Fix CDK imports and add GitHub Actions deployment workflow

[Copilot]

CDK stacks had broken imports preventing cdk synth from running, plus missing CI/CD pipeline for deployment.

CDK Fixes

• Import paths: Fixed module resolution in app.py (cdk.cdk.* → cdk.*) and stack files (config → cdk.config)
• Deprecated APIs: Updated ECR_API → ECR for VPC endpoints, from_ecr() → from_ecr_image() for Lambda code

GitHub Actions Workflow

Added .github/workflows/cdk-deploy.yml:

• Triggers on cdk/** changes to main (push/PR) + manual dispatch
• Uses OIDC authentication via aws-actions/configure-aws-credentials@v4
• Runs cdk synth always, cdk diff on PRs, cdk deploy --all on merge to main

Setup Required

1. Create IAM role with GitHub OIDC trust
2. Add AWS_ROLE_ARN secret to repository
3. Optionally set AWS_REGION variable (defaults to us-east-1)

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• cli.cdk.dev-tools.aws.dev
  • Triggering command: /usr/local/bin/node node /usr/local/bin/cdk synth --no-staging (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

Review my CDK code.

Use github actions to deploy my cdk stacks

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.