From 01518e9e315140e377fd45c4619277db23841262 Mon Sep 17 00:00:00 2001
From: strtgbb <146047128+strtgbb@users.noreply.github.com>
Date: Thu, 17 Sep 2026 14:57:37 -0400
Subject: [PATCH 01/19] Merge pull request #2401 from
 Altinity/ci/minio-mirror-stable-25.3

Stable 25.3 - CI: use the clickhouse/minio-* mirror images
---
 tests/integration/compose/docker_compose_glue_catalog.yml     | 4 ++--
 .../compose/docker_compose_iceberg_rest_catalog.yml           | 4 ++--
 tests/integration/compose/docker_compose_minio.yml            | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/tests/integration/compose/docker_compose_glue_catalog.yml b/tests/integration/compose/docker_compose_glue_catalog.yml
index 9fba475bc02a3..b99fc3db12c16 100644
--- a/tests/integration/compose/docker_compose_glue_catalog.yml
+++ b/tests/integration/compose/docker_compose_glue_catalog.yml
@@ -13,7 +13,7 @@ services:
       start_period: 30s
   # TODO: can we simply use with_minio=True instead?
   minio:
-    image: minio/minio:RELEASE.2024-07-31T05-46-26Z
+    image: clickhouse/minio-minio:RELEASE.2024-07-31T05-46-26Z
     environment:
       - MINIO_ROOT_USER=minio
       - MINIO_ROOT_PASSWORD=ClickHouse_Minio_P@ssw0rd
@@ -31,7 +31,7 @@ services:
     depends_on:
       - minio
     # Stick to version with "mc config"
-    image: minio/mc:RELEASE.2025-04-16T18-13-26Z
+    image: clickhouse/minio-mc:RELEASE.2025-04-16T18-13-26Z
     environment:
       - AWS_ACCESS_KEY_ID=minio
       - AWS_SECRET_ACCESS_KEY=ClickHouse_Minio_P@ssw0rd
diff --git a/tests/integration/compose/docker_compose_iceberg_rest_catalog.yml b/tests/integration/compose/docker_compose_iceberg_rest_catalog.yml
index 89663ce5799c1..082c0dd8bfe04 100644
--- a/tests/integration/compose/docker_compose_iceberg_rest_catalog.yml
+++ b/tests/integration/compose/docker_compose_iceberg_rest_catalog.yml
@@ -34,7 +34,7 @@ services:
       start_period: 30s
   # TODO: can we simply use with_minio=True instead?
   minio:
-    image: minio/minio:RELEASE.2024-07-31T05-46-26Z
+    image: clickhouse/minio-minio:RELEASE.2024-07-31T05-46-26Z
     environment:
       - MINIO_ROOT_USER=minio
       - MINIO_ROOT_PASSWORD=ClickHouse_Minio_P@ssw0rd
@@ -52,7 +52,7 @@ services:
     depends_on:
       - minio
     # Stick to version with "mc config"
-    image: minio/mc:RELEASE.2025-04-16T18-13-26Z
+    image: clickhouse/minio-mc:RELEASE.2025-04-16T18-13-26Z
     environment:
       - AWS_ACCESS_KEY_ID=minio
       - AWS_SECRET_ACCESS_KEY=ClickHouse_Minio_P@ssw0rd
diff --git a/tests/integration/compose/docker_compose_minio.yml b/tests/integration/compose/docker_compose_minio.yml
index 39016633f132e..d1d618a3db1da 100644
--- a/tests/integration/compose/docker_compose_minio.yml
+++ b/tests/integration/compose/docker_compose_minio.yml
@@ -1,6 +1,6 @@
 services:
   minio1:
-    image: minio/minio:RELEASE.2024-07-31T05-46-26Z
+    image: clickhouse/minio-minio:RELEASE.2024-07-31T05-46-26Z
     volumes:
       - data1-1:/data1
       - ${MINIO_CERTS_DIR:-}:/certs

From c628f944895e88b69d573a6d7f735ff9e02db22c Mon Sep 17 00:00:00 2001
From: strtgbb <146047128+strtgbb@users.noreply.github.com>
Date: Fri, 3 Jul 2026 10:32:37 -0400
Subject: [PATCH 02/19] Merge pull request #1969 from
 Altinity/ci/grype-CVE-fixes-stable-25.3

Stable 25.3: Fix Grype scan failures and Ubuntu package CVEs
---
 .github/workflows/grype_scan.yml | 2 +-
 docker/server/Dockerfile.ubuntu  | 8 ++++++--
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/grype_scan.yml b/.github/workflows/grype_scan.yml
index e75043f03fe67..c060cfcaf22ae 100644
--- a/.github/workflows/grype_scan.yml
+++ b/.github/workflows/grype_scan.yml
@@ -50,7 +50,7 @@ jobs:
             sudo apt-get install -y python3-pip python3-venv
             python3 -m venv venv
             source venv/bin/activate
-            pip install --upgrade requests chardet urllib3 unidiff boto3 PyGithub
+            pip install --upgrade requests chardet urllib3 unidiff 'boto3==1.43.33' PyGithub
             pip install testflows==$TESTFLOWS_VERSION awscli==1.33.28
             echo PATH=$PATH >>$GITHUB_ENV
 
diff --git a/docker/server/Dockerfile.ubuntu b/docker/server/Dockerfile.ubuntu
index bb6218b1a4a30..882af8c11bdb1 100644
--- a/docker/server/Dockerfile.ubuntu
+++ b/docker/server/Dockerfile.ubuntu
@@ -7,12 +7,13 @@ ARG DEBIAN_FRONTEND=noninteractive
 # ARG for quick switch to a given ubuntu mirror
 ARG apt_archive="http://archive.ubuntu.com"
 
-# We shouldn't use `apt upgrade` to not change the upstream image. It's updated biweekly
+# Upgrade already installed Ubuntu packages to apply available security fixes
+# without installing recommended packages.
 
 # user/group precreated explicitly with fixed uid/gid on purpose.
 # It is especially important for rootless containers: in that case entrypoint
 # can't do chown and owners of mounted volumes should be configured externally.
-# We do that in advance at the begining of Dockerfile before any packages will be
+# We do that in advance at the beginning of Dockerfile before any packages will be
 # installed to prevent picking those uid / gid by some unrelated software.
 # The same uid / gid (101) is used both for alpine and ubuntu.
 RUN sed -i "s|http://archive.ubuntu.com|${apt_archive}|g" /etc/apt/sources.list \
@@ -24,6 +25,9 @@ RUN sed -i "s|http://archive.ubuntu.com|${apt_archive}|g" /etc/apt/sources.list
         locales \
         tzdata \
         wget \
+    && apt-get upgrade --yes --no-install-recommends \
+    && busybox --install -s \
+    && apt-get clean \
     && rm -rf /var/lib/apt/lists/* /var/cache/debconf /tmp/*
 
 #docker-official-library:off

From 7d76790470e6a742dbceb8d617a48b3a463bf2fb Mon Sep 17 00:00:00 2001
From: strtgbb <146047128+strtgbb@users.noreply.github.com>
Date: Fri, 17 Jul 2026 12:59:07 -0400
Subject: [PATCH 03/19] Merge pull request #2063 from
 Altinity/ci/bump-grype-stable-25.3

Stable 25.3 - Fix Grype Scan: bump grype to v0.115.0
---
 .github/grype/run_grype_scan.sh  | 2 +-
 .github/workflows/grype_scan.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/grype/run_grype_scan.sh b/.github/grype/run_grype_scan.sh
index af428e37d669f..9cf99e9f9f9cb 100755
--- a/.github/grype/run_grype_scan.sh
+++ b/.github/grype/run_grype_scan.sh
@@ -3,7 +3,7 @@ set -e
 
 IMAGE=$1
 
-GRYPE_VERSION=${GRYPE_VERSION:-"v0.92.2"}
+GRYPE_VERSION=${GRYPE_VERSION:-"v0.115.0"}
 
 docker pull $IMAGE
 docker pull anchore/grype:${GRYPE_VERSION}
diff --git a/.github/workflows/grype_scan.yml b/.github/workflows/grype_scan.yml
index c060cfcaf22ae..4bd5cea72cc3c 100644
--- a/.github/workflows/grype_scan.yml
+++ b/.github/workflows/grype_scan.yml
@@ -30,7 +30,7 @@ env:
   AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
   AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
   AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-  GRYPE_VERSION: "v0.92.2-arm64v8"
+  GRYPE_VERSION: "v0.115.0-arm64v8"
 
 jobs:
     grype_scan:

From b0e3c0d3d2d2578897686eecb833b95b4cd05da3 Mon Sep 17 00:00:00 2001
From: strtgbb <146047128+strtgbb@users.noreply.github.com>
Date: Thu, 10 Sep 2026 11:40:19 -0400
Subject: [PATCH 04/19] replace azure with azurite

---
 ci/jobs/functional_stateless_tests.py        | 15 ++++-----------
 ci/jobs/scripts/clickhouse_proc.py           | 16 ++++++++++++++++
 tests/config/config.d/azure_storage_conf.xml |  6 ++----
 tests/docker_scripts/stress_runner.sh        |  1 +
 4 files changed, 23 insertions(+), 15 deletions(-)

diff --git a/ci/jobs/functional_stateless_tests.py b/ci/jobs/functional_stateless_tests.py
index 4c14e3fa1e431..15aa0ad459225 100644
--- a/ci/jobs/functional_stateless_tests.py
+++ b/ci/jobs/functional_stateless_tests.py
@@ -1,5 +1,4 @@
 import argparse
-import os
 import time
 from pathlib import Path
 
@@ -62,15 +61,6 @@ def main():
         if "/" in to:
             batch_num, total_batches = map(int, to.split("/"))
 
-    # TODO: find a way to work with Azure secret so it's ok for local tests as well, for now keep azure disabled
-    os.environ["AZURE_CONNECTION_STRING"] = Shell.get_output(
-        f"aws ssm get-parameter --region us-east-1 --name azure_connection_string --with-decryption --output text --query Parameter.Value",
-        verbose=True,
-    )
-    no_azure = False
-    if not os.environ["AZURE_CONNECTION_STRING"]:
-        no_azure = True
-
     ch_path = args.ch_path
     assert (
         Path(ch_path + "/clickhouse").is_file()
@@ -109,7 +99,7 @@ def main():
             f"ln -sf {ch_path}/clickhouse {ch_path}/clickhouse-format",
             f"rm -rf {temp_dir}/etc/ && mkdir -p {temp_dir}/etc/clickhouse-client {temp_dir}/etc/clickhouse-server",
             f"cp programs/server/config.xml programs/server/users.xml {temp_dir}/etc/clickhouse-server/",
-            f"./tests/config/install.sh {temp_dir}/etc/clickhouse-server {temp_dir}/etc/clickhouse-client --s3-storage {'--no-azure' if no_azure else ''}",
+            f"./tests/config/install.sh {temp_dir}/etc/clickhouse-server {temp_dir}/etc/clickhouse-client --s3-storage",
             # clickhouse benchmark segfaults with --config-path, so provide client config by its default location
             f"cp {temp_dir}/etc/clickhouse-client/* /etc/clickhouse-client/",
             # update_path_ch_config,
@@ -140,6 +130,9 @@ def main():
         res = res and Shell.check(
             "aws s3 ls s3://test --endpoint-url http://localhost:11111/", verbose=True
         )
+        azurite_log = f"{temp_dir}/azurite.log"
+        res = res and CH.start_azurite(log_file_path=azurite_log)
+        logs_to_attach += [azurite_log]
         res = res and CH.log_cluster_config()
         res = res and CH.start()
         res = res and CH.wait_ready()
diff --git a/ci/jobs/scripts/clickhouse_proc.py b/ci/jobs/scripts/clickhouse_proc.py
index 08ea848e5ce41..3634b08e2a309 100644
--- a/ci/jobs/scripts/clickhouse_proc.py
+++ b/ci/jobs/scripts/clickhouse_proc.py
@@ -59,6 +59,22 @@ def start_minio(self, test_type, log_file_path):
         print(f"Started setup_minio.sh asynchronously with PID {process.pid}")
         return True
 
+    def start_azurite(self, log_file_path):
+        command = f"cd {temp_dir} && azurite-blob --blobHost 0.0.0.0 --blobPort 10000 --silent --inMemoryPersistence"
+        with open(log_file_path, "w") as log_file:
+            process = subprocess.Popen(
+                command, stdout=log_file, stderr=subprocess.STDOUT, shell=True
+            )
+        print(f"Started azurite asynchronously with PID {process.pid}")
+        if Shell.check(
+            "curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:10000/ | grep -qE '400|200'",
+            verbose=False,
+            retries=6,
+        ):
+            return True
+        print("Failed to start azurite")
+        return False
+
     @staticmethod
     def log_cluster_config():
         return Shell.check(
diff --git a/tests/config/config.d/azure_storage_conf.xml b/tests/config/config.d/azure_storage_conf.xml
index 2624656f7e88d..8b90ee3654f7c 100644
--- a/tests/config/config.d/azure_storage_conf.xml
+++ b/tests/config/config.d/azure_storage_conf.xml
@@ -6,10 +6,8 @@
                 <object_storage_type>azure</object_storage_type>
                 <skip_access_check>false</skip_access_check>
                 <max_single_part_upload_size>33554432</max_single_part_upload_size>
-                <storage_account_url from_env="AZURE_STORAGE_ACCOUNT_URL"/>
-                <container_name from_env="AZURE_CONTAINER_NAME"/>
-                <account_name from_env="AZURE_ACCOUNT_NAME"/>
-                <account_key from_env="AZURE_STORAGE_KEY"/>
+                <container_name>clickhouse-tests</container_name>
+                <connection_string>DefaultEndpointsProtocol=http;AccountName=devstoreaccount1;AccountKey=Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==;BlobEndpoint=http://127.0.0.1:10000/devstoreaccount1;</connection_string>
             </azure>
             <cached_azure>
                 <type>cache</type>
diff --git a/tests/docker_scripts/stress_runner.sh b/tests/docker_scripts/stress_runner.sh
index 682cf00418045..7f8377e4bebd3 100755
--- a/tests/docker_scripts/stress_runner.sh
+++ b/tests/docker_scripts/stress_runner.sh
@@ -54,6 +54,7 @@ export ZOOKEEPER_FAULT_INJECTION=1
 configure
 
 /repo/tests/docker_scripts/setup_minio.sh stateless # to have a proper environment
+azurite-blob --blobHost 0.0.0.0 --blobPort 10000 --silent --inMemoryPersistence &
 
 config_logs_export_cluster /etc/clickhouse-server/config.d/system_logs_export.yaml
 

From a79ce1b97367612be2b8136df6556b439de19a23 Mon Sep 17 00:00:00 2001
From: strtgbb <146047128+strtgbb@users.noreply.github.com>
Date: Thu, 18 Sep 2025 21:05:12 -0400
Subject: [PATCH 05/19] fix layout of report meta tags

---
 .../actions/create_workflow_report/ci_run_report.html.jinja    | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/actions/create_workflow_report/ci_run_report.html.jinja b/.github/actions/create_workflow_report/ci_run_report.html.jinja
index a92c1aa34e3a0..935d9f9d3847e 100644
--- a/.github/actions/create_workflow_report/ci_run_report.html.jinja
+++ b/.github/actions/create_workflow_report/ci_run_report.html.jinja
@@ -5,6 +5,9 @@
   <meta http-equiv="content-type" content="text/html; charset=UTF-8">
   <meta charset="UTF-8">
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  {%- if is_preview %}
+  <meta http-equiv="Cache-Control" content="max-age=300">
+  {%- endif %}
   <style>
     /* Base colors for Altinity */
     :root {

From c65fcc4e1cad4a72aedfb39365f15e9ada01b2f4 Mon Sep 17 00:00:00 2001
From: Mikhail Koviazin <github@mkmk.aleeas.com>
Date: Fri, 30 Oct 2026 10:12:53 +0100
Subject: [PATCH 06/19] ci: Prefer build reports matching the current SHA

Report discovery could select an unrelated build before one matching the
current commit. Prefer matching artifact URLs while retaining the fallback
for cached builds.

