feat(aws-lambda): attach the arm64 video image to releases and pin it (#6070)

* feat(aws-lambda): attach the arm64 video image to releases and pin it

The release builds the arm64 video function image from the handler ZIP it
attaches, attaches it as an OCI layout tarball with its sha256, and pins it
in prebuilt/video-image.json, read through prebuiltVideoImage(). A retried
release reuses the image already attached.

* fix(aws-lambda): keep the release pin script out of the published package

pin-handler-zip.ts is run from a checkout by publish.yml; nothing in dist or the CLI imports it. Leaving it out keeps aws-lambda under its size budget with the video image reader added.

.github/workflows/lambda-arm64-image.yml

@@ -14,6 +14,11 @@ on:
       - "packages/aws-lambda/package.json"
       - "packages/aws-lambda/scripts/build-zip.ts"
       - ".github/workflows/lambda-arm64-image.yml"
+  # On main it also seeds publish.yml's ffmpeg cache.
+  push:
+    branches: [main]
+    paths:
+      - "packages/aws-lambda/image/**"
   workflow_dispatch:
 
 concurrency:
@@ -35,6 +40,12 @@ jobs:
           docker buildx build --progress=plain --platform linux/arm64 --target artifact
           --output type=local,dest=out packages/aws-lambda/image
       - run: cat out/hf-media-check.txt && sha256sum out/*.tar.gz
+      # Same path and key as publish.yml's lambda-arm64-ffmpeg job reads.
+      - if: matrix.copy == 'a' && github.ref == 'refs/heads/main'
+        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        with:
+          path: out/
+          key: hf-media-linux-aarch64-${{ hashFiles('packages/aws-lambda/image/**') }}
       - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: hf-media-${{ matrix.copy }}

.github/workflows/publish.yml

@@ -13,10 +13,47 @@ on:
     branches: [main]
 
 jobs:
+  lambda-arm64-ffmpeg:
+    name: Lambda arm64 ffmpeg
+    runs-on: ubuntu-24.04-arm
+    # A cache miss compiles ffmpeg natively, 15-20 minutes.
+    timeout-minutes: 60
+    permissions:
+      contents: read
+    env:
+      EXPECTED_RELEASE_SHA: >-
+        ${{ github.event_name == 'pull_request'
+            && github.event.pull_request.merge_commit_sha
+            || github.sha }}
+    if: >-
+      github.event_name == 'push' ||
+      (github.event.pull_request.merged == true &&
+       startsWith(github.event.pull_request.head.ref, 'release/v'))
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          ref: ${{ env.EXPECTED_RELEASE_SHA }}
+      # lambda-arm64-image.yml saves this key on main; a release run's own saves reach only its re-runs.
+      - id: cache
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        with:
+          path: out/
+          key: hf-media-linux-aarch64-${{ hashFiles('packages/aws-lambda/image/**') }}
+      - if: steps.cache.outputs.cache-hit != 'true'
+        run: >-
+          docker buildx build --progress=plain --platform linux/arm64 --target artifact
+          --output type=local,dest=out packages/aws-lambda/image
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: hf-media-linux-aarch64
+          path: out/hf-media-linux-aarch64.tar.gz
+          if-no-files-found: error
+
   publish:
     name: Publish
+    needs: lambda-arm64-ffmpeg
     runs-on: ubuntu-latest
-    timeout-minutes: 20
+    timeout-minutes: 30
     environment: npm-publish
     permissions:
       contents: write
@@ -137,6 +174,33 @@ jobs:
           fi
           bun packages/aws-lambda/scripts/pin-handler-zip.ts
 
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          name: hf-media-linux-aarch64
+          path: dist/hf-media
+
+      # Built from the zip pinned above. The video stage only copies files, so no emulation is needed.
+      - name: Build Lambda video image
+        id: lambda_video_image
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VERSION: ${{ steps.version.outputs.version }}
+          REPO: ${{ github.repository }}
+        run: |
+          # A retried run reuses the image already on the release, so the pin still matches it.
+          if gh release download "v${VERSION}" --repo "$REPO" --pattern hyperframes-lambda-video-arm64.oci.tar --dir dist; then
+            echo "attached=true" >> "$GITHUB_OUTPUT"
+          else
+            bun packages/aws-lambda/scripts/stage-arm64-image.ts --zip=dist/hyperframes-lambda-handler.zip \
+              --ffmpeg=dist/hf-media/hf-media-linux-aarch64.tar.gz --out=dist/arm64-image
+            # OCI export needs a docker-container builder; no attestations, so index.json lists one image.
+            docker buildx create --use
+            docker buildx build --progress=plain --platform linux/arm64 --target video \
+              --provenance=false --sbom=false --build-context task=dist/arm64-image/task \
+              --output type=oci,dest=dist/hyperframes-lambda-video-arm64.oci.tar packages/aws-lambda/image
+          fi
+          bun packages/aws-lambda/scripts/pin-handler-zip.ts --video-image
+
       - run: bun run verify:packed-manifests
 
       - name: Create GitHub Release
@@ -173,6 +237,14 @@ jobs:
           REPO: ${{ github.repository }}
         run: gh release upload "v${VERSION}" dist/hyperframes-lambda-handler.zip dist/hyperframes-lambda-handler.sha256 --repo "$REPO"
 
+      - name: Attach Lambda video image to release
+        if: steps.lambda_video_image.outputs.attached != 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VERSION: ${{ steps.version.outputs.version }}
+          REPO: ${{ github.repository }}
+        run: gh release upload "v${VERSION}" dist/hyperframes-lambda-video-arm64.oci.tar dist/hyperframes-lambda-video-arm64.sha256 --repo "$REPO"
+
       - name: Publish packages
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}