refactor: reduce runner usage and scope CI to speed up

[imbajin]

Purpose of the PR

Documentation-only changes currently request nine CI runners, and ordinary Server changes also trigger expensive compatibility and distributed suites. Separate planning, Java-version and result jobs repeatedly re-enter the shared runner queue.

This change gives CI one entry point, reduces documentation changes to one preflight runner, and limits costly validation to related inputs, weekly coverage or explicit manual runs.

Main Changes

• Share selection, Java runtime validation and license checks in preflight. Run affected Memory/RocksDB suites and ARM startup/persistence smoke; run HBase, RISC-V and ARM full suites for directly related inputs.
• Select PD/Store tests and distributed consumers independently. Combine Docker contracts and current-image runtime validation, and move lightweight startup/stop contracts into existing jobs.
• Run all retained suites every Monday at 06:00 in Asia/Singapore. Keep one branch-based test-set selector for manual mainline, distributed, specialist or full validation.
• Keep real failures visible while making CI advisory and retaining the approving review. Remove permanent result-only runners and automatic retries; use native job reruns. Preflight keeps the real check-license name. A temporary Server memory tests bridge verifies actual Memory results only while live protection requires it, and skips without a runner after Gitbox synchronizes the merged configuration.

flowchart LR
    E[PR / push / weekly / manual] --> P[One preflight]
    P --> D[Documentation: finish]
    P --> T[Selected reusable tests]

Loading

CI overview

One shared preflight selects tests from cumulative changes, with weekly full coverage and manual test-set selection. Runner counts shown apply to normal documentation-only test workflows, excluding the first-PR comment job.

Verifying these changes

• Trivial rework / code cleanup without any test coverage. (No Need)
• Already covered by existing tests.
• Need tests and can be verified as follows:
  • Selector regressions use real Git snapshots and evaluate the actual workflow conditions, including cumulative source changes, documentation, presets, failed license checks, invalid Java versions and cancellation.
  • Workflow lint, native timeout/restart/heap/cleanup contracts, Codecov/TinkerPop contracts, formatting and a Java 17 clean compile passed locally.
  • Native ARM startup, JNI, graph writes/reads, store dump and restart persistence passed locally and on a real GitHub macOS ARM runner. The default ARM job correctly skipped full core/API tests and completed in about 2.5 minutes.
  • Fork mainline validation completed successfully before the contract-routing follow-up, including Memory/RocksDB, Commons, Struct/PD/Store/HStore, Cluster, ARM smoke, Docker, Helm, dependency inventory and CodeQL. HBase/RISC-V were correctly excluded by the mainline preset; dependency review was skipped for the manual event. Docker validation built Server/PD/Store from this commit and verified authentication, readiness and graph read/write. Contract routing, full JDK versions and the temporary protection bridge have focused regression coverage, including failure and skip handling. Real ARM/JDK 17 smoke with a full expected version passed JNI, startup, read/write, dump and restart; cross-major mismatch was rejected. ASF CI must validate the updated head.

Observed master-push performance

Snapshot: 2026-10-15 (Asia/Taipei). The baseline is the three days before each CI change; the post-change sample includes all observed successful master pushes after Server #3337 and Toolchain #816.

Values are per-commit averages, before → after. All push workflows for the same commit are grouped together; failed or cancelled groups are excluded.

Repository	Successful commit samples	Runner jobs / commit	Runner execution (min)	First-start wait (min)	End-to-end completion (min)
Server	20 → 7	26.4 → 3.9	212.5 → 12.8	1.15 → 0.61	101.6 → 8.8
Toolchain	7 → 1	17.4 → 2.0	111.6 → 10.1	18.9 → 149.6	105.4 → 242.2

Runner execution sums the actual job durations across parallel runners. First-start wait runs from the earliest workflow creation to the first allocated runner starting. End-to-end completion ends when the last runner job finishes, including subsequent queue and dependency waits; it excludes external Codecov processing. The historical jobs API does not expose each job's enqueue time, so first-start wait is not average per-job queue time.

Observed runner execution decreased by approximately 94% for Server and 91% for Toolchain. Toolchain has only one post-change master sample: its entry and smoke run used 10.1 runner-minutes, but waited 149.6 minutes before the entry and another 82.5 minutes before smoke. Its longer completion time therefore does not indicate longer test execution.

These are observations across different commits and shared-queue conditions, not a controlled benchmark or evidence of a lasting queue-time improvement.

[imbajin]

[P2] Route relocated contract tests to the jobs that actually execute them

Reviewed commit: 35bb279.

The narrowed selector does not account for several contract scripts' actual owning jobs. Changing only test-stop-hugegraph-store.sh, test-check-jacoco-report.sh, or test-codecov-upload-config.sh selects neither struct nor store, so the Struct job in pd-store-ci.yml (lines 78–104) is skipped even though it contains their contract invocations.

A second example is test-riscv64-java-runtime.sh: the early RISC-V classification in ci-policy.py (lines 162–164) selects only riscv64, while the contract itself now runs in the RocksDB job in server-tests.yml (lines 76–81). The selected RISC-V workflow does not invoke this script. Consequently, changes to these contract tests can leave the changed tests unexecuted.