Port the artifact-selection change from Altinity/ClickHouse#1647.
---
 tests/ci/build_download_helper.py | 34 ++++++++++++++++++++++++++++++-
 1 file changed, 33 insertions(+), 1 deletion(-)

diff --git a/tests/ci/build_download_helper.py b/tests/ci/build_download_helper.py
index e732c324f0769..d10af5f2bedb8 100644
--- a/tests/ci/build_download_helper.py
+++ b/tests/ci/build_download_helper.py
@@ -154,6 +154,16 @@ def read_build_urls(build_name: str, reports_path: Union[Path, str]) -> List[str
     if artifact_report.is_file():
         with open(artifact_report, "r", encoding="utf-8") as f:
             return json.load(f)["build_urls"]  # type: ignore
+    pr_info = None
+    try:
+        from pr_info import PRInfo  # pylint: disable=import-outside-toplevel
+
+        pr_info = PRInfo()
+    except Exception as ex:
+        logger.warning("Failed to init PRInfo while selecting build report: %s", ex)
+
+    reports_by_sha = []  # type: List[List[str]]
+    fallback_reports = []  # type: List[List[str]]
     for root, _, files in os.walk(reports_path):
         for file in files:
             if file.endswith(f"_{build_name}.json"):
@@ -162,7 +172,29 @@ def read_build_urls(build_name: str, reports_path: Union[Path, str]) -> List[str
                     os.path.join(root, file), "r", encoding="utf-8"
                 ) as file_handler:
                     build_report = json.load(file_handler)
-                    return build_report["build_urls"]  # type: ignore
+                    build_urls = build_report.get("build_urls", [])
+                    if not isinstance(build_urls, list):
+                        continue
+                    fallback_reports.append(build_urls)
+                    if pr_info and pr_info.sha and any(
+                        f"/{pr_info.sha}/" in str(url) for url in build_urls
+                    ):
+                        reports_by_sha.append(build_urls)
+
+    if reports_by_sha:
+        logger.info(
+            "Using build report matched by SHA [%s] for [%s]",
+            pr_info.sha if pr_info else "",
+            build_name,
+        )
+        return reports_by_sha[0]
+
+    if fallback_reports:
+        logger.warning(
+            "No SHA-matched build report found for [%s], fallback to first discovered",
+            build_name,
+        )
+        return fallback_reports[0]
 
     logger.info("A build report is not found for %s", build_name)
     return []

From 3757b410e6c130ab2363b2d85bf7fce333b3599e Mon Sep 17 00:00:00 2001
From: Mikhail Koviazin <github@mkmk.aleeas.com>
Date: Fri, 30 Oct 2026 10:14:07 +0100
Subject: [PATCH 07/19] ci: Filter build reports by tag on tagged runs

Tagged runs could discover reports from other runs sharing the same
cache digest. Filter by the tag name, matching how reports are named.

Port the tag-filtering change from Altinity/ClickHouse#1647.
---
 tests/ci/ci.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/tests/ci/ci.py b/tests/ci/ci.py
index bd9c2d66769bd..08c92c0f6b75a 100755
--- a/tests/ci/ci.py
+++ b/tests/ci/ci.py
@@ -303,6 +303,10 @@ def _pre_action(s3, job_name, batch, indata, pr_info):
         #   testing), otherwise reports won't be found
         if not (pr_info.is_scheduled or pr_info.is_dispatched):
             report_prefix = Utils.normalize_string(pr_info.head_ref)
+    elif isinstance(pr_info.ref, str) and pr_info.ref.startswith("refs/tags/"):
+        # For tag-triggered runs, use tag name as prefix to avoid downloading
+        # reports from other runs with the same digest.
+        report_prefix = Utils.normalize_string(pr_info.head_ref)
     elif pr_info.is_pr:
         report_prefix = str(pr_info.number)
     print(

From 4dd03316bf82b9f2cc6f43690a11a18ef80c2140 Mon Sep 17 00:00:00 2001
From: Mikhail Koviazin <github@mkmk.aleeas.com>
Date: Fri, 30 Oct 2026 10:19:30 +0100
Subject: [PATCH 08/19] ci: Wait for ARM signing before finishing CI

The final report could run before ARM signing finished and omit its
failure from the workflow result. Include SignAarch64 in its dependencies.

Port the completion dependency from Altinity/ClickHouse#1647.
---
 .github/workflows/release_branches.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/release_branches.yml b/.github/workflows/release_branches.yml
index 405b3e017ebc8..e2d004a6d6c9b 100644
--- a/.github/workflows/release_branches.yml
+++ b/.github/workflows/release_branches.yml
@@ -478,6 +478,7 @@ jobs:
       - RegressionTestsAarch64
       - GrypeScan
       - SignRelease
+      - SignAarch64
     runs-on: [self-hosted, altinity-on-demand, altinity-style-checker-aarch64]
     steps:
       - name: Check out repository code

From a102f88486b0f95f83b0d9264c4ad9f0ce76ee1f Mon Sep 17 00:00:00 2001
From: Mikhail Koviazin <github@mkmk.aleeas.com>
Date: Fri, 30 Oct 2026 10:21:30 +0100
Subject: [PATCH 09/19] report: Read sort keys from nested cell elements

Honor data-sort attributes on elements inside table cells instead of
sorting only by their visible text. Preserve existing cell-level behavior
when no nested sort key exists.

Port the template sorting change present in Altinity/ClickHouse#1647.
---
 .github/actions/create_workflow_report/ci_run_report.html.jinja | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/actions/create_workflow_report/ci_run_report.html.jinja b/.github/actions/create_workflow_report/ci_run_report.html.jinja
index 935d9f9d3847e..38ef85dad467f 100644
--- a/.github/actions/create_workflow_report/ci_run_report.html.jinja
+++ b/.github/actions/create_workflow_report/ci_run_report.html.jinja
@@ -226,6 +226,8 @@
           element.className = element.className.replace(regex_dir, '') + dir
         }
         function getValue(element) {
+          var childWithSort = element.querySelector('[data-sort]')
+          if (childWithSort) return childWithSort.getAttribute('data-sort')
           return (
             (alt_sort && element.getAttribute('data-sort-alt')) ||
             element.getAttribute('data-sort') || element.innerText

From a95cff3977ccfa20ac8443a182f5913df59df4ce Mon Sep 17 00:00:00 2001
From: Mikhail Koviazin <github@mkmk.aleeas.com>
Date: Fri, 30 Oct 2026 10:32:24 +0100
Subject: [PATCH 10/19] ci: Report signing results and isolate signing keys

Signing could exit without a CI report and ignored GPG failures. Port
checked signing, a private keyring, cleanup, and public-key publication
from Altinity/ClickHouse#1647.

Keep setup and artifact uploads in the same signing directory, and move
path variables outside the Docker JSON environment value.
---
 .github/workflows/reusable_sign.yml |   8 +-
 tests/ci/sign_release.py            | 125 +++++++++++++++++++++++-----
 2 files changed, 108 insertions(+), 25 deletions(-)

diff --git a/.github/workflows/reusable_sign.yml b/.github/workflows/reusable_sign.yml
index 7bfed27583596..c2126cb73e752 100644
--- a/.github/workflows/reusable_sign.yml
+++ b/.github/workflows/reusable_sign.yml
@@ -116,14 +116,14 @@ jobs:
           ${{secrets.secret_envs}}
           DOCKER_TAG<<DOCKER_JSON
           ${{ toJson(fromJson(inputs.data).docker_data.images) }}
+          DOCKER_JSON
           TEMP_PATH=${{runner.temp}}/signed
           REPORTS_PATH=${{runner.temp}}/reports_dir
-          DOCKER_JSON
           EOF
       - name: Common setup
         uses: ./.github/actions/common_setup
         with:
-          job_type: test
+          job_type: signed
       - name: Docker setup
         uses: ./.github/actions/docker_setup
       - name: Setup batch
@@ -160,7 +160,9 @@ jobs:
         uses: actions/upload-artifact@v4
         with:
           name: ${{inputs.test_name}} signed-hashes
-          path: ${{ env.TEMP_PATH }}/*.gpg
+          path: |
+            ${{ env.TEMP_PATH }}/*.gpg
+            ${{ env.TEMP_PATH }}/signing_pubkey.asc
       - name: Clean
         if: always()
         uses: ./.github/actions/clean
diff --git a/tests/ci/sign_release.py b/tests/ci/sign_release.py
index 8a5827097c8b3..50a0030f274cf 100644
--- a/tests/ci/sign_release.py
+++ b/tests/ci/sign_release.py
@@ -1,18 +1,26 @@
 #!/usr/bin/env python3
-import sys
-import os
+import hashlib
 import logging
+import os
+import shutil
+import subprocess
+import sys
+from pathlib import Path
+
+from build_download_helper import download_builds_filter
 from env_helper import TEMP_PATH, REPO_COPY, REPORT_PATH
-from s3_helper import S3Helper
 from pr_info import PRInfo
-from build_download_helper import download_builds_filter
-import hashlib
-from pathlib import Path
+from report import FAIL, OK, FAILURE, SUCCESS, JobReport, TestResult
+from s3_helper import S3Helper
+from stopwatch import Stopwatch
 
