test: replace testcontainers with embedded-clickhouse across the suite

[BorisTyshkevich]

Summary

Replaces every testcontainers-based ClickHouse fixture in this repo with franchb/embedded-clickhouse, which runs ClickHouse as a host subprocess and skips Docker entirely on the happy path.

The motivation is two-pronged:

• Local dev (macOS): testcontainers + Docker Desktop / OrbStack + Ryuk on an isolator-sandboxed dev machine has been a recurring source of flakiness. The Ryuk reaper can't bind the docker socket through the proxy, the proxy intermittently rejected build/exec endpoints, large build contexts hit chunked-body limits, and the Antalya container takes 5–30s to boot per test.
• CI (Linux): every test job re-paid the Docker container startup cost. With ~30 tests touching CH, that adds up.

The migration drops local pkg/server runtime from ~50s to 4.2s, and the GitHub Actions test job from a recent-baseline median of 2:44 to 1:34 (43% faster).

Numbers from this branch

CI wall-clock:

	testcontainers (median of last 4 main runs)	embedded-clickhouse (run 24966839093)
test job	2:44	1:34
build-and-push-platforms (amd64)	~1:14	1:10
build-and-push-platforms (arm64)	~1:25	1:14
create-multiplatform-manifest	~0:15	0:16

Local macOS:

package	testcontainers	embedded-clickhouse
pkg/server	~50s	4.2s
pkg/clickhouse	unchanged baseline	7.5s
cmd/altinity-mcp	unchanged baseline	7.9s

Architecture

internal/testutil/embeddedch (new package) is the single source of truth. Setup(t, ...Option) returns a *config.ClickHouseConfig pointing at a host subprocess; EnsureAntalyaBinary(t) extracts the production Antalya binary from the Docker image once and points BinaryPath() at it.

Two flavors:

• FlavorStock (default): downloads upstream ClickHouse 26.1 from GitHub releases. embedded-clickhouse caches the binary at ~/.cache/embedded-clickhouse/.
• FlavorAntalya: pulls altinity/clickhouse-server:26.1.6.20001.altinityantalya, extracts /usr/bin/clickhouse via docker create + docker cp into ~/.cache/altinity-mcp/antalya-bin/, and runs that. t.Skip()'s on non-Linux because Antalya only ships Linux binaries.

XML config drop-ins go through WithConfigDropIn(xml) — written to <DataPath>/config.d/N.xml before Start(). ClickHouse's standard auto-merge picks them up. This replaces what testcontainers' Files: []ContainerFile was doing, including:

• the cluster-secret + interserver users config (pkg/clickhouse/cluster_secret_test.go)
• the OAuth token_processors + <user_directories> config (pkg/server/oauth_e2e_test.go)
• the TLS https_port.xml + cert references (cmd/altinity-mcp/main_test.go's connection_with_tls)

WithUsersXML(xml) writes a stub users.xml beside config.xml for tests whose drop-ins reference <user_directories><users_xml><path>users.xml</path></users_xml> — the Antalya container shipped one; embedded-clickhouse does not.

Tests touched

Direct migrations (testcontainers → embedded-clickhouse):

• pkg/server/server_test.go — all ~35 setupClickHouseContainer(t) callers swapped to setupEmbeddedClickHouse(t). The helper itself moved to embedded_clickhouse_helpers_test.go as a thin wrapper around embeddedch.Setup plus the default.test seeding.
• pkg/server/oauth_e2e_test.go — setupAntalyaClickHouseWithOIDC rewritten using embeddedch.Setup(WithFlavor(FlavorAntalya), WithConfigDropIn(...), WithUsersXML(...)). Mock OIDC provider is now 127.0.0.1-only (no host.docker.internal plumbing). New newAntalyaOIDCProvider helper serves the full OIDC discovery doc Antalya's token_processors parser requires.
• pkg/server/server_test.go TestOAuthOpenAPIFullFlow/complete_oauth_openapi_flow — same Antalya migration.
• pkg/clickhouse/client_test.go — setupClickHouseContainer (~70 lines) → 3-line wrapper around embeddedch.Setup(WithTCPProtocol()).
• pkg/clickhouse/cluster_secret_test.go — the shell-entrypoint workaround (used to write XML inside the container, dating back to when PUT /containers/.../archive was blocked) replaced with two WithConfigDropIn calls. ~50 lines deleted.
• cmd/altinity-mcp/main_test.go — setupClickHouseContainerMain shrunk to ~10 lines. The 6 inline testcontainers blocks in TestTestConnection (basic, TCP, TLS, readonly, max_execution_time, plus TestNewApplicationWithTestContainer) collapsed to embeddedch.Setup calls. The TLS test writes cert + key to t.TempDir() and references those host paths in a config.d drop-in (CH reads them on the host, not from inside a container).
• startContainerWithTiming helper removed (unused).

New regression test:

• pkg/server/embedded_xml_config_test.go — pins the config.d auto-merge contract end-to-end (custom user authenticates, profile setting applied, server-level setting visible in system.server_settings).

Cross-cutting fixes that landed during the migration

Three issues surfaced only on the GitHub Actions Linux runner during back-to-back runs of this branch; each commit message has the run ID for the failure that triggered it:

• Cross-process binary download race. go test ./... runs each package as a separate go test binary; embedded-clickhouse v0.4.0 locks within a process via sync.Once but not across processes. The first cold-cache run produced embedded-clickhouse: write binary: unexpected EOF and rename temp file: no such file or directory. Fix: hold an OS-level flock on ~/.cache/embedded-clickhouse/.altinity-mcp-extract.lock around the first stock-CH Start() per process. Lock is uncontended once the binary file exists.
• Antalya OIDC discovery doc. Antalya's token_processors parser rejected the abridged discovery doc returned by newTestOAuthProvider. Symptom: Cannot extract userinfo_endpoint or introspection_endpoint from OIDC configuration. Fix: new newAntalyaOIDCProvider returning the full doc (issuer, authorization_endpoint, token_endpoint, jwks_uri, userinfo_endpoint, introspection_endpoint, response_types_supported, subject_types_supported, id_token_signing_alg_values_supported). Bound via explicit net.Listen + http.Server.Serve rather than httptest.NewServer for exact Content-Length / chunked framing — Antalya's HTTP client appears sensitive to chunked-vs-fixed framing on small bodies.
• Antalya <local_directory> permission denied. The original token_processor.xml hardcoded /var/lib/clickhouse/access/, which the Antalya container created automatically but the GitHub runner user can't write. Fix: substitute a t.TempDir() into the XML at setup time.

go.mod

testcontainers-go and docker/docker removed (along with their transitive closure in go.sum). franchb/embedded-clickhouse v0.4.0 added.

What stays on testcontainers

Nothing in this PR. If anyone adds a fixture later that needs a feature embeddedch doesn't yet expose, the helper has clear extension points (WithConfigDropIn, WithUsersXML, WithStartTimeout).

Test plan

• go vet ./... — clean
• go test ./... on macOS — green in ~25s, Antalya tests skip with a clear reason
• CI run 24966839093 — green, test job 1:34, full pipeline including build-and-push and release ~3 min
• Verified no testcontainers imports remain in any _test.go

🤖 Generated with Claude Code