fix(docker): clone ffmpeg from the github mirror

[rickstaa]

Clones FFmpeg from https://github.com/FFmpeg/FFmpeg.git instead of https://git.ffmpeg.org/ffmpeg.git. One URL, nothing else.

Why

git.ffmpeg.org intermittently returns HTTP 502, which fails the clone with exit code: 128:

#19 4.430 Cloning into '/ffmpeg'...
#19 7.337 fatal: unable to access 'https://git.ffmpeg.org/ffmpeg.git/': The requested URL returned error: 502

It failed the v0.9.1 build three times today from GitHub hosted runners, once from a self hosted runner, and cloned fine from a local workstation in between. Details and timings in #4023.

We do not know for certain that this is the root cause. We have no visibility into the server. All ffmpeg.org hostnames resolve to a single address with no CDN or failover, which is consistent with a proxy returning 502 when the backend saturates under clone load, but that is a plausible explanation rather than a confirmed diagnosis. What we can say is that the 502s recur, that they are what breaks the build, and that they come from this host.

Caveat

github.com/FFmpeg/FFmpeg is not an official, FFmpeg endorsed mirror. ffmpeg.org/git-howto.html does not mention GitHub or any mirror and directs git server problems to root@ffmpeg.org. The repository self describes as Mirror of https://git.ffmpeg.org/ffmpeg.git, is not a fork, and is current, but we are relying on its own claim.

Two things reduce that risk:

• A git commit SHA is a hash of the tree, so content cannot silently differ between hosts for the same SHA or tag.
• This build already depends on github.com for grpc_health_probe (line 30) and tasmodel.pb (line 57), so no new trust or availability dependency is introduced. If GitHub is down this build already fails earlier.

If we would rather not depend on the mirror, the alternatives are a retry loop around the clone or vendoring the FFmpeg source. Happy to switch to either.

Scope

Deliberately only the URL, so it can be merged or reverted on its own. It does not change what gets built: the pin on this line does not work (see #4021), so the image tracks upstream master either way. That is fixed separately in #4022.

Refs #4023

🤖 Generated with Claude Code

[j0sh]

LGTM, maybe consolidate with #4022

[rickstaa]

@j0sh tested in https://github.com/livepeer/go-livepeer/actions/runs/31608535985/job/94153778584?pr=4024.

[rickstaa]

Verified on CI

The builder job normally skips its build step on PRs (it is gated on github.ref_name matching main|master|vX.Y.Z), so a green check on this PR would not have proven anything. To actually test the change I temporarily disabled that guard with push: false, ran it, and then removed the commit. This branch is now the one line change only.

Run: https://github.com/livepeer/go-livepeer/actions/runs/31608535985

Job	Runner	Result
go-livepeer builder docker image generation	GitHub hosted ubuntu-24.04	success, 26m04s
Docker image generation	self hosted	success

The ffmpeg layer cold built on the hosted runner, which is where the 502s were occurring:

14:50:57  #15 [build 6/14] RUN ... git clone --depth 1 https://github.com/FFmpeg/FFmpeg.git /ffmpeg ...
14:50:57  #15 0.059  Cloning into '/ffmpeg'...
14:56:08  #15 DONE 310.8s

For comparison, the same layer against git.ffmpeg.org earlier today:

4.430  Cloning into '/ffmpeg'...
7.337  fatal: unable to access 'https://git.ffmpeg.org/ffmpeg.git/': The requested URL returned error: 502

One further data point on the mirror question: this build already clones from github.com three times, so the change does not add a dependency that is not already load bearing here.

https://github.com/FFmpeg/FFmpeg.git          (this line)
https://github.com/FFmpeg/nv-codec-headers.git (install_ffmpeg.sh, via lpms)
https://github.com/livepeer/FFmpeg.git         (install_ffmpeg.sh, via lpms)

The caveats in the description still stand: we have not confirmed the server side cause of the 502s, and github.com/FFmpeg/FFmpeg is not an officially endorsed mirror.

[rickstaa]

@josh consolidated in #4025 as asked.