 GPG_BINARY_SIGNING_KEY = os.getenv("GPG_BINARY_SIGNING_KEY")
 GPG_BINARY_SIGNING_PASSPHRASE = os.getenv("GPG_BINARY_SIGNING_PASSPHRASE")
 
 CHECK_NAME = os.getenv("CHECK_NAME", "Sign release")
+GPG_HOME_PATH = Path(TEMP_PATH) / "gpg_home"
+SIGNING_PUBKEY_PATH = Path(TEMP_PATH) / "signing_pubkey.asc"
+
 
 def hash_file(file_path):
     BLOCK_SIZE = 65536 # The size of each read from the file
@@ -32,22 +40,71 @@ def hash_file(file_path):
 
     return hash_file_path
 
-def sign_file(file_path):
-    priv_key_file_path = 'priv.key'
-    with open(priv_key_file_path, 'x') as f:
-        f.write(GPG_BINARY_SIGNING_KEY)
+
+def import_signing_key(gpg_home_path):
+    if not GPG_BINARY_SIGNING_KEY:
+        raise RuntimeError("GPG_BINARY_SIGNING_KEY is not set")
+    if not GPG_BINARY_SIGNING_PASSPHRASE:
+        raise RuntimeError("GPG_BINARY_SIGNING_PASSPHRASE is not set")
+
+    gpg_home_path.mkdir(mode=0o700, parents=True, exist_ok=True)
+    gpg_home_path.chmod(0o700)
+    subprocess.run(
+        ["gpg", "--homedir", str(gpg_home_path), "--batch", "--import"],
+        input=GPG_BINARY_SIGNING_KEY.encode(),
+        check=True,
+    )
+
+
+def export_public_key(gpg_home_path, out_file_path):
+    with open(out_file_path, "wb") as out_file:
+        subprocess.run(
+            ["gpg", "--homedir", str(gpg_home_path), "--armor", "--export"],
+            stdout=out_file,
+            check=True,
+        )
+    print(f"Exported signing public key to {out_file_path}")
+
+
+def sign_file(file_path, gpg_home_path):
 
     out_file_path = f'{file_path}.gpg'
 
-    os.system(f'echo {GPG_BINARY_SIGNING_PASSPHRASE} | gpg --batch --import {priv_key_file_path}')
-    os.system(f'gpg -o {out_file_path} --pinentry-mode=loopback --batch --yes --passphrase {GPG_BINARY_SIGNING_PASSPHRASE} --sign {file_path}')
+    subprocess.run(
+        [
+            "gpg",
+            "--homedir",
+            str(gpg_home_path),
+            "-o",
+            out_file_path,
+            "--pinentry-mode=loopback",
+            "--batch",
+            "--yes",
+            "--passphrase-fd",
+            "0",
+            "--sign",
+            file_path,
+        ],
+        input=f"{GPG_BINARY_SIGNING_PASSPHRASE}\n".encode(),
+        check=True,
+    )
     print(f"Signed {file_path}")
-    os.remove(priv_key_file_path)
 
     return out_file_path
 
+
+def upload_file_to_s3(s3_helper, file_path, s3_path_prefix):
+    s3_path = s3_path_prefix / os.path.basename(file_path)
+    s3_helper.upload_build_file_to_s3(Path(file_path), str(s3_path))
+    print(f'Uploaded file {file_path} to {s3_path}')
+
+
 def main():
+    stopwatch = Stopwatch()
     reports_path = Path(REPORT_PATH)
+    test_results = []
+    state = SUCCESS
+    description = "Signed artifact hashes successfully"
 
     if not os.path.exists(TEMP_PATH):
         os.makedirs(TEMP_PATH)
@@ -65,15 +122,27 @@ def main():
     # downloads `package_release` artifacts generated
     download_builds_filter(CHECK_NAME, reports_path, Path(TEMP_PATH))
 
-    for f in os.listdir(TEMP_PATH):
-        full_path = os.path.join(TEMP_PATH, f)
-        if os.path.isdir(full_path):
-            continue
-        hashed_file_path = hash_file(full_path)
-        signed_file_path = sign_file(hashed_file_path)
-        s3_path = s3_path_prefix / os.path.basename(signed_file_path)
-        s3_helper.upload_build_file_to_s3(Path(signed_file_path), str(s3_path))
-        print(f'Uploaded file {signed_file_path} to {s3_path}')
+    try:
+        import_signing_key(GPG_HOME_PATH)
+
+        for f in os.listdir(TEMP_PATH):
+            full_path = os.path.join(TEMP_PATH, f)
+            if os.path.isdir(full_path):
+                continue
+            hashed_file_path = hash_file(full_path)
+            signed_file_path = sign_file(hashed_file_path, GPG_HOME_PATH)
+            upload_file_to_s3(s3_helper, signed_file_path, s3_path_prefix)
+            test_results.append(TestResult(name=os.path.basename(full_path), status=OK))
+
+        export_public_key(GPG_HOME_PATH, SIGNING_PUBKEY_PATH)
+        upload_file_to_s3(s3_helper, SIGNING_PUBKEY_PATH, s3_path_prefix)
+        test_results.append(TestResult(name=SIGNING_PUBKEY_PATH.name, status=OK))
+    except Exception as ex:
+        state = FAILURE
+        description = f"Failed to sign release artifacts: {ex}"
+        test_results.append(TestResult(name=CHECK_NAME, status=FAIL, raw_logs=str(ex)))
+    finally:
+        shutil.rmtree(GPG_HOME_PATH, ignore_errors=True)
 
     # Signed hashes are:
     # clickhouse-client_22.3.15.2.altinitystable_amd64.deb.sha512.gpg              clickhouse-keeper_22.3.15.2.altinitystable_x86_64.apk.sha512.gpg
@@ -91,6 +160,18 @@ def main():
     # clickhouse-keeper_22.3.15.2.altinitystable_amd64.deb.sha512.gpg              clickhouse-server-22.3.15.2.altinitystable.x86_64.rpm.sha512.gpg
     # clickhouse-keeper-22.3.15.2.altinitystable-amd64.tgz.sha512.gpg              clickhouse.sha512.gpg
 
+    JobReport(
+        description=description,
+        test_results=test_results,
+        status=state,
+        start_time=stopwatch.start_time_str,
+        duration=stopwatch.duration_seconds,
+        additional_files=[],
+    ).dump()
+
+    if state == FAILURE:
+        sys.exit(1)
+
     sys.exit(0)
 
 if __name__ == "__main__":

From 33b62fa437ae3a0527b941fa1f5e5d2e6432e093 Mon Sep 17 00:00:00 2001
From: strtgbb <146047128+strtgbb@users.noreply.github.com>
Date: Fri, 30 Oct 2026 09:11:40 -0400
Subject: [PATCH 11/19] Run regression from the clickhouse-regression release
 branch and split lightweight_delete, as on 25.3.14

