Dockerfile.test

# HyperFrames Producer - Regression Test Image
#
# Matches the production rendering environment (same Chromium, fonts, FFmpeg)
# but includes the full source + devDependencies for running the test harness.
#
# This ensures golden baselines match what production actually renders.
#
# Usage:
#   docker build -f Dockerfile.test -t hyperframes-producer:test .
#   docker run --rm -v ./packages/producer/tests:/app/packages/producer/tests hyperframes-producer:test
#   docker run --rm -v ./packages/producer/tests:/app/packages/producer/tests hyperframes-producer:test --update

FROM node:22.23.3-bookworm-slim

# ── System dependencies (identical to production) ────────────────────────────
RUN apt-get update && apt-get install -y --no-install-recommends \
    ca-certificates \
    curl \
    unzip \
    xz-utils \
    chromium \
    libgbm1 \
    libnss3 \
    libatk-bridge2.0-0 \
    libdrm2 \
    libxcomposite1 \
    libxdamage1 \
    libxrandr2 \
    libcups2 \
    libasound2 \
    libpangocairo-1.0-0 \
    libxshmfence1 \
    libgtk-3-0 \
    # Font support — matches production
    fonts-liberation \
    fonts-noto-color-emoji \
    fonts-noto-cjk \
    fonts-noto-core \
    fonts-noto-extra \
    fonts-noto-ui-core \
    fonts-freefont-ttf \
    fonts-dejavu-core \
    fontconfig \
    && rm -rf /var/lib/apt/lists/* \
    && apt-get clean \
    && fc-cache -fv

# ── FFmpeg (pinned) ──────────────────────────────────────────────────────────
# One pinned static build (BtbN n8.0.1) instead of Debian's apt ffmpeg, so
# regression baselines and the shipped images use the same FFmpeg version.
# Bump the URL and sha256 together, and keep in sync with the other Dockerfiles
# and .github/actions/install-ffmpeg-linux/action.yml.
ARG TARGETARCH
ARG FFMPEG_RELEASE=https://github.com/BtbN/FFmpeg-Builds/releases/download/autobuild-2026-02-28-12-59
ARG FFMPEG_BUILD=ffmpeg-n8.0.1-66-g27b8d1a017
ARG FFMPEG_SHA256_AMD64=26d2ecd0cefba99f9d1ea92252a3a4f743a58df4c1c3cf9f8bbaaa40b1fca5b0
ARG FFMPEG_SHA256_ARM64=d72cc324cb65dd92a9ffe699cc95ccbacfef4def8d3ad9fe2b5164a6a71b9595
RUN case "$TARGETARCH" in \
      amd64) FF_ARCH=linux64; FF_SHA256="$FFMPEG_SHA256_AMD64" ;; \
      arm64) FF_ARCH=linuxarm64; FF_SHA256="$FFMPEG_SHA256_ARM64" ;; \
      *) echo "unsupported TARGETARCH '$TARGETARCH'" >&2; exit 1 ;; \
    esac \
    && curl -fsSL -o /tmp/ffmpeg.tar.xz "$FFMPEG_RELEASE/$FFMPEG_BUILD-$FF_ARCH-gpl-8.0.tar.xz" \
    && echo "$FF_SHA256  /tmp/ffmpeg.tar.xz" | sha256sum -c - \
    && tar -xJf /tmp/ffmpeg.tar.xz -C /usr/local/bin --strip-components=2 --wildcards '*/bin/ffmpeg' '*/bin/ffprobe' \
    && rm /tmp/ffmpeg.tar.xz \
    && ffmpeg -version | grep -F "ffmpeg version ${FFMPEG_BUILD#ffmpeg-}" \
    && ffprobe -version | grep -F "ffprobe version ${FFMPEG_BUILD#ffmpeg-}"

# Use system Chromium (same as production)
ENV PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=true
ENV PUPPETEER_EXECUTABLE_PATH=/usr/bin/chromium
ENV CONTAINER=true

# Install chrome-headless-shell for deterministic BeginFrame rendering.
# This lightweight Chrome binary supports HeadlessExperimental.beginFrame.
# Install to ~/.cache/puppeteer/ where resolveHeadlessShellPath() looks.
#
# Pinned to a specific build (NOT @stable) so the regression-test golden
# baselines in packages/producer/tests/*/output/output.mp4 stay reproducible.
# Each Chrome stable bump shifts pixel output enough to fail PSNR. Bump this
# version together with regenerating baselines via `docker:test:update`.
RUN npx --yes @puppeteer/browsers install chrome-headless-shell@148.0.7778.167 \
      --path /root/.cache/puppeteer \
    && find /root/.cache/puppeteer/chrome-headless-shell -name "chrome-headless-shell" -type f \
    && echo "chrome-headless-shell installed"

