Verify the published package on clean installs before promoting to latest

[ShawnChen-Sirius]

Problem

The release workflow builds the native addon and runs the suite in the build tree, so
it only ever tests the in-place build, never the artifact users install. That is the gap
#50 fell through: the Linux @chdb/lib-* binary had the build machine's absolute rpath
(/home/runner/work/chdb-node/chdb-node/libchdb.so) baked in, which loaded fine on the CI
build box and threw cannot open shared object file on every clean host.

First principles: what a user runs is the packed tarball, with @chdb/lib-* resolved
through optionalDependencies and loaded by rpath at the installed location, on a clean
machine. None of that is exercised by "build then test in place." So: test what users get,
and gate latest on it.

Change

• test/pack/installed.test.mjs imports chdb by name (never the source tree), so
  it exercises the packed files, the platform binary resolved via optionalDependencies, its
  rpath at the installed location, and the subpath exports. The first import 'chdb' loads
  the native addon from where npm put it — the exact why this path /home/runner/work/chdb-node/chdb-node/libchdb.so #50 failure point. It then runs
  version(), a stateless query, an async query, a Session insert/query/stream round-trip,
  and a chdb/connection subpath resolution.

• prebuild-publish.yml becomes publish → verify → promote:

  • a stable release is published to a holding dist-tag (unverified); prereleases stay on next;
  • a verify matrix (every target platform x Node 18/20/22) installs the just-published
    chdb from npm into a clean dir and runs the installed-package tests;
  • promote moves latest only after verify is green on every leg. If verify fails on any
    platform, users on latest never see the broken release.

Validation

Locally: npm pack -> clean npm install ./chdb-*.tgz (real @chdb/lib-* pulled from npm)
-> the installed-package tests pass 5/5. The same flow would have failed at import 'chdb'
on the #50 build.

Notes

• The unit suite (test/v3, source correctness) still runs in-tree on PRs; the new
  installed-package suite is the release-time artifact gate. Separate concerns.
• @chdb/lib-* subpackages publish before verify, but nobody installs them directly — they
  are pulled transitively only by a chdb version, which is gated by the latest
  promotion, so a bad binary can't reach users via latest.
• Bun/Deno legs can be added to the verify matrix as a follow-up.

Fixes the class of bug behind #50.

---

Additional change: sync @clickhouse/client 1.23.0 release

@clickhouse/client 1.23.0 was published to npm on 2026-06-29 (GitHub release tag client-1.23.0 at commit 70ad405) — the first stable release carrying the connection injection point from clickhouse-js#879/#880. This is the first end-to-end path where users can npm install chdb @clickhouse/client and get a working chDB integration without pinning a pre-release. Three follow-ups landed in the second commit of this PR:

1. peerDependencies['@clickhouse/client']: ">=1.23.0" (optional). Marked optional in peerDependenciesMeta so users installing chdb without chdb/connection aren't forced to pull it in. Users who DO import from chdb/connection with an older @clickhouse/client now get a clear npm warning instead of a runtime TS error / undefined field surprise.

2. skip_list.json#syncedAgainst.ref: main → client-1.23.0. Follows the sync-policy table's third row ("After next release: latest released tag"). lastSyncedSha bumped to 70ad405, lastSyncedAt to 2026-07-01.

3. runner.mjs auto-detects the upstream Vitest layout. client-1.23.0 was cut before clickhouse-js#931 (which merged 2026-06-30 and moved the config/setup into packages/client-node/). The release tag still has the OLD repo-root layout (vitest.node.setup.ts at root, test:node:integration script at root); main has the NEW per-package layout. runner.mjs now probes for both setup-file locations and picks the right npm-script incantation for each.

Verification (clean env):

rm -rf .chdb-runner
npm run build:ts                                    → clean
npx vitest run test/v3/connection/contract.test.ts  → 13/13
node tests/clickhouse-js/runner.mjs                 → detected upstream layout: pre-931
                                                      Test Files 26 pass / 2 skip (28)
                                                      Tests 170 pass / 41 skip / 0 fail (211)

The 10-test drop vs. the previous main run (180 → 170) is because the pre-#931 test:node:integration script only invokes the client-node integration suite; the post-#931 packages/client-node script pulls the shared common tests in as well. ChdbConnection coverage is identical across both — every previously-passing case that surfaces the adapter still passes.

🤖 Generated with Claude Code

Note

Verify the published npm package on clean installs before promoting to latest

• Stable releases now publish under the unverified dist-tag instead of latest; a new verify job in prebuild-publish.yml installs the package into a clean temp dir across 4 OSes and Node 18/20/22, runs the new installed.test.mjs suite, and retries up to 6 times for registry propagation.
• A new promote job moves the latest dist-tag to the verified version only after all matrix checks pass; prereleases continue to publish directly under next.
• npm retry/backoff env vars and cache: npm are added to all CI workflows to reduce flakiness from transient registry errors.
• The clickhouse-js test runner gains a detectLayout() function to handle both pre- and post-#931 upstream repo layouts automatically.
• Behavioral Change: stable releases are no longer immediately available under latest; consumers relying on npm install chdb will get the version only after cross-platform verification completes.

^{Macroscope summarized 79d3a39.}

[ShawnChen-Sirius]

@chibugai, review it

[Copilot]

Pull request overview

Updates the release workflow to validate the published chdb artifact (as installed from npm) on clean machines before promoting a stable release to the latest dist-tag, preventing regressions like the absolute-rpath failure in #50.

Changes:

• Adds an installed-package Vitest suite that imports chdb by package name to exercise optionalDependency resolution, native loading, and subpath exports.
• Refactors the release workflow into publish → verify (matrix clean installs) → promote (move latest after verification), with stable releases published initially under unverified.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
test/pack/installed.test.mjs	New installed-from-npm test suite to validate native loading, basic queries, Session round-trip, and chdb/connection export.
.github/workflows/prebuild-publish.yml	Adds verify/promote jobs and changes stable publish dist-tag to unverified until verified across OS/Node matrix.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.