build(ci): detect changes in-job and cancel superseded PR runs

.github/actions/detect-changes/action.yml

@@ -0,0 +1,94 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Decides whether a change needs a build. The one place on GitHub that knows
+# which paths do not: .claude/ and the root process documents. Workflows run
+# this as a step instead of filtering by path in their triggers, so the list is
+# not repeated per workflow and a required check still reports (see maven.yml).
+# The Jenkinsfile carries the same pattern for the ASF Jenkins build; keep
+# the two in step.
+
+name: Detect changes
+description: "Sets code=true when the change touches anything outside .claude/ and the root process docs"
+
+inputs:
+  token:
+    description: Token used to list the changed files
+    default: ${{ github.token }}
+
+outputs:
+  code:
+    description: "'true' when the change touches anything outside .claude/ and the root process docs"
+    value: ${{ steps.filter.outputs.code }}
+
+runs:
+  using: composite
+  steps:
+    - name: Check which paths the change touches
+      id: filter
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.token }}
+      run: |
+        set -eu
+        # Anything not matched here needs a build. Every pattern is anchored
+        # to the repository root: a nested file of the same name still builds.
+        skip='^(\.claude/|CLAUDE\.md$|AGENTS\.md$|SECURITY\.md$|THREAT_MODEL\.md$|$)'
+        # When the file list cannot be fetched, build: the required check
+        # must still report, and building is the safe direction.
+        case "${{ github.event_name }}" in
+          pull_request)
+            files=$(gh api --paginate \
+              "repos/${{ github.repository }}/pulls/${{ github.event.number }}/files" \
+              --jq '.[].filename') || {
+              echo "Listing the pull request files failed - building."
+              echo "code=true" >> "$GITHUB_OUTPUT"
+              exit 0
+            }
+            ;;
+          push)
+            # A new branch has no "before" to compare against. The compare API
+            # lists at most 300 files; a push that large is not docs-only.
+            before="${{ github.event.before }}"
+            if [ "$before" = "0000000000000000000000000000000000000000" ]; then
+              echo "New branch - building."
+              echo "code=true" >> "$GITHUB_OUTPUT"
+              exit 0
+            fi
+            files=$(gh api \
+              "repos/${{ github.repository }}/compare/${before}...${{ github.sha }}" \
+              --jq '.files[].filename') || {
+              echo "Compare failed - building."
+              echo "code=true" >> "$GITHUB_OUTPUT"
+              exit 0
+            }
+            ;;
+          *)
+            echo "Event ${{ github.event_name }} - building."
+            echo "code=true" >> "$GITHUB_OUTPUT"
+            exit 0
+            ;;
+        esac
+        echo "Changed files:"
+        printf '%s\n' "$files"
+        # Tested by emptiness rather than with `grep -qv`, whose exit status
+        # is not reliable across grep implementations.
+        outside=$(printf '%s\n' "$files" | grep -vE "$skip" || true)
+        if [ -n "$outside" ]; then
+          echo "code=true" >> "$GITHUB_OUTPUT"
+        else
+          echo "Only .claude/ or the process docs changed - skipping the build."
+          echo "code=false" >> "$GITHUB_OUTPUT"
+        fi

.github/workflows/codeql.yml

@@ -28,21 +28,20 @@ on:
 permissions:
   contents: read
 
-jobs:
-  changes:
-    uses: ./.github/workflows/changes.yml
-    permissions:
-      contents: read
-      pull-requests: read
+# Pull requests cancel superseded runs; pushes get unique groups so none is dropped.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
 
+jobs:
   analyze:
     name: Analyze
-    needs: changes
-    if: needs.changes.outputs.code == 'true'
     runs-on: ubuntu-latest
     permissions:
       actions: read
       contents: read
+      # Read by the detect-changes action to list the pull request files.
+      pull-requests: read
       # Needed to upload the results to the code-scanning dashboard.
       security-events: write
     strategy:
@@ -52,19 +51,26 @@ jobs:
     steps:
     - name: Checkout repository
       uses: actions/checkout@v7
+    - name: Detect changes
+      id: changes
+      uses: ./.github/actions/detect-changes
     - name: Setup Java JDK
+      if: steps.changes.outputs.code == 'true'
       uses: actions/setup-java@v6
       with:
         distribution: temurin
         java-version: 17
         cache: 'maven'
     - name: Initialize CodeQL
+      if: steps.changes.outputs.code == 'true'
       uses: github/codeql-action/init@v4.38.2
       with:
         languages: ${{ matrix.language }}
     - name: Autobuild
+      if: steps.changes.outputs.code == 'true'
       uses: github/codeql-action/autobuild@v4.38.2
     - name: Perform CodeQL Analysis
+      if: steps.changes.outputs.code == 'true'
       uses: github/codeql-action/analyze@v4.38.2
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/maven.yml

