Repository: ClickHouse/ClickHouse
File: ci/praktika/s3.py (Python)

Code before:
        ).is_file(), f"Path [{local_path}] is not file. Only files are supported"

        # Use boto3 if available, otherwise AWS CLI
        if BOTO3_AVAILABLE:
            client = cls._get_boto3_client()
            if client:
                # boto3 approach: single file with version in metadata
                s3_path_clean = str(s3_path).removeprefix("s3://")
                bucket, key = s3_path_clean.split("/", maxsplit=1)

                try:
                    extra_args = {
                        "ContentType": (
                            "text/plain" if text else "application/octet-stream"
                        ),
                        "Metadata": {"version": str(version)},
                    }

                    if version == 0:
                        # For version 0, just overwrite (clean start)
                        print(
                            f"Uploading file with version 0 (clean start) using boto3"
                        )
                        client.upload_file(
                            str(local_path), bucket, key, ExtraArgs=extra_args
                        )
                    else:
                        # For version > 0, use conditional PUT with If-Match (ETag check)
                        # First get current ETag
                        try:
                            head_response = client.head_object(Bucket=bucket, Key=key)
                            current_etag = head_response.get("ETag", "").strip('"')
                            current_version = int(
                                head_response.get("Metadata", {}).get("version", "0")
                            )

                            # Verify we're updating from expected version
                            if current_version != version - 1:
                                print(
                                    f"Version mismatch: expected {version - 1}, found {current_version} (concurrent write detected)"
                                )
                                return False

                            # Read file content for put_object (needed for If-Match)
                            with open(local_path, "rb") as f:
                                client.put_object(
                                    Bucket=bucket,
                                    Key=key,
                                    Body=f.read(),
                                    ContentType=(
                                        "text/plain"

Review comment (bug):
`copy_file_to_s3_with_version()` claims concurrent-write safety via ETag/conditions, but the `version == 0` path unconditionally overwrites the object (both boto3 and CLI). This allows clobbering an existing object (including a concurrently running writer) and breaks the “optimistic locking” guarantee for the initial write. Consider making version 0 conditional as well (e.g., `IfNoneMatch="*"` / `--if-none-match "*"`) and returning `False` on `PreconditionFailed`, or explicitly documenting/enforcing that version 0 is a destructive reset and must not be run concurrently.
```suggestion
                        # For version 0, perform a conditional create (fail if object exists)
                        print(
                            f"Uploading file with version 0 (clean start) using boto3 (If-None-Match)"
                        )
                        # Use IfNoneMatch="*" to ensure we don't clobber an existing object
                        with open(local_path, "rb") as f:
                            client.put_object(
                                Bucket=bucket,
                                Key=key,
                                Body=f.read(),
                                ContentType=(
                                    "text/plain"
                                    if text
                                    else "application/octet-stream"
                                ),
                                Metadata={"version": str(version)},
                                IfNoneMatch="*",
                            )
```

Code after:
        :param no_strict: Whether to suppress unexpected errors (returns False instead of raising exception)
        :return: True if successful, False if concurrent write detected (object was modified by another process).
                 On unexpected errors: raises exception if no_strict=False, returns False if no_strict=True.
        """
        assert Path(local_path).exists(), f"Path [{local_path}] does not exist"
        assert Path(
            local_path
        ).is_file(), f"Path [{local_path}] is not file. Only files are supported"

        # Warn about version 0 usage
        if version == 0:
            print(
                "WARNING: Version 0 is a destructive reset operation - ensure no concurrent writes are happening"
            )

        # Use boto3 if available, otherwise AWS CLI
        if BOTO3_AVAILABLE:
            client = cls._get_boto3_client()
            if client:
                # boto3 approach: single file with version in metadata
                s3_path_clean = str(s3_path).removeprefix("s3://")
                bucket, key = s3_path_clean.split("/", maxsplit=1)

                try:
                    extra_args = {
                        "ContentType": (
                            "text/plain" if text else "application/octet-stream"
                        ),
                        "Metadata": {"version": str(version)},
                    }

                    if version == 0:
                        # DESTRUCTIVE: Version 0 overwrites without conditions (NOT safe for concurrent use)
                        print(
                            f"Uploading file with version 0 (destructive reset) using boto3"
                        )
                        client.upload_file(
                            str(local_path), bucket, key, ExtraArgs=extra_args
                        )
                    else:
                        # For version > 0, use conditional PUT with If-Match (ETag check)
                        # First get current ETag
                        try:
                            head_response = client.head_object(Bucket=bucket, Key=key)
                            current_etag = head_response.get("ETag", "").strip('"')
                            current_version = int(
                                head_response.get("Metadata", {}).get("version", "0")
                            )

                            # Verify we're updating from expected version
                            if current_version != version - 1: