ci: reduce integration workflow run time (#1313)

* ci: always run on main

* ci: cache integration go build

* ci: zizmor ignore

* ci: cancel stale workflows on new commits

* ci: concurrency for vm and java-agent

* ci: concurrency for remaining PR-workflows

* ci: refactor matrix by run time

* fix: extract aggregate test run time

* ci: restore markdown workflow paths

* Update scripts/update-test-weights.sh

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Update scripts/update-test-weights.sh

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* fix: ensure error reporting on weights script works

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Author: skl

.gitattributes

@@ -0,0 +1 @@
+scripts/integration-test-weights.generated.json linguist-generated=true

.github/workflows/check_gh_actions_security.yml

@@ -7,6 +7,10 @@ on:
   pull_request:
     branches: ["**"]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 

.github/workflows/clang-format-check.yml

@@ -12,6 +12,10 @@ on:
         required: false
         type: string
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 

.github/workflows/clang-tidy-check.yml

@@ -12,6 +12,10 @@ on:
         required: false
         type: string
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 

.github/workflows/java-agent.yml

@@ -3,9 +3,6 @@ name: Java Agent CI
 on:
   push:
     branches: ["main", "release-*"]
-    paths:
-      - "pkg/internal/java/**"
-      - ".github/workflows/java-agent.yml"
   pull_request:
     branches: ["main", "release-*"]
     paths:
@@ -19,6 +16,10 @@ on:
         required: false
         type: string
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
@@ -72,4 +73,4 @@ jobs:
         with:
           name: obi-java-agent
           path: pkg/internal/java/build/obi-java-agent.jar
-          retention-days: 7
+          retention-days: 7

.github/workflows/lint_darwin.yml

@@ -3,17 +3,6 @@ name: Lint (Darwin)
 on:
   push:
     branches: ["main", "release-*"]
-    paths:
-      - ".github/workflows/lint_darwin.yml"
-      - "**.go"
-      - "go.mod"
-      - "go.sum"
-      - "bpf/**"
-      - "cmd/**"
-      - "configs/**"
-      - "internal/**"
-      - "pkg/**"
-      - "scripts/**"
   pull_request:
     branches: ["main", "release-*"]
     paths:
@@ -28,6 +17,10 @@ on:
       - "pkg/**"
       - "scripts/**"
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 

.github/workflows/markdown-fail-fast.yml

@@ -8,6 +8,10 @@ on:
     paths:
       - "**.md"
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 

.github/workflows/pull_request.yml

@@ -12,6 +12,10 @@ on:
         required: false
         type: string
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 

.github/workflows/pull_request_docker_build_test.yml

@@ -8,6 +8,11 @@ on:
         description: "Git ref (commit, branch, or tag) to check out"
         required: false
         type: string
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 

.github/workflows/pull_request_integration_tests.yml

@@ -3,17 +3,6 @@ name: Pull request integration tests
 on:
   push:
     branches: ["main", "release-*"]
-    paths:
-      - ".github/workflows/pull_request_integration_tests.yml"
-      - "**.go"
-      - "go.mod"
-      - "go.sum"
-      - "bpf/**"
-      - "cmd/**"
-      - "configs/**"
-      - "internal/**"
-      - "pkg/**"
-      - "scripts/**"
   pull_request:
     branches: ["main", "release-*"]
     paths:
@@ -34,6 +23,10 @@ on:
         required: false
         type: string
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
@@ -119,10 +112,18 @@ jobs:
           persist-credentials: false
 
       - name: Set up Go
-        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 # zizmor: ignore[cache-poisoning] go.sum verifies module integrity
         with:
           go-version-file: "go.mod"
-          cache: false
+          cache: true
+
+      - name: Go build cache
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 # zizmor: ignore[cache-poisoning] go build cache is content-addressable and self-verifying
+        with:
+          path: ~/.cache/go-build
+          key: go-build-integration-race-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('**/*.go', 'go.sum') }}
+          restore-keys: |
+            go-build-integration-race-${{ runner.os }}-${{ runner.arch }}-
 
       - name: Generate files
         run: make prereqs docker-generate