feat(ci): synth-per-variant build with github:* context in artifact

[scottschreckengaust]

Summary

• Adds strategy.matrix with variant: [agentcore] to the build job
• Generates cdk/cdk.context.json before build with all 13 github:* tags, computeVariant, and stackName — CDK reads this automatically during synth, baking tags into CloudFormation templates
• Resolves tag values per event type (pull_request, merge_group, push, workflow_dispatch) using intermediate env vars to prevent script injection (CWE-78)
• Uploads cdk/cdk.out/ + cdk/cdk.context.json as immutable artifact (cdk-<variant>-out) for downstream deploy.yml
• Adds /cdk/cdk-*.out/ to .gitignore

How it works

build.yml:
  Resolve github:* → Generate cdk.context.json → mise run build (synth reads context) → Upload artifact
                                                                                              ↓
deploy.yml (future):                                                     Download artifact → cdk deploy --app cdk.out

CDK's Tags.of(stack).add() in main.ts calls app.node.tryGetContext('github:sha') etc. during synthesis. The values come from cdk.context.json, so they are baked directly into the template's resource Tags arrays. No context flags needed at deploy time.

Context values generated

Key	Source (pull_request)	Source (merge_group)	Source (push)
github:sha	PR head SHA	merge group head SHA	commit SHA
github:ref	head branch	base ref (target)	ref name
github:ref-type	branch	branch	branch or tag
github:actor	github.actor	github.actor	github.actor
github:head-ref	source branch	queue branch	empty
github:base-ref	target branch	target branch	empty
github:pr-number	PR number	extracted from queue ref	empty
github:run-id	github.run_id	github.run_id	github.run_id
github:run-attempt	github.run_attempt	github.run_attempt	github.run_attempt
github:event	github.event_name	github.event_name	github.event_name
github:workflow	github.workflow	github.workflow	github.workflow
github:repository	github.repository	github.repository	github.repository
github:clean	true	true	true

Local verification

$ jq -n '{...}' > cdk/cdk.context.json && cd cdk && npx cdk synth -q
$ jq '[ .. | objects | .Tags? // empty | arrays | .[] | select(.Key? | startswith("github:")) ] | unique_by(.Key)' cdk.out/*.template.json
→ All 13 tags present, 132/299 resources tagged (all taggable resources)

Follow-ups

• Additional variants (ecs, eks) added to matrix when compute paths are implemented
• deploy.yml downloads the artifact and runs cdk deploy --app cdk.out — no re-synthesis needed

Test plan

• CI build passes with matrix strategy (build (agentcore))
• cdk-agentcore-out artifact appears in workflow run (contains cdk.out/ + cdk.context.json)
• Mutation check passes (cdk.context.json is gitignored)
• Local synth confirms all 13 github:* tags baked into CloudFormation template
• Semgrep passes — no script injection (all GitHub context via env: + jq --arg)

Refs: #73, #84, #93

🤖 Generated with Claude Code