fix: stabilize required checks and CI runtime

.asf.yaml

@@ -41,8 +41,9 @@ github:
           - Analyze (java)
           - CodeQL
           - check-license
-          - build-server (memory, 11)
-          - build-commons (11)
+          # Require the fixed memory result gate, independent of the runtime JDK list.
+          # Commons CI continues to run without blocking merges.
+          - Server memory tests
       required_pull_request_reviews:
         dismiss_stale_reviews: true
         require_code_owner_reviews: false

.github/workflows/.java-version

@@ -0,0 +1 @@
+11

.github/workflows/auto-pr-review.yml

@@ -28,7 +28,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Add review comment
-        uses: peter-evans/create-or-update-comment@v4
+        uses: peter-evans/create-or-update-comment@v5
         with:
           issue-number: ${{ github.event.pull_request.number }}
           body: |

.github/workflows/check-dependencies.yml

@@ -8,6 +8,7 @@ on:
   pull_request:
     # Keep source/resources and shared build inputs; skip named documentation files.
     paths:
+      - '.github/workflows/.java-version'
       - '**/pom.xml'
       - '.mvn/**'
       - '.github/configs/**'
@@ -29,12 +30,12 @@ jobs:
       SCRIPT_DEPENDENCY: install-dist/scripts/dependency
     steps:
       - name: Checkout source
-        uses: actions/checkout@v4
-      - name: Set up JDK 11
-        uses: actions/setup-java@v3
+        uses: actions/checkout@v7
+      - name: Set up project JDK
+        uses: actions/setup-java@v6
         with:
-          java-version: '11'
-          distribution: 'adopt'
+          java-version-file: .github/workflows/.java-version
+          distribution: 'temurin'
 
       - name: use staged maven repo settings
         if: ${{ env.USE_STAGE == 'true' }}
@@ -56,7 +57,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Checkout Repository'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
       - name: 'Dependency Review'
         uses: actions/dependency-review-action@v5
         # Refer: https://github.com/actions/dependency-review-action

.github/workflows/cluster-test-ci.yml

@@ -9,6 +9,7 @@ on:
   pull_request:
     # Keep source/resources and shared build inputs; skip named documentation files.
     paths:
+      - '.github/workflows/.java-version'
       - 'pom.xml'
       - '.mvn/**'
       - 'style/**'
@@ -33,24 +34,19 @@ jobs:
       USE_STAGE: 'false' # Whether to include the stage repository.
 
     steps:
-      - name: Install JDK 11
-        uses: actions/setup-java@v3
-        with:
-          java-version: '11'
-          distribution: 'zulu'
-
-      - name: Cache Maven packages
-        uses: actions/cache@v3
-        with:
-          path: ~/.m2
-          key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
-          restore-keys: ${{ runner.os }}-m2
-
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 5
 
+      - name: Install project JDK
+        uses: actions/setup-java@v6
+        with:
+          java-version-file: .github/workflows/.java-version
+          distribution: 'zulu'
+          cache: maven
+          cache-jdk: false
+
       - name: use staged maven repo settings
         if: ${{ env.USE_STAGE == 'true' }}
         run: |

.github/workflows/codeql-analysis.yml

@@ -27,13 +27,13 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Java JDK
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@v6
         with:
           distribution: 'zulu'
-          java-version: '11'
+          java-version-file: .github/workflows/.java-version
 
       - name: use staged maven repo settings
         if: ${{ env.USE_STAGE == 'true' }}
@@ -43,7 +43,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@v4
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -54,7 +54,7 @@ jobs:
       # Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v3
+        uses: github/codeql-action/autobuild@v4
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 https://git.io/JvXDl
@@ -68,4 +68,4 @@ jobs:
       #   make release
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@v4

.github/workflows/commons-ci.yml

@@ -10,34 +10,36 @@ on:
   pull_request:
 
 jobs:
+  java-runtime:
+    uses: ./.github/workflows/java-runtime.yml
+    permissions:
+      contents: read
+
   build-commons:
+    name: Commons tests (Java ${{ matrix.JAVA_VERSION }})
+    needs: java-runtime
     runs-on: ubuntu-latest
     env:
       USE_STAGE: 'false' # Whether to include the stage repository.
 
