Merge branch 'master' into agg-ref-debug

* filters in dashcards tracking

* update tracking according to spec

.clj-kondo/config.edn

@@ -58,9 +58,11 @@
   :metabase/check-defmulti-arglists                    {:level :warning}
   :metabase/check-me-humanize                          {:level :warning}
   :metabase/defsetting-must-specify-export             {:level :warning}
+  :metabase/defsetting-namespace                       {:level :warning}
   :metabase/mbql-query-first-arg                       {:level :warning}
   :metabase/missing-test-expr-requires-in-cljs         {:level :warning}
   :metabase/modules                                    {:level :warning} ; more config in `.clj-kondo/config/modules/config.edn`
+  :metabase/namespace-name                             {:level :warning}
   :metabase/require-shape-checker                      {:level :warning}
   :metabase/test-helpers-use-non-thread-safe-functions {:level :warning} ; more config in `.clj-kondo/config/test-helpers/config.edn`
   :metabase/validate-logging                           {:level :warning}
@@ -74,8 +76,13 @@
    ;;
    ;; TODO -- these should all be made thread safe if possible or renamed so they end in `!`. Then we can remove them
    ;; from this list because by default anything ending in `!` is considered to be thread-unsafe
+   ;;
+   ;; TODO (Cam 6/19/25) -- move this into the `test-helpers/config.edn` file so they can live with their friends.
    :parallel/unsafe
-   #{clojure.core/alter-var-root
+   #{java.util.Locale/setDefault
+     java.lang.System/setProperty
+     java.lang.System/setProperties
+     clojure.core/alter-var-root
      clojure.core/with-redefs
      clojure.core/with-redefs-fn
      metabase.actions.test-util/with-actions
@@ -91,11 +98,9 @@
      metabase.test.data.users/with-group-for-user
      metabase.test.data/with-empty-h2-app-db
      metabase.test.util.log/with-log-level
-     metabase.test.util.misc/with-single-admin-user
      metabase.test.util/with-all-users-permission
      metabase.test.util/with-discarded-collections-perms-changes
      metabase.test.util/with-env-keys-renamed-by
-     metabase.test.util/with-locale
      metabase.test.util/with-model-cleanup
      metabase.test.util/with-non-admin-groups-no-root-collection-for-namespace-perms
      metabase.test.util/with-non-admin-groups-no-root-collection-perms
@@ -118,12 +123,10 @@
      metabase.test/with-fake-inbox
      metabase.test/with-group
      metabase.test/with-group-for-user
-     metabase.test/with-locale
      metabase.test/with-log-level
      metabase.test/with-model-cleanup
      metabase.test/with-non-admin-groups-no-root-collection-for-namespace-perms
      metabase.test/with-non-admin-groups-no-root-collection-perms
-     metabase.test/with-single-admin-user
      metabase.test/with-temp-env-var-value
      metabase.test/with-temp-vals-in-db
      metabase.test/with-temporary-raw-setting-values
@@ -232,8 +235,14 @@
     (metabase.driver.druid.query-processor-test/druid-query-returning-rows)
     (metabase.lib.util.match/match)
     (metabase.lib.util.match/match-one)
+    (metabase.lib.util.match/match-lite)
+    (metabase.lib.util.match/match-lite-recursive)
     (metabase.lib.util.match/replace)
     (metabase.lib.util.match/replace-in)
+    (metabase.driver-api.core/match)
+    (metabase.driver-api.core/match-one)
+    (metabase.driver-api.core/replace)
+    (metabase.driver-api.core/replace-in)
     (metabase.query-processor.middleware.cache-backend.interface/with-cached-results)
     (metabase.util.regex/rx [opt])
     (metabase.util/prog1 [<>])
@@ -242,20 +251,14 @@
 
   :deprecated-var
   {:exclude
-   {metabase.cmd/dump                                                            {:namespaces ["metabase\\.cmd-test" "metabase-enterprise\\.serialization\\.cmd-test"]}
-    metabase.cmd/load                                                            {:namespaces ["metabase\\.cmd-test" "metabase-enterprise\\.serialization\\.cmd-test"]}
-    metabase.db.data-migrations/data-migrations                                  {:namespaces ["metabase\\.db\\.data-migrations"]}
-    metabase.db.data-migrations/defmigration                                     {:namespaces ["metabase\\.db\\.data-migrations"]}
-    metabase.db.data-migrations/run-migration-if-needed!                         {:namespaces ["metabase\\.db\\.data-migrations"]}
+   {metabase.cmd.core/dump                                                       {:namespaces ["metabase\\.cmd-test" "metabase-enterprise\\.serialization\\.cmd-test"]}
+    metabase.cmd.core/load                                                       {:namespaces ["metabase\\.cmd-test" "metabase-enterprise\\.serialization\\.cmd-test"]}
     metabase.driver.sql-jdbc.execute.old-impl/set-timezone-sql                   {:namespaces ["metabase\\.driver.*"]}
     metabase.driver.sql-jdbc.execute/set-time-zone-if-supported!                 {:namespaces ["metabase\\.driver.*"]}
     metabase.driver/current-db-time                                              {:namespaces ["metabase.*"]}
     metabase.driver/supports?                                                    {:namespaces ["metabase.*"]}
-    metabase.premium-features.premium-features/enable-enhancements?              {:namespaces ["metabase\\.models.*"]}
     metabase.query-processor.middleware.resolve-joins/maybe-resolve-source-table {:namespaces ["metabase.*"]}
-    metabase.query-processor.util/normalize-token                                {:namespaces ["metabase.*"]}
-    schema.core/both                                                             {:namespaces ["metabase.*"]}
-    schema.core/either                                                           {:namespaces ["metabase.*"]}}}
+    metabase.query-processor.util/normalize-token                                {:namespaces ["metabase.*"]}}}
 
   :discouraged-var
   {clojure.core/print                                 {:message "Use metabase.util.log instead of clojure.core/print"}
@@ -288,7 +291,10 @@
    me.flowthing.pp/pprint                             {:message "Use metabase.util.log instead of me.flowthing.pp/pprint"}
    medley.core/random-uuid                            {:message "Use clojure.core/random-uuid instead of medley.core/random-uuid"}
    metabase.driver/database-supports?                 {:message "Use metabase.driver.util/supports? instead of metabase.driver/database-supports?"}
-   metabase.lib.equality/find-column-indexes-for-refs {:message "Use lib.equality/closest-matches-in-metadata or lib.equality/find-closest-matches-for-refs instead of lib.equality/find-column-indexes-for-refs"}}
+   metabase.lib.equality/find-column-indexes-for-refs {:message "Use lib.equality/closest-matches-in-metadata or lib.equality/find-closest-matches-for-refs instead of lib.equality/find-column-indexes-for-refs"}
+   next.jdbc/active-tx?                               {:message "Use metabase.app-db.core/in-transaction? to see if we are in a transaction"}
+   toucan2.core/debug                                 {:message "Don't commit code using t2/debug"}
+   toucan2.tools.debug/debug                          {:message "Don't commit code using t2/debug"}}
 
   :discouraged-namespace
   {camel-snake-kebab.core {:message "CSK is not Turkish-safe, use the versions in metabase.util instead."}
@@ -309,218 +315,90 @@
 
   :consistent-alias
   {:aliases
-   {buddy.core.hash                                               buddy-hash
-    cheshire.generate                                             json.generate
-    clojure.tools.logging                                         log
-    clj-http.client                                               http
-    clj-ldap.client                                               ldap
-    clj-time.coerce                                               time.coerce
-    clj-time.format                                               time.format
-    clojure.core.async                                            a
-    clojure.core.match                                            clojure.core.match ; Prefer :refer [match]
-    clojure.data                                                  data
-    clojure.math.combinatorics                                    math.combo
-    clojure.pprint                                                pprint
-    clojure.spec.alpha                                            s
-    clojure.string                                                str
-    clojure.test                                                  t
-    clojure.tools.build.api                                       b
-    clojure.tools.namespace.dependency                            ns.deps
-    clojure.tools.namespace.find                                  ns.find
-    clojure.tools.namespace.parse                                 ns.parse
-    colorize.core                                                 colorize
-    environ.core                                                  env
-    hiccup.core                                                   hiccup
-    hiccup.util                                                   hiccup.util
-    honey.sql                                                     sql
-    honey.sql.helpers                                             sql.helpers
-    java-time.api                                                 t
-    macaw.core                                                    macaw
-    malli.core                                                    mc
-    malli.error                                                   me
-    malli.experimental                                            mx
-    malli.generator                                               mg
-    malli.provider                                                mp
-    malli.transform                                               mtx
-    malli.util                                                    mut
-    medley.core                                                   m
-    metabase-enterprise.audit-app.pages.common                    common
-    metabase-enterprise.sandbox.api.table                         table
-    metabase-enterprise.sandbox.api.util                          sandbox.api.util
-    metabase-enterprise.database-routing.core                     database-routing
-    metabase-enterprise.test                                      met
-    metabase.analytics.sdk                                        sdk
-    metabase.analytics.stats                                      stats
-    metabase.analysis.native-query-analyzer                       nqa
-    metabase.analysis.native-query-analyzer.parameter-substitution nqa.sub
-    metabase.analyze.query-results                                qr
-    metabase.analyze.classifiers.category                         classifiers.category
-    metabase.analyze.classifiers.core                             classifiers
-    metabase.analyze.classifiers.name                             classifiers.name
-    metabase.analyze.classifiers.no-preview-display               classifiers.no-preview-display
-    metabase.analyze.classifiers.text-fingerprint                 classifiers.text-fingerprint
-    metabase.analyze.fingerprint.fingerprinters                   fingerprinters
-    metabase.analyze.fingerprint.insights                         insights
-    metabase.analyze.fingerprint.schema                           fingerprint.schema
-    metabase.api.common                                           api
-    metabase.channel.core                                         channel
-    metabase.channel.render.core                                  channel.render
-    metabase.cloud-migration.core                                 cloud-migration
-    metabase.cmd.copy.h2                                          copy.h2
-    metabase.config                                               config
-    metabase.config.file                                          config.file
-    metabase.connection-pool                                      connection-pool
-    metabase.db.connection                                        mdb.connection
-    metabase.db.jdbc-protocols                                    mdb.jdbc-protocols
-    metabase.db.metadata-queries                                  metadata-queries
-    metabase.db.spec                                              mdb.spec
-    metabase.db.query                                             mdb.query
-    metabase.driver.common.parameters                             params
-    metabase.driver.common.parameters.dates                       params.dates
-    metabase.driver.common.parameters.operators                   params.ops
-    metabase.driver.common.parameters.parse                       params.parse
-    metabase.driver.common.parameters.values                      params.values
-    metabase.driver.druid.client                                  druid.client
-    metabase.driver.druid.execute                                 druid.execute
-    metabase.driver.druid.js                                      druid.js
-    metabase.driver.druid.query-processor                         druid.qp
-    metabase.driver.druid.sync                                    druid.sync
-    metabase.driver.impl                                          driver.impl
-    metabase.driver.mongo.execute                                 mongo.execute
-    metabase.driver.mongo.parameters                              mongo.params
-    metabase.driver.mongo.query-processor                         mongo.qp
-    metabase.driver.mongo.util                                    mongo.util
-    metabase.driver.sql                                           driver.sql
-    metabase.driver.sql-jdbc.common                               sql-jdbc.common
-    metabase.driver.sql-jdbc.connection                           sql-jdbc.conn
-    metabase.driver.sql-jdbc.execute                              sql-jdbc.execute
-    metabase.driver.sql-jdbc.execute.diagnostic                   sql-jdbc.execute.diagnostic
-    metabase.driver.sql-jdbc.execute.legacy-impl                  sql-jdbc.legacy
-    metabase.driver.sql-jdbc.execute.old-impl                     sql-jdbc.execute.old
-    metabase.driver.sql-jdbc.sync                                 sql-jdbc.sync
-    metabase.driver.sql-jdbc.sync.common                          sql-jdbc.sync.common
-    metabase.driver.sql-jdbc.sync.describe-database               sql-jdbc.describe-database
-    metabase.driver.sql-jdbc.sync.describe-table                  sql-jdbc.describe-table
-    metabase.driver.sql-jdbc.sync.interface                       sql-jdbc.sync.interface
-    metabase.driver.sql-jdbc.test-util                            sql-jdbc.tu
-    metabase.driver.sql.parameters.substitute                     sql.params.substitute
-    metabase.driver.sql.parameters.substitution                   sql.params.substitution
-    metabase.eid-translation.core                                 eid-translation
-    metabase.formatter                                            formatter
-    metabase.http-client                                          client
-    metabase.legacy-mbql.normalize                                mbql.normalize
-    metabase.legacy-mbql.schema                                   mbql.s
-    metabase.legacy-mbql.util                                     mbql.u
-    metabase.lib.util                                             lib.util
-    metabase.lib.util.match                                       lib.util.match
-    metabase.login-history.core                                   login-history
-    metabase.model-persistence.core                               model-persistence
-    metabase.models.dependency                                    dependency
-    metabase.models.interface                                     mi
-    metabase.notification.core                                    notification
-    metabase.notification.payload.core                            notification.payload
-    metabase.notification.test-util                               notification.tu
-    metabase.permissions.core                                     perms
-    metabase.plugins.initialize                                   plugins.init
-    metabase.public-sharing.core                                  public-sharing
-    metabase.premium-features.core                                premium-features
-    metabase.pulse.core                                           pulse
-    metabase.pulse.render                                         render
-    metabase.pulse.render.body                                    body
-    metabase.pulse.render.style                                   style
-    metabase.pulse.test-util                                      pulse.test-util
-    metabase.pulse.parameters                                     pulse-params
-    metabase.query-processor-test                                 qp.test
-    metabase.query-processor.context                              qp.context
-    metabase.query-processor.error-type                           qp.error-type
-    metabase.query-processor.interface                            qp.i
-    metabase.query-processor.middleware.add-dimension-projections qp.add-dimension-projections
-    metabase.query-processor.middleware.add-implicit-clauses      qp.add-implicit-clauses
-    metabase.query-processor.middleware.add-implicit-joins        qp.add-implicit-joins
-    metabase.query-processor.middleware.auto-bucket-datetimes     qp.auto-bucket-datetimes
-    metabase.query-processor.middleware.constraints               qp.constraints
-    metabase.query-processor.middleware.cumulative-aggregations   qp.cumulative-aggregations
-    metabase.query-processor.middleware.parameters.mbql           qp.mbql
-    metabase.query-processor.middleware.parameters.native         qp.native
-    metabase.query-processor.middleware.permissions               qp.perms
-    metabase.query-processor.middleware.pre-alias-aggregations    qp.pre-alias-aggregations
-    metabase.query-processor.middleware.resolve-fields            qp.resolve-fields
-    metabase.query-processor.middleware.resolve-referenced        qp.resolve-referenced
-    metabase.query-processor.middleware.resolve-source-table      qp.resolve-source-table
-    metabase.query-processor.middleware.wrap-value-literals       qp.wrap-value-literals
-    metabase.query-processor.pivot                                qp.pivot
-    metabase.query-processor.streaming                            qp.streaming
-    metabase.query-processor.streaming.interface                  qp.si
-    metabase.query-processor.streaming.xlsx                       qp.xlsx
-    metabase.query-processor.timezone                             qp.timezone
-    metabase.query-processor.util                                 qp.util
-    metabase.request.core                                         request
-    metabase.revisions.core                                       revisions
-    metabase.search.config                                        search.config
-    metabase.search.filter                                        search.filter
-    metabase.search.in-place.filter                               search.in-place.filter
-    metabase.search.in-place.util                                 search.util
-    metabase.search.in-place.scoring                              scoring
-    metabase.server.core                                          server
-    metabase.server.protocols                                     server.protocols
-    metabase.sso.core                                             sso
-    metabase.settings.core                                        setting
-    metabase.sync.analyze.fingerprint                             sync.fingerprint
-    metabase.sync.field-values                                    sync.field-values
-    metabase.sync.interface                                       i
-    metabase.sync.schedules                                       sync.schedules
-    metabase.sync.sync-metadata.crufty                            crufty
-    metabase.sync.sync-metadata.fields.our-metadata               fields.our-metadata
-    metabase.sync.util                                            sync-util
-    metabase.sync.util-test                                       sync.util-test
-    metabase.test                                                 mt
-    metabase.test.data.dataset-definitions                        defs
-    metabase.test.data.env.impl                                   tx.env.impl
-    metabase.test.data.impl                                       data.impl
-    metabase.test.data.users                                      test.users
-    metabase.test.domain-entities                                 test.de
-    metabase.test.mock.util                                       mock.util
-    metabase.test.sync                                            test.sync
-    metabase.test.redefs                                          test.redefs
-    metabase.test.util.js                                         test.js
-    metabase.test.util.timezone                                   test.tz
-    metabase.timeline.core                                        timeline
-    metabase.timeseries-query-processor-test.util                 tqpt
-    metabase.util.cron                                            u.cron
-    metabase.util.currency                                        currency
-    metabase.util.date-2                                          u.date
-    metabase.util.date-2.common                                   u.date.common
-    metabase.util.date-2.parse                                    u.date.parse
-    metabase.util.embed                                           embed
-    metabase.util.encryption                                      encryption
-    metabase.util.encryption-test                                 encryption-test
-    metabase.util.files                                           u.files
-    metabase.util.grouper                                         grouper
-    metabase.util.honey-sql-2                                     h2x
-    metabase.util.i18n                                            i18n
-    metabase.util.i18n.impl                                       i18n.impl
-    metabase.util.jvm                                             u.jvm
-    metabase.util.log                                             log
-    metabase.util.macros                                          u.macros
-    metabase.util.malli                                           mu
-    metabase.util.malli.schema                                    ms
-    metabase.util.markdown                                        markdown
-    metabase.util.password                                        u.password
-    metabase.util.schema                                          su
-    metabase.util.ui-logic                                        ui-logic
-    metabase.util.urls                                            urls
-    metabase.xrays.core                                           xrays
-    metabuild-common.core                                         u
-    metabuild-common.output                                       out
-    metabuild-common.shell                                        shell
-    monger.collection                                             mcoll
-    ring.mock.request                                             ring.mock
-    ring.util.codec                                               codec
-    ring.util.response                                            response
-    ring.adapter.jetty9.servlet                                   servlet
-    saml20-clj.core                                               saml
-    toucan.db                                                     db
-    toucan.models                                                 models}}}
+   {buddy.core.hash                           buddy-hash
+    cheshire.generate                         json.generate
+    clj-http.client                           http
+    clj-ldap.client                           ldap
+    clj-time.coerce                           time.coerce
+    clj-time.format                           time.format
+    clojure.core.async                        a
+    clojure.core.match                        clojure.core.match
+    clojure.data                              data
+    clojure.math.combinatorics                math.combo
+    clojure.pprint                            pprint
+    clojure.spec.alpha                        s
+    clojure.string                            str
+    clojure.test                              t
+    clojure.tools.build.api                   b
+    clojure.tools.logging                     log
+    clojure.tools.namespace.dependency        ns.deps
+    clojure.tools.namespace.find              ns.find
+    clojure.tools.namespace.parse             ns.parse
+    colorize.core                             colorize
+    environ.core                              env
+    hiccup.core                               hiccup
+    hiccup.util                               hiccup.util
+    honey.sql                                 sql
+    honey.sql.helpers                         sql.helpers
+    java-time.api                             t
+    macaw.core                                macaw
+    malli.core                                mc
+    malli.error                               me
+    malli.experimental                        mx
+    malli.generator                           mg
+    malli.provider                            mp
+    malli.transform                           mtx
+    malli.util                                mut
+    medley.core                               m
+    metabase-enterprise.database-routing.core database-routing
+    metabase.analyze.classifiers.core         classifiers
+    metabase.channel.core                     channel
+    metabase.channel.render.core              channel.render
+    metabase.cloud-migration.core             cloud-migration
+    metabase.eid-translation.core             eid-translation
+    metabase.login-history.core               login-history
+    metabase.model-persistence.core           model-persistence
+    metabase.notification.core                notification
+    metabase.notification.payload.core        notification.payload
+    metabase.permissions.core                 perms
+    metabase.premium-features.core            premium-features
+    metabase.public-sharing.core              public-sharing
+    metabase.pulse.core                       pulse
+    metabase.query-permissions.core           query-perms
+    metabase.request.core                     request
+    metabase.revisions.core                   revisions
+    metabase.server.core                      server
+    metabase.settings.core                    setting
+    metabase.sso.core                         sso
+    metabase.timeline.core                    timeline
+    metabase.util.cron                        u.cron
+    metabase.util.currency                    currency
+    metabase.util.date-2                      u.date
+    metabase.util.date-2.common               u.date.common
+    metabase.util.date-2.parse                u.date.parse
+    metabase.util.embed                       embed
+    metabase.util.encryption                  encryption
+    metabase.util.encryption-test             encryption-test
+    metabase.util.files                       u.files
+    metabase.util.grouper                     grouper
+    metabase.util.honey-sql-2                 h2x
+    metabase.util.i18n                        i18n
+    metabase.util.i18n.impl                   i18n.impl
+    metabase.util.jvm                         u.jvm
+    metabase.util.log                         log
+    metabase.util.macros                      u.macros
+    metabase.util.malli                       mu
+    metabase.util.malli.schema                ms
+    metabase.util.markdown                    markdown
+    metabase.util.password                    u.password
+    metabase.util.ui-logic                    ui-logic
+    metabase.xrays.core                       xrays
+    monger.collection                         mcoll
+    ring.mock.request                         ring.mock
+    ring.util.codec                           codec
+    ring.util.response                        response
+    saml20-clj.core                           saml
+    toucan2.core                              t2}}}
 
  :lint-as
  {cljs.cache/defcache                                                                   clojure.core/deftype
@@ -529,33 +407,37 @@
   clojure.test.check.clojure-test/defspec                                               clojure.test/deftest
   clojure.test.check.properties/for-all                                                 clojure.core/let
   clojurewerkz.quartzite.jobs/defjob                                                    clojure.core/defn
+  instaparse.core/defparser                                                             clojure.core/def
   metabase-enterprise.serialization.test-util/with-dbs                                  clojure.core/fn
   metabase-enterprise.serialization.test-util/with-random-dump-dir                      clojure.core/let
+metabase-enterprise.content-translation.routes-test/with-new-secret-key!                clojure.core/fn
   metabase.actions.test-util/with-actions                                               clojure.core/let
   metabase.api.common/let-404                                                           clojure.core/let
+  metabase.app-db.custom-migrations.util/with-temp-scheduler!                           clojure.core/fn
+  metabase.app-db.custom-migrations/define-migration                                    clj-kondo.lint-as/def-catch-all
+  metabase.app-db.custom-migrations/define-reversible-migration                         clj-kondo.lint-as/def-catch-all
+  metabase.app-db.liquibase/with-liquibase                                              clojure.core/let
+  metabase.app-db.schema-migrations-test.impl/with-temp-empty-app-db                    clojure.core/let
   metabase.channel.impl.http-test/with-captured-http-requests                           clojure.core/fn
   metabase.channel.impl.http-test/with-server                                           clojure.core/let
-  metabase.dashboard-subscription-test/with-dashboard-sub-for-card                      clojure.core/let
-  metabase.db.custom-migrations/define-migration                                        clj-kondo.lint-as/def-catch-all
-  metabase.db.custom-migrations/define-reversible-migration                             clj-kondo.lint-as/def-catch-all
-  metabase.db.custom-migrations.util/with-temp-scheduler!                               clojure.core/fn
-  metabase.db.liquibase/with-liquibase                                                  clojure.core/let
-  metabase.db.schema-migrations-test.impl/with-temp-empty-app-db                        clojure.core/let
+  metabase.collections.models.collection-test/with-collection-in-location               clojure.core/let
   metabase.driver.mongo.connection/with-mongo-client                                    clojure.core/let
   metabase.driver.mongo.connection/with-mongo-database                                  clojure.core/let
   metabase.driver.mongo.query-processor/mongo-let                                       clojure.core/let
   metabase.driver.sql-jdbc.actions/with-jdbc-transaction                                clojure.core/let
+  metabase.driver.sql-jdbc.connection.ssh-tunnel/with-ssh-tunnel                        clojure.core/let
   metabase.driver.sql-jdbc.connection/with-connection-spec-for-testing-connection       clojure.core/let
   metabase.driver.sql-jdbc.execute.diagnostic/capturing-diagnostic-info                 clojure.core/fn
-  metabase.models.collection-test/with-collection-in-location                           clojure.core/let
+  metabase.driver-api.core/defsetting                                                   hooks.metabase.settings.models.setting/defsetting
   metabase.models.json-migration/def-json-migration                                     clj-kondo.lint-as/def-catch-all
   metabase.models.util.spec-update/define-spec                                          clojure.core/def
-  metabase.notification.test-util/with-temp-notification                                clojure.core/let
   metabase.notification.test-util/with-card-notification                                clojure.core/let
   metabase.notification.test-util/with-system-event-notification!                       clojure.core/let
+  metabase.notification.test-util/with-temp-notification                                clojure.core/let
   metabase.premium-features.core/defenterprise-schema                                   clj-kondo.lint-as/def-catch-all
-  metabase.premium-features.core/define-premium-feature                                 clojure.core/def
   metabase.premium-features.defenterprise/defenterprise-schema                          clj-kondo.lint-as/def-catch-all
+  metabase.premium-features.settings/define-premium-feature                             clojure.core/def
+  metabase.pulse.dashboard-subscription-test/with-dashboard-sub-for-card                clojure.core/let
   metabase.pulse.send-test/with-pulse-for-card                                          clojure.core/let
   metabase.query-processor-test.pipeline-queries-test/pmbql-query                       clojure.core/->
   metabase.query-processor-test.pipeline-queries-test/run-pmbql-query                   clojure.core/->
@@ -564,29 +446,29 @@
   metabase.query-processor.middleware.process-userland-query-test/with-query-execution! clojure.core/let
   metabase.query-processor.setup/with-qp-setup                                          clojure.core/let
   metabase.search.api-test/do-test-users                                                clojure.core/let
-  metabase.settings.core/defsetting                                                     clj-kondo.lint-as/def-catch-all
   metabase.settings.core/define-multi-setting                                           clojure.core/def
-  metabase.settings.models.setting/defsetting                                           clj-kondo.lint-as/def-catch-all
+  metabase.settings.core/defsetting                                                     clj-kondo.lint-as/def-catch-all
   metabase.settings.models.setting.multi-setting/define-multi-setting                   clojure.core/def
+  metabase.settings.models.setting/defsetting                                           clj-kondo.lint-as/def-catch-all
   metabase.sso.ldap/with-ldap-connection                                                clojure.core/fn
   metabase.sync.util/sum-for                                                            clojure.core/for
   metabase.sync.util/with-emoji-progress-bar                                            clojure.core/let
-  metabase.task/defjob                                                                  clojure.core/defn
+  metabase.task.core/defjob                                                             clojure.core/defn
+  metabase.task.impl/defjob                                                             clojure.core/defn
   metabase.test.data.interface/defdataset                                               clojure.core/def
   metabase.test.data.interface/defdataset-edn                                           clojure.core/def
+  metabase.test.gentest/defgentest                                                      clojure.test/deftest
   metabase.test/defdataset                                                              clojure.core/def
   metabase.test/let-url                                                                 clojure.core/let
   metabase.test/with-actions                                                            clojure.core/let
   metabase.test/with-grouper-batches!                                                   clojure.core/fn
   metabase.test/with-open-channels                                                      clojure.core/let
-  metabase.test/with-single-admin-user                                                  clojure.core/fn
+  metabase.test/with-single-admin-user!                                                 clojure.core/fn
   metabase.test/with-temp-dir                                                           clojure.core/let
   metabase.test/with-temp-empty-app-db                                                  clojure.core/let
   metabase.test/with-temp-file                                                          clojure.core/let
   metabase.test/with-user-in-groups                                                     clojure.core/let
-  metabase.test.gentest/defgentest                                                      clojure.test/deftest
-  metabase.upload-test/with-upload-table!                                               clojure.core/let
-  metabase.util/with-timer-ms                                                           clojure.core/fn
+  metabase.upload.impl-test/with-upload-table!                                          clojure.core/let
   metabase.util.files/with-open-path-to-resource                                        clojure.core/let
   metabase.util.malli.defn/defn                                                         schema.core/defn
   metabase.util.malli.defn/defn-                                                        schema.core/defn
@@ -596,7 +478,7 @@
   metabase.util.malli/defn-                                                             schema.core/defn
   metabase.util.malli/fn                                                                schema.core/fn
   metabase.util.namespaces/import-fns                                                   potemkin/import-vars
-  metabase.util.ssh/with-ssh-tunnel                                                     clojure.core/let
+  metabase.util/with-timer-ms                                                           clojure.core/fn
   metabase.xrays.domain-entities.malli/defn                                             schema.core/defn
   metabuild-common.core/with-open-jar-file-system                                       clojure.core/let
   metabuild-common.files/with-open-jar-file-system                                      clojure.core/let
@@ -627,22 +509,25 @@
    metabase-enterprise.audit-app.pages-test/with-temp-objects                                                                hooks.common/with-one-binding
    metabase-enterprise.cache.config-test/with-temp-persist-models                                                            hooks.common/with-seven-bindings
    metabase-enterprise.serialization.test-util/with-temp-dpc                                                                 hooks.toucan2.tools.with-temp/with-temp
-   metabase.api.card-test/with-card-param-values-fixtures                                                                    hooks.common/let-one-with-optional-value
-   metabase.api.card-test/with-temp-native-card!                                                                             hooks.common/with-two-bindings
-   metabase.api.card-test/with-temp-native-card-with-params!                                                                 hooks.common/with-two-bindings
-   metabase.api.collection-test/with-french-user-and-personal-collection!                                                    hooks.common/with-two-top-level-bindings
    metabase.api.common.internal-test/with-jetty-server                                                                       hooks.common/with-one-binding
-   metabase.api.dashboard-test/with-chain-filter-fixtures                                                                    hooks.common/let-one-with-optional-value
-   metabase.api.dashboard-test/with-simple-dashboard-with-tabs                                                               hooks.common/with-one-binding
    metabase.api.macros/defendpoint                                                                                           hooks.metabase.api.macros/defendpoint
-   metabase.api.user-test/with-temp-user-email!                                                                              hooks.common/with-one-binding
+   metabase.app-db.schema-migrations-test.impl/test-migrations                                                               hooks.metabase.app-db.schema-migrations-test.impl/test-migrations
+   metabase.channel.render.js.svg/with-static-viz-context                                                                    hooks.common/with-one-top-level-binding
    metabase.channel.template.handlebars-helper/defhelper                                                                     hooks.metabase.channel.template.handlebars-helper/defhelper
    metabase.channel.template.handlebars-test/with-temp-template!                                                             hooks.common/with-vec-first-binding
-   metabase.dashboard-subscription-test/with-link-card-fixture-for-dashboard                                                 hooks.common/let-second
-   metabase.db.schema-migrations-test.impl/test-migrations                                                                   hooks.metabase.db.schema-migrations-test.impl/test-migrations
+   metabase.classloader.core/require                                                                                         hooks.clojure.core.require/lint-require
+   metabase.classloader.impl/require                                                                                         hooks.clojure.core.require/lint-require
+   metabase.collections.api-test/with-french-user-and-personal-collection!                                                   hooks.common/with-two-top-level-bindings
+   metabase.collections.models.collection-test/with-collection-hierarchy!                                                    hooks.common/let-one-with-optional-value
+   metabase.collections.models.collection-test/with-personal-and-impersonal-collections                                      hooks.common/with-two-bindings
+   metabase.dashboards.api-test/with-chain-filter-fixtures                                                                   hooks.common/let-one-with-optional-value
+   metabase.dashboards.api-test/with-simple-dashboard-with-tabs                                                              hooks.common/with-one-binding
+   metabase.dashboards.models.dashboard-tab-test/with-dashtab-in-personal-collection                                         hooks.common/with-one-top-level-binding
+   metabase.dashboards.models.dashboard-test/with-dash-in-collection!                                                        hooks.common/with-three-bindings
    metabase.driver.bigquery-cloud-sdk-test/calculate-bird-scarcity                                                           hooks.metabase.query-processor-test.expressions-test/calculate-bird-scarcity
    metabase.driver.oracle-test/with-temp-user                                                                                hooks.common/let-one-with-optional-value
    metabase.driver/register!                                                                                                 hooks.metabase.driver/register!
+   metabase.driver-api/defenterprise                                                                                         hooks.metabase.premium-features.defenterprise/defenterprise
    metabase.embedding.api.embed-test/do-response-formats                                                                     hooks.common/with-two-bindings
    metabase.embedding.api.embed-test/with-chain-filter-fixtures!                                                             hooks.common/let-one-with-optional-value
    metabase.embedding.api.embed-test/with-temp-card                                                                          hooks.common/let-one-with-optional-value
@@ -657,15 +542,10 @@
    metabase.model-persistence.api-test/with-persistence-setup!                                                               hooks.common/with-one-top-level-binding
    metabase.model-persistence.api-test/with-setup!                                                                           hooks.common/with-one-top-level-binding
    metabase.model-persistence.test-util/with-persistence-enabled!                                                            hooks.metabase.model-persistence.test-util/with-persistence-enabled!
-   metabase.models.collection-test/with-collection-hierarchy!                                                                hooks.common/let-one-with-optional-value
-   metabase.models.collection-test/with-personal-and-impersonal-collections                                                  hooks.common/with-two-bindings
-   metabase.models.dashboard-tab-test/with-dashtab-in-personal-collection                                                    hooks.common/with-one-top-level-binding
-   metabase.models.dashboard-test/with-dash-in-collection!                                                                   hooks.common/with-three-bindings
    metabase.models.interface/define-batched-hydration-method                                                                 hooks.metabase.models.interface/define-hydration-method
    metabase.models.interface/define-simple-hydration-method                                                                  hooks.metabase.models.interface/define-hydration-method
    metabase.permissions.core/allow-changing-all-users-group-members                                                          hooks.common/do*
    metabase.permissions.core/disable-perms-cache                                                                             hooks.common/do*
-   metabase.plugins.classloader/require                                                                                      hooks.clojure.core.require/lint-require
    metabase.premium-features.core/defenterprise                                                                              hooks.metabase.premium-features.defenterprise/defenterprise
    metabase.premium-features.defenterprise/defenterprise                                                                     hooks.metabase.premium-features.defenterprise/defenterprise
    metabase.public-sharing.api-test/with-required-param-card!                                                                hooks.common/with-one-binding
@@ -673,16 +553,20 @@
    metabase.public-sharing.api-test/with-temp-public-dashboard                                                               hooks.common/let-one-with-optional-value
    metabase.public-sharing.api-test/with-temp-public-dashboard-and-card                                                      hooks.common/with-three-bindings
    metabase.pulse.api.alert-test/with-alert-in-collection!                                                                   hooks.common/with-four-bindings
+   metabase.pulse.dashboard-subscription-test/with-link-card-fixture-for-dashboard                                           hooks.common/let-second
    metabase.pulse.models.pulse-test/with-dashboard-subscription-in-collection!                                               hooks.common/with-four-bindings
    metabase.pulse.models.pulse-test/with-pulse-in-collection!                                                                hooks.common/with-four-bindings
    metabase.pulse.test-util/checkins-query-card                                                                              hooks.metabase.test.data/$ids
+   metabase.queries.api.card-test/with-card-param-values-fixtures                                                            hooks.common/let-one-with-optional-value
+   metabase.queries.api.card-test/with-temp-native-card!                                                                     hooks.common/with-two-bindings
+   metabase.queries.api.card-test/with-temp-native-card-with-params!                                                         hooks.common/with-two-bindings
    metabase.query-processor-test.expressions-test/calculate-bird-scarcity                                                    hooks.metabase.query-processor-test.expressions-test/calculate-bird-scarcity
    metabase.query-processor-test.filter-test/count-with-filter-clause                                                        hooks.metabase.test.data/$ids
    metabase.query-processor.middleware.cache-test/with-mock-cache!                                                           hooks.common/with-two-bindings
    metabase.request.core/with-current-request                                                                                hooks.common/with-used-first-arg
    metabase.request.core/with-current-user                                                                                   hooks.common/with-used-first-arg
    metabase.request.core/with-limit-and-offset                                                                               hooks.common/with-used-first-two-args
-   metabase.sample-data-test/with-temp-sample-database-db                                                                    hooks.common/with-one-binding
+   metabase.sample-data.impl-test/with-temp-sample-database-db                                                               hooks.common/with-one-binding
    metabase.search.api-test/with-search-items-in-collection                                                                  hooks.metabase.search.api-test/with-search-items-in-collection
    metabase.search.api-test/with-search-items-in-root-collection                                                             hooks.common/do*
    metabase.server.streaming-response-test/with-start-execution-chan                                                         hooks.common/with-one-binding
@@ -701,15 +585,15 @@
    metabase.test.data/mbql-query                                                                                             hooks.metabase.test.data/mbql-query
    metabase.test.data/run-mbql-query                                                                                         hooks.metabase.test.data/mbql-query
    metabase.test.gentest/iterate                                                                                             hooks.metabase.test.gentest/iterate*
+   metabase.test.util.async/with-open-channels                                                                               hooks.common/let-with-optional-value-for-last-binding
+   metabase.test.util.generators.jvm/with-random-cards                                                                       hooks.metabase.test.util.generators.jvm/with-random-cards
+   metabase.test.util.log/with-log-level                                                                                     hooks.common/with-ignored-first-arg
    metabase.test.util/discard-setting-changes                                                                                hooks.common/with-ignored-first-arg
    metabase.test.util/with-column-remappings                                                                                 hooks.common/with-ignored-first-arg
    metabase.test.util/with-non-admin-groups-no-root-collection-perms                                                         hooks.common/do*
    metabase.test.util/with-prometheus-system!                                                                                hooks.common/with-two-bindings
    metabase.test.util/with-temp-file                                                                                         hooks.metabase.test.util/with-temp-file
    metabase.test.util/with-temporary-setting-values                                                                          hooks.metabase.test.util/with-temporary-setting-values
-   metabase.test.util.async/with-open-channels                                                                               hooks.common/let-with-optional-value-for-last-binding
-   metabase.test.util.generators.jvm/with-random-cards                                                                       hooks.metabase.test.util.generators.jvm/with-random-cards
-   metabase.test.util.log/with-log-level                                                                                     hooks.common/with-ignored-first-arg
    metabase.test/$ids                                                                                                        hooks.metabase.test.data/$ids
    metabase.test/dataset                                                                                                     hooks.metabase.test.data/dataset
    metabase.test/discard-setting-changes                                                                                     hooks.common/with-ignored-first-arg
@@ -724,14 +608,15 @@
    metabase.test/with-log-messages-for-level                                                                                 hooks.metabase.util.log.capture/with-log-messages-for-level
    metabase.test/with-non-admin-groups-no-root-collection-perms                                                              hooks.common/do*
    metabase.test/with-persistence-enabled!                                                                                   hooks.metabase.model-persistence.test-util/with-persistence-enabled!
+   metabase.test/with-prometheus-system!                                                                                     hooks.common/with-two-bindings
    metabase.test/with-temp                                                                                                   hooks.toucan2.tools.with-temp/with-temp
    metabase.test/with-temp-file                                                                                              hooks.metabase.test.util/with-temp-file
-   metabase.test/with-prometheus-system!                                                                                     hooks.common/with-two-bindings
    metabase.test/with-temporary-setting-values                                                                               hooks.metabase.test.util/with-temporary-setting-values
-   metabase.util.i18n/tru                                                                                                    hooks.metabase.util.i18n/tru
+   metabase.users.api-test/with-temp-user-email!                                                                              hooks.common/with-one-binding
+   metabase.util.i18n/deferred-trs                                                                                           hooks.metabase.util.i18n/deferred-trs
    metabase.util.i18n/deferred-tru                                                                                           hooks.metabase.util.i18n/deferred-tru
    metabase.util.i18n/trs                                                                                                    hooks.metabase.util.i18n/trs
-   metabase.util.i18n/deferred-trs                                                                                           hooks.metabase.util.i18n/deferred-trs
+   metabase.util.i18n/tru                                                                                                    hooks.metabase.util.i18n/tru
    metabase.util.log.capture/with-log-messages-for-level                                                                     hooks.metabase.util.log.capture/with-log-messages-for-level
    metabase.util.log/debug                                                                                                   hooks.metabase.util.log/info
    metabase.util.log/debugf                                                                                                  hooks.metabase.util.log/infof
@@ -763,18 +648,17 @@
    metabase-enterprise.serialization.test-util/with-world                                  macros.metabase-enterprise.serialization.test-util/with-world
    metabase-enterprise.test/with-gtaps!                                                    macros.metabase-enterprise.sandbox.test-util/with-gtaps!
    metabase-enterprise.test/with-gtaps-for-user!                                           macros.metabase-enterprise.sandbox.test-util/with-gtaps!
-   metabase.api.card-test/with-ordered-items                                               macros.metabase.api.card-test/with-ordered-items
-   metabase.api.collection-test/with-collection-hierarchy!                                 macros.metabase.api.collection-test/with-collection-hierarchy!
-   metabase.api.collection-test/with-some-children-of-collection!                          macros.metabase.api.collection-test/with-some-children-of-collection!
+   metabase.collections.api-test/with-collection-hierarchy!                                macros.metabase.collections.api-test/with-collection-hierarchy!
+   metabase.collections.api-test/with-some-children-of-collection!                         macros.metabase.collections.api-test/with-some-children-of-collection!
    metabase.embedding.api.embed-test/with-embedding-enabled-and-temp-card-referencing!     macros.metabase.embedding.api.embed-test/with-embedding-enabled-and-temp-card-referencing!
    metabase.embedding.api.embed-test/with-embedding-enabled-and-temp-dashcard-referencing! macros.metabase.embedding.api.embed-test/with-embedding-enabled-and-temp-dashcard-referencing!
    metabase.lib.common/defop                                                               macros.metabase.lib.common/defop
    metabase.lib.filter/deffilter                                                           macros.metabase.lib.filter/deffilter
-   metabase.models.params.chain-filter-test/chain-filter                                   macros.metabase.models.params.chain-filter-test/chain-filter
-   metabase.models.params.chain-filter-test/chain-filter-search                            macros.metabase.models.params.chain-filter-test/chain-filter
-   metabase.models.user-test/with-groups                                                   macros.metabase.models.user-test/with-groups
+   metabase.parameters.chain-filter-test/chain-filter                                      macros.metabase.parameters.chain-filter-test/chain-filter
+   metabase.parameters.chain-filter-test/chain-filter-search                               macros.metabase.parameters.chain-filter-test/chain-filter
    metabase.public-sharing.api-test/with-sharing-enabled-and-temp-card-referencing!        macros.metabase.public-sharing.api-test/with-sharing-enabled-and-temp-card-referencing!
    metabase.public-sharing.api-test/with-sharing-enabled-and-temp-dashcard-referencing!    macros.metabase.public-sharing.api-test/with-sharing-enabled-and-temp-dashcard-referencing!
+   metabase.queries.api.card-test/with-ordered-items                                       macros.metabase.queries.api.card-test/with-ordered-items
    metabase.query-analysis.models.query-analysis-test/with-test-setup                      macros.metabase.query-analysis.models.query-analysis-test/with-test-setup
    metabase.query-analysis.task.test-setup/with-test-setup!                                macros.metabase.query-analysis.task.test-setup/with-test-setup!
    metabase.query-processor.streaming/streaming-response                                   macros.metabase.query-processor.streaming/streaming-response
@@ -785,6 +669,7 @@
    metabase.test/with-group-for-user                                                       macros.metabase.test.data.users/with-group-for-user
    metabase.test/with-temp-env-var-value!                                                  macros.metabase.test.util/with-temp-env-var-value!
    metabase.test/with-temporary-raw-setting-values                                         macros.metabase.test.util/with-temporary-raw-setting-values
+   metabase.users.models.user-test/with-groups!                                            macros.metabase.users.models.user-test/with-groups!
    metabase.util.namespaces/import-fn                                                      macros.metabase.util.namespaces/import-fn
    metabase.xrays.domain-entities.malli/define-getters-and-setters                         macros.metabase.xrays.domain-entities.malli/define-getters-and-setters
    metabase.xrays.related-test/with-world                                                  macros.metabase.xrays.related-test/with-world}}
@@ -812,6 +697,8 @@
    :name    printable-namespaces}
   {:pattern "^metabase\\.(?:(?:lib)|(?:legacy-mbql))\\..*"
    :name    metabase-lib}
+  {:pattern "^metabase\\.lib\\..*"
+   :name    metabase-lib-excluding-legacy-mbql}
   ;;
   ;; QP source namespaces: `metabase.query-processor.*`, `metabase-enterprise.sandbox.query-processor.*`, and
   ;; `metabase.driver.*`, excluding `-test` namespaces.
@@ -837,8 +724,9 @@
    {:inline-def                              {:level :off}
     :missing-docstring                       {:level :off}
     :private-call                            {:level :off}
+    :discouraged-var                         {metabase.driver/database-supports? {:level :off}}
     :metabase/defsetting-must-specify-export {:level :off}
-    :discouraged-var                         {metabase.driver/database-supports? {:level :off}}}
+    :metabase/defsetting-namespace           {:level :off}}
 
