ci: improve workflow with two-stage build/test pipeline (#692)

- Split into build and test jobs (test depends on build)
- Add Java 17/21 test matrix
- Add Maven dependency caching
- Add concurrency control to cancel stale runs
- Add publish test results via EnricoMi/publish-unit-test-result-action
- Upload surefire reports as artifacts on failure
- Add least-privilege permissions
- Expand paths-ignore for docs

Author: jbonofre

.github/workflows/main.yml

@@ -28,10 +28,21 @@ on:
       - '.asf.yml'
       - 'LICENSE'
       - 'NOTICE'
+      - '**/*.md'
+      - 'docs/**'
+
+permissions:
+  contents: read
+  checks: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
   build:
     runs-on: ubuntu-latest
+    name: Build
     steps:
       - name: Free disk space
         run: |
@@ -45,4 +56,55 @@ jobs:
         with:
           java-version: 17
           distribution: zulu
-      - run: ./mvnw -V --no-transfer-progress clean install -Ddump.logs.on.failure=true
+          cache: maven
+      - run: ./mvnw -V --no-transfer-progress clean install -DskipTests
+      - name: Upload build artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: build-artifacts
+          path: |
+            **/target/*.jar
+            **/target/classes/
+            **/target/test-classes/
+          retention-days: 1
+
+  test:
+    runs-on: ubuntu-latest
+    needs: build
+    strategy:
+      fail-fast: false
+      matrix:
+        java-version: ['17', '21']
+    name: Test (Java ${{ matrix.java-version }})
+    steps:
+      - name: Free disk space
+        run: |
+          sudo rm -rf /usr/share/dotnet \
+            /opt/ghc \
+            "/usr/local/share/boost" \
+            "$AGENT_TOOLSDIRECTORY"
+          docker system prune -af
+      - uses: actions/checkout@v4
+      - uses: actions/setup-java@v4
+        with:
+          java-version: ${{ matrix.java-version }}
+          distribution: zulu
+          cache: maven
+      - name: Download build artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: build-artifacts
+      - run: ./mvnw -V --no-transfer-progress verify -Ddump.logs.on.failure=true
+      - name: Publish test results
+        if: always()
+        uses: EnricoMi/publish-unit-test-result-action@v2
+        with:
+          files: '**/target/surefire-reports/*.xml'
+          check_name: Test Results (Java ${{ matrix.java-version }})
+      - name: Upload test reports
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: test-reports-java-${{ matrix.java-version }}
+          path: '**/target/surefire-reports/'
+          retention-days: 7