Merge branch 'internal-tools' into undo-execute-test

* WIP

* Match action and API shape for undo / redo

* WRK-397 Integrate Table actions to button action picker (#58333)

* WRK-397: Add table actions output to table actions picker

* WRK-397: Integrate new endpoint and table actions for Action Buttons

* WRK-397 Ignore null update values (temporary)

* WRK-397: Add typings. Fix lint

* WRK-397: Various improvements for table action picker

* WRK-397: Fix tests

* WRK-397: Merge latest updates

* WRK-397 Remove nils from update params

---------

Co-authored-by: Dan Stone <wotbrew@gmail.com>

* WRK-411: Migrate rows delete to new API

* WRK-411: Migrate rows update to new API

* WRK-411: Migrate rows create to new API

* WRK-411: Migrate undo/redo to new API

* WRK-411: Fix lint

---------

Co-authored-by: Chris Truter <chris@metabase.com>
Co-authored-by: Dan Stone <wotbrew@gmail.com>

.claude/commands/fix-flakey-test.md

@@ -0,0 +1 @@
+Fix flakey test $ARGUMENTS

.claude/commands/fix-issue.md

@@ -0,0 +1 @@
+Fix issue $ARGUMENTS

.claude/commands/fix-pr.md

@@ -0,0 +1 @@
+Fetch unresolved comments for this branch's PR, then fix them

.claude/commands/repro-issue.md

@@ -0,0 +1 @@
+Repro issue $ARGUMENTS in a failing test

.clj-kondo/config.edn

@@ -11,6 +11,7 @@
   :def-fn                       {:level :warning}
   :dynamic-var-not-earmuffed    {:level :warning}
   :equals-expected-position     {:level :warning, :only-in-test-assertion true}
+  :equals-true                  {:level :warning}
   :keyword-binding              {:level :warning}
   :main-without-gen-class       {:level :warning}
   :minus-one                    {:level :warning}
@@ -42,7 +43,6 @@
 
   #_:docstring-leading-trailing-whitespace
   #_:equals-false
-  #_:equals-true
   #_:used-underscored-binding
 
   ;;
@@ -58,9 +58,11 @@
   :metabase/check-defmulti-arglists                    {:level :warning}
   :metabase/check-me-humanize                          {:level :warning}
   :metabase/defsetting-must-specify-export             {:level :warning}
+  :metabase/defsetting-namespace                       {:level :warning}
   :metabase/mbql-query-first-arg                       {:level :warning}
   :metabase/missing-test-expr-requires-in-cljs         {:level :warning}
   :metabase/modules                                    {:level :warning} ; more config in `.clj-kondo/config/modules/config.edn`
+  :metabase/namespace-name                             {:level :warning}
   :metabase/require-shape-checker                      {:level :warning}
   :metabase/test-helpers-use-non-thread-safe-functions {:level :warning} ; more config in `.clj-kondo/config/test-helpers/config.edn`
   :metabase/validate-logging                           {:level :warning}
@@ -91,7 +93,6 @@
      metabase.test.data.users/with-group-for-user
      metabase.test.data/with-empty-h2-app-db
      metabase.test.util.log/with-log-level
-     metabase.test.util.misc/with-single-admin-user
      metabase.test.util/with-all-users-permission
      metabase.test.util/with-discarded-collections-perms-changes
      metabase.test.util/with-env-keys-renamed-by
@@ -123,7 +124,6 @@
      metabase.test/with-model-cleanup
      metabase.test/with-non-admin-groups-no-root-collection-for-namespace-perms
      metabase.test/with-non-admin-groups-no-root-collection-perms
-     metabase.test/with-single-admin-user
      metabase.test/with-temp-env-var-value
      metabase.test/with-temp-vals-in-db
      metabase.test/with-temporary-raw-setting-values
@@ -167,7 +167,7 @@
      clojure.core.async/to-chan!!
      metabase.channel.core/send!
      metabase.driver.sql-jdbc.execute/execute-prepared-statement!
-     metabase.models.notification/create-notification!
+     metabase.notification.models/create-notification!
      metabase.pulse.send/send-pulse!
      metabase.query-processor.store/store-database!
      ;; Safe in tests, where we typically use a private, temporary index per thread.
@@ -190,6 +190,7 @@
               ;; module drivers
               :athena
               :bigquery-cloud-sdk
+              :clickhouse
               :databricks
               :druid
               :druid-jdbc
@@ -203,6 +204,7 @@
               :sparksql
               :sqlite
               :sqlserver
+              :starburst
               :vertica}}
 
   ;;
@@ -240,20 +242,14 @@
 
   :deprecated-var
   {:exclude
-   {metabase.cmd/dump                                                            {:namespaces ["metabase\\.cmd-test" "metabase-enterprise\\.serialization\\.cmd-test"]}
-    metabase.cmd/load                                                            {:namespaces ["metabase\\.cmd-test" "metabase-enterprise\\.serialization\\.cmd-test"]}
-    metabase.db.data-migrations/data-migrations                                  {:namespaces ["metabase\\.db\\.data-migrations"]}
-    metabase.db.data-migrations/defmigration                                     {:namespaces ["metabase\\.db\\.data-migrations"]}
-    metabase.db.data-migrations/run-migration-if-needed!                         {:namespaces ["metabase\\.db\\.data-migrations"]}
+   {metabase.cmd.core/dump                                                       {:namespaces ["metabase\\.cmd-test" "metabase-enterprise\\.serialization\\.cmd-test"]}
+    metabase.cmd.core/load                                                       {:namespaces ["metabase\\.cmd-test" "metabase-enterprise\\.serialization\\.cmd-test"]}
     metabase.driver.sql-jdbc.execute.old-impl/set-timezone-sql                   {:namespaces ["metabase\\.driver.*"]}
     metabase.driver.sql-jdbc.execute/set-time-zone-if-supported!                 {:namespaces ["metabase\\.driver.*"]}
     metabase.driver/current-db-time                                              {:namespaces ["metabase.*"]}
     metabase.driver/supports?                                                    {:namespaces ["metabase.*"]}
-    metabase.premium-features.premium-features/enable-enhancements?              {:namespaces ["metabase\\.models.*"]}
     metabase.query-processor.middleware.resolve-joins/maybe-resolve-source-table {:namespaces ["metabase.*"]}
-    metabase.query-processor.util/normalize-token                                {:namespaces ["metabase.*"]}
-    schema.core/both                                                             {:namespaces ["metabase.*"]}
-    schema.core/either                                                           {:namespaces ["metabase.*"]}}}
+    metabase.query-processor.util/normalize-token                                {:namespaces ["metabase.*"]}}}
 
   :discouraged-var
   {clojure.core/print                                 {:message "Use metabase.util.log instead of clojure.core/print"}
@@ -273,6 +269,7 @@
    compojure.core/context                             {:message "Use metabase.api.util.handlers/route-map-handler instead of compojure.core/context, it is much faster and supports OpenAPI spec generation"}
    compojure.core/defroutes                           {:message "Use metabase.api.util.handlers/defroutes instead of compojure.core/routes, it supports OpenAPI spec generation."}
    compojure.core/routes                              {:message "Use metabase.api.util.handlers/routes instead of compojure.core/routes, it supports OpenAPI spec generation."}
+   clojurewerkz.quartzite.jobs/defjob                 {:message "Use metabase.task/defjob instead of clojurewerkz.quartzite.jobs/defjob"}
    fipp.edn/pprint                                    {:message "Use metabase.util.log instead of fipp.edn/pprint"}
    honeysql.core/call                                 {:message "Use hx/call instead because it is Honey SQL 2 friendly"}
    honeysql.core/raw                                  {:message "Use hx/raw instead because it is Honey SQL 2 friendly"}
@@ -285,7 +282,8 @@
    me.flowthing.pp/pprint                             {:message "Use metabase.util.log instead of me.flowthing.pp/pprint"}
    medley.core/random-uuid                            {:message "Use clojure.core/random-uuid instead of medley.core/random-uuid"}
    metabase.driver/database-supports?                 {:message "Use metabase.driver.util/supports? instead of metabase.driver/database-supports?"}
-   metabase.lib.equality/find-column-indexes-for-refs {:message "Use lib.equality/closest-matches-in-metadata or lib.equality/find-closest-matches-for-refs instead of lib.equality/find-column-indexes-for-refs"}}
+   metabase.lib.equality/find-column-indexes-for-refs {:message "Use lib.equality/closest-matches-in-metadata or lib.equality/find-closest-matches-for-refs instead of lib.equality/find-column-indexes-for-refs"}
+   next.jdbc/active-tx?                               {:message "Use metabase.app-db.core/in-transaction? to see if we are in a transaction"}}
 
   :discouraged-namespace
   {camel-snake-kebab.core {:message "CSK is not Turkish-safe, use the versions in metabase.util instead."}
@@ -298,222 +296,97 @@
    honeysql.types         {:message "Use Honey SQL 2. Honey SQL 1 is removed as a dependency in Metabase 49+."}
    honeysql.util          {:message "Use Honey SQL 2. Honey SQL 1 is removed as a dependency in Metabase 49+."}}
 
+  :discouraged-tag {p {:message "You can use it, but don't commit it."}}
+
   :unresolved-var
   {:exclude
    [colorize.core]}
 
   :consistent-alias
   {:aliases
-   {buddy.core.hash                                               buddy-hash
-    cheshire.generate                                             json.generate
-    clojure.tools.logging                                         log
-    clj-http.client                                               http
-    clj-ldap.client                                               ldap
-    clj-time.coerce                                               time.coerce
-    clj-time.format                                               time.format
-    clojure.core.async                                            a
-    clojure.core.match                                            clojure.core.match ; Prefer :refer [match]
-    clojure.data                                                  data
-    clojure.math.combinatorics                                    math.combo
-    clojure.pprint                                                pprint
-    clojure.spec.alpha                                            s
-    clojure.string                                                str
-    clojure.test                                                  t
-    clojure.tools.build.api                                       b
-    clojure.tools.namespace.dependency                            ns.deps
-    clojure.tools.namespace.find                                  ns.find
-    clojure.tools.namespace.parse                                 ns.parse
-    colorize.core                                                 colorize
-    environ.core                                                  env
-    hiccup.core                                                   hiccup
-    hiccup.util                                                   hiccup.util
-    honey.sql                                                     sql
-    honey.sql.helpers                                             sql.helpers
-    java-time.api                                                 t
-    macaw.core                                                    macaw
-    malli.core                                                    mc
-    malli.error                                                   me
-    malli.experimental                                            mx
-    malli.generator                                               mg
-    malli.provider                                                mp
-    malli.transform                                               mtx
-    malli.util                                                    mut
-    medley.core                                                   m
-    metabase-enterprise.audit-app.pages.common                    common
-    metabase-enterprise.sandbox.api.table                         table
-    metabase-enterprise.sandbox.api.util                          sandbox.api.util
-    metabase-enterprise.test                                      met
-    metabase.analytics.sdk                                        sdk
-    metabase.analytics.stats                                      stats
-    metabase.analysis.native-query-analyzer                       nqa
-    metabase.analysis.native-query-analyzer.parameter-substitution nqa.sub
-    metabase.analyze.query-results                                qr
-    metabase.analyze.classifiers.category                         classifiers.category
-    metabase.analyze.classifiers.core                             classifiers
-    metabase.analyze.classifiers.name                             classifiers.name
-    metabase.analyze.classifiers.no-preview-display               classifiers.no-preview-display
-    metabase.analyze.classifiers.text-fingerprint                 classifiers.text-fingerprint
-    metabase.analyze.fingerprint.fingerprinters                   fingerprinters
-    metabase.analyze.fingerprint.insights                         insights
-    metabase.analyze.fingerprint.schema                           fingerprint.schema
-    metabase.api.common                                           api
-    metabase.channel.core                                         channel
-    metabase.channel.render.core                                  channel.render
-    metabase.cloud-migration.core                                 cloud-migration
-    metabase.cmd.copy.h2                                          copy.h2
-    metabase.config                                               config
-    metabase.config.file                                          config.file
-    metabase.connection-pool                                      connection-pool
-    metabase.db.connection                                        mdb.connection
-    metabase.db.jdbc-protocols                                    mdb.jdbc-protocols
-    metabase.db.metadata-queries                                  metadata-queries
-    metabase.db.spec                                              mdb.spec
-    metabase.db.query                                             mdb.query
-    metabase.driver.common.parameters                             params
-    metabase.driver.common.parameters.dates                       params.dates
-    metabase.driver.common.parameters.operators                   params.ops
-    metabase.driver.common.parameters.parse                       params.parse
-    metabase.driver.common.parameters.values                      params.values
-    metabase.driver.druid.client                                  druid.client
-    metabase.driver.druid.execute                                 druid.execute
-    metabase.driver.druid.js                                      druid.js
-    metabase.driver.druid.query-processor                         druid.qp
-    metabase.driver.druid.sync                                    druid.sync
-    metabase.driver.impl                                          driver.impl
-    metabase.driver.mongo.execute                                 mongo.execute
-    metabase.driver.mongo.parameters                              mongo.params
-    metabase.driver.mongo.query-processor                         mongo.qp
-    metabase.driver.mongo.util                                    mongo.util
-    metabase.driver.sql                                           driver.sql
-    metabase.driver.sql-jdbc.common                               sql-jdbc.common
-    metabase.driver.sql-jdbc.connection                           sql-jdbc.conn
-    metabase.driver.sql-jdbc.execute                              sql-jdbc.execute
-    metabase.driver.sql-jdbc.execute.diagnostic                   sql-jdbc.execute.diagnostic
-    metabase.driver.sql-jdbc.execute.legacy-impl                  sql-jdbc.legacy
-    metabase.driver.sql-jdbc.execute.old-impl                     sql-jdbc.execute.old
-    metabase.driver.sql-jdbc.sync                                 sql-jdbc.sync
-    metabase.driver.sql-jdbc.sync.common                          sql-jdbc.sync.common
-    metabase.driver.sql-jdbc.sync.describe-database               sql-jdbc.describe-database
-    metabase.driver.sql-jdbc.sync.describe-table                  sql-jdbc.describe-table
-    metabase.driver.sql-jdbc.sync.interface                       sql-jdbc.sync.interface
-    metabase.driver.sql-jdbc.test-util                            sql-jdbc.tu
-    metabase.driver.sql.parameters.substitute                     sql.params.substitute
-    metabase.driver.sql.parameters.substitution                   sql.params.substitution
-    metabase.eid-translation                                      eid-translation
-    metabase.formatter                                            formatter
-    metabase.http-client                                          client
-    metabase.legacy-mbql.normalize                                mbql.normalize
-    metabase.legacy-mbql.schema                                   mbql.s
-    metabase.legacy-mbql.util                                     mbql.u
-    metabase.lib.util                                             lib.util
-    metabase.lib.util.match                                       lib.util.match
-    metabase.login-history.core                                   login-history
-    metabase.model-persistence.core                               model-persistence
-    metabase.models.dependency                                    dependency
-    metabase.models.interface                                     mi
-    metabase.models.setting                                       setting
-    metabase.notification.core                                    notification
-    metabase.notification.test-util                               notification.tu
-    metabase.permissions.core                                     perms
-    metabase.plugins.initialize                                   plugins.init
-    metabase.public-settings                                      public-settings
-    metabase.public-sharing.core                                  public-sharing
-    metabase.premium-features.core                                premium-features
-    metabase.pulse.core                                           pulse
-    metabase.pulse.render                                         render
-    metabase.pulse.render.body                                    body
-    metabase.pulse.render.style                                   style
-    metabase.pulse.test-util                                      pulse.test-util
-    metabase.pulse.parameters                                     pulse-params
-    metabase.query-processor-test                                 qp.test
-    metabase.query-processor.context                              qp.context
-    metabase.query-processor.error-type                           qp.error-type
-    metabase.query-processor.interface                            qp.i
-    metabase.query-processor.middleware.add-dimension-projections qp.add-dimension-projections
-    metabase.query-processor.middleware.add-implicit-clauses      qp.add-implicit-clauses
-    metabase.query-processor.middleware.add-implicit-joins        qp.add-implicit-joins
-    metabase.query-processor.middleware.auto-bucket-datetimes     qp.auto-bucket-datetimes
-    metabase.query-processor.middleware.constraints               qp.constraints
-    metabase.query-processor.middleware.cumulative-aggregations   qp.cumulative-aggregations
-    metabase.query-processor.middleware.parameters.mbql           qp.mbql
-    metabase.query-processor.middleware.parameters.native         qp.native
-    metabase.query-processor.middleware.permissions               qp.perms
-    metabase.query-processor.middleware.pre-alias-aggregations    qp.pre-alias-aggregations
-    metabase.query-processor.middleware.resolve-fields            qp.resolve-fields
-    metabase.query-processor.middleware.resolve-referenced        qp.resolve-referenced
-    metabase.query-processor.middleware.resolve-source-table      qp.resolve-source-table
-    metabase.query-processor.middleware.wrap-value-literals       qp.wrap-value-literals
-    metabase.query-processor.pivot                                qp.pivot
-    metabase.query-processor.streaming                            qp.streaming
-    metabase.query-processor.streaming.interface                  qp.si
-    metabase.query-processor.streaming.xlsx                       qp.xlsx
-    metabase.query-processor.timezone                             qp.timezone
-    metabase.query-processor.util                                 qp.util
-    metabase.request.core                                         request
-    metabase.revisions.core                                       revisions
-    metabase.search.config                                        search.config
-    metabase.search.filter                                        search.filter
-    metabase.search.in-place.filter                               search.in-place.filter
-    metabase.search.in-place.util                                 search.util
-    metabase.search.in-place.scoring                              scoring
-    metabase.server.core                                          server
-    metabase.server.protocols                                     server.protocols
-    metabase.sso.core                                             sso
-    metabase.sync.analyze.fingerprint                             sync.fingerprint
-    metabase.sync.field-values                                    sync.field-values
-    metabase.sync.interface                                       i
-    metabase.sync.schedules                                       sync.schedules
-    metabase.sync.sync-metadata.fields.our-metadata               fields.our-metadata
-    metabase.sync.util                                            sync-util
-    metabase.sync.util-test                                       sync.util-test
-    metabase.test                                                 mt
-    metabase.test.data.dataset-definitions                        defs
-    metabase.test.data.env.impl                                   tx.env.impl
-    metabase.test.data.impl                                       data.impl
-    metabase.test.data.users                                      test.users
-    metabase.test.domain-entities                                 test.de
-    metabase.test.mock.util                                       mock.util
-    metabase.test.sync                                            test.sync
-    metabase.test.redefs                                          test.redefs
-    metabase.test.util.js                                         test.js
-    metabase.test.util.timezone                                   test.tz
-    metabase.timeline.core                                        timeline
-    metabase.timeseries-query-processor-test.util                 tqpt
-    metabase.util.cron                                            u.cron
-    metabase.util.currency                                        currency
-    metabase.util.date-2                                          u.date
-    metabase.util.date-2.common                                   u.date.common
-    metabase.util.date-2.parse                                    u.date.parse
-    metabase.util.embed                                           embed
-    metabase.util.encryption                                      encryption
-    metabase.util.encryption-test                                 encryption-test
-    metabase.util.files                                           u.files
-    metabase.util.grouper                                         grouper
-    metabase.util.honey-sql-2                                     h2x
-    metabase.util.i18n                                            i18n
-    metabase.util.i18n.impl                                       i18n.impl
-    metabase.util.jvm                                             u.jvm
-    metabase.util.log                                             log
-    metabase.util.macros                                          u.macros
-    metabase.util.malli                                           mu
-    metabase.util.malli.schema                                    ms
-    metabase.util.markdown                                        markdown
-    metabase.util.password                                        u.password
-    metabase.util.schema                                          su
-    metabase.util.ui-logic                                        ui-logic
-    metabase.util.urls                                            urls
-    metabase.xrays.core                                           xrays
-    metabuild-common.core                                         u
-    metabuild-common.output                                       out
-    metabuild-common.shell                                        shell
-    monger.collection                                             mcoll
-    ring.mock.request                                             ring.mock
-    ring.util.codec                                               codec
-    ring.util.response                                            response
-    ring.adapter.jetty9.servlet                                   servlet
-    saml20-clj.core                                               saml
-    toucan.db                                                     db
-    toucan.models                                                 models}}}
+   {buddy.core.hash                           buddy-hash
+    cheshire.generate                         json.generate
+    clj-http.client                           http
+    clj-ldap.client                           ldap
+    clj-time.coerce                           time.coerce
+    clj-time.format                           time.format
+    clojure.core.async                        a
+    clojure.core.match                        clojure.core.match
+    clojure.data                              data
+    clojure.math.combinatorics                math.combo
+    clojure.pprint                            pprint
+    clojure.spec.alpha                        s
+    clojure.string                            str
+    clojure.test                              t
+    clojure.tools.build.api                   b
+    clojure.tools.logging                     log
+    clojure.tools.namespace.dependency        ns.deps
+    clojure.tools.namespace.find              ns.find
+    clojure.tools.namespace.parse             ns.parse
+    colorize.core                             colorize
+    environ.core                              env
+    hiccup.core                               hiccup
+    hiccup.util                               hiccup.util
+    honey.sql                                 sql
+    honey.sql.helpers                         sql.helpers
+    java-time.api                             t
+    macaw.core                                macaw
+    malli.core                                mc
+    malli.error                               me
+    malli.experimental                        mx
+    malli.generator                           mg
+    malli.provider                            mp
+    malli.transform                           mtx
+    malli.util                                mut
+    medley.core                               m
+    metabase-enterprise.database-routing.core database-routing
+    metabase.analyze.classifiers.core         classifiers
+    metabase.channel.core                     channel
+    metabase.channel.render.core              channel.render
+    metabase.cloud-migration.core             cloud-migration
+    metabase.eid-translation.core             eid-translation
+    metabase.login-history.core               login-history
+    metabase.model-persistence.core           model-persistence
+    metabase.notification.core                notification
+    metabase.notification.payload.core        notification.payload
+    metabase.permissions.core                 perms
+    metabase.premium-features.core            premium-features
+    metabase.public-sharing.core              public-sharing
+    metabase.pulse.core                       pulse
+    metabase.request.core                     request
+    metabase.revisions.core                   revisions
+    metabase.server.core                      server
+    metabase.settings.core                    setting
+    metabase.sso.core                         sso
+    metabase.timeline.core                    timeline
+    metabase.util.cron                        u.cron
+    metabase.util.currency                    currency
+    metabase.util.date-2                      u.date
+    metabase.util.date-2.common               u.date.common
+    metabase.util.date-2.parse                u.date.parse
+    metabase.util.embed                       embed
+    metabase.util.encryption                  encryption
+    metabase.util.encryption-test             encryption-test
+    metabase.util.files                       u.files
+    metabase.util.grouper                     grouper
+    metabase.util.honey-sql-2                 h2x
+    metabase.util.i18n                        i18n
+    metabase.util.i18n.impl                   i18n.impl
+    metabase.util.jvm                         u.jvm
+    metabase.util.log                         log
+    metabase.util.macros                      u.macros
+    metabase.util.malli                       mu
+    metabase.util.malli.schema                ms
+    metabase.util.markdown                    markdown
+    metabase.util.password                    u.password
+    metabase.util.ui-logic                    ui-logic
+    metabase.xrays.core                       xrays
+    monger.collection                         mcoll
+    ring.mock.request                         ring.mock
+    ring.util.codec                           codec
+    ring.util.response                        response
+    saml20-clj.core                           saml
+    toucan2.core                              t2}}}
 
  :lint-as
  {cljs.cache/defcache                                                                   clojure.core/deftype
@@ -526,26 +399,30 @@
   metabase-enterprise.serialization.test-util/with-random-dump-dir                      clojure.core/let
   metabase.actions.test-util/with-actions                                               clojure.core/let
   metabase.api.common/let-404                                                           clojure.core/let
+  metabase.app-db.custom-migrations.util/with-temp-scheduler!                           clojure.core/fn
+  metabase.app-db.custom-migrations/define-migration                                    clj-kondo.lint-as/def-catch-all
+  metabase.app-db.custom-migrations/define-reversible-migration                         clj-kondo.lint-as/def-catch-all
+  metabase.app-db.liquibase/with-liquibase                                              clojure.core/let
+  metabase.app-db.schema-migrations-test.impl/with-temp-empty-app-db                    clojure.core/let
   metabase.channel.impl.http-test/with-captured-http-requests                           clojure.core/fn
   metabase.channel.impl.http-test/with-server                                           clojure.core/let
-  metabase.dashboard-subscription-test/with-dashboard-sub-for-card                      clojure.core/let
-  metabase.db.custom-migrations/define-migration                                        clj-kondo.lint-as/def-catch-all
-  metabase.db.custom-migrations/define-reversible-migration                             clj-kondo.lint-as/def-catch-all
-  metabase.db.data-migrations/defmigration                                              clojure.core/def
-  metabase.db.liquibase/with-liquibase                                                  clojure.core/let
-  metabase.db.schema-migrations-test.impl/with-temp-empty-app-db                        clojure.core/let
+  metabase.collections.models.collection-test/with-collection-in-location               clojure.core/let
   metabase.driver.mongo.connection/with-mongo-client                                    clojure.core/let
   metabase.driver.mongo.connection/with-mongo-database                                  clojure.core/let
   metabase.driver.mongo.query-processor/mongo-let                                       clojure.core/let
   metabase.driver.sql-jdbc.actions/with-jdbc-transaction                                clojure.core/let
+  metabase.driver.sql-jdbc.connection.ssh-tunnel/with-ssh-tunnel                        clojure.core/let
   metabase.driver.sql-jdbc.connection/with-connection-spec-for-testing-connection       clojure.core/let
   metabase.driver.sql-jdbc.execute.diagnostic/capturing-diagnostic-info                 clojure.core/fn
-  metabase.models.collection-test/with-collection-in-location                           clojure.core/let
   metabase.models.json-migration/def-json-migration                                     clj-kondo.lint-as/def-catch-all
-  metabase.models.setting/defsetting                                                    clj-kondo.lint-as/def-catch-all
+  metabase.models.util.spec-update/define-spec                                          clojure.core/def
+  metabase.notification.test-util/with-card-notification                                clojure.core/let
+  metabase.notification.test-util/with-system-event-notification!                       clojure.core/let
+  metabase.notification.test-util/with-temp-notification                                clojure.core/let
   metabase.premium-features.core/defenterprise-schema                                   clj-kondo.lint-as/def-catch-all
-  metabase.premium-features.core/define-premium-feature                                 clojure.core/def
   metabase.premium-features.defenterprise/defenterprise-schema                          clj-kondo.lint-as/def-catch-all
+  metabase.premium-features.settings/define-premium-feature                             clojure.core/def
+  metabase.pulse.dashboard-subscription-test/with-dashboard-sub-for-card                clojure.core/let
   metabase.pulse.send-test/with-pulse-for-card                                          clojure.core/let
   metabase.query-processor-test.pipeline-queries-test/pmbql-query                       clojure.core/->
   metabase.query-processor-test.pipeline-queries-test/run-pmbql-query                   clojure.core/->
@@ -554,22 +431,31 @@
   metabase.query-processor.middleware.process-userland-query-test/with-query-execution! clojure.core/let
   metabase.query-processor.setup/with-qp-setup                                          clojure.core/let
   metabase.search.api-test/do-test-users                                                clojure.core/let
+  metabase.settings.core/define-multi-setting                                           clojure.core/def
+  metabase.settings.core/defsetting                                                     clj-kondo.lint-as/def-catch-all
+  metabase.settings.models.setting.multi-setting/define-multi-setting                   clojure.core/def
+  metabase.settings.models.setting/defsetting                                           clj-kondo.lint-as/def-catch-all
   metabase.sso.ldap/with-ldap-connection                                                clojure.core/fn
   metabase.sync.util/sum-for                                                            clojure.core/for
   metabase.sync.util/with-emoji-progress-bar                                            clojure.core/let
+  metabase.task.core/defjob                                                             clojure.core/defn
+  metabase.task.impl/defjob                                                             clojure.core/defn
   metabase.test.data.interface/defdataset                                               clojure.core/def
   metabase.test.data.interface/defdataset-edn                                           clojure.core/def
+  metabase.test.gentest/defgentest                                                      clojure.test/deftest
   metabase.test/defdataset                                                              clojure.core/def
   metabase.test/let-url                                                                 clojure.core/let
   metabase.test/with-actions                                                            clojure.core/let
   metabase.test/with-grouper-batches!                                                   clojure.core/fn
   metabase.test/with-open-channels                                                      clojure.core/let
-  metabase.test/with-single-admin-user                                                  clojure.core/fn
+  metabase.test/with-single-admin-user!                                                 clojure.core/fn
   metabase.test/with-temp-dir                                                           clojure.core/let
   metabase.test/with-temp-empty-app-db                                                  clojure.core/let
   metabase.test/with-temp-file                                                          clojure.core/let
   metabase.test/with-user-in-groups                                                     clojure.core/let
+  metabase.upload.impl-test/with-upload-table!                                          clojure.core/let
   metabase.upload-test/with-upload-table!                                               clojure.core/let
+  metabase.util/for-map                                                                 clojure.core/for
   metabase.util/with-timer-ms                                                           clojure.core/fn
   metabase.util.files/with-open-path-to-resource                                        clojure.core/let
   metabase.util.malli.defn/defn                                                         schema.core/defn
@@ -580,7 +466,6 @@
   metabase.util.malli/defn-                                                             schema.core/defn
   metabase.util.malli/fn                                                                schema.core/fn
   metabase.util.namespaces/import-fns                                                   potemkin/import-vars
-  metabase.util.ssh/with-ssh-tunnel                                                     clojure.core/let
   metabase.xrays.domain-entities.malli/defn                                             schema.core/defn
   metabuild-common.core/with-open-jar-file-system                                       clojure.core/let
   metabuild-common.files/with-open-jar-file-system                                      clojure.core/let
@@ -611,26 +496,28 @@
    metabase-enterprise.audit-app.pages-test/with-temp-objects                                                                hooks.common/with-one-binding
    metabase-enterprise.cache.config-test/with-temp-persist-models                                                            hooks.common/with-seven-bindings
    metabase-enterprise.serialization.test-util/with-temp-dpc                                                                 hooks.toucan2.tools.with-temp/with-temp
-   metabase.api.card-test/with-card-param-values-fixtures                                                                    hooks.common/let-one-with-optional-value
-   metabase.api.card-test/with-temp-native-card!                                                                             hooks.common/with-two-bindings
-   metabase.api.card-test/with-temp-native-card-with-params!                                                                 hooks.common/with-two-bindings
-   metabase.api.collection-test/with-french-user-and-personal-collection!                                                    hooks.common/with-two-top-level-bindings
    metabase.api.common.internal-test/with-jetty-server                                                                       hooks.common/with-one-binding
-   metabase.api.dashboard-test/with-chain-filter-fixtures                                                                    hooks.common/let-one-with-optional-value
-   metabase.api.dashboard-test/with-simple-dashboard-with-tabs                                                               hooks.common/with-one-binding
-   metabase.api.embed-test/do-response-formats                                                                               hooks.common/with-two-bindings
-   metabase.api.embed-test/with-chain-filter-fixtures!                                                                       hooks.common/let-one-with-optional-value
-   metabase.api.embed-test/with-temp-card                                                                                    hooks.common/let-one-with-optional-value
-   metabase.api.embed-test/with-temp-dashcard                                                                                hooks.common/let-one-with-optional-value
    metabase.api.macros/defendpoint                                                                                           hooks.metabase.api.macros/defendpoint
-   metabase.api.user-test/with-temp-user-email!                                                                              hooks.common/with-one-binding
+   metabase.app-db.schema-migrations-test.impl/test-migrations                                                               hooks.metabase.app-db.schema-migrations-test.impl/test-migrations
+   metabase.channel.render.js.svg/with-static-viz-context                                                                    hooks.common/with-one-top-level-binding
    metabase.channel.template.handlebars-helper/defhelper                                                                     hooks.metabase.channel.template.handlebars-helper/defhelper
    metabase.channel.template.handlebars-test/with-temp-template!                                                             hooks.common/with-vec-first-binding
-   metabase.dashboard-subscription-test/with-link-card-fixture-for-dashboard                                                 hooks.common/let-second
-   metabase.db.schema-migrations-test.impl/test-migrations                                                                   hooks.metabase.db.schema-migrations-test.impl/test-migrations
+   metabase.classloader.core/require                                                                                         hooks.clojure.core.require/lint-require
+   metabase.classloader.impl/require                                                                                         hooks.clojure.core.require/lint-require
+   metabase.collections.api-test/with-french-user-and-personal-collection!                                                   hooks.common/with-two-top-level-bindings
+   metabase.collections.models.collection-test/with-collection-hierarchy!                                                    hooks.common/let-one-with-optional-value
+   metabase.collections.models.collection-test/with-personal-and-impersonal-collections                                      hooks.common/with-two-bindings
+   metabase.dashboards.api-test/with-chain-filter-fixtures                                                                   hooks.common/let-one-with-optional-value
+   metabase.dashboards.api-test/with-simple-dashboard-with-tabs                                                              hooks.common/with-one-binding
+   metabase.dashboards.models.dashboard-tab-test/with-dashtab-in-personal-collection                                         hooks.common/with-one-top-level-binding
+   metabase.dashboards.models.dashboard-test/with-dash-in-collection!                                                        hooks.common/with-three-bindings
    metabase.driver.bigquery-cloud-sdk-test/calculate-bird-scarcity                                                           hooks.metabase.query-processor-test.expressions-test/calculate-bird-scarcity
    metabase.driver.oracle-test/with-temp-user                                                                                hooks.common/let-one-with-optional-value
    metabase.driver/register!                                                                                                 hooks.metabase.driver/register!
+   metabase.embedding.api.embed-test/do-response-formats                                                                     hooks.common/with-two-bindings
+   metabase.embedding.api.embed-test/with-chain-filter-fixtures!                                                             hooks.common/let-one-with-optional-value
+   metabase.embedding.api.embed-test/with-temp-card                                                                          hooks.common/let-one-with-optional-value
+   metabase.embedding.api.embed-test/with-temp-dashcard                                                                      hooks.common/let-one-with-optional-value
    metabase.legacy-mbql.schema.macros/defclause                                                                              hooks.metabase.legacy-mbql.schemas.macros/defclause
    metabase.lib.schema.mbql-clause/define-catn-mbql-clause                                                                   hooks.metabase.lib.schema.mbql-clause/define-mbql-clause
    metabase.lib.schema.mbql-clause/define-mbql-clause                                                                        hooks.metabase.lib.schema.mbql-clause/define-mbql-clause
@@ -641,18 +528,10 @@
    metabase.model-persistence.api-test/with-persistence-setup!                                                               hooks.common/with-one-top-level-binding
    metabase.model-persistence.api-test/with-setup!                                                                           hooks.common/with-one-top-level-binding
    metabase.model-persistence.test-util/with-persistence-enabled!                                                            hooks.metabase.model-persistence.test-util/with-persistence-enabled!
-   metabase.models.collection-test/with-collection-hierarchy!                                                                hooks.common/let-one-with-optional-value
-   metabase.models.collection-test/with-personal-and-impersonal-collections                                                  hooks.common/with-two-bindings
-   metabase.models.dashboard-tab-test/with-dashtab-in-personal-collection                                                    hooks.common/with-one-top-level-binding
-   metabase.models.dashboard-test/with-dash-in-collection!                                                                   hooks.common/with-three-bindings
    metabase.models.interface/define-batched-hydration-method                                                                 hooks.metabase.models.interface/define-hydration-method
    metabase.models.interface/define-simple-hydration-method                                                                  hooks.metabase.models.interface/define-hydration-method
-   metabase.models.setting.multi-setting/define-multi-setting                                                                hooks.metabase.models.setting/define-multi-setting
-   metabase.models.setting.multi-setting/define-multi-setting-impl                                                           hooks.metabase.models.setting/define-multi-setting-impl
-   metabase.models.setting/defsetting                                                                                        hooks.metabase.models.setting/defsetting
    metabase.permissions.core/allow-changing-all-users-group-members                                                          hooks.common/do*
    metabase.permissions.core/disable-perms-cache                                                                             hooks.common/do*
-   metabase.plugins.classloader/require                                                                                      hooks.clojure.core.require/lint-require
    metabase.premium-features.core/defenterprise                                                                              hooks.metabase.premium-features.defenterprise/defenterprise
    metabase.premium-features.defenterprise/defenterprise                                                                     hooks.metabase.premium-features.defenterprise/defenterprise
    metabase.public-sharing.api-test/with-required-param-card!                                                                hooks.common/with-one-binding
@@ -660,19 +539,29 @@
    metabase.public-sharing.api-test/with-temp-public-dashboard                                                               hooks.common/let-one-with-optional-value
    metabase.public-sharing.api-test/with-temp-public-dashboard-and-card                                                      hooks.common/with-three-bindings
    metabase.pulse.api.alert-test/with-alert-in-collection!                                                                   hooks.common/with-four-bindings
+   metabase.pulse.dashboard-subscription-test/with-link-card-fixture-for-dashboard                                           hooks.common/let-second
    metabase.pulse.models.pulse-test/with-dashboard-subscription-in-collection!                                               hooks.common/with-four-bindings
    metabase.pulse.models.pulse-test/with-pulse-in-collection!                                                                hooks.common/with-four-bindings
    metabase.pulse.test-util/checkins-query-card                                                                              hooks.metabase.test.data/$ids
+   metabase.queries.api.card-test/with-card-param-values-fixtures                                                            hooks.common/let-one-with-optional-value
+   metabase.queries.api.card-test/with-temp-native-card!                                                                     hooks.common/with-two-bindings
+   metabase.queries.api.card-test/with-temp-native-card-with-params!                                                         hooks.common/with-two-bindings
    metabase.query-processor-test.expressions-test/calculate-bird-scarcity                                                    hooks.metabase.query-processor-test.expressions-test/calculate-bird-scarcity
    metabase.query-processor-test.filter-test/count-with-filter-clause                                                        hooks.metabase.test.data/$ids
    metabase.query-processor.middleware.cache-test/with-mock-cache!                                                           hooks.common/with-two-bindings
    metabase.request.core/with-current-request                                                                                hooks.common/with-used-first-arg
    metabase.request.core/with-current-user                                                                                   hooks.common/with-used-first-arg
    metabase.request.core/with-limit-and-offset                                                                               hooks.common/with-used-first-two-args
-   metabase.sample-data-test/with-temp-sample-database-db                                                                    hooks.common/with-one-binding
+   metabase.sample-data.impl-test/with-temp-sample-database-db                                                               hooks.common/with-one-binding
    metabase.search.api-test/with-search-items-in-collection                                                                  hooks.metabase.search.api-test/with-search-items-in-collection
    metabase.search.api-test/with-search-items-in-root-collection                                                             hooks.common/do*
    metabase.server.streaming-response-test/with-start-execution-chan                                                         hooks.common/with-one-binding
+   metabase.settings.core/define-multi-setting                                                                               hooks.metabase.settings.models.setting/define-multi-setting
+   metabase.settings.core/define-multi-setting-impl                                                                          hooks.metabase.settings.models.setting/define-multi-setting-impl
+   metabase.settings.core/defsetting                                                                                         hooks.metabase.settings.models.setting/defsetting
+   metabase.settings.models.setting.multi-setting/define-multi-setting                                                       hooks.metabase.settings.models.setting/define-multi-setting
+   metabase.settings.models.setting.multi-setting/define-multi-setting-impl                                                  hooks.metabase.settings.models.setting/define-multi-setting-impl
+   metabase.settings.models.setting/defsetting                                                                               hooks.metabase.settings.models.setting/defsetting
    metabase.stale-test/with-stale-items                                                                                      hooks.toucan2.tools.with-temp/with-temp
    metabase.test.data.datasets/test-driver                                                                                   hooks.metabase.test.data.datasets/test-driver
    metabase.test.data.datasets/test-drivers                                                                                  hooks.metabase.test.data.datasets/test-drivers
@@ -681,8 +570,9 @@
    metabase.test.data/dataset                                                                                                hooks.metabase.test.data/dataset
    metabase.test.data/mbql-query                                                                                             hooks.metabase.test.data/mbql-query
    metabase.test.data/run-mbql-query                                                                                         hooks.metabase.test.data/mbql-query
-   metabase.test.gentest/with-gentest                                                                                        hooks.metabase.test.gentest/with-gentest
+   metabase.test.gentest/iterate                                                                                             hooks.metabase.test.gentest/iterate*
    metabase.test.util.async/with-open-channels                                                                               hooks.common/let-with-optional-value-for-last-binding
+   metabase.test.util.generators.jvm/with-random-cards                                                                       hooks.metabase.test.util.generators.jvm/with-random-cards
    metabase.test.util.log/with-log-level                                                                                     hooks.common/with-ignored-first-arg
    metabase.test.util/discard-setting-changes                                                                                hooks.common/with-ignored-first-arg
    metabase.test.util/with-column-remappings                                                                                 hooks.common/with-ignored-first-arg
@@ -704,10 +594,15 @@
    metabase.test/with-log-messages-for-level                                                                                 hooks.metabase.util.log.capture/with-log-messages-for-level
    metabase.test/with-non-admin-groups-no-root-collection-perms                                                              hooks.common/do*
    metabase.test/with-persistence-enabled!                                                                                   hooks.metabase.model-persistence.test-util/with-persistence-enabled!
+   metabase.test/with-prometheus-system!                                                                                     hooks.common/with-two-bindings
    metabase.test/with-temp                                                                                                   hooks.toucan2.tools.with-temp/with-temp
    metabase.test/with-temp-file                                                                                              hooks.metabase.test.util/with-temp-file
-   metabase.test/with-prometheus-system!                                                                                     hooks.common/with-two-bindings
    metabase.test/with-temporary-setting-values                                                                               hooks.metabase.test.util/with-temporary-setting-values
+   metabase.users.api-test/with-temp-user-email!                                                                              hooks.common/with-one-binding
+   metabase.util.i18n/deferred-trs                                                                                           hooks.metabase.util.i18n/deferred-trs
+   metabase.util.i18n/deferred-tru                                                                                           hooks.metabase.util.i18n/deferred-tru
+   metabase.util.i18n/trs                                                                                                    hooks.metabase.util.i18n/trs
+   metabase.util.i18n/tru                                                                                                    hooks.metabase.util.i18n/tru
    metabase.util.log.capture/with-log-messages-for-level                                                                     hooks.metabase.util.log.capture/with-log-messages-for-level
    metabase.util.log/debug                                                                                                   hooks.metabase.util.log/info
    metabase.util.log/debugf                                                                                                  hooks.metabase.util.log/infof
@@ -727,41 +622,43 @@
    metabase.xrays.api.automagic-dashboards-test/with-indexed-model!                                                          hooks.metabase.xrays.api.automagic-dashboards-test/with-indexed-model!}
 
