[strtgbb]

Upstream version logic has changed in 26.x, rework our customizations to minimize conflicts and improve functionality.

• VERSION_STRING and VERSION_DESCRIBE are common merge conflicts, they are now automated.
• Fix and improve tag validity checks. Get the flavour from tag so the altinitytest flavour remains supported.
• Recognize new prelrease labels antalyatest and altinityfipstest alongside the existing altinitytest, which remains the default for local builds.
• Recognize new prerelease labels for PRs and merges: antalyatest and altinityfipstest, in addition to the existing altinitytest, which remains the default for local builds.
• Derive VERSION_FLAVOUR and first digit of VERSION_TWEAK from branch name so that it no longer gets forgotten when CICD gets rebased from stable to antalya and vice versa.
• Derive VERSION_TWEAK by checking release history. This would remove the need for manual bumps.

Changelog category (leave one):

• CI Fix or Improvement (changelog entry is not required)

CI/CD Options

Exclude tests:

• Fast test
• Integration Tests
• Stateless tests
• Stateful tests
• Unit tests
• Performance tests
• Aarch64 tests
• All with ASAN
• All with TSAN
• All with MSAN
• All with UBSAN
• All with Coverage
• All Regression
• Disable CI Cache

Regression jobs to run:

• Fast suites (mostly <1h)
• Aggregate Functions (2h)
• Alter (1.5h)
• Benchmark (30m)
• CAS (content-addressed storage; Antalya only)
• ClickHouse Keeper (1h)
• Iceberg (2h)
• LDAP (1h)
• OAuth (5m)
• Parquet (1.5h)
• RBAC (1.5h)
• SSL Server (1h)
• S3 (2h)
• S3 Export (2h)
• Swarms (30m)
• Tiered Storage (2h)

[github-actions]

Workflow [PR], commit [d86170f]

[CarlosFelipeOR]

AI audit note: This review comment was generated by AI (gpt-5.3-codex).

Audit update for PR #2485 (Version logic rework):

Confirmed defects:

• Medium: Flavoured PR build versions are non-deterministic across reruns
  Impact: Same PR head SHA can get different version strings over time, causing artifact/version identity drift.
  Anchor: ci/jobs/scripts/workflow_hooks/version_log.py / _build_version
  Trigger: Re-run a flavoured PR after new release tags appear on the same track.
  Why defect: Tweak is recomputed from mutable remote tag history instead of a stable PR-local value.
  Fix direction (short): Pin flavoured PR tweak for PR builds; keep tag-history derivation for branch/tag release flows.
  Regression test direction (short): Assert PR build version stays unchanged when only release_tags output changes.

• Low: release_tags crashes on retries=0 with internal variable error
  Impact: Boundary input causes UnboundLocalError instead of a controlled validation/runtime error.
  Anchor: ci/jobs/scripts/clickhouse_version.py / release_tags
  Trigger: Call release_tags(..., retries=0).
  Why defect: Loop body is skipped and stderr is referenced uninitialized in the else path.
  Fix direction (short): Validate retries >= 1 or initialize stderr before the loop.
  Regression test direction (short): Add a test for retries=0 expecting deterministic error behavior.

Coverage summary:

• Scope reviewed: all changed paths in version derivation, tag validation, and related tests/CMake integration for PR Stable 26.8 - Version logic rework #2485.
• Categories failed: history/timing determinism; parameter-boundary robustness.
• Categories passed: remote lookup fail-close behavior; tag format/track validation paths.
• Assumptions/limits: static + targeted local probes only; no full CI workflow replay in this environment.

[CarlosFelipeOR]

LGTM. I have a few follow-up questions and suggestions below. None of them are blocking.

On the two defects from the AI audit above

1. Version drift with cached builds. I traced this further. It's real but low impact, and it never affects releases.
   • The CI derives the version at the start of each run from the release tags. The build cache key only covers source files, so a new version alone doesn't trigger a rebuild.
   • Example: a feature PR builds on Monday as 26.8.11.10003.altinitytest. On Tuesday, v26.8.11.10003.altinitystable is released. On Wednesday, the same PR reruns with no source changes. The CI now reports 10004, but the build is a cache hit. The binary, packages and Docker image still say 10003.
   • Tag builds are safe. master.yml sets DISABLE_CI_CACHE=1 for tags, so every release compiles fresh.
   • If you decide to fix it, a suggestion: call version.write() in version_log. Pre-hooks run before the digests are computed, so the new version would land in the ./cmake digest and trigger a rebuild.
2. release_tags(retries=0). The finding is correct, but no caller passes retries. I'd leave it as is.

Other suggestions

3. git ls-remote has no timeout. Shell.get_res_stdout_stderr calls subprocess.run without one, and the retry only fires on a non-zero exit. A hung connection blocks the version hook until the job times out, and the hook runs on every PR and release build. Prefixing the command with timeout 60 turns a hang into a failed attempt, so the existing retry handles it.
4. --check-tag doesn't tie the tag to the commit's track. PR and branch builds take the track from the branch, but check_tag_against_versions takes it from the tag's flavour. For example, v26.8.11.20002.altinityantalya on a stable-26.8 commit passes if 20002 is the next antalya tweak, and that release would ship labelled as antalya. Could the tag check also confirm that the commit is on a branch with the matching prefix?
5. Removed tests. Dropping the unflavoured tests makes sense. Why were these two removed?
   • test_version_log_mirrors_version_into_workflow_custom_data: this path now runs on every flavoured build.
   • test_source_upload_restores_submodule_cache: this test isn't related to versioning.