only include tables you can use for native query builder

* Fix some CI issues

* Fix some CI issues

* Fix typecheck issues

* Fix lint

* Fix unit tests

* Fix e2e tests

.clj-kondo/config.edn

@@ -68,6 +68,7 @@
   :metabase/validate-logging                           {:level :warning}
   :metabase/validate-mb-driver-tests                   {:level :warning}
   :metabase/validate-mb-once                           {:level :warning}
+  :metabase/discourage-millis-duration                 {:level :warning}
 
   :metabase/validate-deftest
   {:level :warning
@@ -408,9 +409,10 @@
   clojure.test.check.properties/for-all                                                 clojure.core/let
   clojurewerkz.quartzite.jobs/defjob                                                    clojure.core/defn
   instaparse.core/defparser                                                             clojure.core/def
+  metabase-enterprise.action-v2.test-util/with-test-tables!                             clojure.core/let
   metabase-enterprise.serialization.test-util/with-dbs                                  clojure.core/fn
   metabase-enterprise.serialization.test-util/with-random-dump-dir                      clojure.core/let
-metabase-enterprise.content-translation.routes-test/with-new-secret-key!                clojure.core/fn
+  metabase-enterprise.content-translation.routes-test/with-new-secret-key!              clojure.core/fn
   metabase.actions.test-util/with-actions                                               clojure.core/let
   metabase.api.common/let-404                                                           clojure.core/let
   metabase.app-db.custom-migrations.util/with-temp-scheduler!                           clojure.core/fn
@@ -469,6 +471,7 @@ metabase-enterprise.content-translation.routes-test/with-new-secret-key!
   metabase.test/with-temp-file                                                          clojure.core/let
   metabase.test/with-user-in-groups                                                     clojure.core/let
   metabase.upload.impl-test/with-upload-table!                                          clojure.core/let
+  metabase.util/for-map                                                                 clojure.core/for
   metabase.util.files/with-open-path-to-resource                                        clojure.core/let
   metabase.util.malli.defn/defn                                                         schema.core/defn
   metabase.util.malli.defn/defn-                                                        schema.core/defn
@@ -501,6 +504,7 @@ metabase-enterprise.content-translation.routes-test/with-new-secret-key!
    clojure.core/ns                                                                                                           hooks.clojure.core.ns/lint-ns
    clojure.core/require                                                                                                      hooks.clojure.core.require/lint-require
    clojure.core/requiring-resolve                                                                                            hooks.clojure.core.require/lint-requiring-resolve
+   clojure.core/-                                                                                                            hooks.metabase.util.timing/discourage-millis-duration
    clojure.test/deftest                                                                                                      hooks.clojure.test/deftest
    clojure.test/is                                                                                                           hooks.clojure.test/is
    clojure.test/use-fixtures                                                                                                 hooks.clojure.test/use-fixtures
@@ -525,6 +529,7 @@ metabase-enterprise.content-translation.routes-test/with-new-secret-key!
    metabase.dashboards.models.dashboard-tab-test/with-dashtab-in-personal-collection                                         hooks.common/with-one-top-level-binding
    metabase.dashboards.models.dashboard-test/with-dash-in-collection!                                                        hooks.common/with-three-bindings
    metabase.driver.bigquery-cloud-sdk-test/calculate-bird-scarcity                                                           hooks.metabase.query-processor-test.expressions-test/calculate-bird-scarcity
+   metabase.driver.mongo-test/with-describe-table-for-sample                                                                 hooks.metabase.driver.mongo-test/with-describe-table-for-sample
    metabase.driver.oracle-test/with-temp-user                                                                                hooks.common/let-one-with-optional-value
    metabase.driver/register!                                                                                                 hooks.metabase.driver/register!
    metabase.driver-api/defenterprise                                                                                         hooks.metabase.premium-features.defenterprise/defenterprise
@@ -538,6 +543,7 @@ metabase-enterprise.content-translation.routes-test/with-new-secret-key!
    metabase.lib.schema.mbql-clause/define-tuple-mbql-clause                                                                  hooks.metabase.lib.schema.mbql-clause/define-mbql-clause
    metabase.lib.test-util.macros/$ids                                                                                        hooks.metabase.test.data/$ids
    metabase.lib.test-util.macros/mbql-query                                                                                  hooks.metabase.test.data/mbql-query
+   metabase.lib.test-util.macros/mbql-5-query                                                                                hooks.metabase.test.data/mbql-query
    metabase.lib.test-util.macros/with-testing-against-standard-queries                                                       hooks.metabase.lib.test-util.macros/with-testing-against-standard-queries
    metabase.model-persistence.api-test/with-persistence-setup!                                                               hooks.common/with-one-top-level-binding
    metabase.model-persistence.api-test/with-setup!                                                                           hooks.common/with-one-top-level-binding
@@ -738,6 +744,7 @@ metabase-enterprise.content-translation.routes-test/with-new-secret-key!
   {:linters
    {:metabase/validate-escaped-single-quotes-in-i18n {:level :warning}
     :metabase/validate-string-or-str-args-to-i18n {:level :warning}
+    :metabase/discourage-millis-duration {:level :warning}
     :discouraged-var
     {clojure.core/with-redefs {:message "Don't use with-redefs outside of tests"}
      clojure.core/eval        {:message "Don't use eval outside of tests"}}}}
@@ -806,4 +813,9 @@ metabase-enterprise.content-translation.routes-test/with-new-secret-key!
 
   general-qp-and-driver-test-namespaces
   {:linters
-   {:metabase/disallow-hardcoded-driver-names-in-tests {:level :warning}}}}}
+   {:discouraged-var
+    {metabase.test/with-column-remappings      {:message "Use metabase.lib.test-util/remap-metadata-provider instead of with-column-remappings in QP tests"}
+     metabase.test.util/with-column-remappings {:message "Use metabase.lib.test-util/remap-metadata-provider instead of with-column-remappings in QP tests"}}
+
+    :metabase/disallow-hardcoded-driver-names-in-tests
+    {:level :warning}}}}}

.clj-kondo/src/hooks/metabase/driver/mongo_test.clj

@@ -0,0 +1,18 @@
+(ns hooks.metabase.driver.mongo-test
+  (:require
+   [clj-kondo.hooks-api :as hooks]
+   [hooks.common]))
+
+(defn with-describe-table-for-sample
+  "Forward bindings for results of functions used in mongo's describe-table implementation."
+  [{{[_ _ & body] :children} :node}]
+  (let [node* (hooks/list-node
+               (list*
+                (hooks/token-node 'let)
+                (hooks/vector-node
+                 [(hooks/token-node 'dbfields)      (hooks/token-node '(delay nil))
+                  (hooks/token-node 'ftree)         (hooks/token-node '(delay nil))
+                  (hooks/token-node 'nested-fields) (hooks/token-node '(delay nil))])
+                body))]
+    ;; Avoid warnings when not all from the dbfields, ftree and nested-fields are used.
+    {:node (hooks.common/update-ignored-linters node* conj :unused-binding)}))

.clj-kondo/src/hooks/metabase/settings/models/setting.clj

@@ -139,6 +139,7 @@
      saml-keystore-password
      saml-keystore-path
      saml-user-provisioning-enabled?
+     sdk-iframe-embed-setup-settings
      send-email-on-first-login-from-new-device
      send-new-sso-user-admin-email?
      session-cookie-samesite

.clj-kondo/src/hooks/metabase/util/timing.clj

@@ -0,0 +1,16 @@
+(ns hooks.metabase.util.timing
+  "Custom CLJ Kondo hooks for timing-related linting rules."
+  (:require [clj-kondo.hooks-api :as api]))
+
+(defn discourage-millis-duration
+  "Discourage slow and unreliable duration calculations using System/currentTimeMillis "
+  [{:keys [node]}]
+  (let [sexpr (api/sexpr node)]
+    (when (and (list? sexpr) (= (first sexpr) '-) (>= (count sexpr) 2))
+      (let [first-arg (second sexpr)]
+        (when (= first-arg (list 'System/currentTimeMillis))
+          (api/reg-finding!
+           (assoc (meta node)
+                  :message "Avoid System/currentTimeMillis for calculating durations. Use u/start-timer and u/since-ms for more reliability."
+                  :type :metabase/discourage-millis-duration
+                  :level :warning)))))))

.cljfmt.edn

@@ -152,6 +152,7 @@
   metabase.lib.join/with-join-alias                                                      [[:default]]
   metabase.lib.join/with-join-conditions                                                 [[:default]]
   metabase.lib.test-util.macros/$ids                                                     [[:inner 0]]
+  metabase.lib.test-util.macros/mbql-5-query                                             [[:inner 0]]
   metabase.lib.test-util.macros/mbql-query                                               [[:inner 0]]
   metabase.lib.util.match/match                                                          [[:inner 0]]
   metabase.lib.util.match/match-one                                                      [[:inner 0]]
@@ -284,6 +285,7 @@
   metabase.upload.impl-test/with-upload-table!                                           [[:inner 0]]
   metabase.upload.types/with-currency                                                    [[:default]]
   metabase.upload.types/with-parens                                                      [[:default]]
+  metabase.util/for-map                                                                  [[:block 1]]
   metabase.util.async/cancelable-thread                                                  [[:block 0]]
   metabase.util.date-2/with-time-zone-same-instant                                       [[:default]]
   metabase.util.encryption-test/with-secret-key                                          [[:block 1]]

.eslintrc.js

@@ -1,6 +1,8 @@
 /* eslint-disable import/no-commonjs */
 /* eslint-disable no-undef */
 
+const path = require("path");
+
 // `postcss-modules` lints css modules class names, but it currently crashes
 // eslint on vscode. If you use webstorm or want to run the lint for the cli, you
 // can use this flag to enable it. This is set to true in CI
@@ -155,6 +157,7 @@ module.exports = {
     "import/internal-regex": "^metabase/|^metabase-lib/",
     "import/resolver": {
       webpack: {
+        config: path.resolve(__dirname, "./rspack.main.config.js"),
         typescript: true,
       },
     },
@@ -203,8 +206,9 @@ module.exports = {
         "e2e/**/*",
         "**/tests/*",
         "release/**/*",
-        "webpack.config.js",
         "rspack.config.js",
+        "rspack.main.config.js",
+        "rspack.embedding-sdk-bundle.config.js",
       ],
       rules: {
         "no-color-literals": "off",
@@ -221,8 +225,7 @@ module.exports = {
         "e2e/**/*",
         "**/tests/*",
         "release/**/*",
-        "webpack.config.js",
-        "rspack.config.js",
+        "rspack.main.config.js",
       ],
       rules: {
         "i18next/no-literal-string": "off",
@@ -315,6 +318,12 @@ module.exports = {
         ],
       },
     },
+    {
+      files: ["frontend/src/metabase/query_builder/**/*"],
+      rules: {
+        "import/no-cycle": "error",
+      },
+    },
     {
       files: ["docs/**/snippets/**/*.{ts,tsx,js,jsx}"],
       rules: {
@@ -327,5 +336,11 @@ module.exports = {
         "no-color-literals": "off",
       },
     },
+    {
+      files: ["frontend/build/**/*.js"],
+      rules: {
+        "import/no-commonjs": "off",
+      },
+    },
   ],
 };

