ci: run the HTTP and TCP test suites only for the changes that affect them - #634

Why

tests.yml ran the whole HTTP suite (14 jobs) on every pull request, including TCP-only, docs-only and workflow-only changes. tests-tcp.yml was already path-filtered, but its filters did not include ClickHouse.Driver.Common, which both TCP projects reference, so a change to the shared code ran only the HTTP suite.

Only the HTTP suite uploaded coverage. A TCP pull request got no coverage gate, and the Codecov total did not include the TCP driver.

What changed

• tests.yml (HTTP): an allowlist paths filter on push and pull_request.
• tests-tcp.yml (TCP): adds ClickHouse.Driver.Common/**, the shared build inputs, codecov.yml and !**/*.md to the existing filter, and two new jobs: HTTP driver build (TCP) (see the first note) and Code Coverage (TCP) (see Coverage).
• reusable-tcp.yml, reusable.yml: a coverage input and a Codecov upload with the flag tcp, and the flag http on the existing HTTP upload. Neither uploads for an explicit ref.
• codecov.yml: both flags carry forward.
• ClickHouse.Driver.Tcp.Tests.csproj: does not instrument ClickHouse.Driver.Common/Vendor, the same as the HTTP test project. codecov.yml already ignores it.
• CONTRIBUTING.md: the TCP coverage command, and the coverage rules that CI applies.
• examples.yml: adds the shared build inputs and !**/*.md.
• codeql.yml, benchmark.yml (push to main only): add docs/** to paths-ignore. The docs are .mdx files, so **/*.md did not match them.

Which workflows run on a pull request into main

The shared build inputs, the same in all three workflows:

• Directory.Packages.props sets the package versions for every project. Six packages are used only by the examples (Polly, the OpenTelemetry console exporter, and some Microsoft.Extensions packages).
• Directory.Build.*, global.json and [Nn]u[Gg]et.[Cc]onfig do not exist yet. MSBuild, the SDK and NuGet read them from the repository root, so they are listed before they exist: a pull request that adds one runs all three workflows.
• .editorconfig holds the analyzer and code-style settings. The three library projects set EnforceCodeStyleInBuild.
• sgKey.snk is the strong-name key of the two drivers, Common and both unit test projects. The InternalsVisibleTo attributes carry its public key.

codecov.yml configures Codecov for both coverage uploads, so a change to it runs both suites.

Coverage

• Pull requests. Each suite that runs uploads its report, and codecov/patch uses those reports. A TCP-only pull request is gated on the TCP report.
• main. With the path filters, a push to main can run only one suite. Carryforward copies the report of the other flag from the nearest earlier commit that has one, so the total of each commit covers both drivers. A suite that did not run had no input change, so its carried-forward report is still correct.
• Transition. The commits on main before this merge have one upload with no flag. This pull request changes the workflows of both suites, so its merge commit uploads both flags. A pull request based on an older commit has no http report to carry forward, so its Codecov total is TCP only until it is rebased. codecov/patch is not affected.
• Manual runs with a ref. Codecov records an upload for the commit that started the workflow, not for the ref that the job checks out. With an explicit ref, the coverage jobs of both suites run the tests but do not upload.
• The project total is measured, not gated. codecov.yml configures a project status, but Codecov posts no codecov/project check on this repository. No pull request or main commit that I checked has one, and the Codecov PR comments use the Team plan format, which has no project coverage.