WORKDIR /app

# Install bun
RUN curl -fsSL https://bun.sh/install | BUN_INSTALL="/root/.bun" bash -s "bun-v1.3.13"
ENV PATH="/root/.bun/bin:$PATH"

# Install dependencies (full, including devDependencies for tsx + test harness).
# Every workspace member (packages/*) must be COPYed here — `bun install
# --frozen-lockfile` treats any member missing from the build context as a
# lockfile change and fails.
COPY package.json bun.lock ./
COPY packages/parsers/package.json packages/parsers/package.json
COPY packages/lint/package.json packages/lint/package.json
COPY packages/studio-server/package.json packages/studio-server/package.json
COPY packages/core/package.json packages/core/package.json
COPY packages/engine/package.json packages/engine/package.json
COPY packages/player/package.json packages/player/package.json
COPY packages/producer/package.json packages/producer/package.json
COPY packages/cli/package.json packages/cli/package.json
COPY packages/studio/package.json packages/studio/package.json
COPY packages/shader-transitions/package.json packages/shader-transitions/package.json
COPY packages/aws-lambda/package.json packages/aws-lambda/package.json
COPY packages/gcp-cloud-run/package.json packages/gcp-cloud-run/package.json
COPY packages/sdk/package.json packages/sdk/package.json
COPY packages/sdk-playground/package.json packages/sdk-playground/package.json
COPY packages/inspector/package.json packages/inspector/package.json
# A corrupt tarball extraction (e.g. run 35468046055: "Fail extracting tarball
# for aws-cdk-lib") can print an error and then hang instead of exiting, once
# eating a full 60-minute job timeout. Bound each attempt and retry once.
RUN timeout 300 bun install --frozen-lockfile \
    || timeout 300 bun install --frozen-lockfile

# Copy source in dependency order, running each build as soon as its own
# inputs are present.
#
# Every package used to be copied here before any build ran, which put the
# `COPY packages/producer/` layer above the core build. Docker invalidates
# every layer below a changed one, so a producer-only change rebuilt core —
# which cannot depend on producer. On CI run 30229469233 those two layers
# cost 86s and 63s of the ~4m image build, in all 8 shards, on every PR.
# Locally the same producer-only rebuild goes from 18s to 1s after this split.
#
# Keep the ordering dependency-correct: anything the core build reads must be
# copied above it, and packages nothing above depends on stay below.
# Core's build runs the shared post-emit import rewrite from the repo root.
COPY scripts/rewrite-relative-import-extensions.mjs scripts/rewrite-relative-import-extensions.mjs
COPY packages/parsers/ packages/parsers/
COPY packages/lint/ packages/lint/
COPY packages/studio-server/ packages/studio-server/
COPY packages/core/ packages/core/

# Build workspace packages so "node" export conditions resolve to built dist
RUN bun run --filter '@hyperframes/{parsers,lint,studio-server}' build \
    && bun run --cwd packages/core build

# Build core runtime artifacts (needed by renderer)
RUN bun run --filter @hyperframes/core build:hyperframes-runtime:modular

# Nothing above reads these, so they land after the core build to keep it cached.
COPY packages/engine/ packages/engine/
COPY packages/producer/ packages/producer/

WORKDIR /app/packages/producer

# Skip fixtures tagged `transparency` (Chrome alpha-channel PSNR quirks not
# reproducible on the CI image), `webgpu` (needs a hardware adapter; CI has
# only swiftshader, which cannot render canvas WebGPU) and
# `field-signal-reproducer` (known-broken
# fixture per PR #2512 — codifies a real bug awaiting a fix). Mirrors the
# `--exclude-tags` in the local `test:regression*` scripts in
# packages/producer/package.json so `bun run docker:test*` and the aws-lambda
# smoke tests skip the same set. Docker CMD args from `docker run <image> ...`
# are appended after these flags, so positional test names (e.g. shard args
# `hdr-regression style-5-prod ...` in .github/workflows/regression.yml) still
# resolve normally; the harness applies excludeTags whether testNames is empty
# or non-empty (see discoverTestSuites in src/regression-harness.ts).
ENTRYPOINT ["bunx", "tsx", "src/regression-harness.ts", "--", "--sequential", "--exclude-tags", "transparency,field-signal-reproducer,webgpu"]