.github/CODEOWNERS

@@ -5,7 +5,7 @@ enterprise/frontend/src/embedding-sdk @metabase/embedding
 frontend/src/metabase/embedding-sdk @metabase/embedding
 frontend/src/metabase/public/containers/PublicOrEmbeddedQuestion @metabase/embedding
 frontend/src/metabase/public/containers/PublicOrEmbeddedDashboard @metabase/embedding
-frontend/src/metabase/ui @metabase/core-frontend-admin-webapp
+frontend/src/metabase/ui @metabase/core-frontend-ux-west
 # snowplow/* @metabase/data
 src/metabase/analytics/prometheus.clj @metabase/cloud-ops
 .github @metabase/devexp
@@ -95,8 +95,8 @@ test/metabase/driver/sql_jdbc/actions_test.clj @metabase/core-workflows
 # enterprise/backend/src/metabase_enterprise/upload_management @metabase/core-backend-admin-webapp
 # enterprise/backend/test/metabase_enterprise/upload_management @metabase/core-backend-admin-webapp
 
-src/metabase/actions @metabase/core-backend-admin-webapp
-test/metabase/actions @metabase/core-backend-admin-webapp
+src/metabase/actions @metabase/core-backend-ux-west
+test/metabase/actions @metabase/core-backend-ux-west
 
 # src/metabase/activity_feed @metabase/core-backend-admin-webapp
 # test/metabase/activity_feed @metabase/core-backend-admin-webapp

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -63,7 +63,8 @@ body:
     attributes:
       label: Information about your Metabase installation
       description: |
-        Copy and paste the JSON from `Admin -> Troubleshooting`.
+        For versions >= 56, copy and paste the Diagnostic info from `Admin -> Tools -> Help`.
+        For versions < 56, copy and paste the Diagnostic info from `Admin -> Troubleshooting`.
         _This will be automatically formatted into code, so no need for backticks._
       placeholder: |
         {"browser-info": {

.github/actions/await-port/action.yml

@@ -1,4 +1,5 @@
-name: Wait for localhost port to be ready
+name: await-port
+description: Wait for localhost port to be ready
 
 inputs:
   port:

.github/actions/e2e-prepare-containers/action.yml

@@ -8,7 +8,7 @@ inputs:
     description: DockerHub password/token
     required: true
   maildev:
-    description: Maildev container
+    description: Maildev containers
     required: true
     default: false
   openldap:
@@ -58,6 +58,7 @@ runs:
           $([ ${{ inputs.mysql }} = true ] && echo "mysql-sample") \
           $([ ${{ inputs.mongo }} = true ] && echo "mongo-sample") \
           $([ ${{ inputs.maildev }} = true ] && echo "maildev") \
+          $([ ${{ inputs.maildev }} = true ] && echo "maildev-ssl") \
           $([ ${{ inputs.openldap }} = true ] && echo "ldap") \
           $([ ${{ inputs.webhook }} = true ] && echo "webhook-tester") \
           $([ ${{ inputs.snowplow }} = true ] && echo "snowplow-micro") \
@@ -68,6 +69,11 @@ runs:
           while ! nc -z localhost 1080; do sleep 1; done &&
           while ! nc -z localhost 1025; do sleep 1; done &&
           echo -e "${G}Maildev is up and running!"
+
+          echo -e "${Y}checking maildev-ssl container..." &&
+          while ! nc -z localhost 1081; do sleep 1; done &&
+          while ! nc -z localhost 465; do sleep 1; done &&
+          echo -e "${G}Maildev-ssl is up and running!"
         fi
 
         if ${{ inputs.openldap }}; then

.github/actions/test-driver/action.yml

@@ -1,4 +1,5 @@
 name: Test database driver
+description: Test database driver
 inputs:
   junit-name:
     required: true

.github/actions/upgrade-backend-deps/action.yml

@@ -11,4 +11,7 @@ runs:
       env:
         GITHUB_TOKEN: ${{ inputs.github-token }}
       shell: bash
-      run: bash ${{ github.action_path }}/upgrade-deps.sh
+      run: |
+        git config --global user.email "github-automation@metabase.com"
+        git config --global user.name "Metabase Automation"
+        bash ${{ github.action_path }}/upgrade-deps.sh

.github/actions/upgrade-backend-deps/upgrade-deps.sh

@@ -59,6 +59,11 @@ for upgrade in $UPGRADES; do
 
     # Commit the dependency update, and link to the diff
     git add deps.edn modules
+
+    # Use an email and name that will pass the CLA check:
+    git config --global user.email "github-automation@metabase.com"
+    git config --global user.name "Metabase Automation"
+
     git commit -m ${TITLE} -m ${BODY} --no-verify
     git push -u origin $BRANCH_NAME
 

.github/auto_request_review.yml

@@ -1,17 +0,0 @@
-# The reviewers configuration for the auto_request_review workflow
-# See https://github.com/necojackarc/auto-request-review/tree/master?tab=readme-ov-file#reviewers-configuration
-# for the spec
-
-files:
-  # migrations related files
-  'resources/migrations/**':
-    - team:core-workflows
-  'src/metabase/app_db/custom_migrations.clj':
-    - team:core-workflows
-
-options:
-  ignore_draft: true
-  ignored_keywords:
-    - DO NOT REVIEW
-    - WIP
-  enable_group_assignment: false

.github/copilot-instructions.md

@@ -0,0 +1,52 @@
+# Metabase Developer Assistant Instructions
+
+## Frontend Development
+
+### Repository Structure
+
+```
+frontend/src/
+├── metabase/           # Main application components and pages
+├── metabase-lib/       # Query building and data modeling utilities
+├── metabase-types/     # TypeScript type definitions
+└── metabase/ui/        # Design system components
+
+e2e/                    # Cypress end-to-end tests
+frontend/test/          # Jest unit tests
+```
+
+### Technology Stack
+
+- **Framework**: React 18 with TypeScript
+- **State**: Redux Toolkit
+- **Styling**: CSS Modules (preferred) > Emotion styled-components
+- **UI**: `metabase/ui` components built with Mantine v8
+- **Build**: Rspack (primary), Webpack (legacy)
+- **Testing**: Jest + React Testing Library, Cypress
+
+### Coding Standards
+
+#### Component Preferences
+
+- Prefer `metabase/ui`components over `metabase/common/components`
+- Use `.tsx` for components, `.ts` for utilities
+
+#### Styling
+
+ALWAYS prefer Mantine style props,then CSS modules. DO NOT suggest styled components, they are deprecated.
+
+#### TypeScript Migration
+
+When heavily editing `.js`/`.jsx` files, create a separate PR to convert to TypeScript first, then implement changes.
+
+#### Enterprise Features
+
+Enterprise functionality MUST use the plugin system. It is very important to not expose enterprise code in the OSS version.
+
+#### Testing Requirements
+
+All PRs should include tests. Prefer Unit tests over E2E tests.
+
+#### Localization
+
+All user-facing strings MUST be localized using the ttag library. Localized strings should be complete phrases, do not concatenate a few separately localized strings. You should add context to strings where the meaning of the string might not be obvious in isolation: e.g. "Home" might have different words in some languages depending on whether you're talking about a dwelling or the landing page for a website.

.github/file-paths.yaml

@@ -29,9 +29,9 @@ frontend_configs: &frontend_configs
   - ".eslintrc.js"
   - "postcss.config.js"
   - "rspack.config.js"
-  - "webpack.config.js"
-  - "webpack.embedding-sdk.config.js"
-  - "webpack.static-viz.config.js"
+  - "rspack.main.config.js"
+  - "rspack.embedding-sdk-bundle.config.js"
+  - "rspack.static-viz.config.js"
   - ".nvmrc"
 
 frontend_sources: &frontend_sources
@@ -132,6 +132,7 @@ e2e_embedding_sdk_compatibility:
   - *default
   - *frontend_embedding_sdk_ci
   - *frontend_sources
+  - *backend_sources
   - "e2e/embedding-sdk-host-apps/**"
   - "e2e/runner/embedding-sdk/**"
   - "e2e/test-host-app/**/*.cy.*.{js,ts}"

.github/team.json

@@ -8,22 +8,11 @@
         "romeovs",
         "bshepherdson",
         "metamben",
-        "appleby",
-        "uladzimirdev",
         "wzimrin",
         "ericnormand",
         "galdre"
       ]
     },
-    {
-      "name": "Semantic Layer",
-      "label": ".Team/SemanticLayer",
-      "members": [
-        "kamilmielnik",
-        "lbrdnk",
-        "bronsa"
-      ]
-    },
     {
       "name": "Drivers",
       "label": ".Team/Drivers",
@@ -37,10 +26,10 @@
       "label": ".Team/Embedding",
       "members": [
         "WiNloSt",
-        "oisincoveney",
         "npretto",
         "heypoom",
-        "sanex3339"
+        "sanex3339",
+        "lorem--ipsum"
       ]
     },
     {
@@ -50,35 +39,18 @@
         "qnkhuat",
         "piranha",
         "crisptrutski",
-        "deniskaber",
-        "wotbrew",
         "spalt08",
-        "stasgavrylov"
+        "stasgavrylov",
+        "uladzimirdev",
+        "kulyk",
+        "kamilmielnik"
       ]
     },
     {
       "name": "Admin Webapp",
       "label": ".Team/AdminWebapp",
       "members": [
-        "npfitz",
-        "johnswanson",
-        "rafpaf",
-        "iethree",
-        "nvoxland",
-        "fraserdrops",
-        "edpaget"
-      ]
-    },
-    {
-      "name": "DashViz",
-      "label": ".Team/DashViz",
-      "members": [
-        "alxnddr",
-        "kulyk",
-        "tsplude",
-        "lorem--ipsum",
-        "noahmoss",
-        "bpander"
+        "eliotmetabase"
       ]
     },
     {
@@ -93,20 +65,54 @@
       "name": "Metabot",
       "label": ".Team/Metabot",
       "members": [
+        "appleby",
+        "noahmoss",
         "retro",
         "sloansparger",
-        "somtom"
+        "somtom",
+        "wotbrew",
+        "tsplude",
+        "lbrdnk",
+        "bronsa"
       ]
     },
     {
       "name": "Product Growth",
       "label": ".Team/ProductGrowth",
-      "members": ["nemanjaglumac", "chodorowicz"]
+      "members": [
+        "nemanjaglumac",
+        "chodorowicz",
+        "andsalves"
+      ]
     },
     {
       "name": "Cloud",
       "label": "cloud",
-      "members": []
+      "members": [
+        "filipesilva"
+      ]
+    },
+    {
+      "name": "DashViz",
+      "label": ".Team/DashViz",
+      "members": [
+        "eliotmetabase"
+      ]
+    },
+    {
+      "name": "UX West",
+      "label": ".Team/UXWest",
+      "members": [
+        "eliotmetabase",
+        "npfitz",
+        "johnswanson",
+        "iethree",
+        "nvoxland",
+        "edpaget",
+        "deniskaber",
+        "alxnddr",
+        "bpander"
+      ]
     }
   ]
 }

.github/workflows/auto-request-review.yml

@@ -1,21 +0,0 @@
-# Config is in .github/auto_request_review.yml
-name: Auto Request Review
-
-on:
-  pull_request:
-    types: [opened, ready_for_review, reopened, synchronize]
-
-jobs:
-  auto-request-review:
-    # Don't run on forked repos
-    if: ${{ !github.event.pull_request.head.repo.fork }}
-    permissions:
-      contents: read
-      pull-requests: write
-    name: Auto Request Review
-    runs-on: ubuntu-latest
-    steps:
-      - name: Request review based on files changes and/or groups the author belongs to
-        uses: necojackarc/auto-request-review@v0.13.0
-        with:
-          token: '${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}'

.github/workflows/backport-reminder.yml

@@ -5,6 +5,7 @@ on:
     types: [auto_merge_enabled, review_requested, labeled, unlabeled, synchronize]
     branches:
       - "master"
+  merge_group:
 
 jobs:
   backport-reminder:

.github/workflows/check-backport-script.yml

@@ -3,6 +3,7 @@ name: Prevent backport.sh from being merged
 on:
   pull_request:
     types: [opened, synchronize, reopened]
+  merge_group:
 
 jobs:
   check-backport-script:

.github/workflows/cljs.yml

@@ -40,5 +40,5 @@ jobs:
       uses: ./.github/actions/prepare-backend
       with:
         m2-cache-key: 'cljs'
-    - name: Run Cljs tests for shared/ code
+    - name: Run Cljs tests
       run: yarn run test-cljs

.github/workflows/coverage.yml

@@ -0,0 +1,26 @@
+name: Test coverage
+
+on:
+  schedule:
+    - cron: '40 1 * * *' # every day at 1:40
+
+jobs:
+  fe-test-coverage:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: "cljs"
+      - name: Run frontend unit tests
+        run: yarn run test-unit --silent --coverage
+      - name: Upload coverage to codecov.io
+        uses: codecov/codecov-action@v4
+        with:
+          files: ./coverage/lcov.info
+          flags: front-end
+          token: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/drivers.yml

@@ -21,11 +21,17 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
+      - name: Fetch base branch
+        if: github.event_name == 'pull_request' && github.event.pull_request.base.ref != ''
+        run: |
+          # Fetch the base branch to ensure its history is available for diffing
+          git fetch origin ${{ github.event.pull_request.base.ref }}:${{ github.event.pull_request.base.ref }}
+          # Only run this if it's a pull request and the base ref exists
       - name: Check if tier3 drivers should run
         id: check_team_and_branch
         run: |
           IS_MASTER_OR_RELEASE="${{ github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/heads/release-') }}"
-          HAS_TEAM_LABEL="${{ contains(github.event.pull_request.labels.*.name, '.Team/Drivers') || contains(github.event.pull_request.labels.*.name, '.Team/Querying') || contains(github.event.pull_request.labels.*.name, '.Team/SemanticLayer') }}"
+          HAS_TEAM_LABEL="${{ contains(github.event.pull_request.labels.*.name, '.Team/Drivers') || contains(github.event.pull_request.labels.*.name, '.Team/Querying') || contains(github.event.pull_request.labels.*.name, '.Team/SemanticLayer') || contains(github.event.pull_request.labels.*.name, '.Team/DevEx') }}"
 
 
           echo "Is master or release: ${IS_MASTER_OR_RELEASE}"
@@ -37,8 +43,25 @@ jobs:
             echo "skip=false" >> $GITHUB_OUTPUT
             echo "A relevant team label is present. Tier 3 driver tests will run."
           else
-            echo "skip=true" >> $GITHUB_OUTPUT
-            echo "Not labeled with required team and not merging into master/release. Tier 3 driver tests will be skipped."
+            echo "Checking for changes in relevant folders..."
+            CHANGED_FILES=$(git diff --name-only ${{ github.event.pull_request.base.sha }} ${{ github.sha }})
+
+            # Initialize an empty array to store folders with changes
+            CHANGED_FOLDERS=()
+            for folder in "src/metabase/lib" "src/metabase/query_processor" "modules/drivers"; do
+              if echo "$CHANGED_FILES" | grep -q "$folder"; then
+                CHANGED_FOLDERS+=("$folder")
+              fi
+            done
+
+            if [[ ${#CHANGED_FOLDERS[@]} -gt 0 ]]; then
+              echo "skip=false" >> $GITHUB_OUTPUT
+              echo "Changes detected in the following folders: ${CHANGED_FOLDERS[*]}."
+              echo "Tier 3 driver tests will run."
+            else
+              echo "skip=true" >> $GITHUB_OUTPUT
+              echo "No relevant team label, not merging into master/release, and no changes in relevant folders. Tier 3 driver tests will be skipped."
+            fi
           fi
         shell: bash
   be-tests-athena-ee:
@@ -50,9 +73,11 @@ jobs:
       CI: 'true'
       DRIVERS: athena
       MB_ATHENA_TEST_REGION: us-east-1
+      MB_ATHENA_TEST_REGION_ROUTING: us-east-2
       MB_ATHENA_TEST_ACCESS_KEY: ${{ secrets.MB_ATHENA_TEST_ACCESS_KEY }}
       MB_ATHENA_TEST_SECRET_KEY: ${{ secrets.MB_ATHENA_TEST_SECRET_KEY }}
       MB_ATHENA_TEST_S3_STAGING_DIR: ${{ secrets.MB_ATHENA_TEST_S3_STAGING_DIR }}
+      MB_ATHENA_TEST_S3_STAGING_DIR_ROUTING: ${{ secrets.MB_ATHENA_TEST_S3_STAGING_DIR_ROUTING }}
       # These credentials are used to test the driver when the user does not have the athena:GetTableMetadata permission
       MB_ATHENA_TEST_WITHOUT_GET_TABLE_METADATA_ACCESS_KEY: ${{ secrets.MB_ATHENA_TEST_WITHOUT_GET_TABLE_METADATA_ACCESS_KEY }}
       MB_ATHENA_TEST_WITHOUT_GET_TABLE_METADATA_SECRET_KEY: ${{ secrets.MB_ATHENA_TEST_WITHOUT_GET_TABLE_METADATA_SECRET_KEY }}
@@ -90,6 +115,7 @@ jobs:
       MB_BIGQUERY_TEST_ACCESS_TOKEN: ${{ secrets.MB_BIGQUERY_TEST_ACCESS_TOKEN }}
       MB_BIGQUERY_TEST_REFRESH_TOKEN: ${{ secrets.MB_BIGQUERY_TEST_REFRESH_TOKEN }}
       MB_BIGQUERY_CLOUD_SDK_TEST_SERVICE_ACCOUNT_JSON: ${{ secrets.MB_BIGQUERY_CLOUD_SDK_TEST_SERVICE_ACCOUNT_JSON }}
+      MB_BIGQUERY_CLOUD_SDK_TEST_SERVICE_ACCOUNT_JSON_ROUTING: ${{ secrets.MB_BIGQUERY_CLOUD_SDK_TEST_SERVICE_ACCOUNT_JSON_ROUTING }}
     name: BigQuery
     steps:
     - uses: actions/checkout@v4
@@ -242,6 +268,7 @@ jobs:
       MB_DATABRICKS_TEST_HTTP_PATH: ${{ secrets.MB_DATABRICKS_JDBC_TEST_HTTP_PATH }}
       MB_DATABRICKS_TEST_TOKEN: ${{ secrets.MB_DATABRICKS_JDBC_TEST_TOKEN }}
       MB_DATABRICKS_TEST_CATALOG: 'metabase_ci'
+      MB_DATABRICKS_TEST_CATALOG_ROUTING: 'metabase_routing_catalog'
       MB_DATABRICKS_TEST_CLIENT_ID: ${{ secrets.MB_DATABRICKS_JDBC_TEST_CLIENT_ID }}
       MB_DATABRICKS_TEST_OAUTH_SECRET: ${{ secrets.MB_DATABRICKS_JDBC_TEST_OAUTH_SECRET }}
     name: Databricks
@@ -278,6 +305,7 @@ jobs:
       MB_DATABRICKS_TEST_HTTP_PATH: ${{ secrets.MB_DATABRICKS_JDBC_TEST_HTTP_PATH }}
       MB_DATABRICKS_TEST_TOKEN: ${{ secrets.MB_DATABRICKS_JDBC_TEST_TOKEN }}
       MB_DATABRICKS_TEST_CATALOG: 'metabase_ci'
+      MB_DATABRICKS_TEST_CATALOG_ROUTING: 'metabase_routing_catalog'
       MB_DATABRICKS_TEST_CLIENT_ID: ${{ secrets.MB_DATABRICKS_JDBC_TEST_CLIENT_ID }}
       MB_DATABRICKS_TEST_OAUTH_SECRET: ${{ secrets.MB_DATABRICKS_JDBC_TEST_OAUTH_SECRET }}
     name: Databricks (Multi-Catalog)
@@ -830,6 +858,7 @@ jobs:
       DRIVERS: redshift
       MB_REDSHIFT_TEST_USER: metabase_ci
       MB_REDSHIFT_TEST_DB: testdb
+      MB_REDSHIFT_TEST_DB_ROUTING: dev
       MB_REDSHIFT_TEST_HOST: ${{ secrets.MB_REDSHIFT_TEST_HOST }}
       MB_REDSHIFT_TEST_PASSWORD: ${{ secrets.MB_REDSHIFT_TEST_PASSWORD }}
     name: ${{ matrix.job.name }}
@@ -867,6 +896,10 @@ jobs:
       MB_SNOWFLAKE_TEST_WAREHOUSE: ${{ secrets.MB_SNOWFLAKE_TEST_WAREHOUSE }}
       MB_SNOWFLAKE_TEST_PK_USER: METABASE PK
       MB_SNOWFLAKE_TEST_PK_PRIVATE_KEY: ${{ secrets.MB_SNOWFLAKE_TEST_PK_PRIVATE_KEY }}
+      MB_SNOWFLAKE_TEST_PK_PRIVATE_KEY_2: ${{ secrets.MB_SNOWFLAKE_TEST_PK_PRIVATE_KEY_2 }}
+      MB_SNOWFLAKE_TEST_PK_PUBLIC_KEY: ${{ secrets.MB_SNOWFLAKE_TEST_PK_PUBLIC_KEY }}
+      MB_SNOWFLAKE_TEST_PK_PUBLIC_KEY_2: ${{ secrets.MB_SNOWFLAKE_TEST_PK_PUBLIC_KEY_2 }}
+
       # RSA Role testing:
       MB_SNOWFLAKE_TEST_RSA_ROLE_TEST_DEFAULT_USER: RSA_ROLE_TEST_DEFAULT_USER
       MB_SNOWFLAKE_TEST_RSA_ROLE_TEST_CUSTOM_USER: RSA_ROLE_TEST_CUSTOM_USER

