Repository: ClickHouse/ClickHouse
File: ci/praktika/s3.py (Python)

Code before:
                    if not no_strict:
                        raise
                    return False
                except Exception as e:
                    print(f"ERROR: Failed to upload file using boto3: {e}")
                    if not no_strict:
                        raise
                    return False

        # AWS CLI approach: single file with version in metadata
        s3_path_clean = str(s3_path).removeprefix("s3://")
        bucket, key = s3_path_clean.split("/", maxsplit=1)

        try:
            if version == 0:
                # For version 0, just upload without conditions (clean start)
                print(f"Uploading file with version 0 (clean start) using AWS CLI")
                result_uploaded = cls.put(
                    s3_path=s3_path,
                    local_path=local_path,
                    metadata={"version": str(version)},
                    no_strict=no_strict,
                    text=text,
                )
                if not result_uploaded:
                    print("Failed to put file")
                    return False
            else:
                # For version > 0, use conditional PUT with If-Match (ETag check)
                # First get current ETag and verify version
                head_output = Shell.get_output(
                    f"aws s3api head-object --bucket {bucket} --key {key}",
                    strict=True,
                    verbose=True,
                )
                head_data = json.loads(head_output)
                current_etag = head_data.get("ETag", "").strip('"')
                current_version = int(head_data.get("Metadata", {}).get("version", "0"))

                # Verify we're updating from expected version
                if current_version != version - 1:
                    print(
                        f"Version mismatch: expected {version - 1}, found {current_version} (concurrent write detected)"
                    )
                    return False

                # Upload with If-Match condition
                content_type = "text/plain" if text else "application/octet-stream"
                command = f'aws s3api put-object --bucket {bucket} --key {key} --body {local_path} --content-type {content_type} --metadata version={version} --if-match "{current_etag}"'
                res = cls.run_command_with_retries(command, no_strict=no_strict)
                if not res:

Review comment (bug):
`copy_file_to_s3_with_version()` claims concurrent-write safety via ETag/conditions, but the `version == 0` path unconditionally overwrites the object (both boto3 and CLI). This allows clobbering an existing object (including a concurrently running writer) and breaks the “optimistic locking” guarantee for the initial write. Consider making version 0 conditional as well (e.g., `IfNoneMatch="*"` / `--if-none-match "*"`) and returning `False` on `PreconditionFailed`, or explicitly documenting/enforcing that version 0 is a destructive reset and must not be run concurrently.
```suggestion
                # For version 0, upload only if the object does not yet exist (clean start)
                print(f"Uploading file with version 0 (clean start, conditional) using AWS CLI")
                content_type = "text/plain" if text else "application/octet-stream"
                command = (
                    f'aws s3api put-object --bucket {bucket} --key {key} '
                    f'--body {local_path} --content-type {content_type} '
                    f'--metadata version={version} --if-none-match "*"'
                )
                res = cls.run_command_with_retries(command, no_strict=no_strict)
                if not res:
                    print("Failed to put file (object already exists or other error)")
```

Code after:
                                return False
                            raise

                    print(f"Uploaded file with version {version} using boto3")
                    StorageUsage.add_uploaded(local_path)
                    return True

                except ClientError as e:
                    error_code = e.response.get("Error", {}).get("Code", "")
                    if error_code == "PreconditionFailed":
                        print("Precondition failed (concurrent write detected)")
                        return False
                    print(f"ERROR: Failed to upload file using boto3: {error_code}")
                    if not no_strict:
                        raise
                    return False
                except Exception as e:
                    print(f"ERROR: Failed to upload file using boto3: {e}")
                    if not no_strict:
                        raise
                    return False

        # AWS CLI approach: single file with version in metadata
        s3_path_clean = str(s3_path).removeprefix("s3://")
        bucket, key = s3_path_clean.split("/", maxsplit=1)

        try:
            if version == 0:
                # DESTRUCTIVE: Version 0 uploads without conditions (NOT safe for concurrent use)
                print(
                    f"Uploading file with version 0 (destructive reset) using AWS CLI"
                )
                result_uploaded = cls.put(
                    s3_path=s3_path,
                    local_path=local_path,
                    metadata={"version": str(version)},
                    no_strict=no_strict,
                    text=text,
                )
                if not result_uploaded:
                    print("Failed to put file")
                    return False
            else:
                # For version > 0, use conditional PUT with If-Match (ETag check)
                # First get current ETag and verify version
                head_output = Shell.get_output(
                    f"aws s3api head-object --bucket {bucket} --key {key}",
                    strict=True,
                    verbose=True,
                )
                head_data = json.loads(head_output)