diff --git a/.github/actions/create_workflow_report/ci_run_report.html.jinja b/.github/actions/create_workflow_report/ci_run_report.html.jinja
index a92c1aa34e3a..4c94465a16c6 100644
--- a/.github/actions/create_workflow_report/ci_run_report.html.jinja
+++ b/.github/actions/create_workflow_report/ci_run_report.html.jinja
@@ -5,6 +5,9 @@
   <meta http-equiv="content-type" content="text/html; charset=UTF-8">
   <meta charset="UTF-8">
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  {%- if is_preview %}
+  <meta http-equiv="Cache-Control" content="max-age=300">
+  {%- endif %}
   <style>
     /* Base colors for Altinity */
     :root {
@@ -152,7 +155,7 @@
       </tr>
       <tr>
         <th class="hth no-sort">Build Report</th>
-        <td><a href="https://s3.amazonaws.com/{{ s3_bucket }}/{{ pr_number }}/{{ commit_sha }}/builds/report.html">Build Report</a></td>
+        <td>{% for job_name, link in build_report_links.items() %}<a href="{{ link }}">[{{ job_name }}]</a> {% endfor %}</td>
       </tr>
       <tr>
         <th class="hth no-sort">Date</th>
@@ -223,6 +226,8 @@
           element.className = element.className.replace(regex_dir, '') + dir
         }
         function getValue(element) {
+          var childWithSort = element.querySelector('[data-sort]')
+          if (childWithSort) return childWithSort.getAttribute('data-sort')
           return (
             (alt_sort && element.getAttribute('data-sort-alt')) ||
             element.getAttribute('data-sort') || element.innerText
diff --git a/.github/actions/create_workflow_report/create_workflow_report.py b/.github/actions/create_workflow_report/create_workflow_report.py
index 4f360b9f092d..bb094473eefc 100755
--- a/.github/actions/create_workflow_report/create_workflow_report.py
+++ b/.github/actions/create_workflow_report/create_workflow_report.py
@@ -6,6 +6,9 @@
 import json
 from datetime import datetime
 from functools import lru_cache
+from glob import glob
+import urllib.parse
+import re
 
 import pandas as pd
 from jinja2 import Environment, FileSystemLoader
@@ -13,43 +16,17 @@
 from clickhouse_driver import Client
 import boto3
 from botocore.exceptions import NoCredentialsError
+import yaml
+
 
 DATABASE_HOST_VAR = "CHECKS_DATABASE_HOST"
-DATABASE_USER_VAR = "CHECKS_DATABASE_USER"
-DATABASE_PASSWORD_VAR = "CHECKS_DATABASE_PASSWORD"
+DATABASE_USER_VAR = "CLICKHOUSE_TEST_STAT_LOGIN"
+DATABASE_PASSWORD_VAR = "CLICKHOUSE_TEST_STAT_PASSWORD"
 S3_BUCKET = "altinity-build-artifacts"
 GITHUB_REPO = "Altinity/ClickHouse"
+GITHUB_TOKEN = os.getenv("GITHUB_TOKEN") or os.getenv("GH_TOKEN")
 
-# Set up the Jinja2 environment
-template_dir = os.path.dirname(__file__)
-
-# Load the template
-template = Environment(loader=FileSystemLoader(template_dir)).get_template(
-    "ci_run_report.html.jinja"
-)
-
-
-@lru_cache
-def get_run_details(run_url: str) -> dict:
-    """
-    Fetch run details for a given run URL.
-    """
-    run_id = run_url.split("/")[-1]
-
-    headers = {
-        "Authorization": f"token {os.getenv('GITHUB_TOKEN')}",
-        "Accept": "application/vnd.github.v3+json",
-    }
-
-    url = f"https://api.github.com/repos/{GITHUB_REPO}/actions/runs/{run_id}"
-    response = requests.get(url, headers=headers)
-
-    if response.status_code != 200:
-        raise Exception(
-            f"Failed to fetch run details: {response.status_code} {response.text}"
-        )
-
-    return response.json()
+CVE_SEVERITY_ORDER = {"critical": 1, "high": 2, "medium": 3, "low": 4, "negligible": 5}
 
 
 def get_commit_statuses(sha: str) -> pd.DataFrame:
@@ -64,7 +41,7 @@ def get_commit_statuses(sha: str) -> pd.DataFrame:
         pd.DataFrame: DataFrame containing all statuses.
     """
     headers = {
-        "Authorization": f"token {os.getenv('GITHUB_TOKEN')}",
+        "Authorization": f"token {GITHUB_TOKEN}",
         "Accept": "application/vnd.github.v3+json",
     }
 
@@ -133,7 +110,7 @@ def get_pr_info_from_number(pr_number: str) -> dict:
         dict: Dictionary containing PR information.
     """
     headers = {
-        "Authorization": f"token {os.getenv('GITHUB_TOKEN')}",
+        "Authorization": f"token {GITHUB_TOKEN}",
         "Accept": "application/vnd.github.v3+json",
     }
 
@@ -148,15 +125,12 @@ def get_pr_info_from_number(pr_number: str) -> dict:
     return response.json()
 
 
-@lru_cache
-def get_run_details(run_url: str) -> dict:
+def get_run_details(run_id: str) -> dict:
     """
     Fetch run details for a given run URL.
     """
-    run_id = run_url.split("/")[-1]
-
     headers = {
-        "Authorization": f"token {os.getenv('GITHUB_TOKEN')}",
+        "Authorization": f"token {GITHUB_TOKEN}",
         "Accept": "application/vnd.github.v3+json",
     }
 
@@ -171,9 +145,9 @@ def get_run_details(run_url: str) -> dict:
     return response.json()
 
 
-def get_checks_fails(client: Client, job_url: str):
+def get_checks_fails(client: Client, commit_sha: str, branch_name: str):
     """
-    Get tests that did not succeed for the given job URL.
+    Get tests that did not succeed for the given commit and branch.
     Exclude checks that have status 'error' as they are counted in get_checks_errors.
     """
     query = f"""SELECT job_status, job_name, status as test_status, test_name, results_link
@@ -186,59 +160,116 @@ def get_checks_fails(client: Client, job_url: str):
                     report_url as results_link,
                     task_url
                 FROM `gh-data`.checks
+                WHERE commit_sha='{commit_sha}' AND head_ref='{branch_name}'
                 GROUP BY check_name, test_name, report_url, task_url
             )
-            WHERE task_url LIKE '{job_url}%'
-            AND test_status IN ('FAIL', 'ERROR')
+            WHERE test_status IN ('FAIL', 'ERROR')
             AND job_status!='error'
             ORDER BY job_name, test_name
             """
     return client.query_dataframe(query)
 
 
-def get_checks_known_fails(client: Client, job_url: str, known_fails: dict):
+def get_broken_tests_rules(broken_tests_file_path):
+    with open(broken_tests_file_path, "r", encoding="utf-8") as broken_tests_file:
+        broken_tests = yaml.safe_load(broken_tests_file)
+
+    compiled_rules = {"exact": {}, "pattern": {}}
+
+    for test in broken_tests:
+        regex = test.get("regex") is True
+        rule = {
+            "reason": test["reason"],
+        }
+
+        if test.get("check_types"):
+            rule["check_types"] = test["check_types"]
+
+        if regex:
+            rule["regex"] = True
+            compiled_rules["pattern"][re.compile(test["name"])] = rule
+        else:
+            compiled_rules["exact"][test["name"]] = rule
+
+    return compiled_rules
+
+
+def get_known_fail_reason(test_name: str, check_name: str, known_fails: dict):
+    """
+    Returns the reason why a test is known to fail based on its name and build context.
+
+    - Exact-name rules are checked first.
+    - Pattern-name rules are checked next (first match wins).
+    - Message/not_message conditions are ignored.
+    """
+    # 1. Exact-name rules
+    rule_data = known_fails["exact"].get(test_name)
+    if rule_data:
+        check_types = rule_data.get("check_types", [])
+        if not check_types or any(
+            check_type in check_name for check_type in check_types
+        ):
+            return rule_data["reason"]
+
+    # 2. Pattern-name rules
+    for name_re, rule_data in known_fails["pattern"].items():
+        if name_re.fullmatch(test_name):
+            check_types = rule_data.get("check_types", [])
+            if not check_types or any(
+                check_type in check_name for check_type in check_types
+            ):
+                return rule_data["reason"]
+
+    return "No reason given"
+
+
+def get_checks_known_fails(
+    client: Client, commit_sha: str, branch_name: str, known_fails: dict
+):
     """
-    Get tests that are known to fail for the given job URL.
+    Get tests that are known to fail for the given commit and branch.
     """
     if len(known_fails) == 0:
         return pd.DataFrame()
 
-    query = f"""SELECT job_status, job_name, status as test_status, test_name, results_link
+    query = f"""SELECT job_name, status as test_status, test_name, results_link
         FROM (
             SELECT
-                argMax(check_status, check_start_time) as job_status,
                 check_name as job_name,
                 argMax(test_status, check_start_time) as status,
                 test_name,
                 report_url as results_link,
                 task_url
             FROM `gh-data`.checks
+            WHERE commit_sha='{commit_sha}' AND head_ref='{branch_name}'
             GROUP BY check_name, test_name, report_url, task_url
         )
-        WHERE task_url LIKE '{job_url}%'
-        AND test_status='BROKEN'
-        AND test_name IN ({','.join(f"'{test}'" for test in known_fails.keys())})
+        WHERE test_status='BROKEN'
         ORDER BY job_name, test_name
         """
 
     df = client.query_dataframe(query)
 
+    if df.shape[0] == 0:
+        return df
+
     df.insert(
         len(df.columns) - 1,
         "reason",
-        df["test_name"]
-        .astype(str)
-        .apply(
-            lambda test_name: known_fails[test_name].get("reason", "No reason given")
+        df.apply(
+            lambda row: get_known_fail_reason(
+                row["test_name"], row["job_name"], known_fails
+            ),
+            axis=1,
         ),
     )
 
     return df
 
 
-def get_checks_errors(client: Client, job_url: str):
+def get_checks_errors(client: Client, commit_sha: str, branch_name: str):
     """
-    Get checks that have status 'error' for the given job URL.
+    Get checks that have status 'error' for the given commit and branch.
     """
     query = f"""SELECT job_status, job_name, status as test_status, test_name, results_link
             FROM (
@@ -250,10 +281,10 @@ def get_checks_errors(client: Client, job_url: str):
                     report_url as results_link,
                     task_url
                 FROM `gh-data`.checks
+                WHERE commit_sha='{commit_sha}' AND head_ref='{branch_name}'
                 GROUP BY check_name, test_name, report_url, task_url
             )
-            WHERE task_url LIKE '{job_url}%'
-            AND job_status=='error'
+            WHERE job_status=='error'
             ORDER BY job_name, test_name
             """
     return client.query_dataframe(query)
@@ -397,34 +428,102 @@ def get_new_fails_this_pr(
     return new_fails_df
 
 
-def get_cves(pr_number, commit_sha):
+@lru_cache
+def get_workflow_config() -> dict:
+
+    # 25.12+
+    if os.path.exists("./ci/tmp/workflow_status.json"):
+        with open("./ci/tmp/workflow_status.json", "r") as f:
+            data = json.load(f)["config_workflow"]["outputs"]["data"]
+            assert data is not None, "data is None"
+            if isinstance(data, str):
+                data = json.loads(data)
+            assert (
+                "WORKFLOW_CONFIG" in data.keys()
+            ), f"WORKFLOW_CONFIG not found in data: {data.keys()}"
+            return data["WORKFLOW_CONFIG"]
+
+    workflow_config_files = glob("./ci/tmp/workflow_config*.json")
+    if len(workflow_config_files) == 0:
+        raise Exception("No workflow config file found")
+    if len(workflow_config_files) > 1:
+        raise Exception("Multiple workflow config files found")
+    with open(workflow_config_files[0], "r") as f:
+        return json.load(f)
+
+
+def get_cached_job(job_name: str) -> dict:
+    workflow_config = get_workflow_config()
+    return workflow_config["cache_jobs"].get(job_name, {})
+
+
+def get_cves(pr_number, commit_sha, branch):
     """
     Fetch Grype results from S3.
 
     If no results are available for download, returns ... (Ellipsis).
     """
     s3_client = boto3.client("s3", endpoint_url=os.getenv("S3_URL"))
-    s3_prefix = f"{pr_number}/{commit_sha}/grype/"
+    prefixes_to_check = set()
 
-    results = []
+    def format_prefix(pr_number, commit_sha, branch):
+        if pr_number == 0:
+            return f"REFs/{branch}/{commit_sha}/grype/"
+        else:
+            return f"PRs/{pr_number}/{commit_sha}/grype/"
+
+    cached_server_job = get_cached_job("Docker server image")
+    if cached_server_job:
+        prefixes_to_check.add(
+            format_prefix(
+                cached_server_job["pr_number"],
+                cached_server_job["sha"],
+                cached_server_job["branch"],
+            )
+        )
+    cached_keeper_job = get_cached_job("Docker keeper image")
+    if cached_keeper_job:
+        prefixes_to_check.add(
+            format_prefix(
+                cached_keeper_job["pr_number"],
+                cached_keeper_job["sha"],
+                cached_keeper_job["branch"],
+            )
+        )
 
-    response = s3_client.list_objects_v2(
-        Bucket=S3_BUCKET, Prefix=s3_prefix, Delimiter="/"
-    )
-    grype_result_dirs = [
-        content["Prefix"] for content in response.get("CommonPrefixes", [])
-    ]
+    if not prefixes_to_check:
+        prefixes_to_check = {format_prefix(pr_number, commit_sha, branch)}
+
+    grype_result_dirs = []
+    for s3_prefix in prefixes_to_check:
+        try:
+            response = s3_client.list_objects_v2(
+                Bucket=S3_BUCKET, Prefix=s3_prefix, Delimiter="/"
+            )
+            grype_result_dirs.extend(
+                content["Prefix"]
+                for content in response.get("CommonPrefixes", [])
+                if isinstance(content, dict) and content.get("Prefix")
+            )
+        except Exception as e:
+            print(f"Error listing S3 objects at {s3_prefix}: {e}")
+            continue
 
     if len(grype_result_dirs) == 0:
         # We were asked to check the CVE data, but none was found,
         # maybe this is a preview report and grype results are not available yet
         return ...
 