.github/workflows/e2e-component-tests-embedding-sdk-cross-version.yml

@@ -5,7 +5,7 @@ on:
 
 jobs:
   files-changed:
-    name: Check which files changed
+    name: "SDK cross-version E2E > Check which files changed"
     runs-on: ubuntu-22.04
     timeout-minutes: 3
     outputs:
@@ -21,6 +21,7 @@ jobs:
 
   # if this is a test on a release branch, we need to check the build requirements
   get-build-requirements:
+    name: "SDK cross-version E2E > [Backport only] Get build requirements"
     if: |
       !cancelled()
     runs-on: ubuntu-22.04
@@ -54,6 +55,7 @@ jobs:
             };
 
   build:
+    name: "SDK cross-version E2E > Build uberjar"
     needs: [files-changed, get-build-requirements]
     if: |
       !cancelled()
@@ -85,6 +87,7 @@ jobs:
           name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar-cross-version
 
   resolve-sdk-version:
+    name: "SDK cross-version E2E > Resolve SDK version"
     if: |
       !cancelled()
     runs-on: ubuntu-22.04
@@ -117,12 +120,12 @@ jobs:
             };
 
   e2e-tests:
+    name: "SDK cross-version E2E > Run e2e tests"
     needs: [get-build-requirements, build, resolve-sdk-version]
     if: |
       !cancelled() && needs.build.result == 'success'
     runs-on: ubuntu-22.04
     timeout-minutes: 45
-    name: e2e-tests-embedding-sdk
     env:
       MB_EDITION: ee
       DISPLAY: ""
@@ -225,15 +228,3 @@ jobs:
              const summary = formatSummary(results);
 
              await core.summary.addRaw(summary).write();
-
-  e2e-tests-skipped-stub:
-    needs: [e2e-tests]
-    if: |
-      !cancelled() &&
-      needs.e2e-tests.result == 'skipped'
-    runs-on: ubuntu-22.04
-    timeout-minutes: 5
-    name: e2e-component-tests-embedding-sdk-cross-version
-    steps:
-      - run: |
-          echo "Didn't run due to conditional filtering"

.github/workflows/e2e-component-tests-embedding-sdk.yml

@@ -9,7 +9,7 @@ on:
 
 jobs:
   files-changed:
-    name: Check which files changed
+    name: "SDK e2e > Check which files changed"
     runs-on: ubuntu-22.04
     timeout-minutes: 3
     outputs:
@@ -25,6 +25,7 @@ jobs:
 
   # if this is a test on a release branch, we need to check the build requirements
   get-build-requirements:
+    name: "SDK e2e > [Backport only] Get build requirements"
     if: |
       !cancelled() &&
       contains(github.base_ref || github.ref, 'release-x')
@@ -59,6 +60,7 @@ jobs:
             };
 
   build-uberjar:
+    name: "SDK e2e > Build uberjar"
     needs: [files-changed, get-build-requirements]
     if: |
       !cancelled() &&
@@ -90,9 +92,10 @@ jobs:
       - name: Prepare uberjar artifact
         uses: ./.github/actions/prepare-uberjar-artifact
         with:
-          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar-sdk-tests
 
   e2e-tests:
+    name: "SDK e2e > Run e2e tests (React ${{ matrix.react-version }})"
     needs: [get-build-requirements, build-uberjar]
     if: |
       !cancelled() &&
@@ -103,7 +106,6 @@ jobs:
       matrix:
         react-version: [18, 19]
       fail-fast: false
-    name: React ${{ matrix.react-version }}
     env:
       MB_EDITION: ee
       DISPLAY: ""
@@ -114,7 +116,7 @@ jobs:
       CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.MB_PRO_CLOUD_TOKEN }}
       CYPRESS_MB_PRO_SELF_HOSTED_TOKEN: ${{ secrets.MB_PRO_SELF_HOSTED_TOKEN }}
       CYPRESS_PULL_REQUEST_ID: ${{ github.event.pull_request.number || '' }}
-      CYPRESS_IS_EMBEDDING_SDK: true
+      CYPRESS_IS_EMBEDDING_SDK: "true"
       COMMIT_INFO_MESSAGE: ${{ github.event.pull_request.title || github.event.head_commit.message || github.event.head.sha }}
       TZ: US/Pacific # to make node match the instance tz
       CYPRESS_CI: true
@@ -125,7 +127,7 @@ jobs:
       - name: Retrieve uberjar artifact for ee
         uses: actions/download-artifact@v4
         with:
-          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar-sdk-tests
 
       - name: Prepare front-end environment
         uses: ./.github/actions/prepare-frontend
@@ -176,7 +178,7 @@ jobs:
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
-      - name: Upload Cypress Artifacts upon failure
+      - name: "SDK e2e > Upload Cypress Artifacts upon failure"
         uses: actions/upload-artifact@v4
         if: failure()
         with:
@@ -186,7 +188,7 @@ jobs:
             ./logs/test.log
           if-no-files-found: ignore
 
-      - name: Publish Summary
+      - name: "SDK e2e > Publish Summary"
         if: failure()
         uses: actions/github-script@v7
         with:

.github/workflows/e2e-cross-version-for-breaking-changes.yml

@@ -1,4 +1,4 @@
-name: E2E Cross-version Tests
+name: E2E cross-version for breaking changes
 
 # See `bin/backward-compatibility-test.js` for the documentation of this workflow.
 
@@ -38,6 +38,7 @@ on:
 
 jobs:
   generate-matrix:
+    name: "Breaking changes E2E > Generate matrix"
     runs-on: ubuntu-latest
     outputs:
       matrix_json: ${{ steps.set_matrix.outputs.matrix_json }}
@@ -62,6 +63,7 @@ jobs:
           TOTAL_SHARDS_INPUT: ${{ inputs.total-shards }}
 
   build-jar:
+    name: "Breaking changes E2E > Build jar"
     runs-on: ubuntu-22.04
     timeout-minutes: 45
 
@@ -98,6 +100,7 @@ jobs:
           if-no-files-found: error
 
   run-breaking-changes-tests:
+    name: "Breaking changes E2E > Run breaking changes tests"
     needs: [build-jar, generate-matrix]
     runs-on: ubuntu-22.04
     timeout-minutes: 45

.github/workflows/e2e-embedding-sdk-compatibility-tests.yml

@@ -1,4 +1,4 @@
-name: E2E Embedding SDK Compatibility tests
+name: "[NOT REQUIRED] SDK Compatibility tests"
 
 on:
   push:
@@ -215,7 +215,7 @@ jobs:
       PR_NUMBER: ${{ github.event.pull_request.number || '' }}
       HASH: ${{ github.event.pull_request.head.sha || github.sha }}-${{ github.run_attempt }}
       CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.MB_ALL_FEATURES_TOKEN }}
-      CYPRESS_IS_EMBEDDING_SDK: true
+      CYPRESS_IS_EMBEDDING_SDK: "true"
       TZ: US/Pacific # to make node match the instance tz
       CYPRESS_CI: true
       SAMPLE_APP_BRANCH_NAME: ${{ needs.get-sample-apps-data.outputs.branch_name }}
@@ -322,16 +322,17 @@ jobs:
   # The job is not required, though if it's failing better to be sure that it's not caused by a breaking change.
   # For more details see `Embedding SDK integration tests with Host Apps` in `enterprise/frontend/src/embedding-sdk/dev.md`
   e2e-host-apps-tests:
-    needs: [ get-build-requirements, build ]
+    needs: [get-build-requirements, build]
     strategy:
       matrix:
-        test_suite: [
-          "vite-6-host-app-e2e",
-          "next-15-app-router-host-app-e2e",
-          "next-15-pages-router-host-app-e2e",
-          "angular-20-host-app-e2e",
-        ]
-        environment: [ "production", "development" ]
+        test_suite:
+          [
+            "vite-6-host-app-e2e",
+            "next-15-app-router-host-app-e2e",
+            "next-15-pages-router-host-app-e2e",
+            "angular-20-host-app-e2e",
+          ]
+        environment: ["production", "development"]
     if: |
       !cancelled() && needs.build.result == 'success'
     runs-on: ubuntu-22.04
@@ -344,7 +345,7 @@ jobs:
       PR_NUMBER: ${{ github.event.pull_request.number || '' }}
       HASH: ${{ github.event.pull_request.head.sha || github.sha }}-${{ github.run_attempt }}
       CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.MB_ALL_FEATURES_TOKEN }}
-      CYPRESS_IS_EMBEDDING_SDK: true
+      CYPRESS_IS_EMBEDDING_SDK: "true"
       TZ: US/Pacific # to make node match the instance tz
       CYPRESS_CI: true
       HOST_APP_ENVIRONMENT: ${{ matrix.environment }}

.github/workflows/e2e-test.yml

@@ -57,7 +57,7 @@ jobs:
       TZ: US/Pacific # to make node match the instance tz
       CYPRESS_CI: true
       CYPRESS_QA_DB_MONGO: ${{ inputs.name == 'mongo' }}
-      CYPRESS_IS_EMBEDDING_SDK: ${{ inputs.name == 'embedding-sdk' }}
+      CYPRESS_IS_EMBEDDING_SDK: "${{ inputs.name == 'embedding-sdk' }}"
     steps:
       - uses: actions/checkout@v4
 

