[zvonand]

Changelog category (leave one):

• Improvement

Changelog entry (a user-readable short description of the changes that goes to CHANGELOG.md):

Enable Google as IdP for token-based authentication (#2499 by @zvonand).

CI/CD Options

Exclude tests:

• Fast test
• Integration Tests
• Stateless tests
• Stateful tests
• Performance tests
• All with ASAN
• All with TSAN
• All with MSAN
• All with UBSAN
• All with Coverage
• All with Aarch64
• All Regression
• Disable CI Cache

Regression jobs to run:

• Fast suites (mostly <1h)
• Aggregate Functions (2h)
• Alter (1.5h)
• Benchmark (30m)
• ClickHouse Keeper (1h)
• Iceberg (2h)
• LDAP (1h)
• Parquet (1.5h)
• RBAC (1.5h)
• SSL Server (1h)
• S3 (2h)
• S3 Export (2h)
• Swarms (30m)
• Tiered Storage (2h)

Cherry-picked from #2499.

[github-actions]

Workflow [PR], commit [eacf983]

[zvonand]

@blau-ai

[blau-ai]

CI triage for #2632

Verdict: 4 failing checks (+ the aggregate PR gate) — 0 PR-caused. All are infra / flaky / pre-existing. This PR touches only auth code (GoogleTokenProcessor rewrite, JWKSProvider error-message tweaks, one doc), and every check that actually exercises the build and the test corpus is green: Fast test, all Stateless suites (amd_debug / arm_binary / distributed+s3), all Builds, Stress, Compatibility, AST/BuzzHouse fuzzers, Integration shards 1–3 of 4.

Check	Classification	Why
Integration tests (arm_binary, distributed plan, 4/4)	Infra	Docker image-pull timeout
Parser memory check	Infra	missing upstream master artifact
Regression aarch64 + release swarms	Pre-existing (branch-wide)	same 3 scenarios fail on an unrelated PR
RegressionTestsRelease / Iceberg (2) / iceberg_2	Infra / timeout	job canceled at the 3.5h workflow limit

Details

1. Integration tests (arm_binary, distributed plan, 4/4) — 105/1657
All 105 failures are in a single file, test_storage_kafka/test_batch_fast.py, and every one has the same traceback:

helpers/cluster.py:3868 - in start  -> run_and_check(images_pull_cmd ...)
E   Failed: Timeout (>900.0s) from pytest-timeout.

The Kafka test cluster never came up because the runner couldn't pull its Docker images in time — not a product failure. Shards 1/4, 2/4, 3/4 of the same suite passed (0 failures). Not PR-related — nothing here touches Kafka. → Safe to re-run.

2. Parser memory check — ERROR

Resolve master binary
No master `clickhouse-examples` artifact was found

The job couldn't find the baseline master clickhouse-examples artifact to compare against; it errored before running anything. Infra, not PR-related. → Safe to re-run.

3. Regression swarms (aarch64 + release) — 3 scenarios
Failing scenarios (identical on both arches):

• cluster discovery/check cluster discovery with wrong cluster name — Code: 279 ... ALL_CONNECTION_TRIES_FAILED
• node failure/cpu overload
• node failure/cpu overload all swarm nodes

These are distributed swarm connectivity / deliberate resource-exhaustion tests with no code path to token auth. Pre-existing/branch-wide: PR #2641 (unrelated change, same antalya-26.8 base) fails the exact same three scenarios on both aarch64 and release. Not PR-related — track as a flaky/broken swarm suite on the branch, not a blocker for this PR.

4. RegressionTestsRelease / Iceberg (2) / iceberg_2 — canceled

2026-10-22T14:09:15  start
2026-10-22T17:35:50  ##[error]The operation was canceled.

The job ran 3h31m and was killed at the workflow timeout; no report was uploaded (S3 iceberg2/report.html is 404). The aarch64 iceberg_2 equivalent passed (2h40m) and release iceberg_1 passed — this is a slow-runner timeout, not an assertion. Not PR-related. → Safe to re-run.

Recommendation

No code fix is needed on this PR for any of these. Re-run Integration 4/4, Parser memory check, and Iceberg (2) release; the swarms regression is a pre-existing branch failure (see #2641) and should be triaged separately. Once those clear, the PR aggregate gate will go green on its own.

One non-blocking observation: this PR changes auth behavior, but no auth-specific regression ran in this CI round (the OAuth regression suite is listed as skipping). If you want direct coverage of the new Google /tokeninfo path, consider triggering the OAuth suite before merge.

🤖 Generated with Claude Code