[teeohhem]

Summary

Repoints everything in the repo from hyperdxio/hyperdx to ClickHouse/ClickStack ahead of the GitHub transfer. Stacked on #. Merge after the transfer, not before.

Why after. @hyperdx/cli publishes with npm provenance, which requires the repository URL in packages/cli/package.json to match the repo that ran the workflow. Merged before the transfer, the next release fails. Merged after (with the npm trusted publisher updated), it is what makes the next release work.

What changed

• Links and metadata: README badges, issue templates, CONTRIBUTING, cli README and package.json, OCI image.source labels, VEX @id, Go module path, in-app links (What's new changelog, support text, careers page) and the tests that pin them.
• CI: CODEOWNERS → @ClickHouse/clickstack-app-devs (team must exist first). CLI release notes use $GITHUB_REPOSITORY. security-audit.yml scans this repo instead of the whole hyperdxio org. The review footer URL changes in the helper and deep-review.yml together, as the test requires.
• deep-resolve.yml checks that the commenter has write access. author_association == MEMBER will cover every ClickHouse org member, so association alone no longer means "maintainer".
• Image defaults: docker-compose.yml, DEPLOY.md, AUTO_PROVISION.md use clickhouse/clickstack, which # publishes. One release has to land between the two merges.
• New SECURITY.md pointing at the ClickHouse security policy. Please confirm the wording with ClickHouse security.

Left alone on purpose. CHANGELOG.md history, test fixtures that only exercise URL host handling, the dataset comment in claude-code-review.yml, the VOUCHED.td body, and the LICENSE copyright line (legal call). vouch and external-contributor alerts still treat org members as internal by design.

Side effect. The review prompt and helper are part of the trusted hash, so each open PR gets one extra review on its next push.

How to reproduce

On this branch: git grep -n hyperdxio -- ':!**/CHANGELOG.md' lists only the leftovers above. docker compose config resolves the app image to docker.clickhouse.com/clickhouse/clickstack:2.

How to test on Vercel preview

Preview routes: /search

Steps:

1. Open the Help menu in the left nav and click "What's new".
2. Verify the "View full changelog on GitHub →" link points at https://github.com/ClickHouse/ClickStack.

References

• Related PRs: # (base branch)

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments

Project	Deployment	Actions	Updated
hyperdx-oss	Ignored	Preview	Nov 5, 2026 7:29pm UTC
hyperdx-storybook	Ignored	Preview	Nov 5, 2026 7:29pm UTC

[changeset-bot]

🦋 Changeset detected

Latest commit: ea2ceeb

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 4 packages

Name	Type
@hyperdx/app	Patch
@hyperdx/cli	Patch
@hyperdx/api	Patch
@hyperdx/otel-collector	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

Duplicate code analysis

No new duplicate code introduced by this PR.

---

jscpd compared this branch against origin/main
across app, api and common-utils. Only new clones are listed; the codebase
currently holds 110 in total (1.22%).
Run yarn dupes locally to reproduce, or yarn dupes:all for the full picture.

[github-actions]

E2E Test Results

✅ All tests passed • 462 passed • 1 skipped • 1422s

Status	Count
✅ Passed	462
❌ Failed	0
⚠️ Flaky	2
⏭️ Skipped	1

Tests ran across 4 shards in parallel.

View full report →

[github-actions]

🟡 Tier 3 — Standard

Introduces new logic, modifies core functionality, or touches areas with non-trivial risk.

Why this tier:

• Touches API routes or data models — hidden complexity risk

Additional context: touches background tasks or the delivery pipeline lightly (22 lines, under the 30-line bar for Tier 4), spans packages but only 68 prod lines — under the 100-line cross-layer bar

Review process: Full human review — logic, architecture, edge cases.
SLA: First-pass feedback within 1 business day.