@@ -20,7 +20,7 @@ on:
   # status check in .asf.yaml, and a workflow skipped by path filtering never
   # reports its checks - they stay Pending and the pull request can never be
   # merged. The build job always runs instead, and its steps are skipped by
-  # condition when changes.yml says nothing needs building.
+  # condition when the detect-changes action says nothing needs building.
   pull_request:
   push:
     branches:
@@ -33,17 +33,18 @@ on:
 
 permissions: read-all
 
+# Pull requests cancel superseded runs; pushes get unique groups so none is dropped.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
 env:
   MAVEN_OPTS: -Xmx2048m -Xms1024m
   LANG: en_US.utf8
 
 jobs:
-  changes:
-    uses: ./.github/workflows/changes.yml
-
   build:
     name: Build and Test (JDK ${{ matrix.java }})${{ matrix.profile == '-Pjakartaee11' && ' (Jakarta EE 11 + Spring 7)' || matrix.profile }}
-    needs: changes
     # No job-level `if:` here on purpose. A matrix job whose condition is false
     # is skipped *before* the matrix expands, so it reports a single check run
     # named after the raw `${{ matrix.* }}` template - never "Build and Test
@@ -67,23 +68,25 @@ jobs:
             profile: '-Pjakartaee11'
     steps:
       - name: Checkout code
-        if: needs.changes.outputs.code == 'true'
         uses: actions/checkout@v7
+      - name: Detect changes
+        id: changes
+        uses: ./.github/actions/detect-changes
       - name: Setup Java ${{ matrix.java }}
-        if: needs.changes.outputs.code == 'true'
+        if: steps.changes.outputs.code == 'true'
         uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: ${{ matrix.java }}
           cache: 'maven'
       - name: Maven Verify on Java ${{ matrix.java }}${{ matrix.profile == '-Pjakartaee11' && ' (Jakarta EE 11 + Spring 7)' || matrix.profile }}
-        if: needs.changes.outputs.code == 'true'
+        if: steps.changes.outputs.code == 'true'
         run: mvn -B -V -DskipAssembly verify ${{ matrix.profile }} --no-transfer-progress
 
       - name: Test Summary ${{ matrix.java }} ${{ matrix.profile }}
         uses: mikepenz/action-junit-report@a9170d5795813c01ab4901ffb045b52bab4ab09d #v6.5.0
         continue-on-error: true
-        if: always() && needs.changes.outputs.code == 'true'
+        if: always() && steps.changes.outputs.code == 'true'
         with:
           annotate_only: true # forked repo cannot write to checks so just do annotations
           report_paths: |

.github/workflows/owasp.yml

@@ -27,26 +27,30 @@ on:
 
 permissions: read-all
 
+# Pull requests cancel superseded runs; pushes get unique groups so none is dropped.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
 env:
   MAVEN_OPTS: -Xmx2048m -Xms1024m
   LANG: en_US.utf8
 
 jobs:
-  changes:
-    uses: ./.github/workflows/changes.yml
-
   owasp:
     name: OWASP
-    needs: changes
-    if: needs.changes.outputs.code == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 30
     env:
       HAVE_NIST_NVD_API_KEY: ${{ secrets.NIST_NVD_API_KEY != '' }}
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
+      - name: Detect changes
+        id: changes
+        uses: ./.github/actions/detect-changes
       - name: Setup Java 25
+        if: steps.changes.outputs.code == 'true'
         uses: actions/setup-java@v6
         with:
           distribution: temurin
@@ -55,6 +59,7 @@ jobs:
 
       - name: Cache NVD Database
         id: cache-nvd
+        if: steps.changes.outputs.code == 'true'
         uses: actions/cache/restore@v6
         with:
           path: ~/.m2/repository/org/owasp/dependency-check-data
@@ -65,35 +70,36 @@ jobs:
 
       - name: OWASP Dependency check update cache via NIST_NVD_API_KEY
         id: nvd-api-update
-        if: ${{ env.HAVE_NIST_NVD_API_KEY == 'true' }}
+        if: ${{ steps.changes.outputs.code == 'true' && env.HAVE_NIST_NVD_API_KEY == 'true' }}
         continue-on-error: true
         run:  mvn -N -V -DskipAssembly -Dmaven.test.skip=true -Powasp-nvd-api -Pdependency-update-only --no-transfer-progress
         env:
           NIST_NVD_API_KEY: ${{ secrets.NIST_NVD_API_KEY}}
 
       - name: OWASP Dependency check update cache via Mirror
-        if: ${{ env.HAVE_NIST_NVD_API_KEY == 'false' || steps.nvd-api-update.outcome == 'failure' }}
+        if: ${{ steps.changes.outputs.code == 'true' && (env.HAVE_NIST_NVD_API_KEY == 'false' || steps.nvd-api-update.outcome == 'failure') }}
         run:  mvn -N -V -DskipAssembly -Dmaven.test.skip=true -Powasp-nvd-mirror -Pdependency-update-only --no-transfer-progress
 
       - name: Cache NVD Database
         uses: actions/cache/save@v6
-        if: ${{ always() }}
+        if: ${{ always() && steps.changes.outputs.code == 'true' }}
         with:
           path: ~/.m2/repository/org/owasp/dependency-check-data
           key: nvd-cache-${{ runner.os }}-owasp-${{ github.run_id }}
 
       - name: OWASP check (Without running tests)
+        if: steps.changes.outputs.code == 'true'
         run: mvn -B org.owasp:dependency-check-maven:aggregate -Pdependency-check -Pjakartaee11 -DautoUpdate=false --no-transfer-progress
 
       - name: Upload Dependency Check reports
         uses: actions/upload-artifact@v7
-        if: always()
+        if: always() && steps.changes.outputs.code == 'true'
         with:
           name: dependency-check
           path: target/dependency-check*
 
       - name: Add OWASP summary
-        if: always()
+        if: always() && steps.changes.outputs.code == 'true'
         run: |
           {
             echo "## OWASP Dependency Check"