Changelog: Bundle upload support and Private-Public Bundling SQS Lambda

.github/workflows/build-changelog-scrubber-lambda.yml

@@ -0,0 +1,46 @@
+---
+# This workflow builds the changelog-scrubber Lambda function bootstrap binary
+# that can be deployed to AWS Lambda.
+name: Build Changelog Scrubber Lambda
+
+on:
+  workflow_dispatch:
+  workflow_call:
+    inputs:
+      ref:
+        required: false
+        type: string
+        default: ${{ github.ref }}
+
+permissions: {}
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    env:
+      BINARY_PATH: .artifacts/docs-lambda-changelog-scrubber/release_linux-x64/bootstrap
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.ref }}
+          persist-credentials: false
+      - name: Amazon Linux 2023 build
+        run: |
+          docker build . -t changelog-scrubber:latest -f src/infra/docs-lambda-changelog-scrubber/lambda.DockerFile
+      - name: Get bootstrap binary
+        run: |
+          docker cp "$(docker create --name tc changelog-scrubber:latest)":/app/.artifacts/publish ./.artifacts && docker rm tc
+      - name: Inspect bootstrap binary
+        run: |
+          tree .artifacts
+          stat "${BINARY_PATH}"
+      - name: Archive artifact
+        id: upload-artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: changelog-scrubber-lambda-binary
+          retention-days: 1
+          if-no-files-found: error
+          path: ${{ env.BINARY_PATH }}

.github/workflows/release.yml

@@ -69,19 +69,26 @@ jobs:
       - name: Publish Containers
         run: ./build.sh publishcontainers
 
-  build-lambda:
+  build-link-index-lambda:
     needs: 
       - release-drafter
     uses: ./.github/workflows/build-link-index-updater-lambda.yml
     with:
       ref: ${{ needs.release-drafter.outputs.tag_name }}
-
+
+  build-changelog-scrubber-lambda:
+    needs:
+      - release-drafter
+    uses: ./.github/workflows/build-changelog-scrubber-lambda.yml
+    with:
+      ref: ${{ needs.release-drafter.outputs.tag_name }}
+
   deploy-link-index-updater-lambda-prod:
     environment: 
       name: link-index-updater-prod
     runs-on: ubuntu-latest
     needs:
-      - build-lambda
+      - build-link-index-lambda
       - release-drafter
     permissions:
       contents: write
@@ -93,8 +100,8 @@ jobs:
       - name: Download bootstrap binary
         uses: actions/download-artifact@v8
         with: 
-          name: link-index-updater-lambda-binary # Defined in build-link-index-updater-lambda.yml
-          
+          name: link-index-updater-lambda-binary
+
       - name: Create zip
         run: |
           zip -j "${ZIP_FILE}" ./bootstrap
@@ -113,7 +120,50 @@ jobs:
       - name: Attach Distribution to release
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: gh release upload --repo ${{ github.repository }} ${{ needs.release-drafter.outputs.tag_name }} "${ZIP_FILE}"
+          TAG_NAME: ${{ needs.release-drafter.outputs.tag_name }}
+          REPO: ${{ github.repository }}
+        run: gh release upload --repo "$REPO" "$TAG_NAME" "${ZIP_FILE}"
+
+  deploy-changelog-scrubber-lambda-prod:
+    environment:
+      name: changelog-scrubber-prod
+    runs-on: ubuntu-latest
+    needs:
+      - build-changelog-scrubber-lambda
+      - release-drafter
+    permissions:
+      contents: write
+      id-token: write
+    env:
+      ZIP_FILE: changelog-scrubber-lambda.zip
+    steps:
+
+      - name: Download bootstrap binary
+        uses: actions/download-artifact@v8
+        with:
+          name: changelog-scrubber-lambda-binary
+
+      - name: Create zip
+        run: |
+          zip -j "${ZIP_FILE}" ./bootstrap
+
+      - uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
+        with:
+          role-to-assume: arn:aws:iam::197730964718:role/elastic-docs-v3-changelog-scrubber-deployer
+          aws-region: us-east-1
+
+      - name: Upload Lambda function
+        run: |
+          aws lambda update-function-code \
+            --function-name elastic-docs-v3-changelog-scrubber \
+            --zip-file "fileb://${ZIP_FILE}"
+
+      - name: Attach Distribution to release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG_NAME: ${{ needs.release-drafter.outputs.tag_name }}
+          REPO: ${{ github.repository }}
+        run: gh release upload --repo "$REPO" "$TAG_NAME" "${ZIP_FILE}"
 
   release:
     needs: 
@@ -159,8 +209,9 @@ jobs:
       - name: Attach Distribution to release
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG_NAME: ${{ needs.release-drafter.outputs.tag_name }}
         run: |
-          gh release upload ${{ needs.release-drafter.outputs.tag_name }} .artifacts/publish/docs-builder/release/*.zip
+          gh release upload "$TAG_NAME" .artifacts/publish/docs-builder/release/*.zip
         shell: bash
 
   publish-release:
@@ -169,6 +220,7 @@ jobs:
       - containers
       - release-drafter
       - deploy-link-index-updater-lambda-prod
+      - deploy-changelog-scrubber-lambda-prod
     runs-on: ubuntu-latest
     permissions: 
       contents: write
@@ -177,5 +229,6 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
           TAG_NAME: ${{ needs.release-drafter.outputs.tag_name }}
+          REPO: ${{ github.repository }}
         run: |
-          gh release edit ${{ needs.release-drafter.outputs.tag_name }} --draft=false --latest --repo ${{ github.repository }}
+          gh release edit "$TAG_NAME" --draft=false --latest --repo "$REPO"