   :macroexpand
-  {clojurewerkz.quartzite.jobs/build                                                    macros.quartz/build-job
-   clojurewerkz.quartzite.schedule.cron/schedule                                        macros.quartz/schedule
-   clojurewerkz.quartzite.schedule.simple/schedule                                      macros.quartz/simple-schedule
-   clojurewerkz.quartzite.triggers/build                                                macros.quartz/build-trigger
-   metabase-enterprise.advanced-permissions.api.util-test/with-impersonations!          macros.metabase-enterprise.advanced-permissions.api.util-test/with-impersonations!
-   metabase-enterprise.query-reference-validation.api-test/with-test-setup!             macros.metabase-enterprise.query-reference-validation.api-test/with-test-setup!
-   metabase-enterprise.sandbox.test-util/with-gtaps!                                    macros.metabase-enterprise.sandbox.test-util/with-gtaps!
-   metabase-enterprise.sandbox.test-util/with-gtaps-for-user!                           macros.metabase-enterprise.sandbox.test-util/with-gtaps!
-   metabase-enterprise.serialization.test-util/with-world                               macros.metabase-enterprise.serialization.test-util/with-world
-   metabase-enterprise.test/with-gtaps!                                                 macros.metabase-enterprise.sandbox.test-util/with-gtaps!
-   metabase-enterprise.test/with-gtaps-for-user!                                        macros.metabase-enterprise.sandbox.test-util/with-gtaps!
-   metabase.api.card-test/with-ordered-items                                            macros.metabase.api.card-test/with-ordered-items
-   metabase.api.collection-test/with-collection-hierarchy!                              macros.metabase.api.collection-test/with-collection-hierarchy!
-   metabase.api.collection-test/with-some-children-of-collection!                       macros.metabase.api.collection-test/with-some-children-of-collection!
-   metabase.api.embed-test/with-embedding-enabled-and-temp-card-referencing!            macros.metabase.api.embed-test/with-embedding-enabled-and-temp-card-referencing!
-   metabase.api.embed-test/with-embedding-enabled-and-temp-dashcard-referencing!        macros.metabase.api.embed-test/with-embedding-enabled-and-temp-dashcard-referencing!
-   metabase.lib.common/defop                                                            macros.metabase.lib.common/defop
-   metabase.lib.filter/deffilter                                                        macros.metabase.lib.filter/deffilter
-   metabase.models.params.chain-filter-test/chain-filter                                macros.metabase.models.params.chain-filter-test/chain-filter
-   metabase.models.params.chain-filter-test/chain-filter-search                         macros.metabase.models.params.chain-filter-test/chain-filter
-   metabase.models.query-analysis-test/with-test-setup                                  macros.metabase.models.query-analysis-test/with-test-setup
-   metabase.models.user-test/with-groups                                                macros.metabase.models.user-test/with-groups
-   metabase.public-sharing.api-test/with-sharing-enabled-and-temp-card-referencing!     macros.metabase.public-sharing.api-test/with-sharing-enabled-and-temp-card-referencing!
-   metabase.public-sharing.api-test/with-sharing-enabled-and-temp-dashcard-referencing! macros.metabase.public-sharing.api-test/with-sharing-enabled-and-temp-dashcard-referencing!
-   metabase.query-analysis.task.test-setup/with-test-setup!                             macros.metabase.query-analysis.task.test-setup/with-test-setup!
-   metabase.query-processor.streaming/streaming-response                                macros.metabase.query-processor.streaming/streaming-response
-   metabase.test.data.users/with-group-for-user                                         macros.metabase.test.data.users/with-group-for-user
-   metabase.test.util/with-temp-env-var-value!                                          macros.metabase.test.util/with-temp-env-var-value!
-   metabase.test.util/with-temporary-raw-setting-values                                 macros.metabase.test.util/with-temporary-raw-setting-values
-   metabase.test/with-group-for-user                                                    macros.metabase.test.data.users/with-group-for-user
-   metabase.test/with-temp-env-var-value!                                               macros.metabase.test.util/with-temp-env-var-value!
-   metabase.test/with-temporary-raw-setting-values                                      macros.metabase.test.util/with-temporary-raw-setting-values
-   metabase.util.namespaces/import-fn                                                   macros.metabase.util.namespaces/import-fn
-   metabase.xrays.domain-entities.malli/define-getters-and-setters                      macros.metabase.xrays.domain-entities.malli/define-getters-and-setters
-   metabase.xrays.related-test/with-world                                               macros.metabase.xrays.related-test/with-world}}
+  {clojurewerkz.quartzite.jobs/build                                                       macros.quartz/build-job
+   clojurewerkz.quartzite.schedule.cron/schedule                                           macros.quartz/schedule
+   clojurewerkz.quartzite.schedule.simple/schedule                                         macros.quartz/simple-schedule
+   clojurewerkz.quartzite.triggers/build                                                   macros.quartz/build-trigger
+   metabase-enterprise.database-routing.e2e-test/with-temp-dbs!                            macros.metabase-enterprise.database-routing.e2e-test/with-temp-dbs!
+   metabase-enterprise.impersonation.util-test/with-impersonations!                        macros.metabase-enterprise.impersonation.util-test/with-impersonations!
+   metabase-enterprise.query-reference-validation.api-test/with-test-setup!                macros.metabase-enterprise.query-reference-validation.api-test/with-test-setup!
+   metabase-enterprise.sandbox.test-util/with-gtaps!                                       macros.metabase-enterprise.sandbox.test-util/with-gtaps!
+   metabase-enterprise.sandbox.test-util/with-gtaps-for-user!                              macros.metabase-enterprise.sandbox.test-util/with-gtaps!
+   metabase-enterprise.serialization.test-util/with-world                                  macros.metabase-enterprise.serialization.test-util/with-world
+   metabase-enterprise.test/with-gtaps!                                                    macros.metabase-enterprise.sandbox.test-util/with-gtaps!
+   metabase-enterprise.test/with-gtaps-for-user!                                           macros.metabase-enterprise.sandbox.test-util/with-gtaps!
+   metabase.collections.api-test/with-collection-hierarchy!                                macros.metabase.collections.api-test/with-collection-hierarchy!
+   metabase.collections.api-test/with-some-children-of-collection!                         macros.metabase.collections.api-test/with-some-children-of-collection!
+   metabase.embedding.api.embed-test/with-embedding-enabled-and-temp-card-referencing!     macros.metabase.embedding.api.embed-test/with-embedding-enabled-and-temp-card-referencing!
+   metabase.embedding.api.embed-test/with-embedding-enabled-and-temp-dashcard-referencing! macros.metabase.embedding.api.embed-test/with-embedding-enabled-and-temp-dashcard-referencing!
+   metabase.lib.common/defop                                                               macros.metabase.lib.common/defop
+   metabase.lib.filter/deffilter                                                           macros.metabase.lib.filter/deffilter
+   metabase.parameters.chain-filter-test/chain-filter                                      macros.metabase.parameters.chain-filter-test/chain-filter
+   metabase.parameters.chain-filter-test/chain-filter-search                               macros.metabase.parameters.chain-filter-test/chain-filter
+   metabase.public-sharing.api-test/with-sharing-enabled-and-temp-card-referencing!        macros.metabase.public-sharing.api-test/with-sharing-enabled-and-temp-card-referencing!
+   metabase.public-sharing.api-test/with-sharing-enabled-and-temp-dashcard-referencing!    macros.metabase.public-sharing.api-test/with-sharing-enabled-and-temp-dashcard-referencing!
+   metabase.queries.api.card-test/with-ordered-items                                       macros.metabase.queries.api.card-test/with-ordered-items
+   metabase.query-analysis.models.query-analysis-test/with-test-setup                      macros.metabase.query-analysis.models.query-analysis-test/with-test-setup
+   metabase.query-analysis.task.test-setup/with-test-setup!                                macros.metabase.query-analysis.task.test-setup/with-test-setup!
+   metabase.query-processor.streaming/streaming-response                                   macros.metabase.query-processor.streaming/streaming-response
+   metabase.server.statistics-handler-test/with-server                                     macros.metabase.server.statistics-handler-test/with-server
+   metabase.test.data.users/with-group-for-user                                            macros.metabase.test.data.users/with-group-for-user
+   metabase.test.util/with-temp-env-var-value!                                             macros.metabase.test.util/with-temp-env-var-value!
+   metabase.test.util/with-temporary-raw-setting-values                                    macros.metabase.test.util/with-temporary-raw-setting-values
+   metabase.test/with-group-for-user                                                       macros.metabase.test.data.users/with-group-for-user
+   metabase.test/with-temp-env-var-value!                                                  macros.metabase.test.util/with-temp-env-var-value!
+   metabase.test/with-temporary-raw-setting-values                                         macros.metabase.test.util/with-temporary-raw-setting-values
+   metabase.users.models.user-test/with-groups!                                            macros.metabase.users.models.user-test/with-groups!
+   metabase.util.namespaces/import-fn                                                      macros.metabase.util.namespaces/import-fn
+   metabase.xrays.domain-entities.malli/define-getters-and-setters                         macros.metabase.xrays.domain-entities.malli/define-getters-and-setters
+   metabase.xrays.related-test/with-world                                                  macros.metabase.xrays.related-test/with-world}}
 
  :config-in-comment
  {:linters {:unresolved-symbol {:level :off}}}
@@ -782,9 +679,9 @@
    :name    test-namespaces}
   {:pattern "^(?!.*-test(?:\\..*)?$)(?!.*test-util)(?!^metabase\\.test.*).*$"
    :name    source-namespaces}
-  {:pattern "(?:(?:^metabase\\.cmd.*)|(?:^build.*)|(?:^metabuild-common.*)|(?:^release.*)|(?:^i18n.*)|(?:^lint-migrations-file$))"
+  {:pattern "(?:(?:^metabase\\.cmd.*)|(?:^build.*)|(?:^metabuild-common.*)|(?:^release.*)|(?:^i18n.*)|(?:^lint-migrations-file$))|(?:^mage.*)"
    :name    printable-namespaces}
-  {:pattern "^metabase\\.(?:(?:lib)|(?:legacy-mbql))\\.*"
+  {:pattern "^metabase\\.(?:(?:lib)|(?:legacy-mbql))\\..*"
    :name    metabase-lib}
   ;;
   ;; QP source namespaces: `metabase.query-processor.*`, `metabase-enterprise.sandbox.query-processor.*`, and
@@ -811,8 +708,9 @@
    {:inline-def                              {:level :off}
     :missing-docstring                       {:level :off}
     :private-call                            {:level :off}
+    :discouraged-var                         {metabase.driver/database-supports? {:level :off}}
     :metabase/defsetting-must-specify-export {:level :off}
-    :discouraged-var                         {metabase.driver/database-supports? {:level :off}}}
+    :metabase/defsetting-namespace           {:level :off}}
 
    :hooks
    {:analyze-call
@@ -822,7 +720,9 @@
 
   source-namespaces
   {:linters
-   {:discouraged-var
+   {:metabase/validate-escaped-single-quotes-in-i18n {:level :warning}
+    :metabase/validate-string-or-str-args-to-i18n {:level :warning}
+    :discouraged-var
     {clojure.core/with-redefs {:message "Don't use with-redefs outside of tests"}
      clojure.core/eval        {:message "Don't use eval outside of tests"}}}}
 
@@ -878,10 +778,10 @@
      toucan2.core               {:message "Don't use application database directly in QP code; use QP Store/metadata provider"}}
 
     :discouraged-var
-    {medley.core/map-keys              {:message "Use clojure.core/update-keys"}
-     medley.core/map-vals              {:message "Use clojure.core/update-vals"}
-     metabase.db.query/query           {:message "Don't use application database directly in QP code; use QP Store/metadata provider"}
-     metabase.db.query/reducible-query {:message "Don't use application database directly in QP code; use QP Store/metadata provider"}}}}
+    {medley.core/map-keys                 {:message "Use clojure.core/update-keys"}
+     medley.core/map-vals                 {:message "Use clojure.core/update-vals"}
+     metabase.app-db.core/query           {:message "Don't use application database directly in QP code; use QP Store/metadata provider"}
+     metabase.app-db.core/reducible-query {:message "Don't use application database directly in QP code; use QP Store/metadata provider"}}}}
 
   general-qp-and-driver-test-namespaces
   {:linters

.clj-kondo/config/test-helpers/config.edn

@@ -49,36 +49,43 @@
      metabase.actions.models/insert!
      metabase.analytics.snowplow-test/fake-track-event-impl!
      metabase.analytics.snowplow/track-event-impl!
+     metabase.app-db.core/finish-db-setup!
+     metabase.app-db.core/migrate!
+     metabase.app-db.core/setup-db!
+     metabase.app-db.schema-migrations-test.impl/run-migrations-in-range!
+     metabase.app-db.setup/migrate!
+     metabase.app-db.setup/setup-db!
      metabase.channel.email-test/reset-inbox!
      metabase.channel.email/send-email!
      metabase.cmd.dump-to-h2/dump-to-h2!
      metabase.cmd.load-from-h2/load-from-h2!
+     metabase.content-verification.models.moderation-review/create-review!
      metabase.core.core/ensure-audit-db-installed!
-     metabase.db.schema-migrations-test.impl/run-migrations-in-range!
-     metabase.db.setup/migrate!
-     metabase.db.setup/setup-db!
-     metabase.db/migrate!
-     metabase.db/setup-db!
      metabase.driver.mongo-test/create-database-from-row-maps!
      metabase.driver.postgres-test/create-enums-db!
      metabase.driver.postgres-test/drop-if-exists-and-create-db!
      metabase.driver.sql-jdbc.execute/execute-statement!
      metabase.indexed-entities.models.model-index/add-values!
+     metabase.driver.sql-jdbc.connection.ssh-tunnel-test/start-mock-servers!
+     metabase.driver.sql-jdbc.connection.ssh-tunnel-test/stop-mock-servers!
      metabase.indexed-entities.task.index-values/job-init!
      metabase.model-persistence.models.persisted-info/ready-database!
      metabase.model-persistence.task.persist-refresh/job-init!
      metabase.model-persistence.task.persist-refresh/refresh-tables!
      metabase.model-persistence.task.persist-refresh/schedule-persistence-for-database!
-     metabase.models.collection.graph-test/clear-graph-revisions!
-     metabase.models.collection.graph-test/do-with-n-temp-users-with-personal-collections!
-     metabase.models.field-values/create-or-update-full-field-values!
-     metabase.models.moderation-review/create-review!
      metabase.models.on-demand-test/add-dashcard-with-parameter-mapping!
-     metabase.models.setting-test/test-user-local-allowed-setting!
-     metabase.models.setting-test/test-user-local-only-setting!
-     metabase.models.setting.cache/restore-cache!
-     metabase.models.setting/set!
-     metabase.models.setting/validate-settings-formatting!
+     metabase.permissions.core/grant-application-permissions!
+     metabase.permissions.core/grant-collection-read-permissions!
+     metabase.permissions.core/grant-collection-readwrite-permissions!
+     metabase.permissions.core/grant-full-data-permissions!
+     metabase.permissions.core/grant-native-readwrite-permissions!
+     metabase.permissions.core/grant-permissions!
+     metabase.permissions.core/revoke-application-permissions!
+     metabase.permissions.core/revoke-data-perms!
+     metabase.permissions.core/update-data-perms-graph!
+     metabase.permissions.core/update-group-permissions!
+     metabase.permissions.models.collection.graph-test/clear-graph-revisions!
+     metabase.permissions.models.collection.graph-test/do-with-n-temp-users-with-personal-collections!
      metabase.permissions.models.permissions/grant-application-permissions!
      metabase.permissions.models.permissions/grant-collection-read-permissions!
      metabase.permissions.models.permissions/grant-collection-readwrite-permissions!
@@ -96,7 +103,12 @@
      metabase.query-processor.streaming.interface/begin!
      metabase.query-processor.streaming.interface/finish!
      metabase.query-processor.streaming.interface/write-row!
-     metabase.sample-data/try-to-extract-sample-database!
+     metabase.sample-data.impl/try-to-extract-sample-database!
+     metabase.settings.models.setting-test/test-user-local-allowed-setting!
+     metabase.settings.models.setting-test/test-user-local-only-setting!
+     metabase.settings.models.setting.cache/restore-cache!
+     metabase.settings.models.setting/set!
+     metabase.settings.models.setting/validate-settings-formatting!
      metabase.setup.core/create-token!
      metabase.sso.ldap-test-util/start-ldap-server!
      metabase.sync.core/sync-database!
@@ -104,7 +116,8 @@
      metabase.sync.sync-metadata/sync-db-metadata!
      metabase.sync.util-test/sync-database!
      metabase.sync.util/store-sync-summary!
-     metabase.task/delete-task!
+     metabase.task.core/delete-task!
+     metabase.task.impl/delete-task!
      metabase.test.data.bigquery-cloud-sdk/execute!
      metabase.test.data.impl.get-or-create/set-test-db-permissions!
      metabase.test.data.impl/copy-db-tables-and-fields!
@@ -126,7 +139,6 @@
      metabase.test/initialize-if-needed!
      metabase.test/test-helpers-set-global-values!
      metabase.test/with-temp-env-var-value!
-     metabase.upload-test/set-local-infile!
+     metabase.upload.impl-test/set-local-infile!
      metabase.util.files/create-dir-if-not-exists!
-     metabase.util.ssh-test/start-mock-servers!
-     metabase.util.ssh-test/stop-mock-servers!}}}}
+     metabase.warehouse-schema.models.field-values/create-or-update-full-field-values!}}}}

.clj-kondo/macros/common.clj

@@ -1,5 +0,0 @@
-(ns macros.common
-  "Helpers for common Metabase macro shapes so we don't have to define the same macroexpansions over and over.")
-
-(defn ignore-unused [symb]
-  (vary-meta symb assoc :clj-kondo/ignore [:unused-binding]))

.clj-kondo/macros/metabase/api/card_test.clj

@@ -1,12 +0,0 @@
-(ns macros.metabase.api.card-test
-  (:require [macros.common]))
-
-(defmacro with-ordered-items
-  [collection model-and-name-syms & body]
-  `(let ~(into []
-               (comp (partition-all 2)
-                     (mapcat (fn [[model binding]]
-                               [(macros.common/ignore-unused binding) model])))
-               model-and-name-syms)
-     ~collection
-     ~@body))

.clj-kondo/macros/metabase/api/collection_test.clj

@@ -1,17 +0,0 @@
-(ns macros.metabase.api.collection-test
-  (:require [macros.common]))
-
-(defmacro with-collection-hierarchy! [bindings & body]
-  `(let [~(macros.common/ignore-unused 'a) nil
-         ~(macros.common/ignore-unused 'b) nil
-         ~(macros.common/ignore-unused 'c) nil
-         ~(macros.common/ignore-unused 'd) nil
-         ~(macros.common/ignore-unused 'e) nil
-         ~(macros.common/ignore-unused 'f) nil
-         ~(macros.common/ignore-unused 'g) nil]
-     ~bindings
-     ~@body))
-
-(defmacro with-some-children-of-collection! [collection-or-id-or-nil & body]
-  `(let [~(macros.common/ignore-unused '&ids) ~collection-or-id-or-nil]
-     ~@body))

.clj-kondo/macros/metabase/api/embed_test.clj

@@ -1,13 +0,0 @@
-(ns macros.metabase.api.embed-test)
-
-(defmacro with-embedding-enabled-and-temp-card-referencing!
-  [table-kw field-kw [card-binding] & body]
-  `(let [~card-binding [~table-kw ~field-kw]]
-     ~@body))
-
-(defmacro with-embedding-enabled-and-temp-dashcard-referencing!
-  [table-kw field-kw [dash-binding card-binding dashcard-binding] & body]
-  `(let [~dash-binding             [~table-kw ~field-kw]
-         ~(or card-binding '_)     nil
-         ~(or dashcard-binding '_) nil]
-     ~@body))

.clj-kondo/macros/metabase/collections/api_test.clj

@@ -0,0 +1,24 @@
+(ns macros.metabase.collections.api-test)
+
+(defmacro with-collection-hierarchy! [bindings & body]
+  `(let [~'a nil
+         ~'b nil
+         ~'c nil
+         ~'d nil
+         ~'e nil
+         ~'f nil
+         ~'g nil]
+     ~'a
+     ~'b
+     ~'c
+     ~'d
+     ~'e
+     ~'f
+     ~'g
+     ~bindings
+     ~@body))
+
+(defmacro with-some-children-of-collection! [collection-or-id-or-nil & body]
+  `(let [~'&ids ~collection-or-id-or-nil]
+     ~'&ids
+     ~@body))

.clj-kondo/macros/metabase/embedding/api/embed_test.clj

@@ -0,0 +1,13 @@
+(ns macros.metabase.embedding.api.embed-test)
+
+(defmacro with-embedding-enabled-and-temp-card-referencing!
+  [table-kw field-kw [card-binding] & body]
+  `(let [~card-binding [~table-kw ~field-kw]]
+     ~@body))
+
+(defmacro with-embedding-enabled-and-temp-dashcard-referencing!
+  [table-kw field-kw [dash-binding card-binding dashcard-binding] & body]
+  `(let [~dash-binding             [~table-kw ~field-kw]
+         ~(or card-binding '_)     nil
+         ~(or dashcard-binding '_) nil]
+     ~@body))

.clj-kondo/macros/metabase/models/params/chain_filter_test.clj

@@ -1,4 +0,0 @@
-(ns macros.metabase.models.params.chain-filter-test)
-
-(defmacro chain-filter [& _]
-  `(metabase.models.params.chain-filter/chain-filter nil nil))

.clj-kondo/macros/metabase/models/query_analysis_test.clj

@@ -1,9 +0,0 @@
-(ns macros.metabase.models.query-analysis-test
-  (:require [macros.common]))
-
-(defmacro with-test-setup [& body]
-  `(let [~(macros.common/ignore-unused 'card-id)  1
-         ~(macros.common/ignore-unused 'table-id) 2
-         ~(macros.common/ignore-unused 'tax-id)   3
-         ~(macros.common/ignore-unused 'total-id) 4]
-     ~@body))

.clj-kondo/macros/metabase/models/user_test.clj

@@ -1,9 +0,0 @@
-(ns macros.metabase.models.user-test)
-
-(defmacro with-groups [bindings & body]
-  `(let ~(into []
-              (comp (partition-all 3)
-                    (mapcat (fn [[group-binding properties members]]
-                              [group-binding [properties members]])))
-              bindings)
-     ~@body))

.clj-kondo/macros/metabase/parameters/chain_filter_test.clj

@@ -0,0 +1,4 @@
+(ns macros.metabase.parameters.chain-filter-test)
+
+(defmacro chain-filter [& _]
+  `(metabase.parameters.chain-filter/chain-filter nil nil))

.clj-kondo/macros/metabase/queries/api/card_test.clj

@@ -0,0 +1,13 @@
+(ns macros.metabase.queries.api.card-test)
+
+(defmacro with-ordered-items
+  [collection model-and-name-syms & body]
+  `(let ~(into []
+               (comp (partition-all 2)
+                     (mapcat (fn [[model binding]]
+                               [binding model])))
+               model-and-name-syms)
+     ~collection
+     ~@(->> (partition-all 2 model-and-name-syms)
+            (map second))
+     ~@body))

.clj-kondo/macros/metabase/query_analysis/models/query_analysis_test.clj

@@ -0,0 +1,12 @@
+(ns macros.metabase.query-analysis.models.query-analysis-test)
+
+(defmacro with-test-setup [& body]
+  `(let [~'card-id  1
+         ~'table-id 2
+         ~'tax-id   3
+         ~'total-id 4]
+     ~'card-id
+     ~'table-id
+     ~'tax-id
+     ~'total-id
+     ~@body))

.clj-kondo/macros/metabase/query_analysis/task/test_setup.clj

@@ -1,13 +1,18 @@
-(ns macros.metabase.query-analysis.task.test-setup
-  (:require [macros.common]))
+(ns macros.metabase.query-analysis.task.test-setup)
 
 (defmacro with-test-setup!
   "Set up the data required to test the Query Analysis related tasks"
   [& body]
-  `(let [~(macros.common/ignore-unused 'c1) 1
-         ~(macros.common/ignore-unused 'c2) 2
-         ~(macros.common/ignore-unused 'c3) 3
-         ~(macros.common/ignore-unused 'c4) 4
-         ~(macros.common/ignore-unused 'archived) 5
-         ~(macros.common/ignore-unused 'invalid) 6]
+  `(let [~'c1 1
+         ~'c2 2
+         ~'c3 3
+         ~'c4 4
+         ~'archived 5
+         ~'invalid 6]
+     ~'c1
+     ~'c2
+     ~'c3
+     ~'c4
+     ~'archived
+     ~'invalid
      ~@body))

.clj-kondo/macros/metabase/server/statistics_handler_test.clj

@@ -0,0 +1,9 @@
+(ns macros.metabase.server.statistics-handler-test)
+
+(defmacro with-server
+  [_ _ [connector chan-start-handle chan-finish-handle chan-done-request] & body]
+  `(let [~connector          nil
+         ~chan-start-handle  nil
+         ~chan-finish-handle nil
+         ~chan-done-request  nil]
+     ~@body))

.clj-kondo/macros/metabase/users/models/user_test.clj

@@ -0,0 +1,9 @@
+(ns macros.metabase.users.models.user-test)
+
+(defmacro with-groups! [bindings & body]
+  `(let ~(into []
+               (comp (partition-all 3)
+                     (mapcat (fn [[group-binding properties members]]
+                               [group-binding [properties members]])))
+               bindings)
+     ~@body))

.clj-kondo/macros/metabase/xrays/related_test.clj

@@ -1,13 +1,20 @@
-(ns macros.metabase.xrays.related-test
-  (:require [macros.common]))
+(ns macros.metabase.xrays.related-test)
 
 (defmacro with-world [& body]
-  `(let [~(macros.common/ignore-unused 'collection-id) nil
-         ~(macros.common/ignore-unused 'metric-id-a) nil
-         ~(macros.common/ignore-unused 'metric-id-b) nil
-         ~(macros.common/ignore-unused 'segment-id-a) nil
-         ~(macros.common/ignore-unused 'segment-id-b) nil
-         ~(macros.common/ignore-unused 'card-id-a) nil
-         ~(macros.common/ignore-unused 'card-id-b) nil
-         ~(macros.common/ignore-unused 'card-id-c) nil]
+  `(let [~'collection-id nil
+         ~'metric-id-a nil
+         ~'metric-id-b nil
+         ~'segment-id-a nil
+         ~'segment-id-b nil
+         ~'card-id-a nil
+         ~'card-id-b nil
+         ~'card-id-c nil]
+     ~'collection-id
+     ~'metric-id-a
+     ~'metric-id-b
+     ~'segment-id-a
+     ~'segment-id-b
+     ~'card-id-a
+     ~'card-id-b
+     ~'card-id-c
      ~@body))

.clj-kondo/macros/metabase_enterprise/advanced_permissions/api/util_test.clj

@@ -1,6 +0,0 @@
-(ns macros.metabase-enterprise.advanced-permissions.api.util-test
-  (:require [macros.common]))
-
-(defmacro with-impersonations! [impersonations-and-attributes-map & body]
-  `(let [~(macros.common/ignore-unused '&group) ~impersonations-and-attributes-map]
-     ~@body))

.clj-kondo/macros/metabase_enterprise/database_routing/e2e_test.clj

@@ -0,0 +1,5 @@
+(ns macros.metabase-enterprise.database-routing.e2e-test)
+
+(defmacro with-temp-dbs! [bindings & body]
+  `(let [~@(interleave bindings (repeat nil))]
+     ~@body))

.clj-kondo/macros/metabase_enterprise/impersonation/util_test.clj

@@ -0,0 +1,6 @@
+(ns macros.metabase-enterprise.impersonation.util-test)
+
+(defmacro with-impersonations! [impersonations-and-attributes-map & body]
+  `(let [~'&group ~impersonations-and-attributes-map]
+     ~'&group
+     ~@body))

.clj-kondo/macros/metabase_enterprise/query_reference_validation/api_test.clj

@@ -1,12 +1,18 @@
-(ns macros.metabase-enterprise.query-reference-validation.api-test
-  (:require [macros.common]))
+(ns macros.metabase-enterprise.query-reference-validation.api-test)
 
 (defmacro with-test-setup! [& body]
-  `(let [~(macros.common/ignore-unused 'card-1) 1
-         ~(macros.common/ignore-unused 'card-2) 2
-         ~(macros.common/ignore-unused 'card-3) 3
-         ~(macros.common/ignore-unused 'card-4) 4
-         ~(macros.common/ignore-unused 'card-5) 5
-         ~(macros.common/ignore-unused 'coll-2) 100
-         ~(macros.common/ignore-unused 'coll-3) 200]
+  `(let [~'card-1 1
+         ~'card-2 2
+         ~'card-3 3
+         ~'card-4 4
+         ~'card-5 5
+         ~'coll-2 100
+         ~'coll-3 200]
+     ~'card-1
+     ~'card-2
+     ~'card-3
+     ~'card-4
+     ~'card-5
+     ~'coll-2
+     ~'coll-3
      ~@body))

.clj-kondo/macros/metabase_enterprise/sandbox/test_util.clj

@@ -1,6 +1,6 @@
-(ns macros.metabase-enterprise.sandbox.test-util
-  (:require [macros.common]))
+(ns macros.metabase-enterprise.sandbox.test-util)
 
 (defmacro with-gtaps! [gtaps-definition & body]
-  `(let [~(macros.common/ignore-unused '&group) ~gtaps-definition]
+  `(let [~'&group ~gtaps-definition]
+     ~'&group
      ~@body))

.clj-kondo/macros/metabase_enterprise/serialization/test_util.clj

@@ -1,59 +1,112 @@
-(ns macros.metabase-enterprise.serialization.test-util
-  (:require [macros.common]))
+(ns macros.metabase-enterprise.serialization.test-util)
 
 (defmacro with-world [& body]
-  `(let [~(macros.common/ignore-unused 'db-id)                        nil
-         ~(macros.common/ignore-unused 'table-id)                     nil
-         ~(macros.common/ignore-unused 'table)                        nil
-         ~(macros.common/ignore-unused 'table-id-categories)          nil
-         ~(macros.common/ignore-unused 'table-id-users)               nil
-         ~(macros.common/ignore-unused 'table-id-checkins)            nil
-         ~(macros.common/ignore-unused 'venues-pk-field-id)           nil
-         ~(macros.common/ignore-unused 'numeric-field-id)             nil
-         ~(macros.common/ignore-unused 'name-field-id)                nil
-         ~(macros.common/ignore-unused 'latitude-field-id)            nil
-         ~(macros.common/ignore-unused 'longitude-field-id)           nil
-         ~(macros.common/ignore-unused 'category-field-id)            nil
-         ~(macros.common/ignore-unused 'category-pk-field-id)         nil
-         ~(macros.common/ignore-unused 'date-field-id)                nil
-         ~(macros.common/ignore-unused 'users-pk-field-id)            nil
-         ~(macros.common/ignore-unused 'user-id-field-id)             nil
-         ~(macros.common/ignore-unused 'checkins->venues-field-id)    nil
-         ~(macros.common/ignore-unused 'last-login-field-id)          nil
-         ~(macros.common/ignore-unused 'collection-id)                nil
-         ~(macros.common/ignore-unused 'collection-id-nested)         nil
-         ~(macros.common/ignore-unused 'user-id-temp)                 nil
-         ~(macros.common/ignore-unused 'personal-collection-id)       nil
-         ~(macros.common/ignore-unused 'pc-felicia-nested-id)         nil
-         ~(macros.common/ignore-unused 'pc-nested-id)                 nil
-         ~(macros.common/ignore-unused 'pc-deeply-nested-id)          nil
-         ~(macros.common/ignore-unused 'metric-id)                    nil
-         ~(macros.common/ignore-unused 'segment-id)                   nil
-         ~(macros.common/ignore-unused 'dashboard-id)                 nil
-         ~(macros.common/ignore-unused 'root-dashboard-id)            nil
-         ~(macros.common/ignore-unused 'card-id)                      nil
-         ~(macros.common/ignore-unused 'card-arch-id)                 nil
-         ~(macros.common/ignore-unused 'card-id-root)                 nil
-         ~(macros.common/ignore-unused 'card-id-nested)               nil
-         ~(macros.common/ignore-unused 'card-id-nested-query)         nil
-         ~(macros.common/ignore-unused 'card-id-native-query)         nil
-         ~(macros.common/ignore-unused 'card-id-pivot-table)          nil
-         ~(macros.common/ignore-unused 'dashcard-id)                  nil
-         ~(macros.common/ignore-unused 'dashcard-top-level-click-id)  nil
-         ~(macros.common/ignore-unused 'dashcard-with-click-actions)  nil
-         ~(macros.common/ignore-unused 'dashcard-with-textbox-id)     nil
-         ~(macros.common/ignore-unused 'card-id-root-to-collection)   nil
-         ~(macros.common/ignore-unused 'card-id-collection-to-root)   nil
-         ~(macros.common/ignore-unused 'pulse-id)                     nil
-         ~(macros.common/ignore-unused 'pulsecard-root-id)            nil
-         ~(macros.common/ignore-unused 'pulsecard-collection-id)      nil
-         ~(macros.common/ignore-unused 'card-id-template-tags)        nil
-         ~(macros.common/ignore-unused 'card-id-filter-agg)           nil
-         ~(macros.common/ignore-unused 'card-id-temporal-unit)        nil
-         ~(macros.common/ignore-unused 'snippet-id)                   nil
-         ~(macros.common/ignore-unused 'snippet-collection-id)        nil
-         ~(macros.common/ignore-unused 'snippet-nested-collection-id) nil
-         ~(macros.common/ignore-unused 'nested-snippet-id)            nil
-         ~(macros.common/ignore-unused 'card-id-with-native-snippet)  nil
-         ~(macros.common/ignore-unused 'card-join-card-id)            nil]
+  `(let [~'db-id                        nil
+         ~'table-id                     nil
+         ~'table                        nil
+         ~'table-id-categories          nil
+         ~'table-id-users               nil
+         ~'table-id-checkins            nil
+         ~'venues-pk-field-id           nil
+         ~'numeric-field-id             nil
+         ~'name-field-id                nil
+         ~'latitude-field-id            nil
+         ~'longitude-field-id           nil
+         ~'category-field-id            nil
+         ~'category-pk-field-id         nil
+         ~'date-field-id                nil
+         ~'users-pk-field-id            nil
+         ~'user-id-field-id             nil
+         ~'checkins->venues-field-id    nil
+         ~'last-login-field-id          nil
+         ~'collection-id                nil
+         ~'collection-id-nested         nil
+         ~'user-id-temp                 nil
+         ~'personal-collection-id       nil
+         ~'pc-felicia-nested-id         nil
+         ~'pc-nested-id                 nil
+         ~'pc-deeply-nested-id          nil
+         ~'metric-id                    nil
+         ~'segment-id                   nil
+         ~'dashboard-id                 nil
+         ~'root-dashboard-id            nil
+         ~'card-id                      nil
+         ~'card-arch-id                 nil
+         ~'card-id-root                 nil
+         ~'card-id-nested               nil
+         ~'card-id-nested-query         nil
+         ~'card-id-native-query         nil
+         ~'card-id-pivot-table          nil
+         ~'dashcard-id                  nil
+         ~'dashcard-top-level-click-id  nil
+         ~'dashcard-with-click-actions  nil
+         ~'dashcard-with-textbox-id     nil
+         ~'card-id-root-to-collection   nil
+         ~'card-id-collection-to-root   nil
+         ~'pulse-id                     nil
+         ~'pulsecard-root-id            nil
+         ~'pulsecard-collection-id      nil
+         ~'card-id-template-tags        nil
+         ~'card-id-filter-agg           nil
+         ~'card-id-temporal-unit        nil
+         ~'snippet-id                   nil
+         ~'snippet-collection-id        nil
+         ~'snippet-nested-collection-id nil
+         ~'nested-snippet-id            nil
+         ~'card-id-with-native-snippet  nil
+         ~'card-join-card-id            nil]
+     ~'db-id
+     ~'table-id
+     ~'table
+     ~'table-id-categories
+     ~'table-id-users
+     ~'table-id-checkins
+     ~'venues-pk-field-id
+     ~'numeric-field-id
+     ~'name-field-id
+     ~'latitude-field-id
+     ~'longitude-field-id
+     ~'category-field-id
+     ~'category-pk-field-id
+     ~'date-field-id
+     ~'users-pk-field-id
+     ~'user-id-field-id
+     ~'checkins->venues-field-id
+     ~'last-login-field-id
+     ~'collection-id
+     ~'collection-id-nested
+     ~'user-id-temp
+     ~'personal-collection-id
+     ~'pc-felicia-nested-id
+     ~'pc-nested-id
+     ~'pc-deeply-nested-id
+     ~'metric-id
+     ~'segment-id
+     ~'dashboard-id
+     ~'root-dashboard-id
+     ~'card-id
+     ~'card-arch-id
+     ~'card-id-root
+     ~'card-id-nested
+     ~'card-id-nested-query
+     ~'card-id-native-query
+     ~'card-id-pivot-table
+     ~'dashcard-id
+     ~'dashcard-top-level-click-id
+     ~'dashcard-with-click-actions
+     ~'dashcard-with-textbox-id
+     ~'card-id-root-to-collection
+     ~'card-id-collection-to-root
+     ~'pulse-id
+     ~'pulsecard-root-id
+     ~'pulsecard-collection-id
+     ~'card-id-template-tags
+     ~'card-id-filter-agg
+     ~'card-id-temporal-unit
+     ~'snippet-id
+     ~'snippet-collection-id
+     ~'snippet-nested-collection-id
+     ~'nested-snippet-id
+     ~'card-id-with-native-snippet
+     ~'card-join-card-id
      ~@body))

.clj-kondo/src/hooks/clojure/core/ns.clj

@@ -1,6 +1,7 @@
 (ns hooks.clojure.core.ns
   (:require
    [clj-kondo.hooks-api :as hooks]
+   [clojure.string :as str]
    [hooks.common]
    [hooks.common.modules :as modules]))
 
@@ -59,12 +60,15 @@
                     (printf "Don't know how to figure out what namespace is being required in %s\n" (pr-str node)))))
           args)))
 
+(defn- ns-form-node->ns-symb-node [ns-form-node]
+  (some (fn [node]
+          (when (and (hooks/token-node? node)
+                     (not= (hooks/sexpr node) 'ns))
+            node))
+        (:children ns-form-node)))
+
 (defn- ns-form-node->ns-symb [ns-form-node]
-  (some-> (some (fn [node]
-                  (when (and (hooks/token-node? node)
-                             (not= (hooks/sexpr node) 'ns))
-                    node))
-                (:children ns-form-node))
+  (some-> (ns-form-node->ns-symb-node ns-form-node)
           hooks/sexpr))
 
 (defn- lint-modules [ns-form-node config]
@@ -83,9 +87,34 @@
                                        :message error
                                        :type    :metabase/modules))))))))
 
+(defn- lint-namespace-name [ns-form-node]
+ ; NOCOMMIT
+  (when-let [ns-symb-node (ns-form-node->ns-symb-node ns-form-node)]
+    (when-not (contains? (hooks.common/ignored-linters ns-symb-node) :metabase/namespace-name)
+      (let [parts (str/split (str (hooks/sexpr ns-symb-node)) #"\.")]
+        (when (and (<= (count parts) 2)
+                   (#{"metabase" "metabase-enterprise"} (first parts))
+                   ;; exclude test namespaces for now
+                   (not (str/ends-with? (last parts) "test")))
+          (hooks/reg-finding! (assoc (meta ns-symb-node)
+                                     :message "Metabase namespaces should have the form metabase[-enterprise].<module>.* [:metabase/namespace-name]"
+                                     :type    :metabase/namespace-name)))))))
+
 (defn lint-ns [x]
   (doto (:node x)
     lint-require-shapes
     lint-requires-on-new-lines
-    (lint-modules (modules/config x)))
+    (lint-modules (modules/config x))
+    lint-namespace-name)
   x)
+
+(comment
+  (lint-ns
+   {:node (hooks/parse-string
+           (pr-str
+            '(ns hooks.clojure.core.ns
+               (:require
+                [clj-kondo.hooks-api :as hooks]
+                [clojure.string :as str]
+                [hooks.common]
+                [hooks.common.modules :as modules]))))}))

.clj-kondo/src/hooks/metabase/app_db/schema_migrations_test/impl.clj

@@ -0,0 +1,14 @@
+(ns hooks.metabase.app-db.schema-migrations-test.impl
+  (:require [clj-kondo.hooks-api :as hooks]))
+
+(defn test-migrations
+  [{{[_ migration-range {[binding] :children} & body] :children} :node}]
+  (let [node* (hooks/list-node
+               (list*
+                (hooks/token-node `let)
+                (hooks/vector-node
+                 [binding (hooks/list-node (list (hooks/token-node `fn)
+                                                 (hooks/vector-node [(hooks/token-node '&) (hooks/token-node '_args)])))])
+                migration-range
+                body))]
+    {:node node*}))

.clj-kondo/src/hooks/metabase/db/schema_migrations_test/impl.clj

@@ -1,14 +0,0 @@
-(ns hooks.metabase.db.schema-migrations-test.impl
-  (:require [clj-kondo.hooks-api :as hooks]))
-
-(defn test-migrations
-  [{{[_ migration-range {[binding] :children} & body] :children} :node}]
-  (let [node* (hooks/list-node
-               (list*
-                (hooks/token-node `let)
-                (hooks/vector-node
-                 [binding (hooks/list-node (list (hooks/token-node `fn)
-                                                 (hooks/vector-node [(hooks/token-node '&) (hooks/token-node '_args)])))])
-                migration-range
-                body))]
-    {:node node*}))

.clj-kondo/src/hooks/metabase/models/setting.clj

@@ -1,294 +0,0 @@
-(ns hooks.metabase.models.setting
-  (:require
-   [clj-kondo.hooks-api :as hooks]
-   [hooks.common :as common]))
-
-;;; TODO -- move this into
-(def ^:private ignored-implicit-export?
-  '#{active-users-count
-     admin-email
-     analytics-uuid
-     anon-tracking-enabled
-     api-key
-     attachment-table-row-limit
-     audit-max-retention-days
-     bcc-enabled?
-     breakout-bin-width
-     check-for-updates
-     cloud-gateway-ips
-     config-from-file-sync-databases
-     custom-homepage
-     custom-homepage-dashboard
-     database-enable-actions
-     deprecation-notice-version
-     dismissed-custom-dashboard-toast
-     dismissed-onboarding-sidebar-link
-     email-configured?
-     email-from-address
-     email-from-name
-     email-reply-to
-     email-smtp-host
-     email-smtp-password
-     email-smtp-port
-     email-smtp-security
-     email-smtp-username
-     embedding-app-origin
-     embedding-secret-key
-     enable-password-login
-     enable-public-sharing
-     enable-query-caching
-     engines
-     enum-cardinality-threshold
-     follow-up-email-sent
-     google-auth-auto-create-accounts-domain
-     google-auth-client-id
-     google-auth-configured
-     google-auth-enabled
-     has-sample-database?
-     has-user-setup
-     help-link
-     help-link-custom-destination
-     instance-creation
-     is-hosted?
-     is-metabot-enabled
-     jdbc-data-warehouse-max-connection-pool-size
-     jdbc-data-warehouse-unreturned-connection-timeout-seconds
-     jwt-attribute-email
-     jwt-attribute-firstname
-     jwt-attribute-groups
-     jwt-attribute-lastname
-     jwt-configured
-     jwt-enabled
-     jwt-group-mappings
-     jwt-group-sync
-     jwt-identity-provider-uri
-     jwt-user-provisioning-enabled?
-     jwt-shared-secret
-     last-acknowledged-version
-     last-used-native-database-id
-     ldap-attribute-email
-     ldap-attribute-firstname
-     ldap-attribute-lastname
-     ldap-bind-dn
-     ldap-configured?
-     ldap-enabled
-     ldap-group-base
-     ldap-group-mappings
-     ldap-group-membership-filter
-     ldap-group-sync
-     ldap-host
-     ldap-password
-     ldap-port
-     ldap-user-provisioning-enabled?
-     ldap-security
-     ldap-sync-user-attributes
-     ldap-sync-user-attributes-blacklist
-     ldap-user-base
-     ldap-user-filter
-     load-analytics-content
-     map-tile-server-url
-     metabot-default-embedding-model
-     metabot-feedback-url
-     metabot-get-prompt-templates-url
-     metabot-prompt-generator-token-limit
-     multi-setting-read-only
-     notebook-native-preview-shown
-     notebook-native-preview-sidebar-width
-     notification-link-base-url
-     num-metabot-choices
-     openai-api-key
-     openai-available-models
-     openai-model
-     openai-organization
-     other-sso-enabled?
-     password-complexity
-     persist-models-enabled
-     persisted-model-refresh-cron-schedule
-     premium-embedding-token
-     prometheus-server-port
-     query-caching-max-kb
-     query-caching-max-ttl
-     query-caching-min-ttl
-     query-caching-ttl-ratio
-     redirect-all-requests-to-https
-     reset-token-ttl-hours
-     retired-setting
-     retry-initial-interval
-     retry-max-attempts
-     retry-max-interval-millis
-     retry-multiplier
-     retry-randomization-factor
-     saml-application-name
-     saml-attribute-email
-     saml-attribute-firstname
-     saml-attribute-group
-     saml-attribute-lastname
-     saml-configured
-     saml-enabled
-     saml-group-mappings
-     saml-group-sync
-     saml-identity-provider-certificate
-     saml-identity-provider-issuer
-     saml-identity-provider-uri
-     saml-keystore-alias
-     saml-keystore-password
-     saml-keystore-path
-     saml-user-provisioning-enabled?
-     send-email-on-first-login-from-new-device
-     send-new-sso-user-admin-email?
-     session-cookie-samesite
-     session-cookies
-     session-timeout
-     setup-token
-     show-database-syncing-modal
-     show-metabase-links
-     site-url
-     site-uuid
-     site-uuid-for-premium-features-token-checks
-     site-uuid-for-unsubscribing-url
-     site-uuid-for-version-info-fetching
-     slack-app-token
-     slack-cached-channels-and-usernames
-     slack-channels-and-usernames-last-updated
-     slack-files-channel
-     slack-token
-     slack-token-valid?
-     snowplow-available
-     snowplow-enabled
-     snowplow-url
-     sql-jdbc-fetch-size
-     ssh-heartbeat-interval-sec
-     ssl-certificate-public-key
-     startup-time-millis
-     token-features
-     token-status
-     toucan-name
-     trial-banner-dismissal-timestamp
-     uncached-setting
-     user-visibility
-     version
-     version-info
-     version-info-last-checked})
-
-(defn- defsetting-lint [node setting-name docstring options-list]
-  (let [anon-binding (common/with-macro-meta (hooks/token-node '_) node)
-        ;; (defn my-setting [] ...)
-        getter-node (-> (list
-                         (hooks/token-node 'defn)
-                         setting-name
-                         (hooks/string-node "Docstring.")
-                         (hooks/vector-node []))
-                        hooks/list-node
-                        (with-meta (meta node)))
-        ;; (defn my-setting! [_x] ...)
-        setter-node (-> (list
-                         (hooks/token-node 'defn)
-                         (with-meta
-                          (hooks/token-node (symbol (str (hooks/sexpr setting-name) \!)))
-                          (meta setting-name))
-                         (hooks/string-node "Docstring.")
-                         (hooks/vector-node [(hooks/token-node '_value-or-nil)]))
-                        hooks/list-node
-                        (with-meta (meta node))
-                        common/add-lsp-ignore-unused-public-var-metadata)]
-
-    (when (nil? (second (drop-while (comp not #{[:k :export?]} first) options-list)))
-      (when-not (contains? ignored-implicit-export? (:value setting-name))
-        (hooks/reg-finding! (assoc (meta node)
-                                   :message "Setting definition must provide an explicit value for :export? indicating whether the setting should be exported or not with serialization."
-                                   :type :metabase/defsetting-must-specify-export))))
-
-    {:node (-> (hooks/list-node
-                (list
-                 (hooks/token-node 'let)
-                 ;; include description and the options map so they can get validated as well.
-                 (hooks/vector-node
-                  [anon-binding docstring
-                   anon-binding (hooks/map-node options-list)])
-                 (hooks/reg-keyword! (-> (hooks/keyword-node (keyword (hooks/sexpr setting-name)))
-                                         (with-meta (meta setting-name)))
-                                     'metabase.models.setting/defsetting)
-                 getter-node
-                 setter-node))
-               (with-meta (meta node)))}))
-
-(defn defsetting
-  "Rewrite a [[metabase.models.defsetting]] form like
-
-    (defsetting my-setting \"Description\" :type :boolean)
-
-  as
-
-    (let [_ \"Description\"
-          _ {:type :boolean}]
-      (defn my-setting \"Docstring.\" [])
-      (defn my-setting! \"Docstring.\" [_value-or-nil]))
-
-  for linting purposes."
-  [{:keys [node], :as context}]
-  (let [[setting-name docstring & options] (rest (:children node))]
-    (merge
-     context
-     (defsetting-lint node setting-name docstring options))))
-
-(defn define-multi-setting
-  "Rewrite a [[metabase.models.define-multi-setting]] form like
-
-    (defsetting my-setting \"Description\" :key :type :boolean)
-
-  as
-
-    (let [_ \"Description\"
-          _ {:type :boolean, :multi-thunk :key}]
-      (defn my-setting \"Docstring.\" [])
-      (defn my-setting! \"Docstring.\" [_value-or-nil]))
-
-  for linting purposes."
-  [{:keys [node], :as context}]
-  (let [[setting-name docstring thunk & options] (rest (:children node))]
-    (merge
-     context
-     (defsetting-lint node setting-name docstring (concat options [(hooks/token-node :multi-thunk) thunk])))))
-
-(defn define-multi-setting-impl
-  [context]
-  (letfn [(update-node [node]
-            (let [[_define-multi-setting-impl setting-name & more] (:children node)]
-              (-> (hooks/list-node
-                   (list*
-                    (hooks/token-node 'do)
-                    ;; For a qualified setting name like `oss-namespace/setting`, then leave the symbol as is, so the
-                    ;; usage of that namespace/var gets recorded. Otherwise for an unqualified name convert it to a
-                    ;; keyword so we don't get unresolved var errors.
-                    (if (and (hooks/token-node? setting-name)
-                             (qualified-symbol? (hooks/sexpr setting-name)))
-                      setting-name
-                      (-> (hooks/keyword-node (keyword (hooks/sexpr setting-name)))
-                          (with-meta (meta setting-name))))
-                    more))
-                  (with-meta (meta node)))))]
-    (update context :node update-node)))
-
-(comment
-  (defn- defsetting* [form]
-    (hooks/sexpr
-     (:node
-      (defsetting
-        {:node
-         (hooks/parse-string
-          (with-out-str
-            #_{:clj-kondo/ignore [:unresolved-namespace]}
-            (clojure.pprint/pprint
-             form)))}))))
-
-  (defn x []
-    (defsetting*
-      '(defsetting active-users-count
-         (deferred-tru "Cached number of active users. Refresh every 5 minutes.")
-         :visibility :admin
-         :type       :integer
-         :default    0
-         :getter     (fn []
-                       (if-not ((requiring-resolve 'metabase.db/db-is-set-up?))
-                         0
-                         (cached-active-users-count)))))))

.clj-kondo/src/hooks/metabase/settings/models/setting.clj

@@ -0,0 +1,309 @@
+(ns hooks.metabase.settings.models.setting
+  (:require
+   [clj-kondo.hooks-api :as hooks]
+   [hooks.common :as common]))
+
+(defn lint-defsetting-namespace [node context]
+  (when-not (re-matches #"^metabase(?:-enterprise)?\.[^\.]+\.settings$" (name (:ns context)))
+    (hooks/reg-finding! (assoc (meta node)
+                               :message "All defsettings should live in metabase[-enterprise].<module>.settings namespaces"
+                               :type :metabase/defsetting-namespace))))
+
+;;; TODO -- move this into a Kondo config file in `.clj-kondo/config/`
+(def ^:private ignored-implicit-export?
+  '#{active-users-count
+     admin-email
+     analytics-uuid
+     anon-tracking-enabled
+     api-key
+     attachment-table-row-limit
+     audit-max-retention-days
+     bcc-enabled?
+     breakout-bin-width
+     check-for-updates
+     cloud-gateway-ips
+     config-from-file-sync-databases
+     custom-homepage
+     custom-homepage-dashboard
+     database-enable-actions
+     deprecation-notice-version
+     dismissed-custom-dashboard-toast
+     email-configured?
+     email-from-address
+     email-from-name
+     email-reply-to
+     email-smtp-host
+     email-smtp-password
+     email-smtp-port
+     email-smtp-security
+     email-smtp-username
+     embedding-app-origin
+     embedding-secret-key
+     enable-password-login
+     enable-public-sharing
+     enable-query-caching
+     engines
+     enum-cardinality-threshold
+     follow-up-email-sent
+     google-auth-auto-create-accounts-domain
+     google-auth-client-id
+     google-auth-configured
+     google-auth-enabled
+     has-sample-database?
+     has-user-setup
+     help-link
+     help-link-custom-destination
+     instance-creation
+     is-hosted?
+     is-metabot-enabled
+     jdbc-data-warehouse-max-connection-pool-size
+     jdbc-data-warehouse-unreturned-connection-timeout-seconds
+     jwt-attribute-email
+     jwt-attribute-firstname
+     jwt-attribute-groups
+     jwt-attribute-lastname
+     jwt-configured
+     jwt-enabled
+     jwt-group-mappings
+     jwt-group-sync
+     jwt-identity-provider-uri
+     jwt-user-provisioning-enabled?
+     jwt-shared-secret
+     last-acknowledged-version
+     last-used-native-database-id
+     ldap-attribute-email
+     ldap-attribute-firstname
+     ldap-attribute-lastname
+     ldap-bind-dn
+     ldap-configured?
+     ldap-enabled
+     ldap-group-base
+     ldap-group-mappings
+     ldap-group-membership-filter
+     ldap-group-sync
+     ldap-host
+     ldap-password
+     ldap-port
+     ldap-user-provisioning-enabled?
+     ldap-security
+     ldap-sync-user-attributes
+     ldap-sync-user-attributes-blacklist
+     ldap-user-base
+     ldap-user-filter
+     load-analytics-content
+     map-tile-server-url
+     metabot-default-embedding-model
+     metabot-feedback-url
+     metabot-get-prompt-templates-url
+     metabot-prompt-generator-token-limit
+     multi-setting-read-only
+     notebook-native-preview-shown
+     notebook-native-preview-sidebar-width
+     notification-link-base-url
+     num-metabot-choices
+     openai-api-key
+     openai-available-models
+     openai-model
+     openai-organization
+     other-sso-enabled?
+     password-complexity
+     persist-models-enabled
+     persisted-model-refresh-cron-schedule
+     premium-embedding-token
+     prometheus-server-port
+     query-caching-max-kb
+     query-caching-max-ttl
+     query-caching-min-ttl
+     query-caching-ttl-ratio
+     redirect-all-requests-to-https
+     reset-token-ttl-hours
+     retired-setting
+     retry-initial-interval
+     retry-max-attempts
+     retry-max-interval-millis
+     retry-multiplier
+     retry-randomization-factor
+     saml-application-name
+     saml-attribute-email
+     saml-attribute-firstname
+     saml-attribute-group
+     saml-attribute-lastname
+     saml-configured
+     saml-enabled
+     saml-group-mappings
+     saml-group-sync
+     saml-identity-provider-certificate
+     saml-identity-provider-issuer
+     saml-identity-provider-uri
+     saml-keystore-alias
+     saml-keystore-password
+     saml-keystore-path
+     saml-user-provisioning-enabled?
+     send-email-on-first-login-from-new-device
+     send-new-sso-user-admin-email?
+     session-cookie-samesite
+     session-cookies
+     session-timeout
+     setup-token
+     show-database-syncing-modal
+     show-metabase-links
+     site-url
+     site-uuid
+     site-uuid-for-premium-features-token-checks
+     site-uuid-for-unsubscribing-url
+     site-uuid-for-version-info-fetching
+     slack-app-token
+     slack-cached-channels-and-usernames
+     slack-channels-and-usernames-last-updated
+     slack-files-channel
+     slack-token
+     slack-token-valid?
+     snowplow-available
+     snowplow-enabled
+     snowplow-url
+     sql-jdbc-fetch-size
+     ssh-heartbeat-interval-sec
+     ssl-certificate-public-key
+     startup-time-millis
+     token-features
+     token-status
+     toucan-name
+     trial-banner-dismissal-timestamp
+     uncached-setting
+     user-visibility
+     version
+     version-info
+     version-info-last-checked})
+
+(defn- lint-defsetting-export [node]
+  (let [[_defsetting setting-name _docstring & options] (:children node)]
+    (when (nil? (second (drop-while (comp not #{[:k :export?]} first) options)))
+      (when-not (contains? ignored-implicit-export? (:value setting-name))
+        (hooks/reg-finding! (assoc (meta node)
+                                   :message "Setting definition must provide an explicit value for :export? indicating whether the setting should be exported or not with serialization."
+                                   :type :metabase/defsetting-must-specify-export))))))
+
+(defn- defsetting-replacement-node [node]
+  (let [[_defsetting setting-name docstring & options-list] (:children node)
+        anon-binding (common/with-macro-meta (hooks/token-node '_) node)
+        ;; (defn my-setting [] ...)
+        getter-node (-> (list
+                         (hooks/token-node 'defn)
+                         setting-name
+                         (hooks/string-node "Docstring.")
+                         (hooks/vector-node []))
+                        hooks/list-node
+                        (with-meta (meta node)))
+        ;; (defn my-setting! [_x] ...)
+        setter-node (-> (list
+                         (hooks/token-node 'defn)
+                         (with-meta
+                          (hooks/token-node (symbol (str (hooks/sexpr setting-name) \!)))
+                          (meta setting-name))
+                         (hooks/string-node "Docstring.")
+                         (hooks/vector-node [(hooks/token-node '_value-or-nil)]))
+                        hooks/list-node
+                        (with-meta (meta node))
+                        common/add-lsp-ignore-unused-public-var-metadata)]
+    (-> (hooks/list-node
+         (list
+          (hooks/token-node 'let)
+          ;; include description and the options map so they can get validated as well.
+          (hooks/vector-node
+           [anon-binding docstring
+            anon-binding (hooks/map-node options-list)])
+          (hooks/reg-keyword! (-> (hooks/keyword-node (keyword (hooks/sexpr setting-name)))
+                                  (with-meta (meta setting-name)))
+                              'metabase.settings.models.setting/defsetting)
+          getter-node
+          setter-node))
+        (with-meta (meta node)))))
+
+(defn defsetting
+  "Rewrite a [[metabase.models.defsetting]] form like
+
+    (defsetting my-setting \"Description\" :type :boolean)
+
+  as
+
+    (let [_ \"Description\"
+          _ {:type :boolean}]
+      (defn my-setting \"Docstring.\" [])
+      (defn my-setting! \"Docstring.\" [_value-or-nil]))
+
+  for linting purposes."
+  [{:keys [node], :as context}]
+  (lint-defsetting-namespace node context)
+  (lint-defsetting-export node)
+  (update context :node defsetting-replacement-node))
+
+(defn define-multi-setting-replacement-node [node]
+  (let [[defsetting setting-name docstring thunk & options] (:children node)]
+    (-> (hooks/list-node
+         (list*
+          defsetting
+          setting-name
+          docstring
+          (hooks/token-node :multi-thunk) thunk
+          options))
+        (with-meta (meta node))
+        defsetting-replacement-node)))
+
+(defn define-multi-setting
+  "Rewrite a [[metabase.models.define-multi-setting]] form like
+
+    (defsetting my-setting \"Description\" :key :type :boolean)
+
+  as
+
+    (let [_ \"Description\"
+          _ {:type :boolean, :multi-thunk :key}]
+      (defn my-setting \"Docstring.\" [])
+      (defn my-setting! \"Docstring.\" [_value-or-nil]))
+
+  for linting purposes."
+  [{:keys [node], :as context}]
+  (update context :node define-multi-setting-replacement-node))
+
+(defn define-multi-setting-impl
+  [context]
+  (letfn [(update-node [node]
+            (let [[_define-multi-setting-impl setting-name & more] (:children node)]
+              (-> (hooks/list-node
+                   (list*
+                    (hooks/token-node 'do)
+                    ;; For a qualified setting name like `oss-namespace/setting`, then leave the symbol as is, so the
+                    ;; usage of that namespace/var gets recorded. Otherwise for an unqualified name convert it to a
+                    ;; keyword so we don't get unresolved var errors.
+                    (if (and (hooks/token-node? setting-name)
+                             (qualified-symbol? (hooks/sexpr setting-name)))
+                      setting-name
+                      (-> (hooks/keyword-node (keyword (hooks/sexpr setting-name)))
+                          (with-meta (meta setting-name))))
+                    more))
+                  (with-meta (meta node)))))]
+    (update context :node update-node)))
+
+(comment
+  (defn- defsetting* [form]
+    (hooks/sexpr
+     (:node
+      (defsetting
+        {:node
+         (hooks/parse-string
+          (with-out-str
+            #_{:clj-kondo/ignore [:unresolved-namespace]}
+            (clojure.pprint/pprint
+             form)))}))))
+
+  (defn x []
+    (defsetting*
+      '(defsetting active-users-count
+         (deferred-tru "Cached number of active users. Refresh every 5 minutes.")
+         :visibility :admin
+         :type       :integer
+         :default    0
+         :getter     (fn []
+                       (if-not ((requiring-resolve 'metabase.app-db.core/db-is-set-up?))
+                         0
+                         (cached-active-users-count)))))))

.clj-kondo/src/hooks/metabase/test/data.clj

@@ -45,37 +45,35 @@
       :unqualified/unknown)))
 
 (defn dataset
-  [{{[_ dataset & body] :children} :node this-ns :ns}]
-  (let [noop (constantly nil)
-        body (case (dataset-type this-ns dataset)
-               ;; non-symbol, qualified symbols, and unqualified symbols from the current namespace/let-bound can all
-               ;; get converted from something like
-               ;;
-               ;;    (dataset whatever
-               ;;      ...)
-               ;;
-               ;; to
-               ;;
-               ;;    (let [_ whatever]
-               ;;      ...)
-               (:non-symbol :qualified :unqualified/local-def)
-               (list* (hooks/token-node 'let)
-                      (hooks/vector-node [(hooks/token-node '_) dataset])
-                      body)
+  [{{[_ dataset & body] :children, :as node} :node this-ns :ns}]
+  (let [node' (case (dataset-type this-ns dataset)
+                ;; non-symbol, qualified symbols, and unqualified symbols from the current namespace/let-bound can all
+                ;; get converted from something like
+                ;;
+                ;;    (dataset whatever
+                ;;      ...)
+                ;;
+                ;; to
+                ;;
+                ;;    (let [_ whatever]
+                ;;      ...)
+                (:non-symbol :qualified :unqualified/local-def)
+                (hooks/list-node
+                 (list*
+                  (hooks/token-node 'let)
+                  (hooks/vector-node [(hooks/token-node '_) dataset])
+                  body))
 
-               ;; for ones that came from the dataset defs namespace or ones whose origin is unknown, just ignore them
-               ;; and generate a `print` form:
-               ;;
-               ;;    (print ...)
-               ;;
-               ;; (this used to be a `do` form (which makes a lot more semantic sense), but that resulted in warnings
-               ;; about unused values
-               (:unqualified/from-dataset-defs-namespace :unqualified/unknown)
-               (list* (hooks/token-node noop)
-                      body))]
-    {:node (with-meta (hooks/list-node (with-meta body
-                                                  (meta dataset)))
-                      (meta dataset))}))
+                ;; for ones that came from the dataset defs namespace or ones whose origin is unknown, just ignore them
+                ;; and generate a form like
+                ;;
+                ;;    (do ...)
+                (:unqualified/from-dataset-defs-namespace :unqualified/unknown)
+                (hooks/list-node
+                 (list*
+                  (hooks/token-node `do)
+                  body)))]
+    {:node (with-meta node' (meta node))}))
 
 (defn- special-token-node?
   "Whether this node is one of the special symbols like `$field`."

.clj-kondo/src/hooks/metabase/test/gentest.clj

@@ -2,8 +2,8 @@
   (:require
    [clj-kondo.hooks-api :as hooks]))
 
-(defn with-gentest
-  "(with-gentest {:as limit-spec} [s1 val1 & more] body-form body-form...)"
+(defn iterate*
+  "(iterate {:as limit-spec} [s1 val1 & more] body-form body-form...)"
   [{{:keys [children] :as node} :node :as orig}]
   (let [[token limit-spec bindings & body-nodes] children
         node* (-> (hooks/list-node

.clj-kondo/src/hooks/metabase/test/util/generators/jvm.clj

@@ -0,0 +1,15 @@
+(ns hooks.metabase.test.util.generators.jvm
+  (:require
+   [clj-kondo.hooks-api :as hooks]))
+
+(defn with-random-cards
+  "(with-random-cards <metadata-provider> <integer-count-value> & body-forms)"
+  [{{:keys [children] :as node} :node :as orig}]
+  (let [[token num-cards & body-nodes] children
+        node* (-> (hooks/list-node
+                   (list token num-cards
+                         (hooks/list-node (list* (hooks/token-node 'let)
+                                                 (hooks/vector-node [(hooks/token-node '&cards) (hooks/list-node ())])
+                                                 body-nodes))))
+                  (with-meta (meta node)))]
+    (assoc orig :node node*)))

.clj-kondo/src/hooks/metabase/util/i18n.clj

@@ -0,0 +1,74 @@
+(ns hooks.metabase.util.i18n
+  (:require
+   [clj-kondo.hooks-api :as api]
+   [clojure.string :as str]
+   [hooks.common]))
+
+(defn- valid-apostrophes?
+  "Returns true if `s` contains only doubled quotes (''') or complete placeholder-escaping quotes ('{...}'), false otherwise."
+  [s]
+  (loop [chars (seq s)]
+    (if (empty? chars)
+      true
+      (let [c (first chars)]
+        (if (= c \')
+          (cond
+              ;; Doubled quotes: skip both
+            (and (next chars) (= (second chars) \'))
+            (recur (nthrest chars 2))
+
+              ;; Placeholder escape. We allow for intentional escaping, like either '{0}` or '{{`, but not 'arbitrary
+              ;; strings' So basically, just require the *next* character to be a `{`, find the next single-quote, and
+              ;; continue on from there.
+              ;;
+              ;; Technically a string like "foo bar's happy but i'm not" is totally fine, but we'll say it's invalid
+              ;; because... that inner string literal is probably not what we actually want. So since we've never done
+              ;; this intentionally as far as I can tell, let's just remove the possibility to avoid ambiguity.
+            (= (second chars) \{)
+            (let [at-closing (drop-while #(not= \' %) (next chars))]
+              (if (seq at-closing)
+                (recur (next at-closing))
+                false))
+              ;; Unpaired single quote: invalid
+            :else
+            false)
+          (recur (rest chars)))))))
+
+(defn format-str-arg-node->str
+  [node]
+  (cond
+    ;; it's just a string literal
+    (api/string-node? node) (api/sexpr node)
+    ;; it's `(str "some" "strings")`
+    (and (api/list-node? node)
+         (= 'str (api/sexpr (first (:children node))))
+         (every? api/string-node? (rest (:children node))))
+    (apply str (map api/sexpr (rest (:children node))))
+
+    ;; it's something else, no good
+    :else
+    (do
+      (api/reg-finding!
+       (assoc (meta node)
+              :message "Must be a string literal or a call to `str` with string literal arguments."
+              :type :metabase/validate-string-or-str-args-to-i18n))
+      nil)))
+
+(defn strict-apostrophes
+  "Checks the node to make sure it's not a i18n call that will result in dropped apostrophes."
+  [{:keys [node]}]
+  (let [format-str-arg (second (:children node))
+        ;; `format-str-arg` must be either a `"string"` or `(str "a call " "to" "str")` (to allow for splitting long
+        ;; strings into shorter lines)
+        format-str (format-str-arg-node->str format-str-arg)]
+    (when-not (valid-apostrophes? format-str)
+      (api/reg-finding!
+       (assoc (meta node)
+              :message "Format string contains invalid single quote usage. Use '' for literals or '{...}' for escaping."
+              :type :metabase/validate-escaped-single-quotes-in-i18n))))
+  {:node node})
+
+(def tru strict-apostrophes)
+(def trs strict-apostrophes)
+(def deferred-tru strict-apostrophes)
+(def deferred-trs strict-apostrophes)

.clj-kondo/test/hooks/clojure/core/ns_test.clj

@@ -20,15 +20,17 @@
   (lint-ns form (assoc-in config [:linters :metabase/modules :level] :warning)))
 
 (deftest ^:parallel module-checker-allowed-modules-test
-  (is (=? [{:message "Module task should not be used in the api module. [:metabase/modules api :uses]"
-            :type :metabase/modules}]
-          (lint-modules
-           '(ns metabase.api.search
-              (:require
-               [metabase.request.core :as request]
-               [metabase.task :as task]))
-           '{:metabase/modules {api     {:uses #{request}}
-                                request {:api #{metabase.request.core}}}}))))
+  (are [task-namespace] (=? [{:message "Module task should not be used in the api module. [:metabase/modules api :uses]"
+                              :type :metabase/modules}]
+                            (lint-modules
+                             '(ns metabase.api.search
+                                (:require
+                                 [metabase.request.core :as request]
+                                 [task-namespace :as task]))
+                             '{:metabase/modules {api     {:uses #{request}}
+                                                  request {:api #{metabase.request.core}}}}))
+    metabase.task
+    metabase.task.core))
 
 (deftest ^:parallel module-checker-api-namespaces-test
   (is (=? [{:message "Namespace metabase.search.config is not an allowed external API namespace for the search module. [:metabase/modules search :api]"

.clj-kondo/test/hooks/metabase/settings/models/setting_test.clj

@@ -0,0 +1,34 @@
+(ns hooks.metabase.settings.models.setting-test
+  (:require
+   [clj-kondo.hooks-api :as hooks]
+   [clojure.test :refer :all]
+   [hooks.metabase.settings.models.setting]))
+
+#_{:clj-kondo/ignore [:metabase/validate-deftest]}
+(deftest ^:parallel defsetting-test
+  (let [node (-> '(defsetting active-users-count
+                    (deferred-tru "Cached number of active users. Refreshed every 5 minutes.")
+                    :visibility :admin
+                    :type       :integer
+                    :default    0
+                    :getter     (fn []
+                                  (if-not ((requiring-resolve 'metabase.app-db.core/db-is-set-up?))
+                                    0
+                                    (cached-active-users-count))))
+                 pr-str
+                 hooks/parse-string)]
+    (is (= '(let [_ (deferred-tru "Cached number of active users. Refreshed every 5 minutes.")
+                  _ {:default 0
+                     :type :integer
+                     :getter (fn []
+                               (if-not ((requiring-resolve 'metabase.app-db.core/db-is-set-up?))
+                                 0
+                                 (cached-active-users-count)))
+                     :visibility :admin}]
+              :active-users-count
+              (defn active-users-count "Docstring." [])
+              (defn active-users-count! "Docstring." [_value-or-nil]))
+           (-> {:node node, :ns 'hooks.metabase.settings.models.setting-test}
+               hooks.metabase.settings.models.setting/defsetting
+               :node
+               hooks/sexpr)))))

.clj-kondo/test/hooks/metabase/util/i18n_test.clj

@@ -0,0 +1,33 @@
+(ns hooks.metabase.util.i18n-test
+  (:require [clj-kondo.hooks-api :as api]
+            [clj-kondo.impl.utils]
+            [clojure.string :as str]
+            [clojure.test :refer [deftest testing is are]]
+            [hooks.metabase.util.i18n]))
+
+(defn- warnings
+  [form]
+  (binding [clj-kondo.impl.utils/*ctx* {:config     {:linters {:metabase/validate-string-or-str-args-to-i18n {:level :warning}
+                                                               :metabase/validate-escaped-single-quotes-in-i18n {:level :warning}}}
+                                        :ignores    (atom nil)
+                                        :findings   (atom [])
+                                        :namespaces (atom {})}]
+    (hooks.metabase.util.i18n/strict-apostrophes {:node (api/parse-string (pr-str form))})
+    (mapv :message @(:findings clj-kondo.impl.utils/*ctx*))))
+
+(deftest ^:parallel strict-apostrophes-warns
+  (are [form] (= ["Format string contains invalid single quote usage. Use '' for literals or '{...}' for escaping."]
+                 (warnings (quote form)))
+    (metabase.util.i18n/tru "this isn't good bob")
+    (metabase.util.i18n/tru "'this is not good either'")
+    (metabase.util.i18n/tru "''this isn't''")
+    (metabase.util.i18n/tru "nope you can not escape 'like {{0}} so {{1}}'")
+    (metabase.util.i18n/tru (str "it works" "when strings" "are concatenated'"))))
+
+(deftest ^:parallel strict-apostrophes-doesnt-warn-on-good-ones
+  (are [form] (= []
+                 (warnings (quote form)))
+    (metabase.util.i18n/tru "this isn''t bad")
+    (metabase.util.i18n/tru (str "not sure why you'" "'d do this" "... but ok"))
+    (metabase.util.i18n/tru "you can '{{0}}' do things like that")
+    (metabase.util.i18n/tru "or '{{ this or }}}}}}}}}}' that")))

.cljfmt.edn

@@ -81,267 +81,273 @@
   throttle.core/with-throttling                                                        [[:block 1]]
   ;; the rest of the stuff in this list is generated automatically based on `:style/indent` specs
   ;; by running [[dev.generate-cljfmt-config/specs]]... use that code to update this list
-  metabase-enterprise.advanced-permissions.api.util-test/with-impersonations!          [[:inner 0]]
-  metabase-enterprise.cache.config-test/with-temp-persist-models                       [[:block 1]]
-  metabase-enterprise.sandbox.test-util/with-gtaps!                                    [[:inner 0]]
-  metabase-enterprise.sandbox.test-util/with-gtaps-for-user!                           [[:inner 0]]
-  metabase-enterprise.sandbox.test-util/with-user-attributes                           [[:block 2]]
-  metabase-enterprise.serialization.test-util/with-dbs                                 [[:inner 0]]
-  metabase-enterprise.serialization.test-util/with-random-dump-dir                     [[:block 1]]
-  metabase-enterprise.serialization.test-util/with-world                               [[:block 0]]
-  metabase-enterprise.sso.integrations.jwt-test/with-users-with-email-deleted          [[:block 1]]
-  metabase-enterprise.test/with-gtaps!                                                 [[:inner 0]]
-  metabase-enterprise.test/with-gtaps-for-user!                                        [[:inner 0]]
-  metabase-enterprise.test/with-user-attributes                                        [[:block 2]]
-  metabase.actions.actions-test/with-actions-test-data-and-actions-permissively-enabled [[:block 0]]
-  metabase.actions.test-util/with-actions                                              [[:block 1]]
-  metabase.actions.test-util/with-actions-disabled                                     [[:block 0]]
-  metabase.actions.test-util/with-actions-enabled                                      [[:block 0]]
-  metabase.actions.test-util/with-actions-test-data                                    [[:inner 0]]
-  metabase.actions.test-util/with-actions-test-data-and-actions-enabled                [[:block 0]]
-  metabase.actions.test-util/with-actions-test-data-tables                             [[:block 1]]
-  metabase.actions.test-util/with-empty-db                                             [[:inner 0]]
-  metabase.actions.test-util/with-temp-test-data                                       [[:inner 0]]
-  metabase.api.card-test/with-cards-in-readable-collection                             [[:block 1]]
-  metabase.api.card-test/with-cards-in-writeable-collection                            [[:block 1]]
-  metabase.api.card-test/with-ordered-items                                            [[:inner 0]]
-  metabase.api.card-test/with-temp-native-card!                                        [[:block 1]]
-  metabase.api.card-test/with-temp-native-card-with-params!                            [[:block 1]]
-  metabase.api.collection-test/with-collection-hierarchy                               [[:block 1]]
-  metabase.api.collection-test/with-french-user-and-personal-collection                [[:block 2]]
-  metabase.api.collection-test/with-some-children-of-collection                        [[:block 1]]
-  metabase.api.common/check                                                            [[:default]]
-  metabase.api.common/define-routes                                                    [[:block 0]]
-  metabase.api.common/let-404                                                          [[:block 1]]
-  metabase.api.embed-test/do-response-formats                                          [[:block 1]]
-  metabase.api.embed-test/with-embedding-enabled-and-new-secret-key                    [[:block 0]]
-  metabase.api.embed-test/with-embedding-enabled-and-temp-card-referencing             [[:block 3]]
-  metabase.api.embed-test/with-embedding-enabled-and-temp-dashcard-referencing         [[:block 3]]
-  metabase.api.embed-test/with-new-secret-key                                          [[:block 0]]
-  metabase.api.embed-test/with-temp-card                                               [[:block 1]]
-  metabase.api.embed-test/with-temp-dashcard                                           [[:block 1]]
-  metabase.api.preview-embed-test/with-embedding-enabled-and-new-secret-key            [[:block 0]]
-  metabase.api.preview-embed-test/with-new-secret-key                                  [[:block 0]]
-  metabase.cmd.copy/step                                                               [[:block 1]]
-  metabase.cmd.copy/with-connection-rollback-only                                      [[:block 1]]
-  metabase.cmd.copy/with-disabled-db-constraints                                       [[:block 2]]
-  metabase.config/build-type-case                                                      [[:block 0]]
-  metabase.dashboard-subscription-test/with-link-card-fixture-for-dashboard            [[:block 2]]
-  metabase.db.liquibase/with-liquibase                                                 [[:block 1]]
-  metabase.db.liquibase/with-scope-locked                                              [[:block 1]]
-  metabase.db.schema-migrations-test.impl/test-migrations                              [[:block 2]]
-  metabase.db/with-application-db                                                      [[:inner 0]]
-  metabase.driver.bigquery-cloud-sdk.query-processor/with-temporal-type                [[:default]]
-  metabase.driver.druid.client/DELETE                                                  [[:default]]
-  metabase.driver.druid.client/GET                                                     [[:default]]
-  metabase.driver.druid.client/POST                                                    [[:default]]
-  metabase.driver.druid.query-processor-test/druid-query                               [[:block 0]]
-  metabase.driver.druid.query-processor-test/druid-query-returning-rows                [[:block 0]]
-  metabase.driver.mongo.query-processor/mongo-let                                      [[:block 1]]
-  metabase.driver.sql-jdbc.actions/with-jdbc-transaction                               [[:block 1]]
-  metabase.driver.sql-jdbc.connection/with-connection-spec-for-testing-connection      [[:block 1]]
-  metabase.driver.sql-jdbc.execute.diagnostic/capturing-diagnostic-info                [[:block 1]]
-  metabase.driver.sql.query-processor/apply-top-level-clause                           [[:default]]
-  metabase.driver/with-driver                                                          [[:block 1]]
-  metabase.lib.binning/with-binning                                                    [[:default]]
-  metabase.lib.core/with-binning                                                       [[:default]]
-  metabase.lib.core/with-join-alias                                                    [[:default]]
-  metabase.lib.core/with-join-conditions                                               [[:default]]
-  metabase.lib.join/with-join-alias                                                    [[:default]]
-  metabase.lib.join/with-join-conditions                                               [[:default]]
-  metabase.lib.test-util.macros/$ids                                                   [[:inner 0]]
-  metabase.lib.test-util.macros/mbql-query                                             [[:inner 0]]
-  metabase.lib.util.match/match                                                        [[:inner 0]]
-  metabase.lib.util.match/match-one                                                    [[:inner 0]]
-  metabase.lib.util.match/replace                                                      [[:inner 0]]
-  metabase.lib.util.match/replace-in                                                   [[:inner 0]]
-  metabase.models.collection-test/with-collection-hierarchy                            [[:block 1]]
-  metabase.models.collection-test/with-current-user-perms-for-collections              [[:block 1]]
-  metabase.models.collection-test/with-personal-and-impersonal-collections             [[:block 1]]
-  metabase.models.dashboard-test/with-dash-in-collection                               [[:inner 0]]
-  metabase.models.interface/define-batched-hydration-method                            [[:inner 0]]
-  metabase.models.interface/define-simple-hydration-method                             [[:inner 0]]
-  metabase.models.params.chain-filter-test/with-clean-field-values-for-field           [[:block 1]]
-  metabase.models.params.chain-filter-test/with-fk-field-to-field-remapping            [[:block 0]]
-  metabase.models.params.chain-filter-test/with-human-readable-values-remapping        [[:block 0]]
-  metabase.models.setting.multi-setting/define-multi-setting                           [[:inner 0]]
-  metabase.models.setting/defsetting                                                   [[:block 1]]
-  metabase.models.task-history/with-task-history                                       [[:block 1]]
-  metabase.permissions.core/allow-changing-all-users-group-members                     [[:block 0]]
-  metabase.permissions.core/disable-perms-cache                                        [[:block 0]]
-  metabase.public-sharing.api-test/with-sharing-enabled-and-temp-card-referencing      [[:block 3]]
-  metabase.public-sharing.api-test/with-sharing-enabled-and-temp-dashcard-referencing  [[:block 3]]
-  metabase.public-sharing.api-test/with-temp-public-card                               [[:block 1]]
-  metabase.public-sharing.api-test/with-temp-public-dashboard                          [[:block 1]]
-  metabase.public-sharing.api-test/with-temp-public-dashboard-and-card                 [[:block 1]]
-  metabase.pulse.api.alert-test/with-alert-in-collection                               [[:block 1]]
-  metabase.pulse.models.pulse-test/with-dashboard-subscription-in-collection           [[:block 1]]
-  metabase.pulse.models.pulse-test/with-pulse-in-collection                            [[:inner 0]]
-  metabase.query-processor-test.pipeline-queries-test/pmbql-query                      [[:block 1]]
-  metabase.query-processor-test.pipeline-queries-test/run-pmbql-query                  [[:block 1]]
-  metabase.query-processor.debug/debug>                                                [[:block 0]]
-  metabase.query-processor.error-type/deferror                                         [[:block 1]]
-  metabase.query-processor.middleware.cache-backend.interface/with-cached-results      [[:block 4]]
-  metabase.query-processor.middleware.process-userland-query-test/with-query-execution [[:block 1]]
-  metabase.query-processor.store/cached                                                [[:block 1]]
-  metabase.query-processor.store/with-metadata-provider                                [[:inner 0]]
-  metabase.query-processor.streaming/streaming-response                                [[:block 1]]
-  metabase.query-processor.test-util/format-rows-by                                    [[:default]]
-  metabase.request.core/as-admin                                                       [[:block 0]]
-  metabase.request.core/with-current-request                                           [[:inner 0]]
-  metabase.request.core/with-current-user                                              [[:inner 0]]
-  metabase.request.core/with-limit-and-offset                                          [[:inner 0]]
-  metabase.request.session/as-admin                                                    [[:block 0]]
-  metabase.request.session/with-current-user                                           [[:inner 0]]
-  metabase.sample-data-test/with-temp-sample-database-db                               [[:block 1]]
-  metabase.search.api-test/do-test-users                                               [[:block 1]]
-  metabase.server.middleware.session/as-admin                                          [[:block 0]]
-  metabase.server.middleware.session/with-current-user                                 [[:inner 0]]
-  metabase.server.streaming-response-test/with-streaming-response-thread-pool          [[:block 0]]
-  metabase.server.streaming-response-test/with-test-driver-db!                         [[:block 0]]
-  metabase.server.streaming-response/streaming-response                                [[:block 2]]
-  metabase.session.api/http-401-on-error                                               [[:block 0]]
-  metabase.sync.fetch-metadata/log-if-error                                            [[:block 1]]
-  metabase.sync.sync-metadata.fields-test/with-test-db                                 [[:block 0]]
-  metabase.sync.util/do-with-start-and-finish-debug-logging                            [[:default]]
-  metabase.sync.util/sum-for                                                           [[:block 1]]
-  metabase.sync.util/sync-operation                                                    [[:block 3]]
-  metabase.sync.util/with-db-logging-disabled                                          [[:default]]
-  metabase.sync.util/with-duplicate-ops-prevented                                      [[:default]]
-  metabase.sync.util/with-emoji-progress-bar                                           [[:block 1]]
-  metabase.sync.util/with-error-handling                                               [[:block 1]]
-  metabase.sync.util/with-start-and-finish-logging                                     [[:default]]
-  metabase.sync.util/with-start-and-finish-logging*                                    [[:default]]
-  metabase.sync.util/with-sync-events                                                  [[:default]]
-  metabase.test/$ids                                                                   [[:inner 0]]
-  metabase.test/as-admin                                                               [[:inner 0]]
-  metabase.test/dataset                                                                [[:inner 0]]
-  metabase.test/discard-setting-changes                                                [[:block 1]]
-  metabase.test/format-rows-by                                                         [[:default]]
-  metabase.test/let-url                                                                [[:block 1]]
-  metabase.test/mbql-query                                                             [[:inner 0]]
-  metabase.test/native-query                                                           [[:block 0]]
-  metabase.test/query                                                                  [[:block 1]]
-  metabase.test/run-mbql-query                                                         [[:inner 0]]
-  metabase.test/test-driver                                                            [[:inner 0]]
-  metabase.test/test-drivers                                                           [[:inner 0]]
-  metabase.test/test-helpers-set-global-values!                                        [[:block 0]]
-  metabase.test/throw-if-called!                                                       [[:block 1]]
-  metabase.test/with-actions                                                           [[:block 1]]
-  metabase.test/with-actions-disabled                                                  [[:block 0]]
-  metabase.test/with-actions-enabled                                                   [[:block 0]]
-  metabase.test/with-actions-test-data                                                 [[:inner 0]]
-  metabase.test/with-actions-test-data-and-actions-enabled                             [[:block 0]]
-  metabase.test/with-actions-test-data-tables                                          [[:block 1]]
-  metabase.test/with-additional-premium-features                                       [[:block 1]]
-  metabase.test/with-current-user                                                      [[:inner 0]]
-  metabase.test/with-driver                                                            [[:block 1]]
-  metabase.test/with-empty-db                                                          [[:inner 0]]
-  metabase.test/with-empty-h2-app-db                                                   [[:block 0]]
-  metabase.test/with-metadata-provider                                                 [[:inner 0]]
-  metabase.test/with-premium-features                                                  [[:block 1]]
-  metabase.test/with-temp                                                              [[:inner 0]]
-  metabase.test/with-temp-copy-of-db                                                   [[:block 0]]
-  metabase.test/with-temp-scheduler                                                    [[:block 0]]
-  metabase.test/with-temp-test-data                                                    [[:inner 0]]
-  metabase.test/with-temp-vals-in-db                                                   [[:block 3]]
-  metabase.test/with-test-user                                                         [[:inner 0]]
-  metabase.test/with-user-in-groups                                                    [[:inner 0]]
-  metabase.test.data/$ids                                                              [[:inner 0]]
-  metabase.test.data/dataset                                                           [[:inner 0]]
-  metabase.test.data/mbql-query                                                        [[:inner 0]]
-  metabase.test.data/native-query                                                      [[:block 0]]
-  metabase.test.data/query                                                             [[:block 1]]
-  metabase.test.data/run-mbql-query                                                    [[:inner 0]]
-  metabase.test.data/with-empty-h2-app-db                                              [[:block 0]]
-  metabase.test.data/with-temp-copy-of-db                                              [[:block 0]]
-  metabase.test.data.datasets/test-driver                                              [[:inner 0]]
-  metabase.test.data.datasets/test-drivers                                             [[:inner 0]]
-  metabase.test.data.one-off-dbs/with-blank-db                                         [[:block 0]]
-  metabase.test.data.one-off-dbs/with-blueberries-db                                   [[:block 0]]
-  metabase.test.data.users/with-test-user                                              [[:inner 0]]
-  metabase.test.util/discard-setting-changes                                           [[:block 1]]
-  metabase.test.util/let-url                                                           [[:block 1]]
-  metabase.test.util/throw-if-called!                                                  [[:block 1]]
-  metabase.test.util/with-temp-scheduler                                               [[:block 0]]
-  metabase.test.util/with-temp-vals-in-db                                              [[:block 3]]
-  metabase.test.util/with-user-in-groups                                               [[:inner 0]]
-  metabase.test.util.public-settings/with-additional-premium-features                  [[:block 1]]
-  metabase.test.util.public-settings/with-premium-features                             [[:block 1]]
-  metabase.test.util.thread-local/test-helpers-set-global-values!                      [[:block 0]]
-  metabase.timeseries-query-processor-test.util/test-timeseries-drivers                [[:block 0]]
-  metabase.timeseries-query-processor-test/run-mbql-query                              [[:inner 0]]
-  metabase.upload-test/with-upload-table!                                              [[:inner 0]]
-  metabase.upload.types/with-currency                                                  [[:default]]
-  metabase.upload.types/with-parens                                                    [[:default]]
-  metabase.util/auto-retry                                                             [[:block 1]]
-  metabase.util/case-enum                                                              [[:block 1]]
-  metabase.util/ignore-exceptions                                                      [[:block 0]]
-  metabase.util/or-with                                                                [[:block 1]]
-  metabase.util/profile                                                                [[:block 1]]
-  metabase.util/prog1                                                                  [[:inner 0]]
-  metabase.util/varargs                                                                [[:inner 0]]
-  metabase.util/with-us-locale                                                         [[:block 0]]
-  metabase.util.async/cancelable-thread                                                [[:block 0]]
-  metabase.util.date-2/with-time-zone-same-instant                                     [[:default]]
-  metabase.util.encryption-test/with-secret-key                                        [[:block 1]]
-  metabase.util.honey-sql-2/with-database-type-info                                    [[:default]]
-  metabase.util.i18n/deferred-trs                                                      [[:default]]
-  metabase.util.i18n/deferred-tru                                                      [[:default]]
-  metabase.util.i18n/trs                                                               [[:default]]
-  metabase.util.i18n/trsn                                                              [[:default]]
-  metabase.util.i18n/tru                                                               [[:default]]
-  metabase.util.i18n/trun                                                              [[:default]]
-  metabase.util.jvm/auto-retry                                                         [[:block 1]]
-  metabase.util.jvm/varargs                                                            [[:block 1]]
-  metabase.util.jvm/with-us-locale                                                     [[:block 0]]
-  metabase.util.malli/disable-enforcement                                              [[:block 0]]
-  metabase.util.malli/with                                                             [[:default]]
-  metabase.util.malli/with-api-error-message                                           [[:default]]
-  metabase.util.namespaces/import-fns                                                  [[:default]]
-  metabuild-common.core/exit-when-finished-nonzero-on-exception                        [[:block 0]]
-  metabuild-common.core/step                                                           [[:block 1]]
-  metabuild-common.entrypoint/exit-when-finished-nonzero-on-exception                  [[:block 0]]
-  metabuild-common.steps/step                                                          [[:block 1]]
-  methodical.core/defmethod                                                            [[:inner 0]]
-  methodical.core/defmulti                                                             [[:inner 0]]
-  methodical.core/with-dispatcher                                                      [[:default]]
-  methodical.core/with-method-table                                                    [[:default]]
-  methodical.core/with-prefers                                                         [[:default]]
-  methodical.interface/with-dispatcher                                                 [[:default]]
-  methodical.interface/with-method-table                                               [[:default]]
-  methodical.interface/with-prefers                                                    [[:default]]
-  methodical.macros/defmethod                                                          [[:inner 0]]
-  methodical.macros/defmulti                                                           [[:inner 0]]
-  saml20-clj.sp.response/validate-confirmation-datas                                   [[:block 1]]
-  toucan2.connection/with-transaction                                                  [[:block 1]]
-  toucan2.core/build                                                                   [[:block 0]]
-  toucan2.core/compile                                                                 [[:block 0]]
-  toucan2.core/debug                                                                   [[:block 0]]
-  toucan2.core/define-after-insert                                                     [[:inner 0]]
-  toucan2.core/define-after-select                                                     [[:inner 0]]
-  toucan2.core/define-after-update                                                     [[:inner 0]]
-  toucan2.core/define-before-delete                                                    [[:inner 0]]
-  toucan2.core/define-before-insert                                                    [[:inner 0]]
-  toucan2.core/define-before-select                                                    [[:inner 0]]
-  toucan2.core/define-default-fields                                                   [[:inner 0]]
-  toucan2.core/define-named-query                                                      [[:block 1]]
-  toucan2.core/deftransforms                                                           [[:block 1]]
-  toucan2.core/with-transaction                                                        [[:block 1]]
-  toucan2.tools.after/define-after-impl                                                [[:default]]
-  toucan2.tools.after-insert/define-after-insert                                       [[:inner 0]]
-  toucan2.tools.after-select/define-after-select                                       [[:inner 0]]
-  toucan2.tools.after-update/define-after-update                                       [[:inner 0]]
-  toucan2.tools.before-delete/define-before-delete                                     [[:inner 0]]
-  toucan2.tools.before-insert/define-before-insert                                     [[:inner 0]]
-  toucan2.tools.before-select/define-before-select                                     [[:inner 0]]
-  toucan2.tools.compile/build                                                          [[:block 0]]
-  toucan2.tools.compile/compile                                                        [[:block 0]]
-  toucan2.tools.compile/resolved                                                       [[:block 0]]
-  toucan2.tools.debug/debug                                                            [[:block 0]]
-  toucan2.tools.default-fields/define-default-fields                                   [[:inner 0]]
-  toucan2.tools.named-query/define-named-query                                         [[:block 1]]
-  toucan2.tools.simple-out-transform/define-out-transform                              [[:inner 0]]
-  toucan2.tools.transformed/deftransforms                                              [[:block 1]]
-  toucan2.tools.with-temp/with-temp                                                    [[:inner 0]]
-  toucan2.util/try-with-error-context                                                  [[:inner 0]]}}
+  metabase-enterprise.cache.config-test/with-temp-persist-models                         [[:block 1]]
+  metabase-enterprise.impersonation.util-test/with-impersonations!                       [[:inner 0]]
+  metabase-enterprise.sandbox.test-util/with-gtaps!                                      [[:inner 0]]
+  metabase-enterprise.sandbox.test-util/with-gtaps-for-user!                             [[:inner 0]]
+  metabase-enterprise.sandbox.test-util/with-user-attributes                             [[:block 2]]
+  metabase-enterprise.serialization.test-util/with-dbs                                   [[:inner 0]]
+  metabase-enterprise.serialization.test-util/with-random-dump-dir                       [[:block 1]]
+  metabase-enterprise.serialization.test-util/with-world                                 [[:block 0]]
+  metabase-enterprise.sso.integrations.jwt-test/with-users-with-email-deleted            [[:block 1]]
+  metabase-enterprise.test/with-gtaps!                                                   [[:inner 0]]
+  metabase-enterprise.test/with-gtaps-for-user!                                          [[:inner 0]]
+  metabase-enterprise.test/with-user-attributes                                          [[:block 2]]
+  metabase.actions.actions-test/with-actions-test-data-and-actions-permissively-enabled  [[:block 0]]
+  metabase.actions.test-util/with-actions                                                [[:block 1]]
+  metabase.actions.test-util/with-actions-disabled                                       [[:block 0]]
+  metabase.actions.test-util/with-actions-enabled                                        [[:block 0]]
+  metabase.actions.test-util/with-actions-test-data                                      [[:inner 0]]
+  metabase.actions.test-util/with-actions-test-data-and-actions-enabled                  [[:block 0]]
+  metabase.actions.test-util/with-actions-test-data-tables                               [[:block 1]]
+  metabase.actions.test-util/with-empty-db                                               [[:inner 0]]
+  metabase.actions.test-util/with-temp-test-data                                         [[:inner 0]]
+  metabase.api.common/check                                                              [[:default]]
+  metabase.api.common/define-routes                                                      [[:block 0]]
+  metabase.api.common/let-404                                                            [[:block 1]]
+  metabase.app-db.core/with-application-db                                               [[:inner 0]]
+  metabase.app-db.liquibase/with-liquibase                                               [[:block 1]]
+  metabase.app-db.liquibase/with-scope-locked                                            [[:block 1]]
+  metabase.app-db.schema-migrations-test.impl/test-migrations                            [[:block 2]]
+  metabase.cmd.copy/step                                                                 [[:block 1]]
+  metabase.cmd.copy/with-connection-rollback-only                                        [[:block 1]]
+  metabase.cmd.copy/with-disabled-db-constraints                                         [[:block 2]]
+  metabase.collections.api-test/with-collection-hierarchy                                [[:block 1]]
+  metabase.collections.api-test/with-french-user-and-personal-collection                 [[:block 2]]
+  metabase.collections.api-test/with-some-children-of-collection                         [[:block 1]]
+  metabase.collections.models.collection-test/with-collection-hierarchy                  [[:block 1]]
+  metabase.collections.models.collection-test/with-current-user-perms-for-collections    [[:block 1]]
+  metabase.collections.models.collection-test/with-personal-and-impersonal-collections   [[:block 1]]
+  metabase.config/build-type-case                                                        [[:block 0]]
+  metabase.dashboards.models.dashboard-test/with-dash-in-collection                      [[:inner 0]]
+  metabase.driver.bigquery-cloud-sdk.query-processor/with-temporal-type                  [[:default]]
+  metabase.driver.druid.client/DELETE                                                    [[:default]]
+  metabase.driver.druid.client/GET                                                       [[:default]]
+  metabase.driver.druid.client/POST                                                      [[:default]]
+  metabase.driver.druid.query-processor-test/druid-query                                 [[:block 0]]
+  metabase.driver.druid.query-processor-test/druid-query-returning-rows                  [[:block 0]]
+  metabase.driver.mongo.query-processor/mongo-let                                        [[:block 1]]
+  metabase.driver.sql-jdbc.actions/with-jdbc-transaction                                 [[:block 1]]
+  metabase.driver.sql-jdbc.connection/with-connection-spec-for-testing-connection        [[:block 1]]
+  metabase.driver.sql-jdbc.execute.diagnostic/capturing-diagnostic-info                  [[:block 1]]
+  metabase.driver.sql.query-processor/apply-top-level-clause                             [[:default]]
+  metabase.driver/with-driver                                                            [[:block 1]]
+  metabase.embedding.api.embed-test/do-response-formats                                  [[:block 1]]
+  metabase.embedding.api.embed-test/with-embedding-enabled-and-new-secret-key            [[:block 0]]
+  metabase.embedding.api.embed-test/with-embedding-enabled-and-temp-card-referencing     [[:block 3]]
+  metabase.embedding.api.embed-test/with-embedding-enabled-and-temp-dashcard-referencing [[:block 3]]
+  metabase.embedding.api.embed-test/with-new-secret-key                                  [[:block 0]]
+  metabase.embedding.api.embed-test/with-temp-card                                       [[:block 1]]
+  metabase.embedding.api.embed-test/with-temp-dashcard                                   [[:block 1]]
+  metabase.embedding.api.preview-embed-test/with-embedding-enabled-and-new-secret-key    [[:block 0]]
+  metabase.embedding.api.preview-embed-test/with-new-secret-key                          [[:block 0]]
+  metabase.lib.binning/with-binning                                                      [[:default]]
+  metabase.lib.core/with-binning                                                         [[:default]]
+  metabase.lib.core/with-join-alias                                                      [[:default]]
+  metabase.lib.core/with-join-conditions                                                 [[:default]]
+  metabase.lib.join/with-join-alias                                                      [[:default]]
+  metabase.lib.join/with-join-conditions                                                 [[:default]]
+  metabase.lib.test-util.macros/$ids                                                     [[:inner 0]]
+  metabase.lib.test-util.macros/mbql-query                                               [[:inner 0]]
+  metabase.lib.util.match/match                                                          [[:inner 0]]
+  metabase.lib.util.match/match-one                                                      [[:inner 0]]
+  metabase.lib.util.match/replace                                                        [[:inner 0]]
+  metabase.lib.util.match/replace-in                                                     [[:inner 0]]
+  metabase.models.interface/define-batched-hydration-method                              [[:inner 0]]
+  metabase.models.interface/define-simple-hydration-method                               [[:inner 0]]
+  metabase.parameters.chain-filter-test/with-clean-field-values-for-field                [[:block 1]]
+  metabase.parameters.chain-filter-test/with-fk-field-to-field-remapping                 [[:block 0]]
+  metabase.parameters.chain-filter-test/with-human-readable-values-remapping             [[:block 0]]
+  metabase.permissions.core/allow-changing-all-users-group-members                       [[:block 0]]
+  metabase.permissions.core/disable-perms-cache                                          [[:block 0]]
+  metabase.public-sharing.api-test/with-sharing-enabled-and-temp-card-referencing        [[:block 3]]
+  metabase.public-sharing.api-test/with-sharing-enabled-and-temp-dashcard-referencing    [[:block 3]]
+  metabase.public-sharing.api-test/with-temp-public-card                                 [[:block 1]]
+  metabase.public-sharing.api-test/with-temp-public-dashboard                            [[:block 1]]
+  metabase.public-sharing.api-test/with-temp-public-dashboard-and-card                   [[:block 1]]
+  metabase.pulse.api.alert-test/with-alert-in-collection                                 [[:block 1]]
+  metabase.pulse.dashboard-subscription-test/with-link-card-fixture-for-dashboard        [[:block 2]]
+  metabase.pulse.models.pulse-test/with-dashboard-subscription-in-collection             [[:block 1]]
+  metabase.pulse.models.pulse-test/with-pulse-in-collection                              [[:inner 0]]
+  metabase.queries.api.card-test/with-cards-in-readable-collection                       [[:block 1]]
+  metabase.queries.api.card-test/with-cards-in-writeable-collection                      [[:block 1]]
+  metabase.queries.api.card-test/with-ordered-items                                      [[:inner 0]]
+  metabase.queries.api.card-test/with-temp-native-card!                                  [[:block 1]]
+  metabase.queries.api.card-test/with-temp-native-card-with-params!                      [[:block 1]]
+  metabase.query-processor-test.pipeline-queries-test/pmbql-query                        [[:block 1]]
+  metabase.query-processor-test.pipeline-queries-test/run-pmbql-query                    [[:block 1]]
+  metabase.query-processor.debug/debug>                                                  [[:block 0]]
+  metabase.query-processor.error-type/deferror                                           [[:block 1]]
+  metabase.query-processor.middleware.cache-backend.interface/with-cached-results        [[:block 4]]
+  metabase.query-processor.middleware.process-userland-query-test/with-query-execution   [[:block 1]]
+  metabase.query-processor.store/cached                                                  [[:block 1]]
+  metabase.query-processor.store/with-metadata-provider                                  [[:inner 0]]
+  metabase.query-processor.streaming/streaming-response                                  [[:block 1]]
+  metabase.query-processor.test-util/format-rows-by                                      [[:default]]
+  metabase.request.core/as-admin                                                         [[:block 0]]
+  metabase.request.core/with-current-request                                             [[:inner 0]]
+  metabase.request.core/with-current-user                                                [[:inner 0]]
+  metabase.request.core/with-limit-and-offset                                            [[:inner 0]]
+  metabase.request.session/as-admin                                                      [[:block 0]]
+  metabase.request.session/with-current-user                                             [[:inner 0]]
+  metabase.sample-data.impl-test/with-temp-sample-database-db                            [[:block 1]]
+  metabase.search.api-test/do-test-users                                                 [[:block 1]]
+  metabase.server.middleware.session/as-admin                                            [[:block 0]]
+  metabase.server.middleware.session/with-current-user                                   [[:inner 0]]
+  metabase.server.streaming-response-test/with-streaming-response-thread-pool            [[:block 0]]
+  metabase.server.streaming-response-test/with-test-driver-db!                           [[:block 0]]
+  metabase.server.streaming-response/streaming-response                                  [[:block 2]]
+  metabase.session.api/http-401-on-error                                                 [[:block 0]]
+  metabase.settings.core/define-multi-setting                                            [[:inner 0]]
+  metabase.settings.core/defsetting                                                      [[:block 1]]
+  metabase.settings.models.setting.multi-setting/define-multi-setting                    [[:inner 0]]
+  metabase.settings.models.setting/defsetting                                            [[:block 1]]
+  metabase.sync.fetch-metadata/log-if-error                                              [[:block 1]]
+  metabase.sync.sync-metadata.fields-test/with-test-db                                   [[:block 0]]
+  metabase.sync.util/do-with-start-and-finish-debug-logging                              [[:default]]
+  metabase.sync.util/sum-for                                                             [[:block 1]]
+  metabase.sync.util/sync-operation                                                      [[:block 3]]
+  metabase.sync.util/with-db-logging-disabled                                            [[:default]]
+  metabase.sync.util/with-duplicate-ops-prevented                                        [[:default]]
+  metabase.sync.util/with-emoji-progress-bar                                             [[:block 1]]
+  metabase.sync.util/with-error-handling                                                 [[:block 1]]
+  metabase.sync.util/with-start-and-finish-logging                                       [[:default]]
+  metabase.sync.util/with-start-and-finish-logging*                                      [[:default]]
+  metabase.sync.util/with-sync-events                                                    [[:default]]
+  metabase.task-history.models.task-history/with-task-history                            [[:block 1]]
+  metabase.task.core/rerun-on-error                                                      [[:block 1]]
+  metabase.task.impl/rerun-on-error                                                      [[:block 1]]
+  metabase.test.data.datasets/test-driver                                                [[:inner 0]]
+  metabase.test.data.datasets/test-drivers                                               [[:inner 0]]
+  metabase.test.data.one-off-dbs/with-blank-db                                           [[:block 0]]
+  metabase.test.data.one-off-dbs/with-blueberries-db                                     [[:block 0]]
+  metabase.test.data.users/with-test-user                                                [[:inner 0]]
+  metabase.test.data/$ids                                                                [[:inner 0]]
+  metabase.test.data/dataset                                                             [[:inner 0]]
+  metabase.test.data/mbql-query                                                          [[:inner 0]]
+  metabase.test.data/native-query                                                        [[:block 0]]
+  metabase.test.data/query                                                               [[:block 1]]
+  metabase.test.data/run-mbql-query                                                      [[:inner 0]]
+  metabase.test.data/with-empty-h2-app-db                                                [[:block 0]]
+  metabase.test.data/with-temp-copy-of-db                                                [[:block 0]]
+  metabase.test.util.public-settings/with-additional-premium-features                    [[:block 1]]
+  metabase.test.util.public-settings/with-premium-features                               [[:block 1]]
+  metabase.test.util.thread-local/test-helpers-set-global-values!                        [[:block 0]]
+  metabase.test.util/discard-setting-changes                                             [[:block 1]]
+  metabase.test.util/let-url                                                             [[:block 1]]
+  metabase.test.util/throw-if-called!                                                    [[:block 1]]
+  metabase.test.util/with-temp-scheduler                                                 [[:block 0]]
+  metabase.test.util/with-temp-vals-in-db                                                [[:block 3]]
+  metabase.test.util/with-user-in-groups                                                 [[:inner 0]]
+  metabase.test/$ids                                                                     [[:inner 0]]
+  metabase.test/as-admin                                                                 [[:inner 0]]
+  metabase.test/dataset                                                                  [[:inner 0]]
+  metabase.test/discard-setting-changes                                                  [[:block 1]]
+  metabase.test/format-rows-by                                                           [[:default]]
+  metabase.test/let-url                                                                  [[:block 1]]
+  metabase.test/mbql-query                                                               [[:inner 0]]
+  metabase.test/native-query                                                             [[:block 0]]
+  metabase.test/query                                                                    [[:block 1]]
+  metabase.test/run-mbql-query                                                           [[:inner 0]]
+  metabase.test/test-driver                                                              [[:inner 0]]
+  metabase.test/test-drivers                                                             [[:inner 0]]
+  metabase.test/test-helpers-set-global-values!                                          [[:block 0]]
+  metabase.test/throw-if-called!                                                         [[:block 1]]
+  metabase.test/with-actions                                                             [[:block 1]]
+  metabase.test/with-actions-disabled                                                    [[:block 0]]
+  metabase.test/with-actions-enabled                                                     [[:block 0]]
+  metabase.test/with-actions-test-data                                                   [[:inner 0]]
+  metabase.test/with-actions-test-data-and-actions-enabled                               [[:block 0]]
+  metabase.test/with-actions-test-data-tables                                            [[:block 1]]
+  metabase.test/with-additional-premium-features                                         [[:block 1]]
+  metabase.test/with-current-user                                                        [[:inner 0]]
+  metabase.test/with-driver                                                              [[:block 1]]
+  metabase.test/with-empty-db                                                            [[:inner 0]]
+  metabase.test/with-empty-h2-app-db                                                     [[:block 0]]
+  metabase.test/with-metadata-provider                                                   [[:inner 0]]
+  metabase.test/with-premium-features                                                    [[:block 1]]
+  metabase.test/with-temp                                                                [[:inner 0]]
+  metabase.test/with-temp-copy-of-db                                                     [[:block 0]]
+  metabase.test/with-temp-scheduler                                                      [[:block 0]]
+  metabase.test/with-temp-test-data                                                      [[:inner 0]]
+  metabase.test/with-temp-vals-in-db                                                     [[:block 3]]
+  metabase.test/with-test-user                                                           [[:inner 0]]
+  metabase.test/with-user-in-groups                                                      [[:inner 0]]
+  metabase.timeseries-query-processor-test.util/test-timeseries-drivers                  [[:block 0]]
+  metabase.timeseries-query-processor-test/run-mbql-query                                [[:inner 0]]
+  metabase.upload.impl-test/with-upload-table!                                           [[:inner 0]]
+  metabase.upload.types/with-currency                                                    [[:default]]
+  metabase.upload.types/with-parens                                                      [[:default]]
+  metabase.util/for-map                                                                  [[:block 1]]
+  metabase.util.async/cancelable-thread                                                  [[:block 0]]
+  metabase.util.date-2/with-time-zone-same-instant                                       [[:default]]
+  metabase.util.encryption-test/with-secret-key                                          [[:block 1]]
+  metabase.util.honey-sql-2/with-database-type-info                                      [[:default]]
+  metabase.util.i18n/deferred-trs                                                        [[:default]]
+  metabase.util.i18n/deferred-tru                                                        [[:default]]
+  metabase.util.i18n/trs                                                                 [[:default]]
+  metabase.util.i18n/trsn                                                                [[:default]]
+  metabase.util.i18n/tru                                                                 [[:default]]
+  metabase.util.i18n/trun                                                                [[:default]]
+  metabase.util.jvm/auto-retry                                                           [[:block 1]]
+  metabase.util.jvm/varargs                                                              [[:block 1]]
+  metabase.util.jvm/with-us-locale                                                       [[:block 0]]
+  metabase.util.malli/disable-enforcement                                                [[:block 0]]
+  metabase.util.malli/with                                                               [[:default]]
+  metabase.util.malli/with-api-error-message                                             [[:default]]
+  metabase.util.namespaces/import-fns                                                    [[:default]]
+  metabase.util.queue-test/await-test-while                                              [[:block 1]]
+  metabase.util/auto-retry                                                               [[:block 1]]
+  metabase.util/case-enum                                                                [[:block 1]]
+  metabase.util/ignore-exceptions                                                        [[:block 0]]
+  metabase.util/or-with                                                                  [[:block 1]]
+  metabase.util/profile                                                                  [[:block 1]]
+  metabase.util/prog1                                                                    [[:inner 0]]
+  metabase.util/varargs                                                                  [[:inner 0]]
+  metabase.util/with-us-locale                                                           [[:block 0]]
+  metabuild-common.core/exit-when-finished-nonzero-on-exception                          [[:block 0]]
+  metabuild-common.core/step                                                             [[:block 1]]
+  metabuild-common.entrypoint/exit-when-finished-nonzero-on-exception                    [[:block 0]]
+  metabuild-common.steps/step                                                            [[:block 1]]
+  methodical.core/defmethod                                                              [[:inner 0]]
+  methodical.core/defmulti                                                               [[:inner 0]]
+  methodical.core/with-dispatcher                                                        [[:default]]
+  methodical.core/with-method-table                                                      [[:default]]
+  methodical.core/with-prefers                                                           [[:default]]
+  methodical.interface/with-dispatcher                                                   [[:default]]
+  methodical.interface/with-method-table                                                 [[:default]]
+  methodical.interface/with-prefers                                                      [[:default]]
+  methodical.macros/defmethod                                                            [[:inner 0]]
+  methodical.macros/defmulti                                                             [[:inner 0]]
+  saml20-clj.sp.response/validate-confirmation-datas                                     [[:block 1]]
+  toucan2.connection/with-transaction                                                    [[:block 1]]
+  toucan2.core/build                                                                     [[:block 0]]
+  toucan2.core/compile                                                                   [[:block 0]]
+  toucan2.core/debug                                                                     [[:block 0]]
+  toucan2.core/define-after-insert                                                       [[:inner 0]]
+  toucan2.core/define-after-select                                                       [[:inner 0]]
+  toucan2.core/define-after-update                                                       [[:inner 0]]
+  toucan2.core/define-before-delete                                                      [[:inner 0]]
+  toucan2.core/define-before-insert                                                      [[:inner 0]]
+  toucan2.core/define-before-select                                                      [[:inner 0]]
+  toucan2.core/define-default-fields                                                     [[:inner 0]]
+  toucan2.core/define-named-query                                                        [[:block 1]]
+  toucan2.core/deftransforms                                                             [[:block 1]]
+  toucan2.core/with-transaction                                                          [[:block 1]]
+  toucan2.tools.after-insert/define-after-insert                                         [[:inner 0]]
+  toucan2.tools.after-select/define-after-select                                         [[:inner 0]]
+  toucan2.tools.after-update/define-after-update                                         [[:inner 0]]
+  toucan2.tools.after/define-after-impl                                                  [[:default]]
+  toucan2.tools.before-delete/define-before-delete                                       [[:inner 0]]
+  toucan2.tools.before-insert/define-before-insert                                       [[:inner 0]]
+  toucan2.tools.before-select/define-before-select                                       [[:inner 0]]
+  toucan2.tools.compile/build                                                            [[:block 0]]
+  toucan2.tools.compile/compile                                                          [[:block 0]]
+  toucan2.tools.compile/resolved                                                         [[:block 0]]
+  toucan2.tools.debug/debug                                                              [[:block 0]]
+  toucan2.tools.default-fields/define-default-fields                                     [[:inner 0]]
+  toucan2.tools.named-query/define-named-query                                           [[:block 1]]
+  toucan2.tools.simple-out-transform/define-out-transform                                [[:inner 0]]
+  toucan2.tools.transformed/deftransforms                                                [[:block 1]]
+  toucan2.tools.with-temp/with-temp                                                      [[:inner 0]]
+  toucan2.util/try-with-error-context                                                    [[:inner 0]]}}

.devcontainer/Dockerfile

@@ -1,11 +1,11 @@
-FROM mcr.microsoft.com/vscode/devcontainers/java:11
+FROM mcr.microsoft.com/vscode/devcontainers/java:21
 
 # Set up nodesource, install node, yarn, fontconfig for static viz, rlwrap for dev ergonomics
 
-RUN ( curl -fsSL https://deb.nodesource.com/setup_18.x | bash ) \
+RUN ( curl -fsSL https://deb.nodesource.com/setup_22.x | bash ) \
   && export DEBIAN_FRONTEND=noninteractive \
   && apt-key adv --refresh-keys --keyserver keyserver.ubuntu.com \
   && apt-get update && apt-get -y install --no-install-recommends nodejs yarn rlwrap fontconfig
 
 # install Clojure
-RUN curl https://download.clojure.org/install/linux-install-1.11.1.1262.sh | bash
+RUN curl https://download.clojure.org/install/linux-install-1.12.0.1488.sh | bash

.eslintrc.js

@@ -6,6 +6,10 @@
 // can use this flag to enable it. This is set to true in CI
 const shouldLintCssModules =
   process.env.LINT_CSS_MODULES === "true" || process.env.CI;
+const plugins = ["react", "no-only-tests", "ttag", "i18next"];
+if (shouldLintCssModules) {
+  plugins.push("postcss-modules");
+}
 
 module.exports = {
   rules: {
@@ -22,6 +26,9 @@ module.exports = {
       },
     ],
     "no-empty": [1, { allowEmptyCatch: true }],
+    // Note: adding this rule to a eslint config file in a subfolder will remove
+    // *not* carry over the restricted imports from parent folders, you will
+    // need to copy them over
     "no-restricted-imports": [
       "error",
       {
@@ -111,7 +118,7 @@ module.exports = {
         ],
       },
     ],
-    complexity: ["error", { max: 54 }],
+    complexity: ["error", { max: 55 }],
     ...(shouldLintCssModules
       ? {
           "postcss-modules/no-undef-class": "error",
@@ -131,7 +138,7 @@ module.exports = {
     "jest/globals": true,
   },
   parser: "babel-eslint",
-  plugins: ["react", "no-only-tests", "postcss-modules"],
+  plugins,
   extends: [
     "eslint:recommended",
     "plugin:react/recommended",
@@ -142,6 +149,7 @@ module.exports = {
     "plugin:import/typescript",
     "plugin:depend/recommended",
     "plugin:storybook/recommended",
+    "plugin:i18next/recommended",
   ],
   settings: {
     "import/internal-regex": "^metabase/|^metabase-lib/",
@@ -168,6 +176,7 @@ module.exports = {
       files: ["*.js", "*.jsx", "*.ts", "*.tsx"],
       rules: {
         "no-unconditional-metabase-links-render": "error",
+        "no-color-literals": "error",
         "no-literal-metabase-strings": "error",
         "depend/ban-dependencies": [
           "error",
@@ -187,17 +196,38 @@ module.exports = {
         "*.unit.spec.*",
         "frontend/src/metabase/admin/**/*",
         "frontend/src/metabase/setup/**/*",
+        "enterprise/frontend/src/metabase-enterprise/whitelabel/**/*",
         "frontend/lint/**/*",
         "*.stories.*",
+        "stories-data.*",
         "e2e/**/*",
         "**/tests/*",
         "release/**/*",
+        "webpack.config.js",
+        "rspack.config.js",
       ],
       rules: {
+        "no-color-literals": "off",
         "no-unconditional-metabase-links-render": "off",
         "no-literal-metabase-strings": "off",
       },
     },
+    {
+      files: [
+        "*.unit.spec.*",
+        "frontend/lint/**/*",
+        "*.stories.*",
+        "stories-data.*",
+        "e2e/**/*",
+        "**/tests/*",
+        "release/**/*",
+        "webpack.config.js",
+        "rspack.config.js",
+      ],
+      rules: {
+        "i18next/no-literal-string": "off",
+      },
+    },
     {
       extends: ["plugin:@typescript-eslint/recommended"],
       files: ["*.ts", "*.tsx"],
@@ -245,6 +275,13 @@ module.exports = {
       ],
       rules: {
         "jest/valid-title": ["error", { ignoreTypeOfDescribeName: true }],
+        "jest/expect-expect": [
+          "error",
+          {
+            assertFunctionNames: ["expect*", "assert*"],
+            additionalTestBlockFunctions: [],
+          },
+        ],
       },
     },
     {
@@ -275,13 +312,20 @@ module.exports = {
             message:
               "You may not use base colors in the application, use semantic colors instead. (see colors.module.css)",
           },
-          {
-            selector:
-              "CallExpression[callee.property.name='legacyQuery'] > ObjectExpression > Property[key.name='useStructuredQuery'][value.value=true]",
-            message: "StructuredQuery usage is forbidden. Use MLv2",
-          },
         ],
       },
     },
+    {
+      files: ["docs/**/snippets/**/*.{ts,tsx,js,jsx}"],
+      rules: {
+        "@typescript-eslint/no-unused-vars": "off",
+        "@typescript-eslint/no-var-requires": "off",
+        "import/no-commonjs": "off",
+        "import/no-default-export": "off",
+        "import/order": "off",
+        "import/no-unresolved": "off",
+        "no-color-literals": "off",
+      },
+    },
   ],
 };

