adbc-drivers · lidavidm · May 21, 2026 · May 21, 2026 · May 21, 2026
diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml
@@ -26,6 +26,8 @@ updates:
           - "adbc_*"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
 
   - package-ecosystem: "github-actions"
     commit-message:
@@ -37,3 +39,5 @@ updates:
           - "*"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/dev.yaml b/.github/workflows/dev.yaml
@@ -54,11 +54,16 @@ jobs:
         run: pip install pre-commit
 
       - name: pre-commit (cache)
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306  # v5.0.3
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5.0.5
         with:
           path: ~/.cache/pre-commit
           key: pre-commit-${{ hashFiles('.pre-commit-config.yaml') }}
 
       - name: pre-commit
         run: |
           pre-commit run --all-files --color=always --show-diff-on-failure --verbose
+
+      - name: Analyze workflows with zizmor
+        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d  # v0.5.6
+        with:
+          advanced-security: false
diff --git a/.github/workflows/dev_issues.yaml b/.github/workflows/dev_issues.yaml
@@ -36,7 +36,7 @@ jobs:
     if: github.event.comment.body == 'take'
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd  # v8.0.0
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |

diff --git a/.github/workflows/dev_pr.yaml b/.github/workflows/dev_pr.yaml
@@ -18,10 +18,11 @@
 name: Dev PR
 
 on:
-  pull_request_target:
+  pull_request:
     types:
       - opened
       - edited
+      - reopened
       - synchronize
       - ready_for_review
       - review_requested

diff --git a/.github/workflows/generate.toml b/.github/workflows/generate.toml
@@ -15,8 +15,12 @@
 
 driver = "clickhouse"
 
-[lang]
 # Instead of wrapping their Rust code, use scripts to drive it
-[lang.script]
 [lang.script.build]
+additional-make-args = ["TOOLCHAIN=rust"]
 lang-tools = ["rust"]
+
+[lang.script.validation]
+configs = [
+  { service_name = "test-service", vendor_version = "25.12" },
+]
diff --git a/.github/workflows/script_release.yaml b/.github/workflows/script_release.yaml
@@ -39,6 +39,9 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: "Test/${{ matrix.platform }}_${{ matrix.arch }}"
@@ -66,11 +69,12 @@ jobs:
           persist-credentials: false
           submodules: 'recursive'
 
-      - uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c  # v1.15.2
+      - uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6  # v1.16.1
         with:
+          cache: false
           components: "clippy"
 
-      - uses: prefix-dev/setup-pixi@a0af7a228712d6121d37aba47adf55c1332c9c2e  # v0.9.4
+      - uses: prefix-dev/setup-pixi@1b2de7f3351f171c8b4dfeb558c639cb58ed4ec0  # v0.9.5
         with:
           pixi-version: v0.63.2
           run-install: false
@@ -136,14 +140,14 @@ jobs:
 
 
   validate:
-    name: "Validate/${{ matrix.platform }}_${{ matrix.arch }}"
+    name: "Validate clickhouse ${{ matrix.vendor_version }}/${{ matrix.platform }}_${{ matrix.arch }}"
     runs-on: ${{ matrix.runner }}
     strategy:
       fail-fast: true
       matrix:
         include:
           # I think we only need to test one platform, but we can change that later
-          - { platform: linux, arch: amd64, runner: ubuntu-latest }
+          - { platform: linux, arch: amd64, runner: ubuntu-latest, service_name: "test-service", vendor_version: "25.12" }
     permissions:
       contents: read
     steps:
@@ -160,20 +164,23 @@ jobs:
           persist-credentials: false
           submodules: 'recursive'
 
-      - uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c  # v1.15.2
+      - uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6  # v1.16.1
         with:
+          cache: false
           components: "clippy"
 
-      - uses: prefix-dev/setup-pixi@a0af7a228712d6121d37aba47adf55c1332c9c2e  # v0.9.4
+      - uses: prefix-dev/setup-pixi@1b2de7f3351f171c8b4dfeb558c639cb58ed4ec0  # v0.9.5
         with:
           pixi-version: v0.63.2
           run-install: false
 
 
       - name: Log in to ghcr.io
         if: runner.os == 'Linux'
+        env:
+          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
+          echo "$GHCR_TOKEN" | docker login ghcr.io -u "${GITHUB_ACTOR}" --password-stdin
 
