1.22 beta1

.github/workflows/clean-up.yml

@@ -16,7 +16,8 @@ jobs:
   # and it should run even if other tests fail, to ensure that we keep the ClickHouse Cloud
   # instance clean for the next runs to avoid adding cleanup cost to the critical path of the tests.
   cloud-cleanup:
-    if: always()
+    # Cloud secrets are not available for Dependabot pushes; skip the cleanup in that case.
+    if: ${{ always() && github.triggering_actor != 'dependabot[bot]' }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

.github/workflows/examples.yml

@@ -75,7 +75,7 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Start ClickHouse (version - ${{ matrix.clickhouse }}) in Docker
-        uses: isbang/compose-action@3846bcd61da338e9eaaf83e7ed0234a12b099b72 # v2.4.2
+        uses: hoverkraft-tech/compose-action@11beaa1c2dae4e8ed7b1665aa074723b6cecb0e4 # v3.0.0
         env:
           CLICKHOUSE_VERSION: ${{ matrix.clickhouse }}
         with:

.github/workflows/github-export-otel.yml

@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Export Workflow Telemetry
-        uses: ClickHouse/github-actions-opentelemetry@166e4f803ea5857cfcd90502d99fd35ccb20de32
+        uses: ClickHouse/github-actions-opentelemetry@a43396f9eb698c48126a0d3cbe6b851858188753 # node24
         env:
           OTEL_SERVICE_NAME: github-actions
           OTEL_EXPORTER_OTLP_ENDPOINT: ${{ secrets.OTEL_EXPORTER_OTLP_ENDPOINT }}

.github/workflows/scorecard.yml

@@ -81,6 +81,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@c35d1b164463ee62a100735382aaaa525c5d3496 # codeql-bundle-v2.25.6
         with:
           sarif_file: results.sarif

.github/workflows/tests-node.yml

@@ -59,6 +59,20 @@ jobs:
         run: |
           npm run lint
 
+      - name: Check formatting (Prettier)
+        env:
+          NO_COLOR: "1"
+        run: |
+          if ! npm run -s prettier:check > prettier-output.txt 2>&1; then
+            cat prettier-output.txt
+            grep -E '^\[warn\] ' prettier-output.txt \
+              | grep -vE 'Code style issues|Run Prettier|Forgot to run' \
+              | sed -E 's#^\[warn\] (.+)$#::error file=\1::File is not formatted with Prettier. Run "npm run prettify" to fix.#' || true
+            echo "::error::Prettier check failed. Run 'npm run prettify' locally to fix formatting."
+            exit 1
+          fi
+          cat prettier-output.txt
+
   common-unit-tests:
     timeout-minutes: 5
     runs-on: ubuntu-latest
@@ -88,6 +102,19 @@ jobs:
         run: |
           node .scripts/export-coverage-metrics.mjs
 
+      - name: Upload coverage to Codecov
+        # Codecov token is not available for Dependabot PRs or PRs from forks; skip the upload in those cases.
+        # Upload coverage from a single canonical combination (Node 24) so Codecov
+        # receives exactly one upload per flag (see codecov.yml).
+        if: ${{ github.triggering_actor != 'dependabot[bot]' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && matrix.node == 24 }}
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v6.0.2
+        with:
+          name: node-common-unit
+          flags: node-common-unit
+          token: ${{ secrets.CODECOV_TOKEN }}
+          files: ./coverage/lcov.info
+          fail_ci_if_error: true
+
   unit-tests:
     timeout-minutes: 5
     runs-on: ubuntu-latest
@@ -122,6 +149,19 @@ jobs:
         run: |
           node .scripts/export-coverage-metrics.mjs
 