     strategy:
       fail-fast: false
       matrix:
-        JAVA_VERSION: ['11']
+        JAVA_VERSION: ${{ fromJSON(needs.java-runtime.outputs.versions || '["unavailable"]') }}
 
     steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 2
+
       - name: Install JDK ${{ matrix.JAVA_VERSION }}
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@v6
         with:
           java-version: ${{ matrix.JAVA_VERSION }}
           distribution: 'zulu'
-
-      - name: Cache Maven packages
-        uses: actions/cache@v3
-        with:
-          path: ~/.m2
-          key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
-          restore-keys: ${{ runner.os }}-m2
-
-      - name: Checkout
-        uses: actions/checkout@v3
-        with:
-          fetch-depth: 2
+          cache: maven
+          cache-jdk: false
 
       - name: Use staged maven repo settings
         if: ${{ env.USE_STAGE == 'true' }}
@@ -58,9 +60,27 @@ jobs:
           mvn test -pl hugegraph-commons/hugegraph-rpc -Dtest=UnitTestSuite -DskipCommonsTests=false
 
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v7
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: hugegraph-commons/target/jacoco.xml
           disable_search: true
           fail_ci_if_error: false
+
+  # Temporary compatibility check; Commons becomes optional when .asf.yaml takes effect.
+  legacy-commons-required:
+    name: build-commons (11)
+    needs: [ java-runtime, build-commons ]
+    if: ${{ always() }}
+    runs-on: ubuntu-24.04
+    permissions: {}
+    steps:
+      - name: Require the runtime configuration and all Commons tests to pass
+        env:
+          RUNTIME_RESULT: ${{ needs.java-runtime.result }}
+          COMMONS_RESULT: ${{ needs.build-commons.result }}
+        run: |
+          if [ "$RUNTIME_RESULT" != "success" ] || [ "$COMMONS_RESULT" != "success" ]; then
+            echo "::error::Runtime configuration: $RUNTIME_RESULT; Commons tests: $COMMONS_RESULT"
+            exit 1
+          fi

.github/workflows/docker-build-ci.yml

@@ -49,7 +49,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Verify shared Maven stages stay identical
         shell: bash
@@ -121,7 +121,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Build ${{ matrix.dockerfile }}
         run: |

.github/workflows/java-runtime.yml

@@ -0,0 +1,69 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: CI Java runtime
+
+on:
+  workflow_call:
+    inputs:
+      extra-java-versions:
+        description: Additional JDKs to test alongside the configured project runtime (JSON array).
+        type: string
+        default: '[]'
+    outputs:
+      versions:
+        description: Project runtime followed by any additional test JDKs (JSON array).
+        value: ${{ jobs.read-version.outputs.versions }}
+
+permissions:
+  contents: read
+
+jobs:
+  read-version:
+    runs-on: ubuntu-24.04
+    outputs:
+      versions: ${{ steps.java.outputs.versions }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Read the project runtime and optional test JDKs
+        id: java
+        env:
+          EXTRA_JAVA_VERSIONS: ${{ inputs.extra-java-versions }}
+        run: |
+          python3 - <<'PYTHON'
+          import json
+          import os
+          import re
+          from pathlib import Path
+
+          runtime = Path('.github/workflows/.java-version').read_text().strip()
+          extra = json.loads(os.environ['EXTRA_JAVA_VERSIONS'])
+          if not isinstance(extra, list):
+              raise ValueError('extra-java-versions must be a JSON array')
+          versions = []
+          for version in [runtime, *extra]:
+              if not isinstance(version, str) or not re.fullmatch(r'[1-9][0-9]*(\.[0-9]+)*', version):
+                  raise ValueError('Java versions must be non-empty numeric strings')
+              if version not in versions:
+                  versions.append(version)
+          with open(os.environ['GITHUB_OUTPUT'], 'a') as output:
+              print('versions=' + json.dumps(versions), file=output)
+          PYTHON

.github/workflows/licence-checker.yml

@@ -13,7 +13,7 @@ jobs:
     env:
       USE_STAGE: 'false' # Whether to include the stage repository.
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Check License Header
         uses: apache/skywalking-eyes@main