ci: build via docker compose + headless sim smoke test

Build job was broken (referenced deleted docker/Dockerfile.agents and fed
Dockerfile.o3de an ignored ROS2_IMAGE build-arg). Replace the hand-maintained
build-push-action chain with 'docker compose build/push ros2 o3de' — the same
ros2->o3de graph devs build locally, so it can't drift. Per-branch tags via
AMM_IMG_SUFFIX (empty locally).

Add a second job (needs: build-and-push) that boots the freshly-built o3de image
headless with O3DE's null renderer (--rhi=null, no GPU/display) and passes iff
/clock ticks — proving the image boots, loads the level, steps physics, and
publishes over ROS 2. Camera/rendered sensors need a DRI3 display and are out of
scope. Logic lives in scripts/sim_smoke.sh (pixi task: sim-smoke).

Author: maciejmajek

.github/workflows/build_and_push_docker.yaml

@@ -7,6 +7,11 @@ on:
       - development
   workflow_dispatch:
 
+# Development builds get a -development image suffix so they never clobber main's
+# :latest. Empty on every other branch. Consumed by docker/compose.yaml image names.
+env:
+  SUFFIX: ${{ github.ref_name == 'development' && '-development' || '' }}
+
 jobs:
   build-and-push:
     runs-on: self-hosted
@@ -20,36 +25,31 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Build and push ROS 2 image
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: docker/Dockerfile.ros2
-          push: true
-          tags: |
-            robotecai/mobile-manipulator-demo-ros2${{ github.ref_name == 'development' && '-development' || '' }}:latest
+      # Build the ros2 -> o3de chain straight from docker/compose.yaml (the same
+      # graph devs build locally, via additional_contexts). Scoped to these two:
+      # `demo` is the heavy GPU+NPU single-PC image, not published here.
+      - name: Build and push base images (ros2, o3de)
+        env:
+          AMM_IMG_SUFFIX: ${{ env.SUFFIX }}
+        run: |
+          docker compose -f docker/compose.yaml build ros2 o3de
+          docker compose -f docker/compose.yaml push ros2 o3de
 
-      - name: Build and push Agents image
-        uses: docker/build-push-action@v6
+  # Headless sim liveness gate. Boots O3DE with the null renderer (no GPU/display)
+  # and passes iff /clock ticks — proves the image actually boots, loads the level,
+  # steps physics, and publishes over ROS 2. See scripts/sim_smoke.sh.
+  smoke-test:
+    needs: build-and-push
+    runs-on: self-hosted
+    steps:
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v3
         with:
-          context: .
-          file: docker/Dockerfile.agents
-          push: true
-          build-args: |
-            ROS2_IMAGE=robotecai/mobile-manipulator-demo-ros2${{ github.ref_name == 'development' && '-development' || '' }}:latest
-          tags: |
-            robotecai/mobile-manipulator-demo-agents${{ github.ref_name == 'development' && '-development' || '' }}:latest
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      - name: Build and push O3DE image
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: docker/Dockerfile.o3de
-          push: true
-          build-args: |
-            ROS2_IMAGE=robotecai/mobile-manipulator-demo-ros2${{ github.ref_name == 'development' && '-development' || '' }}:latest
-          tags: |
-            robotecai/mobile-manipulator-demo-o3de${{ github.ref_name == 'development' && '-development' || '' }}:latest
+      - name: Headless sim smoke test (/clock)
+        run: |
+          IMAGE="robotecai/agentic-mobile-manipulator-o3de${SUFFIX}:latest"
+          docker pull "$IMAGE"
+          docker run --rm --entrypoint pixi "$IMAGE" run sim-smoke

docker/compose.yaml

@@ -28,14 +28,15 @@
 services:
   # ── Base: RoboStack ROS 2 + built workspace ────────────────────────────────
   ros2:
-    image: robotecai/agentic-mobile-manipulator-ros2:latest
+    # AMM_IMG_SUFFIX lets CI publish per-branch tags (e.g. -development); empty locally.
+    image: robotecai/agentic-mobile-manipulator-ros2${AMM_IMG_SUFFIX:-}:latest
     build:
       context: ..
       dockerfile: docker/Dockerfile.ros2
 
   # ── Base: + O3DE SDK and built simulation ──────────────────────────────────
   o3de:
-    image: robotecai/agentic-mobile-manipulator-o3de:latest
+    image: robotecai/agentic-mobile-manipulator-o3de${AMM_IMG_SUFFIX:-}:latest
     build:
       context: ..
       dockerfile: docker/Dockerfile.o3de
@@ -44,7 +45,7 @@ services:
 
