Repository: ClickHouse/ClickHouse
File: ci/praktika/s3.py (Python)

Code before:
        cls.run_command_with_retries(cmd, retries=3)

    @classmethod
    def copy_file_from_s3_with_version(cls, s3_path, local_path):
        """
        Downloads a file from S3 and returns its version from object metadata.

        :param s3_path: S3 path (with or without s3:// prefix)
        :param local_path: Local path to save the file
        :return: Version number from object metadata
        """
        # Use boto3 if available, otherwise AWS CLI
        if BOTO3_AVAILABLE:
            client = cls._get_boto3_client()
            if client:
                # boto3 approach: single file with version in metadata
                s3_path_clean = str(s3_path).removeprefix("s3://")
                bucket, key = s3_path_clean.split("/", maxsplit=1)

                # Get object metadata to extract version
                response = client.head_object(Bucket=bucket, Key=key)
                version = int(response.get("Metadata", {}).get("version", "0"))

                # Download the file
                Path(local_path).parent.mkdir(parents=True, exist_ok=True)
                client.download_file(bucket, key, str(local_path))

                print(f"Downloaded file from S3 with version {version} using boto3")
                return version

        # AWS CLI approach: single file with version in metadata
        s3_path_clean = str(s3_path).removeprefix("s3://")
        bucket, key = s3_path_clean.split("/", maxsplit=1)

        # Get object metadata to extract version
        output = Shell.get_output(
            f"aws s3api head-object --bucket {bucket} --key {key}",
            strict=True,
            verbose=True,
        )
        metadata = json.loads(output)
        version = int(metadata.get("Metadata", {}).get("version", "0"))

        # Download the file
        cls.copy_file_from_s3(s3_path=s3_path, local_path=local_path)

        print(f"Downloaded file from S3 with version {version} using AWS CLI")
        return version

    @classmethod
    def copy_file_to_s3_with_version(

Review comment (suggestion):
`copy_file_from_s3_with_version()` derives `version` from a `head_object` call, then downloads the object without any condition tying the download to the same object revision. If the object changes between `HEAD` and download, the returned `version` can mismatch the downloaded content. To keep version/content consistent, use a single `get_object` call (read metadata from the response and stream the body to `local_path`), or capture the ETag from `head_object` and download with an `If-Match` condition (boto3: pass `ExtraArgs={"IfMatch": etag}` to `download_file`; CLI: use `aws s3api get-object --if-match ...`).
```suggestion
                # Use a single get_object call so metadata and content come from the same revision
                response = client.get_object(Bucket=bucket, Key=key)
                version = int(response.get("Metadata", {}).get("version", "0"))

                # Download the file from the response body
                Path(local_path).parent.mkdir(parents=True, exist_ok=True)
                body = response["Body"]
                with open(local_path, "wb") as out_file:
                    for chunk in body.iter_chunks(chunk_size=8192):
                        if chunk:
                            out_file.write(chunk)
```

Code after:
        cls.run_command_with_retries(cmd, retries=3)

    @classmethod
    def copy_file_from_s3_with_version(cls, s3_path, local_path):
        """
        Downloads a file from S3 and returns its version from object metadata.
        Uses a single atomic GET operation to ensure version matches the downloaded content.

        :param s3_path: S3 path (with or without s3:// prefix)
        :param local_path: Local path to save the file
        :return: Version number from object metadata (guaranteed to match downloaded content)
        """
        # Use boto3 if available, otherwise AWS CLI
        if BOTO3_AVAILABLE:
            client = cls._get_boto3_client()
            if client:
                # boto3 approach: use get_object for atomic metadata+content read
                s3_path_clean = str(s3_path).removeprefix("s3://")
                bucket, key = s3_path_clean.split("/", maxsplit=1)

                # Use get_object to atomically read metadata and content
                # This prevents race condition where object changes between HEAD and GET
                response = client.get_object(Bucket=bucket, Key=key)
                version = int(response.get("Metadata", {}).get("version", "0"))

                # Stream body to file
                Path(local_path).parent.mkdir(parents=True, exist_ok=True)
                with open(local_path, "wb") as f:
                    f.write(response["Body"].read())

                print(f"Downloaded file from S3 with version {version} using boto3")
                return version

        # AWS CLI approach: use get-object for atomic metadata+content download
        s3_path_clean = str(s3_path).removeprefix("s3://")
        bucket, key = s3_path_clean.split("/", maxsplit=1)

        # Use get-object to atomically download file and get metadata
        # This prevents race condition where object changes between HEAD and GET
        Path(local_path).parent.mkdir(parents=True, exist_ok=True)
        output = Shell.get_output(
            f"aws s3api get-object --bucket {bucket} --key {key} {local_path}",
            strict=True,
            verbose=True,
        )
        metadata = json.loads(output)
        version = int(metadata.get("Metadata", {}).get("version", "0"))

        print(f"Downloaded file from S3 with version {version} using AWS CLI")
        return version