+    results = []
     for path in grype_result_dirs:
         file_key = f"{path}result.json"
-        file_response = s3_client.get_object(Bucket=S3_BUCKET, Key=file_key)
-        content = file_response["Body"].read().decode("utf-8")
-        results.append(json.loads(content))
+        try:
+            file_response = s3_client.get_object(Bucket=S3_BUCKET, Key=file_key)
+            content = file_response["Body"].read().decode("utf-8")
+            results.append(json.loads(content))
+        except Exception as e:
+            print(f"Error getting S3 object at {file_key}: {e}")
+            continue
 
     rows = []
     for scan_result in results:
@@ -442,19 +541,20 @@ def get_cves(pr_number, commit_sha):
         return pd.DataFrame()
 
     df = pd.DataFrame(rows).drop_duplicates()
-    df = df.sort_values(
-        by="severity",
-        key=lambda col: col.str.lower().map(
-            {"critical": 1, "high": 2, "medium": 3, "low": 4, "negligible": 5}
-        ),
-    )
+
+    def _cve_sort_key(col):
+        if col.name == "severity":
+            return col.str.lower().map(CVE_SEVERITY_ORDER)
+        return col
+
+    df = df.sort_values(by=["severity", "docker_image"], key=_cve_sort_key)
     return df
 
 
 def url_to_html_link(url: str) -> str:
     if not url:
         return ""
-    text = url.split("/")[-1].replace("__", "_")
+    text = url.split("/")[-1].split("?")[0]
     if not text:
         text = "results"
     return f'<a href="{url}">{text}</a>'
@@ -467,11 +567,15 @@ def format_test_name_for_linewrap(text: str) -> str:
 
 def format_test_status(text: str) -> str:
     """Format the test status for better readability."""
-    color = (
-        "red"
-        if text.lower().startswith("fail")
-        else "orange" if text.lower() in ("error", "broken", "pending") else "green"
-    )
+    if text.lower().startswith("fail"):
+        color = "red"
+    elif text.lower() == "skipped":
+        color = "grey"
+    elif text.lower() in ("success", "ok", "passed", "pass"):
+        color = "green"
+    else:
+        color = "orange"
+
     return f'<span style="font-weight: bold; color: {color}">{text}</span>'
 
 
@@ -491,6 +595,9 @@ def format_results_as_html_table(results) -> str:
             "Identifier": lambda i: url_to_html_link(
                 "https://nvd.nist.gov/vuln/detail/" + i
             ),
+            "Severity": lambda s: (
+                f'<span data-sort="{CVE_SEVERITY_ORDER.get(str(s).lower(), 6)}">{s}</span>'
+            ),
         },
         escape=False,
         border=0,
@@ -499,6 +606,103 @@ def format_results_as_html_table(results) -> str:
     return html
 
 
+def backfill_skipped_statuses(
+    job_statuses: pd.DataFrame, pr_number: int, branch: str, commit_sha: str
+):
+    """
+    Fill in the job statuses for skipped jobs.
+    """
+
+    if pr_number == 0:
+        ref_param = f"REF={branch}"
+        workflow_name = "MasterCI"
+    else:
+        ref_param = f"PR={pr_number}"
+        workflow_name = "PR"
+
+    status_file = f"result_{workflow_name.lower()}.json"
+    s3_path = f"https://{S3_BUCKET}.s3.amazonaws.com/{ref_param.replace('=', 's/')}/{commit_sha}/{status_file}"
+    response = requests.get(s3_path)
+
+    if response.status_code != 200:
+        return job_statuses
+
+    status_data = response.json()
+    skipped_jobs = []
+    for job in status_data["results"]:
+        if job["status"] == "skipped" and len(job["links"]) > 0:
+            skipped_jobs.append(
+                {
+                    "job_name": job["name"],
+                    "job_status": job["status"],
+                    "message": job["info"],
+                    "results_link": job["links"][0],
+                }
+            )
+
+    return pd.concat([job_statuses, pd.DataFrame(skipped_jobs)], ignore_index=True)
+
+
+def get_build_report_links(
+    job_statuses: pd.DataFrame, pr_number: int, branch: str, commit_sha: str
+):
+    """
+    Get the build report links for the given PR number, branch, and commit SHA.
+
+    First checks if a build job submitted a success or skipped status.
+    If not available, it guesses the links.
+    """
+    build_job_names = [
+        "Build (amd_release)",
+        "Build (arm_release)",
+        "Docker server image",
+        "Docker keeper image",
+    ]
+    build_report_links = {}
+
+    for job in job_statuses.itertuples():
+        if (
+            job.job_name in build_job_names
+            and job.job_status
+            in (
+                "success",
+                "skipped",
+            )
+            and job.results_link
+        ):
+            build_report_links[job.job_name] = job.results_link
+
+    if 0 < len(build_report_links) < len(build_job_names):
+        # Only have some of the build jobs, guess the rest.
+        # (It was straightforward to force the build jobs to always appear in the cache,
+        # however doing the same for the docker image jobs is difficult.)
+        ref_job, ref_link = list(build_report_links.items())[0]
+        link_template = ref_link.replace(
+            urllib.parse.quote(ref_job, safe=""), "{job_name}"
+        )
+        for job in build_job_names:
+            if job not in build_report_links:
+                build_report_links[job] = link_template.format(job_name=job)
+
+    if len(build_report_links) > 0:
+        return build_report_links
+
+    # No cache or build result was found, guess the links
+    if pr_number == 0:
+        ref_param = f"REF={branch}"
+        workflow_name = "MasterCI"
+    else:
+        ref_param = f"PR={pr_number}"
+        workflow_name = "PR"
+
+    build_report_link_base = f"https://{S3_BUCKET}.s3.amazonaws.com/json.html?{ref_param}&sha={commit_sha}&name_0={urllib.parse.quote(workflow_name, safe='')}"
+    build_report_links = {
+        job_name: f"{build_report_link_base}&name_1={urllib.parse.quote(job_name, safe='')}"
+        for job_name in build_job_names
+    }
+    return build_report_links
+
+
 def parse_args() -> argparse.Namespace:
     parser = argparse.ArgumentParser(description="Create a combined CI report.")
     parser.add_argument(  # Need the full URL rather than just the ID to query the databases
@@ -523,23 +727,47 @@ def parse_args() -> argparse.Namespace:
     return parser.parse_args()
 
 
-def main():
-    args = parse_args()
-
-    if args.pr_number is None or args.commit_sha is None:
-        run_details = get_run_details(args.actions_run_url)
-        if args.pr_number is None:
+def create_workflow_report(
+    actions_run_url: str,
+    pr_number: int = None,
+    commit_sha: str = None,
+    no_upload: bool = False,
+    known_fails_file_path: str = None,
+    check_cves: bool = False,
+    mark_preview: bool = False,
+) -> str:
+
+    host = os.getenv(DATABASE_HOST_VAR)
+    if not host:
+        print(f"{DATABASE_HOST_VAR} is not set")
+    user = os.getenv(DATABASE_USER_VAR)
+    if not user:
+        print(f"{DATABASE_USER_VAR} is not set")
+    password = os.getenv(DATABASE_PASSWORD_VAR)
+    if not password:
+        print(f"{DATABASE_PASSWORD_VAR} is not set")
+    if not GITHUB_TOKEN:
+        print("GITHUB_TOKEN is not set")
+    if not all([host, user, password, GITHUB_TOKEN]):
+        raise Exception("Required environment variables are not set")
+
+    run_id = actions_run_url.split("/")[-1]
+
+    run_details = get_run_details(run_id)
+    branch_name = run_details.get("head_branch", "unknown branch")
+    if pr_number is None or commit_sha is None:
+        if pr_number is None:
             if len(run_details["pull_requests"]) > 0:
-                args.pr_number = run_details["pull_requests"][0]["number"]
+                pr_number = run_details["pull_requests"][0]["number"]
             else:
-                args.pr_number = 0
-        if args.commit_sha is None:
-            args.commit_sha = run_details["head_commit"]["id"]
+                pr_number = 0
+        if commit_sha is None:
+            commit_sha = run_details["head_commit"]["id"]
 
     db_client = Client(
-        host=os.getenv(DATABASE_HOST_VAR),
-        user=os.getenv(DATABASE_USER_VAR),
-        password=os.getenv(DATABASE_PASSWORD_VAR),
+        host=host,
+        user=user,
+        password=password,
         port=9440,
         secure="y",
         verify=False,
@@ -547,41 +775,41 @@ def main():
     )
 
     fail_results = {
-        "job_statuses": get_commit_statuses(args.commit_sha),
-        "checks_fails": get_checks_fails(db_client, args.actions_run_url),
+        "job_statuses": get_commit_statuses(commit_sha),
+        "checks_fails": get_checks_fails(db_client, commit_sha, branch_name),
         "checks_known_fails": [],
         "pr_new_fails": [],
-        "checks_errors": get_checks_errors(db_client, args.actions_run_url),
-        "regression_fails": get_regression_fails(db_client, args.actions_run_url),
-        "docker_images_cves": (
-            [] if not args.cves else get_cves(args.pr_number, args.commit_sha)
-        ),
+        "checks_errors": get_checks_errors(db_client, commit_sha, branch_name),
+        "regression_fails": get_regression_fails(db_client, actions_run_url),
+        "docker_images_cves": [],
     }
 
+    try:
+        fail_results["docker_images_cves"] = (
+            [] if not check_cves else get_cves(pr_number, commit_sha, branch_name)
+        )
+    except Exception as e:
+        print(f"Error in get_cves: {e}")
+
     # get_cves returns ... in the case where no Grype result files were found.
     # This might occur when run in preview mode.
-    cves_not_checked = not args.cves or fail_results["docker_images_cves"] is ...
-
-    if args.known_fails:
-        if not os.path.exists(args.known_fails):
-            print(f"Known fails file {args.known_fails} not found.")
-            exit(1)
+    cves_not_checked = not check_cves or fail_results["docker_images_cves"] is ...
 
-        with open(args.known_fails) as f:
-            known_fails = json.load(f)
+    if known_fails_file_path:
+        if not os.path.exists(known_fails_file_path):
+            print(f"WARNING:Known fails file {known_fails_file_path} not found.")
+        else:
+            known_fails = get_broken_tests_rules(known_fails_file_path)
 
-        if known_fails:
             fail_results["checks_known_fails"] = get_checks_known_fails(
-                db_client, args.actions_run_url, known_fails
+                db_client, commit_sha, branch_name, known_fails
             )
 
-    if args.pr_number == 0:
-        run_details = get_run_details(args.actions_run_url)
-        branch_name = run_details.get("head_branch", "unknown branch")
+    if pr_number == 0:
         pr_info_html = f"Release ({branch_name})"
     else:
         try:
-            pr_info = get_pr_info_from_number(args.pr_number)
+            pr_info = get_pr_info_from_number(pr_number)
             pr_info_html = f"""<a href="https://github.com/{GITHUB_REPO}/pull/{pr_info["number"]}">
                     #{pr_info.get("number")} ({pr_info.get("base", {}).get('ref')} <- {pr_info.get("head", {}).get('ref')})  {pr_info.get("title")}
                     </a>"""
@@ -593,6 +821,11 @@ def main():
             )
         except Exception as e:
             pr_info_html = e
+            pr_info = {}
+
+    fail_results["job_statuses"] = backfill_skipped_statuses(
+        fail_results["job_statuses"], pr_number, branch_name, commit_sha
+    )
 
     high_cve_count = 0
     if not cves_not_checked and len(fail_results["docker_images_cves"]) > 0:
@@ -603,31 +836,37 @@ def main():
             .sum()
         )
 