Notes

• TCP-only changes skip the HTTP suite, but not the HTTP driver build. ClickHouse.Driver references ClickHouse.Driver.Tcp (net8.0 and later) to pack the TCP assembly into the NuGet package, so it compiles against the TCP public types. No HTTP code or test uses them. But a public TCP type can collide with a type that ClickHouse.Driver sees, possibly on some target frameworks only, and examples.yml builds net10.0 only. The new HTTP driver build (TCP) job builds ClickHouse.Driver for all four target frameworks, without the package, whenever the TCP workflow runs. It needs no ClickHouse server.
• Benchmark-only changes run no test suite. No pull request job builds ClickHouse.Driver.Benchmark, with or without this change. The HTTP suite does not reference it.
• No required checks are affected. main has no required status checks (the rulesets require one approval), so a workflow that a path filter skips cannot block a merge. If a suite becomes a required check later, it needs a gate job that always runs, because GitHub leaves the checks of a path-skipped workflow pending.
• Stacked pull requests into tcp/** keep the current behavior: the TCP workflow runs on them (now including the HTTP driver build and the coverage job, so they get codecov/patch too), and the HTTP suite and the examples run when the pull request targets main. A stacked pull request gets these jobs once its branch contains this change.
• workflow_dispatch still starts every suite by hand.

Verification

• Replayed the old and the new filters over the 160 first-parent commits on main since 2026-06-01. Pull requests are squash-merged, so each commit is one pull request. The script reads the on: blocks from both trees and applies the GitHub matching rules (last matching pattern wins, ! excludes):

  Workflow	Old	New
  HTTP tests, pull_request	160	94
  HTTP tests, push	156	94
  TCP tests, pull_request	47	53
  Examples, pull_request	110	115
  CodeQL and Benchmark, push	156	153

  I checked each commit whose result changed. The 66 removed HTTP runs are 36 TCP code or test changes, 16 changes to non-test workflows or .github configuration, 13 docs, changelog or repository configuration changes, and 1 benchmark change. The 6 added TCP runs are 5 ClickHouse.Driver.Common changes and 1 codecov.yml change (Update codecov.yml #372). The 5 added examples runs are Directory.Packages.props bumps. The 3 removed CodeQL and benchmark runs are docs-only merges.

• The same script checked 39 example paths against the real filters, including Directory.Build.targets, nuget.config, NuGet.Config, a vendored README.md inside ClickHouse.Driver.Common, and every workflow file of each suite.

• The open Dependabot pull requests Bump Microsoft.Extensions.Configuration and Microsoft.Extensions.Configuration.Json #378 and Bump Microsoft.Extensions.Diagnostics.HealthChecks from 10.0.8 to 10.0.9 #379 bump packages that only the examples use. The examples workflow did not run on either of them.

• The HTTP driver build job catches a TCP-only break. On a scratch copy, a public TCP type named ClickHouse.Driver.Compression.PooledWriteBufferStream, compiled for net8.0 and net9.0 only, left the TCP test project build (net9.0) and the examples build green. The job's command failed with CS0433 on net8.0 and net9.0 (BatchWriteTarget.cs uses the internal Common type of that name). On this branch the same command passes for net6.0, net8.0, net9.0 and net10.0, and produces no package.

• actionlint 1.7.12: the only new finding is one more $/ self-repository reference, for the new coverage job (6 on the previous tip of this branch, 7 now). actionlint does not know that syntax yet. The shellcheck findings are in files this pull request does not change.

• zizmor 1.29.0 (the gate version) with .github/zizmor.yml: no findings at high, and the same 13 low and 22 medium findings as origin/main with the default persona. The auditor persona adds one low concurrency-limits finding for tests-tcp.yml, which now has a job of its own; ten workflows on main already have the same finding.

• The command of the new coverage job, run locally (net10.0, latest server, Testcontainers): 4186 tests pass in 2.6 minutes and it writes ClickHouse.Driver.Tcp.Tests/coverage.net10.0.opencover.xml, the file the upload step reads. The report has ClickHouse.Driver.Tcp at 95.0% lines and ClickHouse.Driver.Common at 45.5%, and no vendored files. The HTTP report has Common at 98.4%, and Codecov merges the two.

• codecov.io/validate accepts the new codecov.yml.

• This pull request changes the workflow files of all three suites, so its own checks run the new on: blocks and the new jobs, and its merge commit uploads both flags.

🤖 Generated with Claude Code