From 33425f79d3747b55f166de43ab0e7ae87381c48f Mon Sep 17 00:00:00 2001
From: Dotta <bippadotta@protonmail.com>
Date: Fri, 4 Sep 2026 08:08:41 -0500
Subject: [PATCH] ci(runner-e2e): install Playwright FFmpeg on AWS

---
 .github/workflows/runner-full-stack-e2e.yml | 15 +++++++++++++++
 tests/runner-e2e/workflow-security.test.ts  |  8 ++++++++
 2 files changed, 23 insertions(+)

diff --git a/.github/workflows/runner-full-stack-e2e.yml b/.github/workflows/runner-full-stack-e2e.yml
index 9c45df4479..1150d96d54 100644
--- a/.github/workflows/runner-full-stack-e2e.yml
+++ b/.github/workflows/runner-full-stack-e2e.yml
@@ -923,6 +923,21 @@ jobs:
           test -x "$chrome_path"
           google-chrome --version
 
+      - name: Install Playwright FFmpeg on AWS runner
+        if: needs.authorize.outputs.playwright_channel == 'chrome'
+        run: |
+          set -euo pipefail
+          for attempt in 1 2 3; do
+            if pnpm exec playwright install ffmpeg; then
+              exit 0
+            fi
+            if [ "$attempt" -eq 3 ]; then
+              echo "Playwright FFmpeg installation failed after $attempt attempts." >&2
+              exit 1
+            fi
+            sleep "$((attempt * 10))"
+          done
+
       - name: Install Chromium headless shell on GitHub-hosted fallback
         if: needs.authorize.outputs.playwright_channel != 'chrome'
         run: |
diff --git a/tests/runner-e2e/workflow-security.test.ts b/tests/runner-e2e/workflow-security.test.ts
index ee46454dd1..06018fc706 100644
--- a/tests/runner-e2e/workflow-security.test.ts
+++ b/tests/runner-e2e/workflow-security.test.ts
@@ -251,6 +251,9 @@ describe("public repository paid workflow security", () => {
       "if: needs.authorize.outputs.playwright_channel == 'chrome'",
     );
     expect(paidJob).toContain("google-chrome --version");
+    expect(paidJob).toMatch(
+      /- name: Install Playwright FFmpeg on AWS runner\n\s+if: needs\.authorize\.outputs\.playwright_channel == 'chrome'[\s\S]*pnpm exec playwright install ffmpeg/,
+    );
     expect(paidJob).toContain(
       "if: needs.authorize.outputs.playwright_channel != 'chrome'",
     );
@@ -266,9 +269,14 @@ describe("public repository paid workflow security", () => {
     const daytonaPluginPreparation = paidJob.indexOf(
       "Prepare bundled Daytona plugin without dependency lifecycle scripts",
     );
+    const awsFfmpegInstall = paidJob.indexOf(
+      "- name: Install Playwright FFmpeg on AWS runner",
+    );
     const paidExecution = paidJob.indexOf("- name: Run paid cell");
     expect(paidInstall).toBeGreaterThan(0);
     expect(daytonaPluginPreparation).toBeGreaterThan(paidInstall);
+    expect(awsFfmpegInstall).toBeGreaterThan(daytonaPluginPreparation);
+    expect(paidExecution).toBeGreaterThan(awsFfmpegInstall);
     expect(paidExecution).toBeGreaterThan(daytonaPluginPreparation);
     const preparedBeforeProviderAccess = paidJob.slice(
       daytonaPluginPreparation,