Antalya 25.8: bump to 25.8.30

[zvonand]

Changelog category (leave one):

• Not for changelog (changelog entry is not required)

CI/CD Options

Exclude tests:

• Fast test
• Integration Tests
• Stateless tests
• Stateful tests
• Performance tests
• Aarch64 tests
• All with ASAN
• All with TSAN
• All with MSAN
• All with UBSAN
• All with Coverage
• All Regression
• Disable CI Cache

Regression jobs to run:

• Fast suites (mostly <1h)
• Aggregate Functions (2h)
• Alter (1.5h)
• Benchmark (30m)
• ClickHouse Keeper (1h)
• Iceberg (2h)
• LDAP (1h)
• OAuth (5m)
• Parquet (1.5h)
• RBAC (1.5h)
• SSL Server (1h)
• S3 (2h)
• S3 Export (2h)
• Swarms (30m)
• Tiered Storage (2h)

[github-actions]

Workflow [PR], commit [e329783]

[zvonand]

@blau-ai

[blau-ai]

CI triage for #2224 (bump to 25.8.30)

Verdict: 8 red checks, none is a product regression introduced by this bump.
1 infra, 1 expected-for-bump (DCO), 1 pre-existing crash unrelated to the diff, and 4 stateless failures that are all new tests brought in by the bump failing in one specific CI config each (test-harness tagging), plus one deltalake test that needs a look but shows no security regression. Head SHA e3297834526.

Evidence: this PR is only 2 commits past antalya-25.8; the "product" surface is the merge of the v25.8.30.16-lts tag. All four failing stateless tests were added by that merge (none exist on the base branch), and every one of them passes in every other config and fails in exactly the config a standard exclusion tag would remove.

---

Not caused by this PR

Integration tests (amd_binary, 1/5 … 5/5) — all five shards report infrastructure error with no test-level results (only a job.log, no test artifacts). Runner/infra failure, not a product failure. → Re-run.

DCO — fails because the merge commit Merge tag 'v25.8.30.16-lts' and the upstream backport commits carry no Signed-off-by trailer. This is inherent to a version-bump PR that merges upstream history. → Maintainer bypass / override, as for previous bump PRs. Not a code issue.

AST fuzzer (amd_debug) — Logical error: 'Bad cast from type ColumnVector<unsigned long> to ColumnVector<char8_t>'. This is a real but pre-existing crash, not introduced here:

• Crash site: src/Processors/Formats/Impl/Parquet/Reader.cpp:2125 in Parquet::Reader::applyPrewhere — a typeid_cast<ColumnVector<UInt8>> on a ColumnVector<UInt64> column, i.e. a fuzzed PREWHERE cityHash64(...) (UInt64) fed to the native Parquet reader v3 (input_format_parquet_use_native_reader_v3=1).
• This bump makes zero changes under src/Processors/Formats/Impl/Parquet/ (git diff antalya-25.8..HEAD -- .../Parquet/ is empty), and applyPrewhere already exists on antalya-25.8. The bug lives on the base branch.
• → Not a blocker for this PR. Worth a separate issue against the native Parquet v3 reader (PREWHERE filter column must be cast to UInt8, not blindly to the column's own type). Safe to re-run the fuzzer here.

---

Introduced by the bump, but test-only / low-risk (owned by this PR)

All four are brand-new tests that came in with the tag merge. Three are missing a CI-config exclusion tag; one is a security test whose security invariant still holds.

1. 04299_deltalake_local_path_traversal — fails in all 6 stateless configs (deterministic).
Diff: the expected GOT ACCESS DENIED ERROR line is missing for both allow_experimental_delta_kernel_rs=1 and =0; but NO LEAK holds in every config — the crafted path-traversal delta log does not leak the out-of-table secret. So there is no security regression; only the specific PATH_ACCESS_DENIED error the test asserts is not being raised.
The guard (resolvePathInsideTable, backport ClickHouse#106115) is present and wired into both readers (DeltaLakeMetadata.cpp, DeltaLake/TableSnapshot.cpp), so this is most likely a path-normalization detail in the CI temp layout (e.g. pathStartsWith on the non-normalized base/../secret combination, or CLICKHOUSE_TMP under a symlinked path) rather than a missing check.
→ Needs a real look by the delta-lake owner (or the bump author): reproduce deltaLakeLocal(<crafted dir>, 'RawBLOB') and capture the actual error, then either fix the guard so PATH_ACCESS_DENIED is raised, or relax the test to assert "read is blocked" rather than the exact code. Not a merge blocker on security grounds, but must go green.

2. 03918_arrayjoin_join_on_duplicate_execution — fails only under old analyzer.
The old analyzer rejects arrayJoin(...) in a JOIN ON key with INVALID_JOIN_ON_EXPRESSION; the test is a regression test for a new-analyzer plan optimization (query_plan_use_new_logical_join_step) and passes under the new analyzer. → Tag it no-old-analyzer (that tag is already used by 04330_join_global_left_semi_chunk_consistency.sql).

--- Tags: long, no-random-settings
+-- Tags: long, no-random-settings, no-old-analyzer

3. 04510_s3_explicit_url_named_secret_mask — fails only under DatabaseReplicated.
Masking works ([HIDDEN] present); the reference mismatch is the extra replicated-DDL lines DatabaseReplicated injects into the SHOW CREATE stream (CREATE TABLE … UUID '…' and /* ddl_entry=… */ DROP TABLE … SYNC). → Tag no-replicated-database.

--- Tags: no-fasttest
+-- Tags: no-fasttest, no-replicated-database

4. 04296_alter_rename_column_in_memory_rollback — fails only under DatabaseReplicated (sequential).
The test enables the mt_alter_throw_in_start_mutation failpoint, which is specific to StorageMergeTree::alter. Under DatabaseReplicated the MergeTree table becomes ReplicatedMergeTree, whose ALTER path differs, so the in-memory rollback the test checks isn't exercised as intended (→ SELECT id, d hits UNKNOWN_IDENTIFIER: d). It passes in every non-replicated sequential config. → Tag no-replicated-database.

-# Tags: no-parallel
+# Tags: no-parallel, no-replicated-database

(One caveat worth a maintainer glance: confirm the ALTER-rename rollback semantics are equivalent — or intentionally out of scope — under a Replicated engine, so the tag documents a real scope boundary rather than hiding a Replicated-path gap.)

---

Suggested next steps

• Re-run the 5 Integration (amd_binary) shards and the AST fuzzer (both non-PR).
• DCO: maintainer override, as usual for bump PRs.
• File a separate issue for the pre-existing native-Parquet-v3 PREWHERE bad-cast crash.
• Tag fixes for 03918, 04510, 04296 (three one-line diffs above) — these will clear those three stateless suites.
• 04299_deltalake: hand to the delta-lake owner to confirm why PATH_ACCESS_DENIED isn't raised (no leak, so low severity).

I can open a blau/* PR with the three tagging one-liners against this branch if you'd like — just say the word (or tell me to commit them directly to bump/antalya-25.8/25.8.30). I'd leave 04299 and the Parquet-v3 crash for their code owners.