    :hooks
    {:analyze-call
@@ -891,6 +779,11 @@
      toucan.util.test           {:message "Don't use application database inside MLv2 code"}
      toucan2.core               {:message "Don't use application database inside MLv2 code"}}}}
 
+  metabase-lib-excluding-legacy-mbql
+  {:linters
+   {:discouraged-var
+    {metabase.legacy-mbql.util/unique-name-generator {:message "Use metabase.lib.util/unique-name-generator or non-truncating-unique-name-generator"}}}}
+
   driver-namespaces
   {:linters
    {:discouraged-var
@@ -906,10 +799,10 @@
      toucan2.core               {:message "Don't use application database directly in QP code; use QP Store/metadata provider"}}
 
     :discouraged-var
-    {medley.core/map-keys              {:message "Use clojure.core/update-keys"}
-     medley.core/map-vals              {:message "Use clojure.core/update-vals"}
-     metabase.db.query/query           {:message "Don't use application database directly in QP code; use QP Store/metadata provider"}
-     metabase.db.query/reducible-query {:message "Don't use application database directly in QP code; use QP Store/metadata provider"}}}}
+    {medley.core/map-keys                 {:message "Use clojure.core/update-keys"}
+     medley.core/map-vals                 {:message "Use clojure.core/update-vals"}
+     metabase.app-db.core/query           {:message "Don't use application database directly in QP code; use QP Store/metadata provider"}
+     metabase.app-db.core/reducible-query {:message "Don't use application database directly in QP code; use QP Store/metadata provider"}}}}
 
   general-qp-and-driver-test-namespaces
   {:linters

.clj-kondo/config/test-helpers/config.edn

@@ -49,31 +49,43 @@
      metabase.actions.models/insert!
      metabase.analytics.snowplow-test/fake-track-event-impl!
      metabase.analytics.snowplow/track-event-impl!
+     metabase.app-db.core/finish-db-setup!
+     metabase.app-db.core/migrate!
+     metabase.app-db.core/setup-db!
+     metabase.app-db.schema-migrations-test.impl/run-migrations-in-range!
+     metabase.app-db.setup/migrate!
+     metabase.app-db.setup/setup-db!
      metabase.channel.email-test/reset-inbox!
      metabase.channel.email/send-email!
      metabase.cmd.dump-to-h2/dump-to-h2!
      metabase.cmd.load-from-h2/load-from-h2!
+     metabase.content-verification.models.moderation-review/create-review!
      metabase.core.core/ensure-audit-db-installed!
-     metabase.db.schema-migrations-test.impl/run-migrations-in-range!
-     metabase.db.setup/migrate!
-     metabase.db.setup/setup-db!
-     metabase.db/migrate!
-     metabase.db/setup-db!
      metabase.driver.mongo-test/create-database-from-row-maps!
      metabase.driver.postgres-test/create-enums-db!
      metabase.driver.postgres-test/drop-if-exists-and-create-db!
      metabase.driver.sql-jdbc.execute/execute-statement!
      metabase.indexed-entities.models.model-index/add-values!
+     metabase.driver.sql-jdbc.connection.ssh-tunnel-test/start-mock-servers!
+     metabase.driver.sql-jdbc.connection.ssh-tunnel-test/stop-mock-servers!
      metabase.indexed-entities.task.index-values/job-init!
      metabase.model-persistence.models.persisted-info/ready-database!
      metabase.model-persistence.task.persist-refresh/job-init!
      metabase.model-persistence.task.persist-refresh/refresh-tables!
      metabase.model-persistence.task.persist-refresh/schedule-persistence-for-database!
-     metabase.models.collection.graph-test/clear-graph-revisions!
-     metabase.models.collection.graph-test/do-with-n-temp-users-with-personal-collections!
-     metabase.models.field-values/create-or-update-full-field-values!
-     metabase.models.moderation-review/create-review!
      metabase.models.on-demand-test/add-dashcard-with-parameter-mapping!
+     metabase.permissions.core/grant-application-permissions!
+     metabase.permissions.core/grant-collection-read-permissions!
+     metabase.permissions.core/grant-collection-readwrite-permissions!
+     metabase.permissions.core/grant-full-data-permissions!
+     metabase.permissions.core/grant-native-readwrite-permissions!
+     metabase.permissions.core/grant-permissions!
+     metabase.permissions.core/revoke-application-permissions!
+     metabase.permissions.core/revoke-data-perms!
+     metabase.permissions.core/update-data-perms-graph!
+     metabase.permissions.core/update-group-permissions!
+     metabase.permissions.models.collection.graph-test/clear-graph-revisions!
+     metabase.permissions.models.collection.graph-test/do-with-n-temp-users-with-personal-collections!
      metabase.permissions.models.permissions/grant-application-permissions!
      metabase.permissions.models.permissions/grant-collection-read-permissions!
      metabase.permissions.models.permissions/grant-collection-readwrite-permissions!
@@ -91,7 +103,7 @@
      metabase.query-processor.streaming.interface/begin!
      metabase.query-processor.streaming.interface/finish!
      metabase.query-processor.streaming.interface/write-row!
-     metabase.sample-data/try-to-extract-sample-database!
+     metabase.sample-data.impl/try-to-extract-sample-database!
      metabase.settings.models.setting-test/test-user-local-allowed-setting!
      metabase.settings.models.setting-test/test-user-local-only-setting!
      metabase.settings.models.setting.cache/restore-cache!
@@ -104,7 +116,8 @@
      metabase.sync.sync-metadata/sync-db-metadata!
      metabase.sync.util-test/sync-database!
      metabase.sync.util/store-sync-summary!
-     metabase.task/delete-task!
+     metabase.task.core/delete-task!
+     metabase.task.impl/delete-task!
      metabase.test.data.bigquery-cloud-sdk/execute!
      metabase.test.data.impl.get-or-create/set-test-db-permissions!
      metabase.test.data.impl/copy-db-tables-and-fields!
@@ -126,7 +139,6 @@
      metabase.test/initialize-if-needed!
      metabase.test/test-helpers-set-global-values!
      metabase.test/with-temp-env-var-value!
-     metabase.upload-test/set-local-infile!
+     metabase.upload.impl-test/set-local-infile!
      metabase.util.files/create-dir-if-not-exists!
-     metabase.util.ssh-test/start-mock-servers!
-     metabase.util.ssh-test/stop-mock-servers!}}}}
+     metabase.warehouse-schema.models.field-values/create-or-update-full-field-values!}}}}

.clj-kondo/macros/metabase/collections/api_test.clj

@@ -1,4 +1,4 @@
-(ns macros.metabase.api.collection-test)
+(ns macros.metabase.collections.api-test)
 
 (defmacro with-collection-hierarchy! [bindings & body]
   `(let [~'a nil

.clj-kondo/macros/metabase/models/params/chain_filter_test.clj

@@ -1,4 +0,0 @@
-(ns macros.metabase.models.params.chain-filter-test)
-
-(defmacro chain-filter [& _]
-  `(metabase.models.params.chain-filter/chain-filter nil nil))

.clj-kondo/macros/metabase/models/user_test.clj

@@ -1,9 +0,0 @@
-(ns macros.metabase.models.user-test)
-
-(defmacro with-groups [bindings & body]
-  `(let ~(into []
-              (comp (partition-all 3)
-                    (mapcat (fn [[group-binding properties members]]
-                              [group-binding [properties members]])))
-              bindings)
-     ~@body))

.clj-kondo/macros/metabase/parameters/chain_filter_test.clj

@@ -0,0 +1,4 @@
+(ns macros.metabase.parameters.chain-filter-test)
+
+(defmacro chain-filter [& _]
+  `(metabase.parameters.chain-filter/chain-filter nil nil))

.clj-kondo/macros/metabase/queries/api/card_test.clj

@@ -1,4 +1,4 @@
-(ns macros.metabase.api.card-test)
+(ns macros.metabase.queries.api.card-test)
 
 (defmacro with-ordered-items
   [collection model-and-name-syms & body]

.clj-kondo/macros/metabase/users/models/user_test.clj

@@ -0,0 +1,9 @@
+(ns macros.metabase.users.models.user-test)
+
+(defmacro with-groups! [bindings & body]
+  `(let ~(into []
+               (comp (partition-all 3)
+                     (mapcat (fn [[group-binding properties members]]
+                               [group-binding [properties members]])))
+               bindings)
+     ~@body))

.clj-kondo/src/hooks/clojure/core/ns.clj

@@ -1,6 +1,7 @@
 (ns hooks.clojure.core.ns
   (:require
    [clj-kondo.hooks-api :as hooks]
+   [clojure.string :as str]
    [hooks.common]
    [hooks.common.modules :as modules]))
 
@@ -59,12 +60,15 @@
                     (printf "Don't know how to figure out what namespace is being required in %s\n" (pr-str node)))))
           args)))
 
+(defn- ns-form-node->ns-symb-node [ns-form-node]
+  (some (fn [node]
+          (when (and (hooks/token-node? node)
+                     (not= (hooks/sexpr node) 'ns))
+            node))
+        (:children ns-form-node)))
+
 (defn- ns-form-node->ns-symb [ns-form-node]
-  (some-> (some (fn [node]
-                  (when (and (hooks/token-node? node)
-                             (not= (hooks/sexpr node) 'ns))
-                    node))
-                (:children ns-form-node))
+  (some-> (ns-form-node->ns-symb-node ns-form-node)
           hooks/sexpr))
 
 (defn- lint-modules [ns-form-node config]
@@ -83,9 +87,33 @@
                                        :message error
                                        :type    :metabase/modules))))))))
 
+(defn- lint-namespace-name [ns-form-node]
+  (when-let [ns-symb-node (ns-form-node->ns-symb-node ns-form-node)]
+    (when-not (contains? (hooks.common/ignored-linters ns-symb-node) :metabase/namespace-name)
+      (let [parts (str/split (str (hooks/sexpr ns-symb-node)) #"\.")]
+        (when (and (<= (count parts) 2)
+                   (#{"metabase" "metabase-enterprise"} (first parts))
+                   ;; exclude test namespaces for now
+                   (not (str/ends-with? (last parts) "test")))
+          (hooks/reg-finding! (assoc (meta ns-symb-node)
+                                     :message "Metabase namespaces should have the form metabase[-enterprise].<module>.* [:metabase/namespace-name]"
+                                     :type    :metabase/namespace-name)))))))
+
 (defn lint-ns [x]
   (doto (:node x)
     lint-require-shapes
     lint-requires-on-new-lines
-    (lint-modules (modules/config x)))
+    (lint-modules (modules/config x))
+    lint-namespace-name)
   x)
+
+(comment
+  (lint-ns
+   {:node (hooks/parse-string
+           (pr-str
+            '(ns hooks.clojure.core.ns
+               (:require
+                [clj-kondo.hooks-api :as hooks]
+                [clojure.string :as str]
+                [hooks.common]
+                [hooks.common.modules :as modules]))))}))

.clj-kondo/src/hooks/metabase/app_db/schema_migrations_test/impl.clj

@@ -1,4 +1,4 @@
-(ns hooks.metabase.db.schema-migrations-test.impl
+(ns hooks.metabase.app-db.schema-migrations-test.impl
   (:require [clj-kondo.hooks-api :as hooks]))
 
 (defn test-migrations

.clj-kondo/src/hooks/metabase/settings/models/setting.clj

@@ -3,7 +3,13 @@
    [clj-kondo.hooks-api :as hooks]
    [hooks.common :as common]))
 
-;;; TODO -- move this into
+(defn lint-defsetting-namespace [node context]
+  (when-not (re-matches #"^metabase(?:-enterprise)?\.[^\.]+\.settings$" (name (:ns context)))
+    (hooks/reg-finding! (assoc (meta node)
+                               :message "All defsettings should live in metabase[-enterprise].<module>.settings namespaces"
+                               :type :metabase/defsetting-namespace))))
+
+;;; TODO -- move this into a Kondo config file in `.clj-kondo/config/`
 (def ^:private ignored-implicit-export?
   '#{active-users-count
      admin-email
@@ -22,7 +28,6 @@
      database-enable-actions
      deprecation-notice-version
      dismissed-custom-dashboard-toast
-     dismissed-onboarding-sidebar-link
      email-configured?
      email-from-address
      email-from-name
@@ -170,8 +175,17 @@
      version-info
      version-info-last-checked})
 
-(defn- defsetting-lint [node setting-name docstring options-list]
-  (let [anon-binding (common/with-macro-meta (hooks/token-node '_) node)
+(defn- lint-defsetting-export [node]
+  (let [[_defsetting setting-name _docstring & options] (:children node)]
+    (when (nil? (second (drop-while (comp not #{[:k :export?]} first) options)))
+      (when-not (contains? ignored-implicit-export? (:value setting-name))
+        (hooks/reg-finding! (assoc (meta node)
+                                   :message "Setting definition must provide an explicit value for :export? indicating whether the setting should be exported or not with serialization."
+                                   :type :metabase/defsetting-must-specify-export))))))
+
+(defn- defsetting-replacement-node [node]
+  (let [[_defsetting setting-name docstring & options-list] (:children node)
+        anon-binding (common/with-macro-meta (hooks/token-node '_) node)
         ;; (defn my-setting [] ...)
         getter-node (-> (list
                          (hooks/token-node 'defn)
@@ -191,26 +205,19 @@
                         hooks/list-node
                         (with-meta (meta node))
                         common/add-lsp-ignore-unused-public-var-metadata)]
-
-    (when (nil? (second (drop-while (comp not #{[:k :export?]} first) options-list)))
-      (when-not (contains? ignored-implicit-export? (:value setting-name))
-        (hooks/reg-finding! (assoc (meta node)
-                                   :message "Setting definition must provide an explicit value for :export? indicating whether the setting should be exported or not with serialization."
-                                   :type :metabase/defsetting-must-specify-export))))
-
-    {:node (-> (hooks/list-node
-                (list
-                 (hooks/token-node 'let)
-                 ;; include description and the options map so they can get validated as well.
-                 (hooks/vector-node
-                  [anon-binding docstring
-                   anon-binding (hooks/map-node options-list)])
-                 (hooks/reg-keyword! (-> (hooks/keyword-node (keyword (hooks/sexpr setting-name)))
-                                         (with-meta (meta setting-name)))
-                                     'metabase.settings.models.setting/defsetting)
-                 getter-node
-                 setter-node))
-               (with-meta (meta node)))}))
+    (-> (hooks/list-node
+         (list
+          (hooks/token-node 'let)
+          ;; include description and the options map so they can get validated as well.
+          (hooks/vector-node
+           [anon-binding docstring
+            anon-binding (hooks/map-node options-list)])
+          (hooks/reg-keyword! (-> (hooks/keyword-node (keyword (hooks/sexpr setting-name)))
+                                  (with-meta (meta setting-name)))
+                              'metabase.settings.models.setting/defsetting)
+          getter-node
+          setter-node))
+        (with-meta (meta node)))))
 
 (defn defsetting
   "Rewrite a [[metabase.models.defsetting]] form like
@@ -226,10 +233,21 @@
 
   for linting purposes."
   [{:keys [node], :as context}]
-  (let [[setting-name docstring & options] (rest (:children node))]
-    (merge
-     context
-     (defsetting-lint node setting-name docstring options))))
+  (lint-defsetting-namespace node context)
+  (lint-defsetting-export node)
+  (update context :node defsetting-replacement-node))
+
+(defn define-multi-setting-replacement-node [node]
+  (let [[defsetting setting-name docstring thunk & options] (:children node)]
+    (-> (hooks/list-node
+         (list*
+          defsetting
+          setting-name
+          docstring
+          (hooks/token-node :multi-thunk) thunk
+          options))
+        (with-meta (meta node))
+        defsetting-replacement-node)))
 
 (defn define-multi-setting
   "Rewrite a [[metabase.models.define-multi-setting]] form like
@@ -245,10 +263,7 @@
 
   for linting purposes."
   [{:keys [node], :as context}]
-  (let [[setting-name docstring thunk & options] (rest (:children node))]
-    (merge
-     context
-     (defsetting-lint node setting-name docstring (concat options [(hooks/token-node :multi-thunk) thunk])))))
+  (update context :node define-multi-setting-replacement-node))
 
 (defn define-multi-setting-impl
   [context]
@@ -289,6 +304,6 @@
          :type       :integer
          :default    0
          :getter     (fn []
-                       (if-not ((requiring-resolve 'metabase.db/db-is-set-up?))
+                       (if-not ((requiring-resolve 'metabase.app-db.core/db-is-set-up?))
                          0
                          (cached-active-users-count)))))))

.clj-kondo/test/hooks/clojure/core/ns_test.clj

@@ -20,15 +20,17 @@
   (lint-ns form (assoc-in config [:linters :metabase/modules :level] :warning)))
 
 (deftest ^:parallel module-checker-allowed-modules-test
-  (is (=? [{:message "Module task should not be used in the api module. [:metabase/modules api :uses]"
-            :type :metabase/modules}]
-          (lint-modules
-           '(ns metabase.api.search
-              (:require
-               [metabase.request.core :as request]
-               [metabase.task :as task]))
-           '{:metabase/modules {api     {:uses #{request}}
-                                request {:api #{metabase.request.core}}}}))))
+  (are [task-namespace] (=? [{:message "Module task should not be used in the api module. [:metabase/modules api :uses]"
+                              :type :metabase/modules}]
+                            (lint-modules
+                             '(ns metabase.api.search
+                                (:require
+                                 [metabase.request.core :as request]
+                                 [task-namespace :as task]))
+                             '{:metabase/modules {api     {:uses #{request}}
+                                                  request {:api #{metabase.request.core}}}}))
+    metabase.task
+    metabase.task.core))
 
 (deftest ^:parallel module-checker-api-namespaces-test
   (is (=? [{:message "Namespace metabase.search.config is not an allowed external API namespace for the search module. [:metabase/modules search :api]"

.clj-kondo/test/hooks/metabase/settings/models/setting_test.clj

@@ -0,0 +1,34 @@
+(ns hooks.metabase.settings.models.setting-test
+  (:require
+   [clj-kondo.hooks-api :as hooks]
+   [clojure.test :refer :all]
+   [hooks.metabase.settings.models.setting]))
+
+#_{:clj-kondo/ignore [:metabase/validate-deftest]}
+(deftest ^:parallel defsetting-test
+  (let [node (-> '(defsetting active-users-count
+                    (deferred-tru "Cached number of active users. Refreshed every 5 minutes.")
+                    :visibility :admin
+                    :type       :integer
+                    :default    0
+                    :getter     (fn []
+                                  (if-not ((requiring-resolve 'metabase.app-db.core/db-is-set-up?))
+                                    0
+                                    (cached-active-users-count))))
+                 pr-str
+                 hooks/parse-string)]
+    (is (= '(let [_ (deferred-tru "Cached number of active users. Refreshed every 5 minutes.")
+                  _ {:default 0
+                     :type :integer
+                     :getter (fn []
+                               (if-not ((requiring-resolve 'metabase.app-db.core/db-is-set-up?))
+                                 0
+                                 (cached-active-users-count)))
+                     :visibility :admin}]
+              :active-users-count
+              (defn active-users-count "Docstring." [])
+              (defn active-users-count! "Docstring." [_value-or-nil]))
+           (-> {:node node, :ns 'hooks.metabase.settings.models.setting-test}
+               hooks.metabase.settings.models.setting/defsetting
+               :node
+               hooks/sexpr)))))

