Generic Remotion leaderboard video for benchmark composite scores

[HeyGarrison]

Summary

Genericizes packages/remotion-video so the same leaderboard composition can be rendered for any benchmark in results/<benchmark>/latest.json.

• prepare.ts now accepts a benchmark via pnpm generate <benchmark> or BENCHMARK=.... It derives the title from a small mapping (with a BENCHMARK_TITLE env override), reads the result JSON, and uses each provider's compositeScore when present. For sandbox-dax (which has no compositeScore), it falls back to the median phasesCompleted / 7 * 100.
• Logo resolution moved to a dotcom-aligned src/logo.ts using providerBrandId, logomarkSlug, and MISSING_LOGO_BRAND_IDS so cloud-run → google-cloud-run, browseruse → browser-use, and lightning/sail fall back to the local SVGs served by dotcom. Display names use the same capitalize helper as dotcom (CodeSandbox, Cloud Run, Lightning AI, etc.).
• Composition.tsx keeps the 30-second, dark-mode, full-width race layout, but the header now places the dark ComputeSDK wordmark and title in a single flex container so they stay vertically aligned and the logo is sized larger than the title.

Try it

pnpm install
pnpm --filter @computesdk/remotion-video generate              # defaults to burst_tti
BENCHMARK=browser pnpm --filter @computesdk/remotion-video generate
pnpm --filter @computesdk/remotion-video render                # out.mp4
pnpm --filter @computesdk/remotion-video render:png            # out.png at frame 840

Sample output

Opening frame (frame 0):

Final leaderboard at frame 840:

Watch the 30s race video

Only composite scores are displayed; no median/p95/p99 metrics appear in the video.

Link to Devin session: https://app.devin.ai/sessions/e276f3c69f6a4e4783b1d3f09f60d930
Requested by: @HeyGarrison

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[open-cla]

Contributor License Agreement

All contributors are covered by a CLA.

[superagent-security]

Superagent found 1 security concern(s).

[superagent-security]

P2: Path traversal vulnerability in benchmark result resolution

Unsanitized BENCHMARK env/arg used in path.resolve enables directory traversal to read arbitrary files.

Validate benchmark names against an allowlist and ensure resolved paths remain within the intended results directory.

AI prompt

Check if this security scanner issue is valid. If so, understand the root cause and fix it. If appropriate, update or add tests. Keep the change focused and preserve intended behavior.

<file name="packages/remotion-video/src/prepare.ts">
<violation number="1" location="packages/remotion-video/src/prepare.ts:94">
<priority>P2</priority>
<title>Path traversal vulnerability in benchmark result resolution</title>
<evidence>The `getResultPath` function constructs a filesystem path using an unsanitized `benchmark` parameter (`process.argv[2]` or `process.env.BENCHMARK`) passed directly into `path.resolve`: `return path.resolve(PKG_ROOT, '../../results', benchmark, 'latest.json');`. An attacker controlling the `BENCHMARK` environment variable or CLI argument can traverse outside the intended `results` directory to read arbitrary files on the filesystem (e.g., `BENCHMARK=../../../etc/passwd`).</evidence>
<recommendation>Sanitize the `benchmark` input before using it in a path. Validate it against an allowlist of known benchmark names, or reject values containing path traversal sequences (e.g., `..`, absolute paths). Use `path.join` combined with a check that the resolved path remains within the intended base directory.</recommendation>
</violation>
</file>