.github/CODEOWNERS

@@ -3,255 +3,259 @@
 
 enterprise/frontend/src/embedding-sdk @metabase/embedding
 frontend/src/metabase/embedding-sdk @metabase/embedding
+frontend/src/metabase/public/containers/PublicOrEmbeddedQuestion @metabase/embedding
+frontend/src/metabase/public/containers/PublicOrEmbeddedDashboard @metabase/embedding
 frontend/src/metabase/ui @metabase/core-frontend-admin-webapp
-snowplow/* @metabase/data
-e2e @filiphric
-
+# snowplow/* @metabase/data
+src/metabase/analytics/prometheus.clj @metabase/cloud-ops
 .github @metabase/devexp
 .clj-kondo @metabase/devexp
+deps.edn @metabase/backend-developers
+
+docs @metabase/tech-writers
 
 #
 # Backend modules <=> teams that own them
 #
 
-modules/drivers @metabase/drivers
+# modules/drivers @metabase/drivers
 
-enterprise/backend/src/metabase_enterprise/advanced_config @metabase/core-backend-admin-webapp
-enterprise/backend/test/metabase_enterprise/advanced_config @metabase/core-backend-admin-webapp
+# enterprise/backend/src/metabase_enterprise/advanced_config @metabase/core-backend-admin-webapp
+# enterprise/backend/test/metabase_enterprise/advanced_config @metabase/core-backend-admin-webapp
 
-enterprise/backend/src/metabase_enterprise/advanced_permissions @metabase/core-backend-admin-webapp
-enterprise/backend/test/metabase_enterprise/advanced_permissions @metabase/core-backend-admin-webapp
+# enterprise/backend/src/metabase_enterprise/advanced_permissions @metabase/core-backend-admin-webapp
+# enterprise/backend/test/metabase_enterprise/advanced_permissions @metabase/core-backend-admin-webapp
 
-enterprise/backend/src/metabase_enterprise/airgap @metabase/core-backend-admin-webapp
-enterprise/backend/test/metabase_enterprise/airgap @metabase/core-backend-admin-webapp
+# enterprise/backend/src/metabase_enterprise/airgap @metabase/core-backend-admin-webapp
+# enterprise/backend/test/metabase_enterprise/airgap @metabase/core-backend-admin-webapp
 
-enterprise/backend/src/metabase_enterprise/api @metabase/devexp
-enterprise/backend/test/metabase_enterprise/api @metabase/devexp
+# enterprise/backend/src/metabase_enterprise/api @metabase/devexp
+# enterprise/backend/test/metabase_enterprise/api @metabase/devexp
 
-enterprise/backend/src/metabase_enterprise/audit_app @metabase/core-backend-admin-webapp
-enterprise/backend/test/metabase_enterprise/audit_app @metabase/core-backend-admin-webapp
+# enterprise/backend/src/metabase_enterprise/audit_app @metabase/core-backend-admin-webapp
+# enterprise/backend/test/metabase_enterprise/audit_app @metabase/core-backend-admin-webapp
 
-enterprise/backend/src/metabase_enterprise/auth_provider @metabase/core-backend-admin-webapp
-enterprise/backend/test/metabase_enterprise/auth_provider @metabase/core-backend-admin-webapp
+# enterprise/backend/src/metabase_enterprise/auth_provider @metabase/core-backend-admin-webapp
+# enterprise/backend/test/metabase_enterprise/auth_provider @metabase/core-backend-admin-webapp
 
-enterprise/backend/src/metabase_enterprise/billing @metabase/core-backend-admin-webapp
-enterprise/backend/test/metabase_enterprise/billing @metabase/core-backend-admin-webapp
+# enterprise/backend/src/metabase_enterprise/billing @metabase/core-backend-admin-webapp
+# enterprise/backend/test/metabase_enterprise/billing @metabase/core-backend-admin-webapp
 
-enterprise/backend/src/metabase_enterprise/cache @metabase/core-backend-admin-webapp
-enterprise/backend/test/metabase_enterprise/cache @metabase/core-backend-admin-webapp
+# enterprise/backend/src/metabase_enterprise/cache @metabase/core-backend-admin-webapp
+# enterprise/backend/test/metabase_enterprise/cache @metabase/core-backend-admin-webapp
 
-enterprise/backend/src/metabase_enterprise/content_verification @metabase/core-backend-admin-webapp
-enterprise/backend/test/metabase_enterprise/content_verification @metabase/core-backend-admin-webapp
+# enterprise/backend/src/metabase_enterprise/content_verification @metabase/core-backend-admin-webapp
+# enterprise/backend/test/metabase_enterprise/content_verification @metabase/core-backend-admin-webapp
 
-enterprise/backend/src/metabase_enterprise/core @metabase/devexp
-enterprise/backend/test/metabase_enterprise/core @metabase/devexp
+# enterprise/backend/src/metabase_enterprise/core @metabase/devexp
+# enterprise/backend/test/metabase_enterprise/core @metabase/devexp
 
-enterprise/backend/src/metabase_enterprise/dashboard_subscription_filters @metabase/core-workflows
-enterprise/backend/test/metabase_enterprise/dashboard_subscription_filters @metabase/core-workflows
+# enterprise/backend/src/metabase_enterprise/dashboard_subscription_filters @metabase/core-workflows
+# enterprise/backend/test/metabase_enterprise/dashboard_subscription_filters @metabase/core-workflows
 
-enterprise/backend/src/metabase_enterprise/enhancements @metabase/core-backend-admin-webapp
-enterprise/backend/test/metabase_enterprise/enhancements @metabase/core-backend-admin-webapp
+# enterprise/backend/src/metabase_enterprise/enhancements @metabase/core-backend-admin-webapp
+# enterprise/backend/test/metabase_enterprise/enhancements @metabase/core-backend-admin-webapp
 
-# enterprise/backend/src/metabase_enterprise/llm
-# enterprise/backend/test/metabase_enterprise/llm
+# # enterprise/backend/src/metabase_enterprise/llm
+# # enterprise/backend/test/metabase_enterprise/llm
 
-enterprise/backend/src/metabase_enterprise/query_reference_validation @metabase/core-backend-admin-webapp
-enterprise/backend/test/metabase_enterprise/query_reference_validation @metabase/core-backend-admin-webapp
+# enterprise/backend/src/metabase_enterprise/query_reference_validation @metabase/core-backend-admin-webapp
+# enterprise/backend/test/metabase_enterprise/query_reference_validation @metabase/core-backend-admin-webapp
 
-enterprise/backend/src/metabase_enterprise/sandbox @metabase/core-backend-admin-webapp
-enterprise/backend/test/metabase_enterprise/sandbox @metabase/core-backend-admin-webapp
+# enterprise/backend/src/metabase_enterprise/sandbox @metabase/core-backend-admin-webapp
+# enterprise/backend/test/metabase_enterprise/sandbox @metabase/core-backend-admin-webapp
 
-enterprise/backend/src/metabase_enterprise/scim @metabase/core-backend-admin-webapp
-enterprise/backend/test/metabase_enterprise/scim @metabase/core-backend-admin-webapp
+# enterprise/backend/src/metabase_enterprise/scim @metabase/core-backend-admin-webapp
+# enterprise/backend/test/metabase_enterprise/scim @metabase/core-backend-admin-webapp
 
-enterprise/backend/src/metabase_enterprise/search @metabase/core-workflows
-enterprise/backend/test/metabase_enterprise/search @metabase/core-workflows
+# enterprise/backend/src/metabase_enterprise/search @metabase/core-workflows
+# enterprise/backend/test/metabase_enterprise/search @metabase/core-workflows
 
-enterprise/backend/src/metabase_enterprise/serialization @metabase/core-workflows
-enterprise/backend/test/metabase_enterprise/serialization @metabase/core-workflows
+# enterprise/backend/src/metabase_enterprise/serialization @metabase/core-workflows
+# enterprise/backend/test/metabase_enterprise/serialization @metabase/core-workflows
 
-enterprise/backend/src/metabase_enterprise/snippet_collections @metabase/core-backend-admin-webapp
-enterprise/backend/test/metabase_enterprise/snippet_collections @metabase/core-backend-admin-webapp
+# enterprise/backend/src/metabase_enterprise/snippet_collections @metabase/core-backend-admin-webapp
+# enterprise/backend/test/metabase_enterprise/snippet_collections @metabase/core-backend-admin-webapp
 
-enterprise/backend/src/metabase_enterprise/sso @metabase/core-backend-admin-webapp
-enterprise/backend/test/metabase_enterprise/sso @metabase/core-backend-admin-webapp
+# enterprise/backend/src/metabase_enterprise/sso @metabase/core-backend-admin-webapp
+# enterprise/backend/test/metabase_enterprise/sso @metabase/core-backend-admin-webapp
 
-enterprise/backend/src/metabase_enterprise/stale @metabase/core-backend-admin-webapp
-enterprise/backend/test/metabase_enterprise/stale @metabase/core-backend-admin-webapp
+# enterprise/backend/src/metabase_enterprise/stale @metabase/core-backend-admin-webapp
+# enterprise/backend/test/metabase_enterprise/stale @metabase/core-backend-admin-webapp
 
-enterprise/backend/src/metabase_enterprise/stats @metabase/core-backend-admin-webapp
-enterprise/backend/test/metabase_enterprise/stats @metabase/core-backend-admin-webapp
+# enterprise/backend/src/metabase_enterprise/stats @metabase/core-backend-admin-webapp
+# enterprise/backend/test/metabase_enterprise/stats @metabase/core-backend-admin-webapp
 
-enterprise/backend/src/metabase_enterprise/task @metabase/core-backend-admin-webapp
-enterprise/backend/test/metabase_enterprise/task @metabase/core-backend-admin-webapp
+# enterprise/backend/src/metabase_enterprise/task @metabase/core-backend-admin-webapp
+# enterprise/backend/test/metabase_enterprise/task @metabase/core-backend-admin-webapp
 
-enterprise/backend/src/metabase_enterprise/upload_management @metabase/core-backend-admin-webapp
-enterprise/backend/test/metabase_enterprise/upload_management @metabase/core-backend-admin-webapp
+# enterprise/backend/src/metabase_enterprise/upload_management @metabase/core-backend-admin-webapp
+# enterprise/backend/test/metabase_enterprise/upload_management @metabase/core-backend-admin-webapp
 
-src/metabase/actions @metabase/core-backend-admin-webapp
-test/metabase/actions @metabase/core-backend-admin-webapp
+# src/metabase/actions @metabase/core-backend-admin-webapp
+# test/metabase/actions @metabase/core-backend-admin-webapp
 
-src/metabase/activity_feed @metabase/core-backend-admin-webapp
-test/metabase/activity_feed @metabase/core-backend-admin-webapp
+# src/metabase/activity_feed @metabase/core-backend-admin-webapp
+# test/metabase/activity_feed @metabase/core-backend-admin-webapp
 
-src/metabase/analytics @metabase/core-backend-admin-webapp
-test/metabase/analytics @metabase/core-backend-admin-webapp
+# src/metabase/analytics @metabase/core-backend-admin-webapp
+# test/metabase/analytics @metabase/core-backend-admin-webapp
 
-src/metabase/analyze @metabase/drivers
-test/metabase/analyze @metabase/drivers
+# src/metabase/analyze @metabase/drivers
+# test/metabase/analyze @metabase/drivers
 
-src/metabase/api @metabase/devexp
-test/metabase/api @metabase/devexp
+# src/metabase/api @metabase/devexp
+# test/metabase/api @metabase/devexp
 
-src/metabase/audit @metabase/core-backend-admin-webapp
-test/metabase/audit @metabase/core-backend-admin-webapp
+# src/metabase/audit @metabase/core-backend-admin-webapp
+# test/metabase/audit @metabase/core-backend-admin-webapp
 
-src/metabase/auth_provider @metabase/core-backend-admin-webapp
-test/metabase/auth_provider @metabase/core-backend-admin-webapp
+# src/metabase/auth_provider @metabase/core-backend-admin-webapp
+# test/metabase/auth_provider @metabase/core-backend-admin-webapp
 
-src/metabase/bookmarks @metabase/core-backend-admin-webapp
-test/metabase/bookmarks @metabase/core-backend-admin-webapp
+# src/metabase/bookmarks @metabase/core-backend-admin-webapp
+# test/metabase/bookmarks @metabase/core-backend-admin-webapp
 
-src/metabase/cmd @metabase/devexp
-test/metabase/cmd @metabase/devexp
+# src/metabase/cmd @metabase/devexp
+# test/metabase/cmd @metabase/devexp
 
-src/metabase/channel @metabase/core-workflows
-test/metabase/channel @metabase/core-workflows
+# src/metabase/channel @metabase/core-workflows
+# test/metabase/channel @metabase/core-workflows
 
-src/metabase/cloud_migration @metabase/core-workflows
-test/metabase/cloud_migration @metabase/core-workflows
+# src/metabase/cloud_migration @metabase/core-workflows
+# test/metabase/cloud_migration @metabase/core-workflows
 
-src/metabase/cmd @metabase/devexp
-test/metabase/cmd @metabase/devexp
+# src/metabase/cmd @metabase/devexp
+# test/metabase/cmd @metabase/devexp
 
-src/metabase/config @metabase/devexp
-test/metabase/config @metabase/devexp
+# src/metabase/config @metabase/devexp
+# test/metabase/config @metabase/devexp
 
-src/metabase/core @metabase/devexp
-test/metabase/core @metabase/devexp
+# src/metabase/core @metabase/devexp
+# test/metabase/core @metabase/devexp
 
-src/metabase/db @metabase/core-backend-admin-webapp
-test/metabase/db @metabase/core-backend-admin-webapp
+# src/metabase/db @metabase/core-backend-admin-webapp
+# test/metabase/db @metabase/core-backend-admin-webapp
 
-src/metabase/driver @metabase/drivers
-test/metabase/driver @metabase/drivers
+# src/metabase/driver @metabase/drivers
+# test/metabase/driver @metabase/drivers
 
-src/metabase/eid_translation @metabase/core-backend-admin-webapp
-test/metabase/eid_translation @metabase/core-backend-admin-webapp
+# src/metabase/eid_translation @metabase/core-backend-admin-webapp
+# test/metabase/eid_translation @metabase/core-backend-admin-webapp
 
-src/metabase/embed @metabase/embedding
-test/metabase/embed @metabase/embedding
+# src/metabase/embed @metabase/embedding
+# test/metabase/embed @metabase/embedding
 
-src/metabase/events @metabase/devexp
-test/metabase/events @metabase/devexp
+# src/metabase/events @metabase/devexp
+# test/metabase/events @metabase/devexp
 
-src/metabase/formatter @metabase/core-backend-querying
-test/metabase/formatter @metabase/core-backend-querying
+# src/metabase/formatter @metabase/core-backend-querying
+# test/metabase/formatter @metabase/core-backend-querying
 
-src/metabase/indexed_entities @metabase/core-backend-querying
-test/metabase/indexed_entities @metabase/core-backend-querying
+# src/metabase/indexed_entities @metabase/core-backend-querying
+# test/metabase/indexed_entities @metabase/core-backend-querying
 
-src/metabase/integrations @metabase/core-workflows
-test/metabase/integrations @metabase/core-workflows
+# src/metabase/integrations @metabase/core-workflows
+# test/metabase/integrations @metabase/core-workflows
 
-src/metabase/legacy_mbql @metabase/core-backend-querying
-test/metabase/legacy_mbql @metabase/core-backend-querying
+# src/metabase/legacy_mbql @metabase/core-backend-querying
+# test/metabase/legacy_mbql @metabase/core-backend-querying
 
-src/metabase/lib @metabase/core-backend-querying
-test/metabase/lib @metabase/core-backend-querying
+# src/metabase/lib @metabase/core-backend-querying
+# test/metabase/lib @metabase/core-backend-querying
 
-src/metabase/logger @metabase/devexp
-test/metabase/logger @metabase/devexp
+# src/metabase/logger @metabase/devexp
+# test/metabase/logger @metabase/devexp
 
-src/metabase/login_history @metabase/core-backend-admin-webapp
-test/metabase/login_history @metabase/core-backend-admin-webapp
+# src/metabase/login_history @metabase/core-backend-admin-webapp
+# test/metabase/login_history @metabase/core-backend-admin-webapp
 
-src/metabase/model_persistence @metabase/core-backend-querying
-test/metabase/model_persistence @metabase/core-backend-querying
+# src/metabase/model_persistence @metabase/core-backend-querying
+# test/metabase/model_persistence @metabase/core-backend-querying
 
-src/metabase/models @metabase/devexp
-test/metabase/models @metabase/devexp
+# src/metabase/models @metabase/devexp
+# test/metabase/models @metabase/devexp
 
-src/metabase/moderation @metabase/core-backend-admin-webapp
-test/metabase/moderation @metabase/core-backend-admin-webapp
+# src/metabase/moderation @metabase/core-backend-admin-webapp
+# test/metabase/moderation @metabase/core-backend-admin-webapp
 
-src/metabase/notification @metabase/core-workflows
-test/metabase/notification @metabase/core-workflows
+# src/metabase/notification @metabase/core-workflows
+# test/metabase/notification @metabase/core-workflows
 
-src/metabase/permissions @metabase/core-backend-admin-webapp
-test/metabase/permissions @metabase/core-backend-admin-webapp
+# src/metabase/permissions @metabase/core-backend-admin-webapp
+# test/metabase/permissions @metabase/core-backend-admin-webapp
 
-src/metabase/plugins @metabase/devexp
-test/metabase/plugins @metabase/devexp
+# src/metabase/plugins @metabase/devexp
+# test/metabase/plugins @metabase/devexp
 
-src/metabase/premium_features @metabase/core-backend-admin-webapp
-test/metabase/premium_features @metabase/core-backend-admin-webapp
+# src/metabase/premium_features @metabase/core-backend-admin-webapp
+# test/metabase/premium_features @metabase/core-backend-admin-webapp
 
-src/metabase/public_settings @metabase/core-backend-admin-webapp
-test/metabase/public_settings @metabase/core-backend-admin-webapp
+# src/metabase/public_settings @metabase/core-backend-admin-webapp
+# test/metabase/public_settings @metabase/core-backend-admin-webapp
 
-src/metabase/public_sharing @metabase/core-backend-admin-webapp
-test/metabase/public_sharing @metabase/core-backend-admin-webapp
+# src/metabase/public_sharing @metabase/core-backend-admin-webapp
+# test/metabase/public_sharing @metabase/core-backend-admin-webapp
 
-src/metabase/pulse @metabase/core-workflows
-test/metabase/pulse @metabase/core-workflows
+# src/metabase/pulse @metabase/core-workflows
+# test/metabase/pulse @metabase/core-workflows
 
-src/metabase/query_analysis @metabase/core-backend-querying
-test/metabase/query_analysis @metabase/core-backend-querying
+# src/metabase/query_analysis @metabase/core-backend-querying
+# test/metabase/query_analysis @metabase/core-backend-querying
 
-src/metabase/query_processor @metabase/core-backend-querying
-test/metabase/query_processor @metabase/core-backend-querying
+# src/metabase/query_processor @metabase/core-backend-querying
+# test/metabase/query_processor @metabase/core-backend-querying
 
-src/metabase/request @metabase/devexp
-test/metabase/request @metabase/devexp
+# src/metabase/request @metabase/devexp
+# test/metabase/request @metabase/devexp
 
-src/metabase/revisions @metabase/core-backend-admin-webapp
-test/metabase/revisions @metabase/core-backend-admin-webapp
+# src/metabase/revisions @metabase/core-backend-admin-webapp
+# test/metabase/revisions @metabase/core-backend-admin-webapp
 
-src/metabase/sample_data @metabase/core-backend-admin-webapp
-test/metabase/sample_data @metabase/core-backend-admin-webapp
+# src/metabase/sample_data @metabase/core-backend-admin-webapp
+# test/metabase/sample_data @metabase/core-backend-admin-webapp
 
-src/metabase/search @metabase/core-workflows
-test/metabase/search @metabase/core-workflows
+# src/metabase/search @metabase/core-workflows
+# test/metabase/search @metabase/core-workflows
 
-src/metabase/segments @metabase/core-backend-querying
-test/metabase/segments @metabase/core-backend-querying
+# src/metabase/segments @metabase/core-backend-querying
+# test/metabase/segments @metabase/core-backend-querying
 
-src/metabase/server @metabase/devexp
-test/metabase/server @metabase/devexp
+# src/metabase/server @metabase/devexp
+# test/metabase/server @metabase/devexp
 
-src/metabase/session @metabase/core-backend-admin-webapp
-test/metabase/session @metabase/core-backend-admin-webapp
+# src/metabase/session @metabase/core-backend-admin-webapp
+# test/metabase/session @metabase/core-backend-admin-webapp
 
-src/metabase/setup @metabase/core-backend-admin-webapp
-test/metabase/setup @metabase/core-backend-admin-webapp
+# src/metabase/setup @metabase/core-backend-admin-webapp
+# test/metabase/setup @metabase/core-backend-admin-webapp
 
-src/metabase/sso @metabase/core-backend-admin-webapp
-test/metabase/sso @metabase/core-backend-admin-webapp
+# src/metabase/sso @metabase/core-backend-admin-webapp
+# test/metabase/sso @metabase/core-backend-admin-webapp
 
-src/metabase/sync @metabase/drivers
-test/metabase/sync @metabase/drivers
+# src/metabase/sync @metabase/drivers
+# test/metabase/sync @metabase/drivers
 
-src/metabase/task @metabase/devexp
-test/metabase/task @metabase/devexp
+# src/metabase/task @metabase/devexp
+# test/metabase/task @metabase/devexp
 
-src/metabase/tiles @metabase/core-backend-dashviz
-test/metabase/tiles @metabase/core-backend-dashviz
+# src/metabase/tiles @metabase/core-backend-dashviz
+# test/metabase/tiles @metabase/core-backend-dashviz
 
-src/metabase/timeline @metabase/core-backend-dashviz
-test/metabase/timeline @metabase/core-backend-dashviz
+# src/metabase/timeline @metabase/core-backend-dashviz
+# test/metabase/timeline @metabase/core-backend-dashviz
 
-src/metabase/types @metabase/core-backend-querying
-test/metabase/types @metabase/core-backend-querying
+# src/metabase/types @metabase/core-backend-querying
+# test/metabase/types @metabase/core-backend-querying
 
-src/metabase/upload @metabase/core-backend-admin-webapp
-test/metabase/upload @metabase/core-backend-admin-webapp
+# src/metabase/upload @metabase/core-backend-admin-webapp
+# test/metabase/upload @metabase/core-backend-admin-webapp
 
-src/metabase/user_key_value @metabase/core-backend-admin-webapp
-test/metabase/user_key_value @metabase/core-backend-admin-webapp
+# src/metabase/user_key_value @metabase/core-backend-admin-webapp
+# test/metabase/user_key_value @metabase/core-backend-admin-webapp
 
-src/metabase/util @metabase/devexp
-test/metabase/util @metabase/devexp
+# src/metabase/util @metabase/devexp
+# test/metabase/util @metabase/devexp
 
-src/metabase/xrays @metabase/core-backend-querying
-test/metabase/xrays @metabase/core-backend-querying
+# src/metabase/xrays @metabase/core-backend-querying
+# test/metabase/xrays @metabase/core-backend-querying

.github/PULL_REQUEST_TEMPLATE.md

@@ -3,7 +3,7 @@
 
 > **Warning**
 >
-> If that is your first contribution to Metabase, please sign the [Contributor License Agreement](https://docs.google.com/a/metabase.com/forms/d/1oV38o7b9ONFSwuzwmERRMi9SYrhYeOrkbmNaq9pOJ_E/viewform) (unless it's a tiny documentation change). Also, if you're attempting to fix a translation issue, please submit your changes to our [POEditor project](https://poeditor.com/join/project/ynjQmwSsGh) instead of opening a PR.
+> If that is your first contribution to Metabase, please sign the [Contributor License Agreement](https://docs.google.com/a/metabase.com/forms/d/1oV38o7b9ONFSwuzwmERRMi9SYrhYeOrkbmNaq9pOJ_E/viewform) (unless it's a tiny documentation change). Also, if you're attempting to fix a translation issue, please submit your changes to our [Crowdin project](https://crowdin.com/project/metabase-i18n) instead of opening a PR.
 
 Closes https://github.com/metabase/metabase/issues/[issue_number]
 

.github/actions/build-ee-extra/action.yml

@@ -1,116 +0,0 @@
-name: Build ee-extra
-description: Build Metabase Enterprise Edition with extra features
-
-inputs:
-  java-version:
-    required: true
-    default: 21
-  iam-role:
-    description: "The IAM role to assume"
-    required: true
-
-runs:
-  using: composite
-  steps:
-    - name: Prepare Java
-      uses: actions/setup-java@v3
-      with:
-        java-version: ${{ inputs.java-version }}
-        distribution: 'temurin'
-    - name: Reveal its original version.properties
-      run: jar xf ./bin/docker/metabase.jar version.properties && cat version.properties
-      shell: bash
-    - name: get major version
-      id: major_version
-      run: echo "major_version=$(cat version.properties | grep 'tag=' | cut -d'.' -f2)" >> $GITHUB_OUTPUT
-      shell: bash
-    - name: get drivers registry
-      run: |
-        curl -OL https://raw.githubusercontent.com/metabase/metabase-registry/main/registry.yaml
-      shell: bash
-    - uses: actions/setup-node@v4
-      with:
-        node-version: lts/Jod # 22.x.x
-    - run: rm package.json && npm install yaml
-      shell: bash
-    - name: parse drivers registry
-      uses: actions/github-script@v7
-      id: drivers_registry
-      with:
-        script: | # js
-          const { parse } = require('yaml');
-          const fs = require('fs');
-          const registry = parse(fs.readFileSync('registry.yaml', 'utf8'));
-
-          const drivers = registry.drivers;
-          const majorVersion = '${{ steps.major_version.outputs.major_version }}';
-
-          const getDriverUrl = (driverName) => {
-            const driver = drivers.find(driver => driver.name === driverName);
-
-            if (!driver) {
-              throw new Error(`Driver ${driverName} not found in the registry`);
-            }
-
-            const driverUrl = driver.versions[majorVersion] ?? driver.versions.default;
-
-            if (!driverUrl) {
-              throw new Error(`Driver ${driverName} version ${majorVersion} not found in the registry`);
-            }
-
-            return driverUrl;
-          };
-
-          const extraDrivers = {
-            firebolt: getDriverUrl('firebolt'),
-            starburst: getDriverUrl('starburst'),
-            clickhouse: getDriverUrl('clickhouse'),
-            materialize: getDriverUrl('materialize'),
-          };
-
-          console.log(extraDrivers);
-
-          return extraDrivers;
-    - name: Download Firebolt driver
-      run: |
-        curl -OL ${{ fromJson(steps.drivers_registry.outputs.result).firebolt }}
-      working-directory: modules
-      shell: bash
-    - name: Download Starburst driver
-      run: |
-        curl -OL ${{ fromJson(steps.drivers_registry.outputs.result).starburst }}
-      shell: bash
-      working-directory: modules
-    - name: Download Clickhouse driver
-      run: |
-        curl -OL ${{ fromJson(steps.drivers_registry.outputs.result).clickhouse }}
-      shell: bash
-      working-directory: modules
-    - name: Download Materialize driver
-      run: |
-        curl -OL ${{ fromJson(steps.drivers_registry.outputs.result).materialize }}
-      shell: bash
-      working-directory: modules
-    - name: Bundle additional drivers into the Uberjar
-      run: jar uf bin/docker/metabase.jar modules/*.jar
-      shell: bash
-    - name: Launch uberjar
-      run: >-
-        java --add-opens java.base/java.nio=ALL-UNNAMED -jar ./bin/docker/metabase.jar &
-      shell: bash
-    - name: Wait for Metabase to start
-      run: while ! curl 'http://localhost:3000/api/health' | grep '{"status":"ok"}'; do sleep 1; done
-      shell: bash
-    - name: Kill the java process
-      run: pkill -f metabase.jar
-      shell: bash
-    - name: configure aws credentials
-      if: ${{ github.ref_name == 'master' }}
-      uses: aws-actions/configure-aws-credentials@v4
-      with:
-        role-to-assume: ${{ inputs.iam-role }}
-        role-session-name: GitHub_to_AWS_via_FederatedOIDC
-        aws-region: us-east-1
-    - name: Login to Amazon ECR
-      if: ${{ github.ref_name == 'master' }}
-      uses: aws-actions/amazon-ecr-login@v2

.github/actions/create-backport/action.yml

@@ -46,7 +46,7 @@ runs:
           echo "git reset HEAD~1" > ./backport.sh
           echo "rm ./backport.sh" >> ./backport.sh
           echo "git cherry-pick ${COMMIT}" >> ./backport.sh
-          echo "echo 'Resolve conflicts and force push this branch'" >> ./backport.sh
+          echo "echo 'Resolve conflicts and force push this branch.\n\nTo backport translations run: bin/i18n/merge-translations <release-branch>'" >> ./backport.sh
           chmod +x ./backport.sh
           git add ./backport.sh
           git commit -m "Add backport resolution script"

.github/actions/fetch-artifact/action.yml

@@ -0,0 +1,63 @@
+name: Fetch artifact
+description: Fetches a specific artifact and downloads it to the current directory
+
+inputs:
+  name:
+    description: The name of the artifact to fetch
+    required: true
+
+runs:
+  using: "composite"
+  steps:
+    - name: find_release_artifact
+      id: find_release_artifact
+      uses: actions/github-script@v7
+      with:
+        result-encoding: string
+        script: | # js
+          const fs = require('fs');
+
+          const artifacts = await github.rest.actions.listArtifactsForRepo({
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+            name: "${{ inputs.name }}",
+            per_page: 1,
+          });
+
+          if (!artifacts.data?.artifacts?.[0]?.id) {
+            throw new Error(`No artifacts found for ${{ inputs.commit }}`);
+          }
+
+          const artifact_id = artifacts.data.artifacts[0].id;
+
+          const download = await github.rest.actions.downloadArtifact({
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+            artifact_id: artifact_id,
+            archive_format: 'zip',
+          });
+
+          fs.writeFileSync(`${process.env.GITHUB_WORKSPACE}/mb.zip`, Buffer.from(download.data));
+
+    - name: unzip uberjar artifact
+      shell: bash
+      run: unzip mb.zip
+    - name: Move the Uberjar
+      shell: bash
+      run: | # bash
+        if [ -e "metabase.jar" ]; then
+          echo "metabase.jar is already in the right place"
+        elif [ -e "target/uberjar/metabase.jar" ]; then
+            echo "moving metabase.jar to current directory"
+          mv target/uberjar/metabase.jar metabase.jar
+        else
+          echo "Could not find the metabase.jar file"
+          exit 1
+        fi
+
+    - name: Verify that this is a valid JAR file
+      shell: bash
+      run: file --mime-type ./metabase.jar
+    - name: Reveal its version.properties
+      shell: bash
+      run: jar xf metabase.jar version.properties && cat version.properties

.github/actions/notify-pull-request/action.yml

@@ -1,5 +1,13 @@
 name: Notify Pull Request
 inputs:
+  remove-previous-comment:
+    required: false
+    type: boolean
+    default: false
+  add-new-comment:
+    required: false
+    type: boolean
+    default: true
   message:
     required: true
   include-log:
@@ -9,7 +17,44 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - uses: actions/github-script@v7
+    - name: Remove previous pull-request comment
+      uses: actions/github-script@v7
+      if: ${{ inputs.remove-previous-comment == 'true' && always() && github.event_name == 'pull_request' }}
+      with:
+        script: |
+          const pr = context.payload.pull_request ?? context.payload.issue;
+
+          if (!pr) {
+           console.error("This action can only be run on pull requests");
+           return;
+          }
+
+          const { owner, repo } = context.repo;
+
+          const { data: comments } = await github.rest.issues.listComments({
+            owner,
+            repo,
+            issue_number: pr.number,
+          }).catch(console.error);
+
+          if (!comments) {
+            return;
+          }
+
+          const message = "${{ inputs.message }}";
+          const comment = comments.find((comment) => comment.body.includes(message));
+
+          if (comment) {
+            await github.rest.issues.deleteComment({
+              owner,
+              repo,
+              comment_id: comment.id,
+            });
+          }
+
+    - name: Notify pull-request
+      uses: actions/github-script@v7
+      if: ${{ inputs.add-new-comment == 'true' && always() && github.event_name == 'pull_request' }}
       id: notify-pull-request
       with:
         result-encoding: string
@@ -21,7 +66,7 @@ runs:
             return;
           }
 
-          const message = "${{ inputs.message }}"
+          const message = "${{ inputs.message }}";
           const shouldIncludeLog = ${{ inputs.include-log }}.toString() === "true";
           const author = context.payload.sender.login;
 

.github/actions/prepare-cypress/action.yml

@@ -1,6 +1,12 @@
 name: Prepare cypress environment
 description: Cypress preparation steps
 
+inputs:
+  working-directory:
+    description: "Optional working directory for yarn commands"
+    required: false
+    default: "."
+
 outputs:
   chrome-path:
     description: Path to the custom Chrome executable
@@ -33,3 +39,4 @@ runs:
         yarn cypress cache list
         yarn cypress verify
       shell: bash
+      working-directory: ${{ inputs.working-directory }}

.github/actions/test-driver/action.yml

@@ -23,6 +23,8 @@ runs:
       run: yarn build-static-viz
       shell: bash
       if: ${{ inputs.build-static-viz == 'true' }}
+      env:
+        MB_EDITION: ee
     - name: Test database driver
       run: clojure -X:dev:ci:ee:ee-dev:drivers:drivers-dev:test ${{ inputs.test-args }}
       shell: bash

.github/actions/upgrade-backend-deps/action.yml

@@ -0,0 +1,14 @@
+name: Create Backend Dep Bump PRs
+
+inputs:
+  github-token:
+    required: true
+
+runs:
+  using: "composite"
+  steps:
+    - name: Open PRs to Bump Backend Deps
+      env:
+        GITHUB_TOKEN: ${{ inputs.github-token }}
+      shell: bash
+      run: bash ${{ github.action_path }}/upgrade-deps.sh

.github/actions/upgrade-backend-deps/upgrade-deps.sh

@@ -0,0 +1,81 @@
+#! /usr/bin/env bash
+
+# Script is adapted from https://github.com/nnichols/clojure-dependency-update-action/blob/master/dependency-check.sh
+
+# make sure we're in the root dir of the metabase repo
+script_dir=`dirname "${BASH_SOURCE[0]}"`
+cd "$script_dir/../../.."
+
+echo `pwd`
+
+# Configure Git user opening PRs to the GH Actions bot.
+git config --global user.email "metabase-bot@metabase.com"
+git config --global user.name "Metabase bot"
+
+# Run antq to check for outdated dependencies and output to UPGRADE_LIST
+echo "::group::Checking for outdated dependencies"
+UPGRADE_LIST=$(clojure -M:outdated --reporter=format --error-format="{{name}},{{version}},{{latest-version}},{{diff-url}}")
+echo "$UPGRADE_LIST"
+echo "::endgroup::"
+
+# Parse the output of antq into a list of upgrades, and remove any failed fetches
+UPGRADES=$(echo ${UPGRADE_LIST} | sed '/Failed to fetch/d' | sed '/Unable to fetch/d' | sed '/Logging initialized/d' | sort -u)
+
+echo "::group::Upgrades"
+echo ${UPGRADES}
+echo "::endgroup::"
+
+# Make sure we're on master
+git checkout master
+
+# Iterate over all upgrades
+for upgrade in $UPGRADES; do
+
+  echo "::group::Processing upgrade"
+
+  # Parse each upgrade into its constituent parts
+  IFS=',' temp=($upgrade)
+  DEP_NAME=${temp[0]}
+  OLD_VERSION=${temp[1]}
+  NEW_VERSION=${temp[2]}
+  DIFF_URL=${temp[3]}
+  MODIFIED_FILE=${temp[4]}
+  BRANCH_NAME="dependencies/clojure/$DEP_NAME-$NEW_VERSION"
+
+  # Checkout the branch if it exists, otherwise create it
+  echo "Checking out" $BRANCH_NAME
+  git checkout $BRANCH_NAME || git checkout -b $BRANCH_NAME
+
+  # IF we successfully created a new branch, update the dependency
+  if [[ $? == 0 ]]; then
+
+    # Use antq to update the dependency
+    echo "Updating" $DEP_NAME "version" $OLD_VERSION "to" $NEW_VERSION
+    UPDATE_CMD="clojure -M:outdated --upgrade --force --focus=${DEP_NAME}"
+    eval ${UPDATE_CMD} || $(echo "Cannot update ${DEP_NAME}. Continuing" && git checkout master && continue)
+
+    TITLE="Bump $DEP_NAME from $OLD_VERSION to $NEW_VERSION"
+    BODY="Inspect dependency changes here: $DIFF_URL"
+
+    # Commit the dependency update, and link to the diff
+    git add deps.edn modules
+    git commit -m ${TITLE} -m ${BODY} --no-verify
+    git push -u origin $BRANCH_NAME
+
+    # Open the PR
+    echo "Opening pull request for" $DEP_NAME
+    PR_URL=$(gh pr create --base master --head $BRANCH_NAME --label "no-backport" --title ${TITLE} --body ${BODY})
+    PR_NUMBER=${PR_URL##*/}
+    echo "Opened PR #$PR_NUMBER"
+
+    # Make the PR Auto-Merge
+    gh pr merge -R metabase/metabase --squash --auto "$PR_NUMBER"
+
+    # Print a blank line, and reset the branch
+    echo "Checking out master" master
+    git checkout master
+  fi
+
+  echo "::endgroup::"
+
+done

.github/actions/upload-test-results/action.yml

@@ -18,6 +18,9 @@ inputs:
     required: true
   trunk-api-token:
     required: true
+  variant:
+    required: false
+    default: ''
 
 runs:
   using: "composite"
@@ -49,6 +52,7 @@ runs:
       uses: trunk-io/analytics-uploader@main
       with:
         junit-paths: ${{ inputs.input-path }}
+        variant: ${{ inputs.variant || inputs.output-name }}
         org-slug: metabase
         token: ${{ inputs.trunk-api-token }}
       continue-on-error: true

.github/auto_request_review.yml

@@ -6,7 +6,7 @@ files:
   # migrations related files
   'resources/migrations/**':
     - team:core-workflows
-  'src/metabase/db/custom_migrations.clj':
+  'src/metabase/app_db/custom_migrations.clj':
     - team:core-workflows
 
 options:

