feat: add parallel:matrix jobs support

To implement the **dynamic way**, your deployment script shall simply generate a `environment_url.txt` file in the working directory, containing only

the dynamically generated url. When detected by the template, it will use it as the newly deployed environment url.

### Multiple environments support

The AWS template allows deploying multiple environments in parallel. Use cases of this include:

- monorepo, where a single Git repository might host several separate deployable components or apps,

- multi-instances deployment of the same application.

This feature can be enabled using the [parallel matrix jobs](https://docs.gitlab.com/ee/ci/yaml/#parallelmatrix)

pattern at the `.aws-env-base` job level (this is the top parent job of all deployment jobs). 

Environments namespacing is ensured by the `AWS_ENVIRONMENT_NAMESPACE` variable (must start with a slash `/`).

Here is the example of the `.gitlab-ci.yml` file for a project deploying both a frontend and a backend applications:

```yaml

.aws-env-base:

  parallel:

    matrix:

      - AWS_ENVIRONMENT_NAMESPACE: "/front"

        # AWS deployment scripts are located in the ./front/ directory

        AWS_SCRIPTS_DIR: "front"

      - AWS_ENVIRONMENT_NAMESPACE: "/back"

        # AWS deployment scripts are located in the ./back/ directory

        AWS_SCRIPTS_DIR: "back"

# ⚠ on_stop must be unset when defining parallel:matrix environments

# see: https://gitlab.com/gitlab-org/gitlab/-/issues/332247

aws-review:

  environment:

    on_stop: null

```

The above configuration will deploy 2 environments on each pipeline:

- on feature branches: `review/front/$CI_COMMIT_REF_NAME` and `review/back/$CI_COMMIT_REF_NAME`

- on the integration branch: `integration/front` and `integration/back` 

- on the production branch: `staging/front` and `staging/back` (and finally `production/front` and `production/back`)

### Deployment output variables

Each deployment job produces _output variables_ that are propagated to downstream jobs (using [dotenv artifacts](https://docs.gitlab.com/ci/yaml/artifacts_reports/#artifactsreportsdotenv)):

You may also add and propagate your own custom variables, by pushing them to the `aws.env` file in your [deployment script](#deployment-and-cleanup-scripts).

> [!important]

> If [multiple environments](#multiple-environments-support) are configured, the output variables are prefixed with a 

> sluggified value of the `AWS_ENVIRONMENT_NAMESPACE` variable (stripped of punctuation characters and converted to lowercase):

> 

> * `<namespace_slug>_environment_type`: set to the type of environment (`review`, `integration`, `staging` or `production`),

> * `<namespace_slug>_environment_name`: the application name (see below),

> * `<namespace_slug>_environment_url`: set to the environment URL (whether determined statically or dynamically).

> 

> The output dotenv file will be `aws.env.<namespace_slug>` instead, and the dynamic variable `${environment_namespace}` can be used in your scripts and manifests to access the contextual value of `<namespace_slug>`.

## Configuration reference

### Secrets management

| `cli-image` / `AWS_CLI_IMAGE` | the Docker image used to run AWS CLI commands| `docker.io/amazon/aws-cli:latest` <br/>[![Trivy Badge](https://to-be-continuous.gitlab.io/doc/secu/trivy-badge-AWS_CLI_IMAGE.svg)](https://to-be-continuous.gitlab.io/doc/secu/trivy-AWS_CLI_IMAGE) |

| `base-app-name` / `AWS_BASE_APP_NAME` | Base application name                  | `$CI_PROJECT_NAME` ([see GitLab doc](https://docs.gitlab.com/ci/variables/predefined_variables/)) |

| `environment-url` / `AWS_ENVIRONMENT_URL`    | Default environments url _(only define for static environment URLs declaration)_<br/>_supports late variable expansion (ex: `https://%{environment_name}.aws.acme.com`)_ | _none_ |

| `environment-namespace` / `AWS_ENVIRONMENT_NAMESPACE` | Extra [GitLab environments](https://docs.gitlab.com/ci/environments/) namespace _(only required when deploying [multiple environments](#multiple-environments-support))_<br/>:warning: must start with a slash `/` | _none_ |

| `scripts-dir` / `AWS_SCRIPTS_DIR` | Directory where AWS scripts (deploy & cleanup) are located | `.` _(root project dir)_ |

