[shobhit-seg]

Summary

• make every ClickHouse client explicitly use the Certifi CA bundle
• keep TLS certificate verification enabled in frozen macOS builds
• cover main, credential-test, and per-tab client creation paths
• smoke test a real ClickHouse connection from the packaged macOS executable before publishing a release

Root cause

The packaged app includes Certifi, but Clicky did not pass ca_cert to clickhouse-connect. The frozen OpenSSL runtime therefore looked for a build-machine CA path that is absent on user machines.

Release guard

The release workflow launches dist/clicky.app/Contents/MacOS/clicky --release-connection-test and connects through the production DatabaseManager to the public, read-only ClickHouse Playground. The check uses the packaged TLS stack, needs no secrets, retries transient failures, and runs before ZIP packaging or upload.

Validation

• 124 tests passed
• Ruff check and format passed
• compileall passed
• uv lock check passed
• release-style PyInstaller macOS build passed
• frozen executable connected successfully to the ClickHouse Playground
• bundled Certifi CA hash matches the source environment
• codesign deep verification passed