hyperframes/.github/workflows/lambda-arm64-image.yml at main · heygen-com/hyperframes · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
name: Lambda arm64 image

permissions:
  contents: read

# Builds the arm64 Lambda video function image: the native ffmpeg on two separate ARM runners (each runs
# the codec check, the tarballs must match), then the image from the x86 handler ZIP, smoke-run on ARM.
on:
  pull_request:
    paths:
      - "packages/aws-lambda/image/**"
      - "packages/aws-lambda/scripts/stage-arm64-image.ts"
      # A @sparticuz/chromium bump or a ZIP layout change must re-stage the image.
      - "packages/aws-lambda/package.json"
      - "packages/aws-lambda/scripts/build-zip.ts"
      - "packages/aws-lambda/scripts/runtimeLock.ts"
      - "packages/aws-lambda/scripts/runtime-lock/**"
      - ".github/workflows/lambda-arm64-image.yml"
  # On main it also seeds publish.yml's ffmpeg cache.
  push:
    branches: [main]
    paths:
      - "packages/aws-lambda/image/**"
  workflow_dispatch:

concurrency:
  group: lambda-arm64-image-${{ github.ref }}
  cancel-in-progress: true

jobs:
  changes:
    name: Detect changes
    runs-on: ubuntu-latest
    timeout-minutes: 4
    outputs:
      release_only: ${{ steps.release.outputs.release_only }}
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          fetch-depth: 0
      - name: Find a release-only diff
        id: release
        uses: ./.github/actions/release-only-diff

  ffmpeg:
    name: ffmpeg ${{ matrix.copy }}
    needs: changes
    # A release PR changes versions and notes only; a failed change detection must not skip the build.
    if: ${{ !cancelled() && needs.changes.outputs.release_only != 'true' }}
    runs-on: ubuntu-24.04-arm
    timeout-minutes: 90
    strategy:
      matrix:
        copy: [a, b]
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
      - name: Build and check
        run: >-
          docker buildx build --progress=plain --platform linux/arm64 --target artifact
          --output type=local,dest=out packages/aws-lambda/image
      - run: cat out/hf-media-check.txt && sha256sum out/*.tar.gz
      # Same path and key as publish.yml's lambda-arm64-ffmpeg job reads.
      - if: matrix.copy == 'a' && github.ref == 'refs/heads/main'
        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
        with:
          path: out/
          key: hf-media-linux-aarch64-${{ hashFiles('packages/aws-lambda/image/**') }}
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: hf-media-${{ matrix.copy }}
          path: out/
          retention-days: 7

  reproducible:
    name: ffmpeg builds match
    needs: ffmpeg
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
      - run: cmp hf-media-a/hf-media-linux-aarch64.tar.gz hf-media-b/hf-media-linux-aarch64.tar.gz

  handler-zip:
    name: Handler ZIP
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
      - run: bun install --frozen-lockfile
      - run: bun run build
      - run: bun run --cwd packages/aws-lambda build:zip
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: handler-zip
          path: packages/aws-lambda/dist/handler.zip
          retention-days: 7

  image:
    name: Image smoke
    needs: [ffmpeg, handler-zip]
    runs-on: ubuntu-24.04-arm
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
        with:
          path: artifacts
      - name: Stage /var/task
        run: >-
          bun packages/aws-lambda/scripts/stage-arm64-image.ts
          --zip=artifacts/handler-zip/handler.zip
          --ffmpeg=artifacts/hf-media-a/hf-media-linux-aarch64.tar.gz --out=staged
      - name: Build image
        run: >-
          docker buildx build --progress=plain --platform linux/arm64 --target video
          --build-context task=staged/task --load -t hf-video:ci packages/aws-lambda/image
      - name: ffmpeg and Chrome run under the image's own Lambda runtime
        run: |
          docker run -d --name hf-smoke -p 9001:8080 \
            -v "$PWD/packages/aws-lambda/image/smoke-video.mjs:/var/task/smoke-video.mjs:ro" \
            hf-video:ci smoke-video.handler
          reply=$(curl -sS --retry 30 --retry-all-errors --retry-delay 1 \
            -d '{}' http://localhost:9001/2015-03-31/functions/function/invocations)
          docker logs hf-smoke
          echo "$reply"
          jq -e '.arch == "arm64" and .screenshotBytes > 0 and (.ffmpeg | startswith("ffmpeg version 7.0.2"))' <<<"$reply"
      - name: The Lambda runtime loads the handler
        run: |
          docker run -d --name hf-video -p 9000:8080 hf-video:ci
          reply=$(curl -sS --retry 30 --retry-all-errors --retry-delay 1 \
            -d '{"Action":"not-an-action"}' http://localhost:9000/2015-03-31/functions/function/invocations)
          docker logs hf-video
          echo "$reply"
          grep -q 'no recognised Action' <<<"$reply"