[IT-3891] Refactor CI

Refactor Github CI to deploy to multiple environments (dev, stage, prod).

This enforces the following workflow..
1. Create PR from the git dev branch
2. PR is reviewed and approved
3. PR is merged
4. CI deploys changes to the dev environment (dev.openchallenges.io)
   in the org-sagebase-openchallenges-dev account.
5. Changes are promoted (or merged) to the git stage branch.
6. CI deploys changes to the stage environment (stage.openchallenges.io)
   in the org-sagebase-openchallenges-prod account.
6. Changes are promoted (or merged) to the git prod branch.
7. CI deploys changes to the prod environment (prod.openchallenges.io)
   in the org-sagebase-openchallenges-prod account.

.github/workflows/aws-deploy.yaml

@@ -0,0 +1,58 @@
+# reusable template for deployments to AWS accounts
+name: aws-deploy
+
+# Ensures that only one deploy task per branch/environment will run at a time.
+concurrency:
+  group: ${{ inputs.environment }}
+  cancel-in-progress: false
+
+on:
+  workflow_call:
+    inputs:
+      aws-region:
+        type: string
+        default: us-east-1
+      role-to-assume:
+        required: true
+        type: string
+      role-session-name:
+        required: true
+        type: string
+      role-duration-seconds:
+        type: number
+        default: 1200
+      environment:
+        required: true
+        type: string
+        default: "dev"
+      secrets-location:
+        type: string
+        default: "local"
+
+jobs:
+  deploy:
+    permissions:
+      id-token: write
+      contents: read
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v3
+      - name: Install AWS CLI
+        run: sudo snap install aws-cli --classic
+      - name: Install AWS CDK CLI
+        run: npm install -g aws-cdk
+      - name: Install python dependencies
+        run: pip install -r requirements.txt -r requirements-dev.txt
+      - name: Assume AWS Role
+        uses: aws-actions/configure-aws-credentials@v2
+        with:
+          aws-region: ${{ inputs.aws-region }}
+          role-to-assume: ${{ inputs.role-to-assume }}
+          role-session-name: ${{ inputs.role-session-name }}
+          role-duration-seconds: ${{ inputs.role-duration-seconds }}
+      - name: CDK deploy
+        run: cdk deploy --all --require-approval never
+        env:
+          ENV: ${{ inputs.environment }}
+          SECRETS: ${{ inputs.secrets-location }}

.github/workflows/deploy-dev.yaml

@@ -0,0 +1,19 @@
+name: deploy-dev
+
+on:
+  workflow_run:
+    workflows:
+      - check
+    types:
+      - completed
+    branches:
+      - dev
+
+jobs:
+  deploy:
+    uses: "./.github/workflows/aws-deploy.yaml"
+    with:
+      role-to-assume: "arn:aws:iam::221082174873:role/sagebase-github-oidc-openchallenges-deploy"
+      role-session-name: ${{ github.repository_owner }}-${{ github.event.repository.name }}-${{ github.run_id }}
+      environment: ${{ github.head_ref || github.ref_name }}
+      secrets-location: "ssm"

.github/workflows/deploy-prod.yaml

@@ -0,0 +1,19 @@
+name: deploy-prod
+
+on:
+  workflow_run:
+    workflows:
+      - check
+    types:
+      - completed
+    branches:
+      - prod
+
+jobs:
+  deploy:
+    uses: "./.github/workflows/aws-deploy.yaml"
+    with:
+      role-to-assume: "arn:aws:iam::221082174873:role/sagebase-github-oidc-openchallenges-deploy"
+      role-session-name: ${{ github.repository_owner }}-${{ github.event.repository.name }}-${{ github.run_id }}
+      environment: ${{ github.head_ref || github.ref_name }}
+      secrets-location: "ssm"

.github/workflows/deploy-stage.yaml

@@ -0,0 +1,19 @@
+name: deploy-stage
+
+on:
+  workflow_run:
+    workflows:
+      - check
+    types:
+      - completed
+    branches:
+      - stage
+
+jobs:
+  deploy:
+    uses: "./.github/workflows/aws-deploy.yaml"
+    with:
+      role-to-assume: "arn:aws:iam::221082174873:role/sagebase-github-oidc-openchallenges-deploy"
+      role-session-name: ${{ github.repository_owner }}-${{ github.event.repository.name }}-${{ github.run_id }}
+      environment: ${{ github.head_ref || github.ref_name }}
+      secrets-location: "ssm"