+      - name: Upload coverage to Codecov
+        # Codecov token is not available for Dependabot PRs or PRs from forks; skip the upload in those cases.
+        # Upload coverage from a single canonical combination (Node 24) so Codecov
+        # receives exactly one upload per flag (see codecov.yml).
+        if: ${{ github.triggering_actor != 'dependabot[bot]' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && matrix.node == 24 }}
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v6.0.2
+        with:
+          name: node-unit
+          flags: node-unit
+          token: ${{ secrets.CODECOV_TOKEN }}
+          files: ./coverage/lcov.info
+          fail_ci_if_error: true
+
   integration-tests-local-single-node:
     timeout-minutes: 5
     runs-on: ubuntu-latest
@@ -151,7 +191,7 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Start ClickHouse (version - ${{ matrix.clickhouse }}) in Docker
-        uses: isbang/compose-action@3846bcd61da338e9eaaf83e7ed0234a12b099b72 # v2.4.2
+        uses: hoverkraft-tech/compose-action@11beaa1c2dae4e8ed7b1665aa074723b6cecb0e4 # v3.0.0
         env:
           CLICKHOUSE_VERSION: ${{ matrix.clickhouse }}
         with:
@@ -183,6 +223,19 @@ jobs:
         run: |
           node .scripts/export-coverage-metrics.mjs
 
+      - name: Upload coverage to Codecov
+        # Codecov token is not available for Dependabot PRs or PRs from forks; skip the upload in those cases.
+        # Upload coverage from a single canonical combination (Node 24, ClickHouse
+        # latest, default log level) so Codecov receives exactly one upload per flag.
+        if: ${{ github.triggering_actor != 'dependabot[bot]' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && matrix.node == 24 && matrix.clickhouse == 'latest' && matrix.log_level == 'undefined' }}
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v6.0.2
+        with:
+          name: node-integration-single
+          flags: node-integration-single
+          token: ${{ secrets.CODECOV_TOKEN }}
+          files: ./coverage/lcov.info
+          fail_ci_if_error: true
+
   integration-tests-local-cluster:
     timeout-minutes: 5
     runs-on: ubuntu-latest
@@ -196,7 +249,7 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Start ClickHouse cluster (version - ${{ matrix.clickhouse }}) in Docker
-        uses: isbang/compose-action@3846bcd61da338e9eaaf83e7ed0234a12b099b72 # v2.4.2
+        uses: hoverkraft-tech/compose-action@11beaa1c2dae4e8ed7b1665aa074723b6cecb0e4 # v3.0.0
         env:
           CLICKHOUSE_VERSION: ${{ matrix.clickhouse }}
         with:
@@ -222,9 +275,22 @@ jobs:
         run: |
           node .scripts/export-coverage-metrics.mjs
 
+      - name: Upload coverage to Codecov
+        # Codecov token is not available for Dependabot PRs or PRs from forks; skip the upload in those cases.
+        # Upload coverage from a single canonical combination (Node 24, ClickHouse
+        # latest) so Codecov receives exactly one upload per flag.
+        if: ${{ github.triggering_actor != 'dependabot[bot]' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && matrix.node == 24 && matrix.clickhouse == 'latest' }}
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v6.0.2
+        with:
+          name: node-integration-cluster
+          flags: node-integration-cluster
+          token: ${{ secrets.CODECOV_TOKEN }}
+          files: ./coverage/lcov.info
+          fail_ci_if_error: true
+
   integration-tests-cloud:
-    # Cloud secrets are not available for PRs from forks; skip the job in that case.
-    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
+    # Cloud secrets are not available for PRs from forks or Dependabot PRs; skip the job in those cases.
+    if: ${{ github.triggering_actor != 'dependabot[bot]' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) }}
     timeout-minutes: 5
     runs-on: ubuntu-latest
     strategy:
@@ -258,50 +324,15 @@ jobs:
         run: |
           node .scripts/export-coverage-metrics.mjs
 
