feat: add staging ECR deployment action for dev builds

[drernie]

Summary

Adds a reusable GitHub Action for deploying Lambda images to staging ECR, enabling developers to build and test dev images without touching production infrastructure.

Changes

• New Action: lambda-deploy-ecr-staging/
  • action.yaml - Composite action definition with inputs for image tagging
  • upload_ecr_staging.sh - Script to push images to staging ECR

Key Features

• ✅ Deploys to staging account (712023778557) only
• ✅ Supports custom image tags (e.g., dev-feature-v1, dev-bugfix-123)
• ✅ Single region deployment (us-east-1) by default, configurable
• ✅ Auto-creates ECR repository if it doesn't exist
• ✅ OIDC authentication with GitHub Actions
• ✅ Follows same pattern as existing lambda-deploy-ecr action

Usage Example

- uses: quiltdata/gh-actions/lambda-deploy-ecr-staging@main
  with:
    dockerfile-path: Dockerfile
    docker-context-path: .
    name: tabulator
    image-tag: dev-my-feature-v1

Test Plan

• Action syntax validated
• Shell script follows bash best practices
• End-to-end test with tabulator dev workflow (pending infrastructure deployment)

Related

• Part of tabulator dev workflow improvements
• Requires IAM infrastructure updates in infra-templates repo
• Will be used by tabulator's new dev.yml workflow

🤖 Generated with Claude Code

[drernie]

✅ Infrastructure Deployed Successfully

The IAM infrastructure required for this action has been deployed to the staging account.

Deployed Resources

CloudFormation Stack: github-actions-staging (us-east-1, account 712023778557)

1. ✅ IAM Managed Policy: TabulatorECRAccess

   • ARN: arn:aws:iam::712023778557:policy/TabulatorECRAccess
   • Grants ECR push/pull permissions for quiltdata/lambdas/tabulator

2. ✅ IAM Role: GitHub-Testing-Tabulator

   • ARN: arn:aws:iam::712023778557:role/github/GitHub-Testing-Tabulator
   • Authenticated via OIDC from repo:quiltdata/tabulator:*
   • Attached Policy: TabulatorECRAccess

3. ✅ CloudFormation Output: TestingRoleTabulator

   • Provides role ARN for GitHub Actions workflows

Status

• ✅ Stack deployment: UPDATE_COMPLETE (2025-12-15)
• ✅ Role verified and accessible
• ✅ Policy attached and validated

Next Steps

This action is now ready to use! Once this PR is merged, the tabulator dev workflow can use it with:

- uses: quiltdata/gh-actions/lambda-deploy-ecr-staging@main
  with:
    dockerfile-path: Dockerfile
    docker-context-path: .
    name: tabulator
    image-tag: ${{ steps.tag.outputs.tag_name }}

The workflow will authenticate using the deployed IAM role and push images to staging ECR.

Related

• Infrastructure PR: quiltdata/infra-templates#30 (merged to staging)
• Workflow PR: quiltdata/tabulator#105 (ready to test)

🤖 Infrastructure deployed and verified

[sir-sigurd]

maybe we need only to add a debug flag or something like that instead of creating new action?