feat(ci): support optional & ordered actions with jobs/prs

[imbajin]

Select affected tests and run them before compatibility and security work, while sharing image preparation.

Before	After
Independent workflows trigger broad suites and compete for runners.	Select affected modules and consumers; Server changes retain Server, PD/Store/HStore and Cluster tests. Compatibility and security follow the core gate.
Four image builds repeat Maven preparation; Compose smoke uses published images.	Share the build stage and validate current PR images with startup, health and authentication checks. Keep the existing Hubble smoke.
Separate test results and superseded runs require manual coordination.	A strict module gate requires every selected check to succeed; newer PR heads cancel superseded runs. License checks remain independent.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 40.88%. Comparing base (8fd9841) to head (2a37706).

Additional details and impacted files

@@             Coverage Diff              @@
##             master    #3271      +/-   ##
============================================
- Coverage     41.69%   40.88%   -0.82%     
+ Complexity     7365     7187     -178     
============================================
  Files           794      785       -9     
  Lines         69291    68158    -1133     
  Branches       9288     9166     -122     
============================================
- Hits          28891    27866    -1025     
+ Misses        37113    37051      -62     
+ Partials       3287     3241      -46     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[bitflicker64]

Some numbers from the hugegraph org mirrors, in case they help size this.

I replayed every completed push and PR run in hugegraph/hugegraph and hugegraph/hugegraph-toolchain from 2026-10-03 13:43 to 2026-10-04 20:44 UTC (1076 runs; Rerun CI, Dependency Submission, labeler and stale left out), applying this PR's rule: a PR run is cancelled when a newer run of the same workflow on the same PR starts before it finishes.

Repo	Runs this would cancel	Start-to-finish time saved
hugegraph	393 / 565 (70%)	281 h / 592 h (47%)
hugegraph-toolchain	83 / 511 (16%)	39 h / 432 h (9%)
Both	476 / 1076 (44%)	320 h / 1024 h (31%)

Caveats: it was a busy window (gh run list caps at 1000 runs per repo, so it only reaches back about 31 hours), and the hours run from run start to finish, so they include time spent waiting for a runner and overstate billed minutes. The run count is the firmer number.

A snapshot from the evening of 2026-10-04 matches: about 11 jobs running and 141 runs queued across the org, and 25 of 137 live runs were already superseded by a newer run on the same branch.

[bitflicker64]

Blocking: no. Summary: The per-PR concurrency groups cancel only superseded pull_request runs (push, schedule and manual runs keep a unique run_id group), and the retry checker fails closed: it re-verifies the run attempt and the open PR or branch head before and after the delay, loaded from the trusted default-branch commit. No actionable findings at 91fd925. Evidence: read the full diff and the head versions of rerun-ci.yml and server-ci.yml; ran python3 -m unittest discover -s .github/scripts -p 'test_check_rerun.py' locally (14 tests OK) and confirmed the same 14 tests ran in the Server CI wait-storage-shell-test job; checked with gh api that fork PR runs carry an empty pull_requests list and that the commits/{sha}/pulls fallback resolves them (#3269); all eight workflow runs at this head succeeded, and the only red check, codecov/project, is not required and reports a 0.03% drift on a PR with no Java changes.

[imbajin]

Blocking: no. Summary: Fork PR retries can be skipped when GitHub returns no PR association, and stale reruns can cancel current-head CI. Evidence: exact-head run/commit association responses, the workflow group at .github/workflows/server-ci.yml:11-14, and documented Actions rerun/concurrency semantics; all ordinary workflows passed, while codecov/project failed as a non-blocking quality signal.

[bitflicker64]

Blocking: yes. Score: 1.5/10. Summary: The gate, the legacy aliases and the retry freshness checks fail closed as intended, but the selector skips existing tests for some server and docker paths, receipt reuse scans only 30 repository-wide runs, and the 3rd-party check becomes part of the required gate. Evidence: read the full diff against master and the reusable workflows it calls; ran the 39 tests in .github/scripts (OK), ran select() on concrete paths (root and server poms, hugegraph-rocksdb, docker/, store dist, workflow files, docs), YAML and Python syntax checks, and read Actions run history and this PR's checks through the API. CI at a23281d is still running; check-license passes.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[imbajin]

Blocking: no. Summary: The CI receipt and retry paths each have a validation gap that can waste test capacity or exhaust the retry runner. Evidence: the local/API fingerprint comparison and the artifact download path in the exact-head scripts.

[bitflicker64]

Blocking: yes. Summary: PD and Store distribution files that the PD and Store images ship (conf/application.yml, bin/start-.sh) no longer select the Docker suite, so the new image startup, health and PD auth checks never run for them, although docs/ci.md says distribution changes include Docker and master ran Docker Build CI for hugegraph-pd/** and hugegraph-store/**. Evidence: at 77148c7, select("server", ["hugegraph-pd/hg-pd-dist/src/assembly/static/conf/application.yml"]) and the same for hg-store-dist conf/application.yml and bin/start-hugegraph-pd.sh return suites [cluster, pd_store] only, while hugegraph-server/hugegraph-dist/src/assembly/static/conf/rest-server.properties returns [cluster, docker, pd_store, server_memory, server_rocksdb]; hugegraph-pd/Dockerfile:63 copies the assembled dist and docker-entrypoint.sh:146 runs bin/start-hugegraph-pd.sh; python3 -m unittest discover -s .github/scripts -p 'test_.py' passes (64 tests).