Please add exact contract-to-owning-suite mappings before the broad path rules, and regression cases that evaluate the selected inner job/step conditions, not just the reusable-workflow caller. For the RISC-V contract, select its Server/RocksDB owner in addition to any desired native coverage. test-tinkerpop-reports.sh does not have this issue because the selected RocksDB lane also invokes it.

Evidence: two independent source reviews plus execution of the exact-head selector reproduced the selected sets; this is an execution-routing gap, not a reported hosted test failure.

Sources:

hugegraph/.github/scripts/ci-policy.py

Lines 162 to 180 in 35bb279

	if "riscv" in path.lower():
	selected.add("riscv64")
	continue
	if path.startswith(DISTRIBUTED_SERVER_INPUTS) or path.endswith(".proto"):
	selected.update({"hstore", "cluster", "distributed_smoke"})
	if path.endswith(".proto") and path.startswith(RISCV_PROTO_ROOTS):
	selected.add("riscv64")
	if path.startswith("hugegraph-server/hugegraph-dist/docker/"):
	selected.add("docker")
	continue
	if path.startswith("hugegraph-server/hugegraph-dist/"):
	selected.update({"server", "docker", "macos", "macos_full"})
	if (path.startswith("hugegraph-server/hugegraph-dist/src/assembly/static/bin/")
	or "native-runtime" in p.name or "rocksdb-jni" in p.name
	or p.name == "check-rocksdb-only-dist.sh"):
	selected.add("riscv64")
	if any(word in path for word in ("pd", "store", "distributed")):
	selected.update({"hstore", "cluster", "distributed_smoke"})
	continue

hugegraph/.github/workflows/pd-store-ci.yml

Lines 78 to 104 in 35bb279

	struct:
	if: inputs.run-struct || inputs.run-store
	runs-on: ubuntu-24.04
	env:
	USE_STAGE: 'false'
	steps:
	- name: Checkout
	uses: actions/checkout@v7
	with:
	fetch-depth: 5
	- name: Install project JDK
	uses: actions/setup-java@v6
	with:
	java-version-file: .github/workflows/.java-version
	distribution: 'zulu'
	cache: maven
	cache-jdk: false
	- name: Verify Store stop failure propagation and PID retention
	run: bash hugegraph-server/hugegraph-dist/src/assembly/travis/test-stop-hugegraph-store.sh
	- name: Run JaCoCo report validator tests
	run: hugegraph-server/hugegraph-dist/src/assembly/travis/test-check-jacoco-report.sh
	- name: Run Codecov upload configuration tests
	run: hugegraph-server/hugegraph-dist/src/assembly/travis/test-codecov-upload-config.sh

hugegraph/.github/workflows/server-tests.yml

Lines 76 to 81 in 35bb279

	- name: Check startup and native runtime contracts
	if: inputs.backend == 'rocksdb'
	run: |
	"$TRAVIS_DIR/test-wait-storage.sh"
	"$TRAVIS_DIR/test-riscv64-java-runtime.sh"
	bash "$TRAVIS_DIR/test-tinkerpop-reports.sh"

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 54.29%. Comparing base (0b7c0de) to head (50bcccc).

Additional details and impacted files

@@             Coverage Diff             @@
##             master    #3337     +/-   ##
===========================================
  Coverage     54.29%   54.29%             
- Complexity     2616     6308   +3692     
===========================================
  Files           770      770             
  Lines         67952    67952             
  Branches       9213     9213             
===========================================
+ Hits          36892    36893      +1     
- Misses        27482    27483      +1     
+ Partials       3578     3576      -2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[imbajin]

Fixed the contract routing gap. Standalone Store-stop, JaCoCo and Codecov contract changes now select Struct; the RISC-V runtime contract also selects its Server/RocksDB owner. Contract-only inputs do not fan out to unrelated runtime consumers. Regression coverage now evaluates the actual caller inputs, inner job condition and executing step, and reproduces the failures with the previous selector. All policy/deployment tests pass locally; ASF CI will validate the updated head.

[imbajin]

Independent verification confirmed both concerns. Live master still requires check-license and Server memory tests, while Gitbox applies github configuration from the default branch. The migration now retains check-license on the existing preflight runner and temporarily supplies Server memory tests from actual selected Memory results, following the compatibility approach used in #3271 and #3277. This bridge requests one lightweight ubuntu-slim runner only while live protection requires the old context, repeats no tests, and skips without allocating a runner after synchronization. Infra intervention is unnecessary.

The shared JNI smoke now normalizes a full expected JDK version to its major with Bash parameter expansion. Controlled native-wrapper cases cover 17, 17.0.20 and 21.0.1, with mismatched majors rejected. A real ARM/JDK 17.0.20.1 run with expected version 17.0.20 passed JNI, startup, read/write, dump and restart; expecting Java 21 correctly failed. Policy/deployment regressions and workflow lint passed. Latest-head ASF CI is still required before merging.