.github/workflows/e2e-tests.yml

@@ -22,72 +22,6 @@ jobs:
       chunks: 50
       specs: ${{ inputs.specs }}
 
-  # if this is a test on a release branch, we need to check the build requirements
-  get-build-requirements:
-    if: |
-      !cancelled() &&
-      contains(github.ref, 'release-x')
-    runs-on: ubuntu-22.04
-    timeout-minutes: 10
-    outputs:
-      java_version: ${{ fromJson(steps.dependencies.outputs.result).java_version }}
-      node_version: ${{ fromJson(steps.dependencies.outputs.result).node_version }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          sparse-checkout: release
-      - name: Prepare build scripts
-        run: cd ${{ github.workspace }}/release && yarn && yarn build
-      - name: Get build dependencies
-        uses: actions/github-script@v7
-        id: dependencies
-        with:
-          script: | # js
-            const { getBuildRequirements, getVersionFromReleaseBranch } = require('${{ github.workspace }}/release/dist/index.cjs');
-
-            const version = getVersionFromReleaseBranch('${{ github.ref }}');
-            const requirements = getBuildRequirements(version);
-
-            return {
-              java_version: requirements.java,
-              node_version: requirements.node,
-            };
-
-  build:
-    needs: [get-build-requirements]
-    if: ${{ !cancelled() && !inputs.skip }}
-    runs-on: ubuntu-22.04
-    timeout-minutes: 15
-    strategy:
-      matrix:
-        edition: [oss, ee]
-    env:
-      MB_EDITION: ${{ matrix.edition }}
-      INTERACTIVE: false
-      # make sure that builds on release branches get licenses, because we use them for releases
-      SKIP_LICENSES: ${{ github.event_name == 'pull_request' }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-        with:
-          node-version: "${{ needs.get-build-requirements.outputs.node_version }}"
-      - name: Prepare back-end environment
-        uses: ./.github/actions/prepare-backend
-        with:
-          m2-cache-key: uberjar
-          java-version: "${{ needs.get-build-requirements.outputs.java_version || 21 }}"
-
-      - name: Build uberjar with ./bin/build.sh
-        timeout-minutes: 10
-        run: ./bin/build.sh
-        shell: bash
-
-      - name: Prepare uberjar artifact
-        uses: ./.github/actions/prepare-uberjar-artifact
-        with:
-          name: metabase-${{ matrix.edition }}-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
-
   reset-e2e-test-comment:
     if: ${{ github.event_name == 'pull_request' }}
     runs-on: ubuntu-latest
@@ -124,9 +58,8 @@ jobs:
     uses: ./.github/workflows/e2e-test.yml
     needs:
       - e2e-matrix-builder
-      - build
     if: |
-      !cancelled() && needs.build.result == 'success'
+      !cancelled() && !inputs.skip
     strategy:
       fail-fast: false
       matrix: ${{ fromJson(needs.e2e-matrix-builder.outputs.matrix) }}
@@ -145,11 +78,10 @@ jobs:
     name: Flaky e2e Tests
     uses: ./.github/workflows/e2e-test.yml
     needs:
-      - build
       - e2e-matrix-builder
     # skip flaky test run if only e2e specs changed as an optimization
     if: |
-      !cancelled() && needs.build.result == 'success' && needs.e2e-matrix-builder.outputs.isDefaultSpecPattern == 'true'
+      !cancelled() && !inputs.skip && needs.e2e-matrix-builder.outputs.isDefaultSpecPattern == 'true'
     secrets: inherit
     with:
       name: Flaky
@@ -181,11 +113,3 @@ jobs:
             echo "E2E Tests failed"
             exit 1
           fi
-
-  pr-env:
-    needs: [build]
-    if: |
-      !cancelled() &&
-      contains(github.event.pull_request.labels.*.name, 'PR-Env')
-    uses: ./.github/workflows/pr-env.yml
-    secrets: inherit

.github/workflows/embedding-sdk.yml

@@ -1,12 +1,7 @@
-name: Embedding SDK
+name: SDK
 
 on:
-  push:
-    branches:
-      - "master"
-      - "release-**"
-  pull_request:
-    types: [opened, synchronize, reopened]
+  workflow_call:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
@@ -129,7 +124,7 @@ jobs:
         with:
           remove-previous-comment: true
           add-new-comment: ${{ steps.docs-generation.outcome == 'failure' && contains(steps.docs-generation.outputs.output, 'not included in the documentation') }}
-          message: "📝 Some exported from `@metabase/embedding-sdk-react` types reference other types that are not exported, i.e. internal types.<br><br>The internal type reference breaks API documentation generation for the SDK and also may unexpectedly increase the output size of the type declaration file.<br><br>Please check the CI logs to find the name of such type.<br><br>- If a type should be publicly available in the SDK, add a description to it or a TypeDoc annotation and export it from SDK.<br>- If a type is internal and should _not_ be publicly exposed, refactor types to prevent referencing other types that are not exported from SDK.<br><br>You can run `yarn embedding-sdk:docs:generate` locally to  verify that the issue has been resolved."
+          message: "📝 Some exported types from `@metabase/embedding-sdk-react` reference other types that are not exported, i.e. internal types.<br><br>The internal type reference breaks API documentation generation for the SDK and also may unexpectedly increase the output size of the type declaration file.<br><br>Please check the CI logs to find the name of such type.<br><br>- If a type should be publicly available in the SDK, add a description to it or a TypeDoc annotation and export it from SDK.<br>- If a type is internal and should _not_ be publicly exposed, refactor types to prevent referencing other types that are not exported from SDK.<br><br>You can run `yarn embedding-sdk:docs:generate` locally to  verify that the issue has been resolved."
           include-log: true
       - name: Comment on PR if 'Failed to resolve link' error happens
         uses: ./.github/actions/notify-pull-request
@@ -144,6 +139,7 @@ jobs:
 
   # See `Component e2e tests` in `enterprise/frontend/src/embedding-sdk/dev.md`
   sdk-e2e-tests:
+    name: "SDK e2e tests"
     uses: ./.github/workflows/e2e-component-tests-embedding-sdk.yml
     needs: [build]
     secrets: inherit
@@ -151,20 +147,23 @@ jobs:
       cached-embedding-sdk-dist-artifact-name: embedding-sdk-${{ github.event.pull_request.head.sha || github.sha }}
 
   e2e-component-tests-embedding-sdk-cross-version:
+    name: "[Backport only] SDK e2e cross version tests"
     # run on: every push on release branches, and every pr that targets a release branch
     if: ${{ startsWith(github.ref, 'refs/heads/release-x.') || (github.event_name == 'pull_request' && startsWith(github.base_ref, 'release-x.')) }}
     uses: ./.github/workflows/e2e-component-tests-embedding-sdk-cross-version.yml
     secrets: inherit
 
+  # Temporarily skipped because the cypress runner crashes
   # See `bin/backward-compatibility-test.js` for the documentation of this workflow.
-  cross-version-for-breaking-changes:
-    # run on: every pr that targets a release branch, it does NOT run for pr targeting master
-    if: ${{ github.event_name == 'pull_request' && startsWith(github.base_ref, 'release-x.') }}
-    uses: ./.github/workflows/e2e-cross-version-for-breaking-changes.yml
-    secrets: inherit
-    with:
-      fe-ref: ${{ github.base_ref }}
-      be-ref: ${{ github.head_ref }}
+  # cross-version-for-breaking-changes:
+  # name: "[NOT REQUIRED - Experimental - Backport only] detect breaking changes with cross versions tests"
+  #   # run on: every pr that targets a release branch, it does NOT run for pr targeting master
+  #   if: ${{ github.event_name == 'pull_request' && startsWith(github.base_ref, 'release-x.') }}
+  #   uses: ./.github/workflows/e2e-cross-version-for-breaking-changes.yml
+  #   secrets: inherit
+  #   with:
+  #     fe-ref: ${{ github.base_ref }}
+  #     be-ref: ${{ github.head_ref }}
 
   embedding-sdk-tests-result:
     needs:

.github/workflows/frontend.yml

@@ -9,6 +9,16 @@ on:
       skip-lint:
         type: boolean
         default: false
+  workflow_dispatch:
+    inputs:
+      skip:
+        description: "Skip main frontend jobs (type-check, unit tests, timezone tests)"
+        type: boolean
+        default: false
+      skip-lint:
+        description: "Skip linting jobs (prettier, eslint, css variables check)"
+        type: boolean
+        default: false
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}-frontend
@@ -63,8 +73,13 @@ jobs:
   fe-tests-unit:
     if: ${{ !inputs.skip }}
     runs-on: ubuntu-22.04
-    timeout-minutes: 60
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [1, 2] # 2 shards for parallel execution
     env:
+      SHARDS: 2 # should match matrix above
       JEST_JUNIT_OUTPUT_DIR: ./target/junit
       JEST_JUNIT_OUTPUT_NAME: test-report-frontend-unit.xml
     steps:
@@ -75,22 +90,11 @@ jobs:
         uses: ./.github/actions/prepare-backend
         with:
           m2-cache-key: "cljs"
-      - name: Run frontend unit tests and collect the code coverage information
-        if: github.ref_name == 'master'
-        run: yarn run test-unit --coverage --silent
       - name: Run frontend unit tests
-        if: github.ref_name != 'master'
-        run: yarn run test-unit --silent
-      - name: Upload coverage to codecov.io
-        if: github.ref_name == 'master'
-        uses: codecov/codecov-action@v4
-        with:
-          files: ./coverage/lcov.info
-          flags: front-end
-          token: ${{ secrets.CODECOV_TOKEN }}
+        run: yarn run test-unit --silent --shard=${{ matrix.shard }}/${{ env.SHARDS }}
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
-        if: always()
+        if: always() && github.event_name != 'workflow_dispatch'
         with:
           input-path: ./target/junit
           output-name: frontend-unit

.github/workflows/fuzzing.yml

@@ -7,10 +7,10 @@ on:
       - "master"
       - "release-**"
     paths:
-      - "frontend/src/metabase-lib/expressions/**"
+      - "frontend/src/metabase/querying/expressions/**"
   pull_request:
     paths:
-      - "frontend/src/metabase-lib/expressions/**"
+      - "frontend/src/metabase/querying/expressions/**"
 
 jobs:
   fe-fuzz-lexifier:
@@ -24,7 +24,7 @@ jobs:
         uses: ./.github/actions/prepare-backend
         with:
           m2-cache-key: "cljs"
-      - run: yarn test-unit frontend/src/metabase-lib/v1/expressions/pratt/fuzz.lexifier.unit.spec.ts
+      - run: yarn test-unit frontend/src/metabase/querying/expressions/pratt/fuzz.lexifier.unit.spec.ts
         env:
           MB_FUZZ: 1
         name: Run fuzz testing on the lexifier
@@ -40,7 +40,7 @@ jobs:
         uses: ./.github/actions/prepare-backend
         with:
           m2-cache-key: "cljs"
-      - run: yarn test-unit frontend/src/metabase-lib/v1/expressions/fuzz.compiler.unit.spec.ts
+      - run: yarn test-unit frontend/src/metabase/querying/expressions/fuzz.compiler.unit.spec.ts
         env:
           MB_FUZZ: 1
         name: Run fuzz testing on the custom expression compiler
@@ -56,7 +56,7 @@ jobs:
         uses: ./.github/actions/prepare-backend
         with:
           m2-cache-key: "cljs"
-      - run: yarn test-unit frontend/src/metabase-lib/v1/expressions/fuzz.string.unit.spec.ts
+      - run: yarn test-unit frontend/src/metabase/querying/expressions/fuzz.string.unit.spec.ts
         env:
           MB_FUZZ: 1
         name: Run fuzz testing on the custom expression string quoter

.github/workflows/loki.yml

@@ -1,6 +1,8 @@
 name: Loki Visual Regression Testing
 
-on: [pull_request]
+on:
+  pull_request:
+  merge_group:
 
 jobs:
   files-changed:

