ci: build only the Linux native image per PR

Take the slow, 10x-billed macOS native-image build off the PR critical
path to speed up PR builds:

- Build only the Linux native image on PRs, in quick-build mode
  (--quick-build-native / -Ob). The PR binary is only smoke-tested and
  never shipped, so trading binary runtime performance for a much faster
  build is free.
- Run the native-image job in parallel with the java/integration jobs
  instead of after them (dropped the `needs`).
- Move macOS native-image coverage to a dedicated workflow that runs on
  push to main plus a weekly backstop, so macOS-specific native
  regressions are still caught before the Sunday release.

Closes #768

Author: nielspardon

.github/workflows/native-image-macos.yml

@@ -0,0 +1,51 @@
+name: macOS Native Image
+
+# macOS native-image coverage is kept off the per-PR critical path: the macOS
+# build is the long pole and macOS runners bill at 10x. Instead we build and
+# smoke-test the macOS native image on every push to main (per-merge signal)
+# plus a weekly backstop, so macOS-specific native regressions are still caught
+# promptly before the Sunday release. PRs build only the Linux native image
+# (see pr.yml).
+
+on:
+  push:
+    branches:
+      - main
+  schedule:
+    # Saturday 04:23 UTC — backstop ahead of the Sunday release build.
+    - cron: "23 4 * * 6"
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  isthmus-native-image-macos:
+    name: Build Isthmus Native Image (macOS)
+    if: github.repository == 'substrait-io/substrait-java'
+    runs-on: macOS-latest
+    steps:
+    - uses: actions/checkout@v7
+      with:
+        submodules: recursive
+    - uses: actions/setup-java@v5
+      with:
+        java-version: 25
+        distribution: graalvm
+    - name: Setup Gradle
+      uses: gradle/actions/setup-gradle@v6
+    - name: Report Java Version
+      run: java -version
+    - name: Build with Gradle
+      run: |
+        # fetch submodule tags since actions/checkout@v7 does not
+        git submodule foreach 'git fetch --unshallow || true'
+
+        # Full optimization (no --quick-build-native) so this mirrors the
+        # release build and catches anything that would break shipping.
+        ./gradlew nativeCompile
+    - name: Smoke Test
+      run: |
+        ./isthmus-cli/src/test/script/smoke.sh
+        ./isthmus-cli/src/test/script/tpch_smoke.sh

.github/workflows/pr.yml

@@ -94,15 +94,18 @@ jobs:
           git submodule foreach 'git fetch --unshallow || true'
 
           ./gradlew integrationTest
-  isthmus-native-image-mac-linux:
+  isthmus-native-image-linux:
+    # Only the Linux native image is built per PR: it validates the GraalVM
+    # configuration and runs the smoke tests, and its binary is throwaway (only
+    # smoke-tested, never shipped). macOS-specific native coverage runs in
+    # native-image-macos.yml (on push to main + a weekly schedule), keeping the
+    # slow, 10x-billed macOS build off the PR critical path. This job also runs
+    # in parallel with the java/integration jobs rather than after them.
     name: Build Isthmus Native Image
-    needs:
-      - java
-      - integration
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        os: [ubuntu-latest, macOS-latest]
+        os: [ubuntu-latest]
     steps:
     - uses: actions/checkout@v7
       with:
@@ -120,7 +123,9 @@ jobs:
         # fetch submodule tags since actions/checkout@v7 does not
         git submodule foreach 'git fetch --unshallow || true'
 
-        ./gradlew nativeCompile
+        # --quick-build-native (-Ob) trades binary runtime performance for a
+        # much faster build; the PR binary is only smoke-tested, so this is free.
+        ./gradlew nativeCompile --quick-build-native
     - name: Smoke Test
       run: |
         ./isthmus-cli/src/test/script/smoke.sh