core public build pipelines release

Author: swansong314

.github/actions/create-aws-template/README.md

@@ -0,0 +1,43 @@
+
+## Create AWS Template (`actions/create-aws-template`)
+
+### Overview
+
+This action acts as the template compiler for our CloudFormation infrastructure. It takes a generic, region-agnostic meta-template and a JSON RegionMap, merges them using `jq`, and produces a valid, deployable CloudFormation JSON artifact.
+
+### The Workflow
+
+1. **Dependency Verification:** Ensures `jq` is installed on the runner.
+2. **Region Map Injection:** Reads the provided `region_map` string and injects it into the `.Mappings.RegionMap` block of the source meta-template. This overrides any placeholder mappings.
+3. **Lambda Code Injection:** For each entry in `lambda_injections`, reads the source file and injects its contents into `.Resources[<ResourceName>].Properties.Code.ZipFile`. Errors if the resource is missing from the template or the source file does not exist.
+4. **Artifact Publishing:** Uploads the newly generated CloudFormation template as a GitHub Actions artifact for downstream jobs (like deployment or release aggregation) to consume.
+
+### Inputs & Outputs
+
+| Input | Required | Description |
+| --- | --- | --- |
+| `region_map` | Yes | The JSON string containing region-to-AMI mappings. |
+| `output_filename` | Yes | The desired filename for the compiled template. |
+| `artifact_name` | Yes | The name to assign the uploaded GitHub Actions artifact (passed straight to `upload-artifact`'s `name`). This is an artifact label, not a filesystem path. |
+| `metatemplate_file_path` | Yes | Relative path to the source JSON meta-template. |
+| `lambda_injections` | No | JSON object mapping Lambda resource logical IDs to source files to embed. Defaults to `'{}'`. |
+
+### Example Usage
+
+```yaml
+- name: Generate CloudFormation Template
+  uses: mathworks-ref-arch/iac-building-blocks/.github/actions/create-aws-template@main
+  with:
+    region_map: '{"us-east-1": {"AMI": "ami-0123456789abcdef0"}}'
+    output_filename: 'R2025a-release-template.json'
+    artifact_name: 'R2025a-release-template'
+    metatemplate_file_path: 'src/meta-template.json'
+    lambda_injections: '{"AttachInstanceProfileLambda": "src/attachinstanceprofile.py"}'
+
+```
+
+----
+
+Copyright 2026 The MathWorks, Inc.
+
+----

