Migrate CI/CD from CodePipeline to GitHub Actions

.github/workflows/cdk-diff.yml

@@ -0,0 +1,70 @@
+name: cdk-diff
+
+on:
+  pull_request:
+    branches: [mainline]
+    paths:
+      - 'lib/**'
+      - 'smithy/**'
+      - '.github/workflows/cdk-diff.yml'
+      - 'package.json'
+      - 'package-lock.json'
+
+concurrency:
+  group: cdk-diff-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+env:
+  AWS_REGION: "us-west-2"
+  STAGE: "prod"
+
+jobs:
+  diff:
+    runs-on: ubuntu-latest
+    environment: prod
+    permissions:
+      contents: read
+      id-token: write
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-java@v5
+        with:
+          distribution: corretto
+          java-version: 17
+          cache: gradle
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build Smithy model
+        working-directory: smithy
+        run: ./gradlew smithyBuild
+
+      - name: Build TypeScript
+        run: npm run build
+
+      - uses: docker/setup-qemu-action@v3
+        with:
+          platforms: arm64
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v6
+        with:
+          role-to-assume: ${{ secrets.CDK_DEPLOY_ROLE_ARN }}
+          aws-region: ${{ env.AWS_REGION }}
+
+      - name: CDK Synthesize
+        run: npx cdk synth --all --output build/cdk.out
+
+      - name: CDK Diff
+        uses: corymhall/cdk-diff-action@v2
+        with:
+          githubToken: ${{ secrets.GITHUB_TOKEN }}
+          cdkOutDir: build/cdk.out

.github/workflows/deploy.yml

@@ -0,0 +1,89 @@
+name: deploy
+
+on:
+  push:
+    branches: [mainline]
+  workflow_dispatch:
+
+concurrency:
+  group: deploy-${{ github.ref }}
+  cancel-in-progress: false
+
+env:
+  AWS_REGION: "us-west-2"
+  STAGE: "prod"
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-java@v5
+        with:
+          distribution: corretto
+          java-version: 17
+          cache: gradle
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build Smithy model
+        working-directory: smithy
+        run: ./gradlew smithyBuild
+
+      - name: Build TypeScript
+        run: npm run build
+
+      - uses: docker/setup-qemu-action@v3
+        with:
+          platforms: arm64
+
+      - name: CDK synth
+        run: npx cdk synth --all --output build/cdk.out
+
+      - uses: actions/upload-artifact@v6
+        with:
+          name: cdk-out
+          path: build/cdk.out
+          retention-days: 1
+
+  deploy:
+    needs: build
+    runs-on: ubuntu-latest
+    environment: prod
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v6
+
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 24
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - uses: actions/download-artifact@v7
+        with:
+          name: cdk-out
+          path: build/cdk.out
+
+      - uses: aws-actions/configure-aws-credentials@v6
+        with:
+          role-to-assume: ${{ secrets.CDK_DEPLOY_ROLE_ARN }}
+          aws-region: ${{ env.AWS_REGION }}
+
+      - name: Deploy stacks
+        run: npx cdk deploy *-${{ env.STAGE }} --app build/cdk.out --require-approval never

.gitignore

@@ -5,6 +5,7 @@ cdk.out
 *.js
 !.prettierrc.js
 
+smithy/.gradle/
 smithy/build
 build/
 __pycache__