+    # Load the template
+    template = Environment(
+        loader=FileSystemLoader(os.path.dirname(__file__))
+    ).get_template("ci_run_report.html.jinja")
+
     # Define the context for rendering
     context = {
         "title": "ClickHouse® CI Workflow Run Report",
         "github_repo": GITHUB_REPO,
         "s3_bucket": S3_BUCKET,
         "pr_info_html": pr_info_html,
-        "pr_number": args.pr_number,
-        "workflow_id": args.actions_run_url.split("/")[-1],
-        "commit_sha": args.commit_sha,
-        "base_sha": "" if args.pr_number == 0 else pr_info.get("base", {}).get("sha"),
+        "pr_number": pr_number,
+        "workflow_id": run_id,
+        "commit_sha": commit_sha,
+        "base_sha": "" if pr_number == 0 else pr_info.get("base", {}).get("sha"),
         "date": f"{datetime.utcnow().strftime('%Y-%m-%d %H:%M:%S')} UTC",
-        "is_preview": args.mark_preview,
+        "is_preview": mark_preview,
         "counts": {
-            "jobs_status": f"{sum(fail_results['job_statuses']['job_status'] != 'success')} fail/error/pending",
+            "jobs_status": f"{sum(fail_results['job_statuses']['job_status'].value_counts().get(x, 0) for x in ('failure', 'error'))} fail/error",
             "checks_errors": len(fail_results["checks_errors"]),
             "checks_new_fails": len(fail_results["checks_fails"]),
             "regression_new_fails": len(fail_results["regression_fails"]),
             "cves": "N/A" if cves_not_checked else f"{high_cve_count} high/critical",
             "checks_known_fails": (
-                "N/A"
-                if not args.known_fails
-                else len(fail_results["checks_known_fails"])
+                "N/A" if not known_fails else len(fail_results["checks_known_fails"])
             ),
             "pr_new_fails": len(fail_results["pr_new_fails"]),
         },
+        "build_report_links": get_build_report_links(
+            fail_results["job_statuses"], pr_number, branch_name, commit_sha
+        ),
         "ci_jobs_status_html": format_results_as_html_table(
             fail_results["job_statuses"]
         ),
@@ -645,7 +884,7 @@ def main():
         ),
         "checks_known_fails_html": (
             "<p>Not Checked</p>"
-            if not args.known_fails
+            if not known_fails
             else format_results_as_html_table(fail_results["checks_known_fails"])
         ),
         "new_fails_html": format_results_as_html_table(fail_results["pr_new_fails"]),
@@ -658,11 +897,16 @@ def main():
     report_path = Path(report_name)
     report_path.write_text(rendered_html, encoding="utf-8")
 
-    if args.no_upload:
+    if no_upload:
         print(f"Report saved to {report_path}")
         exit(0)
 
-    report_destination_key = f"{args.pr_number}/{args.commit_sha}/{report_name}"
+    if pr_number == 0:
+        report_destination_key = f"REFs/{branch_name}/{commit_sha}"
+    else:
+        report_destination_key = f"PRs/{pr_number}/{commit_sha}"
+
+    report_destination_key += f"/{run_id}/{report_name}"
 
     # Upload the report to S3
     s3_client = boto3.client("s3", endpoint_url=os.getenv("S3_URL"))
@@ -677,7 +921,23 @@ def main():
     except NoCredentialsError:
         print("Credentials not available for S3 upload.")
 
-    print(f"https://s3.amazonaws.com/{S3_BUCKET}/" + report_destination_key)
+    return f"https://s3.amazonaws.com/{S3_BUCKET}/" + report_destination_key
+
+
+def main():
+    args = parse_args()
+
+    report_url = create_workflow_report(
+        args.actions_run_url,
+        args.pr_number,
+        args.commit_sha,
+        args.no_upload,
+        args.known_fails,
+        args.cves,
+        args.mark_preview,
+    )
+
+    print(report_url)
 
 
 if __name__ == "__main__":
diff --git a/.github/workflows/regression-reusable-suite.yml b/.github/workflows/regression-reusable-suite.yml
new file mode 100644
index 000000000000..edf264ca88ab
--- /dev/null
+++ b/.github/workflows/regression-reusable-suite.yml
@@ -0,0 +1,183 @@
+name: Regression suite
+on:
+  workflow_call:
+    inputs:
+      ref:
+        description: "Commit SHA to checkout. Default: current (empty string)."
+        type: string
+        default: ""
+      arch:
+        required: true
+        type: string
+      extra_args:
+        required: false
+        type: string
+      suite_name:
+        required: true
+        type: string
+      suite_executable:
+        required: false
+        type: string
+        default: "regression.py"
+      timeout_minutes:
+        required: true
+        type: number
+      storage_path:
+        required: false
+        type: string
+        default: ""
+      regression_args:
+        required: false
+        type: string
+        default: ""
+      runner_type:
+        required: false
+        type: string
+        default: ""
+      job_name:
+        required: false
+        type: string
+        default: ""
+      part:
+        required: false
+        type: string
+        default: ""
+      build_sha:
+        required: false
+        type: string
+        default: ""
+jobs:
+  suite:
+    name: ${{ format('{0}{1}', inputs.job_name != '' && inputs.job_name || inputs.suite_name, inputs.part != '' && format('_{0}', inputs.part) || '') }}
+    runs-on: [
+      "self-hosted",
+      "altinity-on-demand",
+      "${{ inputs.runner_type }}",
+    ]
+    timeout-minutes: ${{ inputs.timeout_minutes }}
+    env:
+      SUITE: ${{ inputs.suite_name }}
+      SUITE_EXECUTABLE: ${{ inputs.suite_executable }}
+      STORAGE: ${{ inputs.storage_path }}
+      PART: ${{ inputs.part }}
+      REPORT_JOB_NAME: ${{ format('{0}{1}', inputs.job_name != '' && inputs.job_name || inputs.suite_name, inputs.part != '' && format('_{0}', inputs.part) || '') }}
+      # AWS credentials
+      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+      AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
+      # Docker credentials
+      DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+      DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+      # Database credentials
+      CHECKS_DATABASE_HOST: ${{ secrets.CHECKS_DATABASE_HOST }}
+      CHECKS_DATABASE_USER: ${{ secrets.CLICKHOUSE_TEST_STAT_LOGIN }}
+      CHECKS_DATABASE_PASSWORD: ${{ secrets.CLICKHOUSE_TEST_STAT_PASSWORD }}
+      # LocalStack token
+      LOCALSTACK_AUTH_TOKEN: ${{ secrets.LOCALSTACK_AUTH_TOKEN }}
+      # Python
+      PYTHONUNBUFFERED: 1
+      PYTHONIOENCODING: utf-8
+      build_sha: ${{ inputs.build_sha }}
+      pr_number: ${{ github.event.number }}
+      event_name: ${{ github.event_name }}
+      artifacts: builds
+      args: --test-to-end
+        --no-colors
+        --local
+        --collect-service-logs
+        --output classic
+        --parallel 1
+        --log raw.log
+        --with-analyzer
+      artifact_paths: |
+        ./report.html
+        ./*.log.txt
+        ./*.log
+        ./*.html
+        ./*/_instances/*.log
+        ./*/_instances/*/logs/*.log
+        ./*/*/_instances/*/logs/*.log
+        ./*/*/_instances/*.log
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          repository: Altinity/clickhouse-regression
+          ref: ${{ inputs.ref }}
+
+      - name: Set envs
+        run: |
+          cat >> "$GITHUB_ENV" << 'EOF'
+          REPORTS_PATH=${{ runner.temp }}/reports_dir
+          EOF
+
+      - name: Download json reports
+        uses: actions/download-artifact@v4
+        with:
+          path: ${{ env.REPORTS_PATH }}
+          name: build_report_package_${{ inputs.arch }}
+
+      - name: Rename reports
+        run: |
+          mv ${{ env.REPORTS_PATH }}/build_report_*.json ${{ env.REPORTS_PATH }}/build_report_package_${{ inputs.arch }}.json
+
+      - name: Setup
+        run: .github/setup.sh
+
+      - name: Get deb url
+        run: python3 .github/get-deb-url.py --reports-path ${{ env.REPORTS_PATH }} --github-env $GITHUB_ENV
+
+      - name: Process regression args
+        run: |
+          REGRESSION_ARGS='${{ inputs.regression_args }}'
+          # AWS replacements
+          REGRESSION_ARGS="${REGRESSION_ARGS//'{{AWS_BUCKET}}'/${{ secrets.REGRESSION_AWS_S3_BUCKET }}}"
+          REGRESSION_ARGS="${REGRESSION_ARGS//'{{AWS_REGION}}'/${{ secrets.REGRESSION_AWS_S3_REGION }}}"
+          REGRESSION_ARGS="${REGRESSION_ARGS//'{{AWS_KEY_ID}}'/${{ secrets.REGRESSION_AWS_S3_KEY_ID }}}"
+          REGRESSION_ARGS="${REGRESSION_ARGS//'{{AWS_ACCESS_KEY}}'/${{ secrets.REGRESSION_AWS_S3_SECRET_ACCESS_KEY }}}"
+          # GCS replacements
+          REGRESSION_ARGS="${REGRESSION_ARGS//'{{GCS_URI}}'/${{ secrets.REGRESSION_GCS_URI }}}"
+          REGRESSION_ARGS="${REGRESSION_ARGS//'{{GCS_KEY_ID}}'/${{ secrets.REGRESSION_GCS_KEY_ID }}}"
+          REGRESSION_ARGS="${REGRESSION_ARGS//'{{GCS_KEY_SECRET}}'/${{ secrets.REGRESSION_GCS_KEY_SECRET }}}"
+          # Azure replacements
+          REGRESSION_ARGS="${REGRESSION_ARGS//'{{AZURE_ACCOUNT_NAME}}'/${{ secrets.AZURE_ACCOUNT_NAME }}}"
+          REGRESSION_ARGS="${REGRESSION_ARGS//'{{AZURE_STORAGE_KEY}}'/${{ secrets.AZURE_STORAGE_KEY }}}"
+          REGRESSION_ARGS="${REGRESSION_ARGS//'{{AZURE_CONTAINER_NAME}}'/${{ secrets.AZURE_CONTAINER_NAME }}}"
+          echo "REGRESSION_ARGS=$REGRESSION_ARGS" >> $GITHUB_ENV
+
+      - name: Run ${{ env.SUITE }} suite
+        id: run_suite
+        run: EXITCODE=0;
+          python3
+          -u ${{ env.SUITE }}/${{ env.SUITE_EXECUTABLE }}
+          --clickhouse-binary-path ${{ env.clickhouse_path }}
+          ${{ env.REGRESSION_ARGS }}
+          ${{ inputs.extra_args }}
+          --attr project="$GITHUB_REPOSITORY" project.id="$GITHUB_REPOSITORY_ID" package="${{ env.clickhouse_path }}" version="${{ env.version }}" user.name="$GITHUB_ACTOR" repository="https://github.com/Altinity/clickhouse-regression" commit.hash="$(git rev-parse HEAD)" job.name="$REPORT_JOB_NAME" job.retry=$GITHUB_RUN_ATTEMPT job.url="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" arch="$(uname -i)"
+          ${{ env.args }} || EXITCODE=$?;
+          .github/add_link_to_logs.sh;
+          exit $EXITCODE
+
+      - name: Set Commit Status
+        if: always()
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          JOB_OUTCOME: ${{ steps.run_suite.outcome }}
+          SUITE_NAME: ${{ format('Regression {0} {1}{2}', inputs.arch, inputs.job_name != '' && inputs.job_name || inputs.suite_name, inputs.part != '' && format('_{0}', inputs.part) || '') }}
+        run: python3 .github/set_builds_status.py
+
+      - name: Create and upload logs
+        if: always()
+        run: .github/create_and_upload_logs.sh 1
+
+      - name: Upload logs to results database
+        if: always()
+        timeout-minutes: 30
+        run: .github/upload_results_to_database.sh 1
+
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: ${{ format('{0}{1}-{2}-artifacts', inputs.job_name != '' && inputs.job_name || inputs.suite_name, inputs.part != '' && format('_{0}', inputs.part) || '', inputs.arch) }}
+          path: ${{ env.artifact_paths }}
diff --git a/.github/workflows/regression.yml b/.github/workflows/regression.yml
index bcd054d15dff..c23693bd330c 100644
--- a/.github/workflows/regression.yml
+++ b/.github/workflows/regression.yml
@@ -3,7 +3,7 @@ name: Regression test workflow - Release
   workflow_call:
     inputs:
       runner_type:
-        description: the label of runner to use, can be a simple string or a comma-separated list
+        description: the (meta-)label of runner to use
         required: true
         type: string
       commit:
@@ -85,328 +85,86 @@ name: Regression test workflow - Release
         description: gcs uri used for regression tests.
         required: true
 
-env:
-  # Force the stdout and stderr streams to be unbuffered
-  PYTHONUNBUFFERED: 1
-  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-  AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
-  DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-  DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
-  CHECKS_DATABASE_HOST: ${{ secrets.CHECKS_DATABASE_HOST }}
-  CHECKS_DATABASE_USER: ${{ secrets.CLICKHOUSE_TEST_STAT_LOGIN }}
-  CHECKS_DATABASE_PASSWORD:  ${{ secrets.CLICKHOUSE_TEST_STAT_PASSWORD }}
-  args: --test-to-end
-    --no-colors
-    --local
-    --collect-service-logs
-    --output new-fails
-    --parallel 1
-    --log raw.log
-    --with-analyzer
-  artifacts: builds
-  artifact_paths: |
-    ./report.html
-    ./*.log.txt
-    ./*.log
-    ./*.html
-    ./*/_instances/*.log
-    ./*/_instances/*/logs/*.log
-    ./*/*/_instances/*/logs/*.log
-    ./*/*/_instances/*.log
-  build_sha: ${{ inputs.build_sha }}
-  pr_number: ${{ github.event.number }}
-  event_name: ${{ github.event_name }}
-
 jobs:
-  runner_labels_setup:
-    name: Compute proper runner labels for the rest of the jobs
-    runs-on: ubuntu-latest
-    outputs:
-      runner_labels: ${{ steps.setVariables.outputs.runner_labels }}
-    steps:
-      - id: setVariables
-        name: Prepare runner_labels variables for the later steps
-        run: |
-
-          # Prepend self-hosted
-          input="self-hosted, ${input}"
-
-          # Remove all whitespace
-          input="$(echo ${input} | tr -d [:space:])"
-          # Make something like a JSON array from comma-separated list
-          input="[ '${input//\,/\'\, \'}' ]"
-
-          echo "runner_labels=$input" >> ${GITHUB_OUTPUT}
-        env:
-          input: ${{ inputs.runner_type }}
-
   Common:
     strategy:
       fail-fast: false
       matrix:
-        SUITE: [aes_encryption, atomic_insert, base_58, data_types, datetime64_extended_range, disk_level_encryption, dns, engines, example, extended_precision_data_types, functions, kafka, kerberos, key_value, lightweight_delete, memory, part_moves_between_shards, rbac, selects, session_timezone, tiered_storage, version, window_functions]
-    needs: [runner_labels_setup]
-    runs-on: ${{ fromJson(needs.runner_labels_setup.outputs.runner_labels) }}
-    timeout-minutes: ${{ inputs.timeout_minutes }}
-    steps:
-      - name: Checkout regression repo
-        uses: actions/checkout@v4
-        with:
-          repository: Altinity/clickhouse-regression
-          ref: ${{ inputs.commit }}
-      - name: Set envs
-        run: |
-          cat >> "$GITHUB_ENV" << 'EOF'
-          REPORTS_PATH=${{ runner.temp }}/reports_dir
-          SUITE=${{ matrix.SUITE }}
-          EOF
-      - name: Download json reports
-        uses: actions/download-artifact@v4
-        with:
-          path: ${{ env.REPORTS_PATH }}
-          name: build_report_package_${{ inputs.arch }}
-      - name: Rename reports
-        run: |
-          mv ${{ env.REPORTS_PATH }}/build_report_*.json ${{ env.REPORTS_PATH }}/build_report_package_${{ inputs.arch }}.json
-      - name: Setup
-        run: .github/setup.sh
-      - name: Get deb url
-        run: python3 .github/get-deb-url.py --reports-path ${{ env.REPORTS_PATH }} --github-env $GITHUB_ENV
-      - name: Run ${{ env.SUITE }} suite
-        id: run_suite
-        run: EXITCODE=0;
-              python3
-              -u ${{ env.SUITE }}/regression.py
-              --clickhouse-binary-path ${{ env.clickhouse_path }}
-              --attr project="$GITHUB_REPOSITORY" project.id="$GITHUB_REPOSITORY_ID" package="${{ env.clickhouse_path }}" version="${{ env.version }}" user.name="$GITHUB_ACTOR" repository="https://github.com/Altinity/clickhouse-regression" commit.hash="$(git rev-parse HEAD)" job.name="$GITHUB_JOB (${{ matrix.SUITE }})" job.retry=$GITHUB_RUN_ATTEMPT job.url="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" arch="$(uname -i)"
-              ${{ env.args }} || EXITCODE=$?;
-              .github/add_link_to_logs.sh;
-              exit $EXITCODE
-      - name: Set Commit Status
-        if: always()
-        run: python3 .github/set_builds_status.py
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          JOB_OUTCOME: ${{ steps.run_suite.outcome }}
-          SUITE_NAME: "Regression ${{ inputs.arch }} ${{ matrix.SUITE }}"
-      - name: Create and upload logs
-        if: always()
-        run: .github/create_and_upload_logs.sh 1
-      - name: Upload logs to regression results database
-        if: always()
-        timeout-minutes: 20
-        run: .github/upload_results_to_database.sh 1
-      - uses: actions/upload-artifact@v4
-        if: always()
-        with:
-          name: ${{ env.SUITE }}-${{ inputs.arch }}-artifacts
-          path: ${{ env.artifact_paths}}
+        SUITE: [aes_encryption, atomic_insert, base_58, clickhouse_keeper_failover, data_types, datetime64_extended_range, disk_level_encryption, dns, engines, example, extended_precision_data_types, functions, jwt_authentication, kafka, kerberos, key_value, lightweight_delete, memory, part_moves_between_shards, selects, session_timezone, settings, swarms, version, window_functions]
+    uses: ./.github/workflows/regression-reusable-suite.yml
+    with:
+      ref: ${{ inputs.commit }}
+      arch: ${{ inputs.arch }}
+      suite_name: ${{ matrix.SUITE }}
+      suite_executable: regression.py
+      timeout_minutes: ${{ inputs.timeout_minutes }}
+      runner_type: ${{ inputs.runner_type }}
+      build_sha: ${{ inputs.build_sha }}
+      job_name: ${{ matrix.SUITE }}
+    secrets: inherit
 
   AggregateFunctions:
     strategy:
       fail-fast: false
       matrix:
         PART: [1, 2, 3]
-    needs: [runner_labels_setup]
-    runs-on: ${{ fromJson(needs.runner_labels_setup.outputs.runner_labels) }}
-    timeout-minutes: ${{ inputs.timeout_minutes }}
-    steps:
-      - name: Checkout regression repo
-        uses: actions/checkout@v4
-        with:
-          repository: Altinity/clickhouse-regression
-          ref: ${{ inputs.commit }}
-      - name: Set envs
-        run: |
-          cat >> "$GITHUB_ENV" << 'EOF'
-          REPORTS_PATH=${{ runner.temp }}/reports_dir
-          SUITE=aggregate_functions
-          PART=${{ matrix.PART }}
-          EOF
-      - name: Download json reports
-        uses: actions/download-artifact@v4
-        with:
-          path: ${{ env.REPORTS_PATH }}
-          name: build_report_package_${{ inputs.arch }}
-      - name: Rename reports
-        run: |
-          mv ${{ env.REPORTS_PATH }}/build_report_*.json ${{ env.REPORTS_PATH }}/build_report_package_${{ inputs.arch }}.json
-      - name: Setup
-        run: .github/setup.sh
-      - name: Get deb url
-        run: python3 .github/get-deb-url.py --reports-path ${{ env.REPORTS_PATH }} --github-env $GITHUB_ENV
-      - name: Run ${{ env.SUITE }} suite
-        id: run_suite
-        run: EXITCODE=0;
-              python3
-              -u ${{ env.SUITE }}/regression.py
-              --clickhouse-binary-path ${{ env.clickhouse_path }}
-              --attr project="$GITHUB_REPOSITORY" project.id="$GITHUB_REPOSITORY_ID" package="${{ env.clickhouse_path }}" version="${{ env.version }}" user.name="$GITHUB_ACTOR" repository="https://github.com/Altinity/clickhouse-regression" commit.hash="$(git rev-parse HEAD)" job.name="$GITHUB_JOB (${{ matrix.PART }})" job.retry=$GITHUB_RUN_ATTEMPT job.url="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" arch="$(uname -i)"
-              --only "part ${{ matrix.PART }}/*"
-              ${{ env.args }} || EXITCODE=$?;
-              .github/add_link_to_logs.sh;
-              exit $EXITCODE
-      - name: Set Commit Status
-        if: always()
-        run: python3 .github/set_builds_status.py
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          JOB_OUTCOME: ${{ steps.run_suite.outcome }}
-          SUITE_NAME: "Regression ${{ inputs.arch }} ${{ env.SUITE }}-${{ matrix.PART }}"
-      - name: Create and upload logs
-        if: always()
-        run: .github/create_and_upload_logs.sh 1
-      - name: Upload logs to regression results database
-        if: always()
-        timeout-minutes: 20
-        run: .github/upload_results_to_database.sh 1
-      - uses: actions/upload-artifact@v4
-        if: always()
-        with:
-          name: ${{ env.SUITE }}-${{ matrix.PART }}-${{ inputs.arch }}-artifacts
-          path: ${{ env.artifact_paths}}
+    uses: ./.github/workflows/regression-reusable-suite.yml
+    with:
+      ref: ${{ inputs.commit }}
+      arch: ${{ inputs.arch }}
+      suite_name: aggregate_functions
+      suite_executable: regression.py
+      timeout_minutes: ${{ inputs.timeout_minutes }}
+      runner_type: ${{ inputs.runner_type }}
+      part: ${{ matrix.PART }}
+      build_sha: ${{ inputs.build_sha }}
+      job_name: aggregate_functions
+      extra_args: --only "part ${{ matrix.PART }}/*"
+    secrets: inherit
+
   Alter:
-   strategy:
-     fail-fast: false
-     matrix:
-      ONLY: [replace, move]
-      include:
-        - ONLY: attach
-          PART: 1
-        - ONLY: attach
-          PART: 2
-   needs: [runner_labels_setup]
-   runs-on: ${{ fromJson(needs.runner_labels_setup.outputs.runner_labels) }}
-   timeout-minutes: ${{ inputs.timeout_minutes }}
-   steps:
-      - name: Checkout regression repo
-        uses: actions/checkout@v4
-        with:
-          repository: Altinity/clickhouse-regression
-          ref: ${{ inputs.commit }}
-      - name: Set envs
-        run: |
-          cat >> "$GITHUB_ENV" << 'EOF'
-          REPORTS_PATH=${{ runner.temp }}/reports_dir
-          SUITE=alter
-          STORAGE=/${{ matrix.ONLY }}_partition
-          PART='${{ matrix.PART }}'
-          EOF
-      - name: Download json reports
-        uses: actions/download-artifact@v4
-        with:
-          path: ${{ env.REPORTS_PATH }}
-          name: build_report_package_${{ inputs.arch }}
-      - name: Rename reports
-        run: |
-          mv ${{ env.REPORTS_PATH }}/build_report_*.json ${{ env.REPORTS_PATH }}/build_report_package_${{ inputs.arch }}.json
-      - name: Setup
-        run: .github/setup.sh
-      - name: Get deb url
-        run: python3 .github/get-deb-url.py --reports-path ${{ env.REPORTS_PATH }} --github-env $GITHUB_ENV
-      - name: Run ${{ env.SUITE }} suite
-        id: run_suite
-        run:  EXITCODE=0;
-              python3
-              -u alter/regression.py
-              --clickhouse-binary-path ${{ env.clickhouse_path }}
-              --only "/alter/${{ matrix.ONLY }} partition/${{ matrix.PART && format('part {0}/', matrix.PART) || '' }}*"
-              --attr project="$GITHUB_REPOSITORY" project.id="$GITHUB_REPOSITORY_ID" package="${{ env.clickhouse_path }}" version="${{ env.version }}" user.name="$GITHUB_ACTOR" repository="https://github.com/Altinity/clickhouse-regression" commit.hash="$(git rev-parse HEAD)" job.name="$GITHUB_JOB (${{ matrix.ONLY }}${{ matrix.PART }})" job.retry=$GITHUB_RUN_ATTEMPT job.url="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" arch="$(uname -i)"
-              ${{ env.args }} || EXITCODE=$?;
-              .github/add_link_to_logs.sh;
-              exit $EXITCODE
-      - name: Set Commit Status
-        if: always()
-        run: python3 .github/set_builds_status.py
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          JOB_OUTCOME: ${{ steps.run_suite.outcome }}
-          SUITE_NAME: "Regression ${{ inputs.arch }} Alter ${{ matrix.ONLY }} partition ${{ matrix.PART }}"
-      - name: Create and upload logs
-        if: always()
-        run: .github/create_and_upload_logs.sh 1
-      - name: Upload logs to regression results database
-        if: always()
-        timeout-minutes: 20
-        run: .github/upload_results_to_database.sh 1
-      - uses: actions/upload-artifact@v4
-        if: always()
-        with:
-          name: alter-${{ matrix.ONLY }}${{ matrix.PART && format('-{0}', matrix.PART) || '' }}-${{ inputs.arch }}-artifacts
-          path: ${{ env.artifact_paths}}
+    strategy:
+      fail-fast: false
+      matrix:
+        ONLY: [replace, move]
+        include:
+          - ONLY: attach
+            PART: 1
+          - ONLY: attach
+            PART: 2
+    uses: ./.github/workflows/regression-reusable-suite.yml
+    with:
+      ref: ${{ inputs.commit }}
+      arch: ${{ inputs.arch }}
+      suite_name: alter
+      suite_executable: regression.py
+      timeout_minutes: ${{ inputs.timeout_minutes }}
+      runner_type: ${{ inputs.runner_type }}
+      storage_path: /${{ matrix.ONLY }}_partition
+      part: ${{ matrix.PART }}
+      build_sha: ${{ inputs.build_sha }}
+      job_name: alter_${{ matrix.ONLY }}
+      extra_args: --only "/alter/${{ matrix.ONLY }} partition/${{ matrix.PART && format('part {0}/', matrix.PART) || '' }}*"
+    secrets: inherit
 