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .github/workflows/regression.yml       | 29 +++++++++++++++++++++++++-
 .github/workflows/release_branches.yml |  8 +++----
 2 files changed, 32 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/regression.yml b/.github/workflows/regression.yml
index c23693bd330cf..414988408bc35 100644
--- a/.github/workflows/regression.yml
+++ b/.github/workflows/regression.yml
@@ -90,7 +90,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        SUITE: [aes_encryption, atomic_insert, base_58, clickhouse_keeper_failover, data_types, datetime64_extended_range, disk_level_encryption, dns, engines, example, extended_precision_data_types, functions, jwt_authentication, kafka, kerberos, key_value, lightweight_delete, memory, part_moves_between_shards, selects, session_timezone, settings, swarms, version, window_functions]
+        SUITE: [aes_encryption, atomic_insert, base_58, clickhouse_keeper_failover, data_types, datetime64_extended_range, disk_level_encryption, dns, engines, example, extended_precision_data_types, functions, jwt_authentication, kafka, kerberos, key_value, memory, part_moves_between_shards, selects, session_timezone, settings, swarms, version, window_functions]
     uses: ./.github/workflows/regression-reusable-suite.yml
     with:
       ref: ${{ inputs.commit }}
@@ -103,6 +103,33 @@ jobs:
       job_name: ${{ matrix.SUITE }}
     secrets: inherit
 
+  LightweightDelete:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - PART: 1
+            FILTER: --only "/lightweight delete/disk space/*"
+          - PART: 2
+            FILTER: --only "/lightweight delete/hard restart/*"
+          - PART: 3
+            FILTER: --skip "/lightweight delete/disk space/*" "/lightweight delete/hard restart/*" "/lightweight delete/alter after delete/*" "/lightweight delete/concurrent alter and delete/*" "/lightweight delete/concurrent delete/*" "/lightweight delete/basic checks/*" "/lightweight delete/performance/*" "/lightweight delete/ontime tests/*"
+          - PART: 4
+            FILTER: --only "/lightweight delete/alter after delete/*" "/lightweight delete/concurrent alter and delete/*" "/lightweight delete/concurrent delete/*" "/lightweight delete/basic checks/*" "/lightweight delete/performance/*" "/lightweight delete/ontime tests/*"
+    uses: ./.github/workflows/regression-reusable-suite.yml
+    with:
+      ref: ${{ inputs.commit }}
+      arch: ${{ inputs.arch }}
+      suite_name: lightweight_delete
+      suite_executable: regression.py
+      timeout_minutes: 300
+      runner_type: ${{ inputs.runner_type }}
+      part: ${{ matrix.PART }}
+      build_sha: ${{ inputs.build_sha }}
+      job_name: lightweight_delete
+      extra_args: ${{ matrix.FILTER }}
+    secrets: inherit
+
   AggregateFunctions:
     strategy:
       fail-fast: false
diff --git a/.github/workflows/release_branches.yml b/.github/workflows/release_branches.yml
index e2d004a6d6c9b..79fd828fbc4ff 100644
--- a/.github/workflows/release_branches.yml
+++ b/.github/workflows/release_branches.yml
@@ -418,10 +418,10 @@ jobs:
     secrets: inherit
     with:
       runner_type: altinity-regression-tester
-      commit: e1f4e6ae0d862388e113cbc74b8dab32b9db64fc
+      commit: release
       arch: release
       build_sha: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
-      timeout_minutes: 300
+      timeout_minutes: 210
   RegressionTestsAarch64:
     needs: [RunConfig, BuilderDebAarch64]
     if: ${{ !failure() && !cancelled() && !contains(fromJson(needs.RunConfig.outputs.data).ci_settings.exclude_keywords, 'regression') && !contains(fromJson(needs.RunConfig.outputs.data).ci_settings.exclude_keywords, 'aarch64')}}
@@ -429,10 +429,10 @@ jobs:
     secrets: inherit
     with:
       runner_type: altinity-regression-tester-aarch64
-      commit: e1f4e6ae0d862388e113cbc74b8dab32b9db64fc
+      commit: release
       arch: aarch64
       build_sha: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
-      timeout_minutes: 300
+      timeout_minutes: 210
   SignRelease:
     needs: [RunConfig, BuilderDebRelease]
     if: ${{ !failure() && !cancelled() }}

From 06de46635a8fdd9e08412d3714a0fa37347197e5 Mon Sep 17 00:00:00 2001
From: strtgbb <146047128+strtgbb@users.noreply.github.com>
Date: Fri, 30 Oct 2026 09:11:40 -0400
Subject: [PATCH 12/19] Pull Azurite from the altinityinfra mirror

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 tests/integration/compose/docker_compose_azurite.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/integration/compose/docker_compose_azurite.yml b/tests/integration/compose/docker_compose_azurite.yml
index 8ae9f7b85ff48..a853e098da727 100644
--- a/tests/integration/compose/docker_compose_azurite.yml
+++ b/tests/integration/compose/docker_compose_azurite.yml
@@ -1,6 +1,6 @@
 services:
   azurite1:
-    image: mcr.microsoft.com/azure-storage/azurite
+    image: altinityinfra/azurite:3.35.0 # NOTE(strtgbb): Use mirror to avoid access denied error from mcr.microsoft.com
     ports:
       - "${AZURITE_PORT}:${AZURITE_PORT}"
     volumes:

From 861044e27ae0e9a8abdc8b24e9cbc3b69fb6362e Mon Sep 17 00:00:00 2001
From: strtgbb <146047128+strtgbb@users.noreply.github.com>
Date: Fri, 30 Oct 2026 09:12:15 -0400
Subject: [PATCH 13/19] Request 16c/32g runners for the stateless and
 integration jobs, as on 25.3.14

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .github/workflows/release_branches.yml | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/release_branches.yml b/.github/workflows/release_branches.yml
index 79fd828fbc4ff..4a30dee7e524e 100644
--- a/.github/workflows/release_branches.yml
+++ b/.github/workflows/release_branches.yml
@@ -283,7 +283,7 @@ jobs:
     secrets: inherit
     with:
       test_name: Stateless tests (release)
-      runner_type: altinity-func-tester
+      runner_type: altinity-func-tester, 16c
       data: ${{ needs.RunConfig.outputs.data }}
   FunctionalStatelessTestAarch64:
     needs: [RunConfig, BuilderDebAarch64]
@@ -292,7 +292,7 @@ jobs:
     secrets: inherit
     with:
       test_name: Stateless tests (aarch64)
-      runner_type: altinity-func-tester-aarch64
+      runner_type: altinity-func-tester-aarch64, 16c
       data: ${{ needs.RunConfig.outputs.data }}
   FunctionalStatelessTestAsan:
     needs: [RunConfig, BuilderDebAsan]
@@ -301,7 +301,7 @@ jobs:
     secrets: inherit
     with:
       test_name: Stateless tests (asan)
-      runner_type: altinity-func-tester
+      runner_type: altinity-func-tester, 32g
       data: ${{ needs.RunConfig.outputs.data }}
   FunctionalStatelessTestTsan:
     needs: [RunConfig, BuilderDebTsan]
@@ -310,7 +310,7 @@ jobs:
     secrets: inherit
     with:
       test_name: Stateless tests (tsan)
-      runner_type: altinity-func-tester
+      runner_type: altinity-func-tester, 32g
       data: ${{ needs.RunConfig.outputs.data }}
   FunctionalStatelessTestUBsan:
     needs: [RunConfig, BuilderDebUBsan]
@@ -319,7 +319,7 @@ jobs:
     secrets: inherit
     with:
       test_name: Stateless tests (ubsan)
-      runner_type: altinity-func-tester
+      runner_type: altinity-func-tester, 32g
       data: ${{ needs.RunConfig.outputs.data }}
   FunctionalStatelessTestDebug:
     needs: [RunConfig, BuilderDebDebug]
@@ -328,7 +328,7 @@ jobs:
     secrets: inherit
     with:
       test_name: Stateless tests (debug)
-      runner_type: altinity-func-tester
+      runner_type: altinity-func-tester, 16c
       data: ${{ needs.RunConfig.outputs.data }}
 ##############################################################################################
 ######################################### STRESS TESTS #######################################
@@ -379,7 +379,7 @@ jobs:
     secrets: inherit
     with:
       test_name: Integration tests (asan)
-      runner_type: altinity-func-tester
+      runner_type: altinity-func-tester, 16c
       data: ${{ needs.RunConfig.outputs.data }}
   IntegrationTestsAnalyzerAsan:
     needs: [RunConfig, BuilderDebAsan]
@@ -388,7 +388,7 @@ jobs:
     secrets: inherit
     with:
       test_name: Integration tests (asan, old analyzer)
-      runner_type: altinity-func-tester
+      runner_type: altinity-func-tester, 16c
       data: ${{ needs.RunConfig.outputs.data }}
   IntegrationTestsTsan:
     needs: [RunConfig, BuilderDebTsan]
@@ -397,7 +397,7 @@ jobs:
     secrets: inherit
     with:
       test_name: Integration tests (tsan)
-      runner_type: altinity-func-tester
+      runner_type: altinity-func-tester, 16c
       data: ${{ needs.RunConfig.outputs.data }}
   IntegrationTestsRelease:
     needs: [RunConfig, BuilderDebRelease]
@@ -406,7 +406,7 @@ jobs:
     secrets: inherit
     with:
       test_name: Integration tests (release)
-      runner_type: altinity-func-tester
+      runner_type: altinity-func-tester, 16c
       data: ${{ needs.RunConfig.outputs.data }}
 #############################################################################################
 ##################################### REGRESSION TESTS ######################################

