Summary

Follow-up to #706. The wrapper CLI was merged but orchestration was still manual ("download the test files, splice bin/ into PATH, run by hand"). This PR makes that flow reproducible locally and exercised in CI, without forcing a multi-GB clone of ClickHouse/ClickHouse.

• tests/clickhouse-test-runner/scripts/run-upstream-tests.sh — driver that builds the wrapper if needed, reads upstream-allowlist.txt, exports PATH/log path/impl, then execs python3 tests/clickhouse-test "${tests[@]}" "$@" from the upstream checkout. Knobs: UPSTREAM_CLICKHOUSE_DIR, UPSTREAM_TEST_LIST, CLICKHOUSE_CLIENT_CLI_IMPL, CLICKHOUSE_CLIENT_CLI_LOG. Extra args are forwarded.
• tests/clickhouse-test-runner/upstream-allowlist.txt — curated test list, seeded with 01428_hash_set_nan_key. One name per line, # for comments, whitespace trimmed.
• .github/workflows/upstream-sql-tests.yml — standalone workflow (not in the success aggregator). Uses a second actions/checkout with repository: ClickHouse/ClickHouse, fetch-depth: 1, and sparse-checkout: limited to tests/clickhouse-test, tests/queries, tests/config, tests/ci, tests/performance, docker/test/util — no full clone. Matrix impl: [client, http] × clickhouse: [head, latest]. Triggers: workflow_dispatch (with upstream_ref/clickhouse_version inputs), nightly cron, and push/PR scoped to tests/clickhouse-test-runner/**. Run log + *.stdout/*.stderr/*.diff always uploaded as artifacts.
• Docs — README replaces the manual snippet with sparse-clone + helper usage, documents the new env vars, and adds "Extending the allowlist" / "CI" subsections. CONTRIBUTING.md and AGENTS.md get pointer entries. .gitignore excludes .upstream/.

Local usage:

git clone --depth 1 --filter=blob:none --sparse https://github.com/ClickHouse/ClickHouse.git
(cd ClickHouse && git sparse-checkout set tests/clickhouse-test tests/queries tests/config tests/ci)

UPSTREAM_CLICKHOUSE_DIR=$PWD/ClickHouse \
  tests/clickhouse-test-runner/scripts/run-upstream-tests.sh --print-time

The allowlist is intentionally tiny on day one — it grows as we triage which upstream tests pass cleanly through client and http backends. The nightly run against master is what surfaces upstream drift (new tests/clickhouse-test flags, extract-from-config keys, or settings classification changes that the wrapper needs to keep up with).

Checklist

• Unit and integration tests covering the common scenarios were added