   # ── The demo: + agents, local inference engines; runs the whole stack ───────
   demo:
-    image: robotecai/agentic-mobile-manipulator:latest
+    image: robotecai/agentic-mobile-manipulator${AMM_IMG_SUFFIX:-}:latest
     build:
       context: ..
       dockerfile: docker/Dockerfile.demo

pixi.toml

@@ -162,6 +162,10 @@ description = "Launch O3DE simulation in its own tmux session"
 cmd = "$DEMO_ROOT/sim/build/linux/bin/profile/MobileManipulatorDemo.GameLauncher -bg_ConnectToAssetProcessor=0"
 description = "Launch O3DE simulation in the foreground (no tmux)"
 
+[feature.sim.tasks.sim-smoke]
+cmd = "bash scripts/sim_smoke.sh"
+description = "Headless sim smoke test: boot with --rhi=null, pass if /clock ticks (no GPU/display)"
+
 [feature.sim.tasks.editor]
 cmd = "$O3DE_ENGINE_PATH/bin/Linux/profile/Default/Editor --project-path $DEMO_ROOT/sim"
 description = "Launch O3DE Editor from SDK (project must be built first)"

scripts/sim_smoke.sh

@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+# Headless smoke test for the O3DE sim.
+#
+# Boots the GameLauncher with the null renderer (--rhi=null) — no GPU, no X
+# display needed — and passes if the simulation is actually *ticking*, proven by
+# catching a message on /clock within a timeout. That single check exercises the
+# whole cold path: binary runs, assets + level load, PhysX ticks, and the ROS 2
+# bridge publishes.
+#
+# NOT checked: camera / rendered sensors. Those need the Atom (Vulkan) renderer,
+# which headless needs a DRI3-capable display for — Xvfb doesn't provide DRI3, so
+# the GPU+Vulkan path wedges on swapchain creation. rhi=null has no renderer at
+# all, so camera topics are advertised but never publish. Verifying rendered
+# output headless is a separate, unsolved problem; keep it out of the fast gate.
+#
+# Run:        pixi run sim-smoke
+# In Docker:  docker run --rm --entrypoint pixi <o3de-image> run sim-smoke
+# Tune:       SIM_SMOKE_TIMEOUT=120 pixi run sim-smoke
+#             SIM_SMOKE_TOPIC=/joint_states SIM_SMOKE_TYPE=sensor_msgs/msg/JointState pixi run sim-smoke
+set -uo pipefail
+
+# Hermetic: only ever see our own sim on loopback, so a neighbouring sim on a
+# shared CI runner can't cause a false pass.
+export ROS_LOCALHOST_ONLY=1
+
+LAUNCHER="${DEMO_ROOT:-$PWD}/sim/build/linux/bin/profile/MobileManipulatorDemo.GameLauncher"
+TIMEOUT="${SIM_SMOKE_TIMEOUT:-90}"      # boot + first message; rhi=null is faster than Vulkan
+TOPIC="${SIM_SMOKE_TOPIC:-/clock}"
+# Type must be explicit: with no publisher up yet, `ros2 topic echo` can't infer
+# the type from the graph and bails instantly instead of waiting.
+TYPE="${SIM_SMOKE_TYPE:-rosgraph_msgs/msg/Clock}"
+LOG="$(mktemp)"
+
+[ -x "$LAUNCHER" ] || { echo "[FAIL] launcher not built: $LAUNCHER"; exit 1; }
+
+# GameLauncher ignores SIGINT (won't stop on Ctrl+C), so hard-kill on exit.
+# Kill the captured PID, plus a pkill by full command line as a fallback (the
+# comm name isn't reliably set during early boot). pkill -f is safe: this shell's
+# own argv is just "bash scripts/sim_smoke.sh", so it can't match itself.
+LAUNCHER_PID=""
+cleanup() {
+  [ -n "$LAUNCHER_PID" ] && kill -9 "$LAUNCHER_PID" 2>/dev/null
+  pkill -9 -f 'MobileManipulatorDemo.GameLauncher' 2>/dev/null
+}
+trap cleanup EXIT
+
+echo "[smoke] launching sim headless (--rhi=null)"
+env -u DISPLAY "$LAUNCHER" -bg_ConnectToAssetProcessor=0 --rhi=null >"$LOG" 2>&1 &
+LAUNCHER_PID=$!
+
+# /clock is published BEST_EFFORT; a default (reliable) subscriber gets nothing.
+echo "[smoke] waiting up to ${TIMEOUT}s for a message on ${TOPIC} (${TYPE})"
+if timeout "$TIMEOUT" ros2 topic echo --once --qos-reliability best_effort "$TOPIC" "$TYPE" >/dev/null 2>&1; then
+  echo "[PASS] ${TOPIC} is publishing — sim ticks headless"
+  exit 0
+fi
+
+echo "[FAIL] no message on ${TOPIC} within ${TIMEOUT}s"
+echo "----- last 30 log lines -----"
+tail -30 "$LOG"
+exit 1