.github/actions/create-aws-template/action.yml

@@ -0,0 +1,103 @@
+# Copyright 2026 The MathWorks, Inc.
+name: 'Create AWS Template'
+description: 'Generates a CloudFormation template by injecting a RegionMap.'
+
+inputs:
+  region_map:
+    description: 'JSON object string for RegionMap'
+    required: true
+  output_filename:
+    description: 'Filename for the generated template'
+    required: true
+  artifact_name:
+    description: 'Name to assign the uploaded GitHub Actions artifact (an artifact label, not a filesystem path)'
+    required: true
+  metatemplate_file_path:
+    description: 'Path to the source JSON meta-template file'
+    required: true
+  lambda_injections:
+    description: |
+      JSON object mapping Lambda resource logical IDs in the template to
+      source files whose contents are injected into Code.ZipFile.
+      Example: '{"AttachInstanceProfileLambda": "src/attachinstanceprofile.py"}'
+      Pass '{}' or omit when the template has no Lambda code to inject.
+    required: false
+    default: '{}'
+
+runs:
+  using: "composite"
+  steps:
+    - name: Generate Template
+      shell: bash
+      env:
+        TEMPLATE: ${{ inputs.metatemplate_file_path }}
+        REGION_MAP: ${{ inputs.region_map }}
+        OUT_NAME: ${{ inputs.output_filename }}
+        LAMBDA_INJECTIONS: ${{ inputs.lambda_injections }}
+      run: |
+        if ! command -v jq &> /dev/null; then
+            echo "jq not found, installing..."
+            # Retry to ride out transient dpkg/apt lock contention on the runner.
+            for i in 1 2 3 4 5; do
+                sudo apt-get update && sudo apt-get install -y jq && break
+                echo "apt-get failed (attempt $i), retrying in 10s..."
+                sleep 10
+            done
+        fi
+        if ! command -v jq &> /dev/null; then
+            echo "::error::Failed to install jq"
+            exit 1
+        fi
+
+        if [ -z "$REGION_MAP" ]; then
+            echo "::error::region_map input is empty"
+            exit 1
+        fi
+        if [ ! -f "$TEMPLATE" ]; then
+            echo "::error::Meta-template not found at: $TEMPLATE"
+            exit 1
+        fi
+        if ! echo "$REGION_MAP" | jq empty 2>/dev/null; then
+            echo "::error::region_map is not valid JSON: $REGION_MAP"
+            exit 1
+        fi
+
+        echo "Injecting Region Map into template..."
+        echo "$REGION_MAP" > region_map_temp.json
+
+        jq --slurpfile map region_map_temp.json \
+           '.Mappings.RegionMap = $map[0]' \
+           "$TEMPLATE" > "$OUT_NAME"
+
+        rm region_map_temp.json
+
+        INJECTIONS="${LAMBDA_INJECTIONS:-{\}}"
+        if ! echo "$INJECTIONS" | jq -e 'type == "object"' >/dev/null 2>&1; then
+            echo "::error::lambda_injections is not a valid JSON object: $INJECTIONS"
+            exit 1
+        fi
+
+        while IFS=$'\t' read -r resource code_file; do
+            [ -z "$resource" ] && continue
+            if [ ! -f "$code_file" ]; then
+                echo "::error::Lambda code file not found for $resource: $code_file"
+                exit 1
+            fi
+            if ! jq -e --arg r "$resource" '.Resources[$r]' "$OUT_NAME" >/dev/null; then
+                echo "::error::Resource $resource not found in template $OUT_NAME"
+                exit 1
+            fi
+            echo "Injecting Lambda code into $resource from $code_file..."
+            jq --arg r "$resource" --rawfile code "$code_file" \
+               '.Resources[$r].Properties.Code.ZipFile = $code' \
+               "$OUT_NAME" > "${OUT_NAME}.tmp"
+            mv "${OUT_NAME}.tmp" "$OUT_NAME"
+        done < <(echo "$INJECTIONS" | jq -r 'to_entries[] | "\(.key)\t\(.value)"')
+
+        echo "Generated: $OUT_NAME"
+
+    - name: Upload Artifact
+      uses: actions/upload-artifact@v5
+      with:
+        name: ${{ inputs.artifact_name }}
+        path: ${{ inputs.output_filename }}

.github/actions/deploy-cfn/README.md

@@ -0,0 +1,51 @@
+
+## Deploy CFN (`actions/deploy-cfn`)
+
+### Overview
+
+This action deploys an ephemeral CloudFormation stack for integration and smoke testing. To avoid massive, brittle conditional blocks in our workflow YAMLs, this action utilizes a "Flavor Mapping" pattern. It dynamically constructs CloudFormation parameters based on the specific architecture being deployed (e.g., Linux vs. Windows, Single Node vs. Parallel Server).
+
+### The Workflow
+
+1. **Type Resolution:** Reads `refarch-type-mappings.json` to lookup the default parameter values and variable names (like identifying whether to use `SSHKeyName` or `RDPKeyName`) for the requested `refarch_type`.
+2. **Dynamic Parameter Injection:** Fetches the GitHub Runner's current IP address and injects it, along with standard inputs (VPC, Subnet, SSH Key), into a generated `params.json` file.
+3. **Execution:** Triggers `aws cloudformation create-stack` and blocks until the `stack-create-complete` signal is received.
+4. **Data Retrieval:** Parses the final CloudFormation stack outputs into a flattened JSON key-value string.
+
+### Inputs & Outputs
+
+| Input | Required | Description |
+| --- | --- | --- |
+| `compiled_template_file_path` | Yes | Path to the already-compiled CloudFormation template. |
+| `refarch_type` | Yes | Target deployment architecture type matching a key in `refarch-type-mappings.json`. |
+| `region` | Yes | AWS region to deploy the stack into. |
+| `stack_name` | Yes | Unique identifier for the temporary stack. |
+| `vpc_id` / `subnet_id` | Yes | Network configuration for the deployment. |
+| `key_pair_name` | Yes | Name of the pre-provisioned AWS EC2 key pair for access. |
+
+**Outputs:**
+
+* `stack_outputs`: A flat JSON string of the CloudFormation stack outputs (e.g., `{"HeadnodePublicDNS": "ec2-...", "RDPConnection": "..."}`).
+
+### Example Usage
+
+```yaml
+- name: Deploy Ephemeral Stack
+  id: deploy
+  uses: mathworks-ref-arch/iac-building-blocks/.github/actions/deploy-cfn@main
+  with:
+    compiled_template_file_path: './R2025a-test-template.json'
+    refarch_type: 'matlab-linux'
+    region: 'us-east-1'
+    stack_name: 'smoke-test-matlab-linux-R2025a-${{ github.run_id }}'
+    vpc_id: 'vpc-0abcd1234'
+    subnet_id: 'subnet-0abcd1234'
+    key_pair_name: 'smoke-test-key'
+
+```
+
+----
+
+Copyright 2026 The MathWorks, Inc.
+
+----

