Area: infra · CI + deployments — footgun · found via codebase sweep
Expected: the ClickHouse version the project builds, tests, and ships against is pinned in the repo, so a green CI run and a user's docker compose up are reproducible from the commit alone.
Actual: clickhouse/clickhouse-server:latest is used unpinned in six places — .github/workflows/ci.yml:233 and :270 (both e2e pre-pulls), deployments/compose/dependencies.yaml:14, deployments/compose/standalone.yaml:3, scripts/orchestrator/main.go:136 (the e2e orchestrator's container), and tests/integration/setup_test.go:227.
Impact: two distinct failure modes, both invisible in a diff.
- CI/tests: an upstream ClickHouse release can redden
main with no repo change, and the failure looks like a regression in whatever PR happens to run next. It also means a rerun of an old commit does not reproduce that commit's environment.
- Users, now that the repo is public:
deployments/compose/standalone.yaml is the documented quickstart, so every new user gets whatever major ClickHouse published that morning, against a server tested on a different one. v0.1.0 claims no ClickHouse version range anywhere.
Note: the six sites do not have to move together — CI/tests want an exact pin that Dependabot (or Renovate) bumps on a PR; the compose files want the oldest version we intend to support. Deciding the supported range is the actual work; the pin is the easy half.
Related: #501 (item 5 — standalone.yaml can't run the released image either), #441 (Dependabot cooldown bypass), #444
From a codebase sweep (deferred follow-up from the #312 CI rework); validated by code-read against 9d4cef9 on 2026-08-20.
Area: infra · CI + deployments — footgun · found via codebase sweep
Expected: the ClickHouse version the project builds, tests, and ships against is pinned in the repo, so a green CI run and a user's
docker compose upare reproducible from the commit alone.Actual:
clickhouse/clickhouse-server:latestis used unpinned in six places —.github/workflows/ci.yml:233and:270(both e2e pre-pulls),deployments/compose/dependencies.yaml:14,deployments/compose/standalone.yaml:3,scripts/orchestrator/main.go:136(the e2e orchestrator's container), andtests/integration/setup_test.go:227.Impact: two distinct failure modes, both invisible in a diff.
mainwith no repo change, and the failure looks like a regression in whatever PR happens to run next. It also means a rerun of an old commit does not reproduce that commit's environment.deployments/compose/standalone.yamlis the documented quickstart, so every new user gets whatever major ClickHouse published that morning, against a server tested on a different one.v0.1.0claims no ClickHouse version range anywhere.Note: the six sites do not have to move together — CI/tests want an exact pin that Dependabot (or Renovate) bumps on a PR; the compose files want the oldest version we intend to support. Deciding the supported range is the actual work; the pin is the easy half.
Related: #501 (item 5 —
standalone.yamlcan't run the released image either), #441 (Dependabot cooldown bypass), #444From a codebase sweep (deferred follow-up from the #312 CI rework); validated by code-read against
9d4cef9on 2026-08-20.