ci: cut Docker test job from 40m to 25m by building a lean distribution

.github/scripts/openrewrite.sh

@@ -22,6 +22,5 @@ export MAVEN_OPTS=-Xmx8g
 
 echo 'Running Maven install...'
 mvn -B clean install -q -ff -pl '!distribution' -P skip-tests -Dweb.console.skip=true -T1C
-mvn -B install -q -ff -pl 'distribution' -P skip-tests -Dweb.console.skip=true
 
 mvn -B rewrite:dryRun -Dweb.console.skip=true

.github/scripts/packaging-check.sh

@@ -19,7 +19,15 @@ set -e
 set -x
 
 ./.github/scripts/setup_generate_license.sh
-mvn -B clean install -Prat --fail-at-end \
-  -pl '!benchmarks, !distribution' -P skip-tests -Dweb.console.skip=false -T1C
-mvn -B install -Prat -Pdist -Pbundle-contrib-exts --fail-at-end \
-  -pl 'distribution' -P skip-tests -Dweb.console.skip=false -T1C
+# This job is the single place in CI that validates everything a release build
+# produces: RAT license headers, javadoc and source jars, the binary and source
+# distribution assemblies, and the license dependency reports. The apache-release
+# profile is enabled here so that the Docker test job only needs to build the
+# binary tarball. GPG signing and the OWASP dependency check are skipped as they
+# are not meaningful in CI.
+mvn -B clean install -Prat -Papache-release --fail-at-end \
+  -pl '!benchmarks, !distribution' -P skip-tests -Dweb.console.skip=false -T1C \
+  -Dgpg.skip -Ddependency-check.skip
+mvn -B install -Prat -Papache-release -Pdist -Pbundle-contrib-exts --fail-at-end \
+  -pl 'distribution' -P skip-tests -Dweb.console.skip=false -T1C \
+  -Dgpg.skip -Ddependency-check.skip

.github/scripts/run_docker-tests

@@ -35,4 +35,10 @@ fi
 
 # No snapshot updates
 OPTS+=" -nsu"
-mvn -B -pl embedded-tests -am $OPTS verify -Pdocker-tests,skip-static-checks -DskipUTs -D$DRUID_IMAGE_SYS_PROPERTY=$DRUID_IMAGE_NAME "-DjfrProfilerArgLine=$JFR_PROFILER_ARG_LINE" "$@"
+# Only embedded-tests is built here. The Docker workflow builds the distribution
+# first (mvn install of the whole reactor), which installs every module
+# (including web-console, a test-scoped dependency of embedded-tests) into the
+# local Maven repository on a fresh runner, and no Maven build cache is persisted
+# across jobs. Adding -am would re-run the whole reactor, including web-console,
+# a second time.
+mvn -B -pl embedded-tests $OPTS verify -Pdocker-tests,skip-static-checks -DskipUTs -D$DRUID_IMAGE_SYS_PROPERTY=$DRUID_IMAGE_NAME "-DjfrProfilerArgLine=$JFR_PROFILER_ARG_LINE" "$@"

.github/scripts/static-checks-maven.sh

@@ -20,11 +20,19 @@ set -x
 
 echo 'Running Maven install...'
 mvn -B clean install -q -ff -pl '!distribution' -P skip-tests -Dweb.console.skip=true -Dmaven.javadoc.skip=true -T1C
-mvn -B install -q -ff -pl 'distribution' -P skip-tests -Dweb.console.skip=true -Dmaven.javadoc.skip=true
 
 mvn -B checkstyle:checkstyle --fail-at-end
 
-./.github/scripts/license_checks_script.sh
+# Repo-wide RAT check. packaging-check also runs RAT, but it excludes the
+# benchmarks module from its reactor, so keep this standalone pass here.
+mvn -B apache-rat:check -Prat --fail-at-end \
+  -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn \
+  -Drat.consoleOutput=true
+
+# The license dependency reports and check-licenses.py that used to run via
+# license_checks_script.sh are covered by the packaging-check job, which builds
+# the distribution with the apache-release profile. Not repeated here.
+# ./.github/scripts/license_checks_script.sh
 
 ./.github/scripts/analyze_dependencies_script.sh
 

.github/workflows/docker-tests.yml

@@ -31,8 +31,19 @@ jobs:
           distribution: 'zulu'
           java-version: 25
           cache: 'maven'
-      - name: Build the Druid distribution
-        run: .github/scripts/build-dist
+      - name: Build the Druid distribution for the Docker image
+        # Build only what the Docker image needs: the binary distribution tarball.
+        # Release-only work (javadoc and source jars, source-release assembly,
+        # license dependency reports) and the static checks are validated by the
+        # Static Checks CI workflow (packaging-check and static-checks-maven), so
+        # they are skipped here. Same flags as the builder stage in
+        # distribution/docker/Dockerfile. This also installs every reactor module
+        # into the local Maven repository, which run_docker-tests relies on.
+        # benchmarks is excluded: nothing in the distribution or the Docker tests
+        # depends on it. The web console assets are skipped too: no Docker test
+        # uses the console, the router tolerates the missing assets, and the
+        # console is fully built and packaged by packaging-check on every commit.
+        run: mvn -B -T1C clean install -pl '!benchmarks' -Pdist,bundle-contrib-exts,skip-static-checks,skip-tests -Dweb.console.skip=true
       - name: Build the Docker image
         run: |
           DOCKER_BUILDKIT=1 docker build \