitless are internally consistent. The missing-Dockerfile guard executes only after setup and registry login, which adds some overhead for skipped legs but does not affect correctness. The base-oriented tagging comment could be expanded for kitless, but its current wording does not create a material implementation defect.

No blocking issues. No inline issue met the actionable-evidence threshold; the assessment above records the review feedback.

Automated review; human maintainers own approval decisions.