.cljfmt.edn

@@ -102,26 +102,28 @@
   metabase.actions.test-util/with-actions-test-data-tables                               [[:block 1]]
   metabase.actions.test-util/with-empty-db                                               [[:inner 0]]
   metabase.actions.test-util/with-temp-test-data                                         [[:inner 0]]
-  metabase.api.card-test/with-cards-in-readable-collection                               [[:block 1]]
-  metabase.api.card-test/with-cards-in-writeable-collection                              [[:block 1]]
-  metabase.api.card-test/with-ordered-items                                              [[:inner 0]]
-  metabase.api.card-test/with-temp-native-card!                                          [[:block 1]]
-  metabase.api.card-test/with-temp-native-card-with-params!                              [[:block 1]]
-  metabase.api.collection-test/with-collection-hierarchy                                 [[:block 1]]
-  metabase.api.collection-test/with-french-user-and-personal-collection                  [[:block 2]]
-  metabase.api.collection-test/with-some-children-of-collection                          [[:block 1]]
   metabase.api.common/check                                                              [[:default]]
   metabase.api.common/define-routes                                                      [[:block 0]]
   metabase.api.common/let-404                                                            [[:block 1]]
+  metabase.app-db.core/with-application-db                                               [[:inner 0]]
+  metabase.app-db.liquibase/with-liquibase                                               [[:block 1]]
+  metabase.app-db.liquibase/with-scope-locked                                            [[:block 1]]
+  metabase.app-db.schema-migrations-test.impl/test-migrations                            [[:block 2]]
   metabase.cmd.copy/step                                                                 [[:block 1]]
   metabase.cmd.copy/with-connection-rollback-only                                        [[:block 1]]
   metabase.cmd.copy/with-disabled-db-constraints                                         [[:block 2]]
+  metabase.collections.api-test/with-collection-hierarchy                                [[:block 1]]
+  metabase.collections.api-test/with-french-user-and-personal-collection                 [[:block 2]]
+  metabase.collections.api-test/with-some-children-of-collection                         [[:block 1]]
+  metabase.collections.models.collection-test/with-collection-hierarchy                  [[:block 1]]
+  metabase.collections.models.collection-test/with-current-user-perms-for-collections    [[:block 1]]
+  metabase.collections.models.collection-test/with-personal-and-impersonal-collections   [[:block 1]]
   metabase.config/build-type-case                                                        [[:block 0]]
-  metabase.dashboard-subscription-test/with-link-card-fixture-for-dashboard              [[:block 2]]
-  metabase.db.liquibase/with-liquibase                                                   [[:block 1]]
-  metabase.db.liquibase/with-scope-locked                                                [[:block 1]]
-  metabase.db.schema-migrations-test.impl/test-migrations                                [[:block 2]]
-  metabase.db/with-application-db                                                        [[:inner 0]]
+  metabase.dashboards.models.dashboard-test/with-dash-in-collection                      [[:inner 0]]
+  metabase.driver-api.core/match                                                         [[:inner 0]]
+  metabase.driver-api.core/match-one                                                     [[:inner 0]]
+  metabase.driver-api.core/replace                                                       [[:inner 0]]
+  metabase.driver-api.core/replace-in                                                    [[:inner 0]]
   metabase.driver.bigquery-cloud-sdk.query-processor/with-temporal-type                  [[:default]]
   metabase.driver.druid.client/DELETE                                                    [[:default]]
   metabase.driver.druid.client/GET                                                       [[:default]]
@@ -153,17 +155,15 @@
   metabase.lib.test-util.macros/mbql-query                                               [[:inner 0]]
   metabase.lib.util.match/match                                                          [[:inner 0]]
   metabase.lib.util.match/match-one                                                      [[:inner 0]]
+  metabase.lib.util.match/match-lite                                                     [[:inner 0]]
+  metabase.lib.util.match/match-lite-recursive                                           [[:inner 0]]
   metabase.lib.util.match/replace                                                        [[:inner 0]]
   metabase.lib.util.match/replace-in                                                     [[:inner 0]]
-  metabase.models.collection-test/with-collection-hierarchy                              [[:block 1]]
-  metabase.models.collection-test/with-current-user-perms-for-collections                [[:block 1]]
-  metabase.models.collection-test/with-personal-and-impersonal-collections               [[:block 1]]
-  metabase.models.dashboard-test/with-dash-in-collection                                 [[:inner 0]]
   metabase.models.interface/define-batched-hydration-method                              [[:inner 0]]
   metabase.models.interface/define-simple-hydration-method                               [[:inner 0]]
-  metabase.models.params.chain-filter-test/with-clean-field-values-for-field             [[:block 1]]
-  metabase.models.params.chain-filter-test/with-fk-field-to-field-remapping              [[:block 0]]
-  metabase.models.params.chain-filter-test/with-human-readable-values-remapping          [[:block 0]]
+  metabase.parameters.chain-filter-test/with-clean-field-values-for-field                [[:block 1]]
+  metabase.parameters.chain-filter-test/with-fk-field-to-field-remapping                 [[:block 0]]
+  metabase.parameters.chain-filter-test/with-human-readable-values-remapping             [[:block 0]]
   metabase.permissions.core/allow-changing-all-users-group-members                       [[:block 0]]
   metabase.permissions.core/disable-perms-cache                                          [[:block 0]]
   metabase.public-sharing.api-test/with-sharing-enabled-and-temp-card-referencing        [[:block 3]]
@@ -172,8 +172,14 @@
   metabase.public-sharing.api-test/with-temp-public-dashboard                            [[:block 1]]
   metabase.public-sharing.api-test/with-temp-public-dashboard-and-card                   [[:block 1]]
   metabase.pulse.api.alert-test/with-alert-in-collection                                 [[:block 1]]
+  metabase.pulse.dashboard-subscription-test/with-link-card-fixture-for-dashboard        [[:block 2]]
   metabase.pulse.models.pulse-test/with-dashboard-subscription-in-collection             [[:block 1]]
   metabase.pulse.models.pulse-test/with-pulse-in-collection                              [[:inner 0]]
+  metabase.queries.api.card-test/with-cards-in-readable-collection                       [[:block 1]]
+  metabase.queries.api.card-test/with-cards-in-writeable-collection                      [[:block 1]]
+  metabase.queries.api.card-test/with-ordered-items                                      [[:inner 0]]
+  metabase.queries.api.card-test/with-temp-native-card!                                  [[:block 1]]
+  metabase.queries.api.card-test/with-temp-native-card-with-params!                      [[:block 1]]
   metabase.query-processor-test.pipeline-queries-test/pmbql-query                        [[:block 1]]
   metabase.query-processor-test.pipeline-queries-test/run-pmbql-query                    [[:block 1]]
   metabase.query-processor.debug/debug>                                                  [[:block 0]]
@@ -190,7 +196,7 @@
   metabase.request.core/with-limit-and-offset                                            [[:inner 0]]
   metabase.request.session/as-admin                                                      [[:block 0]]
   metabase.request.session/with-current-user                                             [[:inner 0]]
-  metabase.sample-data-test/with-temp-sample-database-db                                 [[:block 1]]
+  metabase.sample-data.impl-test/with-temp-sample-database-db                            [[:block 1]]
   metabase.search.api-test/do-test-users                                                 [[:block 1]]
   metabase.server.middleware.session/as-admin                                            [[:block 0]]
   metabase.server.middleware.session/with-current-user                                   [[:inner 0]]
@@ -215,7 +221,8 @@
   metabase.sync.util/with-start-and-finish-logging*                                      [[:default]]
   metabase.sync.util/with-sync-events                                                    [[:default]]
   metabase.task-history.models.task-history/with-task-history                            [[:block 1]]
-  metabase.task/rerun-on-error                                                           [[:block 1]]
+  metabase.task.core/rerun-on-error                                                      [[:block 1]]
+  metabase.task.impl/rerun-on-error                                                      [[:block 1]]
   metabase.test.data.datasets/test-driver                                                [[:inner 0]]
   metabase.test.data.datasets/test-drivers                                               [[:inner 0]]
   metabase.test.data.one-off-dbs/with-blank-db                                           [[:block 0]]
@@ -227,7 +234,7 @@
   metabase.test.data/native-query                                                        [[:block 0]]
   metabase.test.data/query                                                               [[:block 1]]
   metabase.test.data/run-mbql-query                                                      [[:inner 0]]
-  metabase.test.data/with-empty-h2-app-db                                                [[:block 0]]
+  metabase.test.data/with-empty-h2-app-db!                                               [[:block 0]]
   metabase.test.data/with-temp-copy-of-db                                                [[:block 0]]
   metabase.test.util.public-settings/with-additional-premium-features                    [[:block 1]]
   metabase.test.util.public-settings/with-premium-features                               [[:block 1]]
@@ -262,7 +269,7 @@
   metabase.test/with-current-user                                                        [[:inner 0]]
   metabase.test/with-driver                                                              [[:block 1]]
   metabase.test/with-empty-db                                                            [[:inner 0]]
-  metabase.test/with-empty-h2-app-db                                                     [[:block 0]]
+  metabase.test/with-empty-h2-app-db!                                                    [[:block 0]]
   metabase.test/with-metadata-provider                                                   [[:inner 0]]
   metabase.test/with-premium-features                                                    [[:block 1]]
   metabase.test/with-temp                                                                [[:inner 0]]
@@ -274,7 +281,7 @@
   metabase.test/with-user-in-groups                                                      [[:inner 0]]
   metabase.timeseries-query-processor-test.util/test-timeseries-drivers                  [[:block 0]]
   metabase.timeseries-query-processor-test/run-mbql-query                                [[:inner 0]]
-  metabase.upload-test/with-upload-table!                                                [[:inner 0]]
+  metabase.upload.impl-test/with-upload-table!                                           [[:inner 0]]
   metabase.upload.types/with-currency                                                    [[:default]]
   metabase.upload.types/with-parens                                                      [[:default]]
   metabase.util.async/cancelable-thread                                                  [[:block 0]]

.eslintrc.js

@@ -6,7 +6,7 @@
 // can use this flag to enable it. This is set to true in CI
 const shouldLintCssModules =
   process.env.LINT_CSS_MODULES === "true" || process.env.CI;
-const plugins = ["react", "no-only-tests","ttag"];
+const plugins = ["react", "no-only-tests", "ttag", "i18next"];
 if (shouldLintCssModules) {
   plugins.push("postcss-modules");
 }
@@ -118,7 +118,7 @@ module.exports = {
         ],
       },
     ],
-    complexity: ["error", { max: 54 }],
+    complexity: ["error", { max: 55 }],
     ...(shouldLintCssModules
       ? {
           "postcss-modules/no-undef-class": "error",
@@ -149,6 +149,7 @@ module.exports = {
     "plugin:import/typescript",
     "plugin:depend/recommended",
     "plugin:storybook/recommended",
+    "plugin:i18next/recommended",
   ],
   settings: {
     "import/internal-regex": "^metabase/|^metabase-lib/",
@@ -195,12 +196,15 @@ module.exports = {
         "*.unit.spec.*",
         "frontend/src/metabase/admin/**/*",
         "frontend/src/metabase/setup/**/*",
+        "enterprise/frontend/src/metabase-enterprise/whitelabel/**/*",
         "frontend/lint/**/*",
         "*.stories.*",
         "stories-data.*",
         "e2e/**/*",
         "**/tests/*",
         "release/**/*",
+        "webpack.config.js",
+        "rspack.config.js",
       ],
       rules: {
         "no-color-literals": "off",
@@ -208,6 +212,22 @@ module.exports = {
         "no-literal-metabase-strings": "off",
       },
     },
+    {
+      files: [
+        "*.unit.spec.*",
+        "frontend/lint/**/*",
+        "*.stories.*",
+        "stories-data.*",
+        "e2e/**/*",
+        "**/tests/*",
+        "release/**/*",
+        "webpack.config.js",
+        "rspack.config.js",
+      ],
+      rules: {
+        "i18next/no-literal-string": "off",
+      },
+    },
     {
       extends: ["plugin:@typescript-eslint/recommended"],
       files: ["*.ts", "*.tsx"],
@@ -258,9 +278,9 @@ module.exports = {
         "jest/expect-expect": [
           "error",
           {
-            "assertFunctionNames": ["expect*", "assert*"],
-            "additionalTestBlockFunctions": []
-          }
+            assertFunctionNames: ["expect*", "assert*"],
+            additionalTestBlockFunctions: [],
+          },
         ],
       },
     },
@@ -291,7 +311,7 @@ module.exports = {
             selector: "Literal[value=/mb-base-color-/]",
             message:
               "You may not use base colors in the application, use semantic colors instead. (see colors.module.css)",
-          }
+          },
         ],
       },
     },

.github/CODEOWNERS

@@ -13,12 +13,15 @@ src/metabase/analytics/prometheus.clj @metabase/cloud-ops
 deps.edn @metabase/backend-developers
 
 docs @metabase/tech-writers
+docs/developers-guide # exclude from tech-writer ownership
 
 #
 # Backend modules <=> teams that own them
 #
 
 # modules/drivers @metabase/drivers
+src/metabase/driver/sql_jdbc/actions.clj       @metabase/core-workflows
+test/metabase/driver/sql_jdbc/actions_test.clj @metabase/core-workflows
 
 # enterprise/backend/src/metabase_enterprise/advanced_config @metabase/core-backend-admin-webapp
 # enterprise/backend/test/metabase_enterprise/advanced_config @metabase/core-backend-admin-webapp
@@ -92,8 +95,8 @@ docs @metabase/tech-writers
 # enterprise/backend/src/metabase_enterprise/upload_management @metabase/core-backend-admin-webapp
 # enterprise/backend/test/metabase_enterprise/upload_management @metabase/core-backend-admin-webapp
 
-# src/metabase/actions @metabase/core-backend-admin-webapp
-# test/metabase/actions @metabase/core-backend-admin-webapp
+src/metabase/actions @metabase/core-backend-admin-webapp
+test/metabase/actions @metabase/core-backend-admin-webapp
 
 # src/metabase/activity_feed @metabase/core-backend-admin-webapp
 # test/metabase/activity_feed @metabase/core-backend-admin-webapp

.github/actions/create-backport/action.yml

@@ -23,7 +23,7 @@ runs:
         GITHUB_TOKEN: ${{ inputs.github-token }}
         COMMIT: ${{ inputs.backport-commit }}
       shell: bash
-      run: |
+      run: | # bash
         git config --global user.email "metabase-bot@metabase.com"
         git config --global user.name "Metabase bot"
 
@@ -35,6 +35,8 @@ runs:
         git checkout -b ${BACKPORT_BRANCH}
         git cherry-pick ${COMMIT} || true
 
+        CONFLICT_LIST=$(git ls-files -u)
+
         CONFLICTS=$(git ls-files -u | wc -l)
         if [ "$CONFLICTS" -gt 0 ]; then
           git cherry-pick --abort
@@ -46,7 +48,7 @@ runs:
           echo "git reset HEAD~1" > ./backport.sh
           echo "rm ./backport.sh" >> ./backport.sh
           echo "git cherry-pick ${COMMIT}" >> ./backport.sh
-          echo "echo 'Resolve conflicts and force push this branch'" >> ./backport.sh
+          echo "echo 'Resolve conflicts and force push this branch.\n\nTo backport translations run: bin/i18n/merge-translations <release-branch>'" >> ./backport.sh
           chmod +x ./backport.sh
           git add ./backport.sh
           git commit -m "Add backport resolution script"
@@ -55,7 +57,14 @@ runs:
           #${ORIGINAL_PULL_REQUEST_NUMBER}
           > [!IMPORTANT]
           > Manual conflict resolution is required.
-          Checkout the branch and run \`./backport.sh\` script. Force push your changes after cherry-picking.
+          > Checkout the branch and run \`./backport.sh\` script. Force push your changes after cherry-picking. Check the box below when done.
+
+          Conflicts:
+          \`\`\`shell
+          ${CONFLICT_LIST}
+          \`\`\`
+
+          - [ ] Conflicts resolved
         END
           )
         else

.github/actions/cross-branch-migration-test/action.yml

@@ -1,12 +1,15 @@
 name: Cross-branch migration test
 
 inputs:
-  base-ref:
+  base-ref: ## Base branch PR came from
+    required: true
+  head-ref: ## Source branch of the pull request
     required: true
 
 runs:
   using: "composite"
   steps:
+    ## First we deploy the base branch
     - name: Check out base branch
       uses: actions/checkout@v4
       with:
@@ -39,10 +42,11 @@ runs:
       run: kill $(cat metabase_pid)
       shell: bash
 
+    ## Then we deploy the PR branch to ensure it migrates up successfully
     - name: Check out pull request branch
       uses: actions/checkout@v4
       with:
-        ref: ${{ github.head_ref }}
+        ref: ${{ inputs.head-ref }}
 
     - name: Run backend on pull request branch
       run: |
@@ -65,3 +69,38 @@ runs:
     - name: Stop Metabase on pull request branch
       run: kill $(cat metabase_pid)
       shell: bash
+
+    ## Testing that originally deploying this PR allows you to roll back to a previous release
+    ## Reset the checksums so when we go back to the base branch, it's as if the PR branch was what was originally deployed
+    - name: Reset the checksums as if the PR branch was what was originally deployed
+      run: |
+        clojure -M:dev:ee:migrate reset-checksums
+      shell: bash
+
+    - name: Rollback the last deployment
+      run: |
+        clojure -M:dev:ee:migrate rollback last-deployment
+      shell: bash
+
+    - name: Re-check out base branch
+      uses: actions/checkout@v4
+      with:
+        ref: ${{ inputs.base-ref }}
+
+    - name: Re-run backend on base branch
+      run: |
+        clojure -M:run:ee > metabase.log 2>&1 & echo $! > metabase_pid
+        tail -F metabase.log &
+      shell: bash
+
+    - name: Wait for Metabase to start
+      run: |
+        while ! curl -s 'http://localhost:3000/api/health' | grep '{"status":"ok"}' > /dev/null; do
+          if ! kill -0 $(cat metabase_pid) 2>/dev/null; then
+            cat metabase.log
+            echo "Metabase process has exited."
+            exit 1
+          fi
+          sleep 1
+        done
+      shell: bash

.github/actions/e2e-prepare-containers/action.yml

@@ -31,6 +31,10 @@ inputs:
     description: Webhook tester container
     required: false
     default: false
+  snowplow:
+    description: Snowplow micro container
+    required: false
+    default: false
 
 runs:
   using: "composite"
@@ -42,56 +46,62 @@ runs:
         password: ${{ inputs.password }}
 
     - name: Start Containers
-      run: |
+      shell: bash
+      run: | # bash
         Y='\033[33m'
         G='\033[1;32m'
 
+        cd e2e/test/scenarios/
+
+        docker compose up \
+          $([ ${{ inputs.postgres }} = true ] && echo "postgres-sample") \
+          $([ ${{ inputs.mysql }} = true ] && echo "mysql-sample") \
+          $([ ${{ inputs.mongo }} = true ] && echo "mongo-sample") \
+          $([ ${{ inputs.maildev }} = true ] && echo "maildev") \
+          $([ ${{ inputs.openldap }} = true ] && echo "ldap") \
+          $([ ${{ inputs.webhook }} = true ] && echo "webhook-tester") \
+          $([ ${{ inputs.snowplow }} = true ] && echo "snowplow-micro") \
+          -d
+
         if ${{ inputs.maildev }}; then
-          echo -e "${Y}Starting maildev container..." &&
-          docker run -d -p 1080:1080 -p 1025:1025 maildev/maildev:2.0.5 &&
+          echo -e "${Y}checking maildev container..." &&
           while ! nc -z localhost 1080; do sleep 1; done &&
           while ! nc -z localhost 1025; do sleep 1; done &&
           echo -e "${G}Maildev is up and running!"
         fi
 
         if ${{ inputs.openldap }}; then
-          echo -e "${Y}Starting openldap container..." &&
-          docker run -d -p 389:389 \
-            --env LDAP_ADMIN_PASSWORD=adminpass \
-            --env LDAP_USERS=user01@example.org,user02@example.org \
-            --env LDAP_PASSWORDS=123456,123465 \
-            --env LDAP_ROOT=dc=example,dc=org \
-            --env LDAP_PORT_NUMBER=389 \
-            bitnami/openldap:2.6.4 &&
+          echo -e "${Y}checking openldap container..." &&
           while ! nc -z localhost 389; do sleep 1; done &&
           echo -e "${G}Openldap is up and running!"
         fi
 
         if ${{ inputs.postgres }}; then
-          echo -e "${Y}Starting postgres container..." &&
-          docker run -d -p 5404:5432 -e TZ='US/Pacific' metabase/qa-databases:postgres-sample-12 &&
+          echo -e "${Y}checking postgres container..." &&
           while ! nc -z localhost 5404; do sleep 1; done &&
           echo -e "${G}Postgres is up and running!"
         fi
 
         if ${{ inputs.mysql }}; then
-          echo -e "${Y}Starting mysql container..." &&
-          docker run -d -p 3304:3306 -e TZ='US/Pacific' metabase/qa-databases:mysql-sample-8 &&
+          echo -e "${Y}checking mysql container..." &&
           while ! nc -z localhost 3304; do sleep 1; done &&
           echo -e "${G}MySQL is up and running!"
         fi
 
         if ${{ inputs.mongo }}; then
-          echo -e "${Y}Starting mongo container..." &&
-          docker run -d -p 27004:27017 metabase/qa-databases:mongo-sample-4.4 &&
+          echo -e "${Y}checking mongo container..." &&
           while ! nc -z localhost 27004; do sleep 1; done &&
           echo -e "${G}Mongo is up and running!"
         fi
 
         if ${{ inputs.webhook }}; then
-          echo -e "${Y}Starting webhook test container..." &&
-          docker run -d -p 9080:8080/tcp tarampampam/webhook-tester:1.1.0 serve --create-session 00000000-0000-0000-0000-000000000000 &&
+          echo -e "${Y}checking webhook test container..." &&
           while ! nc -z localhost 9080; do sleep 1; done &&
           echo -e "${G}Webhook tester is up and running!"
         fi
-      shell: bash
+
+        if ${{ inputs.snowplow }}; then
+          echo -e "${Y}checking snowplow micro container..." &&
+          while ! nc -z localhost 9090; do sleep 1; done &&
+          echo -e "${G}Snowplow micro is up and running!"
+        fi

.github/actions/prepare-cypress/action.yml

@@ -1,6 +1,12 @@
 name: Prepare cypress environment
 description: Cypress preparation steps
 
+inputs:
+  working-directory:
+    description: "Optional working directory for yarn commands"
+    required: false
+    default: "."
+
 outputs:
   chrome-path:
     description: Path to the custom Chrome executable
@@ -33,3 +39,4 @@ runs:
         yarn cypress cache list
         yarn cypress verify
       shell: bash
+      working-directory: ${{ inputs.working-directory }}

.github/actions/run-snowplow-micro/action.yml

@@ -1,13 +0,0 @@
-name: Run Snowplow micro
-runs:
-  using: "composite"
-  steps:
-    - name: Download Snowplow micro JAR
-      run: curl -L -o snowplow-micro.jar https://github.com/snowplow-incubator/snowplow-micro/releases/download/micro-1.2.1/snowplow-micro-1.2.1.jar
-      shell: bash
-    - name: Launch Snowplow micro
-      run: java -cp snowplow-micro.jar:snowplow com.snowplowanalytics.snowplow.micro.Main --collector-config snowplow/micro.conf --iglu snowplow/iglu.json &
-      shell: bash
-    - name: Wait until Snowplow micro is ready
-      run: while ! curl -s 'http://localhost:9090' | grep '404'; do sleep 1; done
-      shell: bash

.github/actions/test-driver/action.yml

@@ -38,3 +38,10 @@ runs:
         list-suites: failed
         list-tests: failed
         fail-on-error: false
+    - name: Upload Logs on Failure
+      if: failure()
+      uses: actions/upload-artifact@v4
+      with:
+        name: test-logs-${{ github.job }}
+        path: logs/test-log.json
+        retention-days: 1

.github/actions/upload-test-results/action.yml

@@ -48,7 +48,7 @@ runs:
         aws s3 cp ${OUTPUT_FILE}.zip s3://$BUCKET/$DATE/$GITHUB_RUN_ID/$GITHUB_RUN_ATTEMPT/
 
     - name: Upload results to Trunk
-      if: ${{ always() }}
+      if: ${{ always() && !(github.event_name == 'pull_request' && github.event.pull_request.draft == true) }}
       uses: trunk-io/analytics-uploader@main
       with:
         junit-paths: ${{ inputs.input-path }}

