feat(upload-cdk-source): run on the node24 runtime, implemented in TypeScript

[joakimen]

Moves the action to the node24 runtime. Selects the CDK application's files, archives them with fflate and uploads with the AWS SDK, replacing a find | grep | zip pipeline and the aws CLI.

Unit tests now cover which files are selected and the metadata the pipeline reads.

Stacked on #267, which adds the shared archive and S3 modules this uses.

[aikido-pr-checks]

Potential file inclusion attack via reading file - high severity
If an attacker can control the input leading into the ReadFile function, they might be able to read sensitive files and launch further attacks with that information.

Show fix

Suggested change

	): Result<Uint8Array> => archive(root, names.map((name) => join(root, name)))
	): Result<Uint8Array> => {
	const resolvedRoot = path.resolve(root);
	const validatedPaths = names.map((name) => {
	const target = path.resolve(resolvedRoot, name);
	const relative = path.relative(resolvedRoot, target);
	if (relative.startsWith('..') || path.isAbsolute(relative)) {
	throw new Error('Invalid path');
	}
	return target;
	});
	return archive(root, validatedPaths);
	}

_{Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info}

[joakimen]

@AikidoSec ignore: reads a path the workflow author supplies, who already has code execution in the job;

[aikido-pr-checks]

✅ Based on your feedback, we ignored this issue because of the following reason:

reads a path the workflow author supplies, who already has code execution in the job;

[github-actions]

🎉 This PR is included in version 1.16.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