ci(aws): add production media verification

Author: richiemcilroy

.github/workflows/verify-aws-production.yml

@@ -0,0 +1,30 @@
+name: Verify Rend AWS production
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: rend-aws-production-verification
+  cancel-in-progress: false
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    environment: Production
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+
+      - name: Verify public media pipeline
+        env:
+          REND_API_BASE_URL: https://api.rend.so
+          REND_PLAYBACK_BASE_URL: https://video.rend.so
+          REND_READINESS_API_KEY: ${{ secrets.REND_READINESS_API_KEY }}
+        run: node scripts/smoke-aws-public.mjs

scripts/smoke-aws-public.mjs

@@ -104,8 +104,19 @@ async function signedArtifact(url, cookies, label, headers = {}) {
     headers: { cookie: cookieHeader(cookies), ...headers },
     redirect: "error",
   });
-  if (!response.ok) throw new Error(`${label} returned HTTP ${response.status}`);
   const body = new Uint8Array(await response.arrayBuffer());
+  if (!response.ok) {
+    const detail = new TextDecoder()
+      .decode(body.slice(0, 512))
+      .replace(/\s+/g, " ")
+      .trim();
+    const cache = response.headers.get("x-cache") || "missing";
+    const contentType = response.headers.get("content-type") || "missing";
+    throw new Error(
+      `${label} (${new URL(url).pathname}) returned HTTP ${response.status}; ` +
+        `x-cache=${cache}; content-type=${contentType}; body=${detail || "empty"}`,
+    );
+  }
   if (body.byteLength === 0) throw new Error(`${label} returned an empty body`);
   return { response, body };
 }