.github/auto_request_review.yml

@@ -6,7 +6,7 @@ files:
   # migrations related files
   'resources/migrations/**':
     - team:core-workflows
-  'src/metabase/db/custom_migrations.clj':
+  'src/metabase/app_db/custom_migrations.clj':
     - team:core-workflows
 
 options:

.github/file-paths.yaml

@@ -16,10 +16,12 @@ frontend_ci: &frontend_ci
   - ".github/actions/prepare-backend/**"
   - ".github/workflows/frontend.yml"
 
-frontend_sources: &frontend_sources
-  - *shared_sources
-  - "enterprise/frontend/!(test)**/**/{!(*.spec),}.{js,jsx,ts,tsx,css}"
-  - "frontend/!(test)**/**/{!(*.spec),}.{js,jsx,ts,tsx,css}"
+frontend_embedding_sdk_ci: &frontend_embedding_sdk_ci
+  - ".github/actions/prepare-frontend/**"
+  - ".github/actions/prepare-backend/**"
+  - ".github/workflows/*embedding-sdk*.yml"
+
+frontend_configs: &frontend_configs
   - "yarn.lock"
   - "**/tsconfig*.json"
   - "package.json"
@@ -32,14 +34,22 @@ frontend_sources: &frontend_sources
   - "webpack.static-viz.config.js"
   - ".nvmrc"
 
+frontend_sources: &frontend_sources
+  - *shared_sources
+  - *frontend_configs
+  - "enterprise/frontend/!(test)**/**/{!(*.spec),}.{js,jsx,ts,tsx,css}"
+  - "frontend/!(test)**/**/{!(*.spec),}.{js,jsx,ts,tsx,css}"
+
 frontend_embedding_sdk_sources:
-  - *frontend_sources
+  - *frontend_configs
+  - "enterprise/frontend/!(test)**/**/{!(*.spec),}.{js,jsx,ts,tsx,css}"
 
 frontend_specs: &frontend_specs
   - *shared_specs
   - "frontend/test/**"
   - "frontend/**/tests/**"
   - "frontend/**/*.unit.*"
+  - "enterprise/frontend/**/*.unit.*"
   - ".github/**/*.unit.spec.*"
   - "jest.config.js"
   - "jest.tz.unit.conf.json"
@@ -104,17 +114,28 @@ e2e_ci: &e2e_ci
   - ".github/actions/prepare-uberjar-artifact/**"
   - ".github/actions/e2e-prepare-containers/**"
   - ".github/actions/prepare-cypress/**"
-  - ".github/actions/run-snowplow-micro/**"
   - ".github/workflows/e2e-*"
 
 e2e_specs: &e2e_specs
-  - "**/*.cy.*.js"
-  - "**/*.cy.*.ts"
+  - e2e/!(test-host-app)**/*.cy.*.{js,ts}
 
 e2e_cross_version: &e2e_cross_version
   - ".github/workflows/e2e-cross-version.yml"
   - "e2e/test/scenarios/cross-version/**"
 
+e2e_embedding_sdk:
+  - *frontend_embedding_sdk_ci
+  - *sources
+  - "e2e/component/**/*.cy.*.{js,ts}"
+
+e2e_embedding_sdk_compatibility:
+  - *default
+  - *frontend_embedding_sdk_ci
+  - *frontend_sources
+  - "e2e/embedding-sdk-host-apps/**"
+  - "e2e/runner/embedding-sdk/**"
+  - "e2e/test-host-app/**/*.cy.*.{js,ts}"
+
 e2e_all:
   - *default
   - *e2e_ci
@@ -127,10 +148,13 @@ snowplow:
   - "snowplow/**"
 
 documentation:
-  - ".typedoc/**"
   - "docs/**"
   - "**/*.md"
 
+embedding_documentation:
+  - ".typedoc/**"
+  - "docs/embedding/**"
+
 yaml:
   - "**/*.yml"
   - "**/*.yaml"

.github/scripts/update-pr-with-issues.js

@@ -49,6 +49,55 @@ function httpsRequest(options, data = null) {
   });
 }
 
+// Makes an HTTPS request with exponential backoff retry logic
+async function httpsRequestWithBackoff(options, data = null, backoffOptions = {}) {
+  // Set default backoff options:
+  const {
+    maxRetries = 8,
+    totalDurationSeconds = 60
+  } = backoffOptions;
+
+  let retries = 0;
+  let delay = 500; // Start with a .5 second delay
+
+  // Calculate a reasonable initial delay based on total duration and max retries
+  // This helps distribute the retry attempts across the total allowed duration
+  const totalDurationMs = totalDurationSeconds * 1000;
+
+  // Track the start time
+  const startTime = Date.now();
+
+  // Ensure data is stringified if it's an object
+  const requestData = data ? (typeof data === 'string' ? data : JSON.stringify(data)) : null;
+
+  while (true) {
+    try {
+      const response = await httpsRequest(options, requestData);
+      return response; // Success: Return the data
+
+    } catch (error) {
+      retries++;
+
+      const elapsedMs = Date.now() - startTime;
+      const timeRemaining = totalDurationMs - elapsedMs;
+
+      // Stop retrying if we've hit max retries or exceeded the total duration
+      if (retries >= maxRetries || timeRemaining <= 0) {
+        console.error(`Failed after ${retries} retries (${Math.round(elapsedMs/1000)}s elapsed):`);
+        throw error;
+      }
+
+      // Calculate the next delay with exponential backoff and jitter
+      delay = Math.min(delay * 2 * (0.8 + Math.random() * 0.4), timeRemaining);
+
+      console.log(`Request failed (attempt ${retries}/${maxRetries}). Retrying in ${Math.round(delay)}ms... (${Math.round(timeRemaining/1000)}s remaining)`);
+
+      // Wait for the calculated delay before trying again
+      await new Promise(resolve => setTimeout(resolve, delay));
+    }
+  }
+}
+
 async function link_issues(github) {
 
   try {
@@ -98,7 +147,11 @@ async function link_issues(github) {
                 attachments {
                   nodes {url}}}}}}`});
 
-    const linearData = await httpsRequest({
+    console.log('--- Linear API query ---');
+    console.log(linearQuery);
+    console.log('----- End of query -----');
+
+    const linearData = await httpsRequestWithBackoff({
       hostname: 'api.linear.app',
       path: '/graphql',
       method: 'POST',
@@ -106,7 +159,9 @@ async function link_issues(github) {
         'Content-Type': 'application/json',
         'Authorization': linearApiKey
       }
-    }, linearQuery);
+    },
+    linearQuery,
+    { maxRetries: 8, totalDurationSeconds: 60 });
 
     console.log('Linear API response:');
     console.log(JSON.stringify(linearData) + "\n");

.github/team.json

@@ -11,7 +11,8 @@
         "appleby",
         "uladzimirdev",
         "wzimrin",
-        "ericnormand"
+        "ericnormand",
+        "galdre"
       ]
     },
     {
@@ -19,7 +20,8 @@
       "label": ".Team/SemanticLayer",
       "members": [
         "kamilmielnik",
-        "lbrdnk"
+        "lbrdnk",
+        "bronsa"
       ]
     },
     {
@@ -61,7 +63,6 @@
         "npfitz",
         "johnswanson",
         "rafpaf",
-        "sloansparger",
         "iethree",
         "nvoxland",
         "fraserdrops",
@@ -76,7 +77,8 @@
         "kulyk",
         "tsplude",
         "lorem--ipsum",
-        "noahmoss"
+        "noahmoss",
+        "bpander"
       ]
     },
     {
@@ -91,13 +93,20 @@
       "name": "Metabot",
       "label": ".Team/Metabot",
       "members": [
+        "retro",
+        "sloansparger",
         "somtom"
       ]
     },
     {
       "name": "Product Growth",
       "label": ".Team/ProductGrowth",
-      "members": ["nemanjaglumac"]
+      "members": ["nemanjaglumac", "chodorowicz"]
+    },
+    {
+      "name": "Cloud",
+      "label": "cloud",
+      "members": []
     }
   ]
 }

.github/workflows/app-db.yml

@@ -0,0 +1,405 @@
+name: App DB Tests
+
+on:
+  workflow_call:
+    inputs:
+      skip:
+        type: boolean
+        default: false
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}-app-db
+  cancel-in-progress: true
+
+jobs:
+  be-tests-mariadb:
+    if: ${{ !inputs.skip }}
+    runs-on: ubuntu-22.04
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      matrix:
+        version:
+          - name: MariaDB 10.2
+            junit-name: be-tests-mariadb-10-2-ee
+            image: circleci/mariadb:10.2.23
+            env:
+              enable-ssl-tests: 'false'
+          - name: MariaDB Latest
+            junit-name: be-tests-mariadb-latest-ee
+            image: circleci/mariadb:latest
+            env:
+              enable-ssl-tests: 'false'
+        job:
+          - name: Enterprise Tests
+            build-static-viz: false
+            test-args: >-
+              :only '"enterprise/backend/test"'
+            exclude-tag: ':mb/driver-tests'
+          - name: EE App DB Tests (Part 1)
+            build-static-viz: true
+            test-args: >-
+              :only '"test"'
+              :partition/total 2
+              :partition/index 0
+            exclude-tag: ':mb/driver-tests'
+          - name: EE App DB Tests (Part 2)
+            build-static-viz: true
+            test-args: >-
+              :only '"test"'
+              :partition/total 2
+              :partition/index 1
+            exclude-tag: ':mb/driver-tests'
+
+    services:
+      mysql:
+        image: ${{ matrix.version.image }}
+        ports:
+          - "3306:3306"
+        env:
+          MYSQL_ALLOW_EMPTY_PASSWORD: true
+          MYSQL_DATABASE: circle_test
+    env:
+      # Only run old migrations tests on pushes to master or release branches. All other branches should skip tests
+      # with the tag `mb/old-migrations-test`. `__ADDITIONAL_EXCLUDED_TAG__` is not used anywhere outside of splicing
+      # it in to the command below.
+      __ADDITIONAL_EXCLUDED_TAG__: >-
+        ${{
+          (
+            github.event_name == 'push' &&
+            (
+              github.ref == 'master' ||
+              startsWith(github.ref, 'release-')
+            ) &&
+            ''
+          ) ||
+          ':mb/old-migrations-test'
+        }}
+      # actual serious env vars below
+      CI: 'true'
+      DRIVERS: mysql
+      MB_DB_TYPE: mysql
+      MB_DB_HOST: localhost
+      MB_DB_PORT: 3306
+      MB_DB_DBNAME: circle_test
+      MB_DB_USER: root
+      MB_MYSQL_TEST_USER: root
+      #
+      # SSL config: only for mysql latest tests.
+      #
+      # set up env vars for something named "MYSQL_SSL" to run MySQL SSL tests verifying connectivity with PEM cert
+      # they are deliberately given a different name to prevent them from affecting the regular test run against
+      # the configured MySQL instance, but there is one particular test (mysql-connect-with-ssl-and-pem-cert-test)
+      # that overrides the MB_MYSQL_TEST_* values with them
+      # the MYSQL_RDS_SSL_INSTANCE vars are defined as secrets and can be altered
+      MB_MYSQL_SSL_TEST_SSL: ${{ matrix.version.env.enable-ssl-tests }}
+      MB_MYSQL_SSL_TEST_HOST: ${{ secrets.MYSQL_RDS_SSL_INSTANCE_HOST }}
+      MB_MYSQL_SSL_TEST_ADDITIONAL_OPTIONS: 'verifyServerCertificate=true'
+      # the contents of the ./resources/certificates/rds-combined-ca-bundle.pem file
+      MB_MYSQL_SSL_TEST_SSL_CERT: ${{ secrets.MB_MYSQL_SSL_TEST_SSL_CERT }}
+      MB_MYSQL_SSL_TEST_USER: metabase
+      MB_MYSQL_SSL_TEST_PASSWORD: ${{ secrets.MYSQL_RDS_SSL_INSTANCE_PASSWORD }}
+    # for historic reasons (I don't want to mess around with required jobs) the job name should be something like
+    # "be-tests-mariadb-10-2-ee (0)"
+    name: "${{ matrix.version.name }} ${{ matrix.job.name }}"
+    steps:
+      - uses: actions/checkout@v4
+      - name: Test ${{ matrix.version.name }}
+        uses: ./.github/actions/test-driver
+        with:
+          build-static-viz: ${{ matrix.job.build-static-viz }}
+          junit-name: ${{ matrix.version.junit-name }}
+          test-args: >-
+            ${{ matrix.job.test-args }}
+            :exclude-tags '[ ${{ matrix.job.exclude-tag }} ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
+      - name: Upload Test Results
+        uses: ./.github/actions/upload-test-results
+        if: always()
+        with:
+          input-path: ./target/junit/
+          output-name: ${{ github.job }}
+          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+          aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ vars.AWS_REGION }}
+          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+
+  be-tests-mysql:
+    if: ${{ !inputs.skip }}
+    runs-on: ubuntu-22.04
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      matrix:
+        version:
+          - name: MySQL 8.0
+            junit-name: be-tests-mysql-8-0-ee
+            image: cimg/mysql:8.0
+            env:
+              enable-ssl-tests: 'false'
+          - name: MySQL Latest
+            junit-name: be-tests-mysql-latest-ee
+            image: mysql:latest
+            env:
+              enable-ssl-tests: 'true'
+        job:
+          - name: Enterprise Tests
+            build-static-viz: false
+            test-args: >-
+              :only '"enterprise/backend/test"'
+            exclude-tag: ':mb/driver-tests'
+          - name: EE App DB Tests (Part 1)
+            build-static-viz: true
+            test-args: >-
+              :only '"test"'
+              :partition/total 2
+              :partition/index 0
+            exclude-tag: ':mb/driver-tests'
+          - name: EE App DB Tests (Part 2)
+            build-static-viz: true
+            test-args: >-
+              :only '"test"'
+              :partition/total 2
+              :partition/index 1
+            exclude-tag: ':mb/driver-tests'
+
+    services:
+      mysql:
+        image: ${{ matrix.version.image }}
+        ports:
+          - "3306:3306"
+        env:
+          MYSQL_ALLOW_EMPTY_PASSWORD: true
+          MYSQL_DATABASE: circle_test
+    env:
+      # Only run old migrations tests on pushes to master or release branches. All other branches should skip tests
+      # with the tag `mb/old-migrations-test`. `__ADDITIONAL_EXCLUDED_TAG__` is not used anywhere outside of splicing
+      # it in to the command below.
+      __ADDITIONAL_EXCLUDED_TAG__: >-
+        ${{
+          (
+            github.event_name == 'push' &&
+            (
+              github.ref == 'master' ||
+              startsWith(github.ref, 'release-')
+            ) &&
+            ''
+          ) ||
+          ':mb/old-migrations-test'
+        }}
+      # actual serious env vars below
+      CI: 'true'
+      DRIVERS: mysql
+      MB_DB_TYPE: mysql
+      MB_DB_HOST: localhost
+      MB_DB_PORT: 3306
+      MB_DB_DBNAME: circle_test
+      MB_DB_USER: root
+      MB_MYSQL_TEST_USER: root
+      #
+      # SSL config: only for mysql latest tests.
+      #
+      # set up env vars for something named "MYSQL_SSL" to run MySQL SSL tests verifying connectivity with PEM cert
+      # they are deliberately given a different name to prevent them from affecting the regular test run against
+      # the configured MySQL instance, but there is one particular test (mysql-connect-with-ssl-and-pem-cert-test)
+      # that overrides the MB_MYSQL_TEST_* values with them
+      # the MYSQL_RDS_SSL_INSTANCE vars are defined as secrets and can be altered
+      MB_MYSQL_SSL_TEST_SSL: ${{ matrix.version.env.enable-ssl-tests }}
+      MB_MYSQL_SSL_TEST_HOST: ${{ secrets.MYSQL_RDS_SSL_INSTANCE_HOST }}
+      MB_MYSQL_SSL_TEST_ADDITIONAL_OPTIONS: 'verifyServerCertificate=true'
+      # the contents of the ./resources/certificates/rds-combined-ca-bundle.pem file
+      MB_MYSQL_SSL_TEST_SSL_CERT: ${{ secrets.MB_MYSQL_SSL_TEST_SSL_CERT }}
+      MB_MYSQL_SSL_TEST_USER: metabase
+      MB_MYSQL_SSL_TEST_PASSWORD: ${{ secrets.MYSQL_RDS_SSL_INSTANCE_PASSWORD }}
+    # for historic reasons (I don't want to mess around with required jobs) the job name should be something like
+    # "be-tests-mariadb-10-2-ee (0)"
+    name: "${{ matrix.version.name }} ${{ matrix.job.name }}"
+    steps:
+      - uses: actions/checkout@v4
+      - name: Test ${{ matrix.version.name }}
+        uses: ./.github/actions/test-driver
+        with:
+          build-static-viz: ${{ matrix.job.build-static-viz }}
+          junit-name: ${{ matrix.version.junit-name }}
+          test-args: >-
+            ${{ matrix.job.test-args }}
+            :exclude-tags '[ ${{ matrix.job.exclude-tag }} ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
+      - name: Upload Test Results
+        uses: ./.github/actions/upload-test-results
+        if: always()
+        with:
+          input-path: ./target/junit/
+          output-name: ${{ github.job }}
+          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+          aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ vars.AWS_REGION }}
+          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+
+  be-tests-postgres:
+    if: ${{ !inputs.skip }}
+    runs-on: ubuntu-22.04
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      matrix:
+        version:
+          - name: Postgres 12.x
+            junit-name: postgres-ee
+            docker-image: postgres:12-alpine
+            env:
+              enable-ssl-tests: 'false'
+          - name: Postgres Latest
+            junit-name: postgres-latest-ee
+            docker-image: postgres:latest
+            env:
+              enable-ssl-tests: 'true'
+        job:
+          - name: Driver Tests
+            build-static-viz: false
+            test-args: >-
+              :only-tags [:mb/driver-tests]
+          - name: Enterprise Tests
+            build-static-viz: false
+            test-args: >-
+              :only '"enterprise/backend/test"'
+            exclude-tag: ':mb/driver-tests'
+          - name: EE App DB Tests (Part 1)
+            build-static-viz: true
+            test-args: >-
+              :only '"test"'
+              :exclude-tags [:mb/driver-tests]
+              :partition/total 2
+              :partition/index 0
+            exclude-tag: ':mb/driver-tests'
+          - name: EE App DB Tests (Part 2)
+            build-static-viz: true
+            test-args: >-
+              :only '"test"'
+              :partition/total 2
+              :partition/index 1
+            exclude-tag: ':mb/driver-tests'
+    name: "${{ matrix.version.name }} ${{ matrix.job.name }}"
+    env:
+      # Only run old migrations tests on pushes to master or release branches. All other branches should skip tests
+      # with the tag `mb/old-migrations-test`. `__ADDITIONAL_EXCLUDED_TAG__` is not used anywhere outside of splicing
+      # it in to the command below.
+      __ADDITIONAL_EXCLUDED_TAG__: >-
+        ${{
+          (
+            github.event_name == 'push' &&
+            (
+              github.ref == 'master' ||
+              startsWith(github.ref, 'release-')
+            ) &&
+            ''
+          ) ||
+          ':mb/old-migrations-test'
+        }}
+      # actual serious env vars below
+      CI: 'true'
+      DRIVERS: postgres
+      MB_DB_TYPE: postgres
+      MB_DB_PORT: 5432
+      MB_DB_HOST: localhost
+      MB_DB_DBNAME: mb_test
+      MB_DB_USER: mb_test
+      MB_POSTGRESQL_TEST_USER: mb_test
+      # SSL tests are only enabled for the postgres-latest job.
+      MB_POSTGRES_SSL_TEST_SSL: ${{ matrix.version.env.enable-ssl-tests }}
+      MB_POSTGRES_SSL_TEST_SSL_MODE: verify-full
+      MB_POSTGRES_SSL_TEST_SSL_ROOT_CERT_PATH: 'test-resources/certificates/us-east-2-bundle.pem'
+    services:
+      postgres:
+        image: ${{ matrix.version.docker-image }}
+        ports:
+          - "5432:5432"
+        env:
+          POSTGRES_USER: mb_test
+          POSTGRES_DB: mb_test
+          POSTGRES_HOST_AUTH_METHOD: trust
+    steps:
+      - uses: actions/checkout@v4
+      - name: Test ${{ matrix.version.name }} (${{ matrix.job.name }})
+        uses: ./.github/actions/test-driver
+        with:
+          build-static-viz: ${{ matrix.job.build-static-viz }}
+          junit-name: 'be-tests-${{ matrix.version.junit-name }}'
+          test-args: >-
+            ${{ matrix.job.test-args }}
+            :exclude-tags '[ ${{ matrix.job.exclude-tag }} ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
+      - name: Upload Test Results
+        uses: ./.github/actions/upload-test-results
+        if: always()
+        with:
+          input-path: ./target/junit/
+          output-name: ${{ github.job }}
+          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+          aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+          aws-region: ${{ vars.AWS_REGION }}
+          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+
+  app-db-tests-result:
+    needs:
+      - be-tests-mariadb
+      - be-tests-mysql
+      - be-tests-postgres
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    name: app-db-tests-result
+    if: always() && !cancelled()
+    steps:
+      - name: Check job status
+        uses: actions/github-script@v7
+        env:
+          needs: ${{ toJson(needs) }}
+        with:
+          script: | # js
+            const needs = JSON.parse(process.env.needs);
+
+            const jobs = Object.entries(needs).map(
+              ([jobName, jobValues]) => ({
+                name: jobName,
+                result: jobValues.result
+              }));
+
+            // are all jobs skipped or successful?
+            if (jobs.every(job => (job.result === 'skipped' || job.result === 'success'))) {
+                console.log("");
+                console.log("        _------.        ");
+                console.log("       /  ,     \_      ");
+                console.log("     /   /  /{}\ |o\_   ");
+                console.log("    /    \  `--' /-' \  ");
+                console.log("   |      \      \    | ");
+                console.log("  |              |`-, | ");
+                console.log("  /              /__/)/ ");
+                console.log(" |              |       ");
+                console.log("");
+                console.log("All app db tests have passed (or have been skipped). Cam is very proud of you.");
+              process.exit(0);
+            }
+
+            // otherwise, something failed
+            console.log("");
+            console.log("       .::::::::::.                          .::::::::::.       ");
+            console.log("     .::::''''''::::.                      .::::''''''::::.     ");
+            console.log("   .:::'          `::::....          ....::::'          `:::.   ");
+            console.log("  .::'             `:::::::|        |:::::::'             `::.  ");
+            console.log(" .::|               |::::::|_ ___ __|::::::|               |::. ");
+            console.log(" `--'               |::::::|_()__()_|::::::|               `--' ");
+            console.log("  :::               |::-o::|        |::o-::|               :::  ");
+            console.log("  `::.             .|::::::|        |::::::|.             .::'  ");
+            console.log("   `:::.          .::\-----'        `-----/::.          .:::'   ");
+            console.log("     `::::......::::'                      `::::......::::'     ");
+            console.log("       `::::::::::'                          `::::::::::'       ");
+            console.log("");
+            console.log("App db tests have failed. You have been sentenced to MetaJail.");
+
+            jobs.forEach((job) => {
+              if (job.result !== 'success') {
+                console.log(`${job.name} - ${job.result}`);
+              }
+            });
+
+            process.exit(1);