   Benchmark:
     strategy:
       fail-fast: false
       matrix:
         STORAGE: [minio, aws_s3, gcs]
-    needs: [runner_labels_setup]
-    runs-on: ${{ fromJson(needs.runner_labels_setup.outputs.runner_labels) }}
-    timeout-minutes: ${{ inputs.timeout_minutes }}
-    steps:
-      - name: Checkout regression repo
-        uses: actions/checkout@v4
-        with:
-          repository: Altinity/clickhouse-regression
-          ref: ${{ inputs.commit }}
-      - name: Set envs
-        run: |
-          cat >> "$GITHUB_ENV" << 'EOF'
-          REPORTS_PATH=${{ runner.temp }}/reports_dir
-          SUITE=ontime_benchmark
-          STORAGE=/${{ matrix.STORAGE }}
-          EOF
-      - name: Download json reports
-        uses: actions/download-artifact@v4
-        with:
-          path: ${{ env.REPORTS_PATH }}
-          name: build_report_package_${{ inputs.arch }}
-      - name: Rename reports
-        run: |
-          mv ${{ env.REPORTS_PATH }}/build_report_*.json ${{ env.REPORTS_PATH }}/build_report_package_${{ inputs.arch }}.json
-      - name: Setup
-        run: .github/setup.sh
-      - name: Get deb url
-        run: python3 .github/get-deb-url.py --reports-path ${{ env.REPORTS_PATH }} --github-env $GITHUB_ENV
-
-      - name: Run ${{ env.SUITE }} suite
-        id: run_suite
-        run:  EXITCODE=0;
-              python3
-              -u ${{ env.SUITE }}/benchmark.py
-              --clickhouse-binary-path ${{ env.clickhouse_path }}
-              --storage ${{ matrix.STORAGE }}
-              --gcs-uri ${{ secrets.REGRESSION_GCS_URI }}
-              --gcs-key-id ${{ secrets.REGRESSION_GCS_KEY_ID }}
-              --gcs-key-secret ${{ secrets.REGRESSION_GCS_KEY_SECRET }}
-              --aws-s3-bucket ${{ secrets.REGRESSION_AWS_S3_BUCKET }}
-              --aws-s3-region ${{ secrets.REGRESSION_AWS_S3_REGION }}
-              --aws-s3-key-id ${{ secrets.REGRESSION_AWS_S3_KEY_ID }}
-              --aws-s3-access-key ${{ secrets.REGRESSION_AWS_S3_SECRET_ACCESS_KEY }}
-              --attr project="$GITHUB_REPOSITORY" project.id="$GITHUB_REPOSITORY_ID" package="${{ env.clickhouse_path }}" version="${{ env.version }}" user.name="$GITHUB_ACTOR" repository="https://github.com/Altinity/clickhouse-regression" commit.hash="$(git rev-parse HEAD)" job.name="$GITHUB_JOB (${{ matrix.STORAGE }})" job.retry=$GITHUB_RUN_ATTEMPT job.url="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" arch="$(uname -i)"
-              ${{ env.args }} || EXITCODE=$?;
-              .github/add_link_to_logs.sh;
-              exit $EXITCODE
-      - name: Set Commit Status
-        if: always()
-        run: python3 .github/set_builds_status.py
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          JOB_OUTCOME: ${{ steps.run_suite.outcome }}
-          SUITE_NAME: "Regression ${{ inputs.arch }} Benchmark ${{ matrix.STORAGE }}"
-      - name: Create and upload logs
-        if: always()
-        run: .github/create_and_upload_logs.sh 1
-      - name: Upload logs to regression results database
-        if: always()
-        timeout-minutes: 20
-        run: .github/upload_results_to_database.sh 1
-      - uses: actions/upload-artifact@v4
-        if: always()
-        with:
-          name: benchmark-${{ matrix.STORAGE }}-${{ inputs.arch }}-artifacts
-          path: ${{ env.artifact_paths }}
+    uses: ./.github/workflows/regression-reusable-suite.yml
+    with:
+      ref: ${{ inputs.commit }}
+      arch: ${{ inputs.arch }}
+      suite_name: ontime_benchmark
+      suite_executable: benchmark.py
+      timeout_minutes: ${{ inputs.timeout_minutes }}
+      runner_type: ${{ inputs.runner_type }}
+      storage_path: /${{ matrix.STORAGE }}
+      build_sha: ${{ inputs.build_sha }}
+      job_name: benchmark_${{ matrix.STORAGE }}
+      regression_args: --storage ${{ matrix.STORAGE }} --gcs-uri {{GCS_URI}} --gcs-key-id {{GCS_KEY_ID}} --gcs-key-secret {{GCS_KEY_SECRET}} --aws-s3-bucket {{AWS_BUCKET}} --aws-s3-region {{AWS_REGION}} --aws-s3-key-id {{AWS_KEY_ID}} --aws-s3-access-key {{AWS_ACCESS_KEY}}
+    secrets: inherit
 
   ClickHouseKeeper:
     strategy:
@@ -414,318 +172,126 @@ jobs:
       matrix:
         PART: [1, 2]
         SSL: [ssl, no_ssl]
-    needs: [runner_labels_setup]
-    runs-on: ${{ fromJson(needs.runner_labels_setup.outputs.runner_labels) }}
-    timeout-minutes: ${{ inputs.timeout_minutes }}
-    steps:
-      - name: Checkout regression repo
-        uses: actions/checkout@v4
-        with:
-          repository: Altinity/clickhouse-regression
-          ref: ${{ inputs.commit }}
-      - name: Set envs
-        run: |
-          cat >> "$GITHUB_ENV" << 'EOF'
-          REPORTS_PATH=${{runner.temp}}/reports_dir
-          SUITE=clickhouse_keeper
-          STORAGE=/${{ matrix.SSL }}
-          PART=${{ matrix.PART }}
-          SSL=${{ matrix.SSL == 'ssl' && '--ssl' || '' }}
-          EOF
-      - name: Download json reports
-        uses: actions/download-artifact@v4
-        with:
-          path: ${{ env.REPORTS_PATH }}
-          name: build_report_package_${{ inputs.arch }}
-      - name: Rename reports
-        run: |
-          mv ${{ env.REPORTS_PATH }}/build_report_*.json ${{ env.REPORTS_PATH }}/build_report_package_${{ inputs.arch }}.json
-      - name: Setup
-        run: .github/setup.sh
-      - name: Get deb url
-        run: python3 .github/get-deb-url.py --reports-path ${{ env.REPORTS_PATH }} --github-env $GITHUB_ENV
-      - name: Run ${{ env.SUITE }} suite
-        id: run_suite
-        run:  EXITCODE=0;
-              python3
-              -u ${{ env.SUITE }}/regression.py ${{ env.SSL }}
-              --clickhouse-binary-path ${{ env.clickhouse_path }}
-              --attr project="$GITHUB_REPOSITORY" project.id="$GITHUB_REPOSITORY_ID" package="${{ env.clickhouse_path }}" version="${{ env.version }}" user.name="$GITHUB_ACTOR" repository="https://github.com/Altinity/clickhouse-regression" commit.hash="$(git rev-parse HEAD)" job.name="$GITHUB_JOB (${{ matrix.PART }}, ${{ matrix.SSL }})" job.retry=$GITHUB_RUN_ATTEMPT job.url="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" arch="$(uname -i)"
-              --only "part ${{ matrix.PART }}/*"
-              ${{ env.args }} || EXITCODE=$?;
-              .github/add_link_to_logs.sh;
-              exit $EXITCODE
-      - name: Set Commit Status
-        if: always()
-        run: python3 .github/set_builds_status.py
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          JOB_OUTCOME: ${{ steps.run_suite.outcome }}
-          SUITE_NAME: "Regression ${{ inputs.arch }} Clickhouse Keeper ${{ matrix.SSL }} ${{ matrix.PART }}"
-      - name: Create and upload logs
-        if: always()
-        run: .github/create_and_upload_logs.sh 1
-      - name: Upload logs to regression results database
-        if: always()
-        timeout-minutes: 20
-        run: .github/upload_results_to_database.sh 1
-      - uses: actions/upload-artifact@v4
-        if: always()
-        with:
-          name: ${{ env.SUITE }}-${{ matrix.PART }}-${{ inputs.arch }}-${{ matrix.SSL }}-artifacts
-          path: ${{ env.artifact_paths }}
+    uses: ./.github/workflows/regression-reusable-suite.yml
+    with:
+      ref: ${{ inputs.commit }}
+      arch: ${{ inputs.arch }}
+      suite_name: clickhouse_keeper
+      suite_executable: regression.py
+      timeout_minutes: ${{ inputs.timeout_minutes }}
+      runner_type: ${{ inputs.runner_type }}
+      storage_path: /${{ matrix.SSL }}
+      part: ${{ matrix.PART }}
+      build_sha: ${{ inputs.build_sha }}
+      job_name: clickhouse_keeper_${{ matrix.SSL }}
+      extra_args: ${{ matrix.SSL == 'ssl' && '--ssl' || '' }} --only "part ${{ matrix.PART }}/*"
+    secrets: inherit
+
+  Iceberg:
+    strategy:
+      fail-fast: false
+      matrix:
+        PART: [1, 2]
+    uses: ./.github/workflows/regression-reusable-suite.yml
+    with:
+      ref: ${{ inputs.commit }}
+      arch: ${{ inputs.arch }}
+      suite_name: iceberg
+      suite_executable: regression.py
+      timeout_minutes: ${{ inputs.timeout_minutes }}
+      runner_type: ${{ inputs.runner_type }}
+      part: ${{ matrix.PART }}
+      build_sha: ${{ inputs.build_sha }}
+      job_name: iceberg
+      extra_args: --only ${{ matrix.PART == 1 && '"/iceberg/iceberg engine/rest catalog/*" "/iceberg/s3 table function/*" "/iceberg/icebergS3 table function/*" "/iceberg/iceberg cache/*"' || '"/iceberg/iceberg engine/glue catalog/*" "/iceberg/iceberg table engine/*"' }}
+    secrets: inherit
 
   LDAP:
     strategy:
       fail-fast: false
       matrix:
         SUITE: [authentication, external_user_directory, role_mapping]
-    needs: [runner_labels_setup]
-    runs-on: ${{ fromJson(needs.runner_labels_setup.outputs.runner_labels) }}
-    timeout-minutes: ${{ inputs.timeout_minutes }}
-    steps:
-      - name: Checkout regression repo
-        uses: actions/checkout@v4
-        with:
-          repository: Altinity/clickhouse-regression
-          ref: ${{ inputs.commit }}
-      - name: Set envs
-        run: |
-          cat >> "$GITHUB_ENV" << 'EOF'
-          REPORTS_PATH=${{ runner.temp }}/reports_dir
-          SUITE=ldap/${{ matrix.SUITE }}
-          EOF
-      - name: Download json reports
-        uses: actions/download-artifact@v4
-        with:
-          path: ${{ env.REPORTS_PATH }}
-          name: build_report_package_${{ inputs.arch }}
-      - name: Rename reports
-        run: |
-          mv ${{ env.REPORTS_PATH }}/build_report_*.json ${{ env.REPORTS_PATH }}/build_report_package_${{ inputs.arch }}.json
-      - name: Setup
-        run: .github/setup.sh
-      - name: Get deb url
-        run: python3 .github/get-deb-url.py --reports-path ${{ env.REPORTS_PATH }} --github-env $GITHUB_ENV
-      - name: Run ${{ env.SUITE }} suite
-        id: run_suite
-        run:  EXITCODE=0;
-              python3
-              -u ${{ env.SUITE }}/regression.py
-              --clickhouse-binary-path ${{ env.clickhouse_path }}
-              --attr project="$GITHUB_REPOSITORY" project.id="$GITHUB_REPOSITORY_ID" package="${{ env.clickhouse_path }}" version="${{ env.version }}" user.name="$GITHUB_ACTOR" repository="https://github.com/Altinity/clickhouse-regression" commit.hash="$(git rev-parse HEAD)" job.name="$GITHUB_JOB (${{ matrix.SUITE }})" job.retry=$GITHUB_RUN_ATTEMPT job.url="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" arch="$(uname -i)"
-              ${{ env.args }} || EXITCODE=$?;
-              .github/add_link_to_logs.sh;
-              exit $EXITCODE
-      - name: Set Commit Status
-        if: always()
-        run: python3 .github/set_builds_status.py
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          JOB_OUTCOME: ${{ steps.run_suite.outcome }}
-          SUITE_NAME: "Regression ${{ inputs.arch }} LDAP ${{ matrix.SUITE }}"
-      - name: Create and upload logs
-        if: always()
-        run: .github/create_and_upload_logs.sh 1
-      - name: Upload logs to regression results database
-        if: always()
-        timeout-minutes: 20
-        run: .github/upload_results_to_database.sh 1
-      - uses: actions/upload-artifact@v4
-        if: always()
-        with:
-          name: ldap-${{ matrix.SUITE }}-${{ inputs.arch }}-artifacts
-          path: ${{ env.artifact_paths }}
+    uses: ./.github/workflows/regression-reusable-suite.yml
+    with:
+      ref: ${{ inputs.commit }}
+      arch: ${{ inputs.arch }}
+      suite_name: ldap/${{ matrix.SUITE }}
+      suite_executable: regression.py
+      timeout_minutes: ${{ inputs.timeout_minutes }}
+      runner_type: ${{ inputs.runner_type }}
+      build_sha: ${{ inputs.build_sha }}
+      job_name: ldap_${{ matrix.SUITE }}
+    secrets: inherit
 
