feat(ci): affected-only unit test matrix using Nx

[so0k]

Summary

• Adds a determine-affected job to pr-unit.yml that uses nx show projects --affected to dynamically build the test matrix, skipping packages not impacted by a PR
• Introduces tools/affected-packages.sh helper script with safe fallback to all 8 packages if Nx fails
• Supports ci/run-all-unit label override to force full test coverage
• Includes RFCs/CI-IMPROVEMENTS.md with design rationale and expected impact

Expected impact: Docs-only PRs run 0 unit test jobs instead of 16; leaf-package PRs run 2 instead of 16.

Details

1. tools/affected-packages.sh (new) - Shell script that:

• Runs npx nx show projects --affected to detect changed packages
• Filters to only the 8 testable packages
• Falls back to all packages if Nx fails
• Outputs [] when nothing is affected

2. .github/workflows/pr-unit.yml - Added determine-affected job:

• Runs before all_unit_tests (~30s on ubuntu-latest)
• Handles ci/run-all-unit label override → all 8 packages
• Handles both pull_request and merge_group events for base SHA
• all_unit_tests now uses dynamic fromJSON() matrix and skips entirely when has_packages == false
• results job includes determine-affected in its needs list

Verified locally:

• origin/main → [] (no package changes on this branch)
• HEAD~3 → ["cdktn-cli","@cdktn/cli-core"] (correct transitive deps)
• HEAD~10 → all 8 packages

Test plan

• Run bash tools/affected-packages.sh origin/main locally on various branches
• Open a docs-only PR and confirm 0 unit test jobs run
• Open a PR touching @cdktn/commons and confirm only dependents are tested
• Apply ci/run-all-unit label and confirm all 16 jobs run
• Verify results job still correctly reports pass/fail

🤖 Generated with Claude Code

[so0k]

is this superseeded by #41 @irfn ?

i'll rebase this after #41 is merged and see if it provides benefits still