       - name: Build Library
         working-directory: src
@@ -190,18 +197,18 @@ jobs:
             source .env.test
           fi
           set +a
-          pixi run adbc-make build DEBUG=true VERBOSE=true DRIVER=clickhouse IMPL_LANG=script
+          pixi run adbc-make build DEBUG=true VERBOSE=true DRIVER=clickhouse IMPL_LANG=script TOOLCHAIN=rust
       - name: Start Test Dependencies
         # Can't use Docker on macOS AArch64 runners, and Windows containers
         # work but often the container doesn't support Windows
         if: runner.os == 'Linux'
         working-directory: src
         run: |
           if [[ -f compose.yaml ]]; then
-            if ! docker compose up --detach --wait test-service; then
+            if ! docker compose up --detach --wait ${{ matrix.service_name }}; then
               echo "Service failed to start"
               echo "Logs:"
-              docker compose logs test-service
+              docker compose logs ${{ matrix.service_name }}
               exit 1
             fi
           fi
@@ -224,32 +231,38 @@ jobs:
 
           if [[ -f ci/scripts/pre-test.sh ]]; then
             echo "Loading pre-test"
-            ./ci/scripts/pre-test.sh ${{ matrix.platform }} ${{ matrix.arch }}
+            ./ci/scripts/pre-test.sh ${{ matrix.platform }} ${{ matrix.arch }} ${{ matrix.service_name }}
           fi
 
           docker ps
-          pixi run validate
+          if [[ -n "${{ matrix.vendor_version }}" ]]; then
+            pixi run validate --vendor-version "${{ matrix.vendor_version }}"
+          else
+            pixi run validate
+          fi
 
           if [[ -f ci/scripts/post-test.sh ]]; then
             ./ci/scripts/post-test.sh
           fi
 
-      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
+          cp validation-report.xml validation-report-${{ matrix.vendor_version }}.xml
+
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
-          name: validation-report
-          path: "src/validation-report.xml"
+          name: validation-report-${{ matrix.vendor_version }}
+          path: "src/validation-report-${{ matrix.vendor_version }}.xml"
           retention-days: 7
 
       - name: Generate docs
         working-directory: src
         run: |
           pixi run gendocs --output generated
 
-      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
-          name: docs
+          name: docs-${{ matrix.vendor_version }}
           path: "src/generated/clickhouse.md"
-          retention-days: 2
+          retention-days: 7
 
   build:
     name: "Build clickhouse/${{ matrix.platform }}_${{ matrix.arch }}"
@@ -274,11 +287,12 @@ jobs:
           persist-credentials: false
           submodules: 'recursive'
 
-      - uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c  # v1.15.2
+      - uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6  # v1.16.1
         with:
+          cache: false
           components: "clippy"
 
-      - uses: prefix-dev/setup-pixi@a0af7a228712d6121d37aba47adf55c1332c9c2e  # v0.9.4
+      - uses: prefix-dev/setup-pixi@1b2de7f3351f171c8b4dfeb558c639cb58ed4ec0  # v0.9.5
         with:
           pixi-version: v0.63.2
           run-install: false
@@ -290,8 +304,10 @@ jobs:
 
       - name: Log in to ghcr.io
         if: runner.os == 'Linux'
+        env:
+          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
+          echo "$GHCR_TOKEN" | docker login ghcr.io -u "${GITHUB_ACTOR}" --password-stdin
 
       - name: Build Library
         working-directory: src
@@ -308,9 +324,8 @@ jobs:
             source .env.release
           fi
           set +a
-          pixi run adbc-make check CI=true VERBOSE=true DRIVER=clickhouse IMPL_LANG=script
-
-      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
+          pixi run adbc-make check CI=true VERBOSE=true DRIVER=clickhouse IMPL_LANG=script TOOLCHAIN=rustRELEASE=true
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: drivers-${{ matrix.platform }}-${{ matrix.arch }}
           path: "src/build/libadbc_driver_clickhouse.*"
@@ -319,7 +334,9 @@ jobs:
   package:
     name: "Generate Packages"
     runs-on: ubuntu-latest
-    needs: build
+    needs:
+      - build
+      - validate
     permissions:
       contents: read
 
