Antalya 26.3 - Port CI fixes

.github/grype/run_grype_scan.sh

@@ -3,7 +3,7 @@ set -e
 
 IMAGE=$1
 
-GRYPE_VERSION=${GRYPE_VERSION:-"v0.92.2"}
+GRYPE_VERSION=${GRYPE_VERSION:-"v0.115.0"}
 
 docker pull $IMAGE
 docker pull anchore/grype:${GRYPE_VERSION}

.github/workflows/grype_scan.yml

@@ -30,7 +30,7 @@ env:
   AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
   AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
   AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-  GRYPE_VERSION: "v0.92.2-arm64v8"
+  GRYPE_VERSION: "v0.115.0-arm64v8"
 
 jobs:
     grype_scan:

ci/jobs/clickbench.py

@@ -18,6 +18,13 @@ def main():
 
         def install():
             res = ch.install_clickbench_config()
+            # The ClickBench `create.sql` attaches `hits` on a cached disk
+            # rooted at `/dev/shm/clickhouse/`; ship the matching server-side
+            # allowed-directory override alongside it.
+            res = res and Shell.check(
+                f"cp ./ci/jobs/scripts/clickbench/filesystem_caches_path.xml {temp_dir}/config.d/",
+                verbose=True,
+            )
             if info.is_local_run:
                 return res
             return res # and ch.create_log_export_config()

ci/jobs/scripts/clickbench/filesystem_caches_path.xml

@@ -0,0 +1,13 @@
+<!--
+    The ClickBench `create.sql` attaches the `hits` table on a cached disk
+    rooted at `/dev/shm/clickhouse/`, and the server refuses a cache path
+    outside `custom_cached_disks_base_directory`, so point that at the same root.
+
+    Do not also move `filesystem_caches_path`: it is the root for the named
+    caches in `config.d/storage_conf_local.xml`, and relocating those to the
+    tmpfs on /dev/shm makes the server refuse to start, since their 21 GiB
+    `max_size` exceeds the tmpfs capacity.
+-->
+<clickhouse>
+    <custom_cached_disks_base_directory replace="replace">/dev/shm/clickhouse/</custom_cached_disks_base_directory>
+</clickhouse>

docker/keeper/Dockerfile

@@ -84,6 +84,8 @@ RUN clickhouse-keeper --version \
     && chown root:clickhouse "${DEFAULT_LOG_DIR}" \
     && chmod ugo+Xrw -R "${DEFAULT_DATA_DIR}" "${DEFAULT_LOG_DIR}" "${DEFAULT_CONFIG_DIR}"
 
+RUN apk update && apk upgrade --no-cache
+
 # /var/lib/clickhouse is necessary due to the current default configuration for Keeper
 VOLUME "${DEFAULT_DATA_DIR}" /var/lib/clickhouse
 EXPOSE 2181 10181 44444 9181

docker/server/Dockerfile.alpine

@@ -89,6 +89,8 @@ RUN mkdir -p \
     && chown root:clickhouse "${DEFAULT_LOG_DIR}" \
     && chmod ugo+Xrw -R "${DEFAULT_DATA_DIR}" "${DEFAULT_LOG_DIR}" "${DEFAULT_CLIENT_CONFIG_DIR}" "${DEFAULT_SERVER_CONFIG_DIR}"
 
+RUN apk update && apk upgrade --no-cache
+
 VOLUME "${DEFAULT_DATA_DIR}"
 EXPOSE 9000 8123 9009
 

tests/integration/test_format_schema_source/test.py

@@ -5,7 +5,11 @@
 
 import helpers.kafka.common as k
 from helpers.client import QueryRuntimeException
-from helpers.cluster import ClickHouseCluster
+from helpers.cluster import ClickHouseCluster, is_arm
+
+# Skip on ARM due to Confluent/Kafka
+if is_arm():
+    pytestmark = pytest.mark.skip
 
 cluster = ClickHouseCluster(__file__)
 instance = cluster.add_instance(

tests/integration/test_s3_cluster/test.py

@@ -125,7 +125,8 @@ def started_cluster():
             "c2.s0_0_1",
             main_configs=["configs/cluster.xml", "configs/named_collections.xml", "configs/hidden_clusters.xml"],
             user_configs=["configs/users.xml"],
-            macros={"replica": "replica2", "shard": "shard1"},
+            # Must be unique per instance: the database disk prefix is .../test-{shard}|{replica}
+            macros={"replica": "replica2_c2", "shard": "shard1"},
             with_zookeeper=True,
             stay_alive=True,
         )

tests/integration/test_storage_iceberg_concurrent/test_concurrent_reads.py

@@ -39,8 +39,10 @@ def test_concurrent_reads(started_cluster_iceberg):
 
     def run_concurrent_queries(i):
         def select(_):
+            # Bound per-query fan-out so the concurrent readers don't exhaust the global thread pool.
             instance.query(
                 f"SELECT * FROM {TABLE_NAME}",
+                settings={"max_threads": 4},
             )
 
 

tests/queries/0_stateless/05082_kill_and_system_on_cluster_access_types.sh

@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+# Tags: no-encrypted-storage
 
 CUR_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
 # shellcheck source=../shell_config.sh