refactor(storage): route lambda access through storage providers

[edersonbrilhante]

Description

Move Lambda GitHub App credentials and runner configuration access behind the shared storage-provider interfaces. Control-plane and termination-watcher tests now mock provider contracts, while SSM-specific behavior remains covered by the SSM storage-provider tests. The legacy control-plane SSM housekeeper wrappers were removed and the housekeeper test was moved under the SSM provider.

Test Plan

• Ran the termination-watcher deregistration tests: 13 passed
• Ran the SSM GitHub App credentials provider tests: 7 passed
• Ran ESLint on the changed termination-watcher files
• Ran TypeScript compilation for termination-watcher
• Ran Prettier checks on the changed termination-watcher files
• Verified the targeted diff with git diff --check

Related Issues

Not applicable.

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 1 package(s) with unknown licenses.

See the Details below.

License Issues

lambdas/functions/termination-watcher/package.json

Package	Version	License	Issue Type
@aws-github-runner/storage-providers		Null	Unknown License

OpenSSF Scorecard

Package	Version	Score	Details
npm/@aws-github-runner/storage-providers		Unknown	Unknown

Scanned Files

• lambdas/functions/control-plane/package.json
• lambdas/functions/termination-watcher/package.json

[Copilot]

Copilot review overview

🟡 Changes recommended

Clear the cached credential-load rejection so warm Lambda invocations can retry after transient SSM errors.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1

Open (1)

• Clear cached credentials promise after rejection to allow retries · New

What changed in this PR

Refactors Lambda credential and runner configuration access through shared storage-provider interfaces, removing legacy control-plane SSM wrappers.

Changes:

• Updates provider-contract mocks and related tests.
• Relocates housekeeper coverage under the SSM provider.
• Updates dependencies, typings, and lockfile.
• Removes obsolete SSM wrappers.

File	Summary
lambdas/​yarn.lock	Updates workspace dependencies.
lambdas/​libs/​storage-providers/​aws/​ssm/​runner-config-housekeeper.test.ts	Updates housekeeper test coverage.
lambdas/​libs/​storage-providers/​aws/​ssm/​environment.d.ts	Adds cleanup configuration typing.
lambdas/​libs/​compute-providers/​aws/​ec2/​src/​environment.d.ts	Adds failover configuration typing.
lambdas/​functions/​termination-watcher/​src/​deregister.ts	Uses shared credential storage; rejected loads remain cached and prevent retries.
lambdas/​functions/​termination-watcher/​src/​deregister.test.ts	Mocks the credential provider contract.
lambdas/​functions/​termination-watcher/​package.json	Replaces the direct SSM dependency.
lambdas/​functions/​control-plane/​src/​scale-runners/​ssm-housekeeper.ts	Removes the legacy wrapper.
lambdas/​functions/​control-plane/​src/​scale-runners/​scale-up.test.ts	Mocks storage provider contracts.
lambdas/​functions/​control-plane/​src/​modules.d.ts	Removes moved environment declarations.
lambdas/​functions/​control-plane/​src/​local-ssm-housekeeper.ts	Removes the obsolete local helper.
lambdas/​functions/​control-plane/​src/​lambda.test.ts	Updates housekeeper tests.
lambdas/​functions/​control-plane/​src/​github/​auth.test.ts	Mocks shared credential storage.
lambdas/​functions/​control-plane/​package.json	Removes the direct SSM dependency.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.