   Parquet:
-    needs: [runner_labels_setup]
-    runs-on: ${{ fromJson(needs.runner_labels_setup.outputs.runner_labels) }}
-    timeout-minutes: ${{ inputs.timeout_minutes }}
-    steps:
-      - name: Checkout regression repo
-        uses: actions/checkout@v4
-        with:
-          repository: Altinity/clickhouse-regression
-          ref: ${{ inputs.commit }}
-      - name: Set envs
-        run: |
-          cat >> "$GITHUB_ENV" << 'EOF'
-          REPORTS_PATH=${{ runner.temp }}/reports_dir
-          SUITE=parquet
-          EOF
-      - name: Download json reports
-        uses: actions/download-artifact@v4
-        with:
-          path: ${{ env.REPORTS_PATH }}
-          name: build_report_package_${{ inputs.arch }}
-      - name: Rename reports
-        run: |
-          mv ${{ env.REPORTS_PATH }}/build_report_*.json ${{ env.REPORTS_PATH }}/build_report_package_${{ inputs.arch }}.json
-      - name: Setup
-        run: .github/setup.sh
-      - name: Get deb url
-        run: python3 .github/get-deb-url.py --reports-path ${{ env.REPORTS_PATH }} --github-env $GITHUB_ENV
-      - name: Run ${{ env.SUITE }} suite
-        id: run_suite
-        run:  EXITCODE=0;
-              python3
-              -u ${{ env.SUITE }}/regression.py
-              --clickhouse-binary-path ${{ env.clickhouse_path }}
-              --attr project="$GITHUB_REPOSITORY" project.id="$GITHUB_REPOSITORY_ID" package="${{ env.clickhouse_path }}" version="${{ env.version }}" user.name="$GITHUB_ACTOR" repository="https://github.com/Altinity/clickhouse-regression" commit.hash="$(git rev-parse HEAD)" job.name=$GITHUB_JOB job.retry=$GITHUB_RUN_ATTEMPT job.url="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" arch="$(uname -i)"
-              ${{ env.args }} || EXITCODE=$?;
-              .github/add_link_to_logs.sh;
-              exit $EXITCODE
-      - name: Set Commit Status
-        if: always()
-        run: python3 .github/set_builds_status.py
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          JOB_OUTCOME: ${{ steps.run_suite.outcome }}
-          SUITE_NAME: "Regression ${{ inputs.arch }} Parquet"
-      - name: Create and upload logs
-        if: always()
-        run: .github/create_and_upload_logs.sh 1
-      - name: Upload logs to regression results database
-        if: always()
-        timeout-minutes: 20
-        run: .github/upload_results_to_database.sh 1
-      - uses: actions/upload-artifact@v4
-        if: always()
-        with:
-          name: ${{ env.SUITE }}-${{ inputs.arch }}-artifacts
-          path: ${{ env.artifact_paths }}
+    uses: ./.github/workflows/regression-reusable-suite.yml
+    with:
+      ref: ${{ inputs.commit }}
+      arch: ${{ inputs.arch }}
+      suite_name: parquet
+      suite_executable: regression.py
+      timeout_minutes: ${{ inputs.timeout_minutes }}
+      runner_type: ${{ inputs.runner_type }}
+      build_sha: ${{ inputs.build_sha }}
+      job_name: parquet
+    secrets: inherit
 
   ParquetS3:
     strategy:
       fail-fast: false
       matrix:
         STORAGE: [minio, aws_s3]
-    needs: [runner_labels_setup]
-    runs-on: ${{ fromJson(needs.runner_labels_setup.outputs.runner_labels) }}
-    timeout-minutes: ${{ inputs.timeout_minutes }}
-    steps:
-      - name: Checkout regression repo
-        uses: actions/checkout@v4
-        with:
-          repository: Altinity/clickhouse-regression
-          ref: ${{ inputs.commit }}
-      - name: Set envs
-        run: |
-          cat >> "$GITHUB_ENV" << 'EOF'
-          REPORTS_PATH=${{ runner.temp }}/reports_dir
-          SUITE=parquet
-          STORAGE=${{ matrix.STORAGE}}
-          EOF
-      - name: Download json reports
-        uses: actions/download-artifact@v4
-        with:
-          path: ${{ env.REPORTS_PATH }}
-          name: build_report_package_${{ inputs.arch }}
-      - name: Rename reports
-        run: |
-          mv ${{ env.REPORTS_PATH }}/build_report_*.json ${{ env.REPORTS_PATH }}/build_report_package_${{ inputs.arch }}.json
-      - name: Setup
-        run: .github/setup.sh
-      - name: Get deb url
-        run: python3 .github/get-deb-url.py --reports-path ${{ env.REPORTS_PATH }} --github-env $GITHUB_ENV
-      - name: Run ${{ env.SUITE }} suite
-        id: run_suite
-        run:  EXITCODE=0;
-              python3
-              -u ${{ env.SUITE }}/regression.py
-              --clickhouse-binary-path ${{ env.clickhouse_path }}
-              --storage ${{ matrix.STORAGE }}
-              --aws-s3-bucket ${{ secrets.REGRESSION_AWS_S3_BUCKET }}
-              --aws-s3-region ${{ secrets.REGRESSION_AWS_S3_REGION }}
-              --aws-s3-key-id ${{ secrets.REGRESSION_AWS_S3_KEY_ID }}
-              --aws-s3-access-key ${{ secrets.REGRESSION_AWS_S3_SECRET_ACCESS_KEY }}
-              --attr project="$GITHUB_REPOSITORY" project.id="$GITHUB_REPOSITORY_ID" package="${{ env.clickhouse_path }}" version="${{ env.version }}" user.name="$GITHUB_ACTOR" repository="https://github.com/Altinity/clickhouse-regression" commit.hash="$(git rev-parse HEAD)" job.name="$GITHUB_JOB (${{ matrix.STORAGE }})" job.retry=$GITHUB_RUN_ATTEMPT job.url="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" arch="$(uname -i)"
-              ${{ env.args }} || EXITCODE=$?;
-              .github/add_link_to_logs.sh;
-              exit $EXITCODE
-      - name: Set Commit Status
-        if: always()
-        run: python3 .github/set_builds_status.py
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          JOB_OUTCOME: ${{ steps.run_suite.outcome }}
-          SUITE_NAME: "Regression ${{ inputs.arch }} Parquet ${{ matrix.STORAGE }}"
-      - name: Create and upload logs
-        if: always()
-        run: .github/create_and_upload_logs.sh 1
-      - name: Upload logs to regression results database
-        if: always()
-        timeout-minutes: 20
-        run: .github/upload_results_to_database.sh 1
-      - uses: actions/upload-artifact@v4
-        if: always()
-        with:
-          name: ${{ env.SUITE }}-${{ env.STORAGE }}-${{ inputs.arch }}-artifacts
-          path: ${{ env.artifact_paths }}
+    uses: ./.github/workflows/regression-reusable-suite.yml
+    with:
+      ref: ${{ inputs.commit }}
+      arch: ${{ inputs.arch }}
+      suite_name: parquet
+      suite_executable: regression.py
+      timeout_minutes: ${{ inputs.timeout_minutes }}
+      runner_type: ${{ inputs.runner_type }}
+      storage_path: ${{ matrix.STORAGE }}
+      build_sha: ${{ inputs.build_sha }}
+      job_name: parquet_${{ matrix.STORAGE }}
+      regression_args: --storage ${{ matrix.STORAGE }} --aws-s3-bucket {{AWS_BUCKET}} --aws-s3-region {{AWS_REGION}} --aws-s3-key-id {{AWS_KEY_ID}} --aws-s3-access-key {{AWS_ACCESS_KEY}}
+    secrets: inherit
+
+  RBAC:
+    strategy:
+      fail-fast: false
+      matrix:
+        PART: [1, 2, 3]
+    uses: ./.github/workflows/regression-reusable-suite.yml
+    with:
+      ref: ${{ inputs.commit }}
+      arch: ${{ inputs.arch }}
+      suite_name: rbac
+      suite_executable: regression.py
+      timeout_minutes: ${{ inputs.timeout_minutes }}
+      runner_type: ${{ inputs.runner_type }}
+      part: ${{ matrix.PART }}
+      build_sha: ${{ inputs.build_sha }}
+      job_name: rbac
+      extra_args: --only "/rbac/part ${{ matrix.PART }}/*"
+    secrets: inherit
 
   SSLServer:
     strategy:
       fail-fast: false
       matrix:
         PART: [1, 2, 3]
-    needs: [runner_labels_setup]
-    runs-on: ${{ fromJson(needs.runner_labels_setup.outputs.runner_labels) }}
-    timeout-minutes: ${{ inputs.timeout_minutes }}
-    steps:
-      - name: Checkout regression repo
-        uses: actions/checkout@v4
-        with:
-          repository: Altinity/clickhouse-regression
-          ref: ${{ inputs.commit }}
-      - name: Set envs
-        run: |
-          cat >> "$GITHUB_ENV" << 'EOF'
-          REPORTS_PATH=${{ runner.temp }}/reports_dir
-          SUITE=ssl_server
-          PART=${{ matrix.PART }}
-          EOF
-      - name: Download json reports
-        uses: actions/download-artifact@v4
-        with:
-          path: ${{ env.REPORTS_PATH }}
-          name: build_report_package_${{ inputs.arch }}
-      - name: Rename reports
-        run: |
-          mv ${{ env.REPORTS_PATH }}/build_report_*.json ${{ env.REPORTS_PATH }}/build_report_package_${{ inputs.arch }}.json
-      - name: Setup
-        run: .github/setup.sh
-      - name: Get deb url
-        run: python3 .github/get-deb-url.py --reports-path ${{ env.REPORTS_PATH }} --github-env $GITHUB_ENV
-      - name: Run ${{ env.SUITE }} suite
-        id: run_suite
-        run: EXITCODE=0;
-              python3
-              -u ${{ env.SUITE }}/regression.py
-              --clickhouse-binary-path ${{ env.clickhouse_path }}
-              --attr project="$GITHUB_REPOSITORY" project.id="$GITHUB_REPOSITORY_ID" package="${{ env.clickhouse_path }}" version="${{ env.version }}" user.name="$GITHUB_ACTOR" repository="https://github.com/Altinity/clickhouse-regression" commit.hash="$(git rev-parse HEAD)" job.name="$GITHUB_JOB (${{ matrix.PART }})" job.retry=$GITHUB_RUN_ATTEMPT job.url="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" arch="$(uname -i)"
-              --only "part ${{ matrix.PART }}/*"
-              ${{ env.args }} || EXITCODE=$?;
-              .github/add_link_to_logs.sh;
-              exit $EXITCODE
-      - name: Set Commit Status
-        if: always()
-        run: python3 .github/set_builds_status.py
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          JOB_OUTCOME: ${{ steps.run_suite.outcome }}
-          SUITE_NAME: "Regression ${{ inputs.arch }} ${{ env.SUITE }}-${{ matrix.PART }}"
-      - name: Create and upload logs
-        if: always()
-        run: .github/create_and_upload_logs.sh 1
-      - name: Upload logs to regression results database
-        if: always()
-        timeout-minutes: 20
-        run: .github/upload_results_to_database.sh 1
-      - uses: actions/upload-artifact@v4
-        if: always()
-        with:
-          name: ${{ env.SUITE }}-${{ matrix.PART }}-${{ inputs.arch }}-artifacts
-          path: ${{ env.artifact_paths}}
+    uses: ./.github/workflows/regression-reusable-suite.yml
+    with:
+      ref: ${{ inputs.commit }}
+      arch: ${{ inputs.arch }}
+      suite_name: ssl_server
+      suite_executable: regression.py
+      timeout_minutes: ${{ inputs.timeout_minutes }}
+      runner_type: ${{ inputs.runner_type }}
+      part: ${{ matrix.PART }}
+      build_sha: ${{ inputs.build_sha }}
+      job_name: ssl_server
+      extra_args: --only "part ${{ matrix.PART }}/*"
+    secrets: inherit
 