.github/workflows/optimize-images.yml

@@ -0,0 +1,133 @@
+name: Auto-Optimize Docs PNG Images
+
+on:
+  pull_request:
+    types:
+      - labeled
+
+jobs:
+  optimize-images:
+    runs-on: ubuntu-latest
+    if: ${{ contains(github.event.pull_request.labels.*.name,'Type:Documentation') }}
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+      with:
+        ref: ${{ github.head_ref }}
+        token: ${{ secrets.GITHUB_TOKEN }}
+
+    - name: Install pngcrush and bc
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y pngcrush bc
+
+    - name: Get changed PNG files
+      id: changed-files
+      uses: tj-actions/changed-files@ed68ef82c095e0d48ec87eccea555d944a631a4c # v46
+      with:
+        files: |
+          docs/**/*.png
+
+    - name: Optimize changed PNG files
+      if: steps.changed-files.outputs.any_changed == 'true'
+      id: optimize
+      run: |
+        echo "Optimizing new PNG files with pngcrush..."
+        echo "Branch: $(git_current_branch)"
+
+        # Initialize tracking variables
+        total_files=0
+        total_before=0
+        total_after=0
+
+        for file in ${{ steps.changed-files.outputs.all_changed_files }}; do
+          echo "Processing: $file"
+          before_size=$(stat -c%s "$file")
+
+          # Use pngcrush with maximum lossless compression settings
+          # -rem alla removes all ancillary chunks (metadata)
+          # -brute tries all filter types and compression levels
+          # -ow overwrites the original file
+          pngcrush -rem alla -brute -ow "$file"
+
+          after_size=$(stat -c%s "$file")
+          echo "  > Before: ${before_size} bytes, After: ${after_size} bytes"
+
+          # Track totals
+          total_files=$((total_files + 1))
+          total_before=$((total_before + before_size))
+          total_after=$((total_after + after_size))
+        done
+
+        # Calculate savings
+        total_saved=$((total_before - total_after))
+
+        # Output results for use in commit message
+        echo "files_optimized=${total_files}" >> "$GITHUB_OUTPUT"
+        echo "bytes_saved=${total_saved}" >> "$GITHUB_OUTPUT"
+        echo "total_before=${total_before}" >> "$GITHUB_OUTPUT"
+        echo "total_after=${total_after}" >> "$GITHUB_OUTPUT"
+
+        echo "Optimization complete"
+        echo "Files processed: ${total_files}"
+        echo "Total bytes saved: ${total_saved} (${total_before} -> ${total_after})"
+
+    - name: Check for changes after optimization
+      if: steps.changed-files.outputs.any_changed == 'true'
+      id: check_changes
+      run: |
+        git add ${{ steps.changed-files.outputs.all_changed_files }}
+        if git diff --quiet --cached; then
+          echo "has_changes=false" >> "$GITHUB_OUTPUT"
+          echo "No changes detected after optimization"
+        else
+          echo "has_changes=true" >> "$GITHUB_OUTPUT"
+          echo "Changes detected after optimization"
+          git diff --cached --stat
+        fi
+
+    - name: Commit optimized images
+      if: steps.changed-files.outputs.any_changed == 'true' && steps.check_changes.outputs.has_changes == 'true'
+      env:
+        GITHUB_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+      run: |
+        git config --global user.email "github-automation@metabase.com"
+        git config --global user.name "Metabase Automation"
+        git add docs/**/*.png
+
+        # Format bytes saved for human readability
+        bytes_saved="${{ steps.optimize.outputs.bytes_saved }}"
+        bytes_before="${{ steps.optimize.outputs.total_before }}"
+        if [ "$bytes_saved" -gt 1048576 ]; then
+          # Convert to MB
+          size_saved=$(echo "scale=1; $bytes_saved / 1048576" | bc)
+          size_unit="MB"
+        elif [ "$bytes_saved" -gt 1024 ]; then
+          # Convert to KB
+          size_saved=$(echo "scale=1; $bytes_saved / 1024" | bc)
+          size_unit="KB"
+        else
+          size_saved="$bytes_saved"
+          size_unit="bytes"
+        fi
+
+        # Calculate percentage reduction
+        if [ "$bytes_before" -gt 0 ]; then
+          percentage=$(echo "scale=1; $bytes_saved * 100 / $bytes_before" | bc)
+          git commit -m "Optimized ${{ steps.optimize.outputs.files_optimized }} images, saved ${size_saved} ${size_unit} (${percentage}% smaller)"
+        else
+          git commit -m "Optimized ${{ steps.optimize.outputs.files_optimized }} images, saved ${size_saved} ${size_unit}"
+        fi
+        git push
+        echo 'Files optimized:'
+        echo ${{ steps.changed-files.outputs.all_changed_files }}
+        echo 'Applied: pngcrush -rem alla -brute -ow'
+
+    - name: Output summary
+      if: steps.changed-files.outputs.any_changed == 'true'
+      run: |
+        if [ "${{ steps.check_changes.outputs.has_changes }}" = "false" ]; then
+          echo "PNG files were already optimized - no changes needed"
+        else
+          echo "PNG files optimized and committed successfully"
+        fi

.github/workflows/pr-env-labeled.yml

@@ -9,9 +9,13 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  uberjar:
+    if: ${{ github.event.label.name == 'PR-Env' }}
+    uses: ./.github/workflows/uberjar.yml
+    secrets: inherit
+
   pr-env:
+    needs: [uberjar]
     if: ${{ github.event.label.name == 'PR-Env' }}
     uses: ./.github/workflows/pr-env.yml
-    with:
-      wait_for_uberjar: true
     secrets: inherit

.github/workflows/pr-env.yml

@@ -3,11 +3,6 @@ run-name: Building Dynamic PR Environment for ${{ github.ref_name }} by @${{ git
 
 on:
   workflow_call:
-    inputs:
-      wait_for_uberjar:
-        description: "Wait for uberjar build"
-        required: false
-        type: boolean
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -31,69 +26,10 @@ jobs:
         uses: aws-actions/amazon-ecr-login@v2
         with:
           registries: "${{ secrets.PR_ENV_AWS_ACCOUNT_ID }}"
-      - name: Wait for uberjar
-        id: wait_for_uberjar
-        if: ${{ inputs.wait_for_uberjar == true }}
-        run: |
-          ## Get workflow run id for uberjar build
-          curl -Ls --output e2e-tests.json \
-          -H "Accept: application/vnd.github+json" \
-          -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
-          -H "X-GitHub-Api-Version: 2022-11-28" \
-          https://api.github.com/repos/${{ github.repository }}/actions/workflows/run-tests.yml/runs?head_sha=${{ github.event.pull_request.head.sha || github.sha }}
-          ID=$(jq -r '.workflow_runs[0].id' e2e-tests.json)
-          echo "Run ID: ${ID}"
-
-          ## Get workflow run id for uberjar build
-          while [ -z "$JOB_ID" ]; do
-            NEXT_URL="https://api.github.com/repos/${{ github.repository }}/actions/runs/${ID}/jobs?filter=latest"
-
-            # Search for build job
-            echo "Searching for build job..."
-            while [ -z "$JOB_ID" ] && [ -n "$NEXT_URL" ]; do
-              # Get one page of jobs
-              RESPONSE=$(curl -s -i \
-                -H "Accept: application/vnd.github+json" \
-                -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
-                -H "X-GitHub-Api-Version: 2022-11-28" \
-                "$NEXT_URL")
-
-              # Extract headers and body
-              HEADERS=$(echo "$RESPONSE" | sed -n '1,/^\r$/p')
-              BODY=$(echo "$RESPONSE" | sed '1,/^\r$/d')
-              LINK_HEADER=$(echo "$HEADERS" | grep -i '^link:' | sed 's/^link: //')
-
-              # Check for next page in Link header
-              if echo "$LINK_HEADER" | grep -q 'rel="next"'; then
-                NEXT_URL=$(echo "$LINK_HEADER" | sed -E 's/.*<([^>]+)>; rel="next".*/\1/')
-              else
-                NEXT_URL=""
-              fi
-
-              # Check for build job
-              JOB_ID=$(echo "$BODY" | jq -r '.jobs[] | select(.name | contains("build (ee)")) | .id')
-            done
-          done
-          echo "Job ID: ${JOB_ID}"
-
-          ## Wait for uberjar build to complete
-          while [ true ]; do
-            curl -Ls --output uberjar.json \
-            -H "Accept: application/vnd.github+json" \
-            -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
-            -H "X-GitHub-Api-Version: 2022-11-28" \
-            https://api.github.com/repos/${{ github.repository }}/actions/jobs/${JOB_ID}
-            jq -r '.steps[] | select(.name == "Prepare uberjar artifact") | .status' uberjar.json | grep -q "completed" && break
-            echo "Waiting for uberjar build..."
-            sleep 10
-          done
-          echo "run_id=$(jq -r '.workflow_runs[0].id' e2e-tests.json)" >> $GITHUB_OUTPUT
       - name: Retrieve uberjar artifact for ee
         uses: actions/download-artifact@v4
         with:
           name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          run-id: ${{ inputs.wait_for_uberjar && steps.wait_for_uberjar.outputs.run_id || github.run_id }}
       - name: Move uberjar to bin/docker
         run: |
           jar xf target/uberjar/metabase.jar
@@ -107,7 +43,7 @@ jobs:
           tags: ${{ secrets.PR_ENV_AWS_ACCOUNT_ID }}.dkr.ecr.us-east-1.amazonaws.com/metabase-enterprise:pr${{ github.event.number }}
           push: true
   deploy_pr:
-    needs: [ build ]
+    needs: [build]
     runs-on: ubuntu-latest
     name: PR Review ENV
     permissions:
@@ -191,7 +127,7 @@ jobs:
           kubectl apply -f ./metabase.yml
   preview_links:
     runs-on: ubuntu-latest
-    needs: [ deploy_pr ]
+    needs: [deploy_pr]
     steps:
       - uses: marocchino/sticky-pull-request-comment@v2
         with:

.github/workflows/release-embedding-sdk.yml

@@ -16,6 +16,7 @@ on:
           - release-x.53.x
           - release-x.54.x
           - release-x.55.x
+          - release-x.56.x
           - esbuild-main
 
 concurrency:
@@ -393,10 +394,19 @@ jobs:
         run: |
           echo //registry.npmjs.org/:_authToken=${{ secrets.NPM_RELEASE_TOKEN }} > .npmrc
           # Please keep the value in sync with `inputs.branch`'s release branch
-          npm publish --tag ${{fromJson('{"master": "nightly", "release-x.51.x": "51-stable", "release-x.52.x": "52-stable", "release-x.53.x": "53-stable", "release-x.54.x": "54-stable", "release-x.55.x": "55-stable", "esbuild-main": "56-esbuild"}')[inputs.branch]}}
+          npm publish --tag ${{fromJson('{
+           "master": "nightly",
+           "release-x.51.x": "51-stable",
+           "release-x.52.x": "52-stable",
+           "release-x.53.x": "53-stable",
+           "release-x.54.x": "54-stable",
+           "release-x.55.x": "55-stable",
+           "release-x.56.x": "56-stable",
+           "esbuild-main": "56-esbuild"
+           }')[inputs.branch]}}
 
       - name: Add `latest` tag to the latest release branch (`release-x.55.x`) deployment
-        if: ${{ inputs.branch == 'release-x.55.x' }}
+        if: ${{ inputs.branch == 'release-x.56.x' }}
         working-directory: sdk
         run: |
           npm dist-tag add @metabase/embedding-sdk-react@${{ env.sdk_version }} latest