.github/workflows/auto-backport.yml

@@ -1,18 +1,16 @@
 name: Auto-backport
+run-name: Auto Backport ${{ github.event.pull_request.title }}
 on:
   pull_request:
     types: [closed, labeled]
 
 jobs:
   create-backport:
-    if: | # the PR must be closed and have a backport label
-      (github.event.pull_request.merged == true || github.event.action == 'closed') && (
+    if: | # the PR must be merged and have a backport label
+      github.event.pull_request.merged == true && (
         contains(github.event.pull_request.labels.*.name, 'backport') ||
         contains(github.event.pull_request.labels.*.name, 'double-backport') ||
-        contains(github.event.pull_request.labels.*.name, 'triple-backport') ||
-        github.event.label.name == 'backport' ||
-        github.event.label.name == 'double-backport' ||
-        github.event.label.name == 'triple-backport'
+        contains(github.event.pull_request.labels.*.name, 'triple-backport')
       )
     runs-on: ubuntu-latest
     steps:
@@ -76,7 +74,7 @@ jobs:
           github-token-2: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Double Backport
-        if: ${{ fromJson(steps.how-many-backports.outputs.result) >= 2 }}
+        if: ${{ always() && fromJson(steps.how-many-backports.outputs.result) >= 2 }}
         uses: ./.github/actions/create-backport
         with:
           target-version: ${{ fromJson(steps.get-latest-release-version.outputs.result).secondLatest }}
@@ -85,7 +83,7 @@ jobs:
           github-token-2: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Triple Backport
-        if: ${{ fromJson(steps.how-many-backports.outputs.result) >= 3 }}
+        if: ${{ always() && fromJson(steps.how-many-backports.outputs.result) >= 3 }}
         uses: ./.github/actions/create-backport
         with:
           target-version: ${{ fromJson(steps.get-latest-release-version.outputs.result).thirdLatest }}

.github/workflows/backend.yml

@@ -153,6 +153,14 @@ jobs:
           list-tests: failed
           fail-on-error: false
 
+      - name: Upload Logs on Failure
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: test-logs-${{ matrix.java-version }}-${{ matrix.job.edition }}-${{ github.job }}
+          path: logs/test-log.json
+          retention-days: 1
+
   # checks that all the namespaces we actually ship can be compiled, without any dependencies that we don't ship (such
   # as `:dev` dependencies). See #27009 for more context.
   be-check:

.github/workflows/containerize-jar.yml

@@ -16,6 +16,8 @@ on:
       release:
         type: string
         default: 'true'
+      build-args:
+        type: string
   workflow_dispatch:
     inputs:
       artifact-name:
@@ -87,6 +89,7 @@ jobs:
         tags: ${{ inputs.repo }}:${{ inputs.tag }}
         no-cache: true
         push: true
+        build-args: ${{ inputs.build-args }}
 
     # we need to do this to get the nice fallback behavior of the legacy manifest file
     - name: Build container (x86 only)

.github/workflows/cross-branch-migrations.yml

@@ -5,6 +5,19 @@ on:
     types: [opened, synchronize, reopened, ready_for_review]
     paths:
       - "resources/migrations/**"
+  workflow_dispatch:
+    inputs:
+      base-ref:
+        description: 'Base reference for the migration test'
+        required: true
+        type: string
+      head-ref:
+        description: 'Head reference for the migration test'
+        required: true
+        type: string
+env:
+  BASE_REF: ${{ inputs.base-ref || github.base_ref }}
+  HEAD_REF: ${{ inputs.head-ref || github.head_ref }}
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
@@ -13,19 +26,21 @@ concurrency:
 jobs:
   migrations-h2-ee:
     runs-on: ubuntu-22.04
-    timeout-minutes: 5
+    timeout-minutes: 10
     env:
       CI: 'true'
       MB_DB_TYPE: h2
+
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/cross-branch-migration-test
         with:
-          base-ref: ${{ github.base_ref }}
+          base-ref: ${{ env.BASE_REF }}
+          head-ref: ${{ env.HEAD_REF }}
 
   migrations-postgres-12-ee:
     runs-on: ubuntu-22.04
-    timeout-minutes: 5
+    timeout-minutes: 10
     env:
       CI: 'true'
       MB_DB_TYPE: postgres
@@ -46,11 +61,12 @@ jobs:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/cross-branch-migration-test
         with:
-          base-ref: ${{ github.base_ref }}
+          base-ref: ${{ env.BASE_REF }}
+          head-ref: ${{ env.HEAD_REF }}
 
   migrations-postgres-latest-ee:
     runs-on: ubuntu-22.04
-    timeout-minutes: 5
+    timeout-minutes: 10
     env:
       CI: 'true'
       MB_DB_TYPE: postgres
@@ -71,11 +87,12 @@ jobs:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/cross-branch-migration-test
         with:
-          base-ref: ${{ github.base_ref }}
+          base-ref: ${{ env.BASE_REF }}
+          head-ref: ${{ env.HEAD_REF }}
 
   migrations-mysql-8-0-ee:
     runs-on: ubuntu-22.04
-    timeout-minutes: 5
+    timeout-minutes: 10
     env:
       CI: 'true'
       MB_DB_TYPE: mysql
@@ -92,11 +109,12 @@ jobs:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/cross-branch-migration-test
         with:
-          base-ref: ${{ github.base_ref }}
+          base-ref: ${{ env.BASE_REF }}
+          head-ref: ${{ env.HEAD_REF }}
 
   migrations-mysql-latest-ee:
     runs-on: ubuntu-22.04
-    timeout-minutes: 5
+    timeout-minutes: 10
     env:
       CI: 'true'
       MB_DB_TYPE: mysql
@@ -117,11 +135,12 @@ jobs:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/cross-branch-migration-test
         with:
-          base-ref: ${{ github.base_ref }}
+          base-ref: ${{ env.BASE_REF }}
+          head-ref: ${{ env.HEAD_REF }}
 
   migrations-mariadb-10-2-ee:
     runs-on: ubuntu-22.04
-    timeout-minutes: 5
+    timeout-minutes: 10
     env:
       CI: 'true'
       MB_DB_TYPE: mysql
@@ -138,11 +157,12 @@ jobs:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/cross-branch-migration-test
         with:
-          base-ref: ${{ github.base_ref }}
+          base-ref: ${{ env.BASE_REF }}
+          head-ref: ${{ env.HEAD_REF }}
 
   migrations-mariadb-latest-ee:
     runs-on: ubuntu-22.04
-    timeout-minutes: 5
+    timeout-minutes: 10
     env:
       CI: 'true'
       MB_DB_TYPE: mysql
@@ -159,4 +179,5 @@ jobs:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/cross-branch-migration-test
         with:
-          base-ref: ${{ github.base_ref }}
+          base-ref: ${{ env.BASE_REF }}
+          head-ref: ${{ env.HEAD_REF }}

.github/workflows/docs_bump_detected.yml

@@ -1,34 +1,44 @@
 name: Docs Bump Detected
 
 on:
-  pull_request:
+  pull_request_target:
+    types:
+      - opened
+      - synchronize
+      - reopened
+    branches:
+      - 'master'
+      - 'release-x.[0-9]+.x'
     paths:
       - 'docs/**'
 
 jobs:
   push_workflow_to_docs_metabase_github_io_job:
     runs-on: ubuntu-latest
+    env:
+      SOURCE_BRANCH: ${{ github.head_ref || github.ref  }}
+      TARGET_BRANCH: ${{ github.event.pull_request.base.ref }}
+      PR_NUMBER: ${{ github.event.pull_request.number }}
     steps:
       - name: Report changed docs files exist
         run: |
-          echo "A change in the docs directory was detected."
+          echo "A PR with changes in the docs directory was detected."
+          echo "Sending workflow trigger to create/update the corresponding PR in docs repo."
+          echo "source branch: $SOURCE_BRANCH"
+          echo "target branch: $TARGET_BRANCH"
+          echo "pr number: $PR_NUMBER"
 
       - name: Trigger repo dispatch
         uses: actions/github-script@v7
-        env:
-          BRANCH_NAME: ${{ github.head_ref || github.ref  }}
         with:
           github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
           script: | #js
-            if (process.env.BRANCH_NAME === "master" ||
-                /^release-x\.\d+\.x$/.test(process.env.BRANCH_NAME)) {
               github.rest.repos.createDispatchEvent({
                 owner: "${{ github.repository_owner }}",
                 repo: "docs.metabase.github.io",
                 event_type: "docs_update",
-                client_payload: { branch_name: process.env.BRANCH_NAME
-                }
-              });
-            } else {
-              console.log("Branch name is not to be published: ", process.env.BRANCH_NAME);
-            }
+                client_payload: {
+                  dispatch_type: "docs_update",
+                  source_branch: process.env.SOURCE_BRANCH,
+                  target_branch: process.env.TARGET_BRANCH,
+                  pr_number: process.env.PR_NUMBER}});

.github/workflows/docs_close_detected.yml

@@ -0,0 +1,43 @@
+name: Docs Close Detected
+
+on:
+  pull_request:
+    types:
+      - closed
+    branches:
+      - 'master'
+      - 'release-x.[0-9]+.x'
+    paths:
+      - 'docs/**'
+
+jobs:
+  push_and_merge_workflow_to_docs_metabase_github_io_job:
+    if: github.event.pull_request.merged == false
+    runs-on: ubuntu-latest
+    env:
+      SOURCE_BRANCH: ${{ github.head_ref || github.ref  }}
+      TARGET_BRANCH: ${{ github.event.pull_request.base.ref }}
+      PR_NUMBER: ${{ github.event.pull_request.number }}
+    steps:
+      - name: Report changed docs files exist
+        run: |
+          echo "A PR with changes to the docs directory was closed."
+          echo "Sending workflow trigger to close corresponding PR in docs repo."
+          echo "source branch: $SOURCE_BRANCH"
+          echo "target branch: $TARGET_BRANCH"
+          echo "pr number: $PR_NUMBER"
+
+      - name: Trigger repo dispatch
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+          script: | #js
+            github.rest.repos.createDispatchEvent({
+                owner: "${{ github.repository_owner }}",
+                repo: "docs.metabase.github.io",
+                event_type: "docs_close",
+                client_payload: {
+                  dispatch_type: "docs_close",
+                  source_branch: process.env.SOURCE_BRANCH,
+                  target_branch: process.env.TARGET_BRANCH,
+                  pr_number: process.env.PR_NUMBER}});

.github/workflows/docs_merge_detected.yml

@@ -0,0 +1,43 @@
+name: Docs Merge Detected
+
+on:
+  pull_request:
+    types:
+      - closed
+    branches:
+      - 'master'
+      - 'release-x.[0-9]+.x'
+    paths:
+      - 'docs/**'
+
+jobs:
+  push_and_merge_workflow_to_docs_metabase_github_io_job:
+    if: github.event.pull_request.merged == true
+    runs-on: ubuntu-latest
+    env:
+      SOURCE_BRANCH: ${{ github.head_ref || github.ref  }}
+      TARGET_BRANCH: ${{ github.event.pull_request.base.ref }}
+      PR_NUMBER: ${{ github.event.pull_request.number }}
+    steps:
+      - name: Report changed docs files exist
+        run: |
+          echo "A PR with changes to the docs directory was merged."
+          echo "Sending workflow trigger to merge corresponding PR in docs repo."
+          echo "source branch: $SOURCE_BRANCH"
+          echo "target branch: $TARGET_BRANCH"
+          echo "pr number: $PR_NUMBER"
+
+      - name: Trigger repo dispatch
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+          script: | #js
+            github.rest.repos.createDispatchEvent({
+                owner: "${{ github.repository_owner }}",
+                repo: "docs.metabase.github.io",
+                event_type: "docs_merge",
+                client_payload: {
+                  dispatch_type: "docs_merge",
+                  source_branch: process.env.SOURCE_BRANCH,
+                  target_branch: process.env.TARGET_BRANCH,
+                  pr_number: process.env.PR_NUMBER}});

.github/workflows/drivers.yml

@@ -12,8 +12,38 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  # This job will determine if the tier 3 driver tests should be skipped.
+  # It will always run first.
+  determine-driver-skips:
+    runs-on: ubuntu-latest
+    outputs:
+      skip: ${{ steps.check_team_and_branch.outputs.skip }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - name: Check if tier3 drivers should run
+        id: check_team_and_branch
+        run: |
+          IS_MASTER_OR_RELEASE="${{ github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/heads/release-') }}"
+          HAS_TEAM_LABEL="${{ contains(github.event.pull_request.labels.*.name, '.Team/Drivers') || contains(github.event.pull_request.labels.*.name, '.Team/Querying') || contains(github.event.pull_request.labels.*.name, '.Team/SemanticLayer') }}"
+
+
+          echo "Is master or release: ${IS_MASTER_OR_RELEASE}"
+          echo "Has '.Team/Drivers' or '.Team/Querying' or '.Team/SemanticLayer' label: ${HAS_TEAM_LABEL}"
+          if [[ "${IS_MASTER_OR_RELEASE}" == "true" ]]; then
+            echo "skip=false" >> $GITHUB_OUTPUT
+            echo "Merging into master or a release branch. Tier 3 driver tests will run."
+          elif [[ "${HAS_TEAM_LABEL}" == "true" ]]; then
+            echo "skip=false" >> $GITHUB_OUTPUT
+            echo "A relevant team label is present. Tier 3 driver tests will run."
+          else
+            echo "skip=true" >> $GITHUB_OUTPUT
+            echo "Not labeled with required team and not merging into master/release. Tier 3 driver tests will be skipped."
+          fi
+        shell: bash
   be-tests-athena-ee:
-    if: ${{ !inputs.skip }}
+    needs: determine-driver-skips
+    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
     runs-on: ubuntu-22.04
     timeout-minutes: 60
     env:
@@ -129,7 +159,8 @@ jobs:
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
   be-tests-druid-ee:
-    if: ${{ !inputs.skip }}
+    needs: determine-driver-skips
+    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
     runs-on: ubuntu-22.04
     timeout-minutes: 60
     env:
@@ -164,7 +195,8 @@ jobs:
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
   be-tests-druid-jdbc-ee:
-    if: ${{ !inputs.skip }}
+    needs: determine-driver-skips
+    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
     runs-on: ubuntu-22.04
     timeout-minutes: 60
     env:
@@ -199,7 +231,8 @@ jobs:
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
   be-tests-databricks-ee:
-    if: ${{ !inputs.skip }}
+    needs: determine-driver-skips
+    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
     runs-on: ubuntu-22.04
     timeout-minutes: 60
     env:
@@ -233,7 +266,8 @@ jobs:
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
   be-tests-databricks-multi-catalog-ee:
-    if: ${{ !inputs.skip }}
+    needs: determine-driver-skips
+    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
     runs-on: ubuntu-22.04
     timeout-minutes: 60
     env:
@@ -314,7 +348,7 @@ jobs:
               enable-ssl-tests: 'false'
           - name: MySQL 8.0
             junit-name: be-tests-mysql-8-0-ee
-            image: cimg/mysql:8.0
+            image: mysql:8.0
             env:
               enable-ssl-tests: 'false'
           - name: MySQL Latest
@@ -324,28 +358,8 @@ jobs:
               enable-ssl-tests: 'true'
         job:
           - name: Driver Tests
-            build-static-viz: false
             test-args: >-
               :only-tags [:mb/driver-tests]
-          - name: Enterprise Tests
-            build-static-viz: false
-            test-args: >-
-              :only '"enterprise/backend/test"'
-            exclude-tag: ':mb/driver-tests'
-          - name: EE App DB Tests (Part 1)
-            build-static-viz: true
-            test-args: >-
-              :only '"test"'
-              :partition/total 2
-              :partition/index 0
-            exclude-tag: ':mb/driver-tests'
-          - name: EE App DB Tests (Part 2)
-            build-static-viz: true
-            test-args: >-
-              :only '"test"'
-              :partition/total 2
-              :partition/index 1
-            exclude-tag: ':mb/driver-tests'
 
     services:
       mysql:
@@ -403,7 +417,6 @@ jobs:
       - name: Test ${{ matrix.version.name }}
         uses: ./.github/actions/test-driver
         with:
-          build-static-viz: ${{ matrix.job.build-static-viz }}
           junit-name: ${{ matrix.version.junit-name }}
           test-args: >-
             ${{ matrix.job.test-args }}
@@ -421,19 +434,17 @@ jobs:
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
   be-tests-mongo:
-    if: ${{ !inputs.skip }}
+    needs: determine-driver-skips
+    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
     runs-on: ubuntu-22.04
     timeout-minutes: 60
     strategy:
       fail-fast: false
       matrix:
         version:
-          - name: MongoDB 4.4
-            junit-name: be-tests-mongo-4-4-ee
-            image: metabase/qa-databases:mongo-sample-4.4
-          - name: MongoDB 5.0
-            junit-name: be-tests-mongo-5-0-ee
-            image: metabase/qa-databases:mongo-sample-5.0
+          - name: MongoDB 6.0
+            junit-name: be-tests-mongo-6-0-ee
+            image: metabase/qa-databases:mongo-sample-6
           - name: MongoDB Latest
             junit-name: be-tests-mongo-latest-ee
             image: mongo:latest
@@ -473,19 +484,17 @@ jobs:
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
   be-tests-mongo-ssl:
-    if: ${{ !inputs.skip }}
+    needs: determine-driver-skips
+    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
     runs-on: ubuntu-22.04
     timeout-minutes: 60
     strategy:
       fail-fast: false
       matrix:
         version:
-          - name: MongoDB 4.4
-            junit-name: be-tests-mongo-4-4-ee
-            image: metabase/qa-databases:mongo-sample-4.4
-          - name: MongoDB 5.0
-            junit-name: be-tests-mongo-5-0-ssl-ee
-            image: metabase/qa-databases:mongo-sample-5.0
+          - name: MongoDB 6.0
+            junit-name: be-tests-mongo-6-0-ssl-ee
+            image: metabase/qa-databases:mongo-sample-6
     env:
       CI: 'true'
       DRIVERS: mongo
@@ -540,7 +549,8 @@ jobs:
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
   be-tests-mongo-sharded-cluster-ee:
-    if: ${{ !inputs.skip }}
+    needs: determine-driver-skips
+    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
     runs-on: ubuntu-22.04
     timeout-minutes: 60
     env:
@@ -573,7 +583,8 @@ jobs:
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
   be-tests-oracle:
-    if: ${{ !inputs.skip }}
+    needs: determine-driver-skips
+    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
     runs-on: ubuntu-22.04
     timeout-minutes: 60
     strategy:
@@ -663,29 +674,8 @@ jobs:
               enable-ssl-tests: 'true'
         job:
           - name: Driver Tests
-            build-static-viz: false
             test-args: >-
               :only-tags [:mb/driver-tests]
-          - name: Enterprise Tests
-            build-static-viz: false
-            test-args: >-
-              :only '"enterprise/backend/test"'
-            exclude-tag: ':mb/driver-tests'
-          - name: EE App DB Tests (Part 1)
-            build-static-viz: true
-            test-args: >-
-              :only '"test"'
-              :exclude-tags [:mb/driver-tests]
-              :partition/total 2
-              :partition/index 0
-            exclude-tag: ':mb/driver-tests'
-          - name: EE App DB Tests (Part 2)
-            build-static-viz: true
-            test-args: >-
-              :only '"test"'
-              :partition/total 2
-              :partition/index 1
-            exclude-tag: ':mb/driver-tests'
     name: "${{ matrix.version.name }} ${{ matrix.job.name }}"
     env:
       # Only run old migrations tests on pushes to master or release branches. All other branches should skip tests
@@ -730,7 +720,6 @@ jobs:
       - name: Test ${{ matrix.version.name }} (${{ matrix.job.name }})
         uses: ./.github/actions/test-driver
         with:
-          build-static-viz: ${{ matrix.job.build-static-viz }}
           junit-name: 'be-tests-${{ matrix.version.junit-name }}'
           test-args: >-
             ${{ matrix.job.test-args }}
@@ -748,7 +737,8 @@ jobs:
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
   be-tests-presto-jdbc-ee:
-    if: ${{ !inputs.skip }}
+    needs: determine-driver-skips
+    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
     runs-on: ubuntu-22.04
     timeout-minutes: 60
     env:
@@ -904,7 +894,8 @@ jobs:
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
   be-tests-sparksql-ee:
-    if: ${{ !inputs.skip }}
+    needs: determine-driver-skips
+    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
     runs-on: ubuntu-22.04
     timeout-minutes: 60
     env:
@@ -937,7 +928,8 @@ jobs:
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
   be-tests-sqlite-ee:
-    if: ${{ !inputs.skip }}
+    needs: determine-driver-skips
+    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
     runs-on: ubuntu-22.04
     timeout-minutes: 60
     env:
@@ -965,7 +957,8 @@ jobs:
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
   be-tests-sqlserver:
-    if: ${{ !inputs.skip }}
+    needs: determine-driver-skips
+    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
     runs-on: ubuntu-22.04
     timeout-minutes: 30
     strategy:
@@ -1015,7 +1008,8 @@ jobs:
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
   be-tests-starburst-ee:
-    if: ${{ !inputs.skip }}
+    needs: determine-driver-skips
+    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
     runs-on: ubuntu-22.04
     timeout-minutes: 60
     env:
@@ -1052,7 +1046,8 @@ jobs:
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
   be-tests-vertica-ee:
-    if: ${{ !inputs.skip }}
+    needs: determine-driver-skips
+    if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
     runs-on: ubuntu-22.04
     timeout-minutes: 60
     env:

