Skip to content

Stable 26.8 - CICD Continued - #2581

Open
strtgbb wants to merge 12 commits into
stable-26.8from
cicd/stable-26.8/continued
Open

strtgbb wants to merge 12 commits into
stable-26.8from
cicd/stable-26.8/continued

Conversation

@strtgbb

@strtgbb strtgbb commented Oct 15, 2026

Copy link
Copy Markdown
Collaborator

CICD Fixes and ports for 26.8

Changelog category (leave one):

  • CI Fix or Improvement (changelog entry is not required)

CI/CD Options

Exclude tests:

  • Fast test
  • Integration Tests
  • Stateless tests
  • Stateful tests
  • Unit tests
  • Performance tests
  • Aarch64 tests
  • All with ASAN
  • All with TSAN
  • All with MSAN
  • All with UBSAN
  • All with Coverage
  • All Regression
  • Disable CI Cache

Regression jobs to run:

  • Fast suites (mostly <1h)
  • Aggregate Functions (2h)
  • Alter (1.5h)
  • Benchmark (30m)
  • CAS (content-addressed storage; Antalya only)
  • ClickHouse Keeper (1h)
  • Iceberg (2h)
  • LDAP (1h)
  • OAuth (5m)
  • Parquet (1.5h)
  • RBAC (1.5h)
  • SSL Server (1h)
  • S3 (2h)
  • S3 Export (2h)
  • Swarms (30m)
  • Tiered Storage (2h)

strtgbb and others added 7 commits October 15, 2026 13:44
ARM sanitizer builds disable SimSIMD so `02354_vector_search_rescoring_distance_in_select_list` disagrees with the binary-build reference.

Co-authored-by: Cursor <[email protected]>
Commit statuses belong to the commit, not the ref. When a release tag points at
the tip of its branch, the branch run and the tag run write to the same job
names, and `get_commit_statuses` kept whichever was newest. The jobs table then
showed failures from the branch run while the error tables, which filter on the
tag, did not.

For release runs, keep only statuses whose results link has the reported ref in
it (`REF=<ref>&` or `/REFs/<ref>/`). Pull request runs are not filtered.

Report: https://s3.amazonaws.com/altinity-build-artifacts/REFs/v26.6.8.20002.altinityantalya/20d68b0d4aea62a8977f154edd004e553fc5d034/38626451129/ci_run_report.html#ci-jobs-status

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
The search link used `merged:>YYYY-MM-DD`, which GitHub reads as strictly after
that whole day. PRs merged later on the baseline day were left out, such as
#2315 and #2529 for 26.6.8.20002. The date also came from the release publish
time, while the table lists PRs after the baseline tag commit.

Use the UTC commit time of the baseline commit for both baseline sources, so
`merged:>` matches the range used for the table and the version bump PR that
created the baseline is excluded.

Report: https://s3.amazonaws.com/altinity-build-artifacts/REFs/v26.6.8.20002.altinityantalya/20d68b0d4aea62a8977f154edd004e553fc5d034/38626451129/ci_run_report.html#prs-in-release

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
@strtgbb strtgbb added cicd Improvements and fixes to the CICD process 26.8 labels Oct 15, 2026
@github-actions

github-actions Bot commented Oct 15, 2026 •

Copy link
Copy Markdown

Workflow [PR], commit [b8d21b3]

strtgbb and others added 4 commits October 30, 2026 14:21
Most runners are in Hetzner, so every job that downloads the submodule
archive from AWS S3 pays egress. Keep the archive in a Hetzner bucket
instead.

Buckets listed in `S3_EXTERNAL_BUCKETS` are served by a boto3 client with
their own endpoint and credentials. `S3.put` and `S3.head_object` use it
for those buckets, and keep using the AWS CLI for every other bucket. With
`public_read`, reads are unsigned, so community PRs can use the archive
without credentials; they never create it. A missing credential is an
error, so ambient AWS credentials are never sent to the Hetzner endpoint.

The archive is public, so `_prepare_submodule_cache` refuses to upload it
if the clone token ended up in a git config file.

The workflows export `HETZNER_S3_ACCESS_KEY` and `HETZNER_S3_SECRET_KEY`
from GitHub secrets. The bucket is `altinity-builds-cache` in hel1.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
The first CI run failed with a 403 on the existence check for the
submodule archive. The bucket is public for object reads, but answers a
HEAD of a missing key with 403 to callers who cannot list it. The config
job read the bucket unsigned because the bucket is marked `public_read`,
even though it has the keys.

Reads are now unsigned only for jobs without the bucket's keys. Those
jobs treat a 403 from `head_object` as a miss; jobs with the keys use a
signed client, so a 403 is still an error for them.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
`create_workflow_report.py` conflicted: `stable-26.8` refactored the release
baseline lookup while this branch changed it to report the baseline commit
time and to filter statuses by the reported ref. `antalya-26.8` already
carries both, so take its version of the file.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

26.8 cicd Improvements and fixes to the CICD process

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant