chore: run aws-cdk-lib gen before mixins gen in spec-update workflow

[vishaalmehrishi]

Issue

Fixes the recurring build failure on L1 spec update PRs (e.g. #37530) where git diff-index detects uncommitted changes in packages/@aws-cdk/cfn-property-mixins/package.json.

Supersedes #37556 which added cfn-property-mixins to the gen step but didn't fix the ordering issue.

Root Cause: Race Condition in Parallel Gen

The spec-update workflow runs lerna run gen for all three packages (aws-cdk-lib, @aws-cdk/mixins-preview, @aws-cdk/cfn-property-mixins) in a single command. Lerna executes them in parallel. This creates a race condition:

1. aws-cdk-lib gen writes new service entries (e.g. aws-novaact, aws-securityagent) to scope-map.json via writeModuleMap()

2. cfn-property-mixins gen reads scope-map.json via loadModuleMap() to determine which services to generate exports for — see the filter at line 23: if (moduleMap[service.name])

3. mixins-preview gen has the same dependency on scope-map.json

Evidence from workflow run #354

The gen step logs show cfn-property-mixins finished before aws-cdk-lib:

10:53:00 @aws-cdk/cfn-property-mixins:   Services: 278    ← finished first, read stale scope-map.json
10:53:05 aws-cdk-lib:                     Services: 282    ← finished second, wrote updated scope-map.json

cfn-property-mixins generated for 278 services because it read scope-map.json before aws-cdk-lib added the 4 new service entries. During the CI build, cdk-build runs gen again with the updated scope-map.json, producing 2 new export entries in package.json that weren't in the commit → git diff-index fails.

Description of changes

Split the single lerna run gen command into two sequential steps:

1. Generate L1 code — runs gen for aws-cdk-lib only, which updates scope-map.json
2. Generate mixins — runs gen for mixins-preview and cfn-property-mixins, which now read the updated scope-map.json

Description of how you validated changes

• Traced the full dependency chain through the codebase (links above)
• Confirmed the race condition from workflow run #354 logs showing 278 vs 282 services
• Confirmed the CI build failure logs show the same cfn-property-mixins/package.json | 2 ++ after the workflow re-run

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

(This review is outdated)

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-04-09 12:37 UTC · Rule: default-squash
• ✅ Checks skipped · PR is already up-to-date
• ✅ Merged — 2026-04-09 12:37 UTC · at dc6da6eacf4f2bba31cb7e22885c69cea0f64e06

This pull request spent 12 seconds in the queue, including 2 seconds running CI.

Required conditions to merge

• #approved-reviews-by >= 1 [🛡 GitHub branch protection]
  • chore: run aws-cdk-lib gen before mixins gen in spec-update workflow #37558
• #changes-requested-reviews-by = 0 [🛡 GitHub branch protection]
  • chore: run aws-cdk-lib gen before mixins gen in spec-update workflow #37558
• any of [🛡 GitHub branch protection]:
  • check-success = validate-pr
  • check-neutral = validate-pr
  • check-skipped = validate-pr
• any of [🛡 GitHub branch protection]:
  • check-success = build
  • check-neutral = build
  • check-skipped = build

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.