.github/workflows/e2e-component-tests-embedding-sdk-cross-version.yml

@@ -3,10 +3,6 @@ name: E2E Cross-version Component Tests for Embedding SDK
 on:
   workflow_call:
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
-  cancel-in-progress: true
-
 jobs:
   files-changed:
     name: Check which files changed
@@ -86,7 +82,7 @@ jobs:
       - name: Prepare uberjar artifact
         uses: ./.github/actions/prepare-uberjar-artifact
         with:
-          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar-cross-version
 
   resolve-sdk-version:
     if: |
@@ -132,8 +128,10 @@ jobs:
       DISPLAY: ""
       # Any env starting with `CYPRESS_` will be available to all Cypress tests via `Cypress.env()`
       # Example: you can get `CYPRESS_FOO` with `Cypress.env("FOO")`
-      CYPRESS_ALL_FEATURES_TOKEN: ${{ secrets.ENTERPRISE_TOKEN }}
-      CYPRESS_NO_FEATURES_TOKEN: ${{ secrets.E2E_STARTER_TOKEN }}
+      CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.MB_ALL_FEATURES_TOKEN }}
+      CYPRESS_MB_STARTER_CLOUD_TOKEN: ${{ secrets.MB_STARTER_CLOUD_TOKEN }}
+      CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.MB_PRO_CLOUD_TOKEN }}
+      CYPRESS_MB_PRO_SELF_HOSTED_TOKEN: ${{ secrets.MB_PRO_SELF_HOSTED_TOKEN }}
       CYPRESS_PULL_REQUEST_ID: ${{ github.event.pull_request.number || '' }}
       COMMIT_INFO_MESSAGE: ${{ github.event.pull_request.title || github.event.head_commit.message || github.event.head.sha }}
       TZ: US/Pacific # to make node match the instance tz
@@ -142,12 +140,6 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Prepare Docker containers
-        uses: ./.github/actions/e2e-prepare-containers
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
       # Needed to omit newly added tests for functionality that is not yet released
       - name: Sparse checkout tests from SDK release commit
         uses: actions/checkout@v4
@@ -168,7 +160,7 @@ jobs:
       - name: Retrieve uberjar artifact for ee
         uses: actions/download-artifact@v4
         with:
-          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar-cross-version
 
       - name: Prepare front-end environment
         uses: ./.github/actions/prepare-frontend

.github/workflows/e2e-component-tests-embedding-sdk.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-22.04
     timeout-minutes: 3
     outputs:
-      e2e_all: ${{ steps.changes.outputs.e2e_all }}
+      e2e_embedding_sdk: ${{ steps.changes.outputs.e2e_embedding_sdk }}
     steps:
       - uses: actions/checkout@v4
       - name: Test which files changed
@@ -62,7 +62,7 @@ jobs:
     needs: [files-changed, get-build-requirements]
     if: |
       !cancelled() &&
-      needs.files-changed.outputs.e2e_all == 'true'
+      needs.files-changed.outputs.e2e_embedding_sdk == 'true'
     runs-on: ubuntu-22.04
     timeout-minutes: 25
     env:
@@ -109,8 +109,10 @@ jobs:
       DISPLAY: ""
       # Any env starting with `CYPRESS_` will be available to all Cypress tests via `Cypress.env()`
       # Example: you can get `CYPRESS_FOO` with `Cypress.env("FOO")`
-      CYPRESS_ALL_FEATURES_TOKEN: ${{ secrets.ENTERPRISE_TOKEN }}
-      CYPRESS_NO_FEATURES_TOKEN: ${{ secrets.E2E_STARTER_TOKEN }}
+      CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.MB_ALL_FEATURES_TOKEN }}
+      CYPRESS_MB_STARTER_CLOUD_TOKEN: ${{ secrets.MB_STARTER_CLOUD_TOKEN }}
+      CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.MB_PRO_CLOUD_TOKEN }}
+      CYPRESS_MB_PRO_SELF_HOSTED_TOKEN: ${{ secrets.MB_PRO_SELF_HOSTED_TOKEN }}
       CYPRESS_PULL_REQUEST_ID: ${{ github.event.pull_request.number || '' }}
       CYPRESS_IS_EMBEDDING_SDK: true
       COMMIT_INFO_MESSAGE: ${{ github.event.pull_request.title || github.event.head_commit.message || github.event.head.sha }}
@@ -120,12 +122,6 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Prepare Docker containers
-        uses: ./.github/actions/e2e-prepare-containers
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
       - name: Retrieve uberjar artifact for ee
         uses: actions/download-artifact@v4
         with:

.github/workflows/e2e-cross-version-for-breaking-changes.yml

@@ -1,5 +1,7 @@
 name: E2E Cross-version Tests
 
+# See `bin/backward-compatibility-test.js` for the documentation of this workflow.
+
 on:
   workflow_dispatch:
     inputs:
@@ -13,6 +15,11 @@ on:
         type: string
         required: true
         default: "master"
+      total-shards:
+        description: "Total number of parallel test shards"
+        type: number
+        required: false
+        default: 4
   workflow_call:
     inputs:
       fe-ref:
@@ -23,9 +30,38 @@ on:
         description: "Backend git ref to use"
         type: string
         required: true
+      total-shards:
+        description: "Total number of parallel test shards"
+        type: number
+        required: false
+        default: 4
 
 jobs:
-  cross-version-for-breaking-changes:
+  generate-matrix:
+    runs-on: ubuntu-latest
+    outputs:
+      matrix_json: ${{ steps.set_matrix.outputs.matrix_json }}
+      shards_total: ${{ steps.set_matrix.outputs.shards_total }}
+    steps:
+      - name: Set up shard matrix
+        id: set_matrix
+        uses: actions/github-script@v7
+        with:
+          # generate an output like `{"matrixJson": "{\"shard\": [1, 2, 3, 4]}", "shardsTotal": 4}` to be used in the other jobs
+          script: |
+            const totalShards = parseInt(process.env.TOTAL_SHARDS_INPUT, 10);
+
+            const matrix = { shard: Array.from({ length: totalShards }, (_, i) => i + 1) };
+
+            console.log("Generated matrix JSON", matrix);
+            console.log(`Total shards: ${totalShards}`);
+
+            core.setOutput('matrix_json', JSON.stringify(matrix));
+            core.setOutput('shards_total', totalShards);
+        env:
+          TOTAL_SHARDS_INPUT: ${{ inputs.total-shards }}
+
+  build-jar:
     runs-on: ubuntu-22.04
     timeout-minutes: 45
 
@@ -33,8 +69,12 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Prepare frontend environment
-        uses: ./.github/actions/prepare-frontend
+      - name: Prepare Node.js
+        # We're not using `actions/prepare-frontend` because we don't want to install deps from the root repo
+        # nor we want to touch the cache as we'll be potentially be installing different versions of packages
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: ".nvmrc"
 
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
@@ -46,24 +86,74 @@ jobs:
           MB_EDITION: ee
           CYPRESS_CI: true
         run: |
-          bash bin/backward-compatibility-test.sh \
+          node bin/backward-compatibility-test.js \
             ${{ inputs.fe-ref }} ${{ inputs.be-ref }} \
             build
 
+      - name: Upload Uberjar
+        uses: actions/upload-artifact@v4
+        with:
+          name: metabase-jar-cross-version
+          path: .tmp/metabase-be/target/uberjar/metabase.jar
+          if-no-files-found: error
+
+  run-breaking-changes-tests:
+    needs: [build-jar, generate-matrix]
+    runs-on: ubuntu-22.04
+    timeout-minutes: 45
+    env:
+      TOTAL_SHARDS: ${{ needs.generate-matrix.outputs.shards_total }}
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJson(needs.generate-matrix.outputs.matrix_json) }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Prepare Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: ".nvmrc"
+
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: cross-version-uberjar
+
+      - name: Download Uberjar
+        uses: actions/download-artifact@v4
+        with:
+          name: metabase-jar-cross-version
+          path: .tmp/metabase-be/target/uberjar/
+
+      - name: Download FE repo
+        run: |
+          git clone --depth 1 -b ${{ inputs.fe-ref }} https://github.com/metabase/metabase.git .tmp/metabase-fe
+
+      - name: Install FE dependencies
+        working-directory: .tmp/metabase-fe
+        run: |
+          yarn install
+
       - name: Prepare Cypress environment
         id: cypress-prep
         uses: ./.github/actions/prepare-cypress
+        with:
+          working-directory: .tmp/metabase-fe
 
       - name: Run the tests
         env:
           MB_EDITION: ee
-          CYPRESS_ALL_FEATURES_TOKEN: ${{ secrets.ENTERPRISE_TOKEN }}
-          CYPRESS_NO_FEATURES_TOKEN: ${{ secrets.E2E_STARTER_TOKEN }}
+          CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.MB_ALL_FEATURES_TOKEN }}
+          CYPRESS_MB_STARTER_CLOUD_TOKEN: ${{ secrets.MB_STARTER_CLOUD_TOKEN }}
+          CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.MB_PRO_CLOUD_TOKEN }}
+          CYPRESS_MB_PRO_SELF_HOSTED_TOKEN: ${{ secrets.MB_PRO_SELF_HOSTED_TOKEN }}
           CYPRESS_CI: true
         run: |
-          bash bin/backward-compatibility-test.sh \
+          node bin/backward-compatibility-test.js \
             ${{ inputs.fe-ref }} ${{ inputs.be-ref }} \
             start > /dev/null & \
-            bash bin/backward-compatibility-test.sh \
+            node bin/backward-compatibility-test.js \
             ${{ inputs.fe-ref }} ${{ inputs.be-ref }} \
-            test
+            test ${{ matrix.shard}}/${{ env.TOTAL_SHARDS }}

.github/workflows/e2e-cross-version.yml

@@ -66,8 +66,10 @@ jobs:
         docker run -d \
         -v $PWD/my-metabase:/metabase.db \
         -p 3000:3000 \
-        -e CYPRESS_ALL_FEATURES_TOKEN=${{ secrets.ENTERPRISE_TOKEN }} \
-        -e CYPRESS_NO_FEATURES_TOKEN=${{ secrets.E2E_STARTER_TOKEN }} \
+        -e CYPRESS_MB_ALL_FEATURES_TOKEN=${{ secrets.MB_ALL_FEATURES_TOKEN }} \
+        -e CYPRESS_MB_STARTER_CLOUD_TOKEN=${{ secrets.MB_STARTER_CLOUD_TOKEN }} \
+        -e CYPRESS_MB_PRO_CLOUD_TOKEN=${{ secrets.MB_PRO_CLOUD_TOKEN }} \
+        -e CYPRESS_MB_PRO_SELF_HOSTED_TOKEN=${{ secrets.MB_PRO_SELF_HOSTED_TOKEN }} \
         --name metabase-${{ matrix.version.source }} \
         ${{ env.DOCKER_SOURCE_IMAGE }}
     - name: Wait for Metabase to start on port 3000
@@ -97,8 +99,10 @@ jobs:
         docker run -d \
           -v $PWD/my-metabase:/metabase.db \
           -p 3001:3000 \
-          -e CYPRESS_ALL_FEATURES_TOKEN=${{ secrets.ENTERPRISE_TOKEN }} \
-          -e CYPRESS_NO_FEATURES_TOKEN=${{ secrets.E2E_STARTER_TOKEN }} \
+          -e CYPRESS_MB_ALL_FEATURES_TOKEN=${{ secrets.MB_ALL_FEATURES_TOKEN }} \
+          -e CYPRESS_MB_STARTER_CLOUD_TOKEN=${{ secrets.MB_STARTER_CLOUD_TOKEN }} \
+          -e CYPRESS_MB_PRO_CLOUD_TOKEN=${{ secrets.MB_PRO_CLOUD_TOKEN }} \
+          -e CYPRESS_MB_PRO_SELF_HOSTED_TOKEN=${{ secrets.MB_PRO_SELF_HOSTED_TOKEN }} \
           --name metabase-${{ matrix.version.target }} \
           ${{ env.DOCKER_TARGET_IMAGE }}
     - name: Wait for Metabase to start on port 3001

.github/workflows/e2e-embedding-sdk-compatibility-tests.yml

@@ -1,4 +1,4 @@
-name: E2E Sample Apps tests
+name: E2E Embedding SDK Compatibility tests
 
 on:
   push:
@@ -11,22 +11,6 @@ on:
       - "master"
       - "release-**"
 
-env:
-  # we must support last two stable releases
-  SUPPORTED_RELEASES_COUNT: 2
-  TEST_SUITES: |
-    [
-      "metabase-nodejs-react-sdk-embedding-sample-e2e",
-      "metabase-nextjs-sdk-embedding-sample-e2e",
-      "shoppy-e2e"
-    ]
-  TEST_SUITES_TO_RUN_IN_MASTER_ONLY: |
-    [
-      "shoppy-e2e"
-    ]
-  SAMPLE_APP_MAIN_BRANCH_NAME: "main"
-  SAMPLE_APP_STABLE_RELEASE_BRANCH_NAME_SUFFIX: "stable"
-
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
   cancel-in-progress: true
@@ -37,7 +21,7 @@ jobs:
     runs-on: ubuntu-22.04
     timeout-minutes: 3
     outputs:
-      e2e_all: ${{ steps.changes.outputs.e2e_all }}
+      e2e_embedding_sdk_compatibility: ${{ steps.changes.outputs.e2e_embedding_sdk_compatibility }}
     steps:
       - uses: actions/checkout@v4
       - name: Test which files changed
@@ -87,6 +71,21 @@ jobs:
       !cancelled()
     runs-on: ubuntu-22.04
     timeout-minutes: 10
+    env:
+      # we must support last two stable releases
+      SUPPORTED_RELEASES_COUNT: 2
+      TEST_SUITES: |
+        [
+          "metabase-nodejs-react-sdk-embedding-sample-e2e",
+          "metabase-nextjs-sdk-embedding-sample-e2e",
+          "shoppy-e2e"
+        ]
+      TEST_SUITES_TO_RUN_IN_MASTER_ONLY: |
+        [
+          "shoppy-e2e"
+        ]
+      SAMPLE_APP_MAIN_BRANCH_NAME: "main"
+      SAMPLE_APP_STABLE_RELEASE_BRANCH_NAME_SUFFIX: "stable"
     outputs:
       branch_name: ${{ fromJson(steps.build-sample-apps-data.outputs.result).branch_name }}
       matrix: ${{ toJSON(fromJson(steps.build-sample-apps-data.outputs.result).matrix) }}
@@ -150,7 +149,7 @@ jobs:
     needs: [files-changed, get-build-requirements, get-sample-apps-data]
     if: |
       !cancelled() &&
-      needs.files-changed.outputs.e2e_all == 'true' &&
+      needs.files-changed.outputs.e2e_embedding_sdk_compatibility == 'true' &&
       fromJSON(needs.get-sample-apps-data.outputs.matrix)[0] != null
     runs-on: ubuntu-22.04
     timeout-minutes: 25
@@ -192,39 +191,54 @@ jobs:
           name: embedding-sdk-${{ github.event.pull_request.head.sha || github.sha }}
           path: resources/embedding-sdk
 
-  e2e-tests:
+  # In order to check compatibility between Sample Apps and Embedding SDK, the job for each sample app:
+  # - pulls a Sample App
+  # - starts it
+  # - runs its Cypress tests against the local metabase.jar and local @metabase/embedding-sdk-react package.
+  # The job is not required, though if it's failing better to be sure that it's not caused by a breaking change.
+  # For more details see `Sample Apps compatibility with Embedding SDK tests` in `enterprise/frontend/src/embedding-sdk/dev.md`
+  e2e-sample-apps-tests:
     needs: [get-build-requirements, get-sample-apps-data, build]
     strategy:
       matrix:
         test_suite: ${{ fromJSON(needs.get-sample-apps-data.outputs.matrix) }}
+        environment: ["production", "development"]
     if: |
       !cancelled() && needs.build.result == 'success'
     runs-on: ubuntu-22.04
     timeout-minutes: 45
-    name: e2e-sample-app-${{ matrix.test_suite }}-tests
+    name: e2e-sample-app-${{ matrix.test_suite }}-tests-${{ matrix.environment }}-bundle
     env:
       MB_EDITION: ee
       DISPLAY: ""
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       PR_NUMBER: ${{ github.event.pull_request.number || '' }}
       HASH: ${{ github.event.pull_request.head.sha || github.sha }}-${{ github.run_attempt }}
-      # Any env starting with `CYPRESS_` will be available to all Cypress tests via `Cypress.env()`
-      # Example: you can get `CYPRESS_FOO` with `Cypress.env("FOO")`
-      CYPRESS_ALL_FEATURES_TOKEN: ${{ secrets.ENTERPRISE_TOKEN }}
-      CYPRESS_NO_FEATURES_TOKEN: ${{ secrets.E2E_STARTER_TOKEN }}
-      CYPRESS_PULL_REQUEST_ID: ${{ github.event.pull_request.number || '' }}
+      CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.MB_ALL_FEATURES_TOKEN }}
       CYPRESS_IS_EMBEDDING_SDK: true
-      COMMIT_INFO_MESSAGE: ${{ github.event.pull_request.title || github.event.head_commit.message || github.event.head.sha }}
       TZ: US/Pacific # to make node match the instance tz
-      # Sample Apps testing variables
       CYPRESS_CI: true
       SAMPLE_APP_BRANCH_NAME: ${{ needs.get-sample-apps-data.outputs.branch_name }}
+      SAMPLE_APP_ENVIRONMENT: ${{ matrix.environment }}
     permissions:
       id-token: write
 
     steps:
       - uses: actions/checkout@v4
 
+      # We have to use the latest version that does not have this issue https://github.com/docker/compose/pull/12752
+      - name: Set up Docker Compose
+        uses: docker/setup-compose-action@v1
+        with:
+          version: latest
+
+      - name: Get Sample App name
+        id: get-sample-app-name
+        shell: bash
+        run: |
+          test_suite="${{ matrix.test_suite }}"
+          echo "sample_app_name=${test_suite%-e2e}" >> "$GITHUB_OUTPUT"
+
       - name: Retrieve uberjar artifact for ee
         uses: actions/download-artifact@v4
         with:
@@ -274,23 +288,120 @@ jobs:
         env:
           METABASE_APP_DB_USER: ${{ secrets.SHOPPY_METABASE_APP_DB_USER }}
           METABASE_APP_DB: ${{ secrets.SHOPPY_METABASE_APP_DB_DATABASE }}
-        run: npx tsx ./e2e/runner/start-sample-app-containers/start-ci.ts shoppy-e2e
+        run: npx tsx ./e2e/runner/embedding-sdk/sample-apps/start-ci.ts shoppy-e2e
 
       - name: Prepare and launch Sample Apps for other test suites
         if: ${{ steps.check-sample-app-branch.outputs.sample_app_branch_exists == 'true' && matrix.test_suite != 'shoppy-e2e' }}
-        run: npx tsx ./e2e/runner/start-sample-app-containers/start-ci.ts ${{ matrix.test_suite }}
+        run: npx tsx ./e2e/runner/embedding-sdk/sample-apps/start-ci.ts ${{ matrix.test_suite }}
 
       - name: Run e2e tests for Sample App
         id: run-e2e-tests
         if: ${{ steps.check-sample-app-branch.outputs.sample_app_branch_exists == 'true' }}
+        continue-on-error: true
         run: node e2e/runner/run_cypress_ci.js ${{ matrix.test_suite }} --browser ${{ steps.cypress-prep.outputs.chrome-path }}
 
       - name: Upload Cypress Artifacts upon failure
         uses: actions/upload-artifact@v4
-        if: ${{ steps.check-sample-app-branch.outputs.branch_exists == 'true' && steps.run-e2e-tests.outcome != 'success' }}
+        if: ${{ steps.check-sample-app-branch.outputs.sample_app_branch_exists == 'true' && steps.run-e2e-tests.outcome != 'success' }}
         with:
           name: cypress-recording-sample-app-${{ matrix.test_suite }}-latest
           path: |
-            ./cypress
-            ./logs/test.log
+            ./e2e/tmp/${{ steps.get-sample-app-name.outputs.sample_app_name }}/cypress
           if-no-files-found: ignore
+
+      - name: Fail job if tests failed
+        if: ${{ steps.check-sample-app-branch.outputs.sample_app_branch_exists == 'true' && steps.run-e2e-tests.outcome != 'success' }}
+        run: |
+          exit 1
+
+  # The job checks integration of the Embedding SDK with consumer's apps that use different frameworks/bundlers,
+  # or when we want to test some tricky integration cases like conflicting types.
+  # The job
+  # - starts an app
+  # - runs its Cypress tests against the e2e test metabase instance and local @metabase/embedding-sdk-react package.
+  # The job is not required, though if it's failing better to be sure that it's not caused by a breaking change.
+  # For more details see `Embedding SDK integration tests with Host Apps` in `enterprise/frontend/src/embedding-sdk/dev.md`
+  e2e-host-apps-tests:
+    needs: [ get-build-requirements, build ]
+    strategy:
+      matrix:
+        test_suite: [
+          "vite-6-host-app-e2e",
+          "next-15-app-router-host-app-e2e",
+          "next-15-pages-router-host-app-e2e",
+          "angular-20-host-app-e2e",
+        ]
+        environment: [ "production", "development" ]
+    if: |
+      !cancelled() && needs.build.result == 'success'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 45
+    name: e2e-host-app-${{ matrix.test_suite }}-tests-${{ matrix.environment }}-bundle
+    env:
+      MB_EDITION: ee
+      DISPLAY: ""
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      PR_NUMBER: ${{ github.event.pull_request.number || '' }}
+      HASH: ${{ github.event.pull_request.head.sha || github.sha }}-${{ github.run_attempt }}
+      CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.MB_ALL_FEATURES_TOKEN }}
+      CYPRESS_IS_EMBEDDING_SDK: true
+      TZ: US/Pacific # to make node match the instance tz
+      CYPRESS_CI: true
+      HOST_APP_ENVIRONMENT: ${{ matrix.environment }}
+    permissions:
+      id-token: write
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Retrieve uberjar artifact for ee
+        uses: actions/download-artifact@v4
+        with:
+          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+
+      - name: Retrieve Embedding SDK dist artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: embedding-sdk-${{ github.event.pull_request.head.sha || github.sha }}
+          path: ${{ github.workspace }}/resources/embedding-sdk
+
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+
+      - name: Prepare Cypress environment
+        id: cypress-prep
+        uses: ./.github/actions/prepare-cypress
+
+      - name: Prepare JDK 21
+        uses: actions/setup-java@v4
+        with:
+          java-version: 21
+          distribution: "temurin"
+
+      - name: Run Metabase
+        run: node e2e/runner/run_cypress_ci.js start
+
+      - name: Generate database snapshots
+        run: node e2e/runner/run_cypress_ci.js snapshot
+
+      - name: Prepare and launch Host App
+        run: npx tsx ./e2e/runner/embedding-sdk/host-apps/start-ci.ts ${{ matrix.test_suite }}
+
+      - name: Run e2e tests for Host App
+        id: run-e2e-tests
+        continue-on-error: true
+        run: node e2e/runner/run_cypress_ci.js ${{ matrix.test_suite }} --browser ${{ steps.cypress-prep.outputs.chrome-path }}
+
+      - name: Upload Cypress Artifacts upon failure
+        uses: actions/upload-artifact@v4
+        if: ${{ steps.run-e2e-tests.outcome != 'success' }}
+        with:
+          name: cypress-recording-host-app-${{ matrix.test_suite }}-${{ matrix.environment }}-latest
+          path: |
+            ./cypress
+          if-no-files-found: ignore
+
+      - name: Fail job if tests failed
+        if: ${{ steps.run-e2e-tests.outcome != 'success' }}
+        run: |
+          exit 1

