Add auto-deploy for grafana-proxy CloudFront Function

[wdvr]

Summary

• Adds a GitHub Actions workflow to automatically deploy the grafana-proxy CloudFront Function when aws/cloudfront/grafana-proxy/viewer-response.js is updated
• Follows the existing Lambda deployment pattern: OIDC auth, path-filtered trigger, AWS CLI deploy
• Replaces manual CloudFront Console deployment with CI/CD

Prerequisites

An IAM role gha_deploy_cloudfront_grafana_proxy needs to be created in account 308535385114 with permissions:

• cloudfront:DescribeFunction
• cloudfront:UpdateFunction
• cloudfront:PublishFunction

The role needs a trust policy allowing GitHub Actions OIDC from pytorch/test-infra.

How it works

On push to main affecting aws/cloudfront/grafana-proxy/**:

1. Assumes the deploy role via OIDC
2. Gets the current function ETag
3. Updates the function code (DEVELOPMENT stage)
4. Publishes to LIVE stage

Test plan

• Create the IAM role with the required permissions
• Verify workflow triggers correctly on a test push
• Confirm CloudFront Function is updated in AWS Console after deploy

[vercel]

Someone is attempting to deploy a commit to the Meta Open Source Team on Vercel.

A member of the Team first needs to authorize it.