.github/workflows/release-log.yml

@@ -7,9 +7,7 @@ on:
       - release-x.*
     tags:
       - v*
-      - nightly-*
       - latest-*
-      - beta-*
   workflow_dispatch:
     inputs:
       version:

.github/workflows/release-notes-preview.yml

@@ -34,18 +34,23 @@ jobs:
         AWS_S3_DOWNLOADS_BUCKET: test_bucket
       with:
         script: | # js
-          const { getChangelog } = require('${{ github.workspace }}/release/dist/index.cjs');
+          const R = require('${{ github.workspace }}/release/dist/index.cjs');
           const fs = require('fs');
 
           const version = '${{ inputs.version }}';
 
-          const notes = await getChangelog({
+          const issues = await R.getMilestoneIssues({
             version,
             github,
             owner: context.repo.owner,
             repo: context.repo.repo,
           });
 
+          const notes = R.getWebsiteChangelog({
+            version,
+            issues,
+          });
+
           fs.writeFileSync(`release-notes-preview-${version}.md`, notes);
     - name: Upload Release Notes
       uses: actions/upload-artifact@v4

.github/workflows/release-tag.yml

@@ -12,8 +12,6 @@ on:
         description: Tag name to apply to this release
         type: choice
         options:
-          - nightly
-          - beta
           - latest
         required: true
       tag_rollout:
@@ -36,8 +34,6 @@ on:
       tag_name:
         type: string
         # options:
-        #   - nightly
-        #   - beta
         #   - latest
         #   - none (skips everything)
         required: true
@@ -270,7 +266,7 @@ jobs:
         token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
         fetch-depth: 0 # we want all branches and tags
         fetch-tags: true
-    - name: Add and push git tag for nightly/beta/latest
+    - name: Add and push git tag for latest
       if: ${{ !inputs.dot-x-tag }}
       run: | # sh
         if [[ "${{ matrix.edition }}" == "ee" ]]; then

.github/workflows/release.yml

@@ -17,8 +17,6 @@ on:
         options:
           - none
           - latest
-          - beta
-          - nightly
         required: true
         default: 'none'
       auto:
@@ -41,8 +39,6 @@ on:
         # options:
         #   - none
         #   - latest
-        #   - beta
-        #   - nightly
         required: true
         default: 'none'
       auto:
@@ -403,7 +399,9 @@ jobs:
             });
 
   trigger-ee-extra-pr:
-    needs: verify-s3-download
+    needs:
+      - containerize-ee
+      - verify-s3-download
     runs-on: ubuntu-22.04
     timeout-minutes: 10
     steps:

.github/workflows/run-tests.yml

@@ -7,9 +7,11 @@ on:
       - "release-**"
   pull_request:
     types: [opened, synchronize, reopened]
+  merge_group:
 
 jobs:
   files-changed:
+    if: ${{ !contains(github.event.pull_request.labels.*.name,'ci skip') }}
     name: Check which files changed
     runs-on: ubuntu-22.04
     timeout-minutes: 5
@@ -21,6 +23,7 @@ jobs:
       backend_all: ${{ steps.changes.outputs.backend_all }}
       frontend_all: ${{ steps.changes.outputs.frontend_all }}
       frontend_sources: ${{ steps.changes.outputs.frontend_sources }}
+      documentation: ${{ steps.changes.outputs.documentation }}
     steps:
       - uses: actions/checkout@v4
       - name: Test which files changed
@@ -34,6 +37,7 @@ jobs:
 
   static-viz-files-changed:
     name: Check whether static-viz files changed
+    if: ${{ !contains(github.event.pull_request.labels.*.name,'ci skip') }}
     runs-on: ubuntu-22.04
     timeout-minutes: 10
     outputs:
@@ -63,6 +67,14 @@ jobs:
           token: ${{ github.token }}
           filters: .github/static-viz-sources.yaml
 
+  uberjar:
+    needs: [files-changed, static-viz-files-changed]
+    if: ${{ !cancelled() && !(needs.files-changed.outputs.documentation == 'true' && needs.files-changed.outputs.backend_all == 'false' && needs.files-changed.outputs.frontend_all == 'false' && needs.files-changed.outputs.e2e_all == 'false') }}
+    uses: ./.github/workflows/uberjar.yml
+    secrets: inherit
+    with:
+      source_changed: ${{ needs.files-changed.outputs.backend_all == 'true' || needs.files-changed.outputs.frontend_all == 'true' || needs.static-viz-files-changed.outputs.static_viz == 'true' }}
+
   backend-tests:
     if: ${{ !cancelled() }}
     needs: [files-changed, static-viz-files-changed]
@@ -94,7 +106,8 @@ jobs:
       skip-lint: ${{ needs.files-changed.outputs.frontend_all != 'true' && needs.files-changed.outputs.e2e_specs != 'true' }}
 
   e2e-tests:
-    needs: files-changed
+    needs: [files-changed, uberjar]
+    if: always() && !cancelled()
     uses: ./.github/workflows/e2e-tests.yml
     secrets: inherit
     with:
@@ -104,3 +117,16 @@ jobs:
       # e2e_all_files includes all changes which trigger all e2e tests, if the list of changes files is included in the
       # list of changed specs files, then only specs are changed and we can run only those specs
       specs: ${{ needs.files-changed.outputs.e2e_all_files == needs.files-changed.outputs.e2e_specs_files && needs.files-changed.outputs.e2e_specs_files || '' }}
+
+  sdk-tests:
+    needs: files-changed
+    uses: ./.github/workflows/embedding-sdk.yml
+    secrets: inherit
+
+  pr-env:
+    needs: [uberjar]
+    if: |
+      !cancelled() &&
+      contains(github.event.pull_request.labels.*.name, 'PR-Env')
+    uses: ./.github/workflows/pr-env.yml
+    secrets: inherit

.github/workflows/snyk.yml

@@ -13,12 +13,11 @@ on:
   schedule:
     - cron: '0 5 * * *'
 
-
 jobs:
-  monitor:
-    # don't run this workflow on a cron for forks
+  # Generate pom.xml files for all Maven projects
+  generate-poms:
     if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
-    name: Generate Snyk report
+    name: Generate pom.xml files
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
@@ -26,26 +25,144 @@ jobs:
         uses: ./.github/actions/prepare-backend
         with:
           m2-cache-key: 'snyk'
-      - uses: snyk/actions/setup@0.4.0
       - name: Generate all pom.xml
         run: .github/scripts/write-poms.sh
-      - name: Run snyk main project
+      - name: Upload pom files
+        uses: actions/upload-artifact@v4
+        with:
+          name: pom-files
+          path: |
+            pom.xml
+            modules/drivers/*/pom.xml
+
+  # Yarn/NPM projects that don't need pom files
+  frontend-projects:
+    if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
+    name: ${{ matrix.project.name }}
+    runs-on: ubuntu-22.04
+    strategy:
+      matrix:
+        project:
+          - name: Main Frontend (yarn)
+            file: yarn.lock
+            package-manager: yarn
+            category: main-frontend-yarn
+          - name: Embedding SDK Template
+            file: bin/embedding-sdk/templates/yarn.lock
+            package-manager: yarn
+            category: embedding-sdk-template
+          - name: E2E Angular 20 Host App
+            file: e2e/embedding-sdk-host-apps/angular-20-host-app/package-lock.json
+            package-manager: npm
+            category: e2e-angular-host
+          - name: E2E Next 15 App Router
+            file: e2e/embedding-sdk-host-apps/next-15-app-router-host-app/package-lock.json
+            package-manager: npm
+            category: e2e-next-app-router
+          - name: E2E Next 15 Pages Router
+            file: e2e/embedding-sdk-host-apps/next-15-pages-router-host-app/package-lock.json
+            package-manager: npm
+            category: e2e-next-pages-router
+          - name: E2E Vite 6 Host App
+            file: e2e/embedding-sdk-host-apps/vite-6-host-app/package-lock.json
+            package-manager: npm
+            category: e2e-vite-host
+          - name: Release Helper
+            file: release/yarn.lock
+            package-manager: yarn
+            category: release-helper
+    steps:
+      - uses: actions/checkout@v4
+      - uses: snyk/actions/setup@0.4.0
+      - name: Run snyk test
         env:
           SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
         continue-on-error: true
-        run: snyk test --all-projects --exclude="modules" --sarif-file-output=snyk-main.sarif
-      - name: Upload result to GitHub Code Scanning
+        run: snyk test --org="metabase-AnD9iS4Wfu4eBYMsG2DZ5N" --remote-repo-url="https://github.com/metabase/metabase" --file=${{ matrix.project.file }} --package-manager=${{ matrix.project.package-manager }} --sarif-file-output=snyk-${{ matrix.project.category }}.sarif
+      - name: Upload results
         uses: github/codeql-action/upload-sarif@v3
         with:
-          sarif_file: snyk-main.sarif
-          category: main-project
-      - name: Run snyk drivers
+          sarif_file: snyk-${{ matrix.project.category }}.sarif
+          category: ${{ matrix.project.category }}
+
+  # Maven projects that need pom files
+  maven-projects:
+    needs: generate-poms
+    if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
+    name: ${{ matrix.project.name }}
+    runs-on: ubuntu-22.04
+    strategy:
+      matrix:
+        project:
+          - name: Main Backend (maven)
+            file: pom.xml
+            category: main-backend-maven
+          - name: Driver - Athena
+            file: modules/drivers/athena/pom.xml
+            category: driver-athena
+          - name: Driver - BigQuery Cloud SDK
+            file: modules/drivers/bigquery-cloud-sdk/pom.xml
+            category: driver-bigquery-cloud-sdk
+          - name: Driver - ClickHouse
+            file: modules/drivers/clickhouse/pom.xml
+            category: driver-clickhouse
+          - name: Driver - Databricks
+            file: modules/drivers/databricks/pom.xml
+            category: driver-databricks
+          - name: Driver - Druid
+            file: modules/drivers/druid/pom.xml
+            category: driver-druid
+          - name: Driver - Druid JDBC
+            file: modules/drivers/druid-jdbc/pom.xml
+            category: driver-druid-jdbc
+          - name: Driver - Hive-like
+            file: modules/drivers/hive-like/pom.xml
+            category: driver-hive-like
+          - name: Driver - MongoDB
+            file: modules/drivers/mongo/pom.xml
+            category: driver-mongo
+          - name: Driver - Oracle
+            file: modules/drivers/oracle/pom.xml
+            category: driver-oracle
+          - name: Driver - Presto JDBC
+            file: modules/drivers/presto-jdbc/pom.xml
+            category: driver-presto-jdbc
+          - name: Driver - Redshift
+            file: modules/drivers/redshift/pom.xml
+            category: driver-redshift
+          - name: Driver - Snowflake
+            file: modules/drivers/snowflake/pom.xml
+            category: driver-snowflake
+          - name: Driver - SparkSQL
+            file: modules/drivers/sparksql/pom.xml
+            category: driver-sparksql
+          - name: Driver - SQLite
+            file: modules/drivers/sqlite/pom.xml
+            category: driver-sqlite
+          - name: Driver - SQL Server
+            file: modules/drivers/sqlserver/pom.xml
+            category: driver-sqlserver
+          - name: Driver - Starburst
+            file: modules/drivers/starburst/pom.xml
+            category: driver-starburst
+          - name: Driver - Vertica
+            file: modules/drivers/vertica/pom.xml
+            category: driver-vertica
+    steps:
+      - uses: actions/checkout@v4
+      - uses: snyk/actions/setup@0.4.0
+      - name: Download pom files
+        uses: actions/download-artifact@v4
+        with:
+          name: pom-files
+      - name: Run snyk test
         env:
           SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
         continue-on-error: true
-        run: cd modules && snyk test --all-projects --sarif-file-output=snyk-drivers.sarif
-      - name: Upload result to GitHub Code Scanning
+        run: snyk test --org="metabase-AnD9iS4Wfu4eBYMsG2DZ5N" --remote-repo-url="https://github.com/metabase/metabase" --file=${{ matrix.project.file }} --package-manager=maven --sarif-file-output=snyk-${{ matrix.project.category }}.sarif
+
+      - name: Upload results
         uses: github/codeql-action/upload-sarif@v3
         with:
-          sarif_file: modules/snyk-drivers.sarif
-          category: drivers
+          sarif_file: snyk-${{ matrix.project.category }}.sarif
+          category: ${{ matrix.project.category }}

