Let’s keep our own pantry tarball (#5172)

.github/workflows/cd.yml

@@ -35,3 +35,22 @@ jobs:
     with:
       projects: ${{ needs.ingest.outputs.projects }}
     secrets: inherit
+
+  tarball:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: us-east-1
+
+      - uses: actions/checkout@v4
+      - run: find . -not -name package.yml -delete
+      - run: tar -czf pantry.tgz .
+      - run: aws s3 cp
+          ./pantry.tgz
+          s3://${{ secrets.AWS_S3_BUCKET }}/pantry.tgz
+      - run: aws cloudfront create-invalidation
+          --distribution-id ${{ secrets.AWS_CF_DISTRIBUTION_ID }}
+          --paths /pantry.tgz