.github/file-paths.yaml

@@ -26,16 +26,21 @@ frontend_sources: &frontend_sources
   - "babel.config.json"
   - ".eslintrc.js"
   - "postcss.config.js"
+  - "rspack.config.js"
   - "webpack.config.js"
   - "webpack.embedding-sdk.config.js"
   - "webpack.static-viz.config.js"
   - ".nvmrc"
 
+frontend_embedding_sdk_sources:
+  - *frontend_sources
+
 frontend_specs: &frontend_specs
   - *shared_specs
   - "frontend/test/**"
   - "frontend/**/tests/**"
   - "frontend/**/*.unit.*"
+  - ".github/**/*.unit.spec.*"
   - "jest.config.js"
   - "jest.tz.unit.conf.json"
 
@@ -105,9 +110,6 @@ e2e_ci: &e2e_ci
 e2e_specs: &e2e_specs
   - "**/*.cy.*.js"
   - "**/*.cy.*.ts"
-  - "e2e/runner/**"
-  - "e2e/support/**"
-  - "e2e/snapshot*/**"
 
 e2e_cross_version: &e2e_cross_version
   - ".github/workflows/e2e-cross-version.yml"
@@ -118,12 +120,14 @@ e2e_all:
   - *e2e_ci
   - *sources
   - *e2e_specs
+  - "e2e/**"
 
 snowplow:
   - ".github/workflows/snowplow.yml"
   - "snowplow/**"
 
 documentation:
+  - ".typedoc/**"
   - "docs/**"
   - "**/*.md"
 

.github/scripts/build-e2e-matrix.js

@@ -0,0 +1,84 @@
+// This script is used in .github/workflows/e2e-matrix-builder.yml
+// its aim is to split the e2e test matrix into multiple jobs
+// grouping some specific tests together, other tests are split into chunks
+
+const DEFAULT_SPEC_PATTERN = "./e2e/test/scenarios/**/*.cy.spec.*";
+const EMBEDDING_SDK_SPEC_PATTERN =
+  "./e2e/test/scenarios/embedding-sdk/**.cy.spec.*";
+
+const specialTestConfigs = [
+  {
+    name: "embedding-sdk",
+    specs: EMBEDDING_SDK_SPEC_PATTERN,
+  },
+  {
+    name: "oss-subset",
+    edition: "oss",
+    tags: "@OSS @smoke+-@EE",
+    specs: DEFAULT_SPEC_PATTERN,
+  },
+  { name: "mongo", tags: "@mongo", specs: DEFAULT_SPEC_PATTERN },
+];
+
+/**
+ *
+ * @param {*} inputSpecs - specs, which were changed in the PR, separated by comma
+ * .e.g e2e/test/scenarios/onboarding/command-palette.cy.spec.js,e2e/test/scenarios/question/document-title.cy.spec.js
+ * or a pattern like DEFAULT_SPEC_PATTERN
+ */
+function buildMatrix(options, inputSpecs, inputChunks) {
+  const { java, defaultRunner } = options;
+
+  // number of specs per chunk when running specific specs
+  const SPECS_PER_CHUNK = 5;
+
+  const defaultOptions = {
+    "java-version": java,
+    runner: defaultRunner,
+    edition: "ee",
+  };
+
+  const isDefaultSpecPattern =
+    inputSpecs === "" || inputSpecs === DEFAULT_SPEC_PATTERN;
+
+  console.log("Processed specs value:", inputSpecs);
+  console.log("Is default pattern:", isDefaultSpecPattern);
+
+  let regularChunks;
+  if (isDefaultSpecPattern) {
+    regularChunks = inputChunks - specialTestConfigs.length;
+  } else {
+    // when pattern is not default, it means we passed some custom list of the changed specs
+    // so we need to calculate how many chunks we need to run
+    const matchingSpecsCount = inputSpecs.split(",").length;
+    regularChunks = Math.max(
+      1,
+      Math.ceil(matchingSpecsCount / SPECS_PER_CHUNK),
+    );
+  }
+
+  const regularTests = new Array(regularChunks).fill(1).map((files, index) => ({
+    name: `e2e-group-${index + 1}`,
+    // works when specs less than 5, otherwise seems all chunks will contain
+    // same specs
+    ...(!isDefaultSpecPattern && {
+      specs: inputSpecs
+        .split(",")
+        .slice(SPECS_PER_CHUNK * index, SPECS_PER_CHUNK * (index + 1))
+        .join(","),
+    }),
+  }));
+
+  const testSets = isDefaultSpecPattern
+    ? regularTests.concat(specialTestConfigs)
+    : regularTests;
+
+  const config = testSets.map((options) => ({
+    ...defaultOptions,
+    ...options,
+  }));
+
+  return { config, regularChunks, isDefaultSpecPattern };
+}
+
+module.exports = { buildMatrix };

.github/scripts/build-e2e-matrix.unit.spec.js

@@ -0,0 +1,97 @@
+const { buildMatrix } = require("./build-e2e-matrix");
+
+describe("buildMatrix", () => {
+  const options = {
+    java: "11",
+    defaultRunner: "ubuntu-22.04",
+  };
+  const testBuildMatrix = (entry, chunks) =>
+    buildMatrix(options, entry, chunks);
+
+  it("should calculate correct regular chunks with default parameters", () => {
+    const result = testBuildMatrix("./e2e/test/scenarios/**/*.cy.spec.*", 30);
+
+    expect(result.regularChunks).toBe(27);
+  });
+
+  it("should create correct number of configuration objects", () => {
+    const result = testBuildMatrix("./e2e/test/scenarios/**/*.cy.spec.*", 10);
+
+    expect(result.config.length).toBe(10);
+  });
+
+  it("should apply default specs path when empty entry is provided", () => {
+    const result = testBuildMatrix("", 5);
+
+    expect(result.regularChunks).toBe(2);
+    expect(result.config.length).toBe(5);
+  });
+
+  it("should name regular test groups sequentially", () => {
+    const result = testBuildMatrix("./e2e/test/scenarios/**/*.cy.spec.*", 10);
+    const regularTests = result.config.filter((cfg) =>
+      cfg.name.startsWith("e2e-group-"),
+    );
+
+    regularTests.forEach((test, index) => {
+      expect(test.name).toBe(`e2e-group-${index + 1}`);
+    });
+  });
+
+  it("should handle case when input chunks equals special tests count", () => {
+    const result = testBuildMatrix("./e2e/test/scenarios/**/*.cy.spec.*", 3);
+
+    expect(result.regularChunks).toBe(0);
+    expect(result.config.length).toBe(3);
+    expect(result.config[0].name).toBe("embedding-sdk");
+    expect(result.config[1].name).toBe("oss-subset");
+    expect(result.config[2].name).toBe("mongo");
+  });
+
+  it("should correctly calculate regularChunks for non-default spec pattern", () => {
+    const entry = "file.cy.spec.js,".repeat(12).slice(0, -1);
+    const result = testBuildMatrix(entry, 10);
+
+    // For 12 matching specs with SPECS_PER_CHUNK=5, we expect ceil(12/5) = 3 chunks
+    expect(result.regularChunks).toBe(3);
+
+    const firstGroupSpecs = result.config[0].specs.split(",").length;
+    const secondGroupSpecs = result.config[1].specs.split(",").length;
+    const thirdGroupSpecs = result.config[2].specs.split(",").length;
+
+    expect(firstGroupSpecs).toBe(5);
+    expect(secondGroupSpecs).toBe(5);
+    expect(thirdGroupSpecs).toBe(2);
+  });
+
+  it("should return isDefaultSpecPattern as true when empty or default value is provided", () => {
+    let result = testBuildMatrix("", 5);
+
+    expect(result.isDefaultSpecPattern).toBe(true);
+
+    result = testBuildMatrix("./e2e/test/scenarios/**/*.cy.spec.*", 5);
+
+    expect(result.isDefaultSpecPattern).toBe(true);
+  });
+
+  it("should return isDefaultSpecPattern as false when non-default spec pattern is provided", () => {
+    const result = testBuildMatrix("test1.cy.spec.js,test2.cy.spec.js", 1);
+
+    expect(result.isDefaultSpecPattern).toBe(false);
+  });
+
+  it("should return special test configs when default spec pattern is provided", () => {
+    const result = testBuildMatrix("./e2e/test/scenarios/**/*.cy.spec.*", 50);
+
+    expect(result.config[47].name).toBe("embedding-sdk");
+    expect(result.config[48].name).toBe("oss-subset");
+    expect(result.config[49].name).toBe("mongo");
+  });
+
+  it("should not return special test configs when non-default spec pattern is provided", () => {
+    const result = testBuildMatrix("test1.cy.spec.js,test2.cy.spec.js", 50);
+
+    expect(result.config.length).toBe(1);
+    expect(result.config[0].name).toBe("e2e-group-1");
+  });
+});

.github/scripts/update-pr-with-issues.js

@@ -0,0 +1,241 @@
+const https = require('https');
+
+function getLinkedIssues(body) {
+  const matches = body.match(
+    /(close(s|d)?|fixe?(s|d)?|resolve(s|d)?)(:?) (#|https?:\/\/github\.com\/.+metabase\/issues\/)(\d+)/gi,
+  );
+
+  if (matches) {
+    console.log(`Matches: ${matches}`);
+    return matches.map(m => {
+      const numberMatch = m.match(/\d+/);
+      return numberMatch ? numberMatch[0] : null;
+    });
+  }
+
+  return [];
+}
+
+// Function to make HTTPS requests
+function httpsRequest(options, data = null) {
+  return new Promise((resolve, reject) => {
+    const req = https.request(options, (res) => {
+      let responseData = '';
+      res.on('data', (chunk) => {
+        responseData += chunk;
+      });
+      res.on('end', () => {
+        if (res.statusCode >= 200 && res.statusCode < 300) {
+          try {
+            resolve(JSON.parse(responseData));
+          } catch (e) {
+            resolve(responseData);
+          }
+        } else {
+          reject(new Error(`Request failed with status code ${res.statusCode}: ${responseData}`));
+        }
+      });
+    });
+
+    req.on('error', (error) => {
+      reject(error);
+    });
+
+    if (data) {
+      req.write(data);
+    }
+
+    req.end();
+  });
+}
+
+// Makes an HTTPS request with exponential backoff retry logic
+async function httpsRequestWithBackoff(options, data = null, backoffOptions = {}) {
+  // Set default backoff options:
+  const {
+    maxRetries = 8,
+    totalDurationSeconds = 60
+  } = backoffOptions;
+
+  let retries = 0;
+  let delay = 500; // Start with a .5 second delay
+
+  // Calculate a reasonable initial delay based on total duration and max retries
+  // This helps distribute the retry attempts across the total allowed duration
+  const totalDurationMs = totalDurationSeconds * 1000;
+
+  // Track the start time
+  const startTime = Date.now();
+
+  // Ensure data is stringified if it's an object
+  const requestData = data ? (typeof data === 'string' ? data : JSON.stringify(data)) : null;
+
+  while (true) {
+    try {
+      const response = await httpsRequest(options, requestData);
+      return response; // Success: Return the data
+
+    } catch (error) {
+      retries++;
+
+      const elapsedMs = Date.now() - startTime;
+      const timeRemaining = totalDurationMs - elapsedMs;
+
+      // Stop retrying if we've hit max retries or exceeded the total duration
+      if (retries >= maxRetries || timeRemaining <= 0) {
+        console.error(`Failed after ${retries} retries (${Math.round(elapsedMs/1000)}s elapsed):`);
+        throw error;
+      }
+
+      // Calculate the next delay with exponential backoff and jitter
+      delay = Math.min(delay * 2 * (0.8 + Math.random() * 0.4), timeRemaining);
+
+      console.log(`Request failed (attempt ${retries}/${maxRetries}). Retrying in ${Math.round(delay)}ms... (${Math.round(timeRemaining/1000)}s remaining)`);
+
+      // Wait for the calculated delay before trying again
+      await new Promise(resolve => setTimeout(resolve, delay));
+    }
+  }
+}
+
+async function link_issues(github) {
+
+  try {
+    // Get environment variables
+    const githubToken = process.env.GITHUB_TOKEN;
+    const linearApiKey = process.env.LINEAR_API_KEY;
+    const prNumber = process.env.PR_NUMBER;
+    const repoOwner = process.env.REPO_OWNER;
+    const repoName = process.env.REPO_NAME;
+
+    if (!githubToken || !linearApiKey || !prNumber || !repoOwner || !repoName) {
+      console.error('Missing required environment variables');
+      process.exit(1);
+    }
+
+    // Get PR details from GitHub API
+    const prInfo = await github.rest.issues.get({
+      owner: repoOwner,
+      repo: repoName,
+      issue_number: prNumber
+    }).catch((err) => {
+      console.log("error getting prInfo:\n" + err);
+    });
+
+    console.log('PR Info:\n' + JSON.stringify(prInfo, null, 2) + "\n");
+
+    if (prInfo &&
+        prInfo.data &&
+        prInfo.data.labels &&
+        prInfo.data.labels.some(label => label.name === "no-auto-issue-links")) {
+      console.log('PR has "no-auto-issue-links" label, skipping...');
+      return;
+    }
+
+    const prUrl = prInfo.data.html_url;
+    console.log(`Processing PR: ${prUrl}`);
+
+    // Query Linear API to find tasks linked to this PR
+    const linearQuery = JSON.stringify({
+      query: `
+        query {
+          attachmentsForURL(url: "${prUrl}") {
+            nodes {
+              issue {
+                id
+                identifier
+                attachments {
+                  nodes {url}}}}}}`});
+
+    console.log('--- Linear API query ---');
+    console.log(linearQuery);
+    console.log('----- End of query -----');
+
+    const linearData = await httpsRequestWithBackoff({
+      hostname: 'api.linear.app',
+      path: '/graphql',
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'Authorization': linearApiKey
+      }
+    },
+    linearQuery,
+    { maxRetries: 8, totalDurationSeconds: 60 });
+
+    console.log('Linear API response:');
+    console.log(JSON.stringify(linearData) + "\n");
+
+    if (!linearData.data || !linearData.data.attachmentsForURL || linearData.data.attachmentsForURL.nodes.length === 0) {
+      console.log('No Linear tasks linked to this PR');
+      return;
+    } else {
+      console.log(`Found ${linearData.data.attachmentsForURL.nodes.length} linked Linear tasks`);
+    }
+
+
+    // Extract GitHub issue numbers from all attachments in the linked Linear task
+    const issueNumbers = [];
+    for (const node of linearData.data.attachmentsForURL.nodes) {
+      console.log(`checking node task: ${JSON.stringify(node)}`)
+      const linearIssue = node.issue;
+
+      for (const attachment of linearIssue.attachments.nodes) {
+        const url = attachment.url;
+        console.log(`-->  checking url: ${url}`)
+        const match = url.match(/github\.com\/metabase\/metabase\/issues\/(\d+)/);
+        if (match) {
+          console.log(`-->  found match: ${match[1]}`)
+          issueNumbers.push(match[1]);
+          console.log("")
+        }
+      }
+    }
+
+    console.log(`Found linked GitHub issues: ${JSON.stringify(issueNumbers)}`);
+
+    if (issueNumbers.length === 0) {
+      console.log(`Found linked GitHub issues: ${JSON.stringify(issueNumbers)}`);
+      console.log('No GitHub issues linked to the Linear task');
+      return;
+    }
+
+    let body = prInfo.data.body || '';
+
+    let linked_issues = getLinkedIssues(body);
+    console.log(`Linked issues: ${linked_issues}`);
+
+    let newBody = body || '';
+
+    let issueNumbersToAdd = issueNumbers.filter(num => !linked_issues.includes(num));
+
+    console.log(`Issue numbers to add: ${issueNumbersToAdd}`);
+
+    if (issueNumbersToAdd.length > 0) {
+
+      // Generate closing references
+      const closingRefs = issueNumbersToAdd.map(num => `closes #${num}`).join(' ');
+
+      const messagePreamble = "<!-- Added by 'Add Issue References to PR' GitHub Action. To disable linking, add 'no-auto-issue-links' label to your PR. -->"
+
+      newBody = `${messagePreamble} ${closingRefs}\n` + newBody;
+
+      // Update PR body with new closing references
+      await github.rest.issues.update({
+        owner: repoOwner,
+        repo: repoName,
+        issue_number: prNumber,
+        body: newBody
+      });
+
+      console.log(`Updated PR #${prNumber} with issue references:\n ${closingRefs}`);
+    } else {
+      console.log('PR already contains all closing references');
+    }
+  } catch (error) {
+    console.error('Error:', error.message);
+    process.exit(1);
+  }
+}
+
+module.exports = {link_issues};

.github/team.json

@@ -3,24 +3,29 @@
     {
       "name": "Querying",
       "label": ".Team/Querying",
-      "projectUrl": "https://github.com/orgs/metabase/projects/97/views/1",
       "members": [
         "ranquild",
-        "kamilmielnik",
         "romeovs",
         "bshepherdson",
         "metamben",
-        "lbrdnk",
         "appleby",
         "uladzimirdev",
         "wzimrin",
         "ericnormand"
       ]
     },
+    {
+      "name": "Semantic Layer",
+      "label": ".Team/SemanticLayer",
+      "members": [
+        "kamilmielnik",
+        "lbrdnk",
+        "bronsa"
+      ]
+    },
     {
       "name": "Drivers",
       "label": ".Team/Drivers",
-      "projectUrl": "https://github.com/orgs/metabase/projects/98/views/1",
       "members": [
         "snoe",
         "rileythomp"
@@ -29,7 +34,6 @@
     {
       "name": "Embedding",
       "label": ".Team/Embedding",
-      "projectUrl": "https://github.com/orgs/metabase/projects/88/views/1",
       "members": [
         "WiNloSt",
         "oisincoveney",
@@ -41,7 +45,6 @@
     {
       "name": "Workflows",
       "label": ".Team/Workflows",
-      "projectUrl": "https://github.com/orgs/metabase/projects/50/views/1",
       "members": [
         "qnkhuat",
         "piranha",
@@ -74,7 +77,8 @@
         "kulyk",
         "tsplude",
         "lorem--ipsum",
-        "noahmoss"
+        "noahmoss",
+        "bpander"
       ]
     },
     {
@@ -84,6 +88,18 @@
         "camsaul",
         "escherize"
       ]
+    },
+     {
+      "name": "Metabot",
+      "label": ".Team/Metabot",
+      "members": [
+        "somtom"
+      ]
+    },
+    {
+      "name": "Product Growth",
+      "label": ".Team/ProductGrowth",
+      "members": ["nemanjaglumac"]
     }
   ]
 }

.github/workflows/athena.yml

@@ -0,0 +1,38 @@
+name: Publish Athena JDBC Driver
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Athena JDBC driver version to publish'
+        required: true
+        type: string
+
+jobs:
+  deploy:
+    name: Publish Athena JDBC Driver
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Check out the code
+        uses: actions/checkout@v4
+
+      - name: Set up Babashka
+        uses: turtlequeue/setup-babashka@v1.7.0
+        with:
+          babashka-version: 1.12.197
+
+      - name: Set up AWS CLI
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-access-key-id: ${{ secrets.AWS_S3_MAVEN_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_S3_MAVEN_SECRET_ACCESS_KEY }}
+          aws-region: ${{ vars.AWS_REGION }}
+
+      - name: Deploy Athena JDBC driver
+        run: ./bin/athena.bb ${{ github.event.inputs.version }} --deploy
+
+      - name: Verify deployment
+        run: |
+          aws s3 ls s3://metabase-maven-downloads/com/metabase/athena-jdbc/${{ github.event.inputs.version }}/
+          echo "Athena JDBC driver version ${{ github.event.inputs.version }} has been deployed"

.github/workflows/backend-cloverage.yml

@@ -19,6 +19,8 @@ jobs:
           m2-cache-key: "cloverage"
       - name: Build static viz frontend
         run: yarn build-static-viz
+        env:
+          MB_EDITION: ee
       - name: Collect the test coverage
         run: clojure -X:dev:ci:ee:ee-dev:test:cloverage
       - name: Upload coverage to codecov.io

.github/workflows/backend.yml

@@ -24,7 +24,7 @@ jobs:
         with:
           m2-cache-key: 'kondo'
       - name: Run clj-kondo
-        run: ./bin/kondo.sh
+        run: ./bin/mage kondo
 
   be-linter-eastwood:
     if: ${{ !inputs.skip }}
@@ -114,6 +114,8 @@ jobs:
       - name: Build static-viz frontend
         if: ${{ matrix.job.build-static-viz == 'true' && !inputs.skip }}
         run: yarn build-static-viz
+        env:
+          MB_EDITION: ${{ matrix.job.edition }}
       - name: Download Static Viz Bundle Artifact
         if: ${{ matrix.job.build-static-viz == 'true' && !inputs.skip }}
         uses: actions/download-artifact@v4
@@ -183,7 +185,7 @@ jobs:
         with:
           m2-cache-key: 'cljfmt'
       - name: Run cljfmt
-        run: clojure -T:cljfmt check
+        run: ./bin/mage cljfmt-all --force-check
 
   be-tests-result:
     needs:

.github/workflows/chromatic.yml

@@ -18,7 +18,6 @@ jobs:
     timeout-minutes: 3
     outputs:
       frontend_all: ${{ steps.changes.outputs.frontend_all }}
-      e2e_specs: ${{ steps.changes.outputs.e2e_specs }}
     steps:
       - uses: actions/checkout@v4
       - name: Test which files changed

.github/workflows/containerize-jar.yml

@@ -0,0 +1,141 @@
+name: Containerize Uberjar
+run-name: Containerize ${{ inputs.tag }} Uberjar
+
+on:
+  workflow_call:
+    inputs:
+      artifact-name:
+        type: string
+      repo:
+        description: owner and repo like "metabase/metabase"
+        type: string
+      tag:
+        type: string
+      commit:
+        type: string
+      release:
+        type: string
+        default: 'true'
+      build-args:
+        type: string
+  workflow_dispatch:
+    inputs:
+      artifact-name:
+        description: usually something like "metabase-release-{{ edition }}-{{ hash }}-uberjar"
+        type: string
+      repo:
+        description: docker owner and repo like "metabase/metabase"
+        type: string
+      tag:
+        description: usually a version like v1.87.2
+        type: string
+      commit:
+        description: the full commit hash
+        type: string
+
+jobs:
+  containerize:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    outputs:
+      platforms: ${{ steps.platforms.outputs.result }}
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
+      # we want the dockerfile from the commit we're building
+    - run: git checkout ${{ inputs.commit }} -- bin/docker
+    - name: Retrieve test build uberjar artifact
+      uses: ./.github/actions/fetch-artifact
+      with:
+        name: ${{ inputs.artifact-name }}
+    - name: Prepare build scripts
+      run: cd ${{ github.workspace }}/release && yarn && yarn build
+    - name: Get platforms
+      id: platforms
+      uses: actions/github-script@v7
+      with:
+        result-encoding: string
+        script: | # js
+          const { getBuildRequirements, isValidVersionString} = require('${{ github.workspace }}/release/dist/index.cjs');
+          const version = "${{ inputs.tag }}".split('-')[0];
+
+          if (!isValidVersionString(version)) {
+            return "linux/amd64,linux/arm64";
+          }
+          // versions before 53 need to be handled differently
+          const buildInfo = getBuildRequirements(version);
+          return buildInfo.platforms;
+    - name: Move the Uberjar to the context dir
+      run: mv ./metabase.jar bin/docker/.
+    - name: Login to Docker Hub
+      uses: docker/login-action@v3
+      with:
+        username: ${{ inputs.release == 'true' && secrets.DOCKERHUB_RELEASE_USERNAME || secrets.DOCKERHUB_USERNAME }}
+        password: ${{ inputs.release == 'true' && secrets.DOCKERHUB_RELEASE_TOKEN || secrets.DOCKERHUB_TOKEN }}
+    - name: Set up QEMU
+      if: contains(steps.platforms.outputs.result, 'arm')
+      uses: docker/setup-qemu-action@v3
+    - name: Set up Docker Buildx
+      if: contains(steps.platforms.outputs.result, 'arm')
+      uses: docker/setup-buildx-action@v3
+    - name: Build multi-arch container
+      if: contains(steps.platforms.outputs.result, 'arm')
+      uses: docker/build-push-action@v6
+      with:
+        context: bin/docker/.
+        platforms: ${{ steps.platforms.outputs.result }}
+        network: host
+        tags: ${{ inputs.repo }}:${{ inputs.tag }}
+        no-cache: true
+        push: true
+        build-args: ${{ inputs.build-args }}
+
+    # we need to do this to get the nice fallback behavior of the legacy manifest file
+    - name: Build container (x86 only)
+      if: contains(steps.platforms.outputs.result, 'arm') == false
+      run: | # bash
+        docker build \
+          -t ${{ inputs.repo }}:${{ inputs.tag }} \
+          --network=host \
+          --push \
+          bin/docker/.
+
+  verify-docker-pull:
+    runs-on: ubuntu-latest
+    needs: containerize
+    timeout-minutes: 15
+    steps:
+    - name: Login to Docker Hub
+      uses: docker/login-action@v3
+      with:
+        username: ${{ inputs.release == 'true' && secrets.DOCKERHUB_RELEASE_USERNAME || secrets.DOCKERHUB_USERNAME }}
+        password: ${{ inputs.release == 'true' && secrets.DOCKERHUB_RELEASE_TOKEN || secrets.DOCKERHUB_TOKEN }}
+    - name: Pull the container image
+      run: docker pull ${{ inputs.repo }}:${{ inputs.tag }}
+    - name: Launch container
+      run: docker run --rm -dp 3000:3000 ${{ inputs.repo }}:${{ inputs.tag }}
+      timeout-minutes: 5
+    - name: Wait for Metabase to start
+      run: while ! curl -s 'http://localhost:3000/api/health' | grep '{"status":"ok"}'; do sleep 1; done
+      timeout-minutes: 5
+
+  verify-docker-pull-arm:
+    runs-on: arm-ubuntu-24-2core
+    needs: containerize
+    if: contains(needs.containerize.outputs.platforms, 'linux/arm64')
+    timeout-minutes: 15
+    steps:
+    - name: Login to Docker Hub
+      uses: docker/login-action@v3
+      with:
+        username: ${{ inputs.release == 'true' && secrets.DOCKERHUB_RELEASE_USERNAME || secrets.DOCKERHUB_USERNAME }}
+        password: ${{ inputs.release == 'true' && secrets.DOCKERHUB_RELEASE_TOKEN || secrets.DOCKERHUB_TOKEN }}
+    - name: Pull the container image
+      run: docker pull ${{ inputs.repo }}:${{ inputs.tag }}
+    - name: Launch container
+      run: docker run --rm -dp 3000:3000 ${{ inputs.repo }}:${{ inputs.tag }}
+      timeout-minutes: 5
+    - name: Wait for Metabase to start
+      run: while ! curl -s 'http://localhost:3000/api/health' | grep '{"status":"ok"}'; do sleep 1; done
+      timeout-minutes: 5

.github/workflows/docs_bump_detected.yml

@@ -0,0 +1,34 @@
+name: Docs Bump Detected
+
+on:
+  pull_request:
+    paths:
+      - 'docs/**'
+
+jobs:
+  push_workflow_to_docs_metabase_github_io_job:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Report changed docs files exist
+        run: |
+          echo "A change in the docs directory was detected."
+
+      - name: Trigger repo dispatch
+        uses: actions/github-script@v7
+        env:
+          BRANCH_NAME: ${{ github.head_ref || github.ref  }}
+        with:
+          github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+          script: | #js
+            if (process.env.BRANCH_NAME === "master" ||
+                /^release-x\.\d+\.x$/.test(process.env.BRANCH_NAME)) {
+              github.rest.repos.createDispatchEvent({
+                owner: "${{ github.repository_owner }}",
+                repo: "docs.metabase.github.io",
+                event_type: "docs_update",
+                client_payload: { branch_name: process.env.BRANCH_NAME
+                }
+              });
+            } else {
+              console.log("Branch name is not to be published: ", process.env.BRANCH_NAME);
+            }

.github/workflows/drivers-stress-test.yml

@@ -42,6 +42,7 @@ on:
           - SQLite
           - SQL Server 2017
           - SQL Server 2022
+          - Starburst
           - Vertica
 
 jobs:
@@ -663,6 +664,31 @@ jobs:
         junit-name: 'be-tests-sqlserver-2022-ee'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
+  be-tests-starburst-ee:
+    if: inputs.driver == 'Starburst'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 90
+    env:
+      CI: 'true'
+      DRIVERS: starburst
+    services:
+      starburst:
+        image: trinodb/trino:latest
+        env:
+          CATALOG_MANAGEMENT: dynamic
+        ports:
+          - "8080:8080"
+    name: Starburst
+    steps:
+    - uses: actions/checkout@v4
+    - name: Make plugins directory
+      run: mkdir plugins
+    - name: Test Starburst driver
+      uses: ./.github/actions/test-driver
+      with:
+        junit-name: 'be-tests-starburst-ee'
+        test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
+
   be-tests-vertica-ee:
     if: inputs.driver == 'Vertica'
     runs-on: ubuntu-22.04

.github/workflows/drivers.yml

@@ -12,33 +12,6 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  be-tests-h2:
-    if: ${{ !inputs.skip }}
-    runs-on: ubuntu-22.04
-    timeout-minutes: 60
-    env:
-      CI: 'true'
-    name: H2
-    steps:
-    - uses: actions/checkout@v4
-    - name: Test H2 driver
-      uses: ./.github/actions/test-driver
-      with:
-        junit-name: 'be-tests-h2'
-        test-args: >-
-          :only-tags [:mb/driver-tests]
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
-        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
-        aws-region: ${{ vars.AWS_REGION }}
-        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-
   be-tests-athena-ee:
     if: ${{ !inputs.skip }}
     runs-on: ubuntu-22.04
@@ -108,6 +81,53 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
+  be-tests-clickhouse-ee:
+    if: ${{ !inputs.skip }}
+    runs-on: ubuntu-22.04
+    timeout-minutes: 60
+    env:
+      CI: 'true'
+      DRIVERS: clickhouse
+      MB_CLICKHOUSE_TEST_HOST: localhost
+      MB_CLICKHOUSE_TEST_PORT: 8123
+      MB_CLICKHOUSE_TEST_OLD_PORT: 8124
+      MB_CLICKHOUSE_TEST_NGINX_PORT: 8127
+    name: Clickhouse
+    steps:
+    - uses: actions/checkout@v4
+    - name: Add ClickHouse TLS instance to /etc/hosts
+      run: |
+        sudo echo "127.0.0.1 server.clickhouseconnect.test" | sudo tee -a /etc/hosts
+    - name: Start ClickHouse in Docker
+      uses: hoverkraft-tech/compose-action@v2.0.0
+      with:
+        compose-file: "modules/drivers/clickhouse/docker-compose.yml"
+        down-flags: "--volumes"
+        services: |
+          clickhouse
+          clickhouse_tls
+          clickhouse_older_version
+          clickhouse_cluster_node1
+          clickhouse_cluster_node2
+          nginx
+    - name: Test Clickhouse driver
+      uses: ./.github/actions/test-driver
+      with:
+        junit-name: 'be-tests-clickhouse-ee'
+        test-args: >-
+          :only-tags [:mb/driver-tests]
+    - name: Upload Test Results
+      uses: ./.github/actions/upload-test-results
+      if: always()
+      with:
+        input-path: ./target/junit/
+        output-name: ${{ github.job }}
+        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        aws-region: ${{ vars.AWS_REGION }}
+        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+
   be-tests-druid-ee:
     if: ${{ !inputs.skip }}
     runs-on: ubuntu-22.04
@@ -143,6 +163,41 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
+  be-tests-druid-jdbc-ee:
+    if: ${{ !inputs.skip }}
+    runs-on: ubuntu-22.04
+    timeout-minutes: 60
+    env:
+      CI: 'true'
+      DRIVERS: druid-jdbc
+    services:
+      druid:
+        image: metabase/druid:29.0.1-json-no-ingestion
+        ports:
+          - "8888:8888"
+        env:
+          CLUSTER_SIZE: nano-quickstart
+    name: Druid (JDBC)
+    steps:
+    - uses: actions/checkout@v4
+    - name: Test Druid JDBC driver
+      uses: ./.github/actions/test-driver
+      with:
+        junit-name: 'be-tests-druid-jdbc-ee'
+        test-args: >-
+          :only-tags [:mb/driver-tests]
+    - name: Upload Test Results
+      uses: ./.github/actions/upload-test-results
+      if: always()
+      with:
+        input-path: ./target/junit/
+        output-name: ${{ github.job }}
+        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        aws-region: ${{ vars.AWS_REGION }}
+        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+
   be-tests-databricks-ee:
     if: ${{ !inputs.skip }}
     runs-on: ubuntu-22.04
@@ -177,27 +232,54 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
-  be-tests-druid-jdbc-ee:
+  be-tests-databricks-multi-catalog-ee:
     if: ${{ !inputs.skip }}
     runs-on: ubuntu-22.04
     timeout-minutes: 60
     env:
       CI: 'true'
-      DRIVERS: druid-jdbc
-    services:
-      druid:
-        image: metabase/druid:29.0.1-json-no-ingestion
-        ports:
-          - "8888:8888"
-        env:
-          CLUSTER_SIZE: nano-quickstart
-    name: Druid (JDBC)
+      DRIVERS: databricks
+      MB_DATABRICKS_TEST_MULTI_LEVEL_SCHEMA: true
+      MB_DATABRICKS_TEST_HOST: ${{ secrets.MB_DATABRICKS_JDBC_TEST_HOST }}
+      MB_DATABRICKS_TEST_HTTP_PATH: ${{ secrets.MB_DATABRICKS_JDBC_TEST_HTTP_PATH }}
+      MB_DATABRICKS_TEST_TOKEN: ${{ secrets.MB_DATABRICKS_JDBC_TEST_TOKEN }}
+      MB_DATABRICKS_TEST_CATALOG: 'metabase_ci'
+      MB_DATABRICKS_TEST_CLIENT_ID: ${{ secrets.MB_DATABRICKS_JDBC_TEST_CLIENT_ID }}
+      MB_DATABRICKS_TEST_OAUTH_SECRET: ${{ secrets.MB_DATABRICKS_JDBC_TEST_OAUTH_SECRET }}
+    name: Databricks (Multi-Catalog)
     steps:
     - uses: actions/checkout@v4
-    - name: Test Druid JDBC driver
+    - name: Test Databricks driver with multi-catalog
       uses: ./.github/actions/test-driver
       with:
-        junit-name: 'be-tests-druid-jdbc-ee'
+        junit-name: 'be-tests-databricks-multi-catalog-ee'
+        test-args: >-
+          :only-tags [:mb/driver-tests]
+    - name: Upload Test Results
+      uses: ./.github/actions/upload-test-results
+      if: always()
+      with:
+        input-path: ./target/junit/
+        output-name: ${{ github.job }}
+        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        aws-region: ${{ vars.AWS_REGION }}
+        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+
+  be-tests-h2:
+    if: ${{ !inputs.skip }}
+    runs-on: ubuntu-22.04
+    timeout-minutes: 60
+    env:
+      CI: 'true'
+    name: H2
+    steps:
+    - uses: actions/checkout@v4
+    - name: Test H2 driver
+      uses: ./.github/actions/test-driver
+      with:
+        junit-name: 'be-tests-h2'
         test-args: >-
           :only-tags [:mb/driver-tests]
     - name: Upload Test Results
@@ -346,12 +428,9 @@ jobs:
       fail-fast: false
       matrix:
         version:
-          - name: MongoDB 4.4
-            junit-name: be-tests-mongo-4-4-ee
-            image: metabase/qa-databases:mongo-sample-4.4
-          - name: MongoDB 5.0
-            junit-name: be-tests-mongo-5-0-ee
-            image: metabase/qa-databases:mongo-sample-5.0
+          - name: MongoDB 6.0
+            junit-name: be-tests-mongo-6-0-ee
+            image: metabase/qa-databases:mongo-sample-6
           - name: MongoDB Latest
             junit-name: be-tests-mongo-latest-ee
             image: mongo:latest
@@ -398,12 +477,9 @@ jobs:
       fail-fast: false
       matrix:
         version:
-          - name: MongoDB 4.4
-            junit-name: be-tests-mongo-4-4-ee
-            image: metabase/qa-databases:mongo-sample-4.4
-          - name: MongoDB 5.0
-            junit-name: be-tests-mongo-5-0-ssl-ee
-            image: metabase/qa-databases:mongo-sample-5.0
+          - name: MongoDB 6.0
+            junit-name: be-tests-mongo-6-0-ssl-ee
+            image: metabase/qa-databases:mongo-sample-6
     env:
       CI: 'true'
       DRIVERS: mongo
@@ -890,9 +966,9 @@ jobs:
       fail-fast: false
       matrix:
         version:
-          - name: SQL Server 2017
-            junit-name: be-tests-sqlserver-2017-ee
-            image: mcr.microsoft.com/mssql/server:2017-latest
+          # - name: SQL Server 2017
+          #   junit-name: be-tests-sqlserver-2017-ee
+          #   image: mcr.microsoft.com/mssql/server:2017-latest
           - name: SQL Server 2022
             junit-name: be-tests-sqlserver-2022-ee
             image: mcr.microsoft.com/mssql/server:2022-latest
@@ -932,6 +1008,43 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
+  be-tests-starburst-ee:
+    if: ${{ !inputs.skip }}
+    runs-on: ubuntu-22.04
+    timeout-minutes: 60
+    env:
+      CI: 'true'
+      DRIVERS: starburst
+    services:
+      starburst:
+        image: trinodb/trino:latest
+        env:
+          CATALOG_MANAGEMENT: dynamic
+        ports:
+          - "8080:8080"
+    name: Starburst
+    steps:
+    - uses: actions/checkout@v4
+    - name: Make plugins directory
+      run: mkdir plugins
+    - name: Test Starburst driver
+      uses: ./.github/actions/test-driver
+      with:
+        junit-name: 'be-tests-starburst-ee'
+        test-args: >-
+          :only-tags [:mb/driver-tests]
+    - name: Upload Test Results
+      uses: ./.github/actions/upload-test-results
+      if: always()
+      with:
+        input-path: ./target/junit/
+        output-name: ${{ github.job }}
+        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        aws-region: ${{ vars.AWS_REGION }}
+        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+
   be-tests-vertica-ee:
     if: ${{ !inputs.skip }}
     runs-on: ubuntu-22.04
@@ -988,7 +1101,9 @@ jobs:
       - be-tests-sparksql-ee
       - be-tests-sqlite-ee
       - be-tests-sqlserver
+      - be-tests-starburst-ee
       - be-tests-vertica-ee
+      - be-tests-clickhouse-ee
     runs-on: ubuntu-latest
     timeout-minutes: 5
     name: drivers-tests-result

.github/workflows/e2e-component-tests-embedding-sdk-cross-version.yml

@@ -1,17 +1,7 @@
 name: E2E Cross-version Component Tests for Embedding SDK
 
 on:
-  push:
-    branches:
-      - "release-**"
-  pull_request:
-    types: [opened, synchronize, reopened, ready_for_review]
-    branches:
-      - "release-**"
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
-  cancel-in-progress: true
+  workflow_call:
 
 jobs:
   files-changed:
@@ -66,8 +56,7 @@ jobs:
   build:
     needs: [files-changed, get-build-requirements]
     if: |
-      !cancelled() &&
-      github.event.pull_request.draft == false
+      !cancelled()
     runs-on: ubuntu-22.04
     timeout-minutes: 25
     env:
@@ -93,7 +82,7 @@ jobs:
       - name: Prepare uberjar artifact
         uses: ./.github/actions/prepare-uberjar-artifact
         with:
-          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar-cross-version
 
   resolve-sdk-version:
     if: |
@@ -175,7 +164,7 @@ jobs:
       - name: Retrieve uberjar artifact for ee
         uses: actions/download-artifact@v4
         with:
-          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar-cross-version
 
       - name: Prepare front-end environment
         uses: ./.github/actions/prepare-frontend

.github/workflows/e2e-component-tests-embedding-sdk.yml

@@ -1,16 +1,11 @@
 name: E2E Component Tests for Embedding SDK
 
 on:
-  push:
-    branches:
-      - "master"
-      - "release-**"
-  pull_request:
-    types: [opened, synchronize, reopened, ready_for_review]
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
-  cancel-in-progress: true
+  workflow_call:
+    inputs:
+      cached-embedding-sdk-dist-artifact-name:
+        required: true
+        type: string
 
 jobs:
   files-changed:
@@ -63,11 +58,10 @@ jobs:
               node_version: requirements.node,
             };
 
