feat: Adding client-proxy and clickhouse to e2b-artifacts

[charlie-e2b]

No description provided.

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

[gemini-code-assist]

Code Review

This pull request configures release-please for the client-proxy and clickhouse packages and updates their Makefiles to support pulling prebuilt, versioned images from an E2B artifacts registry when a version variable is provided. However, a critical syntax error was identified in packages/client-proxy/Makefile where the ifeq conditional directive is incorrectly placed inside the target's recipe, which will cause GNU Make to fail. A fix has been suggested to structure the conditional block outside of the target definition.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[codecov]

❌ 5 Tests Failed:

Tests completed	Failed	Passed	Skipped
3173	5	3168	8

View the top 3 failed test(s) by shortest run time

github.com/e2b-dev/infra/tests/integration/internal/tests/envd::TestListDir/depth_1_lists_root_directory

Stack Traces | 0.01s run time

=== RUN   TestListDir/depth_1_lists_root_directory
=== PAUSE TestListDir/depth_1_lists_root_directory
=== CONT  TestListDir/depth_1_lists_root_directory
    filesystem_test.go:96: 
        	Error Trace:	.../tests/envd/filesystem_test.go:96
        	Error:      	Received unexpected error:
        	            	unavailable: 502 Bad Gateway
        	Test:       	TestListDir/depth_1_lists_root_directory
--- FAIL: TestListDir/depth_1_lists_root_directory (0.01s)

github.com/e2b-dev/infra/tests/integration/internal/tests/envd::TestListDir/depth_2_lists_first_level_of_subdirectories_(in_this_case_the_root_directory)

Stack Traces | 0.01s run time

=== RUN   TestListDir/depth_2_lists_first_level_of_subdirectories_(in_this_case_the_root_directory)
=== PAUSE TestListDir/depth_2_lists_first_level_of_subdirectories_(in_this_case_the_root_directory)
=== CONT  TestListDir/depth_2_lists_first_level_of_subdirectories_(in_this_case_the_root_directory)
    filesystem_test.go:96: 
        	Error Trace:	.../tests/envd/filesystem_test.go:96
        	Error:      	Received unexpected error:
        	            	unavailable: 502 Bad Gateway
        	Test:       	TestListDir/depth_2_lists_first_level_of_subdirectories_(in_this_case_the_root_directory)
--- FAIL: TestListDir/depth_2_lists_first_level_of_subdirectories_(in_this_case_the_root_directory) (0.01s)

github.com/e2b-dev/infra/tests/integration/internal/tests/envd::TestListDir/depth_0_lists_only_root_directory

Stack Traces | 0.02s run time

=== RUN   TestListDir/depth_0_lists_only_root_directory
=== PAUSE TestListDir/depth_0_lists_only_root_directory
=== CONT  TestListDir/depth_0_lists_only_root_directory
    filesystem_test.go:96: 
        	Error Trace:	.../tests/envd/filesystem_test.go:96
        	Error:      	Received unexpected error:
        	            	unavailable: 502 Bad Gateway
        	Test:       	TestListDir/depth_0_lists_only_root_directory
--- FAIL: TestListDir/depth_0_lists_only_root_directory (0.02s)

github.com/e2b-dev/infra/packages/orchestrator/pkg/nfsproxy::TestIntegrationTest

Stack Traces | 0.03s run time

=== RUN   TestIntegrationTest
=== PAUSE TestIntegrationTest
=== CONT  TestIntegrationTest
    e2e_test.go:143: creating volume dir: .../001/team-c1ca4c8b-afa3-4f26-b249-fa8befe2e117/vol-94e4e494-1407-4539-aca0-24fe99b1b3dd
    e2e_test.go:159: 
        	Error Trace:	.../pkg/nfsproxy/e2e_test.go:62
        	            				.../pkg/nfsproxy/e2e_test.go:159
        	Error:      	Received unexpected error:
        	            	listen tcp :111: bind: address already in use
        	Test:       	TestIntegrationTest
--- FAIL: TestIntegrationTest (0.03s)

github.com/e2b-dev/infra/tests/integration/internal/tests/envd::TestListDir

Stack Traces | 6.98s run time

=== RUN   TestListDir
=== PAUSE TestListDir
=== CONT  TestListDir
--- FAIL: TestListDir (6.98s)

View the full list of 1 ❄️ flaky test(s)

github.com/e2b-dev/infra/tests/integration/internal/tests/envd::TestListDir/depth_3_lists_all_directories_and_files

Flake rate in main: 30.77% (Passed 9 times, Failed 4 times)

Stack Traces | 0.01s run time

=== RUN   TestListDir/depth_3_lists_all_directories_and_files
=== PAUSE TestListDir/depth_3_lists_all_directories_and_files
=== CONT  TestListDir/depth_3_lists_all_directories_and_files
    filesystem_test.go:96: 
        	Error Trace:	.../tests/envd/filesystem_test.go:96
        	Error:      	Received unexpected error:
        	            	unavailable: 502 Bad Gateway
        	Test:       	TestListDir/depth_3_lists_all_directories_and_files
--- FAIL: TestListDir/depth_3_lists_all_directories_and_files (0.01s)

To view more test analytics, go to the Test Analytics Dashboard
_{📋 Got 3 mins? Take this short survey to help us improve Test Analytics.}

[claude]

LGTM — mirrors the existing docker-reverse-proxy release-please pattern for two more images.

Extended reasoning...