.github/actions/deploy-cfn/action.yml

@@ -0,0 +1,154 @@
+# Copyright 2026 The MathWorks, Inc.
+name: 'Deploy CloudFormation Stack'
+description: 'Downloads template, maps parameters, and deploys stack'
+
+inputs:
+  compiled_template_file_path:
+    description: "Path to the already-compiled CloudFormation template to deploy"
+    required: true
+  refarch_type:
+    description: "Deployment architecture type (e.g., ps-linux, matlab-linux)"
+    required: true
+  region:
+    description: "AWS region to deploy the stack into"
+    required: true
+  stack_name:
+    description: "Unique name for the temporary CloudFormation stack"
+    required: true
+  vpc_id:
+    description: "VPC to deploy the stack into"
+    required: true
+  subnet_id:
+    description: "Subnet to deploy the stack into"
+    required: true
+  key_pair_name:
+    description: "Name of the pre-provisioned AWS EC2 key pair for instance access"
+    required: true
+
+outputs:
+  stack_outputs:
+    description: "JSON string of stack outputs"
+    value: ${{ steps.outputs.outputs.STACK_OUTPUTS }}
+
+runs:
+  using: "composite"
+  steps:
+    - name: Validate Inputs
+      shell: bash
+      env:
+        REFARCH_TYPE: ${{ inputs.refarch_type }}
+        CONFIG_FILE: "${{ github.action_path }}/refarch-type-mappings.json"
+      run: |
+        if [ ! -f "$CONFIG_FILE" ]; then
+          echo "::error::refarch-type-mappings.json not found at $CONFIG_FILE"
+          exit 1
+        fi
+        if ! jq -e ".\"$REFARCH_TYPE\"" "$CONFIG_FILE" > /dev/null 2>&1; then
+          AVAILABLE=$(jq -r 'keys | join(", ")' "$CONFIG_FILE")
+          echo "::error::Unknown refarch_type '$REFARCH_TYPE'. Available types: $AVAILABLE"
+          exit 1
+        fi
+
+    - name: Get Runner Public IP
+      id: get-ip
+      shell: bash
+      run: |
+        IP=$(curl -fsS --retry 3 --max-time 10 https://checkip.amazonaws.com | tr -d '[:space:]')
+        if ! [[ "$IP" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+          echo "::error::Failed to resolve runner public IPv4 (got: '$IP')"
+          exit 1
+        fi
+        echo "ipv4=$IP" >> "$GITHUB_OUTPUT"
+
+    - name: Generate Stack Password
+      id: gen-password
+      shell: bash
+      run: |
+        # Build a 20-char password that satisfies all known MATLAB / NLM regexes:
+        # >=14 chars, includes upper, lower, digit, and special character.
+        UPPER=$(LC_ALL=C tr -dc 'A-Z' < /dev/urandom | head -c1)
+        LOWER=$(LC_ALL=C tr -dc 'a-z' < /dev/urandom | head -c1)
+        DIGIT=$(LC_ALL=C tr -dc '0-9' < /dev/urandom | head -c1)
+        SPECIAL=$(LC_ALL=C tr -dc '!@#%^_+=-' < /dev/urandom | head -c1)
+        REST=$(LC_ALL=C tr -dc 'A-Za-z0-9' < /dev/urandom | head -c16)
+        PASSWORD="${UPPER}${LOWER}${DIGIT}${SPECIAL}${REST}"
+        echo "::add-mask::$PASSWORD"
+        echo "password=$PASSWORD" >> "$GITHUB_OUTPUT"
+
+    - name: Prepare Parameters JSON
+      id: prep-params
+      shell: bash
+      env:
+        REFARCH_TYPE: ${{ inputs.refarch_type }}
+        VPC: ${{ inputs.vpc_id }}
+        SUBNET: ${{ inputs.subnet_id }}
+        KEY: ${{ inputs.key_pair_name }}
+        CLIENT_IP: "${{ steps.get-ip.outputs.ipv4 }}/32"
+        STACK_PASSWORD: ${{ steps.gen-password.outputs.password }}
+        CONFIG_FILE: "${{ github.action_path }}/refarch-type-mappings.json"