@@ -330,24 +347,25 @@ jobs:
           persist-credentials: false
           submodules: 'recursive'
 
-      - uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c  # v1.15.2
+      - uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6  # v1.16.1
         with:
+          cache: false
           components: "clippy"
 
-      - uses: prefix-dev/setup-pixi@a0af7a228712d6121d37aba47adf55c1332c9c2e  # v0.9.4
+      - uses: prefix-dev/setup-pixi@1b2de7f3351f171c8b4dfeb558c639cb58ed4ec0  # v0.9.5
         with:
           pixi-version: v0.63.2
           run-install: false
 
-      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131  # v7.0.0
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           pattern: "drivers-*"
           path: "~/drivers"
 
       - name: Install tools
         working-directory: src
         run: |
-          cargo install cargo-about
+          cargo install cargo-about@0.9.0 --locked -F cli
 
       - name: Generate packages
         working-directory: src
@@ -358,18 +376,38 @@ jobs:
             --name clickhouse \
             --root $(pwd) \
             --manifest-template $(pwd)/manifest.toml \
-            ${{ (inputs.release && '--release') || '' }}\
+            --release \
             -o ~/packages \
             ~/drivers/drivers-*-*/
 
           ls ~/packages
 
-      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f  # v6.0.0
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: all-packages
           path: ~/packages
           retention-days: 7
 
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          pattern: "validation-report-*"
+          path: "~/validation-report"
+
+      - name: Generate combined docs
+        working-directory: src
+        run: |
+          ls -laR ~/validation-report
+          find ~/validation-report -type f -name '*.xml'
+          cp $(find ~/validation-report -type f -name '*.xml') .
+          ls *.xml
+          pixi run gendocs --output generated
+
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        with:
+          name: docs
+          path: "src/generated/clickhouse.md"
+          retention-days: 2
+
   test-packages:
     name: "Test Packages/${{ matrix.platform }}_${{ matrix.arch }}"
     runs-on: ${{ matrix.runner }}
@@ -384,14 +422,15 @@ jobs:
           - { platform: windows, arch: amd64, runner: windows-latest }
     steps:
       # for now, install dbc from main
-      - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5  # v6.2.0
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
         with:
+          cache: false
           go-version: 'stable'
-      - uses: prefix-dev/setup-pixi@a0af7a228712d6121d37aba47adf55c1332c9c2e  # v0.9.4
+      - uses: prefix-dev/setup-pixi@1b2de7f3351f171c8b4dfeb558c639cb58ed4ec0  # v0.9.5
         with:
           pixi-version: v0.63.2
           run-install: false
-      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131  # v7.0.0
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           name: "all-packages"
           path: "~/packages"
@@ -448,17 +487,17 @@ jobs:
           persist-credentials: false
           submodules: 'recursive'
 
-      - uses: prefix-dev/setup-pixi@a0af7a228712d6121d37aba47adf55c1332c9c2e  # v0.9.4
+      - uses: prefix-dev/setup-pixi@1b2de7f3351f171c8b4dfeb558c639cb58ed4ec0  # v0.9.5
         with:
           pixi-version: v0.63.2
           run-install: false
 
-      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131  # v7.0.0
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           name: "all-packages"
           path: "~/packages"
 
-      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131  # v7.0.0
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           name: "docs"
           path: "~/packages"
@@ -469,8 +508,7 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         working-directory: src
         run: |
-          ref=${{ github.ref }}
-          tag=${ref#"refs/tags/"}
+          tag="${GITHUB_REF_NAME}"
           pixi run release $(pwd) $tag
           gh release upload $tag $(find ~/packages -name '*.tar.gz') $(find ~/packages -name 'manifest.yaml') $(find ~/packages -name '*.md')
 
@@ -480,8 +518,8 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         working-directory: src
         run: |
-          git tag go/v1000.0.0
-          tag=go/v1000.0.0
+          git tag src/v1000.0.0
+          tag=src/v1000.0.0
 
           pixi run release --dry-run $(pwd) $tag
           echo gh release upload $tag $(find ~/packages -name '*.tar.gz') $(find ~/packages -name 'manifest.yaml') $(find ~/packages -name '*.md')