Github selects required actions based on the "name" attribute of a job. Therefore I decided to keep the default "Ubuntu" job and moved the additional OpenSSL tests to another job.
For future reference, my first approach was:
strategy:
fail-fast: false
matrix:
openssl_ver: [1.1.1k, 1.0.2u, 1.1.0l, 3.0.0-alpha14]
include:
- openssl_ver: 1.1.1k
testmode: 'full'
...
- name: Tests
run: xvfb-run make buildbottest TESTOPTS="-j4 -uall,-cpu"
if: ${{ matrix.testmode == 'full' }}
- name: SSL tests
run: ./python Lib/test/ssltests.py
if: ${{ matrix.testmode != 'full' }}