[imbajin]

Separate affected consumer tests from merge requirements so maintainers can decide whether failed or cancelled advisory checks need another run.

Before	After
Every selected consumer/image feeds a required module gate; CodeQL waits for it.	Require only basic license checks. Consumer, image and dependency audits remain advisory; CodeQL starts independently.
Dependency inventory misses root Maven configuration changes; pure documentation can still scan.	Audit .mvn/** with the existing Maven context; explicit prose-only changes skip builds and PR scans.
Cancellation and target-branch advancement can block unrelated checks.	Isolate license checks, retain real advisory results, and do not reject completed tests solely because master advanced.

Preserve the merged Java 17 SDK/runtime policy, same-run Server fixtures, configured candidate/release compatibility checks and the existing pinned Hadoop Docker path. Only failed required-license push runs automatically retry; PRs and advisory workflows use manual reruns. The SDK, fixtures and images use the same verified ASF master commit after the Java 17/TinkerPop migration. SDK preparation builds only the Server distribution and its dependencies, retaining every required SDK module. Parent POMs are flattened before installation, and Loader prepares HDFS from the pinned Hadoop image with bounded startup and cleanup.

Migration: .asf.yaml requests only check-license-header. Existing module and scan check names remain available; verify live protection removes their old requirements after merge before independently cancelling advisory work.

Validation: policy/provenance tests, a real Java 17 SDK build from the merged ASF source, workflow checks and independent review pass. GitHub integration needs to run on the updated branch. Independent native workflows keep license checks outside advisory cancellation scope.

Does this PR potentially affect the following parts?

• Dependencies
• Modify configurations
• The public API
• Other affects
• Nope

Documentation Status

• Doc - Done: docs/ci.md
• Doc - TODO
• Doc - No Need

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 45.91%. Comparing base (b066b80) to head (551e08a).
⚠️ Report is 252 commits behind head on master.

Additional details and impacted files

@@              Coverage Diff              @@
##             master     #791       +/-   ##
=============================================
- Coverage     62.49%   45.91%   -16.59%     
- Complexity     1903     4336     +2433     
=============================================
  Files           262      602      +340     
  Lines          9541    29047    +19506     
  Branches        886     3369     +2483     
=============================================
+ Hits           5963    13336     +7373     
- Misses         3190    14458    +11268     
- Partials        388     1253      +865     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[bitflicker64]

Blocking: yes. Summary: The required/advisory split, the license-only automatic retry and the independent CodeQL plan work as described. Manual and weekly CodeQL runs still fall back to all three languages and the dependency audit. The new Maven regression test for the SDK flatten step never runs in CI, and the rollout note promises an Analyze (java) context that the PR no longer always produces. Evidence: full diff of 9a63a4c against merge-base f8db70e (22 files). Ran python3 -m unittest discover -s .github/scripts -p 'test_*.py' at the head (59 tests OK, 2 skipped, one of them CandidateParentModelTest), then the same test with CANDIDATE_SDK_MAVEN_TEST=mvn (passes, writes to ~/.m2). Called create_plan with schedule/dispatch-style events ({} and a zero before), which gives full coverage, all three scan languages and the dependency audit. Live branches/master protection requires check-license-header and affected-module-tests. All latest-head checks pass except the advisory codecov/project.