Add CI that deploys and tests every Pulumi example

[HarshCasper]

The repo had no CI and no tests. Several examples could no longer deploy or did not work once deployed.

Tests

A new Makefile deploys one example with pulumilocal and a local Pulumi backend, then runs its test.sh: make install deploy test EXAMPLE=<example>. CI runs all 10 examples as a matrix.

Example	What test.sh checks
appsync-dynamodb	runs the existing Automation API tests in test_appsync.py (API exists, addTenant mutation, item in DynamoDB)
aws-apigateway-auth0	/hello returns 200 for Bearer goodToken, 404 for another token (awsx maps ACCESS_DENIED to 404), 401 without a token or without Bearer
aws-lambda-stepfunctions	an execution succeeds with output "Hello world!"
elastic-kubernetes-service	cluster and node group are ACTIVE, and kubectl sees Ready worker nodes
lambda-kinesis-firehose-es	a Function URL call is indexed in Elasticsearch through Kinesis and Firehose
lambda-layers	the layer version has its code and compatible runtimes, and is listed
s3-sqs-queues	a queued message is written to lastEvent.json by the subscribed Lambda
s3-static-website	the website endpoint serves index.html and favicon.png
serverless-rest-api	each route's count goes 1, 2, 3 and routes count separately
sns-sqs-subscription-lambda-trigger	a message published to SNS comes back on the result queue via SQS and Lambda

Fixes

• Dependencies: all examples move to @pulumi/aws / pulumi-aws v6. aws-apigateway-auth0 was on Pulumi 2, AWS 3 and awsx 0.24, and serverless-rest-api on awsx 0.40. Both now use awsx v2 through @pulumi/awsx/classic. TypeScript examples add typescript 5 as a dev dependency, so Pulumi stops falling back to its vendored TypeScript 3.8.
• Callback Lambdas used AWS SDK v2: s3-sqs-queues and serverless-rest-api call aws-sdk v2 inside callback functions. Pulumi's default runtime is now nodejs20.x, which ships only SDK v3, and Pulumi excludes aws-sdk from the bundle, so both functions failed at runtime. They now use @aws-sdk/client-s3 and @aws-sdk/lib-dynamodb.
• Authorizer never allowed a request: the aws-apigateway-auth0 authorizer read event.headers, which a TOKEN authorizer does not receive, so every request was denied. It now checks the bearer token with the file's existing getToken helper. The unused jsonwebtoken and jwks-rsa dependencies are removed.
• Deprecated runtimes: python3.7, 3.8 and 3.9 move to python3.12, and the layer's nodejs12/14 runtimes to nodejs20/22.
• Lambda packaging: sns-sqs-subscription-lambda-trigger and lambda-kinesis-firehose-es now package lambda.py directly. The README's manual zip step is gone. The committed lambda.zip in the Kinesis example held an older copy of the handler that used LOCALSTACK_HOSTNAME/EDGE_PORT.
• Firehose: s3Configuration moves into elasticsearchConfiguration, as AWS provider v6 requires.
• Account ID: make deploy sets aws:skipRequestingAccountId to false. pulumilocal sets it to true by default, so the provider built the SNS topic ARN with an empty account ID and LocalStack rejected GetTopicAttributes with '' is not a valid AWS account ID.
• Stack outputs: added the outputs the tests and READMEs use: topicArn, resultQueueUrl, functionUrl, esEndpoint.
• READMEs:
  • the root README documents the make targets
  • the SNS example's receive-message command was malformed
  • the Kinesis example used plain aws without an endpoint
  • the auth0 example now shows which tokens are allowed

Verified by CI only. Locally I only ran npm install and tsc --noEmit on the TypeScript examples.

https://claude.ai/code/session_01DZfDmzUBPqNAu3yFKyfCNM