[zvonand]

Changelog category (leave one):

• Bug Fix

Changelog entry (a user-readable short description of the changes that goes to CHANGELOG.md):

Fixed ALTER MODIFY COLUMN failing when converting a Nullable column to a different type with a DEFAULT (e.g. Nullable(UInt8) → String,LowCardinality(String), or Array(UInt8)). (ClickHouse#102156 by @il9ue)

Documentation entry for user-facing changes

...

CI/CD Options

Exclude tests:

• Fast test
• Integration Tests
• Stateless tests
• Stateful tests
• Unit tests
• Performance tests
• Aarch64 tests
• All with ASAN
• All with TSAN
• All with MSAN
• All with UBSAN
• All with Coverage
• All Regression
• Disable CI Cache

Regression jobs to run:

• Fast suites (mostly <1h)
• Aggregate Functions (2h)
• Alter (1.5h)
• Benchmark (30m)
• CAS (content-addressed storage; Antalya only)
• ClickHouse Keeper (1h)
• Iceberg (2h)
• LDAP (1h)
• OAuth (5m)
• Parquet (1.5h)
• RBAC (1.5h)
• SSL Server (1h)
• S3 (2h)
• S3 Export (2h)
• Swarms (30m)
• Tiered Storage (2h)

[github-actions]

Workflow [PR], commit [5284d10]

[zvonand]

@blau-ai

[blau-ai]

CI triage for 5284d10

Verdict: none of the failures come from this PR. There are 7 failing checks. 4 integration shards fail exactly as they do on #2698, which ran on the same base. 1 stateless test fails because of a randomized setting in an unrelated feature. 1 check is an infra timeout and 1 is a DCO check that always fails on backports.

The new test 03575_modify_column_null_to_default_cross_type passed in every job: the praktika report lists no failure for it.

Check	Failing tests	Classification
Integration (asan_ubsan, db disk, old analyzer, 3/8)	test_database_glue (29), test_storage_iceberg_no_spark/test_writes_statistics_by_minmax_pruning (6)	pre-existing (same on #2698)
Integration (… 4/8)	test_storage_iceberg_with_spark/test_minmax_pruning (12), test_remote_initiator::test_remote_initiator_global_join_without_analyzer[s3] (1)	pre-existing (same on #2698)
Integration (… 7/8)	test_cas_gcs (37), test_datalake_glue_token_forwarding (3), test_storage_s3/test_sts (4)	pre-existing (same on #2698)
Integration (… 8/8)	test_cas_gcs_relink_liveness::test_both_queues_drain_under_slow_checkpoints	same infra cause as 7/8
Stateless (asan_ubsan, distributed plan, parallel, 2/2)	05387_s3_cluster_remote_initiator_keeps_stripped_join	not PR-related; reproducible under a randomized setting
GrypeScanServer / Grype Scan	—	infra: job cancelled after 6h (15:33→21:38)
DCO	—	the cherry-picked upstream merge commit has no Signed-off-by; #2698 fails the same way

Details

Integration, old-analyzer shards 3/4/7/8 (pre-existing). #2698 (4273040) has the same failures with the same counts per module: 29 + 6 on 3/8, 12 + 1 on 4/8, 37 + 3 + 4 on 7/8. Since nothing in this PR touches these tests, that settles it. There are two separate causes:

• Mock containers can't start (glue, cas_gcs, sts, token_forwarding, relink_liveness). The helper containers for the STS and fake-GCS mocks are started as ClickHouse instances, and the binary can't run inside them:

  Exception: Timed out while waiting for instance `sts.us-east-1.amazonaws.com' with ip address 172.16.1.10 to start.
  bash: line 1: /usr/bin/clickhouse: cannot execute: required file not found
  

  The same happens for fakegcs and sts.amazonaws.com. Something is wrong with the integration test environment for this build/shard on antalya-26.6, not with the code.
• Iceberg min/max pruning with the old analyzer. No files get pruned: assert 0 == 3 in check_validity_and_get_prunned_files(... WHERE ts <= timestamp('2024-03-20 14:00:00.000000')). Separately, test_remote_initiator_global_join_without_analyzer fails with Code: 206 ... No alias for subquery or table function in JOIN. Both also fail on Antalya 26.6 Backport of #127318 - Distrust the compromised eMudhra certificates #2698.

05387_s3_cluster_remote_initiator_keeps_stripped_join (not PR-related). The flaky-check rerun narrowed this down to one setting:

Re-running with the same randomized settings: Runs: 26, Failed: 26
Re-running without randomized settings:      Runs: 36, Failed: 0
Culprit settings: --prefer_localhost_replica 0
...
AWSClient: Response status: 403, Forbidden
Code: 499 ... Failed to get object info ... HTTP response code: 403 ... While executing Remote. (S3_ERROR)

• The test is already on the base branch and exists at Antalya 26.6 Backport of #127318 - Distrust the compromised eMudhra certificates #2698's head too. Antalya 26.6 Backport of #127318 - Distrust the compromised eMudhra certificates #2698 passed it, most likely because its run didn't randomize to prefer_localhost_replica=0.
• This PR only changes inplaceBlockConversions.cpp, the conversion of column defaults during ALTER MODIFY COLUMN. That code is not on the s3Cluster / object_storage_remote_initiator path.
• The 403 suggests that when the query really goes to a remote host, the query_to_send produced by the remote-initiator rewrite reaches S3 without working credentials. That would be a latent bug in the remote-initiator feature (area of Fix incorrect interaction between object_storage_remote_initiator and object_storage_cluster. #1783), not in this backport.
• Quick fix (separate PR on antalya-26.6): pin the setting in the test, e.g. SET prefer_localhost_replica = 1;. The better fix is to check whether credentials are lost on the remote-initiator path.

Grype Scan (infra). The job was cancelled at the 6h limit and didn't report anything. It passed in about 7 minutes on #2698, so a re-run should be enough.

DCO. The only commit is upstream's merge commit 5284d10 (author Michicosun), and it has no sign-off. That's normal for these backport PRs (#2698 is also red on DCO). Ignore it, or override DCO if a green status is required.

Next steps

• Nothing needs to change in this PR. Re-run Grype if you want it green.
• Worth tracking separately on antalya-26.6: (a) the mock-container /usr/bin/clickhouse: cannot execute problem on the old-analyzer integration shards, (b) Iceberg min/max pruning with the old analyzer, (c) 05387 under prefer_localhost_replica=0.