+      run: |
+        KEY_PARAM=$(jq -r ".\"$REFARCH_TYPE\".key_param" $CONFIG_FILE)
+        VPC_PARAM=$(jq -r ".\"$REFARCH_TYPE\".vpc_param" $CONFIG_FILE)
+        SUBNET_PARAM=$(jq -r ".\"$REFARCH_TYPE\".subnet_param" $CONFIG_FILE)
+        CLIENT_IP_PARAM=$(jq -r ".\"$REFARCH_TYPE\".client_ip_param" $CONFIG_FILE)
+
+        jq ".\"$REFARCH_TYPE\".defaults" $CONFIG_FILE > params.json
+
+        jq --arg k "$VPC_PARAM" --arg v "$VPC" '. += [{"ParameterKey": $k, "ParameterValue": $v}]' params.json > tmp.json && mv tmp.json params.json
+        jq --arg k "$SUBNET_PARAM" --arg v "$SUBNET" '. += [{"ParameterKey": $k, "ParameterValue": $v}]' params.json > tmp.json && mv tmp.json params.json
+        jq --arg k "$KEY_PARAM" --arg v "$KEY" '. += [{"ParameterKey": $k, "ParameterValue": $v}]' params.json > tmp.json && mv tmp.json params.json
+        jq --arg k "$CLIENT_IP_PARAM" --arg v "$CLIENT_IP" '. += [{"ParameterKey": $k, "ParameterValue": $v}]' params.json > tmp.json && mv tmp.json params.json
+
+        # Inject a random password for any template that asks for one. We
+        # set Password / ConfirmPassword (and never log them) so deployments
+        # do not rely on a hardcoded credential.
+        jq --arg pw "$STACK_PASSWORD" '
+          (.[] | select(.ParameterKey == "Password") | .ParameterValue) |= $pw
+          | (.[] | select(.ParameterKey == "ConfirmPassword") | .ParameterValue) |= $pw
+        ' params.json > tmp.json && mv tmp.json params.json
+
+        echo "Generated Parameters (passwords redacted by runner masking):"
+        cat params.json
+
+    - name: Deploy Stack
+      shell: bash
+      run: |
+        TEMPLATE_FILE="${{ inputs.compiled_template_file_path }}"
+        
+        if [[ ! -f "$TEMPLATE_FILE" ]]; then
+          echo "::error::Template file not found at $TEMPLATE_FILE"
+          exit 1
+        fi
+
+        aws cloudformation create-stack \
+          --stack-name ${{ inputs.stack_name }} \
+          --template-body file://"$TEMPLATE_FILE" \
+          --region ${{ inputs.region }} \
+          --capabilities CAPABILITY_NAMED_IAM CAPABILITY_AUTO_EXPAND \
+          --parameters file://params.json
+
+        echo "Waiting for stack creation..."
+        if ! aws cloudformation wait stack-create-complete \
+          --stack-name ${{ inputs.stack_name }} \
+          --region ${{ inputs.region }} 2>&1; then
+          echo "::error::CloudFormation stack creation failed for ${{ inputs.stack_name }}"
+          aws cloudformation describe-stack-events \
+            --stack-name ${{ inputs.stack_name }} \
+            --region ${{ inputs.region }} \
+            --query "StackEvents[?ResourceStatus=='CREATE_FAILED'].[LogicalResourceId,ResourceStatusReason]" \
+            --output table
+          exit 1
+        fi
+
+    - name: Retrieve Stack Outputs
+      id: outputs
+      shell: bash
+      run: |
+        # Get Outputs as a simplified JSON object { "OutputKey": "OutputValue" }
+        OUTPUTS=$(aws cloudformation describe-stacks \
+          --stack-name ${{ inputs.stack_name }} \
+          --region ${{ inputs.region }} \
+          --query "Stacks[0].Outputs" | \
+          jq -c 'reduce .[] as $item ({}; . + {($item.OutputKey): $item.OutputValue})')
+        
+        echo "STACK_OUTPUTS=$OUTPUTS" >> $GITHUB_OUTPUT