From 6ea99ed09ac3f4b9d7fddceab3cb8cdee3793d9b Mon Sep 17 00:00:00 2001
From: strtgbb <146047128+strtgbb@users.noreply.github.com>
Date: Fri, 26 Jun 2026 09:23:49 -0400
Subject: [PATCH 01/11] fix regression not respecting arm skip flag

---
 .github/workflows/master.yml             | 2 +-
 .github/workflows/pull_request.yml       | 2 +-
 ci/praktika/yaml_additional_templates.py | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/master.yml b/.github/workflows/master.yml
index 321a7ec62507..127be9708022 100644
--- a/.github/workflows/master.yml
+++ b/.github/workflows/master.yml
@@ -5465,7 +5465,7 @@ jobs:
       workflow_config: ${{ needs.config_workflow.outputs.data }}
   RegressionTestsAarch64:
     needs: [config_workflow, build_arm_binary, stateless_tests_arm_binary_parallel]
-    if: ${{  !cancelled() && !contains(needs.*.outputs.pipeline_status, 'failure') && !contains(fromJson(needs.config_workflow.outputs.data).JOB_KV_DATA.ci_exclude_tags, 'regression') && !contains(fromJson(needs.config_workflow.outputs.data).workflow_config.custom_data.ci_exclude_tags, 'aarch64')}}
+    if: ${{  !cancelled() && !contains(needs.*.outputs.pipeline_status, 'failure') && !contains(fromJson(needs.config_workflow.outputs.data).JOB_KV_DATA.ci_exclude_tags, 'regression') && !contains(fromJson(needs.config_workflow.outputs.data).JOB_KV_DATA.ci_exclude_tags, 'aarch64')}}
     uses: ./.github/workflows/regression.yml
     secrets: inherit
     with:
diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml
index 492fa61bdd36..3fbc76081c0b 100644
--- a/.github/workflows/pull_request.yml
+++ b/.github/workflows/pull_request.yml
@@ -4630,7 +4630,7 @@ jobs:
       workflow_config: ${{ needs.config_workflow.outputs.data }}
   RegressionTestsAarch64:
     needs: [config_workflow, build_arm_binary, stateless_tests_arm_binary_parallel]
-    if: ${{  !cancelled() && !contains(needs.*.outputs.pipeline_status, 'failure') && !contains(fromJson(needs.config_workflow.outputs.data).JOB_KV_DATA.ci_exclude_tags, 'regression') && !contains(fromJson(needs.config_workflow.outputs.data).workflow_config.custom_data.ci_exclude_tags, 'aarch64')}}
+    if: ${{  !cancelled() && !contains(needs.*.outputs.pipeline_status, 'failure') && !contains(fromJson(needs.config_workflow.outputs.data).JOB_KV_DATA.ci_exclude_tags, 'regression') && !contains(fromJson(needs.config_workflow.outputs.data).JOB_KV_DATA.ci_exclude_tags, 'aarch64')}}
     uses: ./.github/workflows/regression.yml
     secrets: inherit
     with:
diff --git a/ci/praktika/yaml_additional_templates.py b/ci/praktika/yaml_additional_templates.py
index b4f414eee704..67e35a36c3fa 100644
--- a/ci/praktika/yaml_additional_templates.py
+++ b/ci/praktika/yaml_additional_templates.py
@@ -75,7 +75,7 @@ class AltinityWorkflowTemplates:
       workflow_config: ${{ needs.config_workflow.outputs.data }}
   RegressionTestsAarch64:
     needs: [config_workflow, build_arm_binary, stateless_tests_arm_binary_parallel]
-    if: ${{  !cancelled() && !contains(needs.*.outputs.pipeline_status, 'failure') && !contains(fromJson(needs.config_workflow.outputs.data).JOB_KV_DATA.ci_exclude_tags, 'regression') && !contains(fromJson(needs.config_workflow.outputs.data).workflow_config.custom_data.ci_exclude_tags, 'aarch64')}}
+    if: ${{  !cancelled() && !contains(needs.*.outputs.pipeline_status, 'failure') && !contains(fromJson(needs.config_workflow.outputs.data).JOB_KV_DATA.ci_exclude_tags, 'regression') && !contains(fromJson(needs.config_workflow.outputs.data).JOB_KV_DATA.ci_exclude_tags, 'aarch64')}}
     uses: ./.github/workflows/regression.yml
     secrets: inherit
     with:

From c613e3eb787aa1194111f4fa6a9c18181c610b82 Mon Sep 17 00:00:00 2001
From: strtgbb <146047128+strtgbb@users.noreply.github.com>
Date: Fri, 26 Jun 2026 11:48:59 -0400
Subject: [PATCH 02/11] skip zram setup if already configured

---
 .github/actions/runner_setup/action.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/actions/runner_setup/action.yml b/.github/actions/runner_setup/action.yml
index 5a229fdd47e7..0241d2dd26e2 100644
--- a/.github/actions/runner_setup/action.yml
+++ b/.github/actions/runner_setup/action.yml
@@ -6,6 +6,12 @@ runs:
     - name: Setup zram
       shell: bash
       run: |
+          # Skip if zram swap is already active
+          if grep -q '/dev/zram0' /proc/swaps; then
+            echo "/dev/zram0 swap already configured, skipping zram setup."
+            exit 0
+          fi
+
           sudo modprobe zram
           MemTotal=$(grep -Po "(?<=MemTotal:)\s+\d+" /proc/meminfo) # KiB
           Percent=200

From f34b019731f56ffacbf04965973235f236d4d9c0 Mon Sep 17 00:00:00 2001
From: CarlosFelipeOR <carlosfelipeor@gmail.com>
Date: Tue, 23 Jun 2026 02:02:02 -0300
Subject: [PATCH 03/11] Fix Grype Scan: pin boto3==1.43.33 to avoid botocore
 runtime ImportError (#1931)

Signed-off-by: CarlosFelipeOR <carlosfelipeor@gmail.com>
---
 .github/workflows/grype_scan.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/grype_scan.yml b/.github/workflows/grype_scan.yml
index cdf06d967ca1..f464533775fe 100644
--- a/.github/workflows/grype_scan.yml
+++ b/.github/workflows/grype_scan.yml
@@ -50,7 +50,7 @@ jobs:
             sudo apt-get install -y python3-pip python3-venv
             python3 -m venv venv
             source venv/bin/activate
-            pip install --upgrade requests chardet urllib3 unidiff boto3 PyGithub
+            pip install --upgrade requests chardet urllib3 unidiff 'boto3==1.43.33' PyGithub
             pip install testflows==$TESTFLOWS_VERSION awscli==1.33.28
             echo PATH=$PATH >>$GITHUB_ENV
 

From 3cc1dca95ea15b3ae96f8e88988dc60bd6999193 Mon Sep 17 00:00:00 2001
From: strtgbb <146047128+strtgbb@users.noreply.github.com>
Date: Thu, 25 Jun 2026 10:26:28 -0400
Subject: [PATCH 04/11] Merge pull request #1592 from
 Altinity/report-merged-prs

Antalya 26.3  Add 'PRs in Release' table to report
---
 .../ci_run_report.html.jinja                  | 173 +++++++--
 .../create_workflow_report.py                 | 340 +++++++++++++++---
 2 files changed, 435 insertions(+), 78 deletions(-)

diff --git a/.github/actions/create_workflow_report/ci_run_report.html.jinja b/.github/actions/create_workflow_report/ci_run_report.html.jinja
index 4c94465a16c6..92af0fab1cf0 100644
--- a/.github/actions/create_workflow_report/ci_run_report.html.jinja
+++ b/.github/actions/create_workflow_report/ci_run_report.html.jinja
@@ -13,10 +13,11 @@
     :root {
       --altinity-background: #000D45;
       --altinity-accent: #189DCF;
-      --altinity-highlight: #FFC600;
+      --altinity-link-hover: #FFC600;
       --altinity-gray: #6c757d;
       --altinity-light-gray: #f8f9fa;
       --altinity-white: #ffffff;
+      --altinity-hover: color-mix(in srgb, var(--altinity-accent) 12%, var(--altinity-white));
     }
 
     /* Body and heading fonts */
@@ -45,7 +46,7 @@
 
     /* General table styling */
     table {
-      min-width: min(900px, 98vw);
+      min-width: min(900px, 100%);
       margin: 1rem 0;
       border-collapse: collapse;
       background-color: var(--altinity-white);
@@ -107,7 +108,7 @@
 
     /* Table body row styling */
     tr:hover {
-      background-color: var(--altinity-light-gray);
+      background-color: var(--altinity-hover);
     }
 
     /* Table cell styling */
@@ -123,9 +124,72 @@
     }
 
     a:hover {
-      color: var(--altinity-highlight);
+      color: var(--altinity-link-hover);
       text-decoration: underline;
     }
+
+    /* Tab navigation: wrapping strip; each button is an open-bottom tab shape */
+    .tab {
+      display: flex;
+      flex-wrap: wrap;
+      gap: 0.4rem;
+      padding: 0.4rem;
+      border-radius: 0.75rem;
+      width: fit-content;
+      max-width: 100%;
+      margin: 1.5rem 0;
+      background: var(--altinity-white);
+    }
+
+    .tab button.tablinks {
+      appearance: none;
+      box-sizing: border-box;
+      border: 1px solid var(--altinity-accent);
+      border-bottom: 0;
+      border-radius: 0.5rem 0.5rem 0 0;
+      background: var(--altinity-white);
+      padding: 0.55rem 0.95rem;
+      font: inherit;
+      cursor: pointer;
+      white-space: nowrap;
+      color: var(--altinity-background);
+      transition: background 0.12s, color 0.12s;
+    }
+
+    .tab button.tablinks:hover {
+      background: var(--altinity-hover);
+    }
+
+    .tab button.tablinks.active {
+      background: var(--altinity-hover);
+      box-shadow: inset 0 2px 0 var(--altinity-accent);
+      color: var(--altinity-accent);
+      font-weight: 600;
+    }
+
+    .tabcontent {
+      display: none;
+      padding: 0;
+      overflow-x: auto;
+      animation: fadeEffect 0.3s;
+    }
+
+    .tabcontent table {
+      min-width: 0;
+    }
+
+    .tabcontent > *:first-child {
+      margin-top: 0;
+    }
+
+    .tabcontent.active {
+      display: block;
+    }
+
+    @keyframes fadeEffect {
+      from { opacity: 0; }
+      to   { opacity: 1; }
+    }
   </style>
   <title>{{ title }}</title>
   <link rel="icon" type="image/svg+xml"
@@ -166,46 +230,81 @@
   {% if is_preview %}
   <p style="font-weight: bold;color: red;">This is a preview. The workflow is not yet finished.</p>
   {% endif %}
-  <h2>Table of Contents</h2>
-  <ul>
-    {%- if pr_number != 0 %}<li><a href="#new-fails-pr">New Fails in PR</a> ({{ counts.pr_new_fails }})</li>{% endif %}
-    <li><a href="#ci-jobs-status">CI Jobs Status</a> ({{ counts.jobs_status }})</li>
-    <li><a href="#checks-errors">Checks Errors</a> ({{ counts.checks_errors }})</li>
-    <li><a href="#checks-fails">Checks New Fails</a> ({{ counts.checks_new_fails }})</li>
-    <li><a href="#regression-fails">Regression New Fails</a> ({{ counts.regression_new_fails }})</li>
-    <li><a href="#docker-images-cves">Docker Images CVEs</a> ({{ counts.cves }})</li>
-    <li><a href="#checks-known-fails">Checks Known Fails</a> ({{ counts.checks_known_fails }})</li>
-  </ul>
-
-  {%- if pr_number != 0 -%}
-  <h2 id="new-fails-pr">New Fails in PR</h2>
-  <p> Compared with base sha {{ base_sha }} </p>
-  {{ new_fails_html }}
+  <div class="tab">
+    {%- if pr_number == 0 %}<button class="tablinks" onclick="openTab(event, 'prs-in-release')">PRs in Release ({{ counts.prs_in_release }})</button>{% endif %}
+    {%- if pr_number != 0 %}<button class="tablinks" onclick="openTab(event, 'new-fails-pr')">New Fails in PR ({{ counts.pr_new_fails }})</button>{% endif %}
+    <button class="tablinks" onclick="openTab(event, 'ci-jobs-status')">CI Jobs Status ({{ counts.jobs_status }})</button>
+    <button class="tablinks" onclick="openTab(event, 'checks-errors')">Checks Errors ({{ counts.checks_errors }})</button>
+    <button class="tablinks" onclick="openTab(event, 'checks-fails')">Checks New Fails ({{ counts.checks_new_fails }})</button>
+    <button class="tablinks" onclick="openTab(event, 'regression-fails')">Regression New Fails ({{ counts.regression_new_fails }})</button>
+    <button class="tablinks" onclick="openTab(event, 'docker-images-cves')">Docker Images CVEs ({{ counts.cves }})</button>
+    <button class="tablinks" onclick="openTab(event, 'checks-known-fails')">Checks Known Fails ({{ counts.checks_known_fails }})</button>
+  </div>
+
+  {%- if pr_number == 0 %}
+  <div id="prs-in-release" class="tabcontent">
+    {{ prs_in_release_html }}
+  </div>
   {%- endif %}
 
-  <h2 id="ci-jobs-status">CI Jobs Status</h2>
-  {{ ci_jobs_status_html }}
+  {%- if pr_number != 0 %}
+  <div id="new-fails-pr" class="tabcontent">
+    <p>Compared with base sha {{ base_sha }}</p>
+    {{ new_fails_html }}
+  </div>
+  {%- endif %}
+
+  <div id="ci-jobs-status" class="tabcontent">
+    {{ ci_jobs_status_html }}
+  </div>
 
-  <h2 id="checks-errors">Checks Errors</h2>
-  {{ checks_errors_html }}
+  <div id="checks-errors" class="tabcontent">
+    {{ checks_errors_html }}
+  </div>
 
-  <h2 id="checks-fails">Checks New Fails</h2>
-  {{ checks_fails_html }}
+  <div id="checks-fails" class="tabcontent">
+    {{ checks_fails_html }}
+  </div>
 
-  <h2 id="regression-fails">Regression New Fails</h2>
-  {{ regression_fails_html }}
+  <div id="regression-fails" class="tabcontent">
+    {{ regression_fails_html }}
+  </div>
 
-  <h2 id="docker-images-cves">Docker Images CVEs</h2>
-  {{ docker_images_cves_html }}
+  <div id="docker-images-cves" class="tabcontent">
+    {{ docker_images_cves_html }}
+  </div>
 
-  <h2 id="checks-known-fails">Checks Known Fails</h2>
-  <p>
-    Fail reason conventions:<br/>
-    KNOWN - Accepted fail and fix is not planned<br/>
-    INVESTIGATE - We don't know why it fails<br/>
-    NEEDSFIX - Investigation done and a fix is needed to make it pass<br/>
-  </p>
-  {{ checks_known_fails_html }}
+  <div id="checks-known-fails" class="tabcontent">
+    <p>
+      Fail reason conventions:<br/>
+      KNOWN - Accepted fail and fix is not planned<br/>
+      INVESTIGATE - We don't know why it fails<br/>
+      NEEDSFIX - Investigation done and a fix is needed to make it pass<br/>
+    </p>
+    {{ checks_known_fails_html }}
+  </div>
+
+  <script>
+    function openTab(evt, tabId) {
+      var i, tabcontent, tablinks;
+      tabcontent = document.getElementsByClassName('tabcontent');
+      for (i = 0; i < tabcontent.length; i++) {
+        tabcontent[i].classList.remove('active');
+      }
+      tablinks = document.getElementsByClassName('tablinks');
+      for (i = 0; i < tablinks.length; i++) {
+        tablinks[i].classList.remove('active');
+      }
+      document.getElementById(tabId).classList.add('active');
+      evt.currentTarget.classList.add('active');
+      if (evt.isTrusted) history.replaceState(null, '', '#' + tabId);
+    }
+    // Open the tab named in the URL hash, or fall back to CI Jobs Status
+    var hash = window.location.hash.slice(1);
+    var startTab = (hash && document.querySelector('.tab button[onclick*="' + hash + '"]'))
+      || document.querySelector('.tab button[onclick*="ci-jobs-status"]');
+    if (startTab) startTab.click();
+  </script>
 
   <script>
     document.addEventListener('click', function (e) {
diff --git a/.github/actions/create_workflow_report/create_workflow_report.py b/.github/actions/create_workflow_report/create_workflow_report.py
index 8daf0fc24f31..2aadba55febd 100755
--- a/.github/actions/create_workflow_report/create_workflow_report.py
+++ b/.github/actions/create_workflow_report/create_workflow_report.py
@@ -1,15 +1,19 @@
 #!/usr/bin/env python3
 import argparse
+import html
 import os
+import sys
 import time
 from pathlib import Path
 from itertools import combinations
 import json
 from datetime import datetime
+from datetime import timezone
 from functools import lru_cache
 from glob import glob
 import urllib.parse
 import re
+import subprocess
 
 import pandas as pd
 from jinja2 import Environment, FileSystemLoader
@@ -30,6 +34,7 @@
 
 CVE_SEVERITY_ORDER = {"critical": 1, "high": 2, "medium": 3, "low": 4, "negligible": 5}
 
+
 def _is_clickhouse_memory_limit_error(exc: BaseException) -> bool:
     if isinstance(exc, ServerException) and getattr(exc, "code", None) == 241:
         return True
@@ -169,6 +174,209 @@ def get_run_details(run_id: str) -> dict:
     return response.json()
 
 
+def _enrich_prs_in_release_merge_prs(df: pd.DataFrame, repo: str) -> pd.DataFrame:
+    if len(df) == 0:
+        return pd.DataFrame(columns=["pr_number", "pr_name", "pr_labels"])
+    if not GITHUB_TOKEN:
+        raise Exception("GITHUB_TOKEN is required to fetch PR titles and labels")
+    headers = {
+        "Authorization": f"token {GITHUB_TOKEN}",
+        "Accept": "application/vnd.github.v3+json",
+    }
+    rows = []
+    for pr_number in df["pr_number"].tolist():
+        response = requests.get(
+            f"https://api.github.com/repos/{repo}/pulls/{pr_number}",
+            headers=headers,
+        )
+        if response.status_code != 200:
+            raise Exception(
+                f"Failed to fetch pull request info: {response.status_code} {response.text}"
+            )
+        pr = response.json()
+        label_names = [l["name"] for l in pr.get("labels", [])]
+        # Escape at collection time so untrusted PR data cannot inject HTML
+        # regardless of how columns are later rendered.
+        rows.append(
+            {
+                "pr_name": html.escape(str(pr.get("title", "")), quote=True),
+                "pr_number": pr_number,
+                "pr_labels": html.escape(", ".join(sorted(label_names)), quote=True),
+            }
+        )
+    return pd.DataFrame(rows)
+
+
+def _git_rev_parse(ref: str, cwd: str | None) -> str | None:
+    p = subprocess.run(
+        ["git", "rev-parse", "--verify", ref],
+        cwd=cwd,
+        capture_output=True,
+        text=True,
+    )
+    if p.returncode != 0:
+        return None
+    return p.stdout.strip()
+
+
+def _git_is_ancestor(ancestor: str, descendant: str, cwd: str | None) -> bool:
+    p = subprocess.run(
+        ["git", "merge-base", "--is-ancestor", ancestor, descendant],
+        cwd=cwd,
+        capture_output=True,
+    )
+    return p.returncode == 0
+
+
+def _git_log_merge_prs(
+    baseline: str, branch_ref: str, cwd: str | None, repo: str
+) -> pd.DataFrame:
+    p = subprocess.run(
+        [
+            "git",
+            "-c",
+            "core.quotepath=false",
+            "log",
+            f"{baseline}..{branch_ref}",
+            "--merges",
+            "--format=%H%x09%s",
+        ],
+        cwd=cwd,
+        capture_output=True,
+        text=True,
+        check=True,
+    )
+    rows = []
+    for line in p.stdout.splitlines():
+        if not line.strip():
+            continue
+        sha, subject = line.split("\t", 1)
+        m = re.match(
+            r"Merge pull request #(\d+) from ([^/\s]+)/", subject, re.IGNORECASE
+        )
+        if not m:
+            continue
+        pr_number, head_owner = int(m.group(1)), m.group(2)
+        if head_owner.lower() != repo.split("/")[0].lower():
+            continue
+        rows.append(
+            {
+                "pr_number": pr_number,
+                "merge_commit_sha": sha,
+                "merge_subject": subject,
+            }
+        )
+    if not rows:
+        return pd.DataFrame(columns=["pr_number", "merge_commit_sha", "merge_subject"])
+    df = pd.DataFrame(rows)
+    df = df.drop_duplicates(subset=["pr_number"], keep="first")
+    return df
+
+
+def _find_release_baseline(
+    branch_ref: str, repo: str, cwd: str | None
+) -> tuple[str | None, str | None]:
+    if not GITHUB_TOKEN:
+        return None, None
+    headers = {
+        "Authorization": f"token {GITHUB_TOKEN}",
+        "Accept": "application/vnd.github.v3+json",
+    }
+    response = requests.get(
+        f"https://api.github.com/repos/{repo}/releases?per_page=100",
+        headers=headers,
+    )
+    if response.status_code != 200:
+        raise Exception(
+            f"GitHub API request failed: {response.status_code} {response.text}"
+        )
+    for rel in response.json():
+        if rel.get("draft"):
+            continue
+        tag_name = rel.get("tag_name")
+        if not tag_name:
+            continue
+        tag_sha = _git_rev_parse(tag_name, cwd)
+        if not tag_sha:
+            continue
+        if not _git_is_ancestor(tag_sha, branch_ref, cwd):
+            continue
+        return tag_name, tag_sha
+    return None, None
+
+
+def _find_rebase_baseline(branch_ref: str, cwd: str | None) -> str | None:
+    p = subprocess.run(
+        [
+            "git",
+            "log",
+            branch_ref,
+            "--reverse",
+            "-i",
+            "-E",
+            "--grep=^Rebase CICD",
+            "--grep=Merge pull request .*rebase-cicd",
+            "--grep=Merge pull request .*from Altinity/rebase/",
+            "--format=%H",
+        ],
+        cwd=cwd,
+        capture_output=True,
+        text=True,
+    )
+    if p.returncode != 0:
+        return None
+    lines = [ln for ln in p.stdout.splitlines() if ln.strip()]
+    if not lines:
+        return None
+    return lines[0]
+
+
+def get_prs_in_release_dataframe(
+    branch_ref: str = "HEAD",
+    *,
+    repo: str = GITHUB_REPO,
+    cwd: str,
+) -> pd.DataFrame:
+    f"""
+    PRs merged into branch_ref that belong in the next release notes: after the latest GitHub
+    Release tag on this history, or after the oldest rebase bootstrap if no such tag exists.
+    Only merge commits whose subject has from <repo_owner>/ (e.g. from Altinity/) are included.
+    Columns: pr_number, pr_name, labels. Omits PRs labeled cicd.
+    """
+    branch_sha = _git_rev_parse(branch_ref, cwd)
+    if not branch_sha:
+        raise Exception(f"Cannot resolve branch ref: {branch_ref!r}")
+
+    # CI often checks out with --depth=1 and --no-tags; fetch enough history and tags once.
+    subprocess.run(
+        ["git", "fetch", "--tags", "origin"],
+        cwd=cwd,
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+
+    baseline_ref, baseline_sha = _find_release_baseline(branch_ref, repo, cwd)
+    if not baseline_sha:
+        # If no release tag, try to find rebase commit 200 commits back.
+        subprocess.run(
+            ["git", "fetch", "--deepen=200", "origin", branch_ref],
+            cwd=cwd,
+            capture_output=True,
+            text=True,
+            check=False,
+        )
+        rebase_sha = _find_rebase_baseline(branch_ref, cwd)
+        if not rebase_sha:
+            raise Exception(
+                "No release tag on this branch and no rebase bootstrap merge found"
+            )
+        baseline_sha = rebase_sha
+
+    df = _git_log_merge_prs(baseline_sha, branch_ref, cwd, repo)
+    return _enrich_prs_in_release_merge_prs(df, repo)
+
+
 def _checks_latest_test_status_cte(commit_sha: str, branch_name: str) -> str:
     """
     Shared filtering for gh-data.checks: anchor time excludes stateless teardown checks
@@ -602,6 +810,19 @@ def url_to_html_link(url: str) -> str:
     return f'<a href="{url}">{text}</a>'
 
 
+def format_pr_labels_with_verification(labels: str) -> str:
+    """Format the PR labels with verification.
+
+    Expects ``labels`` to be already HTML-escaped at collection time
+    (see _enrich_prs_in_release_merge_prs).
+    """
+    labels_list = labels.split(", ")
+    if "verified" in labels_list:
+        return labels
+    else:
+        return f'<span style="font-weight: bold; color: red;">{labels} (missing verification)</span>'
+
+
 def format_test_name_for_linewrap(text: str) -> str:
     """Tweak the test name to improve line wrapping."""
     return f'<span style="line-break: anywhere;">{text}</span>'
@@ -622,25 +843,44 @@ def format_test_status(text: str) -> str:
 
 
 def format_results_as_html_table(results) -> str:
+    if not isinstance(results, pd.DataFrame):
+        return results
+
     if len(results) == 0:
         return "<p>Nothing to report</p>"
-    results.columns = [col.replace("_", " ").title() for col in results.columns]
+
+    results = results.copy()
+
+    def format_col_name(col_name: str) -> str:
+        return col_name.replace("_", " ").title().replace("Pr ", "PR ")
+
+    results.columns = [format_col_name(col) for col in results.columns]
+
+    # NOTE: to_html is called with escape=False, so any new column carrying
+    # untrusted text must either be HTML-escaped at collection time or have an
+    # explicit formatter below that escapes it.
+    formatters = {
+        "Results Link": url_to_html_link,
+        "Test Name": format_test_name_for_linewrap,
+        "Test Status": format_test_status,
+        "Job Status": format_test_status,
+        "Status": format_test_status,
+        "Message": lambda m: m.replace("\n", " "),
+        "Identifier": lambda i: url_to_html_link(
+            "https://nvd.nist.gov/vuln/detail/" + i
+        ),
+        "Severity": lambda s: (
+            f'<span data-sort="{CVE_SEVERITY_ORDER.get(str(s).lower(), 6)}">{s}</span>'
+        ),
+        "PR Number": lambda n: url_to_html_link(
+            f"https://github.com/{GITHUB_REPO}/pull/{n}"
+        ),
+        "PR Labels": format_pr_labels_with_verification,
+    }
+
     html = results.to_html(
         index=False,
-        formatters={
-            "Results Link": url_to_html_link,
-            "Test Name": format_test_name_for_linewrap,
-            "Test Status": format_test_status,
-            "Job Status": format_test_status,
-            "Status": format_test_status,
-            "Message": lambda m: m.replace("\n", " "),
-            "Identifier": lambda i: url_to_html_link(
-                "https://nvd.nist.gov/vuln/detail/" + i
-            ),
-            "Severity": lambda s: (
-                f'<span data-sort="{CVE_SEVERITY_ORDER.get(str(s).lower(), 6)}">{s}</span>'
-            ),
-        },
+        formatters=formatters,
         escape=False,
         border=0,
         classes=["test-results-table"],
@@ -816,7 +1056,8 @@ def create_workflow_report(
         settings={"use_numpy": True},
     )
 
-    fail_results = {
+    results_dfs = {
+        "prs_in_release": [],
         "job_statuses": get_commit_statuses(commit_sha),
         "checks_fails": get_checks_fails(db_client, commit_sha, branch_name),
         "checks_known_fails": [],
@@ -826,8 +1067,15 @@ def create_workflow_report(
         "docker_images_cves": [],
     }
 
+    if pr_number == 0 and not mark_preview:
+        try:
+            prs_df = get_prs_in_release_dataframe(branch_name, cwd=os.getcwd())
+            results_dfs["prs_in_release"] = prs_df
+        except Exception as e:
+            print(f"Error in get_prs_in_release_dataframe: {e}")
+
     try:
-        fail_results["docker_images_cves"] = (
+        results_dfs["docker_images_cves"] = (
             [] if not check_cves else get_cves(pr_number, commit_sha, branch_name)
         )
     except Exception as e:
@@ -835,7 +1083,7 @@ def create_workflow_report(
 
     # get_cves returns ... in the case where no Grype result files were found.
     # This might occur when run in preview mode.
-    cves_not_checked = not check_cves or fail_results["docker_images_cves"] is ...
+    cves_not_checked = not check_cves or results_dfs["docker_images_cves"] is ...
 
     if known_fails_file_path:
         if not os.path.exists(known_fails_file_path):
@@ -843,7 +1091,7 @@ def create_workflow_report(
         else:
             known_fails = get_broken_tests_rules(known_fails_file_path)
 
-            fail_results["checks_known_fails"] = get_checks_known_fails(
+            results_dfs["checks_known_fails"] = get_checks_known_fails(
                 db_client, commit_sha, branch_name, known_fails
             )
 
@@ -855,24 +1103,24 @@ def create_workflow_report(
             pr_info_html = f"""<a href="https://github.com/{GITHUB_REPO}/pull/{pr_info["number"]}">
                     #{pr_info.get("number")} ({pr_info.get("base", {}).get('ref')} <- {pr_info.get("head", {}).get('ref')})  {pr_info.get("title")}
                     </a>"""
-            fail_results["pr_new_fails"] = get_new_fails_this_pr(
+            results_dfs["pr_new_fails"] = get_new_fails_this_pr(
                 db_client,
                 pr_info,
-                fail_results["checks_fails"],
-                fail_results["regression_fails"],
+                results_dfs["checks_fails"],
+                results_dfs["regression_fails"],
             )
         except Exception as e:
             pr_info_html = e
             pr_info = {}
 
-    fail_results["job_statuses"] = backfill_skipped_statuses(
-        fail_results["job_statuses"], pr_number, branch_name, commit_sha
+    results_dfs["job_statuses"] = backfill_skipped_statuses(
+        results_dfs["job_statuses"], pr_number, branch_name, commit_sha
     )
 
     high_cve_count = 0
-    if not cves_not_checked and len(fail_results["docker_images_cves"]) > 0:
+    if not cves_not_checked and len(results_dfs["docker_images_cves"]) > 0:
         high_cve_count = (
-            fail_results["docker_images_cves"]["severity"]
+            results_dfs["docker_images_cves"]["severity"]
             .str.lower()
             .isin(("high", "critical"))
             .sum()
@@ -893,43 +1141,53 @@ def create_workflow_report(
         "workflow_id": run_id,
         "commit_sha": commit_sha,
         "base_sha": "" if pr_number == 0 else pr_info.get("base", {}).get("sha"),
-        "date": f"{datetime.utcnow().strftime('%Y-%m-%d %H:%M:%S')} UTC",
+        "date": f"{datetime.now(timezone.utc).strftime('%Y-%m-%d %H:%M:%S')} UTC",
         "is_preview": mark_preview,
         "counts": {
-            "jobs_status": f"{sum(fail_results['job_statuses']['job_status'].value_counts().get(x, 0) for x in ('failure', 'error'))} fail/error",
-            "checks_errors": len(fail_results["checks_errors"]),
-            "checks_new_fails": len(fail_results["checks_fails"]),
-            "regression_new_fails": len(fail_results["regression_fails"]),
+            "jobs_status": f"{sum(results_dfs['job_statuses']['job_status'].value_counts().get(x, 0) for x in ('failure', 'error'))} fail/error",
+            "checks_errors": len(results_dfs["checks_errors"]),
+            "checks_new_fails": len(results_dfs["checks_fails"]),
+            "regression_new_fails": len(results_dfs["regression_fails"]),
             "cves": "N/A" if cves_not_checked else f"{high_cve_count} high/critical",
             "checks_known_fails": (
-                "N/A" if not known_fails else len(fail_results["checks_known_fails"])
+                "N/A" if not known_fails else len(results_dfs["checks_known_fails"])
+            ),
+            "pr_new_fails": len(results_dfs["pr_new_fails"]),
+            "prs_in_release": (
+                "N/A"
+                if mark_preview or pr_number != 0
+                else len(results_dfs["prs_in_release"])
             ),
-            "pr_new_fails": len(fail_results["pr_new_fails"]),
         },
         "build_report_links": get_build_report_links(
-            fail_results["job_statuses"], pr_number, branch_name, commit_sha
+            results_dfs["job_statuses"], pr_number, branch_name, commit_sha
+        ),
+        "prs_in_release_html": (
+            "<p>PR details are not loaded during preview.</p>"
+            if mark_preview or pr_number != 0
+            else format_results_as_html_table(results_dfs["prs_in_release"])
         ),
         "ci_jobs_status_html": format_results_as_html_table(
-            fail_results["job_statuses"]
+            results_dfs["job_statuses"]
         ),
         "checks_errors_html": format_results_as_html_table(
-            fail_results["checks_errors"]
+            results_dfs["checks_errors"]
         ),
-        "checks_fails_html": format_results_as_html_table(fail_results["checks_fails"]),
+        "checks_fails_html": format_results_as_html_table(results_dfs["checks_fails"]),
         "regression_fails_html": format_results_as_html_table(
-            fail_results["regression_fails"]
+            results_dfs["regression_fails"]
         ),
         "docker_images_cves_html": (
             "<p>Not Checked</p>"
             if cves_not_checked
-            else format_results_as_html_table(fail_results["docker_images_cves"])
+            else format_results_as_html_table(results_dfs["docker_images_cves"])
         ),
         "checks_known_fails_html": (
             "<p>Not Checked</p>"
             if not known_fails
-            else format_results_as_html_table(fail_results["checks_known_fails"])
+            else format_results_as_html_table(results_dfs["checks_known_fails"])
         ),
-        "new_fails_html": format_results_as_html_table(fail_results["pr_new_fails"]),
+        "new_fails_html": format_results_as_html_table(results_dfs["pr_new_fails"]),
     }
 
     # Render the template with the context

From a3763582564f7b1e974d0aa422e82d350cb01ab9 Mon Sep 17 00:00:00 2001
From: strtgbb <146047128+strtgbb@users.noreply.github.com>
Date: Thu, 2 Jul 2026 11:53:06 -0400
Subject: [PATCH 05/11] Fix release report fallback baseline and initialize
 `known_fails`.

Increase history fetch from 200 to 500 to make sure tag is found. When no release tag exists, choose the latest bootstrap merge from first-parent history and match `Altinity/bump` subjects, and initialize `known_fails` to avoid an `UnboundLocalError` in report rendering.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .../create_workflow_report.py                      | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/.github/actions/create_workflow_report/create_workflow_report.py b/.github/actions/create_workflow_report/create_workflow_report.py
index 2aadba55febd..0e233288e0c7 100755
--- a/.github/actions/create_workflow_report/create_workflow_report.py
+++ b/.github/actions/create_workflow_report/create_workflow_report.py
@@ -311,12 +311,15 @@ def _find_rebase_baseline(branch_ref: str, cwd: str | None) -> str | None:
             "git",
             "log",
             branch_ref,
-            "--reverse",
+            "--first-parent",
+            "-n",
+            "1",
             "-i",
             "-E",
             "--grep=^Rebase CICD",
             "--grep=Merge pull request .*rebase-cicd",
             "--grep=Merge pull request .*from Altinity/rebase/",
+            "--grep=Merge pull request .*from Altinity/bump/",
             "--format=%H",
         ],
         cwd=cwd,
@@ -339,7 +342,7 @@ def get_prs_in_release_dataframe(
 ) -> pd.DataFrame:
     f"""
     PRs merged into branch_ref that belong in the next release notes: after the latest GitHub
-    Release tag on this history, or after the oldest rebase bootstrap if no such tag exists.
+    Release tag on this history, or after the latest bootstrap merge if no such tag exists.
     Only merge commits whose subject has from <repo_owner>/ (e.g. from Altinity/) are included.
     Columns: pr_number, pr_name, labels. Omits PRs labeled cicd.
     """
@@ -356,11 +359,11 @@ def get_prs_in_release_dataframe(
         check=False,
     )
 
-    baseline_ref, baseline_sha = _find_release_baseline(branch_ref, repo, cwd)
+    _, baseline_sha = _find_release_baseline(branch_ref, repo, cwd)
     if not baseline_sha:
-        # If no release tag, try to find rebase commit 200 commits back.
+        # If no release tag, search recent history for the latest branch bootstrap merge.
         subprocess.run(
-            ["git", "fetch", "--deepen=200", "origin", branch_ref],
+            ["git", "fetch", "--deepen=500", "origin", branch_ref],
             cwd=cwd,
             capture_output=True,
             text=True,
@@ -1066,6 +1069,7 @@ def create_workflow_report(
         "regression_fails": get_regression_fails(db_client, actions_run_url),
         "docker_images_cves": [],
     }
+    known_fails = {}
 
     if pr_number == 0 and not mark_preview:
         try:

From a3e45551724598a358b12789159f0cde4d10e9d3 Mon Sep 17 00:00:00 2001
From: strtgbb <146047128+strtgbb@users.noreply.github.com>
Date: Tue, 30 Jun 2026 15:29:31 -0400
Subject: [PATCH 06/11] Merge pull request #1989 from
 Altinity/make-sign-praktika-ant-26.3

Antalya 26.3 - Port SignRelease and SourceUpload additional jobs to praktika
---
 .github/workflows/master.yml                | 189 +++++++++++++------
 .github/workflows/nightly_keeper.yml        |   2 +
 .github/workflows/nightly_keeper_faults.yml |   2 +
 .github/workflows/pull_request.yml          |  82 ++++----
 .github/workflows/release_builds.yml        | 195 ++++++++++++++------
 .github/workflows/reusable_sign.yml         | 166 -----------------
 ci/defs/altinity_jobs.py                    |  71 +++++++
 ci/defs/defs.py                             |   8 +
 ci/jobs/sign_release.py                     |  82 ++++++++
 ci/jobs/source_upload.py                    |  60 ++++++
 ci/praktika/yaml_additional_templates.py    |  56 ------
 ci/praktika/yaml_generator.py               |   6 -
 ci/workflows/master.py                      |   6 +-
 ci/workflows/pull_request.py                |   4 +-
 ci/workflows/release_builds.py              |   6 +-
 tests/ci/sign_release.py                    |  97 ----------
 16 files changed, 553 insertions(+), 479 deletions(-)
 delete mode 100644 .github/workflows/reusable_sign.yml
 create mode 100644 ci/defs/altinity_jobs.py
 create mode 100644 ci/jobs/sign_release.py
 create mode 100644 ci/jobs/source_upload.py
 delete mode 100644 tests/ci/sign_release.py

diff --git a/.github/workflows/master.yml b/.github/workflows/master.yml
index 127be9708022..185777d7e2d7 100644
--- a/.github/workflows/master.yml
+++ b/.github/workflows/master.yml
@@ -24,6 +24,8 @@ env:
   CLICKHOUSE_TEST_STAT_PASSWORD: ${{ secrets.CLICKHOUSE_TEST_STAT_PASSWORD }}
   AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
   AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+  GPG_BINARY_SIGNING_KEY: ${{ secrets.GPG_BINARY_SIGNING_KEY }}
+  GPG_BINARY_SIGNING_PASSPHRASE: ${{ secrets.GPG_BINARY_SIGNING_PASSPHRASE }}
   AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
   CHECKS_DATABASE_HOST: ${{ secrets.CHECKS_DATABASE_HOST }}
   AZURE_STORAGE_KEY: ${{ secrets.AZURE_STORAGE_KEY }}
@@ -1225,6 +1227,132 @@ jobs:
           . ./ci/tmp/praktika_setup_env.sh
           PYTHONUNBUFFERED=1 python3 -m praktika run 'Install packages (arm_release)' --workflow "MasterCI" --ci --timestamp
 
+  sign_release_amd_release:
+    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker]
+    needs: [build_amd_release, config_workflow, dockers_build_amd, dockers_build_arm, dockers_build_multiplatform_manifest]
+    if: ${{ !cancelled() && !contains(needs.*.outputs.pipeline_status, 'failure') && !contains(needs.*.outputs.pipeline_status, 'undefined') && !contains(fromJson(needs.config_workflow.outputs.data).workflow_config.cache_success_base64, 'U2lnbiByZWxlYXNlIChhbWRfcmVsZWFzZSk=') }}
+    name: "Sign release (amd_release)"
+    outputs:
+      data: ${{ steps.run.outputs.DATA }}
+      pipeline_status: ${{ steps.run.outputs.pipeline_status || 'undefined' }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ env.CHECKOUT_REF }}
+
+      - name: Setup
+        uses: ./.github/actions/runner_setup
+      - name: Docker setup
+        uses: ./.github/actions/docker_setup
+        with:
+          test_name: "Sign release (amd_release)"
+
+      - name: Prepare env script
+        run: |
+          rm -rf ./ci/tmp
+          mkdir -p ./ci/tmp
+          cat > ./ci/tmp/praktika_setup_env.sh << 'ENV_SETUP_SCRIPT_EOF'
+          export PYTHONPATH=./ci:.:
+
+          cat > ./ci/tmp/workflow_job.json << 'EOF'
+          ${{ toJson(job) }}
+          EOF
+          cat > ./ci/tmp/workflow_status.json << 'EOF'
+          ${{ toJson(needs) }}
+          EOF
+          ENV_SETUP_SCRIPT_EOF
+
+      - name: Run
+        id: run
+        run: |
+          . ./ci/tmp/praktika_setup_env.sh
+          PYTHONUNBUFFERED=1 python3 -m praktika run 'Sign release (amd_release)' --workflow "MasterCI" --ci --timestamp
+
+  sign_release_arm_release:
+    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker-aarch64]
+    needs: [build_arm_release, config_workflow, dockers_build_amd, dockers_build_arm, dockers_build_multiplatform_manifest]
+    if: ${{ !cancelled() && !contains(needs.*.outputs.pipeline_status, 'failure') && !contains(needs.*.outputs.pipeline_status, 'undefined') && !contains(fromJson(needs.config_workflow.outputs.data).workflow_config.cache_success_base64, 'U2lnbiByZWxlYXNlIChhcm1fcmVsZWFzZSk=') }}
+    name: "Sign release (arm_release)"
+    outputs:
+      data: ${{ steps.run.outputs.DATA }}
+      pipeline_status: ${{ steps.run.outputs.pipeline_status || 'undefined' }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ env.CHECKOUT_REF }}
+
+      - name: Setup
+        uses: ./.github/actions/runner_setup
+      - name: Docker setup
+        uses: ./.github/actions/docker_setup
+        with:
+          test_name: "Sign release (arm_release)"
+
+      - name: Prepare env script
+        run: |
+          rm -rf ./ci/tmp
+          mkdir -p ./ci/tmp
+          cat > ./ci/tmp/praktika_setup_env.sh << 'ENV_SETUP_SCRIPT_EOF'
+          export PYTHONPATH=./ci:.:
+
+          cat > ./ci/tmp/workflow_job.json << 'EOF'
+          ${{ toJson(job) }}
+          EOF
+          cat > ./ci/tmp/workflow_status.json << 'EOF'
+          ${{ toJson(needs) }}
+          EOF
+          ENV_SETUP_SCRIPT_EOF
+
+      - name: Run
+        id: run
+        run: |
+          . ./ci/tmp/praktika_setup_env.sh
+          PYTHONUNBUFFERED=1 python3 -m praktika run 'Sign release (arm_release)' --workflow "MasterCI" --ci --timestamp
+
+  source_upload:
+    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker-aarch64]
+    needs: [config_workflow, dockers_build_amd, dockers_build_arm, dockers_build_multiplatform_manifest]
+    if: ${{ !cancelled() && !contains(needs.*.outputs.pipeline_status, 'failure') && !contains(needs.*.outputs.pipeline_status, 'undefined') && !contains(fromJson(needs.config_workflow.outputs.data).workflow_config.cache_success_base64, 'U291cmNlIHVwbG9hZA==') }}
+    name: "Source upload"
+    outputs:
+      data: ${{ steps.run.outputs.DATA }}
+      pipeline_status: ${{ steps.run.outputs.pipeline_status || 'undefined' }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ env.CHECKOUT_REF }}
+
+      - name: Setup
+        uses: ./.github/actions/runner_setup
+      - name: Docker setup
+        uses: ./.github/actions/docker_setup
+        with:
+          test_name: "Source upload"
+
+      - name: Prepare env script
+        run: |
+          rm -rf ./ci/tmp
+          mkdir -p ./ci/tmp
+          cat > ./ci/tmp/praktika_setup_env.sh << 'ENV_SETUP_SCRIPT_EOF'
+          export PYTHONPATH=./ci:.:
+
+          cat > ./ci/tmp/workflow_job.json << 'EOF'
+          ${{ toJson(job) }}
+          EOF
+          cat > ./ci/tmp/workflow_status.json << 'EOF'
+          ${{ toJson(needs) }}
+          EOF
+          ENV_SETUP_SCRIPT_EOF
+
+      - name: Run
+        id: run
+        run: |
+          . ./ci/tmp/praktika_setup_env.sh
+          PYTHONUNBUFFERED=1 python3 -m praktika run 'Source upload' --workflow "MasterCI" --ci --timestamp
+
   compatibility_check_amd_release:
     runs-on: [self-hosted, altinity-on-demand, altinity-style-checker]
     needs: [build_amd_release, config_workflow, dockers_build_amd, dockers_build_arm, dockers_build_multiplatform_manifest]
@@ -5385,7 +5513,7 @@ jobs:
 
   finish_workflow:
     runs-on: [self-hosted, altinity-on-demand, altinity-style-checker-aarch64]
-    needs: [ast_fuzzer_amd_debug, ast_fuzzer_amd_msan, ast_fuzzer_amd_tsan, ast_fuzzer_arm_asan_ubsan, build_amd_asan_ubsan, build_amd_binary, build_amd_debug, build_amd_llvm_coverage_per_test, build_amd_msan, build_amd_release, build_amd_tsan, build_arm_asan_ubsan, build_arm_binary, build_arm_debug, build_arm_msan, build_arm_release, build_arm_tsan, build_arm_ubsan, buzzhouse_amd_debug, buzzhouse_amd_msan, buzzhouse_amd_tsan, buzzhouse_arm_asan_ubsan, buzzhouse_experimental_serverfuzz_amd_debug, buzzhouse_experimental_serverfuzz_amd_msan, buzzhouse_experimental_serverfuzz_amd_tsan, buzzhouse_experimental_serverfuzz_arm_asan_ubsan, clickbench_amd_release, clickbench_arm_release, compatibility_check_amd_release, compatibility_check_arm_release, config_workflow, docker_keeper_image, docker_server_image, dockers_build_amd, dockers_build_arm, dockers_build_multiplatform_manifest, install_packages_amd_release, install_packages_arm_release, integration_tests_amd_asan_ubsan_db_disk_old_analyzer_1_6, integration_tests_amd_asan_ubsan_db_disk_old_analyzer_2_6, integration_tests_amd_asan_ubsan_db_disk_old_analyzer_3_6, integration_tests_amd_asan_ubsan_db_disk_old_analyzer_4_6, integration_tests_amd_asan_ubsan_db_disk_old_analyzer_5_6, integration_tests_amd_asan_ubsan_db_disk_old_analyzer_6_6, integration_tests_amd_msan_1_6, integration_tests_amd_msan_2_6, integration_tests_amd_msan_3_6, integration_tests_amd_msan_4_6, integration_tests_amd_msan_5_6, integration_tests_amd_msan_6_6, integration_tests_amd_tsan_1_6, integration_tests_amd_tsan_2_6, integration_tests_amd_tsan_3_6, integration_tests_amd_tsan_4_6, integration_tests_amd_tsan_5_6, integration_tests_amd_tsan_6_6, integration_tests_arm_binary_distributed_plan_1_4, integration_tests_arm_binary_distributed_plan_2_4, integration_tests_arm_binary_distributed_plan_3_4, integration_tests_arm_binary_distributed_plan_4_4, sqllogic_test, sqltest, stateless_tests_amd_asan_ubsan_db_disk_distributed_plan_sequential, stateless_tests_amd_asan_ubsan_distributed_plan_parallel_1_2, stateless_tests_amd_asan_ubsan_distributed_plan_parallel_2_2, stateless_tests_amd_debug_distributed_plan_s3_storage_parallel, stateless_tests_amd_debug_distributed_plan_s3_storage_sequential, stateless_tests_amd_debug_parallel, stateless_tests_amd_debug_sequential, stateless_tests_amd_llvm_coverage_per_test_per_test_coverage_1_8, stateless_tests_amd_llvm_coverage_per_test_per_test_coverage_2_8, stateless_tests_amd_llvm_coverage_per_test_per_test_coverage_3_8, stateless_tests_amd_llvm_coverage_per_test_per_test_coverage_4_8, stateless_tests_amd_llvm_coverage_per_test_per_test_coverage_5_8, stateless_tests_amd_llvm_coverage_per_test_per_test_coverage_6_8, stateless_tests_amd_llvm_coverage_per_test_per_test_coverage_7_8, stateless_tests_amd_llvm_coverage_per_test_per_test_coverage_8_8, stateless_tests_amd_msan_wasmedge_parallel_1_4, stateless_tests_amd_msan_wasmedge_parallel_2_4, stateless_tests_amd_msan_wasmedge_parallel_3_4, stateless_tests_amd_msan_wasmedge_parallel_4_4, stateless_tests_amd_msan_wasmedge_sequential_1_2, stateless_tests_amd_msan_wasmedge_sequential_2_2, stateless_tests_amd_tsan_parallel_1_2, stateless_tests_amd_tsan_parallel_2_2, stateless_tests_amd_tsan_s3_storage_parallel_1_2, stateless_tests_amd_tsan_s3_storage_parallel_2_2, stateless_tests_amd_tsan_s3_storage_sequential_1_2, stateless_tests_amd_tsan_s3_storage_sequential_2_2, stateless_tests_amd_tsan_sequential_1_2, stateless_tests_amd_tsan_sequential_2_2, stateless_tests_arm_asan_ubsan_azure_parallel, stateless_tests_arm_asan_ubsan_azure_sequential, stateless_tests_arm_binary_parallel, stateless_tests_arm_binary_sequential, stress_test_amd_asan_ubsan, stress_test_amd_debug, stress_test_amd_msan, stress_test_amd_tsan, stress_test_arm_asan_ubsan, stress_test_arm_asan_ubsan_s3, stress_test_arm_debug, stress_test_arm_msan, stress_test_arm_release, stress_test_arm_tsan, stress_test_arm_ubsan, stress_test_azure_amd_msan, stress_test_azure_amd_tsan, stress_test_experimental_serverfuzz_amd_asan_ubsan, stress_test_experimental_serverfuzz_amd_debug, stress_test_experimental_serverfuzz_amd_msan, stress_test_experimental_serverfuzz_amd_tsan, stress_test_experimental_serverfuzz_arm_asan_ubsan, stress_test_experimental_serverfuzz_arm_asan_ubsan_s3, stress_test_experimental_serverfuzz_arm_debug, stress_test_experimental_serverfuzz_arm_msan, stress_test_experimental_serverfuzz_arm_release, stress_test_experimental_serverfuzz_arm_tsan, stress_test_experimental_serverfuzz_arm_ubsan, stress_test_experimental_serverfuzz_azure_amd_msan, stress_test_experimental_serverfuzz_azure_amd_tsan, unit_tests_asan_ubsan, unit_tests_asan_ubsan_function_prop_fuzzer, unit_tests_msan, unit_tests_msan_function_prop_fuzzer, unit_tests_tsan, unit_tests_tsan_function_prop_fuzzer]
+    needs: [ast_fuzzer_amd_debug, ast_fuzzer_amd_msan, ast_fuzzer_amd_tsan, ast_fuzzer_arm_asan_ubsan, build_amd_asan_ubsan, build_amd_binary, build_amd_debug, build_amd_llvm_coverage_per_test, build_amd_msan, build_amd_release, build_amd_tsan, build_arm_asan_ubsan, build_arm_binary, build_arm_debug, build_arm_msan, build_arm_release, build_arm_tsan, build_arm_ubsan, buzzhouse_amd_debug, buzzhouse_amd_msan, buzzhouse_amd_tsan, buzzhouse_arm_asan_ubsan, buzzhouse_experimental_serverfuzz_amd_debug, buzzhouse_experimental_serverfuzz_amd_msan, buzzhouse_experimental_serverfuzz_amd_tsan, buzzhouse_experimental_serverfuzz_arm_asan_ubsan, clickbench_amd_release, clickbench_arm_release, compatibility_check_amd_release, compatibility_check_arm_release, config_workflow, docker_keeper_image, docker_server_image, dockers_build_amd, dockers_build_arm, dockers_build_multiplatform_manifest, install_packages_amd_release, install_packages_arm_release, integration_tests_amd_asan_ubsan_db_disk_old_analyzer_1_6, integration_tests_amd_asan_ubsan_db_disk_old_analyzer_2_6, integration_tests_amd_asan_ubsan_db_disk_old_analyzer_3_6, integration_tests_amd_asan_ubsan_db_disk_old_analyzer_4_6, integration_tests_amd_asan_ubsan_db_disk_old_analyzer_5_6, integration_tests_amd_asan_ubsan_db_disk_old_analyzer_6_6, integration_tests_amd_msan_1_6, integration_tests_amd_msan_2_6, integration_tests_amd_msan_3_6, integration_tests_amd_msan_4_6, integration_tests_amd_msan_5_6, integration_tests_amd_msan_6_6, integration_tests_amd_tsan_1_6, integration_tests_amd_tsan_2_6, integration_tests_amd_tsan_3_6, integration_tests_amd_tsan_4_6, integration_tests_amd_tsan_5_6, integration_tests_amd_tsan_6_6, integration_tests_arm_binary_distributed_plan_1_4, integration_tests_arm_binary_distributed_plan_2_4, integration_tests_arm_binary_distributed_plan_3_4, integration_tests_arm_binary_distributed_plan_4_4, sign_release_amd_release, sign_release_arm_release, source_upload, sqllogic_test, sqltest, stateless_tests_amd_asan_ubsan_db_disk_distributed_plan_sequential, stateless_tests_amd_asan_ubsan_distributed_plan_parallel_1_2, stateless_tests_amd_asan_ubsan_distributed_plan_parallel_2_2, stateless_tests_amd_debug_distributed_plan_s3_storage_parallel, stateless_tests_amd_debug_distributed_plan_s3_storage_sequential, stateless_tests_amd_debug_parallel, stateless_tests_amd_debug_sequential, stateless_tests_amd_llvm_coverage_per_test_per_test_coverage_1_8, stateless_tests_amd_llvm_coverage_per_test_per_test_coverage_2_8, stateless_tests_amd_llvm_coverage_per_test_per_test_coverage_3_8, stateless_tests_amd_llvm_coverage_per_test_per_test_coverage_4_8, stateless_tests_amd_llvm_coverage_per_test_per_test_coverage_5_8, stateless_tests_amd_llvm_coverage_per_test_per_test_coverage_6_8, stateless_tests_amd_llvm_coverage_per_test_per_test_coverage_7_8, stateless_tests_amd_llvm_coverage_per_test_per_test_coverage_8_8, stateless_tests_amd_msan_wasmedge_parallel_1_4, stateless_tests_amd_msan_wasmedge_parallel_2_4, stateless_tests_amd_msan_wasmedge_parallel_3_4, stateless_tests_amd_msan_wasmedge_parallel_4_4, stateless_tests_amd_msan_wasmedge_sequential_1_2, stateless_tests_amd_msan_wasmedge_sequential_2_2, stateless_tests_amd_tsan_parallel_1_2, stateless_tests_amd_tsan_parallel_2_2, stateless_tests_amd_tsan_s3_storage_parallel_1_2, stateless_tests_amd_tsan_s3_storage_parallel_2_2, stateless_tests_amd_tsan_s3_storage_sequential_1_2, stateless_tests_amd_tsan_s3_storage_sequential_2_2, stateless_tests_amd_tsan_sequential_1_2, stateless_tests_amd_tsan_sequential_2_2, stateless_tests_arm_asan_ubsan_azure_parallel, stateless_tests_arm_asan_ubsan_azure_sequential, stateless_tests_arm_binary_parallel, stateless_tests_arm_binary_sequential, stress_test_amd_asan_ubsan, stress_test_amd_debug, stress_test_amd_msan, stress_test_amd_tsan, stress_test_arm_asan_ubsan, stress_test_arm_asan_ubsan_s3, stress_test_arm_debug, stress_test_arm_msan, stress_test_arm_release, stress_test_arm_tsan, stress_test_arm_ubsan, stress_test_azure_amd_msan, stress_test_azure_amd_tsan, stress_test_experimental_serverfuzz_amd_asan_ubsan, stress_test_experimental_serverfuzz_amd_debug, stress_test_experimental_serverfuzz_amd_msan, stress_test_experimental_serverfuzz_amd_tsan, stress_test_experimental_serverfuzz_arm_asan_ubsan, stress_test_experimental_serverfuzz_arm_asan_ubsan_s3, stress_test_experimental_serverfuzz_arm_debug, stress_test_experimental_serverfuzz_arm_msan, stress_test_experimental_serverfuzz_arm_release, stress_test_experimental_serverfuzz_arm_tsan, stress_test_experimental_serverfuzz_arm_ubsan, stress_test_experimental_serverfuzz_azure_amd_msan, stress_test_experimental_serverfuzz_azure_amd_tsan, unit_tests_asan_ubsan, unit_tests_asan_ubsan_function_prop_fuzzer, unit_tests_msan, unit_tests_msan_function_prop_fuzzer, unit_tests_tsan, unit_tests_tsan_function_prop_fuzzer]
     if: ${{ always() && needs.config_workflow.outputs.pipeline_status != '' }}
     name: "Finish Workflow"
     outputs:
@@ -5476,25 +5604,6 @@ jobs:
       timeout_minutes: 210
       workflow_config: ${{ needs.config_workflow.outputs.data }}
 
-  SignRelease:
-    needs: [config_workflow, build_amd_release]
-    if: ${{ !failure() && !cancelled() }}
-    uses: ./.github/workflows/reusable_sign.yml
-    secrets: inherit
-    with:
-      test_name: Sign release
-      runner_type: altinity-style-checker
-      data: ${{ needs.config_workflow.outputs.data }}
-  SignAarch64:
-    needs: [config_workflow, build_arm_release]
-    if: ${{ !failure() && !cancelled() }}
-    uses: ./.github/workflows/reusable_sign.yml
-    secrets: inherit
-    with:
-      test_name: Sign aarch64
-      runner_type: altinity-style-checker-aarch64
-      data: ${{ needs.config_workflow.outputs.data }}
-
   FinishCIReport:
     if: ${{ !cancelled() && needs.config_workflow.outputs.pipeline_status != '' }}
     needs:
@@ -5526,6 +5635,9 @@ jobs:
       - docker_keeper_image
       - install_packages_amd_release
       - install_packages_arm_release
+      - sign_release_amd_release
+      - sign_release_arm_release
+      - source_upload
       - compatibility_check_amd_release
       - compatibility_check_arm_release
       - stateless_tests_amd_asan_ubsan_distributed_plan_parallel_1_2
@@ -5630,8 +5742,6 @@ jobs:
       - GrypeScanKeeper
       - RegressionTestsRelease
       - RegressionTestsAarch64
-      - SignRelease
-      - SignAarch64
     runs-on: [self-hosted, altinity-on-demand, altinity-style-checker-aarch64]
     steps:
       - name: Check out repository code
@@ -5644,38 +5754,3 @@ jobs:
         with:
           workflow_config: ${{ toJson(needs) }}
           final: true
-
-  SourceUpload:
-    needs: [config_workflow, build_amd_release]
-    if: ${{ !cancelled() && needs.config_workflow.outputs.pipeline_status != '' && !contains(needs.*.outputs.pipeline_status, 'failure') }}
-    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker-aarch64]
-    env:
-        COMMIT_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
-        PR_NUMBER: ${{ github.event.pull_request.number || 0 }}
-        VERSION: ${{ fromJson(needs.config_workflow.outputs.data).JOB_KV_DATA.version.string }}
-    steps:
-      - name: Check out repository code
-        uses: Altinity/checkout@19599efdf36c4f3f30eb55d5bb388896faea69f6
-        with:
-          clear-repository: true
-          ref: ${{ fromJson(needs.config_workflow.outputs.data).git_ref }}
-          submodules: true
-          fetch-depth: 0
-          filter: tree:0
-      - name: Install aws cli
-        uses: unfor19/install-aws-cli-action@v1
-        with:
-          version: 2
-          arch: arm64
-      - name: Create source tar
-        run: |
-          cd .. && tar czf $RUNNER_TEMP/build_source.src.tar.gz ClickHouse/
-      - name: Upload source tar
-        run: |
-          if [ "$PR_NUMBER" -eq 0 ]; then
-              S3_PATH="REFs/$GITHUB_REF_NAME/$COMMIT_SHA/build_amd_release"
-          else
-              S3_PATH="PRs/$PR_NUMBER/$COMMIT_SHA/build_amd_release"
-          fi
-
-          aws s3 cp $RUNNER_TEMP/build_source.src.tar.gz s3://altinity-build-artifacts/$S3_PATH/clickhouse-$VERSION.src.tar.gz
diff --git a/.github/workflows/nightly_keeper.yml b/.github/workflows/nightly_keeper.yml
index b27cf3d09bc6..128037b6477f 100644
--- a/.github/workflows/nightly_keeper.yml
+++ b/.github/workflows/nightly_keeper.yml
@@ -19,6 +19,8 @@ env:
   CLICKHOUSE_TEST_STAT_PASSWORD: ${{ secrets.CLICKHOUSE_TEST_STAT_PASSWORD }}
   AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
   AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+  GPG_BINARY_SIGNING_KEY: ${{ secrets.GPG_BINARY_SIGNING_KEY }}
+  GPG_BINARY_SIGNING_PASSPHRASE: ${{ secrets.GPG_BINARY_SIGNING_PASSPHRASE }}
   AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
   CHECKS_DATABASE_HOST: ${{ secrets.CHECKS_DATABASE_HOST }}
   AZURE_STORAGE_KEY: ${{ secrets.AZURE_STORAGE_KEY }}
diff --git a/.github/workflows/nightly_keeper_faults.yml b/.github/workflows/nightly_keeper_faults.yml
index 9afc720829dc..41744cd1b212 100644
--- a/.github/workflows/nightly_keeper_faults.yml
+++ b/.github/workflows/nightly_keeper_faults.yml
@@ -19,6 +19,8 @@ env:
   CLICKHOUSE_TEST_STAT_PASSWORD: ${{ secrets.CLICKHOUSE_TEST_STAT_PASSWORD }}
   AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
   AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+  GPG_BINARY_SIGNING_KEY: ${{ secrets.GPG_BINARY_SIGNING_KEY }}
+  GPG_BINARY_SIGNING_PASSPHRASE: ${{ secrets.GPG_BINARY_SIGNING_PASSPHRASE }}
   AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
   CHECKS_DATABASE_HOST: ${{ secrets.CHECKS_DATABASE_HOST }}
   AZURE_STORAGE_KEY: ${{ secrets.AZURE_STORAGE_KEY }}
diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml
index 3fbc76081c0b..63d376c71e14 100644
--- a/.github/workflows/pull_request.yml
+++ b/.github/workflows/pull_request.yml
@@ -26,6 +26,8 @@ env:
   CLICKHOUSE_TEST_STAT_PASSWORD: ${{ secrets.CLICKHOUSE_TEST_STAT_PASSWORD }}
   AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
   AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+  GPG_BINARY_SIGNING_KEY: ${{ secrets.GPG_BINARY_SIGNING_KEY }}
+  GPG_BINARY_SIGNING_PASSPHRASE: ${{ secrets.GPG_BINARY_SIGNING_PASSPHRASE }}
   AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
   CHECKS_DATABASE_HOST: ${{ secrets.CHECKS_DATABASE_HOST }}
   AZURE_STORAGE_KEY: ${{ secrets.AZURE_STORAGE_KEY }}
@@ -4548,9 +4550,51 @@ jobs:
           . ./ci/tmp/praktika_setup_env.sh
           PYTHONUNBUFFERED=1 python3 -m praktika run 'Build Toolchain (PGO, BOLT) (aarch64)' --workflow "PR" --ci --timestamp
 
+  source_upload:
+    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker-aarch64]
+    needs: [config_workflow, dockers_build_amd, dockers_build_arm, dockers_build_multiplatform_manifest]
+    if: ${{ !cancelled() && !contains(needs.*.outputs.pipeline_status, 'failure') && !contains(needs.*.outputs.pipeline_status, 'undefined') && !contains(fromJson(needs.config_workflow.outputs.data).workflow_config.cache_success_base64, 'U291cmNlIHVwbG9hZA==') }}
+    name: "Source upload"
+    outputs:
+      data: ${{ steps.run.outputs.DATA }}
+      pipeline_status: ${{ steps.run.outputs.pipeline_status || 'undefined' }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ env.CHECKOUT_REF }}
+
+      - name: Setup
+        uses: ./.github/actions/runner_setup
+      - name: Docker setup
+        uses: ./.github/actions/docker_setup
+        with:
+          test_name: "Source upload"
+
+      - name: Prepare env script
+        run: |
+          rm -rf ./ci/tmp
+          mkdir -p ./ci/tmp
+          cat > ./ci/tmp/praktika_setup_env.sh << 'ENV_SETUP_SCRIPT_EOF'
+          export PYTHONPATH=./ci:.:
+
+          cat > ./ci/tmp/workflow_job.json << 'EOF'
+          ${{ toJson(job) }}
+          EOF
+          cat > ./ci/tmp/workflow_status.json << 'EOF'
+          ${{ toJson(needs) }}
+          EOF
+          ENV_SETUP_SCRIPT_EOF
+
+      - name: Run
+        id: run
+        run: |
+          . ./ci/tmp/praktika_setup_env.sh
+          PYTHONUNBUFFERED=1 python3 -m praktika run 'Source upload' --workflow "PR" --ci --timestamp
+
   finish_workflow:
     runs-on: [self-hosted, altinity-on-demand, altinity-style-checker-aarch64]
-    needs: [ast_fuzzer_amd_debug, ast_fuzzer_amd_debug_targeted, ast_fuzzer_amd_debug_targeted_old_compatibility, ast_fuzzer_amd_msan, ast_fuzzer_amd_tsan, ast_fuzzer_arm_asan_ubsan, build_amd_asan_ubsan, build_amd_binary, build_amd_debug, build_amd_msan, build_amd_release, build_amd_tsan, build_arm_asan_ubsan, build_arm_binary, build_arm_debug, build_arm_msan, build_arm_release, build_arm_tidy, build_arm_tsan, build_arm_ubsan, build_toolchain_pgo_bolt_aarch64, build_toolchain_pgo_bolt_amd64, buzzhouse_amd_debug, buzzhouse_amd_msan, buzzhouse_amd_tsan, buzzhouse_arm_asan_ubsan, ci_tests, compatibility_check_amd_release, compatibility_check_arm_release, config_workflow, docker_keeper_image, docker_server_image, dockers_build_amd, dockers_build_arm, dockers_build_multiplatform_manifest, fast_test, install_packages_amd_release, install_packages_arm_release, integration_tests_amd_asan_ubsan_db_disk_old_analyzer_1_6, integration_tests_amd_asan_ubsan_db_disk_old_analyzer_2_6, integration_tests_amd_asan_ubsan_db_disk_old_analyzer_3_6, integration_tests_amd_asan_ubsan_db_disk_old_analyzer_4_6, integration_tests_amd_asan_ubsan_db_disk_old_analyzer_5_6, integration_tests_amd_asan_ubsan_db_disk_old_analyzer_6_6, integration_tests_amd_asan_ubsan_targeted, integration_tests_amd_msan_1_6, integration_tests_amd_msan_2_6, integration_tests_amd_msan_3_6, integration_tests_amd_msan_4_6, integration_tests_amd_msan_5_6, integration_tests_amd_msan_6_6, integration_tests_amd_tsan_1_6, integration_tests_amd_tsan_2_6, integration_tests_amd_tsan_3_6, integration_tests_amd_tsan_4_6, integration_tests_amd_tsan_5_6, integration_tests_amd_tsan_6_6, integration_tests_arm_binary_distributed_plan_1_4, integration_tests_arm_binary_distributed_plan_2_4, integration_tests_arm_binary_distributed_plan_3_4, integration_tests_arm_binary_distributed_plan_4_4, keeper_stress_tests_pr, quick_functional_tests, sqllogic_test, stateless_tests_amd_asan_ubsan_db_disk_distributed_plan_sequential, stateless_tests_amd_asan_ubsan_distributed_plan_parallel_1_2, stateless_tests_amd_asan_ubsan_distributed_plan_parallel_2_2, stateless_tests_amd_debug_distributed_plan_s3_storage_parallel, stateless_tests_amd_debug_distributed_plan_s3_storage_sequential, stateless_tests_amd_debug_parallel, stateless_tests_amd_debug_sequential, stateless_tests_amd_msan_wasmedge_parallel_1_4, stateless_tests_amd_msan_wasmedge_parallel_2_4, stateless_tests_amd_msan_wasmedge_parallel_3_4, stateless_tests_amd_msan_wasmedge_parallel_4_4, stateless_tests_amd_msan_wasmedge_sequential_1_2, stateless_tests_amd_msan_wasmedge_sequential_2_2, stateless_tests_amd_tsan_parallel_1_2, stateless_tests_amd_tsan_parallel_2_2, stateless_tests_amd_tsan_s3_storage_parallel_1_2, stateless_tests_amd_tsan_s3_storage_parallel_2_2, stateless_tests_amd_tsan_s3_storage_sequential_1_2, stateless_tests_amd_tsan_s3_storage_sequential_2_2, stateless_tests_amd_tsan_sequential_1_2, stateless_tests_amd_tsan_sequential_2_2, stateless_tests_arm_asan_ubsan_azure_parallel, stateless_tests_arm_asan_ubsan_azure_sequential, stateless_tests_arm_asan_ubsan_targeted, stateless_tests_arm_binary_parallel, stateless_tests_arm_binary_sequential, stress_test_amd_asan_ubsan, stress_test_amd_debug, stress_test_amd_msan, stress_test_amd_tsan, stress_test_arm_asan_ubsan, stress_test_arm_asan_ubsan_s3, stress_test_arm_debug, stress_test_arm_msan, stress_test_arm_release, stress_test_arm_tsan, stress_test_arm_ubsan, unit_tests_asan_ubsan, unit_tests_asan_ubsan_function_prop_fuzzer, unit_tests_msan, unit_tests_msan_function_prop_fuzzer, unit_tests_tsan, unit_tests_tsan_function_prop_fuzzer]
+    needs: [ast_fuzzer_amd_debug, ast_fuzzer_amd_debug_targeted, ast_fuzzer_amd_debug_targeted_old_compatibility, ast_fuzzer_amd_msan, ast_fuzzer_amd_tsan, ast_fuzzer_arm_asan_ubsan, build_amd_asan_ubsan, build_amd_binary, build_amd_debug, build_amd_msan, build_amd_release, build_amd_tsan, build_arm_asan_ubsan, build_arm_binary, build_arm_debug, build_arm_msan, build_arm_release, build_arm_tidy, build_arm_tsan, build_arm_ubsan, build_toolchain_pgo_bolt_aarch64, build_toolchain_pgo_bolt_amd64, buzzhouse_amd_debug, buzzhouse_amd_msan, buzzhouse_amd_tsan, buzzhouse_arm_asan_ubsan, ci_tests, compatibility_check_amd_release, compatibility_check_arm_release, config_workflow, docker_keeper_image, docker_server_image, dockers_build_amd, dockers_build_arm, dockers_build_multiplatform_manifest, fast_test, install_packages_amd_release, install_packages_arm_release, integration_tests_amd_asan_ubsan_db_disk_old_analyzer_1_6, integration_tests_amd_asan_ubsan_db_disk_old_analyzer_2_6, integration_tests_amd_asan_ubsan_db_disk_old_analyzer_3_6, integration_tests_amd_asan_ubsan_db_disk_old_analyzer_4_6, integration_tests_amd_asan_ubsan_db_disk_old_analyzer_5_6, integration_tests_amd_asan_ubsan_db_disk_old_analyzer_6_6, integration_tests_amd_asan_ubsan_targeted, integration_tests_amd_msan_1_6, integration_tests_amd_msan_2_6, integration_tests_amd_msan_3_6, integration_tests_amd_msan_4_6, integration_tests_amd_msan_5_6, integration_tests_amd_msan_6_6, integration_tests_amd_tsan_1_6, integration_tests_amd_tsan_2_6, integration_tests_amd_tsan_3_6, integration_tests_amd_tsan_4_6, integration_tests_amd_tsan_5_6, integration_tests_amd_tsan_6_6, integration_tests_arm_binary_distributed_plan_1_4, integration_tests_arm_binary_distributed_plan_2_4, integration_tests_arm_binary_distributed_plan_3_4, integration_tests_arm_binary_distributed_plan_4_4, keeper_stress_tests_pr, quick_functional_tests, source_upload, sqllogic_test, stateless_tests_amd_asan_ubsan_db_disk_distributed_plan_sequential, stateless_tests_amd_asan_ubsan_distributed_plan_parallel_1_2, stateless_tests_amd_asan_ubsan_distributed_plan_parallel_2_2, stateless_tests_amd_debug_distributed_plan_s3_storage_parallel, stateless_tests_amd_debug_distributed_plan_s3_storage_sequential, stateless_tests_amd_debug_parallel, stateless_tests_amd_debug_sequential, stateless_tests_amd_msan_wasmedge_parallel_1_4, stateless_tests_amd_msan_wasmedge_parallel_2_4, stateless_tests_amd_msan_wasmedge_parallel_3_4, stateless_tests_amd_msan_wasmedge_parallel_4_4, stateless_tests_amd_msan_wasmedge_sequential_1_2, stateless_tests_amd_msan_wasmedge_sequential_2_2, stateless_tests_amd_tsan_parallel_1_2, stateless_tests_amd_tsan_parallel_2_2, stateless_tests_amd_tsan_s3_storage_parallel_1_2, stateless_tests_amd_tsan_s3_storage_parallel_2_2, stateless_tests_amd_tsan_s3_storage_sequential_1_2, stateless_tests_amd_tsan_s3_storage_sequential_2_2, stateless_tests_amd_tsan_sequential_1_2, stateless_tests_amd_tsan_sequential_2_2, stateless_tests_arm_asan_ubsan_azure_parallel, stateless_tests_arm_asan_ubsan_azure_sequential, stateless_tests_arm_asan_ubsan_targeted, stateless_tests_arm_binary_parallel, stateless_tests_arm_binary_sequential, stress_test_amd_asan_ubsan, stress_test_amd_debug, stress_test_amd_msan, stress_test_amd_tsan, stress_test_arm_asan_ubsan, stress_test_arm_asan_ubsan_s3, stress_test_arm_debug, stress_test_arm_msan, stress_test_arm_release, stress_test_arm_tsan, stress_test_arm_ubsan, unit_tests_asan_ubsan, unit_tests_asan_ubsan_function_prop_fuzzer, unit_tests_msan, unit_tests_msan_function_prop_fuzzer, unit_tests_tsan, unit_tests_tsan_function_prop_fuzzer]
     if: ${{ always() && needs.config_workflow.outputs.pipeline_status != '' }}
     name: "Finish Workflow"
     outputs:
@@ -4751,6 +4795,7 @@ jobs:
       - keeper_stress_tests_pr
       - build_toolchain_pgo_bolt_amd64
       - build_toolchain_pgo_bolt_aarch64
+      - source_upload
       - finish_workflow
       - GrypeScanServer
       - GrypeScanKeeper
@@ -4768,38 +4813,3 @@ jobs:
         with:
           workflow_config: ${{ toJson(needs) }}
           final: true
-
-  SourceUpload:
-    needs: [config_workflow, build_amd_release]
-    if: ${{ !cancelled() && needs.config_workflow.outputs.pipeline_status != '' && !contains(needs.*.outputs.pipeline_status, 'failure') }}
-    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker-aarch64]
-    env:
-        COMMIT_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
-        PR_NUMBER: ${{ github.event.pull_request.number || 0 }}
-        VERSION: ${{ fromJson(needs.config_workflow.outputs.data).JOB_KV_DATA.version.string }}
-    steps:
-      - name: Check out repository code
-        uses: Altinity/checkout@19599efdf36c4f3f30eb55d5bb388896faea69f6
-        with:
-          clear-repository: true
-          ref: ${{ fromJson(needs.config_workflow.outputs.data).git_ref }}
-          submodules: true
-          fetch-depth: 0
-          filter: tree:0
-      - name: Install aws cli
-        uses: unfor19/install-aws-cli-action@v1
-        with:
-          version: 2
-          arch: arm64
-      - name: Create source tar
-        run: |
-          cd .. && tar czf $RUNNER_TEMP/build_source.src.tar.gz ClickHouse/
-      - name: Upload source tar
-        run: |
-          if [ "$PR_NUMBER" -eq 0 ]; then
-              S3_PATH="REFs/$GITHUB_REF_NAME/$COMMIT_SHA/build_amd_release"
-          else
-              S3_PATH="PRs/$PR_NUMBER/$COMMIT_SHA/build_amd_release"
-          fi
-
-          aws s3 cp $RUNNER_TEMP/build_source.src.tar.gz s3://altinity-build-artifacts/$S3_PATH/clickhouse-$VERSION.src.tar.gz
diff --git a/.github/workflows/release_builds.yml b/.github/workflows/release_builds.yml
index 40f5b6dea27a..bc730a915a71 100644
--- a/.github/workflows/release_builds.yml
+++ b/.github/workflows/release_builds.yml
@@ -15,6 +15,8 @@ env:
   CLICKHOUSE_TEST_STAT_PASSWORD: ${{ secrets.CLICKHOUSE_TEST_STAT_PASSWORD }}
   AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
   AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+  GPG_BINARY_SIGNING_KEY: ${{ secrets.GPG_BINARY_SIGNING_KEY }}
+  GPG_BINARY_SIGNING_PASSPHRASE: ${{ secrets.GPG_BINARY_SIGNING_PASSPHRASE }}
   AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
   CHECKS_DATABASE_HOST: ${{ secrets.CHECKS_DATABASE_HOST }}
   AZURE_STORAGE_KEY: ${{ secrets.AZURE_STORAGE_KEY }}
@@ -964,6 +966,138 @@ jobs:
           . ./ci/tmp/praktika_setup_env.sh
           PYTHONUNBUFFERED=1 python3 -m praktika run 'Install packages (arm_release)' --workflow "Release Builds" --ci --timestamp
 
+  sign_release_amd_release:
+    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker]
+    needs: [build_amd_release, config_workflow, dockers_build_amd, dockers_build_arm, dockers_build_multiplatform_manifest]
+    if: ${{ !cancelled() && !contains(needs.*.outputs.pipeline_status, 'failure') && !contains(needs.*.outputs.pipeline_status, 'undefined') && !contains(fromJson(needs.config_workflow.outputs.data).workflow_config.cache_success_base64, 'U2lnbiByZWxlYXNlIChhbWRfcmVsZWFzZSk=') }}
+    name: "Sign release (amd_release)"
+    outputs:
+      data: ${{ steps.run.outputs.DATA }}
+      pipeline_status: ${{ steps.run.outputs.pipeline_status || 'undefined' }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ env.CHECKOUT_REF }}
+
+      - name: Setup
+        uses: ./.github/actions/runner_setup
+      - name: Docker setup
+        uses: ./.github/actions/docker_setup
+        with:
+          test_name: "Sign release (amd_release)"
+
+      - name: Prepare env script
+        run: |
+          rm -rf ./ci/tmp
+          mkdir -p ./ci/tmp
+          cat > ./ci/tmp/praktika_setup_env.sh << 'ENV_SETUP_SCRIPT_EOF'
+          export PYTHONPATH=./ci:.:
+          cat > ./ci/tmp/workflow_inputs.json << 'EOF'
+          ${{ toJson(github.event.inputs) }}
+          EOF
+          cat > ./ci/tmp/workflow_job.json << 'EOF'
+          ${{ toJson(job) }}
+          EOF
+          cat > ./ci/tmp/workflow_status.json << 'EOF'
+          ${{ toJson(needs) }}
+          EOF
+          ENV_SETUP_SCRIPT_EOF
+
+      - name: Run
+        id: run
+        run: |
+          . ./ci/tmp/praktika_setup_env.sh
+          PYTHONUNBUFFERED=1 python3 -m praktika run 'Sign release (amd_release)' --workflow "Release Builds" --ci --timestamp
+
+  sign_release_arm_release:
+    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker-aarch64]
+    needs: [build_arm_release, config_workflow, dockers_build_amd, dockers_build_arm, dockers_build_multiplatform_manifest]
+    if: ${{ !cancelled() && !contains(needs.*.outputs.pipeline_status, 'failure') && !contains(needs.*.outputs.pipeline_status, 'undefined') && !contains(fromJson(needs.config_workflow.outputs.data).workflow_config.cache_success_base64, 'U2lnbiByZWxlYXNlIChhcm1fcmVsZWFzZSk=') }}
+    name: "Sign release (arm_release)"
+    outputs:
+      data: ${{ steps.run.outputs.DATA }}
+      pipeline_status: ${{ steps.run.outputs.pipeline_status || 'undefined' }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ env.CHECKOUT_REF }}
+
+      - name: Setup
+        uses: ./.github/actions/runner_setup
+      - name: Docker setup
+        uses: ./.github/actions/docker_setup
+        with:
+          test_name: "Sign release (arm_release)"
+
+      - name: Prepare env script
+        run: |
+          rm -rf ./ci/tmp
+          mkdir -p ./ci/tmp
+          cat > ./ci/tmp/praktika_setup_env.sh << 'ENV_SETUP_SCRIPT_EOF'
+          export PYTHONPATH=./ci:.:
+          cat > ./ci/tmp/workflow_inputs.json << 'EOF'
+          ${{ toJson(github.event.inputs) }}
+          EOF
+          cat > ./ci/tmp/workflow_job.json << 'EOF'
+          ${{ toJson(job) }}
+          EOF
+          cat > ./ci/tmp/workflow_status.json << 'EOF'
+          ${{ toJson(needs) }}
+          EOF
+          ENV_SETUP_SCRIPT_EOF
+
+      - name: Run
+        id: run
+        run: |
+          . ./ci/tmp/praktika_setup_env.sh
+          PYTHONUNBUFFERED=1 python3 -m praktika run 'Sign release (arm_release)' --workflow "Release Builds" --ci --timestamp
+
+  source_upload:
+    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker-aarch64]
+    needs: [config_workflow, dockers_build_amd, dockers_build_arm, dockers_build_multiplatform_manifest]
+    if: ${{ !cancelled() && !contains(needs.*.outputs.pipeline_status, 'failure') && !contains(needs.*.outputs.pipeline_status, 'undefined') && !contains(fromJson(needs.config_workflow.outputs.data).workflow_config.cache_success_base64, 'U291cmNlIHVwbG9hZA==') }}
+    name: "Source upload"
+    outputs:
+      data: ${{ steps.run.outputs.DATA }}
+      pipeline_status: ${{ steps.run.outputs.pipeline_status || 'undefined' }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ env.CHECKOUT_REF }}
+
+      - name: Setup
+        uses: ./.github/actions/runner_setup
+      - name: Docker setup
+        uses: ./.github/actions/docker_setup
+        with:
+          test_name: "Source upload"
+
+      - name: Prepare env script
+        run: |
+          rm -rf ./ci/tmp
+          mkdir -p ./ci/tmp
+          cat > ./ci/tmp/praktika_setup_env.sh << 'ENV_SETUP_SCRIPT_EOF'
+          export PYTHONPATH=./ci:.:
+          cat > ./ci/tmp/workflow_inputs.json << 'EOF'
+          ${{ toJson(github.event.inputs) }}
+          EOF
+          cat > ./ci/tmp/workflow_job.json << 'EOF'
+          ${{ toJson(job) }}
+          EOF
+          cat > ./ci/tmp/workflow_status.json << 'EOF'
+          ${{ toJson(needs) }}
+          EOF
+          ENV_SETUP_SCRIPT_EOF
+
+      - name: Run
+        id: run
+        run: |
+          . ./ci/tmp/praktika_setup_env.sh
+          PYTHONUNBUFFERED=1 python3 -m praktika run 'Source upload' --workflow "Release Builds" --ci --timestamp
+
   stateless_tests_arm_binary_parallel:
     runs-on: [self-hosted, altinity-on-demand, altinity-func-tester-aarch64]
     needs: [build_arm_binary, config_workflow, dockers_build_amd, dockers_build_arm, dockers_build_multiplatform_manifest]
@@ -1054,7 +1188,7 @@ jobs:
 
   finish_workflow:
     runs-on: [self-hosted, altinity-on-demand, altinity-style-checker-aarch64]
-    needs: [build_amd_asan_ubsan, build_amd_binary, build_amd_debug, build_amd_msan, build_amd_release, build_amd_tsan, build_arm_asan_ubsan, build_arm_binary, build_arm_debug, build_arm_msan, build_arm_release, build_arm_tsan, build_arm_ubsan, config_workflow, docker_keeper_image, docker_server_image, dockers_build_amd, dockers_build_arm, dockers_build_multiplatform_manifest, install_packages_amd_release, install_packages_arm_release, stateless_tests_arm_binary_parallel, stateless_tests_arm_binary_sequential]
+    needs: [build_amd_asan_ubsan, build_amd_binary, build_amd_debug, build_amd_msan, build_amd_release, build_amd_tsan, build_arm_asan_ubsan, build_arm_binary, build_arm_debug, build_arm_msan, build_arm_release, build_arm_tsan, build_arm_ubsan, config_workflow, docker_keeper_image, docker_server_image, dockers_build_amd, dockers_build_arm, dockers_build_multiplatform_manifest, install_packages_amd_release, install_packages_arm_release, sign_release_amd_release, sign_release_arm_release, source_upload, stateless_tests_arm_binary_parallel, stateless_tests_arm_binary_sequential]
     if: ${{ always() && needs.config_workflow.outputs.pipeline_status != '' }}
     name: "Finish Workflow"
     outputs:
@@ -1122,25 +1256,6 @@ jobs:
         docker_image: altinityinfra/clickhouse-keeper
         version: ${{ fromJson(needs.config_workflow.outputs.data).JOB_KV_DATA.version.string }}
 
-  SignRelease:
-    needs: [config_workflow, build_amd_release]
-    if: ${{ !failure() && !cancelled() }}
-    uses: ./.github/workflows/reusable_sign.yml
-    secrets: inherit
-    with:
-      test_name: Sign release
-      runner_type: altinity-style-checker
-      data: ${{ needs.config_workflow.outputs.data }}
-  SignAarch64:
-    needs: [config_workflow, build_arm_release]
-    if: ${{ !failure() && !cancelled() }}
-    uses: ./.github/workflows/reusable_sign.yml
-    secrets: inherit
-    with:
-      test_name: Sign aarch64
-      runner_type: altinity-style-checker-aarch64
-      data: ${{ needs.config_workflow.outputs.data }}
-
   FinishCIReport:
     if: ${{ !cancelled() && needs.config_workflow.outputs.pipeline_status != '' }}
     needs:
@@ -1165,13 +1280,14 @@ jobs:
       - docker_keeper_image
       - install_packages_amd_release
       - install_packages_arm_release
+      - sign_release_amd_release
+      - sign_release_arm_release
+      - source_upload
       - stateless_tests_arm_binary_parallel
       - stateless_tests_arm_binary_sequential
       - finish_workflow
       - GrypeScanServer
       - GrypeScanKeeper
-      - SignRelease
-      - SignAarch64
     runs-on: [self-hosted, altinity-on-demand, altinity-style-checker-aarch64]
     steps:
       - name: Check out repository code
@@ -1184,38 +1300,3 @@ jobs:
         with:
           workflow_config: ${{ toJson(needs) }}
           final: true
-
-  SourceUpload:
-    needs: [config_workflow, build_amd_release]
-    if: ${{ !cancelled() && needs.config_workflow.outputs.pipeline_status != '' && !contains(needs.*.outputs.pipeline_status, 'failure') }}
-    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker-aarch64]
-    env:
-        COMMIT_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
-        PR_NUMBER: ${{ github.event.pull_request.number || 0 }}
-        VERSION: ${{ fromJson(needs.config_workflow.outputs.data).JOB_KV_DATA.version.string }}
-    steps:
-      - name: Check out repository code
-        uses: Altinity/checkout@19599efdf36c4f3f30eb55d5bb388896faea69f6
-        with:
-          clear-repository: true
-          ref: ${{ fromJson(needs.config_workflow.outputs.data).git_ref }}
-          submodules: true
-          fetch-depth: 0
-          filter: tree:0
-      - name: Install aws cli
-        uses: unfor19/install-aws-cli-action@v1
-        with:
-          version: 2
-          arch: arm64
-      - name: Create source tar
-        run: |
-          cd .. && tar czf $RUNNER_TEMP/build_source.src.tar.gz ClickHouse/
-      - name: Upload source tar
-        run: |
-          if [ "$PR_NUMBER" -eq 0 ]; then
-              S3_PATH="REFs/$GITHUB_REF_NAME/$COMMIT_SHA/build_amd_release"
-          else
-              S3_PATH="PRs/$PR_NUMBER/$COMMIT_SHA/build_amd_release"
-          fi
-
-          aws s3 cp $RUNNER_TEMP/build_source.src.tar.gz s3://altinity-build-artifacts/$S3_PATH/clickhouse-$VERSION.src.tar.gz
diff --git a/.github/workflows/reusable_sign.yml b/.github/workflows/reusable_sign.yml
deleted file mode 100644
index 7bfed2758359..000000000000
--- a/.github/workflows/reusable_sign.yml
+++ /dev/null
@@ -1,166 +0,0 @@
-name: Sigining workflow
-'on':
-  workflow_call:
-    inputs:
-      test_name:
-        description: the value of test type from tests/ci/ci_config.py, ends up as $CHECK_NAME ENV
-        required: true
-        type: string
-      runner_type:
-        description: the label of runner to use
-        required: true
-        type: string
-      run_command:
-        description: the command to launch the check
-        default: ""
-        required: false
-        type: string
-      checkout_depth:
-        description: the value of the git shallow checkout
-        required: false
-        type: number
-        default: 1
-      submodules:
-        description: if the submodules should be checked out
-        required: false
-        type: boolean
-        default: false
-      additional_envs:
-        description: additional ENV variables to setup the job
-        type: string
-      data:
-        description: ci data
-        type: string
-        required: true
-      working-directory:
-        description: sets custom working directory
-        type: string
-        default: "$GITHUB_WORKSPACE/tests/ci"
-    secrets:
-      secret_envs:
-        description: if given, it's passed to the environments
-        required: false
-      AWS_SECRET_ACCESS_KEY:
-        description: the access key to the aws param store.
-        required: true
-      AWS_ACCESS_KEY_ID:
-        description: the access key id to the aws param store.
-        required: true
-      GPG_BINARY_SIGNING_KEY:
-        description: gpg signing key for packages.
-        required: true
-      GPG_BINARY_SIGNING_PASSPHRASE:
-        description: gpg signing key passphrase.
-        required: true
-
-env:
-  # Force the stdout and stderr streams to be unbuffered
-  PYTHONUNBUFFERED: 1
-  CHECK_NAME: ${{inputs.test_name}}
-  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-  AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
-  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-  CLICKHOUSE_TEST_STAT_LOGIN: ${{ secrets.CLICKHOUSE_TEST_STAT_LOGIN }}
-  CLICKHOUSE_TEST_STAT_PASSWORD: ${{ secrets.CLICKHOUSE_TEST_STAT_PASSWORD }}
-  CLICKHOUSE_TEST_STAT_URL: ${{ secrets.CLICKHOUSE_TEST_STAT_URL }}
-  DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
-  ROBOT_TOKEN: ${{ secrets.ROBOT_TOKEN }}
-
-jobs:
-  runner_labels_setup:
-    name: Compute proper runner labels for the rest of the jobs
-    runs-on: ubuntu-latest
-    outputs:
-      runner_labels: ${{ steps.setVariables.outputs.runner_labels }}
-    steps:
-      - id: setVariables
-        name: Prepare runner_labels variables for the later steps
-        run: |
-
-          # Prepend self-hosted
-          input="self-hosted, altinity-on-demand, ${input}"
-
-          # Remove all whitespace
-          input="$(echo ${input} | tr -d [:space:])"
-          # Make something like a JSON array from comma-separated list
-          input="[ '${input//\,/\'\, \'}' ]"
-
-          echo "runner_labels=$input" >> ${GITHUB_OUTPUT}
-        env:
-          input: ${{ inputs.runner_type }}
-
-  Test:
-    needs: [runner_labels_setup]
-    runs-on: ${{ fromJson(needs.runner_labels_setup.outputs.runner_labels) }}
-    name: ${{inputs.test_name}}${{ fromJson(inputs.data).jobs_data.jobs_params[inputs.test_name].num_batches > 1 && format('-{0}',matrix.batch) || '' }}
-    env:
-      GITHUB_JOB_OVERRIDDEN: ${{inputs.test_name}}${{ fromJson(inputs.data).jobs_data.jobs_params[inputs.test_name].num_batches > 1 && format('-{0}',matrix.batch) || '' }}
-    strategy:
-      fail-fast: false  # we always wait for entire matrix
-      matrix:
-        batch: ${{ fromJson(inputs.data).jobs_data.jobs_params[inputs.test_name].batches }}
-    steps:
-      - name: Check out repository code
-        uses: Altinity/checkout@19599efdf36c4f3f30eb55d5bb388896faea69f6
-        with:
-          clear-repository: true
-          ref: ${{ fromJson(inputs.data).git_ref }}
-          submodules: ${{inputs.submodules}}
-          fetch-depth: ${{inputs.checkout_depth}}
-          filter: tree:0
-      - name: Set build envs
-        run: |
-          cat >> "$GITHUB_ENV" << 'EOF'
-          CHECK_NAME=${{ inputs.test_name }}
-          ${{inputs.additional_envs}}
-          ${{secrets.secret_envs}}
-          DOCKER_TAG<<DOCKER_JSON
-          ${{ toJson(fromJson(inputs.data).docker_data.images) }}
-          TEMP_PATH=${{runner.temp}}/signed
-          REPORTS_PATH=${{runner.temp}}/reports_dir
-          DOCKER_JSON
-          EOF
-      - name: Common setup
-        uses: ./.github/actions/common_setup
-        with:
-          job_type: test
-      - name: Docker setup
-        uses: ./.github/actions/docker_setup
-      - name: Setup batch
-        if: ${{ fromJson(inputs.data).jobs_data.jobs_params[inputs.test_name].num_batches > 1 }}
-        run: |
-          cat >> "$GITHUB_ENV" << 'EOF'
-          RUN_BY_HASH_NUM=${{matrix.batch}}
-          RUN_BY_HASH_TOTAL=${{ fromJson(inputs.data).jobs_data.jobs_params[inputs.test_name].num_batches }}
-          EOF
-      - name: Pre run
-        run: |
-          python3 "$GITHUB_WORKSPACE/tests/ci/ci.py" --infile ${{ toJson(inputs.data) }} --pre --job-name '${{inputs.test_name}}'
-      - name: Sign release
-        env:
-          GPG_BINARY_SIGNING_KEY: ${{ secrets.GPG_BINARY_SIGNING_KEY }}
-          GPG_BINARY_SIGNING_PASSPHRASE: ${{ secrets.GPG_BINARY_SIGNING_PASSPHRASE }}
-        run: |
-          cd "${{ inputs.working-directory }}"
-          python3 "$GITHUB_WORKSPACE/tests/ci/ci.py" \
-            --infile ${{ toJson(inputs.data) }} \
-            --job-name '${{inputs.test_name}}' \
-            --run \
-            --force \
-            --run-command '''python3 sign_release.py'''
-      - name: Post run
-        if: ${{ !cancelled() }}
-        run: |
-          python3 "$GITHUB_WORKSPACE/tests/ci/ci.py" --infile ${{ toJson(inputs.data) }} --post --job-name '${{inputs.test_name}}'
-      - name: Mark as done
-        if: ${{ !cancelled() }}
-        run: |
-          python3 "$GITHUB_WORKSPACE/tests/ci/ci.py" --infile ${{ toJson(inputs.data) }} --mark-success --job-name '${{inputs.test_name}}' --batch ${{matrix.batch}}
-      - name: Upload signed hashes
-        uses: actions/upload-artifact@v4
-        with:
-          name: ${{inputs.test_name}} signed-hashes
-          path: ${{ env.TEMP_PATH }}/*.gpg
-      - name: Clean
-        if: always()
-        uses: ./.github/actions/clean
diff --git a/ci/defs/altinity_jobs.py b/ci/defs/altinity_jobs.py
new file mode 100644
index 000000000000..84ae688b157d
--- /dev/null
+++ b/ci/defs/altinity_jobs.py
@@ -0,0 +1,71 @@
+from praktika import Artifact, Job
+
+from ci.defs.defs import TEMP_DIR, ArtifactNames, RunnerLabels
+
+
+class AltinityArtifactNames:
+    SIGNED_AMD_RELEASE = "SIGNED_AMD_RELEASE"
+    SIGNED_ARM_RELEASE = "SIGNED_ARM_RELEASE"
+
+
+class AltinityArtifactConfigs:
+    signed_hashes = Artifact.Config(
+        name="*",
+        type=Artifact.Type.S3,
+        path=f"{TEMP_DIR}/*.gpg",
+    ).parametrize(
+        names=[
+            AltinityArtifactNames.SIGNED_AMD_RELEASE,
+            AltinityArtifactNames.SIGNED_ARM_RELEASE,
+        ]
+    )
+
+
+class AltinityJobNames:
+    SIGN_RELEASE = "Sign release"
+    SOURCE_UPLOAD = "Source upload"
+
+
+class AltinityJobConfigs:
+    sign_release_jobs = Job.Config(
+        name=AltinityJobNames.SIGN_RELEASE,
+        runs_on=[],  # from parametrize()
+        command="python3 ./ci/jobs/sign_release.py",
+        digest_config=Job.CacheDigestConfig(
+            include_paths=[
+                "./ci/jobs/sign_release.py",
+            ],
+        ),
+        timeout=900,
+    ).parametrize(
+        Job.ParamSet(
+            parameter="amd_release",
+            runs_on=RunnerLabels.STYLE_CHECK_AMD,
+            requires=[
+                ArtifactNames.DEB_AMD_RELEASE,
+                ArtifactNames.RPM_AMD_RELEASE,
+                ArtifactNames.TGZ_AMD_RELEASE,
+                ArtifactNames.CH_AMD_RELEASE,
+            ],
+            provides=[AltinityArtifactNames.SIGNED_AMD_RELEASE],
+        ),
+        Job.ParamSet(
+            parameter="arm_release",
+            runs_on=RunnerLabels.STYLE_CHECK_ARM,
+            requires=[
+                ArtifactNames.DEB_ARM_RELEASE,
+                ArtifactNames.RPM_ARM_RELEASE,
+                ArtifactNames.TGZ_ARM_RELEASE,
+                ArtifactNames.CH_ARM_RELEASE,
+            ],
+            provides=[AltinityArtifactNames.SIGNED_ARM_RELEASE],
+        ),
+    )
+    # No digest_config: the job tars the whole source tree, which changes every
+    # commit, so it must never be skipped by the content-addressed CI cache.
+    source_upload_job = Job.Config(
+        name=AltinityJobNames.SOURCE_UPLOAD,
+        runs_on=RunnerLabels.STYLE_CHECK_ARM,
+        command="python3 ./ci/jobs/source_upload.py",
+        timeout=3600,
+    )
diff --git a/ci/defs/defs.py b/ci/defs/defs.py
index fc7d41b7609d..21f5eefa0354 100644
--- a/ci/defs/defs.py
+++ b/ci/defs/defs.py
@@ -99,6 +99,14 @@ class CIFiles:
         name="AWS_SECRET_ACCESS_KEY",
         type=Secret.Type.GH_SECRET,
     ),
+    Secret.Config(
+        name="GPG_BINARY_SIGNING_KEY",
+        type=Secret.Type.GH_SECRET,
+    ),
+    Secret.Config(
+        name="GPG_BINARY_SIGNING_PASSPHRASE",
+        type=Secret.Type.GH_SECRET,
+    ),
 ]
 
 DOCKERS = [
diff --git a/ci/jobs/sign_release.py b/ci/jobs/sign_release.py
new file mode 100644
index 000000000000..f7ab465e9c97
--- /dev/null
+++ b/ci/jobs/sign_release.py
@@ -0,0 +1,82 @@
+#!/usr/bin/env python3
+import hashlib
+import os
+from pathlib import Path
+
+from ci.praktika.result import Result
+from ci.praktika.utils import Shell, Utils
+
+TEMP_PATH = Path(f"{Utils.cwd()}/ci/tmp")
+
+GPG_BINARY_SIGNING_KEY = os.getenv("GPG_BINARY_SIGNING_KEY")
+GPG_BINARY_SIGNING_PASSPHRASE = os.getenv("GPG_BINARY_SIGNING_PASSPHRASE")
+
+# Release package artifacts (downloaded via job `requires`) and the
+# self-extracting binary are the inputs to sign.
+PACKAGE_SUFFIXES = (".deb", ".rpm", ".tgz")
+BINARY_NAMES = ("clickhouse",)
+
+
+def hash_file(file_path: Path) -> Path:
+    block_size = 65536
+    file_hash = hashlib.sha512()
+    with open(file_path, "rb") as f:
+        block = f.read(block_size)
+        while block:
+            file_hash.update(block)
+            block = f.read(block_size)
+    hash_file_path = Path(f"{file_path}.sha512")
+    hash_file_path.write_text(file_hash.hexdigest(), encoding="utf-8")
+    return hash_file_path
+
+
+def collect_files_to_sign():
+    files = []
+    for f in sorted(TEMP_PATH.iterdir()):
+        if not f.is_file():
+            continue
+        if f.suffix in PACKAGE_SUFFIXES or f.name in BINARY_NAMES:
+            files.append(f)
+    return files
+
+
+def main():
+    stopwatch = Utils.Stopwatch()
+
+    assert (
+        GPG_BINARY_SIGNING_KEY and GPG_BINARY_SIGNING_PASSPHRASE
+    ), "GPG_BINARY_SIGNING_KEY and GPG_BINARY_SIGNING_PASSPHRASE must be set"
+
+    # Pass the passphrase via a file so it does not leak into command logs.
+    passphrase_file = TEMP_PATH / "gpg_passphrase"
+    passphrase_file.write_text(GPG_BINARY_SIGNING_PASSPHRASE, encoding="utf-8")
+    priv_key_file = TEMP_PATH / "priv.key"
+    priv_key_file.write_text(GPG_BINARY_SIGNING_KEY, encoding="utf-8")
+
+    gpg_common = (
+        "gpg --batch --yes --pinentry-mode=loopback "
+        f"--passphrase-file {passphrase_file}"
+    )
+
+    results = []
+    try:
+        Shell.check(f"{gpg_common} --import {priv_key_file}", verbose=True, strict=True)
+
+        for file_path in collect_files_to_sign():
+            hashed = hash_file(file_path)
+            signed = Path(f"{hashed}.gpg")
+            results.append(
+                Result.from_commands_run(
+                    name=signed.name,
+                    command=f"{gpg_common} -o {signed} --sign {hashed}",
+                )
+            )
+    finally:
+        priv_key_file.unlink(missing_ok=True)
+        passphrase_file.unlink(missing_ok=True)
+
+    Result.create_from(results=results, stopwatch=stopwatch).complete_job()
+
+
+if __name__ == "__main__":
+    main()
diff --git a/ci/jobs/source_upload.py b/ci/jobs/source_upload.py
new file mode 100644
index 000000000000..8b49c871c502
--- /dev/null
+++ b/ci/jobs/source_upload.py
@@ -0,0 +1,60 @@
+#!/usr/bin/env python3
+from pathlib import Path
+
+from ci.jobs.scripts.clickhouse_version import CHVersion
+from ci.praktika._environment import _Environment
+from ci.praktika.result import Result
+from ci.praktika.s3 import S3
+from ci.praktika.settings import Settings
+from ci.praktika.utils import Shell, Utils
+
+REPO_PATH = Path(Utils.cwd())
+
+# The source tarball is published next to the release build's artifacts so that
+# the legacy S3 layout (consumed outside this repo) keeps working.
+S3_SUBDIR = "build_amd_release"
+
+
+def checkout_submodules():
+    return Shell.check(
+        "git submodule sync && git submodule init", verbose=True
+    ) and Shell.check(
+        "contrib/update-submodules.sh --max-procs 10", verbose=True, retries=3
+    )
+
+
+def main():
+    stopwatch = Utils.Stopwatch()
+
+    version = CHVersion.get_version()
+    tarball = REPO_PATH.parent / f"clickhouse-{version}.src.tar.gz"
+
+    results = [
+        Result.from_commands_run(
+            name="Checkout submodules",
+            command=checkout_submodules,
+        )
+    ]
+
+    if results[-1].is_ok():
+        results.append(
+            Result.from_commands_run(
+                name="Create source tar",
+                command=f"tar czf {tarball} -C {REPO_PATH.parent} {REPO_PATH.name}",
+            )
+        )
+
+    link = ""
+    if results[-1].is_ok():
+        s3_path = f"{Settings.S3_ARTIFACT_PATH}/{_Environment.get().get_s3_prefix()}/{S3_SUBDIR}"
+        link = S3.copy_file_to_s3(s3_path=s3_path, local_path=str(tarball))
+
+    Result.create_from(
+        results=results,
+        stopwatch=stopwatch,
+        links=[link] if link else None,
+    ).complete_job()
+
+
+if __name__ == "__main__":
+    main()
diff --git a/ci/praktika/yaml_additional_templates.py b/ci/praktika/yaml_additional_templates.py
index 67e35a36c3fa..200e75495dea 100644
--- a/ci/praktika/yaml_additional_templates.py
+++ b/ci/praktika/yaml_additional_templates.py
@@ -85,26 +85,6 @@ class AltinityWorkflowTemplates:
       build_sha: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
       timeout_minutes: 210
       workflow_config: ${{ needs.config_workflow.outputs.data }}
-""",
-        "SignRelease": r"""
-  SignRelease:
-    needs: [config_workflow, build_amd_release]
-    if: ${{ !failure() && !cancelled() }}
-    uses: ./.github/workflows/reusable_sign.yml
-    secrets: inherit
-    with:
-      test_name: Sign release
-      runner_type: altinity-style-checker
-      data: ${{ needs.config_workflow.outputs.data }}
-  SignAarch64:
-    needs: [config_workflow, build_arm_release]
-    if: ${{ !failure() && !cancelled() }}
-    uses: ./.github/workflows/reusable_sign.yml
-    secrets: inherit
-    with:
-      test_name: Sign aarch64
-      runner_type: altinity-style-checker-aarch64
-      data: ${{ needs.config_workflow.outputs.data }}
 """,
         "CIReport": r"""
   FinishCIReport:
@@ -123,42 +103,6 @@ class AltinityWorkflowTemplates:
         with:
           workflow_config: ${{ toJson(needs) }}
           final: true
-""",
-        "SourceUpload": r"""
-  SourceUpload:
-    needs: [config_workflow, build_amd_release]
-    if: ${{ !cancelled() && needs.config_workflow.outputs.pipeline_status != '' && !contains(needs.*.outputs.pipeline_status, 'failure') }}
-    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker-aarch64]
-    env:
-        COMMIT_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
-        PR_NUMBER: ${{ github.event.pull_request.number || 0 }}
-        VERSION: ${{ fromJson(needs.config_workflow.outputs.data).JOB_KV_DATA.version.string }}
-    steps:
-      - name: Check out repository code
-        uses: Altinity/checkout@19599efdf36c4f3f30eb55d5bb388896faea69f6
-        with:
-          clear-repository: true
-          ref: ${{ fromJson(needs.config_workflow.outputs.data).git_ref }}
-          submodules: true
-          fetch-depth: 0
-          filter: tree:0
-      - name: Install aws cli
-        uses: unfor19/install-aws-cli-action@v1
-        with:
-          version: 2
-          arch: arm64
-      - name: Create source tar
-        run: |
-          cd .. && tar czf $RUNNER_TEMP/build_source.src.tar.gz ClickHouse/
-      - name: Upload source tar
-        run: |
-          if [ "$PR_NUMBER" -eq 0 ]; then
-              S3_PATH="REFs/$GITHUB_REF_NAME/$COMMIT_SHA/build_amd_release"
-          else
-              S3_PATH="PRs/$PR_NUMBER/$COMMIT_SHA/build_amd_release"
-          fi
-
-          aws s3 cp $RUNNER_TEMP/build_source.src.tar.gz s3://altinity-build-artifacts/$S3_PATH/clickhouse-$VERSION.src.tar.gz
 """,
     }
     ADDITIONAL_JOBS_BANNER = r"""
diff --git a/ci/praktika/yaml_generator.py b/ci/praktika/yaml_generator.py
index 46f820d2dce0..df0c6e3ed7fd 100644
--- a/ci/praktika/yaml_generator.py
+++ b/ci/praktika/yaml_generator.py
@@ -543,16 +543,10 @@ def _all_needs(job_name: str) -> set:
             ALL_JOBS += (
                 "\n      - RegressionTestsRelease\n      - RegressionTestsAarch64"
             )
-        if "SignRelease" in self.workflow_config.additional_jobs:
-            res += AltinityWorkflowTemplates.ALTINITY_JOBS["SignRelease"]
-            ALL_JOBS += "\n      - SignRelease\n      - SignAarch64"
         if "CIReport" in self.workflow_config.additional_jobs:
             res += AltinityWorkflowTemplates.ALTINITY_JOBS["CIReport"].replace(
                 "{ALL_JOBS}", ALL_JOBS
             )
-        if "SourceUpload" in self.workflow_config.additional_jobs:
-            res += AltinityWorkflowTemplates.ALTINITY_JOBS["SourceUpload"]
-            ALL_JOBS += "\n      - SourceUpload"
 
         return res
 
diff --git a/ci/workflows/master.py b/ci/workflows/master.py
index d8e3dd03b4dd..2c14620509c2 100644
--- a/ci/workflows/master.py
+++ b/ci/workflows/master.py
@@ -1,5 +1,6 @@
 from praktika import Workflow
 
+from ci.defs.altinity_jobs import AltinityArtifactConfigs, AltinityJobConfigs
 from ci.defs.defs import (
     BASE_BRANCH,
     BINARIES_WITH_LONG_RETENTION,
@@ -40,6 +41,8 @@
         JobConfigs.docker_server,
         JobConfigs.docker_keeper,
         *JobConfigs.install_check_master_jobs,
+        *AltinityJobConfigs.sign_release_jobs,
+        AltinityJobConfigs.source_upload_job,
         *JobConfigs.compatibility_test_jobs,
         # *JobConfigs.functional_test_llvm_coverage_jobs,
         # *JobConfigs.functional_test_excluded_from_llvm_job,
@@ -70,9 +73,7 @@
     additional_jobs=[
         "GrypeScan",
         "Regression",
-        "SignRelease",
         "CIReport",
-        "SourceUpload",
     ],
     artifacts=[
         *ArtifactConfigs.unittests_binaries,
@@ -80,6 +81,7 @@
         *ArtifactConfigs.clickhouse_debians,
         *ArtifactConfigs.clickhouse_rpms,
         *ArtifactConfigs.clickhouse_tgzs,
+        *AltinityArtifactConfigs.signed_hashes,
         ArtifactConfigs.fuzzers,
         ArtifactConfigs.fuzzers_corpus,
         # *ArtifactConfigs.llvm_profdata_file,
diff --git a/ci/workflows/pull_request.py b/ci/workflows/pull_request.py
index 3401a3f41012..12c3249280bb 100644
--- a/ci/workflows/pull_request.py
+++ b/ci/workflows/pull_request.py
@@ -1,5 +1,6 @@
 from praktika import Workflow
 
+from ci.defs.altinity_jobs import AltinityJobConfigs
 from ci.defs.defs import (
     BASE_BRANCH,
     DOCKERS,
@@ -151,8 +152,9 @@
             .set_name("Keeper Stress Tests (PR)")
             .set_timeout(3 * 3600),
         *JobConfigs.toolchain_build_jobs,
+        AltinityJobConfigs.source_upload_job,
     ],
-    additional_jobs=["GrypeScan", "Regression", "CIReport", "SourceUpload"],
+    additional_jobs=["GrypeScan", "Regression", "CIReport"],
     artifacts=[
         *ArtifactConfigs.unittests_binaries,
         *ArtifactConfigs.clickhouse_binaries,
diff --git a/ci/workflows/release_builds.py b/ci/workflows/release_builds.py
index 9cc42f01aacf..bf4aee074cb5 100644
--- a/ci/workflows/release_builds.py
+++ b/ci/workflows/release_builds.py
@@ -1,5 +1,6 @@
 from praktika import Workflow
 
+from ci.defs.altinity_jobs import AltinityArtifactConfigs, AltinityJobConfigs
 from ci.defs.defs import BINARIES_WITH_LONG_RETENTION, DOCKERS, SECRETS, ArtifactConfigs
 from ci.defs.job_configs import JobConfigs
 from ci.jobs.scripts.workflow_hooks.filter_job import should_skip_job
@@ -40,18 +41,21 @@
         JobConfigs.docker_server,
         JobConfigs.docker_keeper,
         *JobConfigs.install_check_master_jobs,
+        *AltinityJobConfigs.sign_release_jobs,
+        AltinityJobConfigs.source_upload_job,
         *[
             job
             for job in JobConfigs.functional_tests_jobs
             if any(t in job.name for t in ("release", "binary"))
         ],
     ],
-    additional_jobs=["GrypeScan", "SignRelease", "CIReport", "SourceUpload"],
+    additional_jobs=["GrypeScan", "CIReport"],
     artifacts=[
         *clickhouse_binaries_with_tags,
         *ArtifactConfigs.clickhouse_debians,
         *ArtifactConfigs.clickhouse_rpms,
         *ArtifactConfigs.clickhouse_tgzs,
+        *AltinityArtifactConfigs.signed_hashes,
     ],
     dockers=DOCKERS,
     enable_dockers_manifest_merge=True,
diff --git a/tests/ci/sign_release.py b/tests/ci/sign_release.py
deleted file mode 100644
index 8a5827097c8b..000000000000
--- a/tests/ci/sign_release.py
+++ /dev/null
@@ -1,97 +0,0 @@
-#!/usr/bin/env python3
-import sys
-import os
-import logging
-from env_helper import TEMP_PATH, REPO_COPY, REPORT_PATH
-from s3_helper import S3Helper
-from pr_info import PRInfo
-from build_download_helper import download_builds_filter
-import hashlib
-from pathlib import Path
-
-GPG_BINARY_SIGNING_KEY = os.getenv("GPG_BINARY_SIGNING_KEY")
-GPG_BINARY_SIGNING_PASSPHRASE = os.getenv("GPG_BINARY_SIGNING_PASSPHRASE")
-
-CHECK_NAME = os.getenv("CHECK_NAME", "Sign release")
-
-def hash_file(file_path):
-    BLOCK_SIZE = 65536 # The size of each read from the file
-
-    file_hash = hashlib.sha256() # Create the hash object, can use something other than `.sha256()` if you wish
-    with open(file_path, 'rb') as f: # Open the file to read it's bytes
-        fb = f.read(BLOCK_SIZE) # Read from the file. Take in the amount declared above
-        while len(fb) > 0: # While there is still data being read from the file
-            file_hash.update(fb) # Update the hash
-            fb = f.read(BLOCK_SIZE) # Read the next block from the file
-
-    hash_file_path = file_path + '.sha256'
-    with open(hash_file_path, 'x') as f:
-        digest = file_hash.hexdigest()
-        f.write(digest)
-        print(f'Hashed {file_path}: {digest}')
-
-    return hash_file_path
-
-def sign_file(file_path):
-    priv_key_file_path = 'priv.key'
-    with open(priv_key_file_path, 'x') as f:
-        f.write(GPG_BINARY_SIGNING_KEY)
-
-    out_file_path = f'{file_path}.gpg'
-
-    os.system(f'echo {GPG_BINARY_SIGNING_PASSPHRASE} | gpg --batch --import {priv_key_file_path}')
-    os.system(f'gpg -o {out_file_path} --pinentry-mode=loopback --batch --yes --passphrase {GPG_BINARY_SIGNING_PASSPHRASE} --sign {file_path}')
-    print(f"Signed {file_path}")
-    os.remove(priv_key_file_path)
-
-    return out_file_path
-
-def main():
-    reports_path = Path(REPORT_PATH)
-
-    if not os.path.exists(TEMP_PATH):
-        os.makedirs(TEMP_PATH)
-
-    pr_info = PRInfo()
-
-    logging.info("Repo copy path %s", REPO_COPY)
-
-    s3_helper = S3Helper()
-
-    s3_path_prefix = Path(f"{pr_info.number}/{pr_info.sha}/" + CHECK_NAME.lower().replace(
-        " ", "_"
-    ).replace("(", "_").replace(")", "_").replace(",", "_"))
-
-    # downloads `package_release` artifacts generated
-    download_builds_filter(CHECK_NAME, reports_path, Path(TEMP_PATH))
-
-    for f in os.listdir(TEMP_PATH):
-        full_path = os.path.join(TEMP_PATH, f)
-        if os.path.isdir(full_path):
-            continue
-        hashed_file_path = hash_file(full_path)
-        signed_file_path = sign_file(hashed_file_path)
-        s3_path = s3_path_prefix / os.path.basename(signed_file_path)
-        s3_helper.upload_build_file_to_s3(Path(signed_file_path), str(s3_path))
-        print(f'Uploaded file {signed_file_path} to {s3_path}')
-
-    # Signed hashes are:
-    # clickhouse-client_22.3.15.2.altinitystable_amd64.deb.sha512.gpg              clickhouse-keeper_22.3.15.2.altinitystable_x86_64.apk.sha512.gpg
-    # clickhouse-client-22.3.15.2.altinitystable-amd64.tgz.sha512.gpg              clickhouse-keeper-22.3.15.2.altinitystable.x86_64.rpm.sha512.gpg
-    # clickhouse-client_22.3.15.2.altinitystable_x86_64.apk.sha512.gpg             clickhouse-keeper-dbg_22.3.15.2.altinitystable_amd64.deb.sha512.gpg
-    # clickhouse-client-22.3.15.2.altinitystable.x86_64.rpm.sha512.gpg             clickhouse-keeper-dbg-22.3.15.2.altinitystable-amd64.tgz.sha512.gpg
-    # clickhouse-common-static_22.3.15.2.altinitystable_amd64.deb.sha512.gpg       clickhouse-keeper-dbg_22.3.15.2.altinitystable_x86_64.apk.sha512.gpg
-    # clickhouse-common-static-22.3.15.2.altinitystable-amd64.tgz.sha512.gpg       clickhouse-keeper-dbg-22.3.15.2.altinitystable.x86_64.rpm.sha512.gpg
-    # clickhouse-common-static_22.3.15.2.altinitystable_x86_64.apk.sha512.gpg      clickhouse-keeper.sha512.gpg
-    # clickhouse-common-static-22.3.15.2.altinitystable.x86_64.rpm.sha512.gpg      clickhouse-library-bridge.sha512.gpg
-    # clickhouse-common-static-dbg_22.3.15.2.altinitystable_amd64.deb.sha512.gpg   clickhouse-odbc-bridge.sha512.gpg
-    # clickhouse-common-static-dbg-22.3.15.2.altinitystable-amd64.tgz.sha512.gpg   clickhouse-server_22.3.15.2.altinitystable_amd64.deb.sha512.gpg
-    # clickhouse-common-static-dbg_22.3.15.2.altinitystable_x86_64.apk.sha512.gpg  clickhouse-server-22.3.15.2.altinitystable-amd64.tgz.sha512.gpg
-    # clickhouse-common-static-dbg-22.3.15.2.altinitystable.x86_64.rpm.sha512.gpg  clickhouse-server_22.3.15.2.altinitystable_x86_64.apk.sha512.gpg
-    # clickhouse-keeper_22.3.15.2.altinitystable_amd64.deb.sha512.gpg              clickhouse-server-22.3.15.2.altinitystable.x86_64.rpm.sha512.gpg
-    # clickhouse-keeper-22.3.15.2.altinitystable-amd64.tgz.sha512.gpg              clickhouse.sha512.gpg
-
-    sys.exit(0)
-
-if __name__ == "__main__":
-    main()

From 473db0593a1d1b84b30467f85dfdda3554c68fc9 Mon Sep 17 00:00:00 2001
From: strtgbb <146047128+strtgbb@users.noreply.github.com>
Date: Thu, 2 Jul 2026 14:28:11 -0400
Subject: [PATCH 07/11] skip swarms and oauth for non-antalya builds

---
 .github/workflows/regression.yml | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/regression.yml b/.github/workflows/regression.yml
index 2488a13e3843..8d2dde66fa46 100644
--- a/.github/workflows/regression.yml
+++ b/.github/workflows/regression.yml
@@ -305,8 +305,11 @@ jobs:
 
   OAuth:
     if: |
-      fromJson(inputs.workflow_config).JOB_KV_DATA.ci_regression_jobs[0] == null ||
-      contains(fromJson(inputs.workflow_config).JOB_KV_DATA.ci_regression_jobs, 'oauth')
+      contains(fromJson(inputs.workflow_config).JOB_KV_DATA.version.string, 'antalya') &&
+      (
+        fromJson(inputs.workflow_config).JOB_KV_DATA.ci_regression_jobs[0] == null ||
+        contains(fromJson(inputs.workflow_config).JOB_KV_DATA.ci_regression_jobs, 'oauth')
+      )
     uses: ./.github/workflows/regression-reusable-suite.yml
     with:
       ref: ${{ inputs.commit }}
@@ -482,8 +485,11 @@ jobs:
 
   Swarms:
       if: |
-        fromJson(inputs.workflow_config).JOB_KV_DATA.ci_regression_jobs[0] == null ||
-        contains(fromJson(inputs.workflow_config).JOB_KV_DATA.ci_regression_jobs, 'swarms')
+        contains(fromJson(inputs.workflow_config).JOB_KV_DATA.version.string, 'antalya') &&
+        (
+          fromJson(inputs.workflow_config).JOB_KV_DATA.ci_regression_jobs[0] == null ||
+          contains(fromJson(inputs.workflow_config).JOB_KV_DATA.ci_regression_jobs, 'swarms')
+        )
       uses: ./.github/workflows/regression-reusable-suite.yml
       with:
         ref: ${{ inputs.commit }}

From 07df96b3a8a6e9e326322398ad158558a8bf2ab6 Mon Sep 17 00:00:00 2001
From: strtgbb <146047128+strtgbb@users.noreply.github.com>
Date: Tue, 30 Jun 2026 09:28:48 -0400
Subject: [PATCH 08/11] Merge pull request #1974 from
 Altinity/ci/upgrade-ubuntu-packages-antalya-26.3

Antalya 26.3: Upgrade Ubuntu packages to apply security fixes
---
 docker/server/Dockerfile.ubuntu | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/docker/server/Dockerfile.ubuntu b/docker/server/Dockerfile.ubuntu
index 5bd0c73bb7d3..8b777c0ed03c 100644
--- a/docker/server/Dockerfile.ubuntu
+++ b/docker/server/Dockerfile.ubuntu
@@ -7,12 +7,13 @@ ARG DEBIAN_FRONTEND=noninteractive
 # ARG for quick switch to a given ubuntu mirror
 ARG apt_archive="http://archive.ubuntu.com"
 
-# We shouldn't use `apt upgrade` to not change the upstream image. It's updated biweekly
+# Upgrade already installed Ubuntu packages to apply available security fixes
+# without installing recommended packages.
 
 # user/group precreated explicitly with fixed uid/gid on purpose.
 # It is especially important for rootless containers: in that case entrypoint
 # can't do chown and owners of mounted volumes should be configured externally.
-# We do that in advance at the begining of Dockerfile before any packages will be
+# We do that in advance at the beginning of Dockerfile before any packages will be
 # installed to prevent picking those uid / gid by some unrelated software.
 # The same uid / gid (101) is used both for alpine and ubuntu.
 RUN sed -i "s|http://archive.ubuntu.com|${apt_archive}|g" /etc/apt/sources.list \
@@ -25,6 +26,7 @@ RUN sed -i "s|http://archive.ubuntu.com|${apt_archive}|g" /etc/apt/sources.list
         locales \
         tzdata \
         wget \
+    && apt-get upgrade --yes --no-install-recommends \
     && busybox --install -s \
     && rm -rf /var/lib/apt/lists/* /var/cache/debconf /tmp/*
 

From ab0a10be993508a7b88ca577676ae35e0622e20e Mon Sep 17 00:00:00 2001
From: strtgbb <146047128+strtgbb@users.noreply.github.com>
Date: Thu, 2 Jul 2026 15:10:31 -0400
Subject: [PATCH 09/11] partial revert of a37635825

---
 .../create_workflow_report/create_workflow_report.py  | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/.github/actions/create_workflow_report/create_workflow_report.py b/.github/actions/create_workflow_report/create_workflow_report.py
index 0e233288e0c7..773b1e13fbb8 100755
--- a/.github/actions/create_workflow_report/create_workflow_report.py
+++ b/.github/actions/create_workflow_report/create_workflow_report.py
@@ -311,15 +311,12 @@ def _find_rebase_baseline(branch_ref: str, cwd: str | None) -> str | None:
             "git",
             "log",
             branch_ref,
-            "--first-parent",
-            "-n",
-            "1",
+            "--reverse",
             "-i",
             "-E",
             "--grep=^Rebase CICD",
             "--grep=Merge pull request .*rebase-cicd",
             "--grep=Merge pull request .*from Altinity/rebase/",
-            "--grep=Merge pull request .*from Altinity/bump/",
             "--format=%H",
         ],
         cwd=cwd,
@@ -342,7 +339,7 @@ def get_prs_in_release_dataframe(
 ) -> pd.DataFrame:
     f"""
     PRs merged into branch_ref that belong in the next release notes: after the latest GitHub
-    Release tag on this history, or after the latest bootstrap merge if no such tag exists.
+    Release tag on this history, or after the oldest rebase bootstrap if no such tag exists.
     Only merge commits whose subject has from <repo_owner>/ (e.g. from Altinity/) are included.
     Columns: pr_number, pr_name, labels. Omits PRs labeled cicd.
     """
@@ -359,9 +356,9 @@ def get_prs_in_release_dataframe(
         check=False,
     )
 
-    _, baseline_sha = _find_release_baseline(branch_ref, repo, cwd)
+    baseline_ref, baseline_sha = _find_release_baseline(branch_ref, repo, cwd)
     if not baseline_sha:
-        # If no release tag, search recent history for the latest branch bootstrap merge.
+        # If no release tag, try to find rebase commit 500 commits back.
         subprocess.run(
             ["git", "fetch", "--deepen=500", "origin", branch_ref],
             cwd=cwd,

From e0440d2ef1914db06edd1a756d5469ebaa232857 Mon Sep 17 00:00:00 2001
From: strtgbb <146047128+strtgbb@users.noreply.github.com>
Date: Thu, 2 Jul 2026 16:17:26 -0400
Subject: [PATCH 10/11] move config/finish/grype jobs to x86 runners instead of
 limited arm runners

---
 .github/workflows/grype_scan.yml             |  2 +-
 .github/workflows/master.yml                 | 10 +++++-----
 .github/workflows/nightly_keeper.yml         |  4 ++--
 .github/workflows/nightly_keeper_faults.yml  |  4 ++--
 .github/workflows/pull_request.yml           |  8 ++++----
 .github/workflows/pull_request_community.yml |  2 +-
 .github/workflows/release_builds.yml         | 10 +++++-----
 ci/defs/altinity_jobs.py                     |  4 ++--
 ci/praktika/yaml_additional_templates.py     |  2 +-
 ci/settings/altinity_overrides.py            |  2 +-
 ci/settings/settings.py                      |  2 +-
 11 files changed, 25 insertions(+), 25 deletions(-)

diff --git a/.github/workflows/grype_scan.yml b/.github/workflows/grype_scan.yml
index f464533775fe..15ecef727641 100644
--- a/.github/workflows/grype_scan.yml
+++ b/.github/workflows/grype_scan.yml
@@ -35,7 +35,7 @@ env:
 jobs:
     grype_scan:
         name: Grype Scan
-        runs-on: [self-hosted, altinity-on-demand, altinity-style-checker-aarch64]
+        runs-on: [self-hosted, altinity-on-demand, altinity-style-checker]
         steps:
         - name: Checkout repository
           uses: actions/checkout@v6
diff --git a/.github/workflows/master.yml b/.github/workflows/master.yml
index 185777d7e2d7..a446373909cf 100644
--- a/.github/workflows/master.yml
+++ b/.github/workflows/master.yml
@@ -39,7 +39,7 @@ env:
 jobs:
 
   config_workflow:
-    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker-aarch64]
+    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker]
     needs: []
     name: "Config Workflow"
     outputs:
@@ -1270,7 +1270,7 @@ jobs:
           PYTHONUNBUFFERED=1 python3 -m praktika run 'Sign release (amd_release)' --workflow "MasterCI" --ci --timestamp
 
   sign_release_arm_release:
-    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker-aarch64]
+    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker]
     needs: [build_arm_release, config_workflow, dockers_build_amd, dockers_build_arm, dockers_build_multiplatform_manifest]
     if: ${{ !cancelled() && !contains(needs.*.outputs.pipeline_status, 'failure') && !contains(needs.*.outputs.pipeline_status, 'undefined') && !contains(fromJson(needs.config_workflow.outputs.data).workflow_config.cache_success_base64, 'U2lnbiByZWxlYXNlIChhcm1fcmVsZWFzZSk=') }}
     name: "Sign release (arm_release)"
@@ -1312,7 +1312,7 @@ jobs:
           PYTHONUNBUFFERED=1 python3 -m praktika run 'Sign release (arm_release)' --workflow "MasterCI" --ci --timestamp
 
   source_upload:
-    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker-aarch64]
+    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker]
     needs: [config_workflow, dockers_build_amd, dockers_build_arm, dockers_build_multiplatform_manifest]
     if: ${{ !cancelled() && !contains(needs.*.outputs.pipeline_status, 'failure') && !contains(needs.*.outputs.pipeline_status, 'undefined') && !contains(fromJson(needs.config_workflow.outputs.data).workflow_config.cache_success_base64, 'U291cmNlIHVwbG9hZA==') }}
     name: "Source upload"
@@ -5512,7 +5512,7 @@ jobs:
           PYTHONUNBUFFERED=1 python3 -m praktika run 'SQLLogic test' --workflow "MasterCI" --ci --timestamp
 
   finish_workflow:
-    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker-aarch64]
+    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker]
     needs: [ast_fuzzer_amd_debug, ast_fuzzer_amd_msan, ast_fuzzer_amd_tsan, ast_fuzzer_arm_asan_ubsan, build_amd_asan_ubsan, build_amd_binary, build_amd_debug, build_amd_llvm_coverage_per_test, build_amd_msan, build_amd_release, build_amd_tsan, build_arm_asan_ubsan, build_arm_binary, build_arm_debug, build_arm_msan, build_arm_release, build_arm_tsan, build_arm_ubsan, buzzhouse_amd_debug, buzzhouse_amd_msan, buzzhouse_amd_tsan, buzzhouse_arm_asan_ubsan, buzzhouse_experimental_serverfuzz_amd_debug, buzzhouse_experimental_serverfuzz_amd_msan, buzzhouse_experimental_serverfuzz_amd_tsan, buzzhouse_experimental_serverfuzz_arm_asan_ubsan, clickbench_amd_release, clickbench_arm_release, compatibility_check_amd_release, compatibility_check_arm_release, config_workflow, docker_keeper_image, docker_server_image, dockers_build_amd, dockers_build_arm, dockers_build_multiplatform_manifest, install_packages_amd_release, install_packages_arm_release, integration_tests_amd_asan_ubsan_db_disk_old_analyzer_1_6, integration_tests_amd_asan_ubsan_db_disk_old_analyzer_2_6, integration_tests_amd_asan_ubsan_db_disk_old_analyzer_3_6, integration_tests_amd_asan_ubsan_db_disk_old_analyzer_4_6, integration_tests_amd_asan_ubsan_db_disk_old_analyzer_5_6, integration_tests_amd_asan_ubsan_db_disk_old_analyzer_6_6, integration_tests_amd_msan_1_6, integration_tests_amd_msan_2_6, integration_tests_amd_msan_3_6, integration_tests_amd_msan_4_6, integration_tests_amd_msan_5_6, integration_tests_amd_msan_6_6, integration_tests_amd_tsan_1_6, integration_tests_amd_tsan_2_6, integration_tests_amd_tsan_3_6, integration_tests_amd_tsan_4_6, integration_tests_amd_tsan_5_6, integration_tests_amd_tsan_6_6, integration_tests_arm_binary_distributed_plan_1_4, integration_tests_arm_binary_distributed_plan_2_4, integration_tests_arm_binary_distributed_plan_3_4, integration_tests_arm_binary_distributed_plan_4_4, sign_release_amd_release, sign_release_arm_release, source_upload, sqllogic_test, sqltest, stateless_tests_amd_asan_ubsan_db_disk_distributed_plan_sequential, stateless_tests_amd_asan_ubsan_distributed_plan_parallel_1_2, stateless_tests_amd_asan_ubsan_distributed_plan_parallel_2_2, stateless_tests_amd_debug_distributed_plan_s3_storage_parallel, stateless_tests_amd_debug_distributed_plan_s3_storage_sequential, stateless_tests_amd_debug_parallel, stateless_tests_amd_debug_sequential, stateless_tests_amd_llvm_coverage_per_test_per_test_coverage_1_8, stateless_tests_amd_llvm_coverage_per_test_per_test_coverage_2_8, stateless_tests_amd_llvm_coverage_per_test_per_test_coverage_3_8, stateless_tests_amd_llvm_coverage_per_test_per_test_coverage_4_8, stateless_tests_amd_llvm_coverage_per_test_per_test_coverage_5_8, stateless_tests_amd_llvm_coverage_per_test_per_test_coverage_6_8, stateless_tests_amd_llvm_coverage_per_test_per_test_coverage_7_8, stateless_tests_amd_llvm_coverage_per_test_per_test_coverage_8_8, stateless_tests_amd_msan_wasmedge_parallel_1_4, stateless_tests_amd_msan_wasmedge_parallel_2_4, stateless_tests_amd_msan_wasmedge_parallel_3_4, stateless_tests_amd_msan_wasmedge_parallel_4_4, stateless_tests_amd_msan_wasmedge_sequential_1_2, stateless_tests_amd_msan_wasmedge_sequential_2_2, stateless_tests_amd_tsan_parallel_1_2, stateless_tests_amd_tsan_parallel_2_2, stateless_tests_amd_tsan_s3_storage_parallel_1_2, stateless_tests_amd_tsan_s3_storage_parallel_2_2, stateless_tests_amd_tsan_s3_storage_sequential_1_2, stateless_tests_amd_tsan_s3_storage_sequential_2_2, stateless_tests_amd_tsan_sequential_1_2, stateless_tests_amd_tsan_sequential_2_2, stateless_tests_arm_asan_ubsan_azure_parallel, stateless_tests_arm_asan_ubsan_azure_sequential, stateless_tests_arm_binary_parallel, stateless_tests_arm_binary_sequential, stress_test_amd_asan_ubsan, stress_test_amd_debug, stress_test_amd_msan, stress_test_amd_tsan, stress_test_arm_asan_ubsan, stress_test_arm_asan_ubsan_s3, stress_test_arm_debug, stress_test_arm_msan, stress_test_arm_release, stress_test_arm_tsan, stress_test_arm_ubsan, stress_test_azure_amd_msan, stress_test_azure_amd_tsan, stress_test_experimental_serverfuzz_amd_asan_ubsan, stress_test_experimental_serverfuzz_amd_debug, stress_test_experimental_serverfuzz_amd_msan, stress_test_experimental_serverfuzz_amd_tsan, stress_test_experimental_serverfuzz_arm_asan_ubsan, stress_test_experimental_serverfuzz_arm_asan_ubsan_s3, stress_test_experimental_serverfuzz_arm_debug, stress_test_experimental_serverfuzz_arm_msan, stress_test_experimental_serverfuzz_arm_release, stress_test_experimental_serverfuzz_arm_tsan, stress_test_experimental_serverfuzz_arm_ubsan, stress_test_experimental_serverfuzz_azure_amd_msan, stress_test_experimental_serverfuzz_azure_amd_tsan, unit_tests_asan_ubsan, unit_tests_asan_ubsan_function_prop_fuzzer, unit_tests_msan, unit_tests_msan_function_prop_fuzzer, unit_tests_tsan, unit_tests_tsan_function_prop_fuzzer]
     if: ${{ always() && needs.config_workflow.outputs.pipeline_status != '' }}
     name: "Finish Workflow"
@@ -5742,7 +5742,7 @@ jobs:
       - GrypeScanKeeper
       - RegressionTestsRelease
       - RegressionTestsAarch64
-    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker-aarch64]
+    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker]
     steps:
       - name: Check out repository code
         uses: Altinity/checkout@19599efdf36c4f3f30eb55d5bb388896faea69f6
diff --git a/.github/workflows/nightly_keeper.yml b/.github/workflows/nightly_keeper.yml
index 128037b6477f..ef9dd60c7566 100644
--- a/.github/workflows/nightly_keeper.yml
+++ b/.github/workflows/nightly_keeper.yml
@@ -33,7 +33,7 @@ env:
 jobs:
 
   config_workflow:
-    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker-aarch64]
+    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker]
     needs: []
     name: "Config Workflow"
     outputs:
@@ -257,7 +257,7 @@ jobs:
           PYTHONUNBUFFERED=1 python3 -m praktika run 'Keeper Stress (No Faults)' --workflow "NightlyKeeperNoFaults" --ci --timestamp
 
   finish_workflow:
-    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker-aarch64]
+    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker]
     needs: [build_arm_binary, config_workflow, dockers_build_amd, dockers_build_arm, keeper_stress_no_faults]
     if: ${{ always() && needs.config_workflow.outputs.pipeline_status != '' }}
     name: "Finish Workflow"
diff --git a/.github/workflows/nightly_keeper_faults.yml b/.github/workflows/nightly_keeper_faults.yml
index 41744cd1b212..6b8e3225137a 100644
--- a/.github/workflows/nightly_keeper_faults.yml
+++ b/.github/workflows/nightly_keeper_faults.yml
@@ -33,7 +33,7 @@ env:
 jobs:
 
   config_workflow:
-    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker-aarch64]
+    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker]
     needs: []
     name: "Config Workflow"
     outputs:
@@ -257,7 +257,7 @@ jobs:
           PYTHONUNBUFFERED=1 python3 -m praktika run 'Keeper Stress (Faults)' --workflow "NightlyKeeperFaults" --ci --timestamp
 
   finish_workflow:
-    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker-aarch64]
+    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker]
     needs: [build_arm_binary, config_workflow, dockers_build_amd, dockers_build_arm, keeper_stress_faults]
     if: ${{ always() && needs.config_workflow.outputs.pipeline_status != '' }}
     name: "Finish Workflow"
diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml
index 63d376c71e14..0d606093101e 100644
--- a/.github/workflows/pull_request.yml
+++ b/.github/workflows/pull_request.yml
@@ -41,7 +41,7 @@ env:
 jobs:
 
   config_workflow:
-    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker-aarch64]
+    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker]
     needs: []
     if: ${{ github.repository == github.event.pull_request.head.repo.full_name || github.event_name == 'workflow_dispatch' }}
     name: "Config Workflow"
@@ -4551,7 +4551,7 @@ jobs:
           PYTHONUNBUFFERED=1 python3 -m praktika run 'Build Toolchain (PGO, BOLT) (aarch64)' --workflow "PR" --ci --timestamp
 
   source_upload:
-    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker-aarch64]
+    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker]
     needs: [config_workflow, dockers_build_amd, dockers_build_arm, dockers_build_multiplatform_manifest]
     if: ${{ !cancelled() && !contains(needs.*.outputs.pipeline_status, 'failure') && !contains(needs.*.outputs.pipeline_status, 'undefined') && !contains(fromJson(needs.config_workflow.outputs.data).workflow_config.cache_success_base64, 'U291cmNlIHVwbG9hZA==') }}
     name: "Source upload"
@@ -4593,7 +4593,7 @@ jobs:
           PYTHONUNBUFFERED=1 python3 -m praktika run 'Source upload' --workflow "PR" --ci --timestamp
 
   finish_workflow:
-    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker-aarch64]
+    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker]
     needs: [ast_fuzzer_amd_debug, ast_fuzzer_amd_debug_targeted, ast_fuzzer_amd_debug_targeted_old_compatibility, ast_fuzzer_amd_msan, ast_fuzzer_amd_tsan, ast_fuzzer_arm_asan_ubsan, build_amd_asan_ubsan, build_amd_binary, build_amd_debug, build_amd_msan, build_amd_release, build_amd_tsan, build_arm_asan_ubsan, build_arm_binary, build_arm_debug, build_arm_msan, build_arm_release, build_arm_tidy, build_arm_tsan, build_arm_ubsan, build_toolchain_pgo_bolt_aarch64, build_toolchain_pgo_bolt_amd64, buzzhouse_amd_debug, buzzhouse_amd_msan, buzzhouse_amd_tsan, buzzhouse_arm_asan_ubsan, ci_tests, compatibility_check_amd_release, compatibility_check_arm_release, config_workflow, docker_keeper_image, docker_server_image, dockers_build_amd, dockers_build_arm, dockers_build_multiplatform_manifest, fast_test, install_packages_amd_release, install_packages_arm_release, integration_tests_amd_asan_ubsan_db_disk_old_analyzer_1_6, integration_tests_amd_asan_ubsan_db_disk_old_analyzer_2_6, integration_tests_amd_asan_ubsan_db_disk_old_analyzer_3_6, integration_tests_amd_asan_ubsan_db_disk_old_analyzer_4_6, integration_tests_amd_asan_ubsan_db_disk_old_analyzer_5_6, integration_tests_amd_asan_ubsan_db_disk_old_analyzer_6_6, integration_tests_amd_asan_ubsan_targeted, integration_tests_amd_msan_1_6, integration_tests_amd_msan_2_6, integration_tests_amd_msan_3_6, integration_tests_amd_msan_4_6, integration_tests_amd_msan_5_6, integration_tests_amd_msan_6_6, integration_tests_amd_tsan_1_6, integration_tests_amd_tsan_2_6, integration_tests_amd_tsan_3_6, integration_tests_amd_tsan_4_6, integration_tests_amd_tsan_5_6, integration_tests_amd_tsan_6_6, integration_tests_arm_binary_distributed_plan_1_4, integration_tests_arm_binary_distributed_plan_2_4, integration_tests_arm_binary_distributed_plan_3_4, integration_tests_arm_binary_distributed_plan_4_4, keeper_stress_tests_pr, quick_functional_tests, source_upload, sqllogic_test, stateless_tests_amd_asan_ubsan_db_disk_distributed_plan_sequential, stateless_tests_amd_asan_ubsan_distributed_plan_parallel_1_2, stateless_tests_amd_asan_ubsan_distributed_plan_parallel_2_2, stateless_tests_amd_debug_distributed_plan_s3_storage_parallel, stateless_tests_amd_debug_distributed_plan_s3_storage_sequential, stateless_tests_amd_debug_parallel, stateless_tests_amd_debug_sequential, stateless_tests_amd_msan_wasmedge_parallel_1_4, stateless_tests_amd_msan_wasmedge_parallel_2_4, stateless_tests_amd_msan_wasmedge_parallel_3_4, stateless_tests_amd_msan_wasmedge_parallel_4_4, stateless_tests_amd_msan_wasmedge_sequential_1_2, stateless_tests_amd_msan_wasmedge_sequential_2_2, stateless_tests_amd_tsan_parallel_1_2, stateless_tests_amd_tsan_parallel_2_2, stateless_tests_amd_tsan_s3_storage_parallel_1_2, stateless_tests_amd_tsan_s3_storage_parallel_2_2, stateless_tests_amd_tsan_s3_storage_sequential_1_2, stateless_tests_amd_tsan_s3_storage_sequential_2_2, stateless_tests_amd_tsan_sequential_1_2, stateless_tests_amd_tsan_sequential_2_2, stateless_tests_arm_asan_ubsan_azure_parallel, stateless_tests_arm_asan_ubsan_azure_sequential, stateless_tests_arm_asan_ubsan_targeted, stateless_tests_arm_binary_parallel, stateless_tests_arm_binary_sequential, stress_test_amd_asan_ubsan, stress_test_amd_debug, stress_test_amd_msan, stress_test_amd_tsan, stress_test_arm_asan_ubsan, stress_test_arm_asan_ubsan_s3, stress_test_arm_debug, stress_test_arm_msan, stress_test_arm_release, stress_test_arm_tsan, stress_test_arm_ubsan, unit_tests_asan_ubsan, unit_tests_asan_ubsan_function_prop_fuzzer, unit_tests_msan, unit_tests_msan_function_prop_fuzzer, unit_tests_tsan, unit_tests_tsan_function_prop_fuzzer]
     if: ${{ always() && needs.config_workflow.outputs.pipeline_status != '' }}
     name: "Finish Workflow"
@@ -4801,7 +4801,7 @@ jobs:
       - GrypeScanKeeper
       - RegressionTestsRelease
       - RegressionTestsAarch64
-    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker-aarch64]
+    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker]
     steps:
       - name: Check out repository code
         uses: Altinity/checkout@19599efdf36c4f3f30eb55d5bb388896faea69f6
diff --git a/.github/workflows/pull_request_community.yml b/.github/workflows/pull_request_community.yml
index fdb410c89a2c..21411b8424aa 100644
--- a/.github/workflows/pull_request_community.yml
+++ b/.github/workflows/pull_request_community.yml
@@ -26,7 +26,7 @@ env:
 jobs:
 
   config_workflow:
-    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker-aarch64]
+    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker]
     needs: []
     if: ${{ github.repository != github.event.pull_request.head.repo.full_name }}
     name: "Config Workflow"
diff --git a/.github/workflows/release_builds.yml b/.github/workflows/release_builds.yml
index bc730a915a71..5c553066ca2e 100644
--- a/.github/workflows/release_builds.yml
+++ b/.github/workflows/release_builds.yml
@@ -30,7 +30,7 @@ env:
 jobs:
 
   config_workflow:
-    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker-aarch64]
+    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker]
     needs: []
     name: "Config Workflow"
     outputs:
@@ -1011,7 +1011,7 @@ jobs:
           PYTHONUNBUFFERED=1 python3 -m praktika run 'Sign release (amd_release)' --workflow "Release Builds" --ci --timestamp
 
   sign_release_arm_release:
-    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker-aarch64]
+    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker]
     needs: [build_arm_release, config_workflow, dockers_build_amd, dockers_build_arm, dockers_build_multiplatform_manifest]
     if: ${{ !cancelled() && !contains(needs.*.outputs.pipeline_status, 'failure') && !contains(needs.*.outputs.pipeline_status, 'undefined') && !contains(fromJson(needs.config_workflow.outputs.data).workflow_config.cache_success_base64, 'U2lnbiByZWxlYXNlIChhcm1fcmVsZWFzZSk=') }}
     name: "Sign release (arm_release)"
@@ -1055,7 +1055,7 @@ jobs:
           PYTHONUNBUFFERED=1 python3 -m praktika run 'Sign release (arm_release)' --workflow "Release Builds" --ci --timestamp
 
   source_upload:
-    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker-aarch64]
+    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker]
     needs: [config_workflow, dockers_build_amd, dockers_build_arm, dockers_build_multiplatform_manifest]
     if: ${{ !cancelled() && !contains(needs.*.outputs.pipeline_status, 'failure') && !contains(needs.*.outputs.pipeline_status, 'undefined') && !contains(fromJson(needs.config_workflow.outputs.data).workflow_config.cache_success_base64, 'U291cmNlIHVwbG9hZA==') }}
     name: "Source upload"
@@ -1187,7 +1187,7 @@ jobs:
           PYTHONUNBUFFERED=1 python3 -m praktika run 'Stateless tests (arm_binary, sequential)' --workflow "Release Builds" --ci --timestamp
 
   finish_workflow:
-    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker-aarch64]
+    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker]
     needs: [build_amd_asan_ubsan, build_amd_binary, build_amd_debug, build_amd_msan, build_amd_release, build_amd_tsan, build_arm_asan_ubsan, build_arm_binary, build_arm_debug, build_arm_msan, build_arm_release, build_arm_tsan, build_arm_ubsan, config_workflow, docker_keeper_image, docker_server_image, dockers_build_amd, dockers_build_arm, dockers_build_multiplatform_manifest, install_packages_amd_release, install_packages_arm_release, sign_release_amd_release, sign_release_arm_release, source_upload, stateless_tests_arm_binary_parallel, stateless_tests_arm_binary_sequential]
     if: ${{ always() && needs.config_workflow.outputs.pipeline_status != '' }}
     name: "Finish Workflow"
@@ -1288,7 +1288,7 @@ jobs:
       - finish_workflow
       - GrypeScanServer
       - GrypeScanKeeper
-    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker-aarch64]
+    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker]
     steps:
       - name: Check out repository code
         uses: Altinity/checkout@19599efdf36c4f3f30eb55d5bb388896faea69f6
diff --git a/ci/defs/altinity_jobs.py b/ci/defs/altinity_jobs.py
index 84ae688b157d..1d736abaa17e 100644
--- a/ci/defs/altinity_jobs.py
+++ b/ci/defs/altinity_jobs.py
@@ -51,7 +51,7 @@ class AltinityJobConfigs:
         ),
         Job.ParamSet(
             parameter="arm_release",
-            runs_on=RunnerLabels.STYLE_CHECK_ARM,
+            runs_on=RunnerLabels.STYLE_CHECK_AMD,
             requires=[
                 ArtifactNames.DEB_ARM_RELEASE,
                 ArtifactNames.RPM_ARM_RELEASE,
@@ -65,7 +65,7 @@ class AltinityJobConfigs:
     # commit, so it must never be skipped by the content-addressed CI cache.
     source_upload_job = Job.Config(
         name=AltinityJobNames.SOURCE_UPLOAD,
-        runs_on=RunnerLabels.STYLE_CHECK_ARM,
+        runs_on=RunnerLabels.STYLE_CHECK_AMD,
         command="python3 ./ci/jobs/source_upload.py",
         timeout=3600,
     )
diff --git a/ci/praktika/yaml_additional_templates.py b/ci/praktika/yaml_additional_templates.py
index 200e75495dea..bf4c6c8a4e25 100644
--- a/ci/praktika/yaml_additional_templates.py
+++ b/ci/praktika/yaml_additional_templates.py
@@ -91,7 +91,7 @@ class AltinityWorkflowTemplates:
     if: ${{ !cancelled() && needs.config_workflow.outputs.pipeline_status != '' }}
     needs:
 {ALL_JOBS}
-    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker-aarch64]
+    runs-on: [self-hosted, altinity-on-demand, altinity-style-checker]
     steps:
       - name: Check out repository code
         uses: Altinity/checkout@19599efdf36c4f3f30eb55d5bb388896faea69f6
diff --git a/ci/settings/altinity_overrides.py b/ci/settings/altinity_overrides.py
index ad0be323dba7..bfa89909fe5e 100644
--- a/ci/settings/altinity_overrides.py
+++ b/ci/settings/altinity_overrides.py
@@ -17,7 +17,7 @@ class RunnerLabels:
 
 MAIN_BRANCH = "antalya"
 S3_ARTIFACT_PATH = S3_BUCKET_NAME
-CI_CONFIG_RUNS_ON = RunnerLabels.STYLE_CHECK_ARM
+CI_CONFIG_RUNS_ON = RunnerLabels.STYLE_CHECK_AMD
 
 ENABLE_MULTIPLATFORM_DOCKER_IN_ONE_JOB = False
 DOCKER_BUILD_AND_MERGE_RUNS_ON = RunnerLabels.STYLE_CHECK_AMD
diff --git a/ci/settings/settings.py b/ci/settings/settings.py
index 290f779abcf2..c77481b00cfa 100644
--- a/ci/settings/settings.py
+++ b/ci/settings/settings.py
@@ -15,7 +15,7 @@ class RunnerLabels:
 
 MAIN_BRANCH = "master"
 S3_ARTIFACT_PATH = S3_BUCKET_NAME
-CI_CONFIG_RUNS_ON = RunnerLabels.STYLE_CHECK_ARM
+CI_CONFIG_RUNS_ON = RunnerLabels.STYLE_CHECK_AMD
 
 ENABLE_MULTIPLATFORM_DOCKER_IN_ONE_JOB = False
 DOCKER_MERGE_RUNS_ON = RunnerLabels.STYLE_CHECK_AMD

From 26570516df5ba6b4b9570de1935d3f9a903719dd Mon Sep 17 00:00:00 2001
From: strtgbb <146047128+strtgbb@users.noreply.github.com>
Date: Wed, 1 Jul 2026 14:24:26 -0400
Subject: [PATCH 11/11] add cve component to report

---
 .../actions/create_workflow_report/create_workflow_report.py | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/actions/create_workflow_report/create_workflow_report.py b/.github/actions/create_workflow_report/create_workflow_report.py
index 773b1e13fbb8..f624cc143ac6 100755
--- a/.github/actions/create_workflow_report/create_workflow_report.py
+++ b/.github/actions/create_workflow_report/create_workflow_report.py
@@ -778,12 +778,17 @@ def format_prefix(pr_number, commit_sha, branch):
     rows = []
     for scan_result in results:
         for match in scan_result["matches"]:
+            artifact = match.get("artifact", {})
+            artifact_name = artifact.get("name", "")
+            artifact_version = artifact.get("version", "")
+            affected_component = f"{artifact_name} {artifact_version}".strip()
             rows.append(
                 {
                     "docker_image": scan_result["source"]["target"]["userInput"],
                     "severity": match["vulnerability"]["severity"],
                     "identifier": match["vulnerability"]["id"],
                     "namespace": match["vulnerability"]["namespace"],
+                    "affected_component": html.escape(affected_component),
                 }
             )