Skip to content

build(ci): build a reduced matrix on pull requests - #2011

Merged
lukaszlenart merged 1 commit into
mainfrom
ci-trim-pr-jobs
Oct 15, 2026
Merged

lukaszlenart merged 1 commit into
mainfrom
ci-trim-pr-jobs

Conversation

@lukaszlenart

Copy link
Copy Markdown
Member

Why

GitHub Actions jobs here spend 30–90 minutes queued on the shared ASF runner pool and 1–7 minutes running. Each push to a pull request queued 8 jobs. This PR halves that.

It complements #2010, which removes the separate changes job so that each job queues once instead of twice. The two are kept apart so that each one's effect is visible on its own.

What changes

  • Maven matrix. The matrix is restructured into java × profile dimensions. The JDK 17 + Jakarta EE 11 combination is excluded, which leaves the same 5 combinations and the same check names as before.
    • On pull requests, two expression-based excludes also drop JDK 21 and plain JDK 25. A PR builds JDK 17, which is the required check, and JDK 25 with -Pjakartaee11. That covers the oldest JDK and the newest stack.
    • Pushes to main / develop / release/* / support/* and workflow_dispatch still build all 5 combinations.
  • OWASP. On pull requests it runs only when a pom.xml, src/etc/project-suppression.xml or the workflow itself changes. It isn't a required check, so the path filter can't leave a PR blocked. All dependencies are declared in pom.xml files.

A PR push now queues 4 jobs instead of 8: JDK 17, JDK 25 + Jakarta EE 11, CodeQL and Sonar.

Trade-offs

  • A failure that appears only on JDK 21, or only on plain JDK 25, shows up after merge instead of on the PR.
  • A new CVE against a dependency that hasn't changed is reported by the push run on main, not on unrelated PRs.

Verification

  • actionlint is clean.
  • This PR's own run should show exactly two "Build and Test" jobs and no OWASP job.
  • The push path (full matrix) shows up on the first main build after merge, or earlier with a workflow_dispatch on this branch.

🤖 Generated with Claude Code

Every push to a pull request queued 8 jobs on the shared ASF runner
pool. Pull requests now build JDK 17 (the required check) and JDK 25
with Jakarta EE 11, covering the oldest JDK and the newest stack;
pushes to the long-lived branches still build the full matrix.

OWASP runs on a pull request only when it changes a pom.xml, the
suppression file or the workflow itself. It is not a required check,
so the path filter cannot leave a pull request waiting on it.

A pull request push now queues 4 jobs instead of 8.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@lukaszlenart
lukaszlenart marked this pull request as ready for review October 14, 2026 11:41
@sonarqubecloud

Copy link
Copy Markdown

@lukaszlenart
lukaszlenart merged commit 447ae1b into main Oct 15, 2026
13 checks passed
@lukaszlenart
lukaszlenart deleted the ci-trim-pr-jobs branch October 15, 2026 05:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant