Antalya 26.6 - Drop partition for Iceberg

[xieandrew]

Changelog category (leave one):

• New Feature

Changelog entry (a user-readable short description of the changes that goes to CHANGELOG.md):

Adds support for ALTER TABLE <table> DROP PARTITION <id> for Iceberg tables.

Documentation entry for user-facing changes

Adds support for ALTER TABLE <table> DROP PARTITION <id> for Iceberg tables. This resolves the correct partition to remove and writes a new Iceberg snapshot with the matching data files excluded.

WIP: Add support for purging data files (physically delete)

CI/CD Options

Exclude tests:

• Fast test
• Integration Tests
• Stateless tests
• Stateful tests
• Unit tests
• Performance tests
• Aarch64 tests
• All with ASAN
• All with TSAN
• All with MSAN
• All with UBSAN
• All with Coverage
• All Regression
• Disable CI Cache

Regression jobs to run:

• Fast suites (mostly <1h)
• Aggregate Functions (2h)
• Alter (1.5h)
• Benchmark (30m)
• CAS (content-addressed storage; Antalya only)
• ClickHouse Keeper (1h)
• Iceberg (2h)
• LDAP (1h)
• OAuth (5m)
• Parquet (1.5h)
• RBAC (1.5h)
• SSL Server (1h)
• S3 (2h)
• S3 Export (2h)
• Swarms (30m)
• Tiered Storage (2h)

Closes #1046

[github-actions]

Workflow [PR], commit [953220d]

[xieandrew]

@blau-ai

[blau-ai]

CI triage for #2361 @ 953220d

Verdict: 4 red checks, 0 PR-caused. They are 2 logical Grype image scans (keeper + server-alpine, each surfaced twice — once as a GitHub check-run, once as an S3 result). Every test/build job that has finished is green; the rest of the workflow is still running.

---

Not PR-related — Grype base-image CVE (infra/fleet-wide)

Check	Result
GrypeScanKeeper / Grype Scan (altinityinfra/clickhouse-keeper)	fail — 1 high/critical
GrypeScanServer (-alpine) / Grype Scan (altinityinfra/clickhouse-server:…-alpine)	fail — 1 high/critical

Both images fail on the same single High vulnerability, CVE-2026-85091 (an nvd:cpe match; the only other finding, CVE-2025-60876, is Medium and passes the threshold). Evidence it is not caused by this PR:

• The diff is C++ source + one test only — src/Storages/ObjectStorage/DataLakes/Iceberg/*, StorageObjectStorage.*, IDataLakeMetadata.h, and tests/integration/.../test_drop_partition.py. No Dockerfile, no dependency/package manifest, no base-image change. Grype scans OS/runtime packages baked into the image, which this PR does not touch.
• A fresh 2026 CVE. CVE-2026-85091 was published essentially now (today is 2026-09-23), so it lights up on every image built after the grype DB picked it up — independent of source changes.
• Reproduces on an unrelated PR. Sibling PR Iceberg: reuse the Puffin object metadata across deletion-vector reads #2419 (Iceberg Puffin, no shared code) shows the identical two failures with the same "1 high/critical" message. Notably its ubuntu-based clickhouse-server image passes with 0 high/critical — i.e. the CVE lives in the keeper + alpine base images, not in anything either PR wrote.

Suggested action: nothing to change in this PR. This is resolved at the CI/base-image level by Altinity infra — patch/rebuild the keeper and alpine base images, or add CVE-2026-85091 to the grype ignore list once triaged. Re-running the job won't clear it until the base image is updated, and it should not block review/merge of the code change.

---

Everything else so far: green

Finished and passing: Fast test (0 failed / 9392 passed), all Builds (amd debug/asan_ubsan/binary/release, arm release), Unit tests (asan_ubsan: 0/14839), Stateless (amd_debug parallel 0/11130; amd_asan_ubsan distributed-plan parallel 1/2 0/5550), both AST fuzzer (targeted) jobs, Integration tests (amd_asan_ubsan, targeted), Docker server/keeper images, Source upload.

⚠️ The PR workflow is still running — many jobs are PENDING/RUNNING (remaining Stateless shards, Integration db disk / old analyzer 1–8, Stress tests, Compatibility check, SQLLogic/SQLStorm, the RegressionTestsRelease / Iceberg regression suite, Finish Workflow). No functional failures have appeared yet, but the run isn't complete — worth a final glance once it settles, especially the Iceberg regression + integration jobs given what this PR changes.

— @blau-ai (analysis only; CI is the source of truth since I can't build/run ClickHouse here)