amaechler opened a new pull request, #20692: URL: https://github.com/apache/druid/pull/20692
### Description `Cron Job ITs` runs the OWASP dependency check on pull requests that change `owasp-dependency-check-suppressions.xml`. It had no `concurrency` block, so each new push to such a PR started another run while the previous one kept going. The check purges and re-downloads the NVD database every time, so a run takes 28 minutes at the median and up to six hours. Between 2025-09-05 and 2026-10-22, 17 of 130 pull request runs were still going when a newer push to the same PR started, and they ran for about 2,660 more job-minutes after that point. Cancelling them frees shared ASF runners, as the [ASF GitHub Actions policy](https://infra.apache.org/github-actions-policy.html) asks. #### Added a concurrency group to `cron-job-its.yml` The block is the same one `unit-and-integration-tests-unified.yml`, `static-checks.yml` and `codeql.yml` use. Pull request runs are grouped by head label, so a new push cancels the run in progress. Scheduled runs on master and pushes to release branches fall back to `github.run_id`, get a group of their own, and are never cancelled. Grouping release-branch pushes by `github.ref` as well would save about 650 more job-minutes over the same period. I kept the shared expression so all workflows behave the same way on branch pushes. I tested the block with the same triggers in a private repository, using a job that sleeps for four minutes: - A second push to a PR cancelled the run for the first push, about a minute after the new run was queued. - Two quick pushes to a release branch both ran to completion in parallel. - Re-running the cancelled run of an older commit cancels the run for the PR head. The other workflows using this group behave the same way. - PRs from one branch to `master` and to a release branch share a group, so a push cancels one of the two runs. Both PRs then show the surviving run's check. This has not happened for this workflow in the last 13 months. #### Fixed the failure message re-running Maven The failure message wrapped `./mvnw dependency-check:check` in backticks inside a double-quoted string, so bash ran it as a command substitution. Every failed check started a second Maven run and pasted its output into the message. The command is now in single quotes, so it is printed instead of run. #### Workflows left unchanged - `ci.yml`, `docker-tests.yml`, `worker.yml`: reusable workflows. Their jobs belong to the caller's run and are cancelled with it. A called workflow sees the caller's `github.workflow`, so a block of its own could clash with the caller's group. - Unit and integration tests, static checks, CodeQL and PR commit checks already cancel superseded PR runs. - `backport.yml` and `stale.yml` create PRs, comments or labels, and cancelling them partway could leave partial results. <hr> ##### Key changed/added classes in this PR * `.github/workflows/cron-job-its.yml` <hr> This PR has: - [x] been self-reviewed. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