.github/workflows/uberjar.yml

@@ -3,12 +3,15 @@ name: Build + Docker Uberjar
 # This workflow builds an uberjar and pushes it to dockerhub for any branch, either on-demand,
 # or automatically for the listed branches
 
+concurrency:
+  group: uberjar-${{ github.ref }}
+  cancel-in-progress: false
+
 on:
   push:
     branches:
       - master
       - metabot-v3-main
-      - feature-visualizer
       - internal-tools
     paths-ignore:
       # config files
@@ -24,12 +27,95 @@ on:
     inputs:
       commit:
         description: "Optional full-length commit SHA-1 hash"
+  workflow_call:
+    inputs:
+      source_changed:
+        description: "Whether source code has changed"
+        type: boolean
+        default: true
 
 jobs:
+  check-existing-artifacts:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    outputs:
+      ee_exists: ${{ steps.check-ee.outcome == 'success' }}
+      oss_exists: ${{ steps.check-oss.outcome == 'success' }}
+      should_build: ${{ steps.decide.outputs.should_build }}
+    steps:
+      - name: Try to download existing EE artifact
+        id: check-ee
+        continue-on-error: true
+        uses: actions/download-artifact@v4
+        with:
+          name: metabase-ee-${{ github.event.inputs.commit || github.event.pull_request.head.sha || github.sha }}-uberjar
+
+      - name: Try to download existing OSS artifact
+        id: check-oss
+        continue-on-error: true
+        uses: actions/download-artifact@v4
+        with:
+          name: metabase-oss-${{ github.event.inputs.commit || github.event.pull_request.head.sha || github.sha }}-uberjar
+
+      - name: Decide if build is needed
+        id: decide
+        run: |
+          SOURCE_CHANGED="${{ inputs.source_changed == true }}"
+          EE_EXISTS="${{ steps.check-ee.outcome == 'success' }}"
+          OSS_EXISTS="${{ steps.check-oss.outcome == 'success' }}"
+
+          echo "Source changed: $SOURCE_CHANGED"
+          echo "EE exists: $EE_EXISTS"
+          echo "OSS exists: $OSS_EXISTS"
+
+          # Build if source changed OR artifacts don't exist
+          if [[ "$SOURCE_CHANGED" == "true" ]] || [[ "$EE_EXISTS" == "false" ]] || [[ "$OSS_EXISTS" == "false" ]]; then
+            SHOULD_BUILD="true"
+            echo "Will build: source_changed=$SOURCE_CHANGED, ee_exists=$EE_EXISTS, oss_exists=$OSS_EXISTS"
+          else
+            SHOULD_BUILD="false"
+            echo "Skipping build: artifacts exist and no source changes"
+          fi
+
+          echo "should_build=$SHOULD_BUILD" >> $GITHUB_OUTPUT
+
+  # if this is on a release branch, we need to check the build requirements
+  get-build-requirements:
+    if: |
+      !cancelled() &&
+      contains(github.ref, 'release-x')
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    outputs:
+      java_version: ${{ fromJson(steps.dependencies.outputs.result).java_version }}
+      node_version: ${{ fromJson(steps.dependencies.outputs.result).node_version }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: release
+      - name: Prepare build scripts
+        run: cd ${{ github.workspace }}/release && yarn && yarn build
+      - name: Get build dependencies
+        uses: actions/github-script@v7
+        id: dependencies
+        with:
+          script: | # js
+            const { getBuildRequirements, getVersionFromReleaseBranch } = require('${{ github.workspace }}/release/dist/index.cjs');
+
+            const version = getVersionFromReleaseBranch('${{ github.ref }}');
+            const requirements = getBuildRequirements(version);
+
+            return {
+              java_version: requirements.java,
+              node_version: requirements.node,
+            };
+
   get-container-info:
     runs-on: ubuntu-22.04
     timeout-minutes: 5
     name: Get container info
+    # Skip if this is a PR without the build-docker-uberjar label
+    if: github.ref_name == 'master' || contains(github.event.pull_request.labels.*.name, 'build-docker-uberjar')
     outputs:
       editions: ${{ toJson(fromJson(steps.info.outputs.result).editions) }}
       ee: ${{ toJson(fromJson(steps.info.outputs.result).ee) }}
@@ -72,17 +158,19 @@ jobs:
           echo "${{ steps.info.outputs.result }}"
 
   build:
-    needs: get-container-info
+    needs:
+      [check-existing-artifacts, get-build-requirements, get-container-info]
+    if: always() && !cancelled() && needs.check-existing-artifacts.outputs.should_build == 'true' && (needs.get-build-requirements.result == 'success' || needs.get-build-requirements.result == 'skipped')
     name: Build MB ${{ matrix.edition }}
     runs-on: ubuntu-22.04
     timeout-minutes: 15
     strategy:
       matrix:
-        edition: ${{ fromJson(needs.get-container-info.outputs.editions) }}
+        edition: ${{ needs.get-container-info.result == 'success' && fromJson(needs.get-container-info.outputs.editions) || fromJson('["ee", "oss"]') }}
     env:
       MB_EDITION: ${{ matrix.edition }}
       INTERACTIVE: false
-      SKIP_LICENSES: true # faster builds for dev
+      SKIP_LICENSES: ${{ github.event_name == 'pull_request' }}  # faster builds for dev
     steps:
       - name: Check out the code
         uses: actions/checkout@v4
@@ -90,26 +178,29 @@ jobs:
           ref: ${{ github.event.inputs.commit }}
       - name: Prepare front-end environment
         uses: ./.github/actions/prepare-frontend
+        with:
+          node-version: "${{ needs.get-build-requirements.outputs.node_version || '22' }}"
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
         with:
           m2-cache-key: uberjar
-          java-version: 21
+          java-version: "${{ needs.get-build-requirements.outputs.java_version || 21 }}"
       - name: Build
         run: ./bin/build.sh
       - name: Prepare uberjar artifact
         uses: ./.github/actions/prepare-uberjar-artifact
         with:
-          name: metabase-${{ matrix.edition }}-${{ github.event.inputs.commit || github.sha  }}-uberjar
+          name: metabase-${{ matrix.edition }}-${{ github.event.inputs.commit || github.event.pull_request.head.sha || github.sha }}-uberjar
 
   check-jar-health:
     runs-on: ubuntu-22.04
     name: Is ${{ matrix.edition }} (java ${{ matrix.java-version }}) healthy?
-    needs: [build, get-container-info]
+    needs: [build, check-existing-artifacts, get-container-info]
+    if: always() && !cancelled() && (needs.build.result == 'success' || (needs.check-existing-artifacts.outputs.should_build == 'false' && needs.check-existing-artifacts.outputs.ee_exists == 'true' && needs.check-existing-artifacts.outputs.oss_exists == 'true'))
     timeout-minutes: 10
     strategy:
       matrix:
-        edition: ${{ fromJson(needs.get-container-info.outputs.editions) }}
+        edition: ${{ needs.get-container-info.result == 'success' && fromJson(needs.get-container-info.outputs.editions) || fromJson('["ee", "oss"]') }}
         java-version: [21]
     steps:
       - name: Prepare JRE (Java Run-time Environment)
@@ -122,7 +213,7 @@ jobs:
       - uses: actions/download-artifact@v4
         name: Retrieve uberjar artifact
         with:
-          name: metabase-${{ matrix.edition }}-${{ github.event.inputs.commit || github.sha  }}-uberjar
+          name: metabase-${{ matrix.edition }}-${{ github.event.inputs.commit || github.event.pull_request.head.sha || github.sha }}-uberjar
       - name: Launch uberjar
         run: >-
           java --add-opens java.base/java.nio=ALL-UNNAMED -jar ./target/uberjar/metabase.jar &
@@ -130,14 +221,15 @@ jobs:
         run: while ! curl 'http://localhost:3000/api/health' | grep '{"status":"ok"}'; do sleep 1; done
 
   containerize:
-    needs: [check-jar-health, get-container-info]
+    needs: [check-jar-health, get-container-info, build]
+    if: needs.get-container-info.result == 'success' && needs.build.result == 'success'
     strategy:
       matrix:
         edition: ${{ fromJson(needs.get-container-info.outputs.editions) }}
     uses: ./.github/workflows/containerize-jar.yml
     secrets: inherit
     with:
-      artifact-name: metabase-${{ matrix.edition }}-${{ github.event.inputs.commit || github.sha }}-uberjar
+      artifact-name: metabase-${{ matrix.edition }}-${{ github.event.inputs.commit || github.event.pull_request.head.sha || github.sha }}-uberjar
       commit: ${{ github.event.inputs.commit || github.sha }}
       repo: ${{ fromJson(needs.get-container-info.outputs[matrix.edition]).repo }}
       tag: ${{ fromJson(needs.get-container-info.outputs[matrix.edition]).tag }}

.github/workflows/whitespace.yml

@@ -6,6 +6,7 @@ on:
       - 'master'
       - 'release-**'
   pull_request:
+  merge_group:
 
 jobs:
   whitespace-linter:

.gitignore

@@ -51,6 +51,7 @@ cypress.env.json
 /lein-plugins/*/target
 /local
 /locales/metabase-*.pot
+/logs
 /modules/drivers/*/resources/namespaces.edn
 /modules/drivers/*/target
 /node_modules/
@@ -152,3 +153,4 @@ CLAUDE.local.md
 .eslintcache
 
 /logs
+/.clojure-mcp