wip: inital set of shared actions

.github/actions/aws-lambda-update/README.md

@@ -0,0 +1,50 @@
+# aws-lambda-update
+
+Update Lambda function alias to a new version, optionally wait for provisioned concurrency.
+
+## Inputs
+
+| Input | Required | Default | Description |
+|-------|----------|---------|-------------|
+| `function-name` | Yes | | Lambda function name |
+| `function-version` | Yes | | Lambda version number |
+| `alias-name` | Yes | | Alias name |
+| `aws-role-arn` | Yes | | IAM role via OIDC |
+| `wait-provisioned-concurrency` | No | `false` | Poll until provisioned concurrency is READY |
+| `aws-profile` | No | `default` | AWS CLI profile name |
+| `region` | No | `eu-central-1` | AWS region |
+| `lambda-alias-updates-json` | No | `""` | JSON array of `{function_name, version, alias_name}` objects for batch updates |
+
+## Usage
+
+```yaml
+- uses: schmalz/shared-actions/.github/actions/aws-lambda-update@v1
+  with:
+    function-name: my-function
+    function-version: "42"
+    alias-name: live
+    aws-role-arn: ${{ secrets.AWS_ROLE_ARN }}
+    wait-provisioned-concurrency: "true"
+```
+
+### Batch update
+
+```yaml
+- uses: schmalz/shared-actions/.github/actions/aws-lambda-update@v1
+  with:
+    function-name: unused
+    function-version: "0"
+    alias-name: unused
+    aws-role-arn: ${{ secrets.AWS_ROLE_ARN }}
+    lambda-alias-updates-json: |
+      [
+        {"function_name": "fn-a", "version": "3", "alias_name": "live"},
+        {"function_name": "fn-b", "version": "7", "alias_name": "live"}
+      ]
+```
+
+## Notes
+
+- When `lambda-alias-updates-json` is set, the single-alias inputs (`function-name`, `function-version`, `alias-name`) are ignored.
+- Provisioned concurrency polling checks every 5 seconds and fails the step if status becomes `FAILED`.
+- Uses `aws-configure` internally for OIDC authentication.