expire_snapshots on a stale table deletes a branch moved onto the expired snapshot #4200

Apache Iceberg version

0.12.0 (latest release)

Please describe the bug 🐞

Currently, ExpireSnapshots._commit picks the protected snapshots from the table's loaded metadata and sends no requirements, so when another writer has since pointed a ref at the snapshot being expired, the commit succeeds and RemoveSnapshotsUpdate removes that ref. With main rolled back to it, the table loses main and reads as empty.

import tempfile
import pyarrow as pa
from pyiceberg.catalog.sql import SqlCatalog

cat = SqlCatalog("c", uri="sqlite:///:memory:", warehouse=f"file://{tempfile.mkdtemp()}")
cat.create_namespace("ns")
t = cat.create_table("ns.t", schema=pa.schema([("x", pa.int64())]))
t.append(pa.table({"x": [1]}))
s1 = t.current_snapshot().snapshot_id
t.append(pa.table({"x": [2]}))

cat.load_table("ns.t").manage_snapshots().rollback_to_snapshot(s1).commit()  # another writer
t.maintenance.expire_snapshots().by_id(s1).commit()

t = cat.load_table("ns.t")
print(list(t.metadata.refs), t.scan().to_arrow()["x"].to_pylist())
# [] [], should be ['main'] [1]

A tag or branch another writer created on s1 is removed the same way. Java's RemoveSnapshots refreshes the table before choosing what to expire.

tested on pyiceberg 0.12.0 and main

Willingness to contribute

• I can contribute a fix for this bug independently
• I would be willing to contribute a fix for this bug with guidance from the Iceberg community
• I cannot contribute a fix for this bug at this time