From a679ebd293c7982aac0720bebb0e64df8d5c092b Mon Sep 17 00:00:00 2001
From: strtgbb <146047128+strtgbb@users.noreply.github.com>
Date: Fri, 30 Oct 2026 09:12:31 -0400
Subject: [PATCH 14/19] Time out builds after 150 minutes and abort stalled
 submodule fetches

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .github/workflows/reusable_build.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/reusable_build.yml b/.github/workflows/reusable_build.yml
index fd2e44fc16cad..747b907f126b6 100644
--- a/.github/workflows/reusable_build.yml
+++ b/.github/workflows/reusable_build.yml
@@ -53,8 +53,12 @@ jobs:
   Build:
     name: Build-${{inputs.build_name}}
     if: ${{ contains(fromJson(inputs.data).jobs_data.jobs_to_do, inputs.build_name) || inputs.force }}
+    timeout-minutes: 150
     env:
       GITHUB_JOB_OVERRIDDEN: Build-${{inputs.build_name}}
+      # Abort a submodule fetch stalled below 1 KB/s for 60 s, so .github/retry.sh can retry it.
+      GIT_HTTP_LOW_SPEED_LIMIT: 1000
+      GIT_HTTP_LOW_SPEED_TIME: 60
     runs-on: [self-hosted, altinity-on-demand, altinity-builder]
     steps:
       - name: Check out repository code

From eaebedc401c12b69017c5593b836c6c791c11306 Mon Sep 17 00:00:00 2001
From: strtgbb <146047128+strtgbb@users.noreply.github.com>
Date: Fri, 30 Oct 2026 09:15:54 -0400
Subject: [PATCH 15/19] Add the Fast Builds workflow, as on 25.3.14 without
 MSan

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .github/workflows/fast_builds.yml | 301 ++++++++++++++++++++++++++++++
 tests/ci/ci_config.py             |  19 ++
 tests/ci/ci_definitions.py        |   1 +
 3 files changed, 321 insertions(+)
 create mode 100644 .github/workflows/fast_builds.yml