### Review environments configuration

      "type": "url",

      "description": "The default environments url _(only define for static environment URLs declaration)_\n\n_supports late variable expansion (ex: `https://%{environment_name}.aws.acme.com`)_"

    },

    {

      "name": "AWS_ENVIRONMENT_NAMESPACE",

      "description": "Extra [GitLab environments](https://docs.gitlab.com/ci/environments/) namespace _(only required when deploying multiple environments)_\n\n:warning: must start with a slash `/`",

      "advanced": true

    },

    {

      "name": "AWS_SCRIPTS_DIR",

      "description": "Directory where AWS scripts (deploy & cleanup) are located",

  AWS_STAGING_OIDC_ROLE_ARN: $[[ inputs.staging-oidc-role-arn ]]

  AWS_PROD_OIDC_ROLE_ARN: $[[ inputs.prod-oidc-role-arn ]]

.aws-base:

.aws-env-base:

  id_tokens:

    AWS_JWT:

      aud: "$AWS_OIDC_AUD"

        _supports late variable expansion (ex: `https://%{environment_name}.aws.acme.com`)_

      default: ''

    environment-namespace:

      description: |-

        Extra [GitLab environments](https://docs.gitlab.com/ci/environments/) namespace _(only required when deploying multiple environments)_

        :warning: must start with a slash `/`

      default: ''

    scripts-dir:

      description: Directory where AWS scripts (deploy & cleanup) are located

      default: .

  INTEG_REF: /^develop$/

  AWS_ENVIRONMENT_URL: $[[ inputs.environment-url ]]

  AWS_ENVIRONMENT_NAMESPACE: $[[ inputs.environment-namespace ]]

  AWS_REVIEW_ENABLED: $[[ inputs.review-enabled ]]

  AWS_REVIEW_APP_NAME: $[[ inputs.review-app-name ]]

  AWS_REVIEW_ENVIRONMENT_URL: $[[ inputs.review-environment-url ]]

    export environment_type=$ENV_TYPE

    export environment_name=${ENV_APP_NAME:-${AWS_BASE_APP_NAME}${ENV_APP_SUFFIX}}

    environment_url=${ENV_URL:-$AWS_ENVIRONMENT_URL}

    environment_namespace=$(echo "$AWS_ENVIRONMENT_NAMESPACE" | tr -d '[:punct:]' | tr '[:upper:]' '[:lower:]')

    export environment_namespace

    # backward compatibility

    export env=$environment_type

    log_info "--- \$hostname: \\e[33;1m${hostname}\\e[0m"

    # unset any upstream deployment env & artifacts

    rm -f aws.env

    rm -f aws.env*

    rm -f environment_url.txt

    deployscript=$(ls -1 "$AWS_SCRIPTS_DIR/aws-deploy-${environment_type}.sh" 2>/dev/null || ls -1 "$AWS_SCRIPTS_DIR/aws-deploy.sh" 2>/dev/null || echo "")

    else

      echo "$environment_url" > environment_url.txt

    fi

    echo -e "environment_type=$environment_type\\nenvironment_name=$environment_name\\nenvironment_url=$environment_url" >> aws.env

    chmod 644 environment_url.txt aws.env

    # var prefix ('_' if namespace)

    prefix="${environment_namespace:+${environment_namespace}_}"

    dotenvfile="aws.env${environment_namespace:+.${environment_namespace}}"

    {

      echo "${prefix}environment_type=${environment_type}"

      echo "${prefix}environment_name=${environment_name}"

      echo "${prefix}environment_url=${environment_url}"

    } >> "$dotenvfile"

    chmod 644 environment_url.txt "$dotenvfile"

  }

  # environment cleanup function

  # ENDSCRIPT

# job prototype

# Base job prototype

# defines default Docker image, tracking probe, cache policy and tags

.aws-base:

  image:

  before_script:

    - !reference [.aws-scripts]

    - install_ca_certs "${CUSTOM_CA_CERTS:-$DEFAULT_CA_CERTS}"

    - aws_auth

# Deploy job prototype

# Env management job prototype

# Can be extended to define a concrete environment

#

# @arg ENV_TYPE      : environment type

# @arg ENV_APP_NAME  : env-specific application name

# @arg ENV_APP_SUFFIX: env-specific application suffix

# @arg ENV_URL       : env-specific application url

.aws-deploy:

.aws-env-base:

  extends: .aws-base

  stage: deploy

  variables:

    ENV_APP_SUFFIX: "-$CI_ENVIRONMENT_SLUG"

  before_script:

    - !reference [.aws-base, before_script]

    - aws_auth

  environment:

    name: ${ENV_TYPE}${AWS_ENVIRONMENT_NAMESPACE}

  resource_group: ${ENV_TYPE}${AWS_ENVIRONMENT_NAMESPACE}

# Deploy job prototype

# Can be extended for each deployable environment

# @arg ENV_URL       : env-specific application url

.aws-deploy:

  extends: .aws-env-base

  script:

    - aws_deploy

  artifacts:

    paths:

      - environment_url.txt

    reports:

      dotenv: aws.env

      dotenv: aws.env*

  environment:

    url: "$environment_url" # can be either static or dynamic

# Cleanup job prototype

# Can be extended for each deletable environment

#

# @arg ENV_TYPE      : environment type

# @arg ENV_APP_NAME  : env-specific application name

# @arg ENV_APP_SUFFIX: env-specific application suffix

.aws-cleanup:

  extends: .aws-base

  stage: deploy

  extends: .aws-env-base

  # force no dependencies

  dependencies: []

  variables:

    ENV_APP_SUFFIX: "-$CI_ENVIRONMENT_SLUG"

  script:

    - aws_delete

  environment:

    ENV_URL: "${AWS_REVIEW_ENVIRONMENT_URL}"

    ENV_OIDC_ROLE_ARN: "$AWS_REVIEW_OIDC_ROLE_ARN"

  environment:

    name: review/$CI_COMMIT_REF_NAME

    name: ${ENV_TYPE}${AWS_ENVIRONMENT_NAMESPACE}/${CI_COMMIT_REF_NAME}

    # ⚠ on_stop must be unset when defining parallel:matrix environments

    # see: https://gitlab.com/gitlab-org/gitlab/-/issues/332247

    on_stop: aws-cleanup-review

    auto_stop_in: "$AWS_REVIEW_AUTOSTOP_DURATION"

  resource_group: review/$CI_COMMIT_REF_NAME

  resource_group: ${ENV_TYPE}${AWS_ENVIRONMENT_NAMESPACE}/${CI_COMMIT_REF_NAME}

  rules:

    # exclude tags

    - if: $CI_COMMIT_TAG

    ENV_APP_NAME: "$AWS_REVIEW_APP_NAME"

    ENV_OIDC_ROLE_ARN: "$AWS_REVIEW_OIDC_ROLE_ARN"

  environment:

    name: review/$CI_COMMIT_REF_NAME

    name: ${ENV_TYPE}${AWS_ENVIRONMENT_NAMESPACE}/${CI_COMMIT_REF_NAME}

    action: stop

  resource_group: review/$CI_COMMIT_REF_NAME

  resource_group: ${ENV_TYPE}${AWS_ENVIRONMENT_NAMESPACE}/${CI_COMMIT_REF_NAME}

  rules:

    # exclude tags

    - if: $CI_COMMIT_TAG

    ENV_APP_NAME: "$AWS_INTEG_APP_NAME"

    ENV_URL: "${AWS_INTEG_ENVIRONMENT_URL}"

    ENV_OIDC_ROLE_ARN: "$AWS_INTEG_OIDC_ROLE_ARN"

  environment:

    name: integration

  resource_group: integration

  rules:

    # only on integration branch(es), with $AWS_INTEG_ENABLED set

    - if: '$AWS_INTEG_ENABLED == "true" && $CI_COMMIT_REF_NAME =~ $INTEG_REF'

    ENV_APP_NAME: "$AWS_STAGING_APP_NAME"

    ENV_URL: "${AWS_STAGING_ENVIRONMENT_URL}"

    ENV_OIDC_ROLE_ARN: "$AWS_STAGING_OIDC_ROLE_ARN"

  environment:

    name: staging

  resource_group: staging

  rules:

    # only on production branch(es), with $AWS_STAGING_ENABLED set

    - if: '$AWS_STAGING_ENABLED == "true" && $CI_COMMIT_REF_NAME =~ $PROD_REF'

    ENV_APP_NAME: "$AWS_PROD_APP_NAME"

    ENV_URL: "${AWS_PROD_ENVIRONMENT_URL}"

    ENV_OIDC_ROLE_ARN: "$AWS_PROD_OIDC_ROLE_ARN"

  environment:

    name: production

  resource_group: production

  rules:

    # exclude non-production branches

    - if: '$CI_COMMIT_REF_NAME !~ $PROD_REF'