Overview

This PR extends the existing release-please onboarding (originally set up for docker-reverse-proxy) to two more packages: packages/client-proxy and packages/clickhouse. It touches five files: adds two new publish jobs to .github/workflows/release-please.yml, seeds two entries in .release-please-manifest.json, registers both packages in release-please-config.json, and adds a CLIENT_PROXY_VERSION / CLICKHOUSE_MIGRATOR_VERSION released-image hook to each package's Makefile. All changes are mechanical copies of the established pattern.

Security risks

None material. The new workflow jobs reuse the same WIF provider and publisher service account (E2B_ARTIFACTS_WIF_PROVIDER / E2B_ARTIFACTS_PUBLISH_SA) that were vetted for the docker-reverse-proxy publish job, with the same persist-credentials: false checkout and the same --provenance=false --sbom=false Artifact Registry compatibility flags. The Makefile change is guarded on an opt-in env var and defaults to the existing source-build path.

Level of scrutiny

Low. This is CI/CD plumbing and build-tooling, not production runtime code. It doesn't touch auth, request handling, sandbox logic, or database access. The released-image Makefile hook is opt-in and default-off, so the existing source-build path for all self-hosters is unchanged. The workflow jobs only fire on release-please tag creation, gated on *_released == 'true'.

Other factors

The three findings from the bug-hunting pass are all explicitly nits: a hardcoded linux/amd64 platform that mirrors the publish job (moot until multi-arch publish is added), missing .env.*.template entries for the new version-hook variables (docs discoverability), and a telemetry-version constant that won't match release tags (observability data quality only). None are merge-blocking, and the inline comments already document them for follow-up. The pattern being extended has one prior successful merge (docker-reverse-proxy).

[claude]

🟡 The client-proxy's telemetry version won't match the release tag. packages/client-proxy/main.go:45 hardcodes const version = "1.2.0", but the release-please manifest starts at 0.0.0 — the first release will produce tags like v0.0.1/v0.1.0 while every published image reports telemetry version 1.2.0. Either seed the manifest at 1.2.0, or wire VERSION through Dockerfile/Makefile/workflow like docker-reverse-proxy does (change const→var, add -X=main.version= ldflag, add ARG VERSION to Dockerfile, pass --build-arg VERSION="${IMAGE_TAG}" in the publish job).

Extended reasoning...

The mismatch

packages/client-proxy/main.go:45 declares:

const (
    serviceName = "client-proxy"
    // ...
    version = "1.2.0"
)

and main.go:63 passes it to telemetry:

tel, err := telemetry.New(ctx, nodeID, serviceName, commitSHA, version, instanceID)

This PR seeds .release-please-manifest.json with "packages/client-proxy": "0.0.0". On the first release, release-please will therefore produce a tag like client-proxy-v0.0.1 or client-proxy-v0.1.0, and the new publish-client-proxy job in .github/workflows/release-please.yml will push an image tagged v0.0.1 (or similar). That image's telemetry, however, will report version="1.2.0" forever.

Why the existing plumbing doesn't fix it

packages/client-proxy/Makefile build target has -ldflags "-X=main.commitSHA=$(COMMIT_SHA)" — it stamps only commitSHA, not version. And even if the ldflag were added, version is a const (not a var), so -X main.version=... would silently do nothing. packages/client-proxy/Dockerfile accepts ARG COMMIT_SHA but has no ARG VERSION. The new publish-client-proxy job passes --build-arg COMMIT_SHA but no --build-arg VERSION.

Contrast with the sibling pattern this PR copies

The publish-reverse-proxy job in the same workflow does thread the version through end-to-end:

• packages/docker-reverse-proxy/main.go declares var version = "dev" (a var, stamped via ldflags).
• Its Makefile has -X=main.version=$(VERSION).
• Its Dockerfile has ARG VERSION=dev and passes VERSION=${VERSION} to make build.
• The workflow passes --build-arg VERSION="${IMAGE_TAG}".

The client-proxy publish job omits that last piece and the underlying plumbing was never added.

Step-by-step proof

1. Someone merges a feat: commit that touches packages/client-proxy/.
2. release-please opens the release PR bumping packages/client-proxy from 0.0.0 to 0.1.0.
3. Release PR merges; workflow tags client-proxy-v0.1.0 and triggers publish-client-proxy with VERSION=0.1.0.
4. The job runs docker buildx build ... --tag us-docker.pkg.dev/e2b-artifacts/client-proxy/client-proxy:v0.1.0 ... (no --build-arg VERSION).
5. Inside the container, Go binary was compiled with const version = "1.2.0".
6. Container starts, calls telemetry.New(..., serviceName, commitSHA, "1.2.0", instanceID).
7. Grafana/Tempo/etc. see service.version=1.2.0 on a v0.1.0 image. Debugging "which release is prod on" gets confusing.

Impact and fix

Telemetry data-quality only — nothing crashes and the proxy works correctly. Two fixes, either works:

• Cheap: bump .release-please-manifest.json entry for packages/client-proxy to "1.2.0", so the first release-please tag is v1.2.1 / v1.3.0.
• Aligned with docker-reverse-proxy: flip const version = "1.2.0" to var version = "dev", add -X=main.version=$(VERSION) to the client-proxy Makefile ldflags, add ARG VERSION to packages/client-proxy/Dockerfile, and pass --build-arg VERSION="${IMAGE_TAG}" in publish-client-proxy.

(clickhouse-migrator has no comparable in-binary version constant so it isn't affected.)

[cursor]

Stale comment