diff --git a/.github/workflows/fast_builds.yml b/.github/workflows/fast_builds.yml
new file mode 100644
index 0000000000000..8d8762414851e
--- /dev/null
+++ b/.github/workflows/fast_builds.yml
@@ -0,0 +1,301 @@
+# yamllint disable rule:comments-indentation
+name: Fast Builds
+run-name: "${{ github.event.inputs.workflow_name || ' ' }}"
+
+env:
+  # Force the stdout and stderr streams to be unbuffered
+  PYTHONUNBUFFERED: 1
+  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+  AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
+  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+  CLICKHOUSE_TEST_STAT_LOGIN: ${{ secrets.CLICKHOUSE_TEST_STAT_LOGIN }}
+  CLICKHOUSE_TEST_STAT_PASSWORD: ${{ secrets.CLICKHOUSE_TEST_STAT_PASSWORD }}
+  CLICKHOUSE_TEST_STAT_URL: ${{ secrets.CLICKHOUSE_TEST_STAT_URL }}
+  DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+  ROBOT_TOKEN: ${{ secrets.ROBOT_TOKEN }}
+
+on: # yamllint disable-line rule:truthy
+  workflow_dispatch:
+    inputs:
+      workflow_name:
+        description: 'Name of the workflow'
+        required: false
+        type: string
+
+jobs:
+  RunConfig:
+    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker-aarch64]
+    outputs:
+      data: ${{ steps.runconfig.outputs.CI_DATA }}
+    steps:
+      - name: Check out repository code
+        uses: Altinity/checkout@19599efdf36c4f3f30eb55d5bb388896faea69f6
+        with:
+          clear-repository: true # to ensure correct digests
+          fetch-depth: 0 # to get version
+          filter: tree:0
+      - name: Debug Info
+        uses: ./.github/actions/debug
+      - name: PrepareRunConfig
+        id: runconfig
+        run: |
+            echo "::group::configure CI run"
+            python3 "$GITHUB_WORKSPACE/tests/ci/ci.py" --configure --workflow FastBuilds --outfile ${{ runner.temp }}/ci_run_data.json
+            echo "::endgroup::"
+            echo "::group::CI run configure results"
+            python3 -m json.tool ${{ runner.temp }}/ci_run_data.json
+            echo "::endgroup::"
+            {
+              echo 'CI_DATA<<EOF'
+              cat  ${{ runner.temp }}/ci_run_data.json
+              echo 'EOF'
+            } >> "$GITHUB_OUTPUT"
+      - name: Re-create GH statuses for skipped jobs if any
+        run: |
+            python3 "$GITHUB_WORKSPACE/tests/ci/ci.py" --infile ${{ runner.temp }}/ci_run_data.json --update-gh-statuses
+      - name: Note report location to summary
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number || 0 }}
+          COMMIT_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
+        run: |
+          REPORT_LINK=https://s3.amazonaws.com/altinity-build-artifacts/$PR_NUMBER/$COMMIT_SHA/ci_run_report.html
+          echo "Workflow Run Report: [View Report]($REPORT_LINK)" >> $GITHUB_STEP_SUMMARY
+
+  BuildDockers:
+    needs: [RunConfig]
+    if: ${{ !failure() && !cancelled() }}
+    uses: ./.github/workflows/docker_test_images.yml
+    secrets: inherit
+    with:
+      data: ${{ needs.RunConfig.outputs.data }}
+
+  BuilderDebRelease:
+    needs: [RunConfig, BuildDockers]
+    if: ${{ !failure() && !cancelled() }}
+    uses: ./.github/workflows/reusable_build.yml
+    secrets: inherit
+    with:
+      build_name: package_release
+      checkout_depth: 0
+      data: ${{ needs.RunConfig.outputs.data }}
+      # always rebuild on release branches to be able to publish from any commit
+      force: true
+
+  BuilderDebAarch64:
+    needs: [RunConfig, BuildDockers]
+    if: ${{ !failure() && !cancelled() }}
+    uses: ./.github/workflows/reusable_build.yml
+    secrets: inherit
+    with:
+      build_name: package_aarch64
+      checkout_depth: 0
+      data: ${{ needs.RunConfig.outputs.data }}
+      # always rebuild on release branches to be able to publish from any commit
+      force: true
+      runner_type: builder-aarch64
+
+  BuilderDebAsan:
+    needs: [RunConfig, BuildDockers]
+    if: ${{ !failure() && !cancelled() }}
+    uses: ./.github/workflows/reusable_build.yml
+    secrets: inherit
+    with:
+      build_name: package_asan
+      data: ${{ needs.RunConfig.outputs.data }}
+
+  BuilderDebUBsan:
+    needs: [RunConfig, BuildDockers]
+    if: ${{ !failure() && !cancelled() }}
+    uses: ./.github/workflows/reusable_build.yml
+    secrets: inherit
+    with:
+      build_name: package_ubsan
+      data: ${{ needs.RunConfig.outputs.data }}
+
+  BuilderDebTsan:
+    needs: [RunConfig, BuildDockers]
+    if: ${{ !failure() && !cancelled() }}
+    uses: ./.github/workflows/reusable_build.yml
+    secrets: inherit
+    with:
+      build_name: package_tsan
+      data: ${{ needs.RunConfig.outputs.data }}
+
+  BuilderDebDebug:
+    needs: [RunConfig, BuildDockers]
+    if: ${{ !failure() && !cancelled() }}
+    uses: ./.github/workflows/reusable_build.yml
+    secrets: inherit
+    with:
+      build_name: package_debug
+      data: ${{ needs.RunConfig.outputs.data }}
+      force: true
+
+  DockerServerImage:
+    needs: [RunConfig, BuilderDebRelease, BuilderDebAarch64]
+    if: ${{ !failure() && !cancelled() }}
+    uses: ./.github/workflows/reusable_test.yml
+    secrets: inherit
+    with:
+      test_name: Docker server image
+      runner_type: altinity-func-tester
+      data: ${{ needs.RunConfig.outputs.data }}
+
+  DockerKeeperImage:
+    needs: [RunConfig, BuilderDebRelease, BuilderDebAarch64]
+    if: ${{ !failure() && !cancelled() }}
+    uses: ./.github/workflows/reusable_test.yml
+    secrets: inherit
+    with:
+      test_name: Docker keeper image
+      runner_type: altinity-func-tester
+      data: ${{ needs.RunConfig.outputs.data }}
+
+  GrypeScan:
+    needs: [RunConfig, DockerServerImage, DockerKeeperImage]
+    if: ${{ !failure() && !cancelled() }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - image: server
+            suffix: ''
+          - image: server
+            suffix: '-alpine'
+          - image: keeper
+            suffix: ''
+    uses: ./.github/workflows/grype_scan.yml
+    secrets: inherit
+    with:
+      docker_image: altinityinfra/clickhouse-${{ matrix.image }}
+      version: ${{ fromJson(needs.RunConfig.outputs.data).version }}
+      tag-suffix: ${{ matrix.suffix }}
+
+  Builds_Report:
+    # run report check for failed builds to indicate the CI error
+    if: ${{ !cancelled() && needs.RunConfig.result == 'success' && contains(fromJson(needs.RunConfig.outputs.data).jobs_data.jobs_to_do, 'Builds') }}
+    needs: [RunConfig, BuilderDebRelease, BuilderDebAarch64, BuilderDebAsan, BuilderDebUBsan, BuilderDebTsan, BuilderDebDebug]
+    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker-aarch64]
+    steps:
+      - name: Check out repository code
+        uses: Altinity/checkout@19599efdf36c4f3f30eb55d5bb388896faea69f6
+      - name: Download reports
+        run: |
+          python3 "$GITHUB_WORKSPACE/tests/ci/ci.py" --infile ${{ toJson(needs.RunConfig.outputs.data) }} --pre --job-name Builds
+      - name: Builds report
+        run: |
+          cd "$GITHUB_WORKSPACE/tests/ci"
+          python3 ./build_report_check.py --reports package_release package_aarch64 package_asan package_ubsan package_tsan package_debug
+      - name: Set status
+        # NOTE(vnemkov): generate and upload the report even if previous step failed
+        if: success() || failure()
+        run: |
+          python3 "$GITHUB_WORKSPACE/tests/ci/ci.py" --infile ${{ toJson(needs.RunConfig.outputs.data) }} --post --job-name Builds
+
+  InstallPackagesTestRelease:
+    needs: [RunConfig, BuilderDebRelease]
+    if: ${{ !failure() && !cancelled() }}
+    uses: ./.github/workflows/reusable_test.yml
+    secrets: inherit
+    with:
+      test_name: Install packages (release)
+      runner_type: altinity-func-tester
+      data: ${{ needs.RunConfig.outputs.data }}
+      run_command: |
+        python3 install_check.py "$CHECK_NAME"
+
+  InstallPackagesTestAarch64:
+    needs: [RunConfig, BuilderDebAarch64]
+    if: ${{ !failure() && !cancelled() }}
+    uses: ./.github/workflows/reusable_test.yml
+    secrets: inherit
+    with:
+      test_name: Install packages (aarch64)
+      runner_type: altinity-func-tester-aarch64
+      data: ${{ needs.RunConfig.outputs.data }}
+      run_command: |
+        python3 install_check.py "$CHECK_NAME"
+
+  FunctionalStatelessTestRelease:
+    needs: [RunConfig, BuilderDebRelease]
+    if: ${{ !failure() && !cancelled() }}
+    uses: ./.github/workflows/reusable_test.yml
+    secrets: inherit
+    with:
+      test_name: Stateless tests (release)
+      runner_type: altinity-func-tester, 16c
+      data: ${{ needs.RunConfig.outputs.data }}
+
+  FunctionalStatelessTestAarch64:
+    needs: [RunConfig, BuilderDebAarch64]
+    if: ${{ !failure() && !cancelled() }}
+    uses: ./.github/workflows/reusable_test.yml
+    secrets: inherit
+    with:
+      test_name: Stateless tests (aarch64)
+      runner_type: altinity-func-tester-aarch64, 16c
+      data: ${{ needs.RunConfig.outputs.data }}
+
+  SignRelease:
+    needs: [RunConfig, BuilderDebRelease]
+    if: ${{ !failure() && !cancelled() }}
+    uses: ./.github/workflows/reusable_sign.yml
+    secrets: inherit
+    with:
+      test_name: Sign release
+      runner_type: altinity-style-checker
+      data: ${{ needs.RunConfig.outputs.data }}
+
+  SignAarch64:
+    needs: [RunConfig, BuilderDebAarch64]
+    if: ${{ !failure() && !cancelled() }}
+    uses: ./.github/workflows/reusable_sign.yml
+    secrets: inherit
+    with:
+      test_name: Sign aarch64
+      runner_type: altinity-style-checker-aarch64
+      data: ${{ needs.RunConfig.outputs.data }}
+
+  FinishCheck:
+    if: ${{ !cancelled() }}
+    needs:
+      - RunConfig
+      - DockerServerImage
+      - DockerKeeperImage
+      - Builds_Report
+      - FunctionalStatelessTestRelease
+      - FunctionalStatelessTestAarch64
+      - InstallPackagesTestRelease
+      - InstallPackagesTestAarch64
+      - GrypeScan
+      - SignRelease
+      - SignAarch64
+    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker-aarch64]
+    steps:
+      - name: Check out repository code
+        uses: Altinity/checkout@19599efdf36c4f3f30eb55d5bb388896faea69f6
+        with:
+          clear-repository: true
+      - name: Finish label
+        if: ${{ !failure() }}
+        run: |
+          # update overall ci report
+          python3 ./tests/ci/finish_check.py --wf-status ${{ contains(needs.*.result, 'failure') && 'failure' || 'success' }}
+      - name: Check Workflow results
+        if: ${{ !cancelled() }}
+        run: |
+          export WORKFLOW_RESULT_FILE="/tmp/workflow_results.json"
+          cat > "$WORKFLOW_RESULT_FILE" << 'EOF'
+          ${{ toJson(needs) }}
+          EOF
+          python3 ./tests/ci/ci_buddy.py --check-wf-status
+      - name: Finalize workflow report
+        if: ${{ !cancelled() }}
+        uses: ./.github/actions/create_workflow_report
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          CHECKS_DATABASE_HOST: ${{ secrets.CHECKS_DATABASE_HOST }}
+          CHECKS_DATABASE_USER: ${{ secrets.CLICKHOUSE_TEST_STAT_LOGIN }}
+          CHECKS_DATABASE_PASSWORD: ${{ secrets.CLICKHOUSE_TEST_STAT_PASSWORD }}
+        with:
+          final: true
diff --git a/tests/ci/ci_config.py b/tests/ci/ci_config.py
index 58d884788db7a..c6141fa2244b9 100644
--- a/tests/ci/ci_config.py
+++ b/tests/ci/ci_config.py
@@ -53,6 +53,25 @@ class CI:
                 JobNames.LIBFUZZER_TEST,
             ]
         ),
+        WorkFlowNames.FAST_BUILDS: LabelConfig(
+            run_jobs=[
+                BuildNames.PACKAGE_RELEASE,
+                BuildNames.PACKAGE_AARCH64,
+                BuildNames.PACKAGE_ASAN,
+                BuildNames.PACKAGE_UBSAN,
+                BuildNames.PACKAGE_TSAN,
+                BuildNames.PACKAGE_DEBUG,
+                JobNames.BUILD_CHECK,
+                JobNames.DOCKER_SERVER,
+                JobNames.DOCKER_KEEPER,
+                JobNames.INSTALL_TEST_AMD,
+                JobNames.INSTALL_TEST_AARCH64,
+                JobNames.STATELESS_TEST_RELEASE,
+                JobNames.STATELESS_TEST_AARCH64,
+                JobNames.SIGN_RELEASE,
+                JobNames.SIGN_AARCH64,
+            ]
+        ),
     }  # type: Dict[str, LabelConfig]
 
