Antalya 26.3 - Port SignRelease and SourceUpload additional jobs to praktika#1989
Merged
Conversation
MyroTk
previously approved these changes
Jun 30, 2026
strtgbb
force-pushed
the
make-sign-praktika-ant-26.3
branch
from
13c6019 to
186efc1
Compare
The `SignRelease` (`reusable_sign.yml`) additional job was broken: it matrixed over a deprecated `jobs_data.jobs_params[...].batches` field that evaluated to an empty value (failing `MasterCI`'s strategy step) and called `tests/ci/ci.py`, which no longer exists. Rather than patch dead code, port both `SignRelease` and `SourceUpload` to native praktika jobs. - Add `ci/jobs/sign_release.py`: hashes release packages (deb/rpm/tgz and the self-extracting `clickhouse` binary) with SHA512 and GPG-signs the hash files, passing the passphrase via a file so it never hits the logs. - Add `ci/jobs/source_upload.py`: checks out submodules (praktika's job checkout has none, unlike the old `Altinity/checkout`), tars the tree and uploads it to the unchanged legacy S3 path so external consumers keep working. No `digest_config` so the CI cache never skips it across commits. - Add `ci/defs/altinity_jobs.py` to hold Altinity-only jobs and their artifacts (`sign_release_jobs`, `source_upload_job`, `signed_hashes`), keeping the upstream-tracked `defs.py`/`job_configs.py` merge-clean. - Wire the new jobs into `master`, `release_builds`, and (source upload only) `pull_request`; drop the ported entries from `additional_jobs`. - Remove the `SignRelease`/`SourceUpload` templates and generator wiring, the obsolete `reusable_sign.yml`, and the old `tests/ci/sign_release.py`. - Regenerate the workflow YAML. Ref: https://github.com/Altinity/ClickHouse/actions/runs/28142888526 Co-authored-by: Cursor <cursoragent@cursor.com>
strtgbb
force-pushed
the
make-sign-praktika-ant-26.3
branch
from
186efc1 to
2e1d59e
Compare
strtgbb
added
the
port-everywhere
strtgbb
added a commit
that referenced
this pull request
Jul 2, 2026
Antalya 26.3 - Port SignRelease and SourceUpload additional jobs to praktika
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
SignRelease(reusable_sign.yml) additional job was broken: it matrixed over a deprecatedjobs_data.jobs_params[...].batchesfield that evaluated to an empty value (failingMasterCI's strategy step) and calledtests/ci/ci.py, which no longer exists. Rather than patch dead code, port bothSignReleaseandSourceUploadto native praktika jobs.ci/jobs/sign_release.py: hashes release packages (deb/rpm/tgz and the self-extractingclickhousebinary) with SHA512 and GPG-signs the hash files, passing the passphrase via a file so it never hits the logs.ci/jobs/source_upload.py: checks out submodules (praktika's job checkout has none, unlike the oldAltinity/checkout), tars the tree and uploads it to the unchanged legacy S3 path so external consumers keep working. Nodigest_configso the CI cache never skips it across commits.ci/defs/altinity_jobs.pyto hold Altinity-only jobs and their artifacts (sign_release_jobs,source_upload_job,signed_hashes), keeping the upstream-trackeddefs.py/job_configs.pymerge-clean.master,release_builds, and (source upload only)pull_request; drop the ported entries fromadditional_jobs.SignRelease/SourceUploadtemplates and generator wiring, the obsoletereusable_sign.yml, and the oldtests/ci/sign_release.py.Ref: https://github.com/Altinity/ClickHouse/actions/runs/28142888526
Changelog category (leave one):
Changelog entry (a user-readable short description of the changes that goes to CHANGELOG.md):
...
Documentation entry for user-facing changes
...
CI/CD Options
Exclude tests:
Regression jobs to run: