refactor(server): preserve core gremlin semantics (2/3)

.github/workflows/.java-version

@@ -1 +1 @@
-11
+17

.github/workflows/check-dependencies.yml

@@ -22,6 +22,11 @@ on:
 permissions:
   contents: read
 
+# Keep the newest PR run; preserve independent push, release and manual runs.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   dependency-check:
     runs-on: ubuntu-latest

.github/workflows/cluster-test-ci.yml

@@ -27,6 +27,11 @@ on:
       - '!**/AGENTS.md'
       - '!**/CLAUDE.md'
 
+# Keep the newest PR run; preserve independent push, release and manual runs.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   cluster-test:
     runs-on: ubuntu-latest
@@ -59,8 +64,27 @@ jobs:
 
       - name: Run simple cluster test
         run: |
-          mvn test -pl hugegraph-cluster-test/hugegraph-clustertest-test -am -P simple-cluster-test
+          timeout 45m mvn test -pl hugegraph-cluster-test/hugegraph-clustertest-test \
+            -am -P simple-cluster-test
 
       - name: Run multi cluster test
         run: |
-          mvn test -pl hugegraph-cluster-test/hugegraph-clustertest-test -am -P multi-cluster-test
+          timeout 45m mvn test -pl hugegraph-cluster-test/hugegraph-clustertest-test \
+            -am -P multi-cluster-test
+
+      - name: Show cluster diagnostics on failure
+        if: failure()
+        run: |
+          echo "[ci] java processes:"
+          ps -ef | grep -E "HugeGraph|hg-|java" | grep -v grep || true
+          echo "[ci] listening tcp ports:"
+          (ss -ltnp || netstat -ltnp || true) 2>&1
+          find hugegraph-cluster-test -path '*/logs/*' -type f | sort | while read -r log; do
+            echo "--- tail -n 200 $log ---"
+            tail -n 200 "$log" || true
+          done
+          find . -path '*/surefire-reports/*' -type f \
+            \( -name '*.txt' -o -name '*.xml' \) | sort | while read -r report; do
+            echo "--- tail -n 120 $report ---"
+            tail -n 120 "$report" || true
+          done

.github/workflows/codeql-analysis.yml

@@ -9,6 +9,11 @@ on:
   schedule:
     - cron: '33 0 * * 5'
 
+# Keep the newest PR run; preserve independent push, release and manual runs.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   analyze:
     env:

.github/workflows/commons-ci.yml

@@ -9,6 +9,11 @@ on:
       - 'test-*'
   pull_request:
 
+# Keep the newest PR run; preserve independent push, release and manual runs.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   java-runtime:
     uses: ./.github/workflows/java-runtime.yml
@@ -53,11 +58,13 @@ jobs:
 
       - name: Run common test
         run: |
-          mvn test -pl hugegraph-commons/hugegraph-common -Dtest=UnitTestSuite -DskipCommonsTests=false
+          mvn test -pl hugegraph-commons/hugegraph-common -Dtest=UnitTestSuite \
+            -DskipCommonsTests=false -Dsurefire.failIfNoSpecifiedTests=true
 
       - name: Run rpc test
         run: |
-          mvn test -pl hugegraph-commons/hugegraph-rpc -Dtest=UnitTestSuite -DskipCommonsTests=false
+          mvn test -pl hugegraph-commons/hugegraph-rpc -Dtest=UnitTestSuite \
+            -DskipCommonsTests=false -Dsurefire.failIfNoSpecifiedTests=true
 
       - name: Upload coverage to Codecov
         uses: codecov/codecov-action@v7

.github/workflows/docker-build-ci.yml

@@ -44,6 +44,11 @@ on:
       - '!**/AGENTS.md'
       - '!**/CLAUDE.md'
 
+# Keep the newest PR run; preserve independent push, release and manual runs.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   docker-bake-check:
     runs-on: ubuntu-latest
@@ -137,6 +142,15 @@ jobs:
           echo "Healthcheck: $HC"
           [[ "$HC" != "null" ]] || { echo "ERROR: HEALTHCHECK missing in ${{ matrix.dockerfile }}"; exit 1; }
 
+      - name: Verify Java 17 runtime in ${{ matrix.dockerfile }}
+        run: |
+          JAVA_VERSION=$(docker run --rm --entrypoint java "$IMAGE_ID" -version 2>&1)
+          echo "$JAVA_VERSION"
+          grep -Eq 'version "17\.' <<< "$JAVA_VERSION" || {
+            echo "ERROR: expected a Java 17 runtime in ${{ matrix.dockerfile }}"
+            exit 1
+          }
+
       - name: Test server entrypoint property mapping
         if: matrix.dockerfile == 'hugegraph-server/Dockerfile'
         run: bash hugegraph-server/hugegraph-dist/docker/test/test-docker-entrypoint.sh

.github/workflows/helm-chart-ci.yml

@@ -27,6 +27,11 @@ on:
 permissions:
   contents: read
 
+# Keep the newest PR run; preserve independent push, release and manual runs.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   lint-and-render:
     runs-on: ubuntu-latest

.github/workflows/licence-checker.yml

@@ -7,6 +7,11 @@ on:
       - 'release-*'
   pull_request:
 
+# Keep the newest PR run; preserve independent push, release and manual runs.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   check-license:
     runs-on: ubuntu-latest