docs: derive CI module lists from the poms that declare them, not a hard-coded list

[github-actions]

What this proposes

A script or CI workflow must read the set of modules it iterates over from the
poms that declare them (a <module> list, or a per-module marker such as
validation.run), rather than carrying a hard-coded module list that drifts
when someone adds a module.

Where it came from

Rule	Seen in	Raised by	Evidence	How I checked it landed
Derive module lists from the poms	#25919, #25736	@Artur-, @mcollovati	comment, comment	Merged code obeys (signal 1). scripts/previewModule.js:50-63 on main now reads <module> from flow-tests/pom.xml ("so that a new test module is picked up without listing it anywhere"); .github/workflows/validation.yml:97,510-512 derives the Quarkus matrix from the validation.run POM marker via scripts/computeMatrix.js:452-465.

Window: 53 merged pull requests from the last 7 days (62 merged total; 9
dependency bumps skipped).

Counter-example check: grepped scripts/ and .github/workflows/ for module
handling. Compliance dominates — computeMatrix.js, previewModule.js and
previewPackage.sh all parse <module>/validation.run from poms; the central
matrix is entirely pom-derived. The one -pl test-devloop-*/devloop-shared
line in validation.yml:281 is a targeted build-prerequisite command for two
shared submodules, not a maintained module inventory, so it is not a
counter-example.

Why it is worth a rule

Two reviewers, on two unrelated pull requests, made the same call by hand:
Artur on a preview-deploy script ("This should not list all modules, nobody
will remember to update them"), and mcollovati on the Quarkus CI matrix
("Having the modules hard-coded here looks a bit difficult to maintain... have
the configuration in the pom.xml, where the modules are actually defined").
Both authors reworked the code to read from the poms. A reader of the new
paragraph writing the next CI script will derive the list up front instead of
being told to in review, and a stale hard-coded list — the kind that silently
skips a new module from a test run — is caught at authoring time.

Considered and dropped

• Verb in method names (feat: run declared JavaScript without compiling it in the browser #25749) — already covered by CONVENTIONS.md § Naming.
• Don't add tests for unchanged/refactored behavior (refactor: declare the JavaScript for titles and web component calls #25891, feat: run declared JavaScript without compiling it in the browser #25749) — already
  covered by § Testing ("Do not add tests for behavior you did not change").
• Extend an existing test view instead of a new one (fix: keep query parameters and hash of queued navigation #25910, feat: call a function on an element without compiling JavaScript #25852, feat: support variadic methods in a JavaScript definition #25877) —
  already covered by § Testing ("extend one instead of adding a near-duplicate").
• "Don't assert generated JS equals a hardcoded copy" (feat: run element-bound framework JavaScript from the bundle #25853, refactor: declare the JavaScript for titles and web component calls #25891) — fails
  the counter-example check; exact-string assertions on generated JS are the
  norm across flow-server tests.
• Unrelated lock-file changes (feat(spring): add opt-in Keycloak role mapping to VaadinSecurityConfigurer #25627) — a single incident; overlaps § Commit &
  PR Hygiene.

Review notes

• Docs only: CONVENTIONS.md. No code, tests or build files.
• The wording is a proposal. Rewriting it in review is cheaper than closing it.
• Closing this without merging tells the bot never to propose these rules
  again.

---

Auto-generated by Guidelines Bot from review comments on merged pull requests.

Generated by Guidelines Bot · ◷

• expires on Oct 12, 2026, 8:25 AM UTC

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Test Results

 1 551 files  ±0   1 635 suites  ±0   1h 36m 15s ⏱️ - 4m 49s
12 467 tests ±0  12 395 ✅ ±0  72 💤 ±0  0 ❌ ±0 
12 866 runs  ±0  12 794 ✅ ±0  72 💤 ±0  0 ❌ ±0 

Results for commit f900825. ± Comparison against base commit 7515b5a.