     TAG_CONFIGS = {
diff --git a/tests/ci/ci_definitions.py b/tests/ci/ci_definitions.py
index 3ef4d7ad9a6f8..8d818dc2f15e7 100644
--- a/tests/ci/ci_definitions.py
+++ b/tests/ci/ci_definitions.py
@@ -95,6 +95,7 @@ class WorkFlowNames(metaclass=WithIter):
     JEPSEN = "JepsenWorkflow"
     CreateRelease = "CreateRelease"
     NIGHTLY = "NightlyBuilds"
+    FAST_BUILDS = "FastBuilds"
 
 
 class BuildNames(metaclass=WithIter):

From 4d0f9de477fedcb8726cd666b4a0da2a9ed69b64 Mon Sep 17 00:00:00 2001
From: strtgbb <146047128+strtgbb@users.noreply.github.com>
Date: Fri, 30 Oct 2026 09:15:54 -0400
Subject: [PATCH 16/19] Report the real base and head refs to the CI database

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 tests/ci/clickhouse_helper.py | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/tests/ci/clickhouse_helper.py b/tests/ci/clickhouse_helper.py
index 44f75ad6806d7..0ed36cfa43b9a 100644
--- a/tests/ci/clickhouse_helper.py
+++ b/tests/ci/clickhouse_helper.py
@@ -9,7 +9,12 @@
 
 import requests
 
-from env_helper import CLICKHOUSE_TEST_STAT_URL, CLICKHOUSE_TEST_STAT_PASSWORD, CLICKHOUSE_TEST_STAT_LOGIN
+from env_helper import (
+    GITHUB_REPOSITORY,
+    CLICKHOUSE_TEST_STAT_URL,
+    CLICKHOUSE_TEST_STAT_PASSWORD,
+    CLICKHOUSE_TEST_STAT_LOGIN,
+)
 from get_robot_token import get_parameter_from_ssm
 from pr_info import PRInfo
 from report import TestResults
@@ -212,11 +217,11 @@ def prepare_tests_results_for_clickhouse(
     report_url: str,
     check_name: str,
 ) -> List[dict]:
-    pull_request_url = "https://github.com/Altinity/ClickHouse/commits/master"
-    base_ref = "master"
-    head_ref = "master"
-    base_repo = pr_info.repo_full_name
-    head_repo = pr_info.repo_full_name
+    base_ref = pr_info.base_ref
+    base_repo = pr_info.base_name
+    head_ref = pr_info.head_ref
+    head_repo = pr_info.head_name
+    pull_request_url = f"https://github.com/{GITHUB_REPOSITORY}/commits/{head_ref}"
     if pr_info.number != 0:
         pull_request_url = pr_info.pr_html_url
 

From 871a684912b25a961ca2aeb877ef304a8dbb622d Mon Sep 17 00:00:00 2001
From: strtgbb <146047128+strtgbb@users.noreply.github.com>
Date: Fri, 30 Oct 2026 09:15:54 -0400
Subject: [PATCH 17/19] Pass str paths to boto3 upload_file and download_file

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 tests/ci/s3_helper.py | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/tests/ci/s3_helper.py b/tests/ci/s3_helper.py
index 8f66a01ed2013..dafb4f44f4cc7 100644
--- a/tests/ci/s3_helper.py
+++ b/tests/ci/s3_helper.py
@@ -144,7 +144,9 @@ def _upload_file_to_s3(
                 logging.info("Processing file without compression")
             logging.info("File is too large, do not provide content type")
 
-        self.client.upload_file(file_path, bucket_name, s3_path, ExtraArgs=metadata)
+        self.client.upload_file(
+            str(file_path), bucket_name, s3_path, ExtraArgs=metadata
+        )
         url = self.s3_url(bucket_name, s3_path)
         logging.info("Upload %s to %s Meta: %s", file_path, url, metadata)
         return url
@@ -175,7 +177,7 @@ def download_file(
         if Path(local_file_path).is_dir():
             local_file_path = Path(local_file_path) / s3_path.split("/")[-1]
         try:
-            self.client.download_file(bucket, s3_path, local_file_path)
+            self.client.download_file(bucket, s3_path, str(local_file_path))
         except botocore.exceptions.ClientError as e:
             if e.response and e.response["ResponseMetadata"]["HTTPStatusCode"] == 404:
                 assert False, f"No such object [s3://{S3_BUILDS_BUCKET}/{s3_path}]"
@@ -228,7 +230,7 @@ def upload_task(file_path: Path) -> str:
                 for i in range(5):
                     try:
                         self.client.upload_file(
-                            file_path, bucket_name, s3_path, ExtraArgs=metadata
+                            str(file_path), bucket_name, s3_path, ExtraArgs=metadata
                         )
                         break
                     except Exception as ex:

From 909ef7adb91866625033e92e3c53bcf317c55afb Mon Sep 17 00:00:00 2001
From: strtgbb <146047128+strtgbb@users.noreply.github.com>
Date: Fri, 30 Oct 2026 11:02:05 -0400
Subject: [PATCH 18/19] Map the regression Docker credential from the
 DOCKER_TOKEN secret, as on 26.8

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .github/workflows/regression-reusable-suite.yml | 2 +-
 .github/workflows/regression.yml                | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/regression-reusable-suite.yml b/.github/workflows/regression-reusable-suite.yml
index edf264ca88ab1..677cd35a1aa22 100644
--- a/.github/workflows/regression-reusable-suite.yml
+++ b/.github/workflows/regression-reusable-suite.yml
@@ -67,7 +67,7 @@ jobs:
       AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
       # Docker credentials
       DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-      DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+      DOCKER_PASSWORD: ${{ secrets.DOCKER_TOKEN }}
       # Database credentials
       CHECKS_DATABASE_HOST: ${{ secrets.CHECKS_DATABASE_HOST }}
       CHECKS_DATABASE_USER: ${{ secrets.CLICKHOUSE_TEST_STAT_LOGIN }}
diff --git a/.github/workflows/regression.yml b/.github/workflows/regression.yml
index 414988408bc35..a5ce914c0cad8 100644
--- a/.github/workflows/regression.yml
+++ b/.github/workflows/regression.yml
@@ -60,8 +60,8 @@ name: Regression test workflow - Release
       DOCKER_USERNAME:
         description: username of the docker user.
         required: true
-      DOCKER_PASSWORD:
-        description: password to the docker user.
+      DOCKER_TOKEN:
+        description: token of the docker user.
         required: true
       REGRESSION_AWS_S3_BUCKET:
         description: aws s3 bucket used for regression tests.

From 4e80df15079bf89df99e161878e73a6efdd0d163 Mon Sep 17 00:00:00 2001
From: Mikhail Koviazin <github@mkmk.aleeas.com>
Date: Sat, 31 Oct 2026 14:30:24 +0100
Subject: [PATCH 19/19] docker: Remove unavailable BusyBox command

The Ubuntu image does not install BusyBox, so invoking it aborts the
image build with exit code 127. Remove the command, as in stable 25.3.

Port the BusyBox removal from Altinity/ClickHouse#2076.
---
 docker/server/Dockerfile.ubuntu | 1 -
 1 file changed, 1 deletion(-)

diff --git a/docker/server/Dockerfile.ubuntu b/docker/server/Dockerfile.ubuntu
index 882af8c11bdb1..1842fbfc37fc5 100644
--- a/docker/server/Dockerfile.ubuntu
+++ b/docker/server/Dockerfile.ubuntu
@@ -26,7 +26,6 @@ RUN sed -i "s|http://archive.ubuntu.com|${apt_archive}|g" /etc/apt/sources.list
         tzdata \
         wget \
     && apt-get upgrade --yes --no-install-recommends \
-    && busybox --install -s \
     && apt-get clean \
     && rm -rf /var/lib/apt/lists/* /var/cache/debconf /tmp/*