From 39ebffd41ef8cd3469ef51672fb9d918ad76d489 Mon Sep 17 00:00:00 2001
From: Lukasz Lenart <lukaszlenart@apache.org>
Date: Wed, 14 Oct 2026 12:53:41 +0200
Subject: [PATCH] build(ci): build a reduced matrix on pull requests

Every push to a pull request queued 8 jobs on the shared ASF runner
pool. Pull requests now build JDK 17 (the required check) and JDK 25
with Jakarta EE 11, covering the oldest JDK and the newest stack;
pushes to the long-lived branches still build the full matrix.

OWASP runs on a pull request only when it changes a pom.xml, the
suppression file or the workflow itself. It is not a required check,
so the path filter cannot leave a pull request waiting on it.

A pull request push now queues 4 jobs instead of 8.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/maven.yml | 14 ++++++--------
 .github/workflows/owasp.yml |  5 +++++
 2 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml
index 3575dd2ffc..82f0f87d8e 100644
--- a/.github/workflows/maven.yml
+++ b/.github/workflows/maven.yml
@@ -54,17 +54,15 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        include:
+        java: [ '17', '21', '25' ]
+        profile: [ '', '-Pjakartaee11' ]
+        exclude:
           - java: '17'
-            profile: ''
-          - java: '21'
-            profile: ''
-          - java: '21'
             profile: '-Pjakartaee11'
-          - java: '25'
+          # Pull requests build the oldest JDK and the newest on Jakarta EE 11; pushes build everything.
+          - java: ${{ github.event_name == 'pull_request' && '21' || 'none' }}
+          - java: ${{ github.event_name == 'pull_request' && '25' || 'none' }}
             profile: ''
-          - java: '25'
-            profile: '-Pjakartaee11'
     steps:
       - name: Checkout code
         if: needs.changes.outputs.code == 'true'
diff --git a/.github/workflows/owasp.yml b/.github/workflows/owasp.yml
index 2dde9deb95..0dcf862610 100644
--- a/.github/workflows/owasp.yml
+++ b/.github/workflows/owasp.yml
@@ -16,7 +16,12 @@
 name: OWASP checkup
 
 on:
+  # Not a required check, so path filtering cannot leave a pull request blocked.
   pull_request:
+    paths:
+      - '**/pom.xml'
+      - 'src/etc/project-suppression.xml'
+      - '.github/workflows/owasp.yml'
   push:
     branches:
       - 'main'