ci: split Lambda layer publish credentials by region

[zhongkechen]

Summary

• resolve Lambda layer publish targets into credential-scoped matrix jobs
• use one role ARN secret per opt-in commercial Region, one China secret for both China Regions, and one GovCloud secret for both GovCloud Regions
• configure the China OIDC audience, validate manual Region overrides, and document the required secret names
• retain the universal layer artifact introduced on current main

Testing

• python -m pytest .github/scripts/tests/test_resolve_layer_publish_targets.py .github/scripts/tests/test_lambda_layer_publish_workflow.py .github/scripts/tests/test_build_lambda_layer.py .github/scripts/tests/test_parse_sdk_branch.py .github/scripts/tests/test_resolve_layer_sdk_version.py (18 passed)
• Ruff lint and format checks
• actionlint .github/workflows/lambda-layer-publish.yml .github/workflows/test-parser.yml

[github-actions]

Codex AI review

[P1] Preserve access to the environment-scoped region setting. This lookup moved from publish-layer, which declares the lambda-layer-publish environment, into build-distributions, which does not. Consequently an environment-level LAYER_PUBLISH_REGIONS is unavailable here, so the empty value selects every configured region, potentially publishing beyond the requested scope or failing on unrelated role secrets. Resolve targets in a job that declares the environment, or migrate and document this as a repository-level variable.

[github-actions]

Codex AI review

Found one high-severity release workflow regression. The YAML tests do not cover GitHub environment-scoped variable availability.

Reviewed commit d2aa4596f9e886712e3c1a1db6c9e0ee2a56a5a2. Workflow run

[github-actions]

Claude AI review

No blocking findings. This CI-only PR splits the Lambda layer publish job into a credential-scoped matrix, and the logic is sound:

• resolve_layer_publish_targets.py always returns a non-empty target tuple (default → all groups; filtered → validated against SUPPORTED_REGIONS), so the fromJSON(...) matrix can never be empty. Unknown regions raise ValueError, surfaced via parser.error and failing the resolve step under set -e.
• DEFAULT_COMMERCIAL_REGIONS ∪ OPT_IN_REGIONS reproduces the previous 34-region commercial default exactly; the 2 China + 2 GovCloud regions are the intentional additions.
• Matrix wiring (secrets[matrix.publish_target.role_secret], dynamic aws_region/audience/regions, single-dimension matrix, fail-fast: false) is valid; role-session names stay within AWS length/charset limits. Removing the DEFAULT_LAYER_REGIONS fallback is safe since LAYER_REGIONS now always comes from a non-empty matrix value.
• The idempotent SHA-verify/reuse publish loop is unchanged, and the same universal artifact is downloaded per matrix job, preserving retry determinism.
• Tests are adequate: the resolver unit tests and the lambda-layer-publish.yml structure test match the workflow, and test-parser.yml adds PyYAML plus the new files/triggers.

Residual (non-blocking, operational) risk: the default target set now includes China and GovCloud. On any release where LAYER_PUBLISH_REGIONS is unset, the workflow will attempt those partitions, and the matrix jobs will fail at "Configure AWS credentials" (empty role-to-assume) unless LAYER_PUBLISH_ROLE_ARN_CHINA, LAYER_PUBLISH_ROLE_ARN_US_GOV, and every per-Region opt-in secret are configured in the lambda-layer-publish environment. Because a failed matrix job fails the overall run, commercial-only setups that previously succeeded will now report failure until the new secrets exist. This is intended and documented in RELEASING.md; ensure the secrets are provisioned before the next release. Also confirm the OIDC audience/public-layer-permission behavior for the China/GovCloud roles in a manual workflow_dispatch scoped to those Regions, since the default sts.amazonaws.com audience and --principal "*" sharing are applied to those partitions for the first time.

Reviewed commit d2aa4596f9e886712e3c1a1db6c9e0ee2a56a5a2. Workflow run