-  build:
+  build-uberjar:
     needs: [files-changed, get-build-requirements]
     if: |
       !cancelled() &&
-      github.event.pull_request.draft == false &&
       needs.files-changed.outputs.e2e_all == 'true'
     runs-on: ubuntu-22.04
     timeout-minutes: 25
@@ -78,10 +72,12 @@ jobs:
       SKIP_LICENSES: ${{ github.event_name == 'pull_request' }}
     steps:
       - uses: actions/checkout@v4
+
       - name: Prepare front-end environment
         uses: ./.github/actions/prepare-frontend
         with:
           node-version: "${{ needs.get-build-requirements.outputs.node_version }}"
+
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
         with:
@@ -97,12 +93,17 @@ jobs:
           name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
 
   e2e-tests:
-    needs: [get-build-requirements, build]
+    needs: [get-build-requirements, build-uberjar]
     if: |
-      !cancelled() && needs.build.result == 'success'
+      !cancelled() &&
+      needs.build-uberjar.result == 'success'
     runs-on: ubuntu-22.04
     timeout-minutes: 45
-    name: e2e-tests-embedding-sdk
+    strategy:
+      matrix:
+        react-version: [18, 19]
+      fail-fast: false
+    name: React ${{ matrix.react-version }}
     env:
       MB_EDITION: ee
       DISPLAY: ""
@@ -148,12 +149,11 @@ jobs:
         with:
           m2-cache-key: "cljs"
 
-      - name: Compile CLJS
-        run: yarn build-pure:cljs
-        shell: bash
-
-      - name: Build Embedding SDK package
-        run: yarn build-embedding-sdk
+      - name: Retrieve Embedding SDK dist artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: ${{ inputs.cached-embedding-sdk-dist-artifact-name }}
+          path: ${{ github.workspace }}/resources/embedding-sdk
 
       - name: Run Metabase
         run: node e2e/runner/run_cypress_ci.js start
@@ -161,6 +161,10 @@ jobs:
       - name: Make app db snapshot
         run: node e2e/runner/run_cypress_ci.js snapshot --browser ${{ steps.cypress-prep.outputs.chrome-path }}
 
+      # Has to be run after the app db snapshot is made, as it is not compatible with React 19
+      - name: Change React version to ${{ matrix.react-version }}
+        run: ./bin/embedding-sdk/change-react-version.bash ${{ matrix.react-version }}
+
       - name: Run component tests for Embedding SDK
         run: node e2e/runner/run_cypress_ci.js component --browser ${{ steps.cypress-prep.outputs.chrome-path }}
 
@@ -169,7 +173,7 @@ jobs:
         if: always()
         with:
           input-path: ./target/junit
-          output-name: e2e-embedding-sdk
+          output-name: e2e-embedding-sdk-react-${{ matrix.react-version }}
           bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
           aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
@@ -180,7 +184,7 @@ jobs:
         uses: actions/upload-artifact@v4
         if: failure()
         with:
-          name: cypress-recording-embedding-sdk-latest
+          name: cypress-recording-embedding-sdk-react-${{ matrix.react-version }}
           path: |
             ./cypress
             ./logs/test.log
@@ -202,15 +206,3 @@ jobs:
              const summary = formatSummary(results);
 
              await core.summary.addRaw(summary).write();
-
-  e2e-tests-skipped-stub:
-    needs: [e2e-tests]
-    if: |
-      !cancelled() &&
-      needs.e2e-tests.result == 'skipped'
-    runs-on: ubuntu-22.04
-    timeout-minutes: 5
-    name: e2e-component-tests-embedding-sdk
-    steps:
-      - run: |
-          echo "Didn't run due to conditional filtering"

.github/workflows/e2e-cross-version-for-breaking-changes.yml

@@ -0,0 +1,155 @@
+name: E2E Cross-version Tests
+
+on:
+  workflow_dispatch:
+    inputs:
+      fe-ref:
+        description: "Frontend git ref to use"
+        type: string
+        required: true
+        default: "master"
+      be-ref:
+        description: "Backend git ref to use"
+        type: string
+        required: true
+        default: "master"
+      total-shards:
+        description: "Total number of parallel test shards"
+        type: number
+        required: false
+        default: 4
+  workflow_call:
+    inputs:
+      fe-ref:
+        description: "Frontend git ref to use"
+        type: string
+        required: true
+      be-ref:
+        description: "Backend git ref to use"
+        type: string
+        required: true
+      total-shards:
+        description: "Total number of parallel test shards"
+        type: number
+        required: false
+        default: 4
+
+jobs:
+  generate-matrix:
+    runs-on: ubuntu-latest
+    outputs:
+      matrix_json: ${{ steps.set_matrix.outputs.matrix_json }}
+      shards_total: ${{ steps.set_matrix.outputs.shards_total }}
+    steps:
+      - name: Set up shard matrix
+        id: set_matrix
+        uses: actions/github-script@v7
+        with:
+          # generate an output like `{"matrixJson": "{\"shard\": [1, 2, 3, 4]}", "shardsTotal": 4}` to be used in the other jobs
+          script: |
+            const totalShards = parseInt(process.env.TOTAL_SHARDS_INPUT, 10);
+
+            const matrix = { shard: Array.from({ length: totalShards }, (_, i) => i + 1) };
+
+            console.log("Generated matrix JSON", matrix);
+            console.log(`Total shards: ${totalShards}`);
+
+            core.setOutput('matrix_json', JSON.stringify(matrix));
+            core.setOutput('shards_total', totalShards);
+        env:
+          TOTAL_SHARDS_INPUT: ${{ inputs.total-shards }}
+
+  build-jar:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 45
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Prepare Node.js
+        # We're not using `actions/prepare-frontend` because we don't want to install deps from the root repo
+        # nor we want to touch the cache as we'll be potentially be installing different versions of packages
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: ".nvmrc"
+
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: cross-version-uberjar
+
+      - name: Build jar with different frontend and backend version
+        env:
+          MB_EDITION: ee
+          CYPRESS_CI: true
+        run: |
+          node bin/backward-compatibility-test.js \
+            ${{ inputs.fe-ref }} ${{ inputs.be-ref }} \
+            build
+
+      - name: Upload Uberjar
+        uses: actions/upload-artifact@v4
+        with:
+          name: metabase-jar-cross-version
+          path: .tmp/metabase-be/target/uberjar/metabase.jar
+          if-no-files-found: error
+
+  run-breaking-changes-tests:
+    needs: [build-jar, generate-matrix]
+    runs-on: ubuntu-22.04
+    timeout-minutes: 45
+    env:
+      TOTAL_SHARDS: ${{ needs.generate-matrix.outputs.shards_total }}
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJson(needs.generate-matrix.outputs.matrix_json) }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Prepare Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: ".nvmrc"
+
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: cross-version-uberjar
+
+      - name: Download Uberjar
+        uses: actions/download-artifact@v4
+        with:
+          name: metabase-jar-cross-version
+          path: .tmp/metabase-be/target/uberjar/
+
+      - name: Download FE repo
+        run: |
+          git clone --depth 1 -b ${{ inputs.fe-ref }} https://github.com/metabase/metabase.git .tmp/metabase-fe
+
+      - name: Install FE dependencies
+        working-directory: .tmp/metabase-fe
+        run: |
+          yarn install
+
+      - name: Prepare Cypress environment
+        id: cypress-prep
+        uses: ./.github/actions/prepare-cypress
+        with:
+          working-directory: .tmp/metabase-fe
+
+      - name: Run the tests
+        env:
+          MB_EDITION: ee
+          CYPRESS_ALL_FEATURES_TOKEN: ${{ secrets.ENTERPRISE_TOKEN }}
+          CYPRESS_NO_FEATURES_TOKEN: ${{ secrets.E2E_STARTER_TOKEN }}
+          CYPRESS_CI: true
+        run: |
+          node bin/backward-compatibility-test.js \
+            ${{ inputs.fe-ref }} ${{ inputs.be-ref }} \
+            start > /dev/null & \
+            node bin/backward-compatibility-test.js \
+            ${{ inputs.fe-ref }} ${{ inputs.be-ref }} \
+            test ${{ matrix.shard}}/${{ env.TOTAL_SHARDS }}

.github/workflows/e2e-matrix-builder.yml

@@ -7,11 +7,17 @@ on:
         required: true
         type: number
         default: 30
+      specs:
+        required: false
+        type: string
+        default: "./e2e/test/scenarios/**/*.cy.spec.*"
     outputs:
       matrix:
         value: ${{ jobs.build-matrix.outputs.matrix }}
       regularChunks:
         value: ${{ jobs.build-matrix.outputs.regularChunks }}
+      isDefaultSpecPattern:
+        value: ${{ jobs.build-matrix.outputs.isDefaultSpecPattern }}
 
 jobs:
   build-matrix:
@@ -20,53 +26,38 @@ jobs:
     outputs:
       matrix: ${{ steps.matrix.outputs.config }}
       regularChunks: ${{ steps.matrix.outputs.regularChunks }}
+      isDefaultSpecPattern: ${{ steps.matrix.outputs.isDefaultSpecPattern }}
     steps:
-      - uses: actions/setup-node@v3
+      - uses: actions/checkout@v4
         with:
-          node-version: '22.x'
-      - uses: actions/github-script@v7
+          sparse-checkout: |
+            .github
+          sparse-checkout-cone-mode: false
+      - uses: actions/setup-node@v4
+        with:
+          node-version: lts/Jod # 22.x.x
+      - name: Build e2e matrix
+        uses: actions/github-script@v7
         id: matrix
         env:
           chunks: ${{ inputs.chunks }}
         with:
           script: | # js
+            const { buildMatrix } = require('${{ github.workspace }}/.github/scripts/build-e2e-matrix.js');
+            const inputSpecs = "${{ inputs.specs }}";
+            const inputChunks = Number(process.env.chunks);
             const java = 21;
             const defaultRunner = "ubuntu-22.04";
-
-            const defaultOptions = {
-              "java-version": java,
-              runner: defaultRunner,
-              edition: "ee",
+            const options = {
+              java,
+              defaultRunner,
             };
-
-            const allSpecs = "./e2e/test/scenarios/**/*.cy.spec.*";
-
-            // see config.js function getSplittableSpecs for logic that excludes some tests from auto splitting
-            const specialTests = [
-              { name: "embedding-sdk", specs: "./e2e/test/scenarios/embedding-sdk/**.cy.spec.*" },
-              { name: "oss-subset", edition: 'oss', tags: "@OSS @smoke+-@EE", specs: allSpecs },
-              { name: "mongo", tags: "@mongo", specs: allSpecs },
-            ];
-
-            const inputChunks = Number(process.env.chunks);
-            const regularChunks = inputChunks - specialTests.length;
-
-            const regularTests = new Array(regularChunks).fill(1)
-              .map((files, index) => ({
-                name: `e2e-group-${index + 1}`,
-              }));
-
-            // regular chunks need to come before special chunks
-            const testSets = [...regularTests, ...specialTests];
-
-            const config = testSets.map((options) => ({
-              ...defaultOptions,
-              ...options,
-            }));
-
+            const { config, regularChunks, isDefaultSpecPattern } = buildMatrix(options, inputSpecs, inputChunks);
 
             core.setOutput("regularChunks", JSON.stringify(regularChunks));
             core.setOutput("config", JSON.stringify({ include: config }));
+            core.setOutput("isDefaultSpecPattern", JSON.stringify(isDefaultSpecPattern));
 
             console.log({ regularChunks });
             console.log("matrix config", config);
+            console.log("isDefaultSpecPattern", isDefaultSpecPattern);

.github/workflows/e2e-sample-apps-tests.yml

@@ -0,0 +1,298 @@
+name: E2E Sample Apps tests
+
+on:
+  push:
+    branches:
+      - "master"
+      - "release-**"
+  pull_request:
+    types: [opened, synchronize, reopened]
+    branches:
+      - "master"
+      - "release-**"
+
+env:
+  # we must support last two stable releases
+  SUPPORTED_RELEASES_COUNT: 2
+  TEST_SUITES: |
+    [
+      "metabase-nodejs-react-sdk-embedding-sample-e2e",
+      "metabase-nextjs-sdk-embedding-sample-e2e",
+      "shoppy-e2e"
+    ]
+  TEST_SUITES_TO_RUN_IN_MASTER_ONLY: |
+    [
+      "shoppy-e2e"
+    ]
+  SAMPLE_APP_MAIN_BRANCH_NAME: "main"
+  SAMPLE_APP_STABLE_RELEASE_BRANCH_NAME_SUFFIX: "stable"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  files-changed:
+    name: Check which files changed
+    runs-on: ubuntu-22.04
+    timeout-minutes: 3
+    outputs:
+      e2e_all: ${{ steps.changes.outputs.e2e_all }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Test which files changed
+        uses: dorny/paths-filter@v3.0.0
+        id: changes
+        with:
+          token: ${{ github.token }}
+          filters: .github/file-paths.yaml
+
+  # if this is a test on a release branch, we need to check the build requirements
+  get-build-requirements:
+    if: |
+      !cancelled() &&
+      contains(github.base_ref || github.ref, 'release-x')
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    outputs:
+      java_version: ${{ fromJson(steps.dependencies.outputs.result).java_version }}
+      node_version: ${{ fromJson(steps.dependencies.outputs.result).node_version }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: release
+      - name: Prepare build scripts
+        run: cd ${{ github.workspace }}/release && yarn && yarn build
+      - name: Get build dependencies
+        uses: actions/github-script@v7
+        id: dependencies
+        with:
+          script: | # js
+            const {
+              getBuildRequirements,
+              getVersionFromReleaseBranch,
+            } = require('${{ github.workspace }}/release/dist/index.cjs');
+            const targetBranchName = '${{ github.base_ref || github.ref }}';
+
+            const version = getVersionFromReleaseBranch(targetBranchName);
+            const requirements = getBuildRequirements(version);
+
+            return {
+              java_version: requirements.java,
+              node_version: requirements.node,
+            };
+
+  get-sample-apps-data:
+    if: |
+      !cancelled()
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    outputs:
+      branch_name: ${{ fromJson(steps.build-sample-apps-data.outputs.result).branch_name }}
+      matrix: ${{ toJSON(fromJson(steps.build-sample-apps-data.outputs.result).matrix) }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Prepare build scripts
+        run: cd ${{ github.workspace }}/release && yarn && yarn build
+
+      - name: Build sample app compatibility data
+        uses: actions/github-script@v7
+        id: build-sample-apps-data
+        with:
+          script: | # js
+            const {
+              isReleaseBranch,
+              getMajorVersionNumberFromReleaseBranch,
+            } = require('${{ github.workspace }}/release/dist/index.cjs');
+
+            const testSuites = JSON.parse(process.env.TEST_SUITES);
+            const testSuitesToRunInMasterOnly = JSON.parse(process.env.TEST_SUITES_TO_RUN_IN_MASTER_ONLY);
+
+            const ref = '${{ github.base_ref || github.ref }}';
+            const branchName = ref.replace(/^refs\/heads\//, '');
+
+            const isMainBranchRef = branchName === 'master';
+            const isReleaseBranchRef = isReleaseBranch(branchName);
+
+            if (isMainBranchRef) {
+              return {
+                branch_name: '${{ env.SAMPLE_APP_MAIN_BRANCH_NAME }}',
+                matrix: testSuites,
+              };
+            }
+
+            if (isReleaseBranchRef) {
+              const supportedReleasesCount = Number(${{ env.SUPPORTED_RELEASES_COUNT }});
+
+              const currentReleaseVersion = Number(${{ vars.CURRENT_VERSION }});
+              const currentBranchVersion = Number(getMajorVersionNumberFromReleaseBranch(branchName));
+
+              const sampleAppBranchName = `${currentBranchVersion}-${{ env.SAMPLE_APP_STABLE_RELEASE_BRANCH_NAME_SUFFIX }}`
+
+              const shouldRunTestsForVersion = (currentReleaseVersion - currentBranchVersion) <= (supportedReleasesCount - 1);
+              const releaseBranchTestSuites = testSuites.filter(testSuite => !testSuitesToRunInMasterOnly.includes(testSuite));
+
+              return {
+                branch_name: sampleAppBranchName,
+                matrix: shouldRunTestsForVersion
+                  ? releaseBranchTestSuites
+                  : []
+              };
+            }
+
+            return {
+              branch_name: '',
+              matrix: []
+            };
+
+  build:
+    needs: [files-changed, get-build-requirements, get-sample-apps-data]
+    if: |
+      !cancelled() &&
+      needs.files-changed.outputs.e2e_all == 'true' &&
+      fromJSON(needs.get-sample-apps-data.outputs.matrix)[0] != null
+    runs-on: ubuntu-22.04
+    timeout-minutes: 25
+    env:
+      MB_EDITION: ee
+      INTERACTIVE: false
+      # make sure that builds on release branches get licenses, because we use them for releases
+      SKIP_LICENSES: ${{ github.event_name == 'pull_request' }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+        with:
+          node-version: "${{ needs.get-build-requirements.outputs.node_version }}"
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: uberjar
+          java-version: "${{ needs.get-build-requirements.outputs.java_version || 21 }}"
+
+      - name: Build uberjar with ./bin/build.sh
+        run: ./bin/build.sh
+
+      - name: Prepare uberjar artifact
+        uses: ./.github/actions/prepare-uberjar-artifact
+        with:
+          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+
+      - name: Compile CLJS
+        run: yarn build-pure:cljs
+        shell: bash
+
+      - name: Build Embedding SDK package
+        run: yarn build-embedding-sdk
+
+      - name: Prepare Embedding SDK artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: embedding-sdk-${{ github.event.pull_request.head.sha || github.sha }}
+          path: resources/embedding-sdk
+
+  e2e-tests:
+    needs: [get-build-requirements, get-sample-apps-data, build]
+    strategy:
+      matrix:
+        test_suite: ${{ fromJSON(needs.get-sample-apps-data.outputs.matrix) }}
+        environment: ["production", "development"]
+    if: |
+      !cancelled() && needs.build.result == 'success'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 45
+    name: e2e-sample-app-${{ matrix.test_suite }}-tests-${{ matrix.environment }}-bundle
+    env:
+      MB_EDITION: ee
+      DISPLAY: ""
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      PR_NUMBER: ${{ github.event.pull_request.number || '' }}
+      HASH: ${{ github.event.pull_request.head.sha || github.sha }}-${{ github.run_attempt }}
+      # Any env starting with `CYPRESS_` will be available to all Cypress tests via `Cypress.env()`
+      # Example: you can get `CYPRESS_FOO` with `Cypress.env("FOO")`
+      CYPRESS_ALL_FEATURES_TOKEN: ${{ secrets.ENTERPRISE_TOKEN }}
+      CYPRESS_NO_FEATURES_TOKEN: ${{ secrets.E2E_STARTER_TOKEN }}
+      CYPRESS_PULL_REQUEST_ID: ${{ github.event.pull_request.number || '' }}
+      CYPRESS_IS_EMBEDDING_SDK: true
+      COMMIT_INFO_MESSAGE: ${{ github.event.pull_request.title || github.event.head_commit.message || github.event.head.sha }}
+      TZ: US/Pacific # to make node match the instance tz
+      # Sample Apps testing variables
+      CYPRESS_CI: true
+      SAMPLE_APP_BRANCH_NAME: ${{ needs.get-sample-apps-data.outputs.branch_name }}
+      SAMPLE_APP_ENVIRONMENT: ${{ matrix.environment }}
+    permissions:
+      id-token: write
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Retrieve uberjar artifact for ee
+        uses: actions/download-artifact@v4
+        with:
+          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+
+      - name: Retrieve Embedding SDK dist artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: embedding-sdk-${{ github.event.pull_request.head.sha || github.sha }}
+          path: ${{ github.workspace }}/resources/embedding-sdk
+
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+
+      - name: Prepare Cypress environment
+        id: cypress-prep
+        uses: ./.github/actions/prepare-cypress
+
+      - name: Check if sample app branch exists
+        id: check-sample-app-branch
+        run: |
+          TEST_SUITE="${{ matrix.test_suite }}"
+          REPO_NAME="${TEST_SUITE%-e2e}"
+          REPO_URL="https://github.com/metabase/${REPO_NAME}.git"
+          echo "Checking if branch '${SAMPLE_APP_BRANCH_NAME}' exists in ${REPO_URL}..."
+          if git ls-remote --exit-code --heads "$REPO_URL" "${SAMPLE_APP_BRANCH_NAME}"; then
+            echo "sample_app_branch_exists=true" >> $GITHUB_OUTPUT
+          else
+            echo "sample_app_branch_exists=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Configure AWS credentials
+        if: ${{ matrix.test_suite == 'shoppy-e2e' }}
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.SHOPPY_IAM_ROLE }}
+          role-session-name: GitHub_to_AWS_via_FederatedOIDC
+          aws-region: us-east-1
+
+      - name: Download Shoppy's App DB PostgreSQL dump from S3
+        if: ${{ matrix.test_suite == 'shoppy-e2e' }}
+        run: |
+          aws s3 cp s3://${{ secrets.SHOPPY_METABASE_APP_DB_S3_BUCKET }}/${{ secrets.SHOPPY_METABASE_APP_DB_S3_KEY }} ./e2e/tmp/db_dumps/shoppy_metabase_app_db_dump.sql
+
+      - name: Prepare and launch Sample Apps for shoppy-e2e test suite
+        if: ${{ steps.check-sample-app-branch.outputs.sample_app_branch_exists == 'true' && matrix.test_suite == 'shoppy-e2e' }}
+        env:
+          METABASE_APP_DB_USER: ${{ secrets.SHOPPY_METABASE_APP_DB_USER }}
+          METABASE_APP_DB: ${{ secrets.SHOPPY_METABASE_APP_DB_DATABASE }}
+        run: npx tsx ./e2e/runner/start-sample-app-containers/start-ci.ts shoppy-e2e
+
+      - name: Prepare and launch Sample Apps for other test suites
+        if: ${{ steps.check-sample-app-branch.outputs.sample_app_branch_exists == 'true' && matrix.test_suite != 'shoppy-e2e' }}
+        run: npx tsx ./e2e/runner/start-sample-app-containers/start-ci.ts ${{ matrix.test_suite }}
+
+      - name: Run e2e tests for Sample App
+        id: run-e2e-tests
+        if: ${{ steps.check-sample-app-branch.outputs.sample_app_branch_exists == 'true' }}
+        run: node e2e/runner/run_cypress_ci.js ${{ matrix.test_suite }} --browser ${{ steps.cypress-prep.outputs.chrome-path }}
+
+      - name: Upload Cypress Artifacts upon failure
+        uses: actions/upload-artifact@v4
+        if: ${{ steps.check-sample-app-branch.outputs.branch_exists == 'true' && steps.run-e2e-tests.outcome != 'success' }}
+        with:
+          name: cypress-recording-sample-app-${{ matrix.test_suite }}-latest
+          path: |
+            ./cypress
+            ./logs/test.log
+          if-no-files-found: ignore

.github/workflows/e2e-stress-test-flake-fix.yml

@@ -4,24 +4,25 @@ on:
   workflow_dispatch:
     inputs:
       spec:
-        description: 'Relative path of the target spec'
+        description: "Relative path of the target spec"
         type: string
         required: true
       burn_in:
-        description: 'Number of times to run the test (e.g. 20)'
+        description: "Number of times to run the test (e.g. 20)"
         type: string
         required: true
+        default: "20"
       grep:
-        description: 'Grep and filter tests to run in isolation'
+        description: "Grep and filter tests to run in isolation"
         type: string
         required: false
       mb_edition:
-        description: 'Set MB_EDITION env var to "ee" (enteprise) or "oss" (open-source)'
+        description: 'Set MB_EDITION env var to "ee" (enterprise) or "oss" (open-source)'
         type: string
         required: false
         default: "ee"
       qa_db:
-        description: 'Select the type of Database you want to run your tests with'
+        description: "Select the type of Database you want to run your tests with"
         type: choice
         required: true
         default: "none"
@@ -29,6 +30,11 @@ on:
           - none
           - sql
           - mongo
+      enable_network_throttling:
+        description: "Enable network throttling simulation (4g slow like in chrome dev tools)"
+        type: boolean
+        required: false
+        default: true
 
 jobs:
   workflow-summary:
@@ -45,6 +51,7 @@ jobs:
           echo '- `burn_in`: ${{ inputs.burn_in }}' >> $GITHUB_STEP_SUMMARY
           echo '- `grep`: "${{ inputs.grep }}"' >> $GITHUB_STEP_SUMMARY
           echo '- `qa_db`: "${{ inputs.qa_db }}"' >> $GITHUB_STEP_SUMMARY
+          echo '- `enable_network_throttling`: "${{ inputs.enable_network_throttling }}"' >> $GITHUB_STEP_SUMMARY
           echo '' >> $GITHUB_STEP_SUMMARY
           echo 'triggered by: @${{ github.event.sender.login }}' >> $GITHUB_STEP_SUMMARY
 
@@ -61,6 +68,7 @@ jobs:
       MB_SNOWPLOW_AVAILABLE: true
       MB_SNOWPLOW_URL: "http://localhost:9090" # Snowplow micro
       MB_EDITION: ${{ inputs.mb_edition }}
+      CYPRESS_ENABLE_NETWORK_THROTTLING: ${{ inputs.enable_network_throttling }}
       TERM: xterm
       TZ: US/Pacific # to make node match the instance tz
     steps:
@@ -83,7 +91,7 @@ jobs:
       - name: Download Metabase ${{ matrix.edition }} uberjar
         uses: ./.github/actions/e2e-download-uberjar
         with:
-          edition: 'ee'
+          edition: "ee"
 
       - name: Prepare front-end environment
         uses: ./.github/actions/prepare-frontend
@@ -105,10 +113,12 @@ jobs:
       # For all options and fine-grained control, take a look at the documentation
       # https://github.com/cypress-io/cypress/tree/develop/npm/grep
       - name: Stress-test ${{ github.event.inputs.spec }} ${{ github.event.inputs.burn_in }} times
+        env:
+          GREP: ${{ github.event.inputs.grep }}
         run: |
           node e2e/runner/run_cypress_ci.js e2e \
           --spec '${{ github.event.inputs.spec }}' \
-          --env burn=${{ github.event.inputs.burn_in }},grep='${{ github.event.inputs.grep }}' \
+          --env burn=${{ github.event.inputs.burn_in }} \
           --config-file e2e/support/cypress-stress-test.config.js \
           --browser ${{ steps.cypress-prep.outputs.chrome-path }}
 

.github/workflows/e2e-test.yml

@@ -49,6 +49,7 @@ jobs:
       CYPRESS_PULL_REQUEST_ID: ${{ github.event.pull_request.number || '' }}
       COMMIT_INFO_MESSAGE: ${{ github.event.pull_request.title || github.event.head_commit.message || github.event.head.sha }}
       MB_EXPERIMENTAL_SEARCH_BLOCK_ON_QUEUE: true
+      MB_SEARCH_ENGINE: appdb
       MB_SNOWPLOW_AVAILABLE: true
       MB_SNOWPLOW_URL: "http://localhost:9090" # Snowplow micro
       TZ: US/Pacific # to make node match the instance tz
@@ -98,6 +99,18 @@ jobs:
         id: cypress-prep
         uses: ./.github/actions/prepare-cypress
 
+      - name: Download failed test artifacts
+        uses: actions/download-artifact@v4
+        if: github.run_attempt != '1'
+        continue-on-error: true
+        id: failed-specs
+        with:
+          name: failed-tests-${{ inputs.name }}-${{ inputs.edition }}
+
+      - name: Get failed specs
+        if: github.run_attempt != '1'
+        run: echo "specs=$(cat failed-specs)" >> $GITHUB_ENV
+
       - name: Run Snowplow micro
         uses: ./.github/actions/run-snowplow-micro
 
@@ -117,19 +130,25 @@ jobs:
           SPLIT_TIME_THRESHOLD: 5.0
           # do not write cypress-split summary to github
           SPLIT_SUMMARY: false
+          SPEC_PATH: ${{ env.specs || inputs.specs }}
         shell: bash
         run: |
+          echo "Running tests with specs: $SPEC_PATH"
           node e2e/runner/run_cypress_ci.js e2e \
             --env grepTags="-@mongo+-@flaky+-@OSS --@quarantine",grepOmitFiltered=true \
+            --spec "$SPEC_PATH" \
             --browser ${{ steps.cypress-prep.outputs.chrome-path }}
 
       - name: Run Tagged EE Cypress tests on ${{ inputs.name }}
         if: ${{ inputs.specs }}
         shell: bash
+        env:
+          SPEC_PATH: ${{ env.specs || inputs.specs }}
         run: |
+          echo "Running tests with specs: $SPEC_PATH"
           node e2e/runner/run_cypress_ci.js e2e \
           --env grepTags="${{inputs.tags}} --@quarantine",grepOmitFiltered=true \
-          --spec '${{ inputs.specs }}' \
+          --spec "$SPEC_PATH" \
           --browser ${{ steps.cypress-prep.outputs.chrome-path }}
 
       - name: Upload Test Results
@@ -138,6 +157,7 @@ jobs:
         with:
           input-path: ./target/junit
           output-name: e2e-${{ inputs.name }}
+          variant: e2e-tests
           bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
           aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
@@ -154,6 +174,13 @@ jobs:
             ./logs/test.log
           if-no-files-found: ignore
 
+      - name: Upload Failed Tests
+        uses: actions/upload-artifact@v4
+        if: failure()
+        with:
+          name: failed-tests-${{ inputs.name }}-${{ inputs.edition }}
+          path: ./cypress/test-results
+
       - name: Publish Summary
         if: failure()
         uses: actions/github-script@v7

.github/workflows/e2e-tests.yml

@@ -6,6 +6,10 @@ on:
       skip:
         type: boolean
         default: false
+      specs:
+        type: string
+        required: false
+        default: ""
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}-e2e
@@ -16,6 +20,7 @@ jobs:
     uses: ./.github/workflows/e2e-matrix-builder.yml
     with:
       chunks: 50
+      specs: ${{ inputs.specs }}
 
   # if this is a test on a release branch, we need to check the build requirements
   get-build-requirements:
@@ -52,7 +57,7 @@ jobs:
     needs: [get-build-requirements]
     if: ${{ !cancelled() && !inputs.skip }}
     runs-on: ubuntu-22.04
-    timeout-minutes: 25
+    timeout-minutes: 15
     strategy:
       matrix:
         edition: [oss, ee]
@@ -74,7 +79,9 @@ jobs:
           java-version: "${{ needs.get-build-requirements.outputs.java_version || 21 }}"
 
       - name: Build uberjar with ./bin/build.sh
+        timeout-minutes: 10
         run: ./bin/build.sh
+        shell: bash
 
       - name: Prepare uberjar artifact
         uses: ./.github/actions/prepare-uberjar-artifact
@@ -137,19 +144,21 @@ jobs:
   flaky-e2e-tests:
     name: Flaky e2e Tests
     uses: ./.github/workflows/e2e-test.yml
-    needs: build
+    needs:
+      - build
+      - e2e-matrix-builder
+    # skip flaky test run if only e2e specs changed as an optimization
     if: |
-      !cancelled() && needs.build.result == 'success'
+      !cancelled() && needs.build.result == 'success' && needs.e2e-matrix-builder.outputs.isDefaultSpecPattern == 'true'
     secrets: inherit
     with:
       name: Flaky
       tags: "@flaky"
-      specs: "./e2e/test/scenarios/**/*.cy.spec.*"
 
   e2e-tests-result:
     needs:
-     - e2e-tests
-     - flaky-e2e-tests
+      - e2e-tests
+      - flaky-e2e-tests
     runs-on: ubuntu-latest
     timeout-minutes: 5
     name: e2e-tests-result

.github/workflows/embedding-sdk.yml

@@ -2,21 +2,39 @@ name: Embedding SDK
 
 on:
   push:
-    branches:
-      - "master"
-      - "release-**"
+
   pull_request:
-    types: [opened, synchronize, reopened, ready_for_review]
+    types: [opened, synchronize, reopened]
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
   cancel-in-progress: true
 
 jobs:
-  sdk-build:
-    if: contains(github.event.pull_request.labels.*.name, 'embedding-sdk-build')
+  files-changed:
+    name: Check which files changed
     runs-on: ubuntu-22.04
-    timeout-minutes: 20
+    timeout-minutes: 3
+    outputs:
+      documentation: ${{ steps.changes.outputs.documentation }}
+      frontend_embedding_sdk_sources: ${{ steps.changes.outputs.frontend_embedding_sdk_sources }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Test which files changed
+        uses: dorny/paths-filter@v3.0.0
+        id: changes
+        with:
+          token: ${{ github.token }}
+          filters: .github/file-paths.yaml
+
+  build:
+    needs: [files-changed]
+    if: |
+      !cancelled() &&
+      (needs.files-changed.outputs.frontend_embedding_sdk_sources == 'true' ||
+      needs.files-changed.outputs.documentation == 'true')
+    runs-on: ubuntu-22.04
+    timeout-minutes: 25
     steps:
       - uses: actions/checkout@v4
       - name: Prepare front-end environment
@@ -25,15 +43,146 @@ jobs:
         uses: ./.github/actions/prepare-backend
         with:
           m2-cache-key: "cljs"
-      - name: Build SDK bundle
-        run: yarn run build-embedding-sdk
-      - name: Generate SDK package.json
-        run: yarn run embedding-sdk:generate-package "$GITHUB_SHA"
-      - name: Generate .npmrc for Github npm registry
-        uses: actions/setup-node@v4
+      - name: Build Embedding SDK package
+        run: yarn build-embedding-sdk
+      - name: Prepare Embedding SDK artifact
+        uses: actions/upload-artifact@v4
         with:
-          registry-url: "https://npm.pkg.github.com"
-      - name: Publish package
-        run: yarn run embedding-sdk:publish
+          name: embedding-sdk-${{ github.event.pull_request.head.sha || github.sha }}
+          path: resources/embedding-sdk
+
+  embedding-sdk-cli-snippets-type-check:
+    needs: [files-changed, build]
+    if: |
+      needs.files-changed.outputs.frontend_embedding_sdk_sources == 'true' &&
+      needs.build.result == 'success'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+      - name: Retrieve Embedding SDK dist artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: embedding-sdk-${{ github.event.pull_request.head.sha || github.sha }}
+          path: ${{ github.workspace }}/resources/embedding-sdk
+      - name: Run frontend embedding SDK snippets type check
+        run: yarn run embedding-sdk:cli-snippets:type-check
+
+  embedding-sdk-docs-snippets-type-check:
+    needs: [files-changed, build]
+    if: |
+      needs.files-changed.outputs.documentation == 'true' &&
+      needs.build.result == 'success'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+      - name: Retrieve Embedding SDK dist artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: embedding-sdk-${{ github.event.pull_request.head.sha || github.sha }}
+          path: ${{ github.workspace }}/resources/embedding-sdk
+      - name: Run frontend embedding SDK snippets type check
+        run: yarn run embedding-sdk:docs-snippets:type-check
+
+  embedding-sdk-no-exposed-internal-types-validate:
+    needs: [files-changed, build]
+    if: |
+      needs.files-changed.outputs.frontend_embedding_sdk_sources == 'true' &&
+      needs.build.result == 'success'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+      - name: Retrieve Embedding SDK dist artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: embedding-sdk-${{ github.event.pull_request.head.sha || github.sha }}
+          path: ${{ github.workspace }}/resources/embedding-sdk
+      - name: Run no exposed internal types validation
+        run: |
+          output="$(yarn embedding-sdk:docs:generate:pure --emit none 2>&1)" || {
+            if [[ "$output" == *"not included in the documentation"* ]]; then
+              echo "$output"
+              exit 1
+            fi
+          }
+      - name: Comment on PR if docs need update
+        uses: ./.github/actions/notify-pull-request
+        if: success() || failure()
+        with:
+          remove-previous-comment: true
+          add-new-comment: ${{ job.status == 'failure' }}
+          message: "📝 One or more internal Metabase types were accidentally exported from the `@metabase/embedding‑sdk‑react` package in this pull request.<br/><br/>Publishing these types would change the public API and may drastically change generated SDK documentation.<br/><br/>Please update the code so internal types remain private and the public API stays unchanged."
+          include-log: true
+
+  sdk-e2e-tests:
+    uses: ./.github/workflows/e2e-component-tests-embedding-sdk.yml
+    needs: [build]
+    secrets: inherit
+    with:
+      cached-embedding-sdk-dist-artifact-name: embedding-sdk-${{ github.event.pull_request.head.sha || github.sha }}
+
+  e2e-component-tests-embedding-sdk-cross-version:
+    # run on: every push on release branches, and every pr that targets a release branch
+    if: ${{ startsWith(github.ref, 'refs/heads/release-x.') || (github.event_name == 'pull_request' && startsWith(github.base_ref, 'release-x.')) }}
+    uses: ./.github/workflows/e2e-component-tests-embedding-sdk-cross-version.yml
+    secrets: inherit
+
+  cross-version-for-breaking-changes:
+    # run on: every pr that targets a release branch
+    if: ${{ github.event_name == 'pull_request' && startsWith(github.base_ref, 'release-x.') }}
+    uses: ./.github/workflows/e2e-cross-version-for-breaking-changes.yml
+    secrets: inherit
+    with:
+      fe-ref: ${{ github.base_ref }}
+      be-ref: ${{ github.head_ref }}
+
+  embedding-sdk-tests-result:
+    needs:
+      - embedding-sdk-cli-snippets-type-check
+      - embedding-sdk-docs-snippets-type-check
+      - embedding-sdk-no-exposed-internal-types-validate
+      - sdk-e2e-tests
+      - e2e-component-tests-embedding-sdk-cross-version
+    if: always() && !cancelled()
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    env:
+      needs: ${{ toJson(needs) }}
+    steps:
+      - name: Check embedding SDK job status
+        uses: actions/github-script@v7
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          needs: ${{ toJson(needs) }}
+        with:
+          script: | # js
+            const needs = JSON.parse(process.env.needs);
+            const jobs = Object.entries(needs).map(
+              ([jobName, jobValues]) => ({
+                name: jobName,
+                result: jobValues.result
+              }));
+
+            // are all jobs skipped or successful?
+            if (jobs.every(job => (job.result === 'skipped' || job.result === 'success'))) {
+              console.log('All jobs are skipped or successful');
+              process.exit(0);
+            }
+
+            // otherwise, something failed
+            console.log('Some embedding SDK jobs failed');
+            jobs.forEach((job) => {
+              if (job.result !== 'success') {
+                console.log(`${job.name} - ${job.result}`);
+              }
+            });
+            process.exit(1);

.github/workflows/frontend.yml

@@ -6,6 +6,9 @@ on:
       skip:
         type: boolean
         default: false
+      skip-lint:
+        type: boolean
+        default: false
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}-frontend
@@ -13,7 +16,7 @@ concurrency:
 
 jobs:
   fe-lint:
-    if: ${{ !inputs.skip }}
+    if: ${{ !inputs.skip-lint }}
     runs-on: ubuntu-22.04
     timeout-minutes: 20
     steps:

.github/workflows/fuzzing.yml

@@ -4,43 +4,59 @@ on:
   workflow_dispatch:
   push:
     branches:
-      - 'master'
-      - 'release-**'
+      - "master"
+      - "release-**"
     paths:
-      - 'frontend/src/metabase-lib/expressions/**'
+      - "frontend/src/metabase-lib/expressions/**"
   pull_request:
     paths:
-      - 'frontend/src/metabase-lib/expressions/**'
+      - "frontend/src/metabase-lib/expressions/**"
 
 jobs:
-  fe-fuzz-tokenizer:
+  fe-fuzz-lexifier:
     runs-on: ubuntu-22.04
     timeout-minutes: 15
     steps:
-    - uses: actions/checkout@v4
-    - name: Prepare front-end environment
-      uses: ./.github/actions/prepare-frontend
-    - name: Prepare back-end environment
-      uses: ./.github/actions/prepare-backend
-      with:
-        m2-cache-key: 'cljs'
-    - run: yarn test-unit frontend/test/metabase/lib/expressions/fuzz.tokenizer.unit.spec.js
-      env:
-        MB_FUZZ: 1
-      name: Run fuzz testing on the tokenizer
+      - uses: actions/checkout@v4
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: "cljs"
+      - run: yarn test-unit frontend/src/metabase-lib/v1/expressions/pratt/fuzz.lexifier.unit.spec.ts
+        env:
+          MB_FUZZ: 1
+        name: Run fuzz testing on the lexifier
 
-  fe-fuzz-recursive-parser:
+  fe-fuzz-compiler:
     runs-on: ubuntu-22.04
     timeout-minutes: 15
     steps:
-    - uses: actions/checkout@v4
-    - name: Prepare front-end environment
-      uses: ./.github/actions/prepare-frontend
-    - name: Prepare back-end environment
-      uses: ./.github/actions/prepare-backend
-      with:
-        m2-cache-key: 'cljs'
-    - run: yarn test-unit frontend/test/metabase/lib/expressions/fuzz.recursive-parser.unit.spec.js
-      env:
-        MB_FUZZ: 1
-      name: Run fuzz testing on the recursive parser
+      - uses: actions/checkout@v4
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: "cljs"
+      - run: yarn test-unit frontend/src/metabase-lib/v1/expressions/fuzz.compiler.unit.spec.ts
+        env:
+          MB_FUZZ: 1
+        name: Run fuzz testing on the custom expression compiler
+
+  fe-fuzz-string-quoting:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: "cljs"
+      - run: yarn test-unit frontend/src/metabase-lib/v1/expressions/fuzz.string.unit.spec.ts
+        env:
+          MB_FUZZ: 1
+        name: Run fuzz testing on the custom expression string quoter

.github/workflows/generative-query-test.yml

@@ -3,18 +3,25 @@ name: Generative Query Test
 on:
   workflow_dispatch:
     inputs:
-      seed:
-        description: 'Seed value (empty = random; logged)'
+      context-seed:
+        description: 'Context seed (empty = random)'
+        type: number
+      iteration-seed:
+        description: 'Iteration seed (for iteration replay, empty = dependent on Context seed)'
         type: number
       iterations:
-        description: 'Number of test iterations (overrides `seconds`)'
+        description: 'Iterations (number of test iterations, overrides seconds)'
         type: number
       seconds:
-        description: 'No further iteration after _this_ number of seconds since test started'
+        description: 'Seconds (Number of seconds after which next iteration will not start)'
+      test:
+        description: 'Test or namespace to run'
+        default: metabase.query-processor-test.generative-test/execution-with-cards-test
       ref:
         description: 'Ref to run generative tests on'
-        default: qgen-milestone-1
+        default: qgen-ms2
 
+# TODO: Consider renaming the job in next milestones
 jobs:
   generative-query-test:
     runs-on: ubuntu-22.04
@@ -22,24 +29,24 @@ jobs:
     name: Generative Query Test
     env:
       CI: 'true'
-      MB_GENTEST_SEED: ${{ inputs.seed }}
+      MB_GENTEST_CONTEXT_SEED: ${{ inputs.context-seed }}
+      MB_GENTEST_ITERATION_SEED: ${{ inputs.iteration-seed }}
       MB_GENTEST_LIMIT_ITERATIONS: ${{ inputs.iterations }}
       MB_GENTEST_LIMIT_SECONDS: ${{ inputs.seconds }}
-      # TODO: Remove in favor of cp root with further tests
       MB_GENTEST_RUN: true
     steps:
       - uses: actions/checkout@v4
         with:
           ref: ${{ inputs.ref }}
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
         with:
           m2-cache-key: generative-query-test
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
 
       - name: Run test
-        run: clojure -X:dev:ci:test:ee:ee-dev :only 'metabase.query-processor-test.generative-test'
+        run: clojure -X:dev:ci:test:ee:ee-dev :only '${{ inputs.test }}'
 
       - name: Publish Test Report (JUnit)
         uses: dorny/test-reporter@v1

.github/workflows/linear-pr-links.yml

@@ -0,0 +1,24 @@
+name: Add Issue References to PR
+
+on:
+  pull_request:
+    types: [opened, edited, synchronize]
+
+jobs:
+  add-issue-references:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: Run the link script
+        uses: actions/github-script@v7
+        env:
+           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+           LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}
+           PR_NUMBER: ${{ github.event.pull_request.number }}
+           REPO_OWNER: ${{ github.repository_owner }}
+           REPO_NAME: ${{ github.event.repository.name }}
+        with:
+          script: |
+            const { link_issues } = require('${{ github.workspace }}/.github/scripts/update-pr-with-issues.js');
+            await link_issues(github)

.github/workflows/links.yml

@@ -19,7 +19,7 @@ jobs:
         uses: lycheeverse/lychee-action@v2
         with:
           fail: false
-          args: docs --config ./.lychee/config.toml --verbose --no-progress
+          args: docs --include-fragments --config ./.lychee/config.toml --verbose --no-progress
           format: markdown
 
       - name: Create Issue From File

.github/workflows/loki-update.yml

@@ -45,17 +45,35 @@ jobs:
           echo "Storybook is being served!"
 
