ci: add preview tarball workflow

[Hweinstock]

Description

Add a GitHub Actions workflow that builds and publishes a prerelease tarball (with bundled CDK constructs) on every push to main. The release is tagged prerelease and updated in-place. Also supports workflow_dispatch for manually pulling in latest CDK changes.

Related Issue

N/A

Documentation PR

N/A

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Other (please describe):

Testing

How have you tested the change?

• I ran npm run test:unit and npm run test:integ
• I ran npm run typecheck
• I ran npm run lint
• If I modified src/assets/, I ran npm run test:update-snapshots and committed the updated snapshots

Workflow-only change — validated YAML syntax locally.

Checklist

• I have read the CONTRIBUTING document
• I have added any necessary tests that prove my fix is effective or my feature works
• I have updated the documentation accordingly
• I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
• My changes generate no new warnings
• Any dependent changes have been merged and published

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the
terms of your choice.

[github-actions]

Package Tarball

aws-agentcore-0.14.2.tgz

How to install

gh release download pr-1349-tarball --repo aws/agentcore-cli --pattern "*.tgz" --dir /tmp/pr-tarball
npm install -g /tmp/pr-tarball/aws-agentcore-0.14.2.tgz

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-cli-automation]

Workflow looks reasonable overall, but there are a few things that should be sorted out before merging. Main concerns:

1. The workflow depends on a GitHub App (vars.APP_ID / secrets.APP_PRIVATE_KEY) that no other workflow in the repo references — if those aren't configured at the repo/org level, every run on main will fail. It's also unclear why an App token is needed when pr-tarball.yml uses the default ${{ github.token }} for the same gh release create flow.
2. The delete-then-recreate sequence for the prerelease tag opens a multi-minute window where the download URL 404s for users (the upload of the bundled tarball isn't trivial). Worth using gh release upload --clobber to swap the asset on an existing release instead.
3. The Node version (22.x) doesn't match the 20.x used by pr-tarball.yml and the main job in release.yml, so the prerelease tarball won't be built/packed under the same Node as the official release.

None of these are deep changes — leaving inline comments with specifics.

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)