   S3:
     strategy:
@@ -736,143 +302,59 @@ jobs:
         include:
           - STORAGE: minio
             PART: 3
-    needs: [runner_labels_setup]
-    runs-on: ${{ fromJson(needs.runner_labels_setup.outputs.runner_labels) }}
-    timeout-minutes: ${{ inputs.timeout_minutes }}
-    steps:
-      - name: Checkout regression repo
-        uses: actions/checkout@v4
-        with:
-          repository: Altinity/clickhouse-regression
-          ref: ${{ inputs.commit }}
-      - name: Set envs
-        run: |
-          cat >> "$GITHUB_ENV" << 'EOF'
-          REPORTS_PATH=${{ runner.temp }}/reports_dir
-          SUITE=s3
-          PART=${{ matrix.PART }}
-          STORAGE=/${{ matrix.STORAGE }}
-          EOF
-      - name: Download json reports
-        uses: actions/download-artifact@v4
-        with:
-          path: ${{ env.REPORTS_PATH }}
-          name: build_report_package_${{ inputs.arch }}
-      - name: Rename reports
-        run: |
-          mv ${{ env.REPORTS_PATH }}/build_report_*.json ${{ env.REPORTS_PATH }}/build_report_package_${{ inputs.arch }}.json
-      - name: Setup
-        run: .github/setup.sh
-      - name: Get deb url
-        run: python3 .github/get-deb-url.py --reports-path ${{ env.REPORTS_PATH }} --github-env $GITHUB_ENV
-      - name: Run ${{ env.SUITE }} suite
-        id: run_suite
-        run:  EXITCODE=0;
-              python3
-              -u ${{ env.SUITE }}/regression.py
-              --clickhouse-binary-path ${{ env.clickhouse_path }}
-              --storage ${{ matrix.STORAGE }}
-              --gcs-uri ${{ secrets.REGRESSION_GCS_URI }}
-              --gcs-key-id ${{ secrets.REGRESSION_GCS_KEY_ID }}
-              --gcs-key-secret ${{ secrets.REGRESSION_GCS_KEY_SECRET }}
-              --aws-s3-bucket ${{ secrets.REGRESSION_AWS_S3_BUCKET }}
-              --aws-s3-region ${{ secrets.REGRESSION_AWS_S3_REGION }}
-              --aws-s3-key-id ${{ secrets.REGRESSION_AWS_S3_KEY_ID }}
-              --aws-s3-access-key ${{ secrets.REGRESSION_AWS_S3_SECRET_ACCESS_KEY }}
-              --azure-account-name ${{ secrets.AZURE_ACCOUNT_NAME }}
-              --azure-storage-key ${{ secrets.AZURE_STORAGE_KEY }}
-              --azure-container ${{ secrets.AZURE_CONTAINER_NAME }}
-              --attr project="$GITHUB_REPOSITORY" project.id="$GITHUB_REPOSITORY_ID" package="${{ env.clickhouse_path }}" version="${{ env.version }}" user.name="$GITHUB_ACTOR" repository="https://github.com/Altinity/clickhouse-regression" commit.hash="$(git rev-parse HEAD)" job.name="$GITHUB_JOB (${{ matrix.STORAGE }}-${{ matrix.PART }})" job.retry=$GITHUB_RUN_ATTEMPT job.url="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" arch="$(uname -i)"
-              --only ":/try*" ":/part ${{ matrix.PART }}/*"
-              ${{ env.args }} || EXITCODE=$?;
-              .github/add_link_to_logs.sh;
-              exit $EXITCODE
-      - name: Set Commit Status
-        if: always()
-        run: python3 .github/set_builds_status.py
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          JOB_OUTCOME: ${{ steps.run_suite.outcome }}
-          SUITE_NAME: "Regression ${{ inputs.arch }} S3 ${{ matrix.STORAGE }}-${{ matrix.PART }}"
-      - name: Create and upload logs
-        if: always()
-        run: .github/create_and_upload_logs.sh 1
-      - name: Upload logs to regression results database
-        if: always()
-        timeout-minutes: 20
-        run: .github/upload_results_to_database.sh 1
-      - uses: actions/upload-artifact@v4
-        if: always()
-        with:
-          name: ${{ env.SUITE }}-${{ matrix.STORAGE }}-${{ matrix.PART }}-${{ inputs.arch }}-artifacts
-          path: ${{ env.artifact_paths}}
+    uses: ./.github/workflows/regression-reusable-suite.yml
+    with:
+      ref: ${{ inputs.commit }}
+      arch: ${{ inputs.arch }}
+      suite_name: s3
+      suite_executable: regression.py
+      timeout_minutes: ${{ inputs.timeout_minutes }}
+      runner_type: ${{ inputs.runner_type }}
+      storage_path: /${{ matrix.STORAGE }}
+      part: ${{ matrix.PART }}
+      build_sha: ${{ inputs.build_sha }}
+      job_name: s3_${{ matrix.STORAGE }}
+      regression_args: --storage ${{ matrix.STORAGE }} --gcs-uri {{GCS_URI}} --gcs-key-id {{GCS_KEY_ID}} --gcs-key-secret {{GCS_KEY_SECRET}} --aws-s3-bucket {{AWS_BUCKET}} --aws-s3-region {{AWS_REGION}} --aws-s3-key-id {{AWS_KEY_ID}} --aws-s3-access-key {{AWS_ACCESS_KEY}} --azure-account-name {{AZURE_ACCOUNT_NAME}} --azure-storage-key {{AZURE_STORAGE_KEY}} --azure-container {{AZURE_CONTAINER_NAME}}
+      extra_args: --only ":/try*" ":/part ${{ matrix.PART }}/*"
+    secrets: inherit
+
+  S3Export:
+    strategy:
+      fail-fast: false
+      matrix:
+        PART: [part, partition]
+    uses: ./.github/workflows/regression-reusable-suite.yml
+    with:
+      ref: ${{ inputs.commit }}
+      arch: ${{ inputs.arch }}
+      suite_name: s3
+      suite_executable: regression.py
+      timeout_minutes: ${{ inputs.timeout_minutes }}
+      runner_type: ${{ inputs.runner_type }}
+      storage_path: /minio
+      part: ${{ matrix.PART }}
+      build_sha: ${{ inputs.build_sha }}
+      job_name: s3_export
+      regression_args: --storage minio
+      extra_args: --only ":/try*" "minio/export tests/export ${{ matrix.PART }}/*"
+    secrets: inherit
 
   TieredStorage:
     strategy:
       fail-fast: false
       matrix:
-        STORAGE: [minio, s3amazon, s3gcs]
-    needs: [runner_labels_setup]
-    runs-on: ${{ fromJson(needs.runner_labels_setup.outputs.runner_labels) }}
-    timeout-minutes: ${{ inputs.timeout_minutes }}
-    steps:
-      - name: Checkout regression repo
-        uses: actions/checkout@v4
-        with:
-          repository: Altinity/clickhouse-regression
-          ref: ${{ inputs.commit }}
-      - name: Set envs
-        run: |
-          cat >> "$GITHUB_ENV" << 'EOF'
-          REPORTS_PATH=${{ runner.temp }}/reports_dir
-          SUITE=tiered_storage
-          STORAGE=/${{ matrix.STORAGE }}
-          EOF
-      - name: Download json reports
-        uses: actions/download-artifact@v4
-        with:
-          path: ${{ env.REPORTS_PATH }}
-          name: build_report_package_${{ inputs.arch }}
-      - name: Rename reports
-        run: |
-          mv ${{ env.REPORTS_PATH }}/build_report_*.json ${{ env.REPORTS_PATH }}/build_report_package_${{ inputs.arch }}.json
-      - name: Setup
-        run: .github/setup.sh
-      - name: Get deb url
-        run: python3 .github/get-deb-url.py --reports-path ${{ env.REPORTS_PATH }} --github-env $GITHUB_ENV
-      - name: Run ${{ env.SUITE }} suite
-        id: run_suite
-        run:  EXITCODE=0;
-              python3
-              -u ${{ env.SUITE }}/regression.py
-              --clickhouse-binary-path ${{ env.clickhouse_path }}
-              --aws-s3-access-key ${{ secrets.REGRESSION_AWS_S3_SECRET_ACCESS_KEY }}
-              --aws-s3-key-id ${{ secrets.REGRESSION_AWS_S3_KEY_ID }}
-              --aws-s3-uri https://s3.${{ secrets.REGRESSION_AWS_S3_REGION}}.amazonaws.com/${{ secrets.REGRESSION_AWS_S3_BUCKET }}/data/
-              --gcs-key-id ${{ secrets.REGRESSION_GCS_KEY_ID }}
-              --gcs-key-secret ${{ secrets.REGRESSION_GCS_KEY_SECRET }}
-              --gcs-uri ${{ secrets.REGRESSION_GCS_URI }}
-              --with-${{ matrix.STORAGE }}
-              --attr project="$GITHUB_REPOSITORY" project.id="$GITHUB_REPOSITORY_ID" package="${{ env.clickhouse_path }}" version="${{ env.version }}" user.name="$GITHUB_ACTOR" repository="https://github.com/Altinity/clickhouse-regression" commit.hash="$(git rev-parse HEAD)" job.name="$GITHUB_JOB (${{ matrix.STORAGE }})" job.retry=$GITHUB_RUN_ATTEMPT job.url="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" arch="$(uname -i)"
-              ${{ env.args }} || EXITCODE=$?;
-              .github/add_link_to_logs.sh;
-              exit $EXITCODE
-      - name: Set Commit Status
-        if: always()
-        run: python3 .github/set_builds_status.py
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          JOB_OUTCOME: ${{ steps.run_suite.outcome }}
-          SUITE_NAME: "Regression ${{ inputs.arch }} Tiered Storage ${{ matrix.STORAGE }}"
-      - name: Create and upload logs
-        if: always()
-        run: .github/create_and_upload_logs.sh 1
-      - name: Upload logs to regression results database
-        if: always()
-        timeout-minutes: 20
-        run: .github/upload_results_to_database.sh 1
-      - uses: actions/upload-artifact@v4
-        if: always()
-        with:
-          name: ${{ env.SUITE }}-${{ matrix.STORAGE }}-${{ inputs.arch }}-artifacts
-          path: ${{ env.artifact_paths}}
+        STORAGE: [local, minio, s3amazon, s3gcs]
+    uses: ./.github/workflows/regression-reusable-suite.yml
+    with:
+      ref: ${{ inputs.commit }}
+      arch: ${{ inputs.arch }}
+      suite_name: tiered_storage
+      suite_executable: regression.py
+      timeout_minutes: ${{ inputs.timeout_minutes }}
+      runner_type: ${{ inputs.runner_type }}
+      storage_path: /${{ matrix.STORAGE }}
+      build_sha: ${{ inputs.build_sha }}
+      job_name: tiered_storage_${{ matrix.STORAGE }}
+      regression_args: --aws-s3-access-key {{AWS_ACCESS_KEY}} --aws-s3-key-id {{AWS_KEY_ID}} --aws-s3-uri https://s3.{{AWS_REGION}}.amazonaws.com/{{AWS_BUCKET}}/data/ --gcs-key-id {{GCS_KEY_ID}} --gcs-key-secret {{GCS_KEY_SECRET}} --gcs-uri {{GCS_URI}}
+      extra_args: ${{ matrix.STORAGE != 'local' && format('--with-{0}', matrix.STORAGE) || '' }}
+    secrets: inherit
diff --git a/.github/workflows/release_branches.yml b/.github/workflows/release_branches.yml
index f9a2953e0d2a..a8ff62bd04f7 100644
--- a/.github/workflows/release_branches.yml
+++ b/.github/workflows/release_branches.yml
@@ -1,5 +1,6 @@
 # yamllint disable rule:comments-indentation
 name: ReleaseBranchCI
+run-name: "${{ github.event.inputs.workflow_name || ' ' }}"
 
 env:
   # Force the stdout and stderr streams to be unbuffered
@@ -20,19 +21,22 @@ on: # yamllint disable-line rule:truthy
       - reopened
       - opened
     branches:
-      # Anything/24.8 (e.g customizations/24.8.x)
-      - '**24.8*'
+      - 'customizations/*'
+      - 'releases/*'
+      - 'stable-*'
   release:
     types:
       - published
       - prereleased
   push:
-    branches:
-      - 'releases/24.8**'
-      - 'customizations/24.8**'
     tags:
       - '*'
   workflow_dispatch:
+    inputs:
+      workflow_name:
+        description: 'Name of the workflow'
+        required: false
+        type: string
 
 jobs:
   RunConfig:
@@ -552,22 +556,22 @@ jobs:
     uses: ./.github/workflows/regression.yml
     secrets: inherit
     with:
-      runner_type: altinity-on-demand, altinity-regression-tester
-      commit: b72ac10337ea9d7a0f764b86a40f4bb7dc0f81ff
+      runner_type: altinity-regression-tester
+      commit: release
       arch: release
       build_sha: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
-      timeout_minutes: 300
+      timeout_minutes: 210
   RegressionTestsAarch64:
     needs: [RunConfig, BuilderDebAarch64]
     if: ${{ !failure() && !cancelled() && !contains(fromJson(needs.RunConfig.outputs.data).ci_settings.exclude_keywords, 'regression') && !contains(fromJson(needs.RunConfig.outputs.data).ci_settings.exclude_keywords, 'aarch64')}}
     uses: ./.github/workflows/regression.yml
     secrets: inherit
     with:
-      runner_type: altinity-on-demand, altinity-regression-tester-aarch64
-      commit: b72ac10337ea9d7a0f764b86a40f4bb7dc0f81ff
+      runner_type: altinity-regression-tester-aarch64
+      commit: release
       arch: aarch64
       build_sha: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
-      timeout_minutes: 300
+      timeout_minutes: 210
   SignRelease:
     needs: [RunConfig, BuilderDebRelease]
     if: ${{ !failure() && !cancelled() }}
@@ -641,6 +645,7 @@ jobs:
       - RegressionTestsAarch64
       - GrypeScan
       - SignRelease
+      - SignAarch64
     runs-on: [self-hosted, altinity-on-demand, altinity-style-checker-aarch64]
     steps:
       - name: Check out repository code
diff --git a/.github/workflows/reusable_sign.yml b/.github/workflows/reusable_sign.yml
index fee2f9131469..67c79a8d2124 100644
--- a/.github/workflows/reusable_sign.yml
+++ b/.github/workflows/reusable_sign.yml
@@ -160,7 +160,9 @@ jobs:
         uses: actions/upload-artifact@v4
         with:
           name: ${{inputs.test_name}} signed-hashes
-          path: ${{ env.TEMP_PATH }}/*.gpg
+          path: |
+            ${{ runner.temp }}/signed/*.gpg
+            ${{ runner.temp }}/signed/signing_pubkey.asc
       - name: Clean
         if: always()
         uses: ./.github/actions/clean
diff --git a/docker/keeper/Dockerfile b/docker/keeper/Dockerfile
index 3355c8d82507..5eb9c255a5e8 100644
--- a/docker/keeper/Dockerfile
+++ b/docker/keeper/Dockerfile
@@ -79,6 +79,8 @@ RUN mkdir -p "${DEFAULT_DATA_DIR}" "${DEFAULT_LOG_DIR}" "${DEFAULT_CONFIG_DIR}"
     && chown root:clickhouse "${DEFAULT_LOG_DIR}" \
     && chmod ugo+Xrw -R "${DEFAULT_DATA_DIR}" "${DEFAULT_LOG_DIR}" "${DEFAULT_CONFIG_DIR}"
 