-  # It should only use the current LTS version of Node.js.
-  codecov-upload:
-    timeout-minutes: 5
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        clickhouse: [head, latest]
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          fetch-depth: 0
-
-      - name: Start ClickHouse (version - ${{ matrix.clickhouse }}) in Docker
-        uses: isbang/compose-action@3846bcd61da338e9eaaf83e7ed0234a12b099b72 # v2.4.2
-        env:
-          CLICKHOUSE_VERSION: ${{ matrix.clickhouse }}
-        with:
-          compose-file: "docker-compose.yml"
-          down-flags: "--volumes"
-
-      - name: Setup NodeJS
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
-        with:
-          node-version: 24
-
-      - name: Install dependencies
-        run: |
-          npm install
-
-      - name: Add ClickHouse TLS instance to /etc/hosts
-        run: |
-          sudo echo "127.0.0.1 server.clickhouseconnect.test" | sudo tee -a /etc/hosts
-
-      - name: Run unit + integration + TLS tests with coverage
-        env:
-          LOG_LEVEL: TRACE
-        run: |
-          npm run test:node:coverage
-
       - name: Upload coverage to Codecov
+        # Codecov token is not available for Dependabot PRs or PRs from forks; skip the upload in those cases.
+        # Upload coverage from a single canonical combination (Node 24) so Codecov
+        # receives exactly one upload per flag (see codecov.yml).
+        if: ${{ github.triggering_actor != 'dependabot[bot]' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && matrix.node == 24 }}
         uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v6.0.2
         with:
-          name: node
+          name: node-integration-cloud
+          flags: node-integration-cloud
           token: ${{ secrets.CODECOV_TOKEN }}
           files: ./coverage/lcov.info
           fail_ci_if_error: true
@@ -315,7 +346,6 @@ jobs:
         "integration-tests-local-single-node",
         "integration-tests-local-cluster",
         "integration-tests-cloud",
-        "codecov-upload",
       ]
     # Run even if some needed jobs were skipped (e.g. cloud jobs on PRs from forks),
     # but still fail if any of them failed or were cancelled.

.github/workflows/tests-oss-dependents.yml

@@ -0,0 +1,79 @@
+name: "oss-dependents"
+
+permissions: {}
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+    paths-ignore:
+      - "**/*.md"
+      - "LICENSE"
+      - "benchmarks/**"
+  pull_request:
+    paths-ignore:
+      - "**/*.md"
+      - "LICENSE"
+      - "benchmarks/**"
+
+  schedule:
+    - cron: "0 9 * * *"
+
+concurrency:
+  group: "${{ github.workflow }}-${{ github.ref }}"
+  cancel-in-progress: true
+
+jobs:
+  # Runnable reproductions of how the top OSS dependents use the client, resolved
+  # against the workspace source via the @clickhouse/client* vitest aliases. This
+  # is a separate workflow so a regression that breaks a known consumer is clearly
+  # attributable. It targets only the stable ClickHouse release on a local
+  # single-node instance, across the supported Node.js versions.
+  oss-dependents-tests:
+    timeout-minutes: 5
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        node: [20, 22, 24]
+
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - name: Start ClickHouse (stable) in Docker
+        uses: hoverkraft-tech/compose-action@11beaa1c2dae4e8ed7b1665aa074723b6cecb0e4 # v3.0.0
+        env:
+          CLICKHOUSE_VERSION: latest
+        with:
+          compose-file: "docker-compose.yml"
+          down-flags: "--volumes"
+
+      - name: Setup NodeJS ${{ matrix.node }}
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        with:
+          node-version: ${{ matrix.node }}
+
+      - name: Install dependencies
+        run: |
+          npm ci
+
+      # The oss-dependents specs resolve `@clickhouse/client*` to the built
+      # workspace packages (not `src`), so build before running them.
+      - name: Build workspace packages
+        run: |
+          npm run build
+
+      - name: Run OSS-dependent integration tests
+        run: |
+          npm run test:node:oss-dependents
+
+  success:
+    needs: ["oss-dependents-tests"]
+    if: ${{ always() }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Fail if any needed job failed or was cancelled
+        if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}
+        run: exit 1
+      - name: All OSS-dependent tests passed
+        run: echo "All OSS-dependent tests passed! 🎉"