Stable 25.8 Backport of #123436 - Fix ALIAS row policies on legacy distributed reads

[mkmkme]

Fix ALIAS row policies on legacy distributed reads

Changelog category (leave one):

• Bug Fix (user-visible misbehavior in an official stable release)

Changelog entry (a user-readable short description of the changes that goes to CHANGELOG.md):

Fix a bug where using aliases and row policies with enable_analyzer=0 could error out (ClickHouse#123436 by @mkmkme)

Documentation entry for user-facing changes

...

CI/CD Options

Exclude tests:

• Fast test
• Integration Tests
• Stateless tests
• Stateful tests
• Unit tests
• Performance tests
• Aarch64 tests
• All with ASAN
• All with TSAN
• All with MSAN
• All with UBSAN
• All with Coverage
• All Regression
• Disable CI Cache

Regression jobs to run:

• Fast suites (mostly <1h)
• Aggregate Functions (2h)
• Alter (1.5h)
• Benchmark (30m)
• CAS (content-addressed storage; Antalya only)
• ClickHouse Keeper (1h)
• Iceberg (2h)
• LDAP (1h)
• OAuth (5m)
• Parquet (1.5h)
• RBAC (1.5h)
• SSL Server (1h)
• S3 (2h)
• S3 Export (2h)
• Swarms (30m)
• Tiered Storage (2h)

[github-actions]

Workflow [PR], commit [83d5877]

[mkmkme]

@blau-ai

[blau-ai]

CI triage — #2496 (backport of ClickHouse#123436, ALIAS row policies on legacy distributed reads)

Verdict: 4 failing checks, 0 caused by this PR. 2 are base-image CVE scans, 2 are the stress-test runner failing before the server ever started (Azure emulator unreachable). Every test suite that actually exercises this PR's code — including the suites running the new 05316_row_policy_alias_column_distributed test — is green. No code change is needed from you; the reds are a known base-image CVE plus a transient infra flake, safe to re-run.

Head SHA: 83d5877

---

1–2. Grype Scan (keeper + server -alpine) — NOT PR-caused (base-image CVE)

Both fail with "Grype Scan Completed with 1 high/critical vulnerabilities". The keeper report names it:

/docker vulnerabilities/CVE-2026-85091 @ alpine: distro: alpine: 3.21, High

This is an OS-package CVE in the Alpine base image, surfaced by scanning the built Docker image — it has nothing to do with a C++ source backport. The diff touches only src/Interpreters/InterpreterSelectQuery.cpp and a stateless test; it cannot add or remove an Alpine package CVE. These scans fail fleet-wide until the base image / Alpine CVE fix lands (cf. the recent 25.8-stable-alpine-cve-fix merge on this branch) and are tracked separately by the release team.
Next step: none for this PR. Rebase once the Alpine CVE bump reaches stable-25.8, or let the release owners clear it.

3–4. Stress test (amd_debug) and Stress test (amd_ubsan) — NOT PR-caused (infra)

Both report check_status.tsv doesn't exists, i.e. the job produced no results because the server never started. From run.log, the harness tried clickhouse start 120 times, each time hitting:

Code: 210. DB::NetException: Connection refused (localhost:9000). (NETWORK_ERROR)

and application_errors.txt shows why the server kept dying on boot — it was crashing during metadata load, before any query runs:

<Error> Application: Caught exception while loading metadata: std::exception. Code: 1001,
type: Azure::Storage::StorageException, e.what() = 500 Poco::Exception. Code: 1000,
e.code() = 111, Connection refused

The stress config enables Azure/S3 storage policies, and the Azure Blob emulator (Azurite) was unreachable (Connection refused), so the server couldn't load disk metadata and never came up. Identical root cause on both amd_debug and amd_ubsan. This is an environment failure at startup; this PR only changes row-policy ALIAS handling during query interpretation — code that isn't reached until a server is running and a query executes.
Next step: re-run the two Stress test jobs. No code change required.

---

Health check (the parts that matter for this PR are green)

All builds, unit tests, and the full stateless matrix passed, including the suites that run the new test 05316_row_policy_alias_column_distributed (tagged distributed, enable_analyzer=0):

• Stateless tests (amd_debug, parallel) / (amd_debug, sequential) ✅
• Stateless tests (amd_asan, distributed plan, parallel 1/2, 2/2, sequential) ✅
• Stateless tests (amd_ubsan, parallel/sequential) ✅
• Stateless tests (amd_binary, old analyzer, …) and ParallelReplicas variants ✅
• All Build (*) and Unit tests (asan/ubsan) ✅

So the backport's behavioral change is validated by CI. The only reds are the Alpine base-image CVE (release-owned) and the Azure-emulator stress-test infra flake (re-runnable). Nothing here blocks on the author.

Analysis from CI reports only — I can't build or run ClickHouse in this container.