CI: Run the code quality checks once, in the job that is meant to run them

.github/workflows/codeql.yml

@@ -44,8 +44,10 @@ jobs:
           languages: java
           build-mode: manual
 
+      # This job builds only so that CodeQL can watch it. The quality gate bound to
+      # package belongs to the static analysis job in maven.yml, so it is turned off here.
       - name: Build
-        run: mvn -B -DskipTests package
+        run: mvn -B -DskipTests package -Pwithout-quality-gates
 
       - name: Perform CodeQL analysis
         uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8

.github/workflows/examples.yml

@@ -93,8 +93,10 @@ jobs:
       - name: Empty this coordinate in the local repository
         run: rm -rf "${HOME}/.m2/repository/de/tum/cit/ase/ares/${ARES_VERSION}"
 
+      # Installing is what this step is for. The quality gate bound to package is the
+      # static analysis job's business, so it is turned off here.
       - name: Install Ares from this commit
-        run: mvn -B -ntp install -DskipTests
+        run: mvn -B -ntp install -DskipTests -Pwithout-quality-gates
 
       # Asserted rather than assumed: everything downstream reads the local
       # repository, and an absent classifier there fails as a resolution error in an

.github/workflows/maven.yml

@@ -19,8 +19,10 @@ concurrency:
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
-  # The mandatory gate. Everything else waits on it, so a broken build costs one job
-  # rather than four.
+  # The mandatory gate, and it answers one question only: does the project build. Whether
+  # the code is written the way this repository writes code is the static analysis job's
+  # question. Everything else waits on this one, so a broken build costs one job rather
+  # than four.
   build:
     name: Build
     runs-on: ubuntu-24.04
@@ -40,11 +42,11 @@ jobs:
           distribution: 'temurin'
           cache: 'maven'
 
-      - name: Spotless Check
-        run: mvn spotless:check
-
+      # Checkstyle, PMD, CPD and SpotBugs are bound to package in the POM, so they would
+      # run here as well and repeat what the static analysis job is for. The profile turns
+      # that gate off for this one command; it stays on for a local build.
       - name: Build
-        run: mvn clean package -DskipTests
+        run: mvn clean package -DskipTests -Pwithout-quality-gates
 
   static-analysis:
     name: Static Code Analysis
@@ -66,7 +68,8 @@ jobs:
           distribution: 'temurin'
           cache: 'maven'
 
-      # SpotBugs reads class files, so the sources have to be compiled first.
+      # SpotBugs reads class files, and PMD needs them on its auxiliary classpath to tell a
+      # used wildcard import from an unused one, so the sources have to be compiled first.
       - name: Compile
         run: mvn -DskipTests compile
 
@@ -84,6 +87,13 @@ jobs:
         if: ${{ !cancelled() }}
         run: mvn pmd:check
 
+      # cpd-check is a goal of its own; pmd:check does not include it. It reached CI only
+      # as a side effect of the package-bound execution, which this workflow no longer
+      # runs, so without this step nothing would look for duplicated code.
+      - name: CPD
+        if: ${{ !cancelled() }}
+        run: mvn pmd:cpd-check
+
       - name: SpotBugs
         if: ${{ !cancelled() }}
         run: mvn spotbugs:check
@@ -96,6 +106,7 @@ jobs:
           path: |
             target/checkstyle-result.xml
             target/pmd.xml
+            target/cpd.xml
             target/spotbugsXml.xml
           if-no-files-found: warn
 
@@ -284,7 +295,7 @@ jobs:
       - name: Merge execution data and evaluate thresholds
         shell: bash
         run: |
-          mvn verify -Pcoverage-aggregate -DskipTests -Djacoco.haltOnFailure=false -f pom.xml \
+          mvn verify -Pcoverage-aggregate,without-quality-gates -DskipTests -Djacoco.haltOnFailure=false -f pom.xml \
             2>&1 | tee "${RUNNER_TEMP}/coverage-aggregate.log"
 
       - name: Write coverage summary

pom.xml

@@ -817,16 +817,13 @@
 					</java>
 				</configuration>
 			</plugin>
-			<!-- Static analysis: the failing goals are bound to package so every local or CI
-				artefact build crosses the same Checkstyle, PMD, CPD and SpotBugs gate. The
-				goals may also be run directly for faster feedback; report-only goals remain
-				available for inspection.
+			<!-- Static analysis: these goals are bound to package, so a local build crosses the
+				same gate. CI runs it once, in the job named after it, and turns it off elsewhere
+				with the without-quality-gates profile below.
 
-				The rule sets live in .settings next to the Eclipse formatter rules. They are
-				deliberately trimmed so that no rule contradicts the formatter (which owns
-				indentation, tabs, line length and import order) and no rule objects to a
-				deliberate security idiom; see the comment in each file. The findings that
-				remain are build failures rather than report-only warnings. -->
+				The rule sets in .settings are trimmed so that no rule contradicts the formatter,
+				which owns indentation and import order, and none objects to a deliberate security
+				idiom. What is left fails the build rather than warning. -->
 			<plugin>
 				<groupId>org.apache.maven.plugins</groupId>
 				<artifactId>maven-checkstyle-plugin</artifactId>
@@ -1253,6 +1250,26 @@
 				</plugins>
 			</build>
 		</profile>
+		<!-- Turns the whole quality gate off for a single Maven invocation. Checkstyle, PMD,
+			CPD and SpotBugs are bound to package above, so every command that reaches that
+			phase runs them, whether or not checking the code was the point of the command.
+			CI activates this profile wherever it was not, so the gate is enforced once
+			rather than in every job that happens to package the project. The profile is not
+			active by default, so a local build still crosses the gate. -->
+		<profile>
+			<id>without-quality-gates</id>
+			<properties>
+				<!-- Spotless has no execution of its own and is invoked as a goal by the job that
+					owns the gate, so this property changes nothing today. It is here so that
+					binding spotless:check to a phase later cannot put it back into the builds
+					that opted out, silently and without a second edit. -->
+				<spotless.skip>true</spotless.skip>
+				<checkstyle.skip>true</checkstyle.skip>
+				<pmd.skip>true</pmd.skip>
+				<cpd.skip>true</cpd.skip>
+				<spotbugs.skip>true</spotbugs.skip>
+			</properties>
+		</profile>
 		<!-- This is only for GitHub -->
 		<profile>
 			<id>github</id>