Stats

• Production files changed: 28
• Production lines changed: 68 (+ 20 in test files, excluded from tier calculation)
• Branch: teeohhem/tom/clickhouse-repo-migration
• Author: teeohhem

To override this classification, remove the review/tier-3 label and apply a different review/tier-* label. Manual overrides are preserved on subsequent pushes.

[github-actions]

PR Review

✅ No issues found.

[github-actions]

Deep Review

Report-only multi-agent review of a mechanical repo-rename PR (hyperdxio/hyperdx → ClickHouse/ClickStack) ahead of the GitHub transfer. Most of the diff is string/comment/URL replacement verified to have matching test updates; the behavioral changes (docker-compose env-var swap, release.yml dynamic URL, deep-resolve.yml write-access gate, Go module rename) were checked directly and are sound. .env defines CH_IMAGE_REPO/NEXT_IMAGE_NAME_DOCKERHUB, no Go source imports the old module path, and the write-access gate fails closed. One recommended item stands out.

✅ No critical issues found.

🟡 P2 -- recommended

• .github/workflows/security-audit.yml:13 -- The daily Dependabot/CVE alert step drops org: hyperdxio without substituting any other scope selector, so the scheduled job likely runs green while fetching zero alerts (or errors), silently disabling vulnerability alerting to Slack rather than repointing it.
  • Fix: Set an explicit scan target on the action-cve step (org: ClickHouse, or the action's repo/repos input scoped to this repository) and confirm a workflow_dispatch run actually emits an alert.
  • _{correctness, reliability, maintainability, security}

🔵 P3 nitpicks (2)

• packages/api/docs/auto_provision/AUTO_PROVISION.md:151 -- The Compose example folds two non-mechanical changes into the rename: the image moves from the API-only hyperdx/api to the combined clickhouse/clickstack while the service stays named hyperdx-api, and the tag moves from floating :latest to pinned :2, so a reader copying it gets a materially different container than the doc describes.
  • Fix: Point the example at the API image's successor or rename the service to match the all-in-one image, and keep the tag convention consistent with the doc's intent.
  • _{maintainability, project-standards}
• .github/CODEOWNERS:2 -- @ClickHouse/clickstack-app-devs only resolves once the repo lives in the ClickHouse org and the team has access; until then GitHub silently assigns no reviewer with no error, disabling round-robin review assignment.
  • Fix: Ensure the team exists and has repo access at the point this takes effect (consistent with the merge-after-transfer sequencing).

---

Reviewers (7): correctness, security, reliability, maintainability, testing, project-standards, previous-comments.

Testing gaps:

• The new deep-resolve.yml "Require write access" gate (permission predicate + 404-vs-rethrow branches) has no automated coverage; the logic traces as fail-closed, but it is security-sensitive and the repo only unit-tests extracted script modules, not inline workflow YAML.
• Several production URL constants with no pre-existing tests (ContactSupportText.tsx, CareersPage.tsx) were swapped unverified; no new logic, so no regression, but the new values are unpinned by any test.

Residual risks (not blocking, inherent to shipping ahead of the transfer):

• docker-compose.yml:59 now resolves the default app image to docker.clickhouse.com/clickhouse/clickstack:2; docker compose up fails for self-hosters unless that tag is published to the new registry before this lands.
• Live-fetch surfaces (useWhatsNew.ts changelog, CareersPage.tsx commits API) now target ClickHouse/ClickStack and will 404 until the transfer completes, degrading "What's new"/careers feeds to their empty/error state in the interim.
• Pre-existing and widened by the larger org: deep-resolve.yml consumes the latest <!-- deep-review --> comment by marker regardless of author, while the new gate authenticates only the /just-fix-it triggerer — any user can plant finding/injection content that a maintainer's trigger then executes with edit+push credentials.

_{No finding blocks merge automatically. A maintainer will expect P0/P1 findings in code this PR changes to be fixed; P2/P3 are your call -- fix or reply. Never fix findings about surrounding code here; reply instead. Do not widen the PR. How to respond}