ci: add workflow to invalidate CloudFront after a CLI release

.github/workflows/cloudfront.yaml

@@ -0,0 +1,61 @@
+name: CloudFront invalidation
+
+on:
+  workflow_dispatch:
+
+permissions:
+  id-token: write
+
+concurrency:
+  group: cloudfront-invalidate-production
+  cancel-in-progress: false
+
+jobs:
+  invalidate:
+    if: github.repository == 'crossplane/cli' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    env:
+      INVALIDATIONS: ${{ secrets.CLOUDFRONT_INVALIDATIONS }}
+    steps:
+      - name: Validate configuration
+        run: |
+          echo "$INVALIDATIONS" | jq -e '
+            type == "object" and length > 0 and
+            all(to_entries[];
+              (.key | test("^E[A-Z0-9]{8,20}$")) and
+              (.value | type == "array" and length > 0 and all(.[]; type == "string" and startswith("/"))))
+          ' > /dev/null || {
+            echo "::error::CLOUDFRONT_INVALIDATIONS must be a JSON object of distribution ID -> non-empty list of paths starting with '/'"
+            exit 1
+          }
+
+      - name: Configure AWS credentials (OIDC)
+        uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
+        with:
+          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
+          role-session-name: gha-${{ github.run_id }}-${{ github.run_attempt }}
+          aws-region: us-east-1
+
+      - name: Create invalidations
+        run: |
+          echo "### CloudFront invalidations" >> "$GITHUB_STEP_SUMMARY"
+          : > invalidations.txt
+          for DIST in $(echo "$INVALIDATIONS" | jq -r 'keys[]'); do
+            echo "::add-mask::$DIST"
+            mapfile -t PATHS < <(echo "$INVALIDATIONS" | jq -r --arg d "$DIST" '.[$d][]')
+            ID=$(aws cloudfront create-invalidation \
+              --distribution-id "$DIST" \
+              --paths "${PATHS[@]}" \
+              --query 'Invalidation.Id' \
+              --output text)
+            echo "$DIST $ID" >> invalidations.txt
+            echo "Created $ID on $DIST (${#PATHS[@]} paths)"
+          done
+
+      - name: Wait for all invalidations
+        run: |
+          while read -r DIST ID; do
+            aws cloudfront wait invalidation-completed --distribution-id "$DIST" --id "$ID"
+            echo "- \`$ID\` OK" >> "$GITHUB_STEP_SUMMARY"
+          done < invalidations.txt