name: Lambda arm64 ffmpeg

permissions:
  contents: read

# Builds the native ffmpeg for the arm64 Lambda video function on two separate ARM runners.
# Each build runs the codec check on the bare Lambda base; the tarballs must be byte-identical.
on:
  pull_request:
    paths:
      - "packages/aws-lambda/image/**"
      - ".github/workflows/lambda-ffmpeg.yml"
  workflow_dispatch:

concurrency:
  group: lambda-ffmpeg-${{ github.ref }}
  cancel-in-progress: true

jobs:
  build:
    name: Build ${{ matrix.copy }}
    runs-on: ubuntu-24.04-arm
    timeout-minutes: 90
    strategy:
      matrix:
        copy: [a, b]
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
      - name: Build and check
        run: >-
          docker buildx build --progress=plain --platform linux/arm64 --target artifact
          --output type=local,dest=out packages/aws-lambda/image
      - run: cat out/hf-media-check.txt && sha256sum out/*.tar.gz
      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: hf-media-${{ matrix.copy }}
          path: out/
          retention-days: 7

  reproducible:
    name: Builds match
    needs: build
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
      - run: cmp hf-media-a/hf-media-linux-aarch64.tar.gz hf-media-b/hf-media-linux-aarch64.tar.gz