Add the deploy workflow for the log uploader lambdas

.github/workflows/gha-log-uploader-lambda.yml

@@ -0,0 +1,76 @@
+name: Test and deploy gha-log-uploader
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - ".github/workflows/gha-log-uploader-lambda.yml"
+      - "aws/lambda/gha-log-uploader/**"
+  pull_request:
+    paths:
+      - ".github/workflows/gha-log-uploader-lambda.yml"
+      - "aws/lambda/gha-log-uploader/**"
+
+defaults:
+  run:
+    working-directory: aws/lambda/gha-log-uploader/
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: '3.12'
+          cache: pip
+      - run: pip3 install -r requirements.txt pytest==7.4.0
+      - run: pytest -v test_lambda_function.py
+      # Build the deployment package too. `prepare` resolves manylinux wheels for
+      # the lambda's platform rather than the runner's, and `verify` refuses a zip
+      # that is missing a vendored module -- neither of which the plain install
+      # above exercises. Without this a bad requirements.txt only fails at deploy
+      # time, which is to say on main.
+      - run: make prepare
+
+  deploy:
+    needs: test
+    runs-on: ubuntu-latest
+    if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
+    permissions:
+      id-token: write
+      contents: read
+    # Serialise deploys: two merges in quick succession would otherwise race on
+    # update-function-code, and if the older run finishes last the function is
+    # left on the older commit. Queue rather than cancel -- cancelling a deploy
+    # mid-flight is worse than waiting for it.
+    concurrency:
+      group: ${{ github.workflow }}-deploy
+      cancel-in-progress: false
+    steps:
+      - name: configure aws credentials
+        uses: aws-actions/configure-aws-credentials@67fbcbb121271f7775d2e7715933280b06314838 # v1.7.0
+        with:
+          role-to-assume: arn:aws:iam::308535385114:role/gha_workflow_gha-log-uploader-lambda
+          aws-region: us-east-1
+
+      - name: Check out test infra
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Setup python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+
+      - uses: nick-fields/retry@3e91a01664abd3c5cd539100d10d33b9c5b68482 # v2.8.2
+        name: Setup dependencies
+        with:
+          shell: bash
+          timeout_minutes: 10
+          max_attempts: 3
+          retry_wait_seconds: 30
+          command: |
+            set -eux
+            python3 -m pip install awscli==1.45.39
+
+      - name: Deploy the lambda
+        run: make deploy