feat(aws-lambda): arm64 video function image from the handler ZIP

The image is the release handler ZIP with its x86 ffmpeg and Chrome swapped for the native ffmpeg tree and the sha256-pinned Sparticuz arm64 Chrome pack, so the x86 and arm64 functions run the same handler code. The image stage only copies, so any host builds it. CI builds it and runs ffmpeg, a real Chrome render and the Lambda runtime on an ARM runner.
2026-11-15 13:58:20 +00:00 · 2026-10-22 12:18:18 -04:00
parent 295c5a7498
commit 7474f38420
7 changed files with 342 additions and 47 deletions
@@ -0,0 +1,98 @@
+name: Lambda arm64 image
+
+permissions:
+  contents: read
+
+# Builds the arm64 Lambda video function image: the native ffmpeg on two separate ARM runners (each runs
+# the codec check, the tarballs must match), then the image from the x86 handler ZIP, smoke-run on ARM.
+on:
+  pull_request:
+    paths:
+      - "packages/aws-lambda/image/**"
+      - "packages/aws-lambda/scripts/stage-arm64-image.ts"
+      - ".github/workflows/lambda-arm64-image.yml"
+  workflow_dispatch:
+
+concurrency:
+  group: lambda-arm64-image-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  ffmpeg:
+    name: ffmpeg ${{ matrix.copy }}
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 90
+    strategy:
+      matrix:
+        copy: [a, b]
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - name: Build and check
+        run: >-
+          docker buildx build --progress=plain --platform linux/arm64 --target artifact
+          --output type=local,dest=out packages/aws-lambda/image
+      - run: cat out/hf-media-check.txt && sha256sum out/*.tar.gz
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: hf-media-${{ matrix.copy }}
+          path: out/
+          retention-days: 7
+
+  reproducible:
+    name: ffmpeg builds match
+    needs: ffmpeg
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+      - run: cmp hf-media-a/hf-media-linux-aarch64.tar.gz hf-media-b/hf-media-linux-aarch64.tar.gz
+
+  handler-zip:
+    name: Handler ZIP
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+      - run: bun install --frozen-lockfile
+      - run: bun run build
+      - run: bun run --cwd packages/aws-lambda build:zip
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: handler-zip
+          path: packages/aws-lambda/dist/handler.zip
+          retention-days: 7
+
+  image:
+    name: Image smoke
+    needs: [ffmpeg, handler-zip]
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          path: artifacts
+      - name: Stage /var/task
+        run: >-
+          bun packages/aws-lambda/scripts/stage-arm64-image.ts
+          --zip=artifacts/handler-zip/handler.zip
+          --ffmpeg=artifacts/hf-media-a/hf-media-linux-aarch64.tar.gz --out=staged
+      - name: Build image
+        run: >-
+          docker buildx build --progress=plain --platform linux/arm64 --target video
+          --build-context task=staged/task --load -t hf-video:ci packages/aws-lambda/image
+      - name: ffmpeg and Chrome run in the image
+        run: >-
+          docker run --rm --entrypoint /var/lang/bin/node
+          -v "$PWD/packages/aws-lambda/image/smoke-video.mjs:/var/task/smoke-video.mjs:ro"
+          hf-video:ci /var/task/smoke-video.mjs
+      - name: The Lambda runtime loads the handler
+        run: |
+          docker run -d --name hf-video -p 9000:8080 hf-video:ci
+          reply=$(curl -sS --retry 20 --retry-connrefused --retry-delay 1 \
+            -d '{"Action":"not-an-action"}' http://localhost:9000/2015-03-31/functions/function/invocations)
+          docker logs hf-video
+          echo "$reply"
+          grep -q 'no recognised Action' <<<"$reply"
@@ -1,47 +0,0 @@
-name: Lambda arm64 ffmpeg
-
-permissions:
-  contents: read
-
-# Builds the native ffmpeg for the arm64 Lambda video function on two separate ARM runners.
-# Each build runs the codec check on the bare Lambda base; the tarballs must be byte-identical.
-on:
-  pull_request:
-    paths:
-      - "packages/aws-lambda/image/**"
-      - ".github/workflows/lambda-ffmpeg.yml"
-  workflow_dispatch:
-
-concurrency:
-  group: lambda-ffmpeg-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  build:
-    name: Build ${{ matrix.copy }}
-    runs-on: ubuntu-24.04-arm
-    timeout-minutes: 90
-    strategy:
-      matrix:
-        copy: [a, b]
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
-      - name: Build and check
-        run: >-
-          docker buildx build --progress=plain --platform linux/arm64 --target artifact
-          --output type=local,dest=out packages/aws-lambda/image
-      - run: cat out/hf-media-check.txt && sha256sum out/*.tar.gz
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
-        with:
-          name: hf-media-${{ matrix.copy }}
-          path: out/
-          retention-days: 7
-
-  reproducible:
-    name: Builds match
-    needs: build
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
-      - run: cmp hf-media-a/hf-media-linux-aarch64.tar.gz hf-media-b/hf-media-linux-aarch64.tar.gz