Maintenance: derive CI workflow matrices from the workspace list instead of hardcoding them

[svozza]

Summary

The set of packages in this monorepo is defined by the workspaces array in the root package.json, together with each package's private flag. Two consumers already derive from it: the Lambda layer bundles every non-private @aws-lambda-powertools/* workspace (#5577), and the release gate polls the registry for every non-private workspace (#5572).

Three GitHub Actions workflows still carry their own hand-maintained copy of the list, and one of them has drifted:

• reusable-run-linting-check-and-unit-tests.yml lists 13 workspaces in the code-quality matrix
• quality_check.yml, which runs on merge_group and so only fires once a merge queue is enabled, lists 10 and is missing data-masking, validation and kafka
• run-e2e-tests.yml lists the 9 packages that have tests/e2e plus layers

The root tsconfig.json references list has also drifted, missing data-masking, jmespath, kafka and signer, but that is a different mechanism and is better handled separately.

Why is this needed?

Adding a package currently requires editing three workflow files by hand, and the quality_check.yml gap shows that this step gets missed. Once merge queues are enabled, packages missing from that check could land on main without their unit tests running at that stage. The PR matrix has the same problem today: packages/signer is not in it, so signer has no unit-test job in CI. A single rule, applied everywhere, removes the class of error and shrinks the "wiring a new package into CI" instructions to one line: add it to the root workspaces.

Which area does this relate to?

Automation, Tests

Solution

Derive the matrices at runtime from the same rule the layer and release gate already use:

1. Make quality_check.yml call the reusable unit-test workflow instead of duplicating its jobs. This removes one list outright and fixes the three missing packages. If the merge-queue run was intentionally slimmer, the reusable workflow can take an input to skip the layer-publisher and docs jobs.
2. Add a resolve-workspaces job to the reusable workflow and to run-e2e-tests.yml that emits a JSON list, consumed by the matrices via fromJSON:
   • unit and lint matrix: every non-private workspace under packages/, from npm pkg get name private --workspaces --json
   • e2e matrix: the subset with files under tests/e2e, plus layers. The test:e2e script is present in every package so it is not a usable signal, but the directory matches the current matrix exactly.
3. Keep the unit-tests-complete aggregate job (ci(maintenance): add aggregate unit-test check for branch protection #5567) as is. It already treats skipped jobs as failures, so a failed resolve job still blocks the required check.

The trade-off is one extra short job per workflow run and a matrix that is no longer readable from the YAML alone. The alternative of generating the YAML with a drift check keeps the file static but adds a generator and a manual step for contributors.

Acknowledgment

• This request meets Powertools for AWS Lambda (TypeScript) Tenets
• Should this be considered in other Powertools for AWS Lambda languages? i.e. Python, Java, and .NET

Future readers

Please react with 👍 and your use case to help us understand customer demand.