.github/workflows/e2e-stress-test-flake-fix.yml

@@ -63,8 +63,10 @@ jobs:
       DISPLAY: ""
       QA_DB_ENABLED: ${{ contains(fromJSON('["sql", "mongo"]'), inputs.qa_db) }}
       CYPRESS_QA_DB_MONGO: ${{ inputs.qa_db == 'mongo' }}
-      CYPRESS_ALL_FEATURES_TOKEN: ${{ secrets.ENTERPRISE_TOKEN }}
-      CYPRESS_NO_FEATURES_TOKEN: ${{ secrets.E2E_STARTER_TOKEN }}
+      CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.MB_ALL_FEATURES_TOKEN }}
+      CYPRESS_MB_STARTER_CLOUD_TOKEN: ${{ secrets.MB_STARTER_CLOUD_TOKEN }}
+      CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.MB_PRO_CLOUD_TOKEN }}
+      CYPRESS_MB_PRO_SELF_HOSTED_TOKEN: ${{ secrets.MB_PRO_SELF_HOSTED_TOKEN }}
       MB_SNOWPLOW_AVAILABLE: true
       MB_SNOWPLOW_URL: "http://localhost:9090" # Snowplow micro
       MB_EDITION: ${{ inputs.mb_edition }}
@@ -84,6 +86,7 @@ jobs:
           password: ${{ secrets.DOCKERHUB_TOKEN }}
           maildev: true
           openldap: true
+          snowplow: true
           postgres: ${{ inputs.qa_db == 'sql' }}
           mysql: ${{ inputs.qa_db == 'sql' }}
           mongo: ${{ inputs.qa_db == 'mongo' }}
@@ -103,8 +106,6 @@ jobs:
       - name: Prepare Cypress environment
         id: cypress-prep
         uses: ./.github/actions/prepare-cypress
-      - name: Run Snowplow micro
-        uses: ./.github/actions/run-snowplow-micro
       - name: Run Metabase
         run: node e2e/runner/run_cypress_ci.js start
       - name: Generate database snapshots

.github/workflows/e2e-test.yml

@@ -44,8 +44,10 @@ jobs:
       JOB_NAME: ${{ inputs.name }}
       # Any env starting with `CYPRESS_` will be available to all Cypress tests via `Cypress.env()`
       # Example: you can get `CYPRESS_FOO` with `Cypress.env("FOO")`
-      CYPRESS_ALL_FEATURES_TOKEN: ${{ secrets.ENTERPRISE_TOKEN }}
-      CYPRESS_NO_FEATURES_TOKEN: ${{ secrets.E2E_STARTER_TOKEN }}
+      CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.MB_ALL_FEATURES_TOKEN }}
+      CYPRESS_MB_STARTER_CLOUD_TOKEN: ${{ secrets.MB_STARTER_CLOUD_TOKEN }}
+      CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.MB_PRO_CLOUD_TOKEN }}
+      CYPRESS_MB_PRO_SELF_HOSTED_TOKEN: ${{ secrets.MB_PRO_SELF_HOSTED_TOKEN }}
       CYPRESS_PULL_REQUEST_ID: ${{ github.event.pull_request.number || '' }}
       COMMIT_INFO_MESSAGE: ${{ github.event.pull_request.title || github.event.head_commit.message || github.event.head.sha }}
       MB_EXPERIMENTAL_SEARCH_BLOCK_ON_QUEUE: true
@@ -56,12 +58,6 @@ jobs:
       CYPRESS_CI: true
       CYPRESS_QA_DB_MONGO: ${{ inputs.name == 'mongo' }}
       CYPRESS_IS_EMBEDDING_SDK: ${{ inputs.name == 'embedding-sdk' }}
-      mongo: ${{ inputs.name == 'mongo' }}
-      postgres: ${{ inputs.name != 'mongo' }}
-      mysql: ${{ inputs.name != 'mongo' }}
-      openldap: true
-      maildev: true
-      webhook: true
     steps:
       - uses: actions/checkout@v4
 
@@ -71,11 +67,12 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
           maildev: true
-          openldap: ${{ env.openldap }}
-          postgres: ${{ env.postgres }}
-          mysql: ${{ env.mysql }}
-          mongo: ${{ env.mongo }}
-          webhook: ${{ env.webhook }}
+          openldap: true
+          webhook: true
+          snowplow: true
+          postgres: ${{ inputs.name != 'mongo' }}
+          mysql: ${{ inputs.name != 'mongo' }}
+          mongo: ${{ inputs.name == 'mongo' }}
 
       - name: Run Embedding SDK Storybook
         if: inputs.name == 'embedding-sdk'
@@ -111,9 +108,6 @@ jobs:
         if: github.run_attempt != '1'
         run: echo "specs=$(cat failed-specs)" >> $GITHUB_ENV
 
-      - name: Run Snowplow micro
-        uses: ./.github/actions/run-snowplow-micro
-
       - name: Run Metabase
         run: node e2e/runner/run_cypress_ci.js start
 

.github/workflows/embedding-sdk.yml

@@ -18,8 +18,9 @@ jobs:
     runs-on: ubuntu-22.04
     timeout-minutes: 3
     outputs:
-      documentation: ${{ steps.changes.outputs.documentation }}
+      e2e_embedding_sdk: ${{ steps.changes.outputs.e2e_embedding_sdk }}
       frontend_embedding_sdk_sources: ${{ steps.changes.outputs.frontend_embedding_sdk_sources }}
+      embedding_documentation: ${{ steps.changes.outputs.embedding_documentation }}
     steps:
       - uses: actions/checkout@v4
       - name: Test which files changed
@@ -33,8 +34,9 @@ jobs:
     needs: [files-changed]
     if: |
       !cancelled() &&
-      (needs.files-changed.outputs.frontend_embedding_sdk_sources == 'true' ||
-      needs.files-changed.outputs.documentation == 'true')
+      (needs.files-changed.outputs.e2e_embedding_sdk == 'true' ||
+      needs.files-changed.outputs.frontend_embedding_sdk_sources == 'true' ||
+      needs.files-changed.outputs.embedding_documentation == 'true')
     runs-on: ubuntu-22.04
     timeout-minutes: 25
     steps:
@@ -75,7 +77,7 @@ jobs:
   embedding-sdk-docs-snippets-type-check:
     needs: [files-changed, build]
     if: |
-      needs.files-changed.outputs.documentation == 'true' &&
+      needs.files-changed.outputs.embedding_documentation == 'true' &&
       needs.build.result == 'success'
     runs-on: ubuntu-22.04
     timeout-minutes: 20
@@ -91,7 +93,7 @@ jobs:
       - name: Run frontend embedding SDK snippets type check
         run: yarn run embedding-sdk:docs-snippets:type-check
 
-  embedding-sdk-no-exposed-internal-types-validate:
+  embedding-sdk-api-documentation-generation-validation:
     needs: [files-changed, build]
     if: |
       needs.files-changed.outputs.frontend_embedding_sdk_sources == 'true' &&
@@ -109,23 +111,38 @@ jobs:
         with:
           name: embedding-sdk-${{ github.event.pull_request.head.sha || github.sha }}
           path: ${{ github.workspace }}/resources/embedding-sdk
-      - name: Run no exposed internal types validation
+      - name: Generate documentation to check for generation errors
+        id: docs-generation
+        continue-on-error: true
+        shell: bash
         run: |
-          output="$(yarn embedding-sdk:docs:generate:pure --emit none 2>&1)" || {
-            if [[ "$output" == *"not included in the documentation"* ]]; then
-              echo "$output"
-              exit 1
-            fi
-          }
-      - name: Comment on PR if docs need update
+          set -o pipefail
+          yarn embedding-sdk:docs:generate:pure --emit none 2>&1 \
+          | tee /dev/stdout \
+          | tee >( tail -n 10 \
+          | sed '1s/^/output<<EOF\n/' \
+                   | sed '$aEOF' \
+                   >> "$GITHUB_OUTPUT" )
+          exit ${PIPESTATUS[0]}
+      - name: Comment on PR if 'not included in the documentation' error happens
         uses: ./.github/actions/notify-pull-request
-        if: success() || failure()
         with:
           remove-previous-comment: true
-          add-new-comment: ${{ job.status == 'failure' }}
-          message: "📝 One or more internal Metabase types were accidentally exported from the `@metabase/embedding‑sdk‑react` package in this pull request.<br/><br/>Publishing these types would change the public API and may drastically change generated SDK documentation.<br/><br/>Please update the code so internal types remain private and the public API stays unchanged."
+          add-new-comment: ${{ steps.docs-generation.outcome == 'failure' && contains(steps.docs-generation.outputs.output, 'not included in the documentation') }}
+          message: "📝 Some exported from `@metabase/embedding-sdk-react` types reference other types that are not exported, i.e. internal types.<br><br>The internal type reference breaks API documentation generation for the SDK and also may unexpectedly increase the output size of the type declaration file.<br><br>Please check the CI logs to find the name of such type.<br><br>- If a type should be publicly available in the SDK, add a description to it or a TypeDoc annotation and export it from SDK.<br>- If a type is internal and should _not_ be publicly exposed, refactor types to prevent referencing other types that are not exported from SDK.<br><br>You can run `yarn embedding-sdk:docs:generate` locally to  verify that the issue has been resolved."
           include-log: true
+      - name: Comment on PR if 'Failed to resolve link' error happens
+        uses: ./.github/actions/notify-pull-request
+        with:
+          remove-previous-comment: true
+          add-new-comment: ${{ steps.docs-generation.outcome == 'failure' && contains(steps.docs-generation.outputs.output, 'Failed to resolve link') }}
+          message: "📝 A typedoc `{@link <TYPE_NAME>}` annotation is found that can't be resolved.<br><br>Most likely it happens when the referenced type is not exported. Please check the CI logs to find the name of such type.<br><br>- If a referenced in `{@link}` type should be publicly available in the SDK, add a description to it or a TypeDoc annotation and export it from SDK.<br>- If a type is internal and should _not_ be publicly exposed, change types to prevent unexported type reference in `{@link}` annotation.<br><br>You can run `yarn embedding-sdk:docs:generate` locally to verify that the issue has been resolved."
+          include-log: true
+      - name: Fail Job
+        if: ${{ steps.docs-generation.outcome == 'failure' }}
+        run: exit 1
 
+  # See `Component e2e tests` in `enterprise/frontend/src/embedding-sdk/dev.md`
   sdk-e2e-tests:
     uses: ./.github/workflows/e2e-component-tests-embedding-sdk.yml
     needs: [build]
@@ -134,12 +151,15 @@ jobs:
       cached-embedding-sdk-dist-artifact-name: embedding-sdk-${{ github.event.pull_request.head.sha || github.sha }}
 
   e2e-component-tests-embedding-sdk-cross-version:
-    if: ${{ startsWith(inputs.branch, 'release-x.') }}
+    # run on: every push on release branches, and every pr that targets a release branch
+    if: ${{ startsWith(github.ref, 'refs/heads/release-x.') || (github.event_name == 'pull_request' && startsWith(github.base_ref, 'release-x.')) }}
     uses: ./.github/workflows/e2e-component-tests-embedding-sdk-cross-version.yml
     secrets: inherit
 
+  # See `bin/backward-compatibility-test.js` for the documentation of this workflow.
   cross-version-for-breaking-changes:
-    if: github.event_name == 'pull_request' && startsWith(inputs.branch, 'release-x.')
+    # run on: every pr that targets a release branch, it does NOT run for pr targeting master
+    if: ${{ github.event_name == 'pull_request' && startsWith(github.base_ref, 'release-x.') }}
     uses: ./.github/workflows/e2e-cross-version-for-breaking-changes.yml
     secrets: inherit
     with:
@@ -150,7 +170,7 @@ jobs:
     needs:
       - embedding-sdk-cli-snippets-type-check
       - embedding-sdk-docs-snippets-type-check
-      - embedding-sdk-no-exposed-internal-types-validate
+      - embedding-sdk-api-documentation-generation-validation
       - sdk-e2e-tests
       - e2e-component-tests-embedding-sdk-cross-version
     if: always() && !cancelled()

.github/workflows/frontend.yml

@@ -27,6 +27,13 @@ jobs:
         uses: ./.github/actions/prepare-backend
         with:
           m2-cache-key: "cljs"
+      - name: Restore ESLint cache
+        uses: actions/cache@v4
+        with:
+          path: .eslintcache
+          key: eslintcache-${{ hashFiles('yarn.lock', '.eslintrc.js') }}
+          restore-keys: |
+            eslintcache-
       - name: Compile CLJS
         run: yarn build-pure:cljs
       - name: Find CSS variables that are used but never defined

.github/workflows/pre-release.yml

@@ -103,8 +103,14 @@ jobs:
     env:
       MB_EDITION: ${{ matrix.edition }}
       DISPLAY: ""
-      CYPRESS_ALL_FEATURES_TOKEN: ${{ secrets.ENTERPRISE_TOKEN }}
-      CYPRESS_NO_FEATURES_TOKEN: ${{ secrets.E2E_STARTER_TOKEN }}
+      CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.MB_ALL_FEATURES_TOKEN }}
+      CYPRESS_MB_STARTER_CLOUD_TOKEN: ${{ secrets.MB_STARTER_CLOUD_TOKEN }}
+      CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.MB_PRO_CLOUD_TOKEN }}
+      CYPRESS_MB_PRO_SELF_HOSTED_TOKEN: ${{ secrets.MB_PRO_SELF_HOSTED_TOKEN }}
+      # these are needed for backwards compatibility with release branches earlier than v55, since
+      # this workflow always runs from master, but we run tests from the release branch
+      CYPRESS_ALL_FEATURES_TOKEN: ${{ secrets.MB_ALL_FEATURES_TOKEN }}
+      CYPRESS_NO_FEATURES_TOKEN: ${{ secrets.MB_STARTER_CLOUD_TOKEN }}
       # disabled because of out of memory issues
       # probably related to https://github.com/cypress-io/cypress/issues/27415
       CYPRESS_NO_COMMAND_LOG: 1
@@ -122,6 +128,7 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
           maildev: true
+          snowplow: true
       - name: Prepare front-end environment
         uses: ./.github/actions/prepare-frontend
       - name: Prepare JDK 21
@@ -132,8 +139,6 @@ jobs:
       - name: Prepare Cypress environment
         id: cypress-prep
         uses: ./.github/actions/prepare-cypress
-      - name: Run Snowplow micro
-        uses: ./.github/actions/run-snowplow-micro
       - uses: actions/download-artifact@v4
         name: Retrieve uberjar artifact for ${{ matrix.edition }}
         with:

.github/workflows/release-embedding-sdk.yml

@@ -15,7 +15,8 @@ on:
           - release-x.52.x
           - release-x.53.x
           - release-x.54.x
-          - metabot-v3-main
+          - release-x.55.x
+          - esbuild-main
 
 concurrency:
   # We want to ensure only one job is running at a time per branch because
@@ -392,10 +393,10 @@ jobs:
         run: |
           echo //registry.npmjs.org/:_authToken=${{ secrets.NPM_RELEASE_TOKEN }} > .npmrc
           # Please keep the value in sync with `inputs.branch`'s release branch
-          npm publish --tag ${{fromJson('{"master": "nightly", "release-x.51.x": "51-stable", "release-x.52.x": "52-stable", "release-x.53.x": "53-stable", "release-x.54.x": "54-stable", "metabot-v3-main": "55-metabot"}')[inputs.branch]}}
+          npm publish --tag ${{fromJson('{"master": "nightly", "release-x.51.x": "51-stable", "release-x.52.x": "52-stable", "release-x.53.x": "53-stable", "release-x.54.x": "54-stable", "release-x.55.x": "55-stable", "esbuild-main": "56-esbuild"}')[inputs.branch]}}
 
-      - name: Add `latest` tag to the latest release branch (`release-x.54.x`) deployment
-        if: ${{ inputs.branch == 'release-x.54.x' }}
+      - name: Add `latest` tag to the latest release branch (`release-x.55.x`) deployment
+        if: ${{ inputs.branch == 'release-x.55.x' }}
         working-directory: sdk
         run: |
           npm dist-tag add @metabase/embedding-sdk-react@${{ env.sdk_version }} latest

.github/workflows/release-tag.yml

@@ -250,19 +250,9 @@ jobs:
 
     - name: Tag the docker image
       run: | # sh
-        docker pull $DOCKERHUB_REPO\:$DOCKERHUB_VERSION
-        docker tag $DOCKERHUB_REPO\:$DOCKERHUB_VERSION $DOCKERHUB_REPO\:$TAG_NAME
-        docker image ls $DOCKERHUB_REPO
-
-        SOURCE_ID=$(docker image ls $DOCKERHUB_REPO\:$DOCKERHUB_VERSION -q)
-        TAGGED_ID=$(docker image ls $DOCKERHUB_REPO\:$TAG_NAME -q)
-
-        if [[ $SOURCE_ID != $TAGGED_ID ]]; then
-          echo "Error tagging docker image"
-          exit 1
-        fi
-
-        docker push $DOCKERHUB_REPO\:$TAG_NAME
+        docker buildx imagetools create --tag \
+          $DOCKERHUB_REPO\:$TAG_NAME \
+          $DOCKERHUB_REPO\:$DOCKERHUB_VERSION
 
   push-git-tags:
     permissions: write-all

.github/workflows/run-tests.yml

@@ -71,6 +71,13 @@ jobs:
     with:
       skip: ${{ needs.files-changed.outputs.backend_all != 'true' && needs.static-viz-files-changed.outputs.static_viz != 'true' }}
 
+  app-db-tests:
+    needs: files-changed
+    uses: ./.github/workflows/app-db.yml
+    secrets: inherit
+    with:
+      skip: ${{ needs.files-changed.outputs.backend_all != 'true' }}
+
   driver-tests:
     needs: files-changed
     uses: ./.github/workflows/drivers.yml

.github/workflows/snyk.yml

@@ -29,12 +29,23 @@ jobs:
       - uses: snyk/actions/setup@0.4.0
       - name: Generate all pom.xml
         run: .github/scripts/write-poms.sh
-      - name: Run snyk
+      - name: Run snyk main project
         env:
           SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
         continue-on-error: true
-        run: snyk test --all-projects --sarif-file-output=snyk.sarif
+        run: snyk test --all-projects --exclude="modules" --sarif-file-output=snyk-main.sarif
       - name: Upload result to GitHub Code Scanning
         uses: github/codeql-action/upload-sarif@v3
         with:
-          sarif_file: snyk.sarif
+          sarif_file: snyk-main.sarif
+          category: main-project
+      - name: Run snyk drivers
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        continue-on-error: true
+        run: cd modules && snyk test --all-projects --sarif-file-output=snyk-drivers.sarif
+      - name: Upload result to GitHub Code Scanning
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: modules/snyk-drivers.sarif
+          category: drivers

.github/workflows/translation-update.yml

@@ -43,6 +43,7 @@ jobs:
           command_args: |
             --config locales/crowdin.yml
             -e=el
+            -e=et
             -e=es-MX
             -e=gu-IN
             -e=hr
@@ -108,7 +109,7 @@ jobs:
       - name: Auto approve PR
         uses: juliangruber/approve-pull-request-action@v1
         with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
+          github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
           number: ${{ steps.create_pr.outputs.pr_number }}
 
       - name: Enable Pull Request Automerge

.github/workflows/uberjar.yml

@@ -7,6 +7,7 @@ on:
   push:
     branches:
       - master
+      - metabot-v3-main
       - feature-visualizer
       - internal-tools
     paths-ignore:
@@ -141,6 +142,8 @@ jobs:
       repo: ${{ fromJson(needs.get-container-info.outputs[matrix.edition]).repo }}
       tag: ${{ fromJson(needs.get-container-info.outputs[matrix.edition]).tag }}
       release: "false"
+      build-args: |
+        GIT_COMMIT_SHA=${{ github.event.inputs.commit || github.sha }}
 
   run-trivy:
     needs: [get-container-info, containerize]

.gitignore

@@ -6,6 +6,7 @@
 *.po~
 *.sqlite
 *.trace.db
+*.trace.db.old
 *.xcworkspacedata
 .DS_Store
 .\#*
@@ -35,6 +36,7 @@
 /coverage
 /crate-*
 /cypress
+cypress.env.json
 /deploy/artifacts/*
 /docs/**/node_modules
 /docs/**/package.json
@@ -57,7 +59,10 @@
 /reset-password-artifacts
 /resources/frontend_client/app/dist/
 /resources/frontend_client/app/locales
+/resources/frontend_client/app/embed.js
+/resources/frontend_client/tmp-embed-js/
 /resources/frontend_client/embed.html
+/resources/frontend_client/embed-sdk.html
 /resources/frontend_client/index.html
 /resources/frontend_client/public.html
 /resources/embedding-sdk
@@ -133,8 +138,17 @@ modules/drivers/*/.lsp/*
 
 # jar downloader
 /jars/
+
+# metabot
+llm-payloads
+
 /bin/bb
 
 .aider*
 /config.yml
 CLAUDE.local.md
+.claude/settings.local.json
+
+.eslintcache
+
+/logs