ci: split Lambda layer publish credentials by region

[zhongkechen]

Summary

• resolve Lambda layer publish targets into credential-scoped matrix jobs
• use one role ARN secret per opt-in commercial Region, one China secret for both China Regions, and one GovCloud secret for both GovCloud Regions
• configure the China OIDC audience, validate manual Region overrides, and document the required secret names
• retain the universal layer artifact introduced on current main

Testing

• python -m pytest .github/scripts/tests/test_resolve_layer_publish_targets.py .github/scripts/tests/test_lambda_layer_publish_workflow.py .github/scripts/tests/test_build_lambda_layer.py .github/scripts/tests/test_parse_sdk_branch.py .github/scripts/tests/test_resolve_layer_sdk_version.py (18 passed)
• Ruff lint and format checks
• actionlint .github/workflows/lambda-layer-publish.yml .github/workflows/test-parser.yml

[github-actions]

Codex AI review

[P1] Resolve the environment-scoped variable from an environment job

vars.LAYER_PUBLISH_REGIONS is now evaluated in build-distributions, which does not target the lambda-layer-publish environment. Environment-level variables are unavailable there, so release runs will see an empty value and silently select every credential group, potentially publishing to unintended Regions or failing on missing role secrets. Resolve targets in a job bound to that environment and pass its output to the matrix, or move the variable to repository/organization scope and update the documentation accordingly.

[github-actions]

Codex AI review

One blocking workflow regression found. The static YAML tests do not cover GitHub environment-variable scoping.

Reviewed commit 7f6e60f7fb38ba38bdedbdcfef666ba386a7e545. Workflow run

[github-actions]

Claude AI review

No blocking findings. This is a CI-only change that splits Lambda layer publishing into a credential-scoped matrix; it touches no SDK runtime code, so replay/determinism/serialization semantics are not affected.

The new resolve_layer_publish_targets.py is deterministic (group iteration order is preserved; the request set is used only for membership), rejects unsupported regions, and emits compact single-line JSON that is safe for $GITHUB_OUTPUT and fromJSON. Because command substitution runs under the default bash -eo pipefail, an invalid manual regions override correctly fails the resolve step. Dynamic secrets[matrix.publish_target.role_secret] indexing and the audience input are valid for configure-aws-credentials@v6, and each partition's fixed aws_region correctly seeds STS for cross-region publishing within that partition. Tests cover the default target set, region filtering, unsupported-region rejection, matrix serialization, and the no-duplicate-region invariant; the docs and opt-in list are consistent with the script.

Residual operational risk (not a code defect): the removed DEFAULT_LAYER_REGIONS fallback previously scoped the default (unset LAYER_PUBLISH_REGIONS) run to commercial + opt-in regions only. The default now returns every configured group, including the China and GovCloud partitions (.github/scripts/resolve_layer_publish_targets.py:109-121). On the first otel-v release after merge, if vars.LAYER_PUBLISH_REGIONS is unset and the LAYER_PUBLISH_ROLE_ARN_CHINA / LAYER_PUBLISH_ROLE_ARN_US_GOV (and per-opt-in-region) secrets are not yet configured, those matrix jobs will fail at "Configure AWS credentials" (empty role-to-assume). With fail-fast: false the commercial layers still publish, but the overall workflow reports failure. Confirm all per-region/per-partition role ARN secrets are provisioned before the first release, or set LAYER_PUBLISH_REGIONS to the ready subset.

Reviewed commit 7f6e60f7fb38ba38bdedbdcfef666ba386a7e545. Workflow run