+RUN apk upgrade --no-cache libcrypto3 libssl3
+
 # /var/lib/clickhouse is necessary due to the current default configuration for Keeper
 VOLUME "${DEFAULT_DATA_DIR}" /var/lib/clickhouse
 EXPOSE 2181 10181 44444 9181
diff --git a/docker/server/Dockerfile.alpine b/docker/server/Dockerfile.alpine
index 0f57d169d0c0..31f51e3e77c3 100644
--- a/docker/server/Dockerfile.alpine
+++ b/docker/server/Dockerfile.alpine
@@ -88,6 +88,8 @@ RUN mkdir -p \
     && chown root:clickhouse "${DEFAULT_LOG_DIR}" \
     && chmod ugo+Xrw -R "${DEFAULT_DATA_DIR}" "${DEFAULT_LOG_DIR}" "${DEFAULT_CLIENT_CONFIG_DIR}" "${DEFAULT_SERVER_CONFIG_DIR}"
 
+RUN apk upgrade --no-cache libcrypto3 libssl3
+
 VOLUME "${DEFAULT_DATA_DIR}"
 EXPOSE 9000 8123 9009
 
diff --git a/tests/ci/build_download_helper.py b/tests/ci/build_download_helper.py
index 8482abb26e0a..4e03ec99dbe6 100644
--- a/tests/ci/build_download_helper.py
+++ b/tests/ci/build_download_helper.py
@@ -123,6 +123,22 @@ def set_auth_header():
 
 
 def read_build_urls(build_name: str, reports_path: Union[Path, str]) -> List[str]:
+    from env_helper import REPO_COPY  # pylint: disable=import-outside-toplevel
+
+    artifact_report = Path(REPO_COPY) / "ci" / "tmp" / BUILD_TO_REPORT[build_name]
+    if artifact_report.is_file():
+        with open(artifact_report, "r", encoding="utf-8") as f:
+            return json.load(f)["build_urls"]  # type: ignore
+    pr_info = None
+    try:
+        from pr_info import PRInfo  # pylint: disable=import-outside-toplevel
+
+        pr_info = PRInfo()
+    except Exception as ex:
+        logger.warning("Failed to init PRInfo while selecting build report: %s", ex)
+
+    reports_by_sha = []  # type: List[List[str]]
+    fallback_reports = []  # type: List[List[str]]
     for root, _, files in os.walk(reports_path):
         for file in files:
             if file.endswith(f"_{build_name}.json"):
@@ -131,7 +147,29 @@ def read_build_urls(build_name: str, reports_path: Union[Path, str]) -> List[str
                     os.path.join(root, file), "r", encoding="utf-8"
                 ) as file_handler:
                     build_report = json.load(file_handler)
-                    return build_report["build_urls"]  # type: ignore
+                    build_urls = build_report.get("build_urls", [])
+                    if not isinstance(build_urls, list):
+                        continue
+                    fallback_reports.append(build_urls)
+                    if pr_info and pr_info.sha and any(
+                        f"/{pr_info.sha}/" in str(url) for url in build_urls
+                    ):
+                        reports_by_sha.append(build_urls)
+
+    if reports_by_sha:
+        logger.info(
+            "Using build report matched by SHA [%s] for [%s]",
+            pr_info.sha if pr_info else "",
+            build_name,
+        )
+        return reports_by_sha[0]
+
+    if fallback_reports:
+        logger.warning(
+            "No SHA-matched build report found for [%s], fallback to first discovered",
+            build_name,
+        )
+        return fallback_reports[0]
 
     logger.info("A build report is not found for %s", build_name)
     return []
diff --git a/tests/ci/ci.py b/tests/ci/ci.py
index 95edf2cd7501..5fc45d5c8882 100644
--- a/tests/ci/ci.py
+++ b/tests/ci/ci.py
@@ -301,6 +301,10 @@ def _pre_action(s3, job_name, batch, indata, pr_info):
         #   testing), otherwise reports won't be found
         if not (pr_info.is_scheduled or pr_info.is_dispatched):
             report_prefix = Utils.normalize_string(pr_info.head_ref)
+    elif isinstance(pr_info.ref, str) and pr_info.ref.startswith("refs/tags/"):
+        # For tag-triggered runs, use tag name as prefix to avoid downloading
+        # reports from other runs with the same digest.
+        report_prefix = Utils.normalize_string(pr_info.head_ref)
     elif pr_info.is_pr:
         report_prefix = str(pr_info.number)
     print(
diff --git a/tests/ci/sign_release.py b/tests/ci/sign_release.py
index 8a5827097c8b..192b54417108 100644
--- a/tests/ci/sign_release.py
+++ b/tests/ci/sign_release.py
@@ -2,17 +2,29 @@
 import sys
 import os
 import logging
+import subprocess
+import base64
+import binascii
 from env_helper import TEMP_PATH, REPO_COPY, REPORT_PATH
 from s3_helper import S3Helper
 from pr_info import PRInfo
 from build_download_helper import download_builds_filter
+from report import FAIL, OK, FAILURE, SUCCESS, JobReport, TestResult
+from stopwatch import Stopwatch
 import hashlib
 from pathlib import Path
+from tempfile import NamedTemporaryFile
+from typing import Tuple
 
 GPG_BINARY_SIGNING_KEY = os.getenv("GPG_BINARY_SIGNING_KEY")
 GPG_BINARY_SIGNING_PASSPHRASE = os.getenv("GPG_BINARY_SIGNING_PASSPHRASE")
 
 CHECK_NAME = os.getenv("CHECK_NAME", "Sign release")
+SIGNING_PUBLIC_KEY_FILE = "signing_pubkey.asc"
+KEY_FORMAT_GUIDANCE = (
+    "GPG_BINARY_SIGNING_KEY must be either an ASCII-armored OpenPGP private key "
+    "(-----BEGIN PGP ...) or base64-encoded key payload (armored text or binary key bytes)."
+)
 
 def hash_file(file_path):
     BLOCK_SIZE = 65536 # The size of each read from the file
@@ -32,22 +44,104 @@ def hash_file(file_path):
 
     return hash_file_path
 
-def sign_file(file_path):
-    priv_key_file_path = 'priv.key'
-    with open(priv_key_file_path, 'x') as f:
-        f.write(GPG_BINARY_SIGNING_KEY)
+def _normalize_private_key_material(raw_key: str) -> Tuple[bytes, str]:
+    if raw_key is None or not raw_key.strip():
+        raise ValueError(
+            "GPG_BINARY_SIGNING_KEY is missing or empty. "
+            + KEY_FORMAT_GUIDANCE
+        )
+
+    stripped_key = raw_key.strip()
+    if "-----BEGIN PGP " in stripped_key:
+        return stripped_key.encode("utf-8"), "armored"
+
+    key_no_whitespace = "".join(stripped_key.split())
+    try:
+        decoded_key = base64.b64decode(key_no_whitespace, validate=True)
+    except (binascii.Error, ValueError) as ex:
+        raise ValueError(
+            "Failed to parse GPG_BINARY_SIGNING_KEY as armored or base64 data. "
+            + KEY_FORMAT_GUIDANCE
+        ) from ex
+
+    if not decoded_key:
+        raise ValueError("Decoded GPG_BINARY_SIGNING_KEY is empty. " + KEY_FORMAT_GUIDANCE)
+
+    try:
+        decoded_text = decoded_key.decode("utf-8")
+    except UnicodeDecodeError:
+        return decoded_key, "base64->binary"
+
+    if "-----BEGIN PGP " in decoded_text:
+        return decoded_text.strip().encode("utf-8"), "base64->armored"
+
+    return decoded_key, "base64->binary"
+
+
+def import_private_signing_key():
+    if GPG_BINARY_SIGNING_PASSPHRASE is None or GPG_BINARY_SIGNING_PASSPHRASE == "":
+        raise ValueError("GPG_BINARY_SIGNING_PASSPHRASE is missing or empty")
+
+    private_key_bytes, key_mode = _normalize_private_key_material(GPG_BINARY_SIGNING_KEY)
+    logging.info("Detected signing key format: %s", key_mode)
+
+    with NamedTemporaryFile("wb", delete=False, suffix=".key") as key_file:
+        key_file.write(private_key_bytes)
+        priv_key_file_path = key_file.name
+
+    try:
+        subprocess.run(
+            [
+                "gpg",
+                "--batch",
+                "--yes",
+                "--pinentry-mode=loopback",
+                "--passphrase",
+                GPG_BINARY_SIGNING_PASSPHRASE,
+                "--import",
+                priv_key_file_path,
+            ],
+            check=True,
+        )
+    finally:
+        os.remove(priv_key_file_path)
 
-    out_file_path = f'{file_path}.gpg'
 
-    os.system(f'echo {GPG_BINARY_SIGNING_PASSPHRASE} | gpg --batch --import {priv_key_file_path}')
-    os.system(f'gpg -o {out_file_path} --pinentry-mode=loopback --batch --yes --passphrase {GPG_BINARY_SIGNING_PASSPHRASE} --sign {file_path}')
+def sign_file(file_path):
+    out_file_path = f'{file_path}.gpg'
+    subprocess.run(
+        [
+            "gpg",
+            "-o",
+            out_file_path,
+            "--pinentry-mode=loopback",
+            "--batch",
+            "--yes",
+            "--passphrase",
+            GPG_BINARY_SIGNING_PASSPHRASE,
+            "--sign",
+            file_path,
+        ],
+        check=True,
+    )
     print(f"Signed {file_path}")
-    os.remove(priv_key_file_path)
 
     return out_file_path
 
+
+def export_public_signing_key(out_file_path: Path):
+    subprocess.run(
+        ["gpg", "--armor", "--output", str(out_file_path), "--export"],
+        check=True,
+    )
+    print(f"Exported signing public key to {out_file_path}")
+
 def main():
+    stopwatch = Stopwatch()
     reports_path = Path(REPORT_PATH)
+    test_results = []
+    state = SUCCESS
+    description = "Signed artifact hashes successfully"
 
     if not os.path.exists(TEMP_PATH):
         os.makedirs(TEMP_PATH)
@@ -65,15 +159,29 @@ def main():
     # downloads `package_release` artifacts generated
     download_builds_filter(CHECK_NAME, reports_path, Path(TEMP_PATH))
 
-    for f in os.listdir(TEMP_PATH):
-        full_path = os.path.join(TEMP_PATH, f)
-        if os.path.isdir(full_path):
-            continue
-        hashed_file_path = hash_file(full_path)
-        signed_file_path = sign_file(hashed_file_path)
-        s3_path = s3_path_prefix / os.path.basename(signed_file_path)
-        s3_helper.upload_build_file_to_s3(Path(signed_file_path), str(s3_path))
-        print(f'Uploaded file {signed_file_path} to {s3_path}')
+    try:
+        import_private_signing_key()
+        for f in os.listdir(TEMP_PATH):
+            full_path = os.path.join(TEMP_PATH, f)
+            if os.path.isdir(full_path):
+                continue
+            hashed_file_path = hash_file(full_path)
+            signed_file_path = sign_file(hashed_file_path)
+            s3_path = s3_path_prefix / os.path.basename(signed_file_path)
+            s3_helper.upload_build_file_to_s3(Path(signed_file_path), str(s3_path))
+            print(f'Uploaded file {signed_file_path} to {s3_path}')
+            test_results.append(TestResult(name=os.path.basename(full_path), status=OK))
+
+        public_key_path = Path(TEMP_PATH) / SIGNING_PUBLIC_KEY_FILE
+        export_public_signing_key(public_key_path)
+        s3_helper.upload_build_file_to_s3(
+            public_key_path, str(s3_path_prefix / SIGNING_PUBLIC_KEY_FILE)
+        )
+        test_results.append(TestResult(name=SIGNING_PUBLIC_KEY_FILE, status=OK))
+    except Exception as ex:
+        state = FAILURE
+        description = f"Failed to sign release artifacts: {ex}"
+        test_results.append(TestResult(name=CHECK_NAME, status=FAIL, raw_logs=str(ex)))
 
     # Signed hashes are:
     # clickhouse-client_22.3.15.2.altinitystable_amd64.deb.sha512.gpg              clickhouse-keeper_22.3.15.2.altinitystable_x86_64.apk.sha512.gpg
@@ -91,6 +199,18 @@ def main():
     # clickhouse-keeper_22.3.15.2.altinitystable_amd64.deb.sha512.gpg              clickhouse-server-22.3.15.2.altinitystable.x86_64.rpm.sha512.gpg
     # clickhouse-keeper-22.3.15.2.altinitystable-amd64.tgz.sha512.gpg              clickhouse.sha512.gpg
 
+    JobReport(
+        description=description,
+        test_results=test_results,
+        status=state,
+        start_time=stopwatch.start_time_str,
+        duration=stopwatch.duration_seconds,
+        additional_files=[],
+    ).dump()
+
+    if state == FAILURE:
+        sys.exit(1)
+
     sys.exit(0)
 
 if __name__ == "__main__":