       - name: Update Loki Snapshots
-        run: yarn test-visual:loki-update
+        run: yarn test-visual:loki || yarn test-visual:loki-approve-diff && yarn test-visual:loki-prune
+
+      - name: Check for changes
+        id: check-changes
+        run: |
+          if [[ -n "$(git status --porcelain .loki/reference/)" ]]; then
+            echo "has_changes=true" >> $GITHUB_OUTPUT
+          else
+            echo "has_changes=false" >> $GITHUB_OUTPUT
+          fi
 
       - name: Commit and Push Changes
+        if: steps.check-changes.outputs.has_changes == 'true'
         run: |
           git config --global user.name "Metabase Automation"
           git config --global user.email "github-automation@metabase.com"
-          git add .loki/**
+          git add .loki/reference/
           git commit -m "Update Loki Snapshots"
           git push
         env:
           GITHUB_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+
+      - name: Notify No Changes
+        if: steps.check-changes.outputs.has_changes == 'false'
+        uses: ./.github/actions/notify-pull-request
+        with:
+          include-log: false
+          message: No visual differences were found. All Loki snapshots are up to date.
+
       - name: Remove 'loki-update' label
         uses: actions/github-script@v7
         with:

.github/workflows/mage.yml

@@ -0,0 +1,27 @@
+name: Mage Tests
+
+on:
+  pull_request:
+    paths: ["mage/**", "test/mage/**"]
+
+jobs:
+  # run mage tests even if the rest of be isnt needed
+  mage-tests:
+    runs-on: ubuntu-22.04
+    name: Mage
+    steps:
+      - uses: actions/checkout@v4
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: 'kondo'
+      - name: Setup Babashka
+        uses: turtlequeue/setup-babashka@v1.7.0
+        with:
+          babashka-version: 1.12.197
+      - name: Check bb runs
+        run: bb --version
+      - name: bb task list
+        run: bb tasks
+      - name: Run mage tests
+        run: bb ./test/mage/runtests.clj

.github/workflows/migrations.yml

@@ -19,4 +19,4 @@ jobs:
         with:
           m2-cache-key: lint-migrations
       - name: Verify Liquibase Migrations
-        run: ./bin/lint-migrations-file.sh
+        run: ./bin/mage lint-migrations

.github/workflows/on-epic-close.yml

@@ -1,48 +0,0 @@
-name: A New Feature Slack Notification
-
-on:
-  issues:
-    types:
-      - closed
-
-jobs:
-  on-epic-closed:
-    runs-on: ubuntu-22.04
-    timeout-minutes: 5
-    if: ${{ contains(github.event.issue.labels.*.name, '.Epic') || contains(github.event.issue.labels.*.name, 'Type:New Feature') }}
-    steps:
-      - name: Setting title
-        uses: actions/github-script@v6
-        id: vars
-        with:
-          script: |
-            core.setOutput('issue_title', ${{ toJson(github.event.issue.title) }}.replaceAll(/"/g, '\\"'));
-      - name: Extracting team name
-        id: team_name
-        run: |
-          team_label=$(echo "${{ join(github.event.issue.labels.*.name, ',') }}" | grep -o '\.Team/[^,]*' | head -n 1)
-          echo $team_label
-          echo "team_label=${team_label}" >> "$GITHUB_OUTPUT"
-          team_name=${team_label#*.Team/}
-          echo $team_name
-          echo "team_name=${team_name^^}_SLACK_EPIC_WEBHOOK_URL" >> "$GITHUB_OUTPUT"
-      - name: Send the issue ${{ github.event.issue.number }} to Slack
-        id: slack
-        if: ${{ steps.team_name.outputs.team_label }}
-        uses: slackapi/slack-github-action@v1.26.0
-        with:
-          payload: |
-            {
-              "blocks": [
-                {
-                  "type": "section",
-                  "text": {
-                    "type": "mrkdwn",
-                    "text": "${{ steps.vars.outputs.issue_title }}\n${{ github.event.issue.html_url }}"
-                  }
-                }
-              ]
-            }
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets[steps.team_name.outputs.team_name] }}
-          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK

.github/workflows/perf-test.yml

@@ -40,16 +40,50 @@ jobs:
           -H "Accept: application/vnd.github+json" \
           -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
           -H "X-GitHub-Api-Version: 2022-11-28" \
-          https://api.github.com/repos/${{ github.repository }}/actions/workflows/e2e-tests.yml/runs?head_sha=${{ github.event.pull_request.head.sha || github.sha }}
+          https://api.github.com/repos/${{ github.repository }}/actions/workflows/run-tests.yml/runs?head_sha=${{ github.event.pull_request.head.sha || github.sha }}
           ID=$(jq -r '.workflow_runs[0].id' e2e-tests.json)
+          echo "Run ID: ${ID}"
+
+          ## Get workflow run id for uberjar build
+          while [ -z "$JOB_ID" ]; do
+            NEXT_URL="https://api.github.com/repos/${{ github.repository }}/actions/runs/${ID}/jobs?filter=latest"
+
+            # Search for build job
+            echo "Searching for build job..."
+            while [ -z "$JOB_ID" ] && [ -n "$NEXT_URL" ]; do
+              # Get one page of jobs
+              RESPONSE=$(curl -s -i \
+                -H "Accept: application/vnd.github+json" \
+                -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
+                -H "X-GitHub-Api-Version: 2022-11-28" \
+                "$NEXT_URL")
+
+              # Extract headers and body
+              HEADERS=$(echo "$RESPONSE" | sed -n '1,/^\r$/p')
+              BODY=$(echo "$RESPONSE" | sed '1,/^\r$/d')
+              LINK_HEADER=$(echo "$HEADERS" | grep -i '^link:' | sed 's/^link: //')
+
+              # Check for next page in Link header
+              if echo "$LINK_HEADER" | grep -q 'rel="next"'; then
+                NEXT_URL=$(echo "$LINK_HEADER" | sed -E 's/.*<([^>]+)>; rel="next".*/\1/')
+              else
+                NEXT_URL=""
+              fi
+
+              # Check for build job
+              JOB_ID=$(echo "$BODY" | jq -r '.jobs[] | select(.name | contains("build (ee)")) | .id')
+            done
+          done
+          echo "Job ID: ${JOB_ID}"
+
           ## Wait for uberjar build to complete
           while [ true ]; do
             curl -Ls --output uberjar.json \
             -H "Accept: application/vnd.github+json" \
             -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
             -H "X-GitHub-Api-Version: 2022-11-28" \
-            https://api.github.com/repos/${{ github.repository }}/actions/runs/${ID}/jobs?filter=latest
-            jq -r '.jobs[] | select(.name == "build (ee)") | .steps[] | select(.name == "Prepare uberjar artifact") | .status' uberjar.json | grep -q "completed" && break
+            https://api.github.com/repos/${{ github.repository }}/actions/jobs/${JOB_ID}
+            jq -r '.steps[] | select(.name == "Prepare uberjar artifact") | .status' uberjar.json | grep -q "completed" && break
             echo "Waiting for uberjar build..."
             sleep 10
           done

.github/workflows/pr-env.yml

@@ -40,16 +40,50 @@ jobs:
           -H "Accept: application/vnd.github+json" \
           -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
           -H "X-GitHub-Api-Version: 2022-11-28" \
-          https://api.github.com/repos/${{ github.repository }}/actions/workflows/e2e-tests.yml/runs?head_sha=${{ github.event.pull_request.head.sha || github.sha }}
+          https://api.github.com/repos/${{ github.repository }}/actions/workflows/run-tests.yml/runs?head_sha=${{ github.event.pull_request.head.sha || github.sha }}
           ID=$(jq -r '.workflow_runs[0].id' e2e-tests.json)
+          echo "Run ID: ${ID}"
+
+          ## Get workflow run id for uberjar build
+          while [ -z "$JOB_ID" ]; do
+            NEXT_URL="https://api.github.com/repos/${{ github.repository }}/actions/runs/${ID}/jobs?filter=latest"
+
+            # Search for build job
+            echo "Searching for build job..."
+            while [ -z "$JOB_ID" ] && [ -n "$NEXT_URL" ]; do
+              # Get one page of jobs
+              RESPONSE=$(curl -s -i \
+                -H "Accept: application/vnd.github+json" \
+                -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
+                -H "X-GitHub-Api-Version: 2022-11-28" \
+                "$NEXT_URL")
+
+              # Extract headers and body
+              HEADERS=$(echo "$RESPONSE" | sed -n '1,/^\r$/p')
+              BODY=$(echo "$RESPONSE" | sed '1,/^\r$/d')
+              LINK_HEADER=$(echo "$HEADERS" | grep -i '^link:' | sed 's/^link: //')
+
+              # Check for next page in Link header
+              if echo "$LINK_HEADER" | grep -q 'rel="next"'; then
+                NEXT_URL=$(echo "$LINK_HEADER" | sed -E 's/.*<([^>]+)>; rel="next".*/\1/')
+              else
+                NEXT_URL=""
+              fi
+
+              # Check for build job
+              JOB_ID=$(echo "$BODY" | jq -r '.jobs[] | select(.name | contains("build (ee)")) | .id')
+            done
+          done
+          echo "Job ID: ${JOB_ID}"
+
           ## Wait for uberjar build to complete
           while [ true ]; do
             curl -Ls --output uberjar.json \
             -H "Accept: application/vnd.github+json" \
             -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
             -H "X-GitHub-Api-Version: 2022-11-28" \
-            https://api.github.com/repos/${{ github.repository }}/actions/runs/${ID}/jobs?filter=latest
-            jq -r '.jobs[] | select(.name == "build (ee)") | .steps[] | select(.name == "Prepare uberjar artifact") | .status' uberjar.json | grep -q "completed" && break
+            https://api.github.com/repos/${{ github.repository }}/actions/jobs/${JOB_ID}
+            jq -r '.steps[] | select(.name == "Prepare uberjar artifact") | .status' uberjar.json | grep -q "completed" && break
             echo "Waiting for uberjar build..."
             sleep 10
           done

.github/workflows/pre-release.yml

@@ -35,41 +35,15 @@ jobs:
       oss_version: ${{ steps.version-properties.outputs.oss_version }}
       commit: ${{ steps.version-properties.outputs.commit }}
     steps:
-      - name: find_release_artifact
-        id: find_release_artifact
-        uses: actions/github-script@v7
+      - uses: actions/checkout@v4
         with:
-          result-encoding: string
-          script: | # js
-            const fs = require('fs');
+          sparse-checkout: .github
+      - name: Retrieve test build uberjar artifact for ${{ matrix.edition }}
+        uses: ./.github/actions/fetch-artifact
+        with:
+          name: metabase-release-${{ matrix.edition }}-${{ inputs.commit }}-uberjar
 
-            const artifacts = await github.rest.actions.listArtifactsForRepo({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              name: `metabase-release-${{ matrix.edition }}-${{ inputs.commit }}-uberjar`,
-              per_page: 1,
-            });
-
-            if (!artifacts.data?.artifacts?.[0]?.id) {
-              throw new Error(`No artifacts found for ${{ inputs.commit }}`);
-            }
-
-            const artifact_id = artifacts.data.artifacts[0].id;
-
-            const download = await github.rest.actions.downloadArtifact({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              artifact_id: artifact_id,
-              archive_format: 'zip',
-            });
-
-            fs.writeFileSync(`${process.env.GITHUB_WORKSPACE}/mb.zip`, Buffer.from(download.data));
-      - name: Unzip Metabase artifact containing an uberjar
-        run: unzip mb.zip
-      - name: Extract the version.properties file from the JAR
-        run: |
-          jar xf metabase.jar version.properties
-      - name: Reveal Metabase ${{ matrix.edition }} properties
+      - name: Extract version number from  version.properties
         id: version-properties
         run: |
           cat version.properties
@@ -204,121 +178,30 @@ jobs:
             ./logs/test.log
           if-no-files-found: ignore
 
-  containerize:
-    needs: [release-artifact]
-    runs-on: ubuntu-22.04
-    timeout-minutes: 15
-    strategy:
-      matrix:
-        edition: [oss, ee]
-    services:
-      registry:
-        image: registry:2
-        ports:
-          - 5000:5000
-    outputs:
-      image_tag: ${{ steps.target.outputs.image_tag }}
-    steps:
-      - name: Get the version
-        run: |
-          if [[ "${{ matrix.edition }}" == "ee" ]]; then
-            echo "VERSION=${{ needs.release-artifact.outputs.ee_version }}" >> $GITHUB_ENV
-          else
-            echo "VERSION=${{ needs.release-artifact.outputs.oss_version }}" >> $GITHUB_ENV
-          fi
-      - name: Check out the code
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ needs.release-artifact.outputs.commit }}
-      - uses: actions/download-artifact@v4
-        name: Retrieve uberjar artifact
-        with:
-          name: metabase-test-${{ matrix.edition }}-uberjar
-      - name: Move the Uberjar to the context dir
-        run: mv metabase.jar bin/docker/.
-      - name: Set up Docker Buildx
-        id: buildx
-        uses: docker/setup-buildx-action@v3
-        with:
-          driver-opts: network=host
-      - name: Build ${{ matrix.edition }} container
-        uses: docker/build-push-action@v6
-        with:
-          context: bin/docker/.
-          platforms: linux/amd64
-          network: host
-          tags: localhost:5000/local-metabase:${{ env.VERSION }}
-          no-cache: true
-          push: true
+  containerize-oss:
+    needs: release-artifact
+    uses: ./.github/workflows/containerize-jar.yml
+    secrets: inherit
+    with:
+      artifact-name: metabase-release-oss-${{ inputs.commit }}-uberjar
+      commit: ${{ inputs.commit }}
+      repo: ${{ vars.DOCKERHUB_OWNER }}/${{ vars.DOCKERHUB_STAGING_REPO }}
+      tag: ${{ needs.release-artifact.outputs.oss_version }}-${{ inputs.commit }}
 
-      - name: Launch container
-        run: docker run --rm -dp 3000:3000 localhost:5000/local-metabase:${{ env.VERSION }}
-        timeout-minutes: 5
-      - name: Wait for Metabase to start
-        run: while ! curl -s 'http://localhost:3000/api/health' | grep '{"status":"ok"}'; do sleep 1; done
-        timeout-minutes: 3
-
-      - name: Login to Docker Hub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_RELEASE_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_RELEASE_TOKEN }}
-      - name: Retag and push container image to ${{ vars.DOCKERHUB_OWNER }} staging Docker Hub repo
-        id: target
-        run: |
-          # SHA-1 truncated to 7 digits should be enough
-          SHORT_HASH=${COMMIT:0:7}
-
-          IMAGE_TAG=$VERSION-$SHORT_HASH
-          CONTAINER_IMAGE=${{ vars.DOCKERHUB_OWNER }}/${{ vars.DOCKERHUB_STAGING_REPO }}:$IMAGE_TAG
-
-          echo "image_tag=$IMAGE_TAG" >> $GITHUB_OUTPUT
-
-          echo "Retag local image for staging"
-          docker tag localhost:5000/local-metabase:$VERSION $CONTAINER_IMAGE
-
-          echo "Pushing container image $CONTAINER_IMAGE ..."
-          docker push $CONTAINER_IMAGE
-
-          echo "Finished!"
-        shell: bash
-        env:
-          COMMIT: ${{ needs.release-artifact.outputs.commit }}
-
-  verify-docker-pull:
-    runs-on: ubuntu-22.04
-    needs: [release-artifact, containerize]
-    timeout-minutes: 15
-    strategy:
-      matrix:
-        edition: [oss, ee]
-    env:
-      IMAGE_TAG: ${{ needs.containerize.outputs.image_tag }}
-    steps:
-      - name: Login to Docker Hub # authenticated, to avoid being rate-throttled
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_RELEASE_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_RELEASE_TOKEN }}
-      - name: Pull the container image
-        run: |
-          CONTAINER_IMAGE=${{ vars.DOCKERHUB_OWNER }}/${{ vars.DOCKERHUB_STAGING_REPO }}:$IMAGE_TAG
-          echo "Pulling container image $CONTAINER_IMAGE ..."
-          docker pull $CONTAINER_IMAGE
-          echo "Successful!"
-      - name: Launch container
-        run: |
-          CONTAINER_IMAGE=${{ vars.DOCKERHUB_OWNER }}/${{ vars.DOCKERHUB_STAGING_REPO }}:$IMAGE_TAG
-          docker run --rm -dp 3000:3000 $CONTAINER_IMAGE
-        timeout-minutes: 5
-      - name: Wait for Metabase to start
-        run: while ! curl -s 'http://localhost:3000/api/health' | grep '{"status":"ok"}'; do sleep 1; done
-        timeout-minutes: 3
+  containerize-ee:
+    needs: release-artifact
+    uses: ./.github/workflows/containerize-jar.yml
+    secrets: inherit
+    with:
+      artifact-name: metabase-release-ee-${{ inputs.commit }}-uberjar
+      commit: ${{ inputs.commit }}
+      repo: ${{ vars.DOCKERHUB_OWNER }}/${{ vars.DOCKERHUB_STAGING_REPO }}
+      tag: ${{ needs.release-artifact.outputs.ee_version }}-${{ inputs.commit }}
 
   tests-complete-message:
     if: always()
     runs-on: ubuntu-22.04
-    needs: [run-sanity-check, check-uberjar-health, verify-docker-pull]
+    needs: [run-sanity-check, check-uberjar-health, containerize-ee, containerize-oss]
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v4
@@ -338,7 +221,8 @@ jobs:
             const allJobsSuccessful =
               '${{ needs.run-sanity-check.result }}' === 'success' &&
               '${{ needs.check-uberjar-health.result }}' === 'success' &&
-              '${{ needs.verify-docker-pull.result }}' === 'success';
+              '${{ needs.containerize-ee.result }}' === 'success' &&
+              '${{ needs.containerize-oss.result }}' === 'success';
 
             await sendTestsCompleteMessage({
               owner: context.repo.owner,

.github/workflows/release-embedding-sdk.yml

@@ -14,6 +14,9 @@ on:
           - release-x.51.x
           - release-x.52.x
           - release-x.53.x
+          - release-x.54.x
+          - metabot-v3-main
+          - esbuild-main
 
 concurrency:
   # We want to ensure only one job is running at a time per branch because
@@ -37,12 +40,143 @@ jobs:
           triggered by: @${{ github.event.sender.login }}
           EOF
 
-  determine-version:
-    name: Determine SDK version
+  send-slack-notification-start:
+    name: "Send Slack notification: SDK release started"
+    needs: determine-sdk-version
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    outputs:
+      slackMessageId: ${{ steps.send-slack-message-start.outputs.result }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: release
+
+      - name: Prepare build scripts
+        run: cd ${{ github.workspace }}/release && yarn && yarn build
+
+      - name: Cache build scripts
+        uses: actions/upload-artifact@v4
+        with:
+          name: build-scripts
+          path: release/dist/index.cjs
+
+      - name: Send build start message
+        id: send-slack-message-start
+        uses: actions/github-script@v7
+        env:
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+        with:
+          result-encoding: string
+          script: | # js
+            const { mentionUserByGithubLogin, sendSlackMessage, githubRunLink } = require('${{ github.workspace }}/release/dist/index.cjs');
+            const sdkVersion = "${{ needs.determine-sdk-version.outputs.sdk_version }}";
+
+            const title = `:rocket: *SDK release: ${sdkVersion}* :rocket:`
+            const runLink = githubRunLink(
+              `:building_construction: _CI Run_ :building_construction:`,
+              context.runId,
+              context.repo.owner,
+              context.repo.repo,
+            );
+            const body = `${runLink} - run by ${mentionUserByGithubLogin("${{ github.event.sender.login }}")}`
+            const sendSlackMessageResponse = await sendSlackMessage({
+              channelName: 'team-embedding-releases',
+              message: `${title}\n${body}`,
+            });
+
+            return sendSlackMessageResponse.message.ts
+
+  # Technically this should be placed last, since it runs after other jobs, but I want to co-locate all Slack jobs
+  send-slack-notification-failure:
+    name: "Send Slack notification: SDK release failed"
+    needs:
+      [
+        "determine-sdk-version",
+        "send-slack-notification-start",
+        "check-git-tag",
+        "test",
+        "build-sdk",
+        "publish-npm",
+        "git-tag",
+      ]
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    env:
+      slackMessageId: ${{ needs.send-slack-notification-start.outputs.slackMessageId }}
+    if: ${{ always() && contains(needs.*.result, 'failure') }}
+    steps:
+      - name: Retrieve build scripts
+        uses: actions/download-artifact@v4
+        with:
+          name: build-scripts
+          path: release/dist/
+
+      - name: Send build failure message
+        uses: actions/github-script@v7
+        env:
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+        with:
+          script: | # js
+            const { githubRunLink, sendSlackReply } = require('${{ github.workspace }}/release/dist/index.cjs');
+            const sdkVersion = "${{ needs.determine-sdk-version.outputs.sdk_version }}";
+
+            const runLink = githubRunLink(
+              `:x: ${sdkVersion} Release has failed`,
+              context.runId,
+              context.repo.owner,
+              context.repo.repo,
+            );
+            sendSlackReply({
+              channelName: 'team-embedding-releases',
+              message: runLink,
+              messageId: ${{ env.slackMessageId}},
+              broadcast: true
+            });
+
+  send-slack-notification-successful:
+    name: "Send Slack notification: SDK release successful"
+    needs:
+      ["determine-sdk-version", "send-slack-notification-start", "publish-npm"]
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    env:
+      slackMessageId: ${{ needs.send-slack-notification-start.outputs.slackMessageId }}
+    steps:
+      - name: Retrieve build scripts
+        uses: actions/download-artifact@v4
+        with:
+          name: build-scripts
+          path: release/dist/
+
+      - name: Send build successful message
+        uses: actions/github-script@v7
+        env:
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+        with:
+          script: | # js
+            const { githubRunLink, sendSlackReply } = require('${{ github.workspace }}/release/dist/index.cjs');
+            const sdkVersion = "${{ needs.determine-sdk-version.outputs.sdk_version }}";
+
+            const runLink = githubRunLink(
+              `:partydeploy: ${sdkVersion} Release is complete :partydeploy:`,
+              context.runId,
+              context.repo.owner,
+              context.repo.repo,
+            );
+            sendSlackReply({
+              channelName: 'team-embedding-releases',
+              message: runLink,
+              messageId: ${{ env.slackMessageId}},
+              broadcast: true
+            });
+
+  determine-sdk-version:
     runs-on: ubuntu-22.04
     timeout-minutes: 20
     outputs:
-      sdk_version: ${{ steps.new-sdk-version.outputs.result }}
+      sdk_version: ${{ fromJson(steps.new-sdk-version.outputs.result).version }}
+      major_version: ${{ fromJson(steps.new-sdk-version.outputs.result).majorVersion }}
     steps:
       - name: Check out the code using the provided branch
         uses: actions/checkout@v4
@@ -59,19 +193,25 @@ jobs:
         id: new-sdk-version
         uses: actions/github-script@v7
         with:
-          result-encoding: string
           script: |
             const currentVersion = "${{ steps.current-sdk-version.outputs.sdk_current_version }}";
             const [currentVersionWithoutSuffix, suffix] = currentVersion.split("-");
             const versionParts = currentVersionWithoutSuffix.split(".");
             versionParts[versionParts.length - 1] = parseInt(versionParts.at(-1)) + 1;
             const newVersion = versionParts.join(".");
+            const [_, majorVersion] = versionParts
 
             if (!suffix) {
-              return newVersion;
+              return {
+                version: newVersion,
+                majorVersion
+              };
             }
 
-            return `${newVersion}-${suffix}`
+            return {
+              version: `${newVersion}-${suffix}`,
+              majorVersion
+            }
 
       - name: Append workflow summary
         run: |
@@ -79,15 +219,16 @@ jobs:
           **Derived inputs:**
 
           - \`current_version\`: "${{ steps.current-sdk-version.outputs.sdk_current_version }}"
-          - \`next_version\`: "${{ steps.new-sdk-version.outputs.result }}"
+          - \`next_version\`: "${{ fromJson(steps.new-sdk-version.outputs.result).version }}"
+          - \`major_version\`: "${{ fromJson(steps.new-sdk-version.outputs.result).majorVersion }}"
           EOF
 
   check-git-tag:
-    needs: determine-version
+    needs: determine-sdk-version
     runs-on: ubuntu-22.04
     timeout-minutes: 20
     env:
-      tag: embedding-sdk-${{ needs.determine-version.outputs.sdk_version }}
+      tag: embedding-sdk-${{ needs.determine-sdk-version.outputs.sdk_version }}
     steps:
       - name: Check out the code using the provided branch
         uses: actions/checkout@v4
@@ -128,7 +269,7 @@ jobs:
         run: yarn embedding-sdk:test-unit
 
   build-sdk:
-    needs: [test, determine-version]
+    needs: [test, determine-sdk-version]
     runs-on: ubuntu-22.04
     timeout-minutes: 20
     steps:
@@ -150,7 +291,7 @@ jobs:
       - name: Bump published npm package version
         # NOTE: this should happen before "Build SDK bundle" as we inject SDK version into the code during build step
         run: |
-          ./bin/embedding-sdk/release_utils.bash update_package_json_template ${{ needs.determine-version.outputs.sdk_version }}
+          ./bin/embedding-sdk/release_utils.bash update_package_json_template ${{ needs.determine-sdk-version.outputs.sdk_version }}
 
       - name: Update changelog
         run: |
@@ -175,15 +316,16 @@ jobs:
           path: ./changelog-diff
 
   publish-npm:
-    needs: [build-sdk, determine-version]
+    needs: [build-sdk, determine-sdk-version]
     runs-on: ubuntu-22.04
     timeout-minutes: 20
     env:
-      sdk_version: ${{ needs.determine-version.outputs.sdk_version }}
+      sdk_version: ${{ needs.determine-sdk-version.outputs.sdk_version }}
     steps:
       - name: Check out branch to prepare for a SDK version bump PR
         uses: actions/checkout@v4
         with:
+          token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
           # when we created version update PR, it would only have diff from 2 files SDK readme and SDK package.json template
           ref: ${{ inputs.branch}}
 
@@ -212,10 +354,6 @@ jobs:
 
       - name: Create a PR updating readme + published version, and changelog (using GitHub Metabase Automation account)
         run: |
-          # TODO: Remove this step once github includes the new gh CLI version 2.65.0
-          eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
-          brew install gh
-
           git checkout -b update-sdk-version-${{ env.sdk_version }}
           git commit -a -m 'Update Readme version references and published npm version to ${{ env.sdk_version }}'
           git push origin HEAD
@@ -226,17 +364,11 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
 
-      - uses: actions/create-github-app-token@v1
-        id: app-token
-        with:
-          app-id: ${{ secrets.METABASE_BOT_APP_ID }}
-          private-key: ${{ secrets.METABASE_BOT_APP_PRIVATE_KEY }}
-
       - name: Edit PR adding useful information (using Metabase bot app)
         run: |
           gh pr edit --add-reviewer @metabase/embedding,albertoperdomo --add-label no-backport
         env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          GH_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
 
       - name: Auto approve PR (using GitHub Actions account)
         run: |
@@ -261,32 +393,40 @@ jobs:
         run: |
           echo //registry.npmjs.org/:_authToken=${{ secrets.NPM_RELEASE_TOKEN }} > .npmrc
           # Please keep the value in sync with `inputs.branch`'s release branch
-          npm publish --tag ${{fromJson('{"master": "nightly", "release-x.51.x": "51-stable", "release-x.52.x": "52-stable", "release-x.53.x": "53-stable"}')[inputs.branch]}}
+          npm publish --tag ${{fromJson('{"master": "nightly", "release-x.51.x": "51-stable", "release-x.52.x": "52-stable", "release-x.53.x": "53-stable", "release-x.54.x": "54-stable", "metabot-v3-main": "55-metabot", "esbuild-main": "56-esbuild"}')[inputs.branch]}}
 
-      - name: Add `latest` tag to the latest release branch (`release-x.53.x`) deployment
-        if: ${{ inputs.branch == 'release-x.53.x' }}
+      - name: Add `latest` tag to the latest release branch (`release-x.54.x`) deployment
+        if: ${{ inputs.branch == 'release-x.54.x' }}
         working-directory: sdk
         run: |
           npm dist-tag add @metabase/embedding-sdk-react@${{ env.sdk_version }} latest
 
   git-tag:
-    needs: [publish-npm, determine-version]
+    needs: [publish-npm, determine-sdk-version]
     runs-on: ubuntu-22.04
     timeout-minutes: 20
     env:
-      tag: embedding-sdk-${{ needs.determine-version.outputs.sdk_version }}
+      tag: embedding-sdk-${{ needs.determine-sdk-version.outputs.sdk_version }}
+      stable_tag: embedding-sdk-${{ needs.determine-sdk-version.outputs.major_version }}-stable
     steps:
       - name: Check out the code using the provided branch
         uses: actions/checkout@v4
         with:
+          token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
           ref: ${{ inputs.branch }}
 
-      # Lightweight tags don't need committer name and email
-      - name: Create a new git tag
+      - name: Setup git user
         run: |
-          git tag ${{ env.tag }}
+          git config --global user.email "github-automation@metabase.com"
+          git config --global user.name "Metabase Automation"
 
-      - name: Push the new tag
-        id: push-tag
+      - name: Create and push SDK version tag
         run: |
+          git tag -a ${{ env.tag }} -m "Tagging SDK version ${{ env.tag }}"
           git push origin ${{ env.tag }}
+
+      - name: Create and push SDK stable version tag
+        if: ${{ startsWith(inputs.branch, 'release-x.') }}
+        run: |
+          git tag -a -f ${{ env.stable_tag }} -m "Tagging SDK stable version ${{ env.stable_tag }}"
+          git push origin -f ${{ env.stable_tag }}

.github/workflows/release-status.yml

@@ -50,7 +50,7 @@ jobs:
         sparse-checkout: release
     - name: Prepare build scripts
       run: cd ${{ github.workspace }}/release && yarn --frozen-lockfile && yarn build
-    - name: Check release status and post to Slack
+    - name: Check backport status and post to Slack
       uses: actions/github-script@v7
       env:
         SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}

.github/workflows/release-tag.yml

@@ -269,12 +269,15 @@ jobs:
     needs: check-version
     runs-on: ubuntu-22.04
     timeout-minutes: 5
+    env:
+      GH_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
     strategy:
       matrix:
         edition: ${{ fromJson(needs.check-version.outputs.edition_matrix) }}
     steps:
     - uses: actions/checkout@v4
       with:
+        token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
         fetch-depth: 0 # we want all branches and tags
         fetch-tags: true
     - name: Add and push git tag for nightly/beta/latest

.github/workflows/release.yml

@@ -99,7 +99,11 @@ jobs:
             throw new Error("This version has already been released!", version);
           }
 
-          return versions;
+          console.log({
+            versions,
+          });
+
+          return versions
 
   publish-start-message:
     runs-on: ubuntu-22.04
@@ -137,41 +141,13 @@ jobs:
       matrix:
         edition: [oss, ee]
     steps:
-    - name: find_release_artifact
-      id: find_release_artifact
-      uses: actions/github-script@v7
+    - uses: actions/checkout@v4
       with:
-        result-encoding: string
-        script: | # js
-          const fs = require('fs');
-
-          const artifacts = await github.rest.actions.listArtifactsForRepo({
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-            name: `metabase-release-${{ matrix.edition }}-${{ inputs.commit }}-uberjar`,
-            per_page: 1,
-          });
-
-          if (!artifacts.data?.artifacts?.[0]?.id) {
-            throw new Error(`No artifacts found for ${{ inputs.commit }}`);
-          }
-
-          const artifact_id = artifacts.data.artifacts[0].id;
-
-          const download = await github.rest.actions.downloadArtifact({
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-            artifact_id: artifact_id,
-            archive_format: 'zip',
-          });
-
-          fs.writeFileSync(`${process.env.GITHUB_WORKSPACE}/mb.zip`, Buffer.from(download.data));
-    - name: unzip uberjar artifact
-      run: unzip mb.zip
-    - name: Verify that this is a valid JAR file
-      run: file --mime-type ./metabase.jar | grep "application/zip"
-    - name: Reveal its version.properties
-      run: jar xf metabase.jar version.properties && cat version.properties
+        sparse-checkout: .github
+    - name: Retrieve test build uberjar artifact for ${{ matrix.edition }}
+      uses: ./.github/actions/fetch-artifact
+      with:
+        name: metabase-release-${{ matrix.edition }}-${{ inputs.commit }}-uberjar
     - name: Check JAR version properties
       run: |
         # ensure actual jar checksum matches checksum file
@@ -247,7 +223,6 @@ jobs:
         --distribution-id ${{ vars.AWS_CLOUDFRONT_DOWNLOADS_ID }} \
         --paths /${{ steps.version_path.outputs.result }}/metabase.jar
 
-
   verify-s3-download:
     runs-on: ubuntu-22.04
     needs: upload-to-s3
@@ -281,143 +256,29 @@ jobs:
     - name: Verify Checksum
       run: grep -q $(sha256sum ./metabase-downloaded.jar) SHA256.sum && echo "checksums match" || exit 1
 
-  containerize:
-    runs-on: ubuntu-22.04
-    needs: [check-version, download-uberjar]
-    timeout-minutes: 15
-    strategy:
-      matrix:
-        edition: [oss, ee]
-    services:
-      registry:
-        image: registry:2
-        ports:
-          - 5000:5000
-    steps:
-    - uses: actions/checkout@v4
-      with:
-        # checkout the commit that was tagged so we get the right dockerfile
-        ref: ${{ inputs.commit }}
-        fetch-depth: 0  # IMPORTANT! to get all the tags
-    - name: prepare release scripts
-      run: cd release && yarn && yarn build
-    - name: Determine the docker version tag
-      uses: actions/github-script@v7
-      id: canonical_version
-      with:
-        result-encoding: string
-        script: |
-          const version = '${{ inputs.version }}';
-          const edition = '${{ matrix.edition }}';
+  containerize-oss:
+    needs: check-version
+    uses: ./.github/workflows/containerize-jar.yml
+    secrets: inherit
+    with:
+      artifact-name: metabase-release-oss-${{ inputs.commit }}-uberjar
+      commit: ${{ inputs.commit }}
+      repo: ${{ vars.DOCKERHUB_OWNER }}/${{ vars.DOCKERHUB_REPO }}
+      tag: ${{ needs.check-version.outputs.oss }}
 
-          const canonical_version = edition === 'ee'
-            ? '${{ needs.check-version.outputs.ee }}'
-            : '${{ needs.check-version.outputs.oss }}';
-
-          console.log("The canonical version of this Metabase", edition, "edition is", canonical_version);
-
-          return canonical_version;
-    - uses: actions/download-artifact@v4
-      name: Retrieve previously downloaded Uberjar
-      with:
-        name: metabase-${{ matrix.edition }}-uberjar
-    - name: Move the Uberjar to the context dir
-      run: mv ./metabase.jar bin/docker/.
-    - name: Set up Docker Buildx
-      id: buildx
-      uses: docker/setup-buildx-action@v2
-      with:
-        driver-opts: network=host
-    - name: Build ${{ matrix.edition }} container
-      uses: docker/build-push-action@v3
-      with:
-        context: bin/docker/.
-        platforms: linux/amd64
-        network: host
-        tags: localhost:5000/local-metabase:${{ steps.canonical_version.outputs.result }}
-        no-cache: true
-        push: true
-
-    - name: Launch container
-      run: docker run --rm -dp 3000:3000 localhost:5000/local-metabase:${{ steps.canonical_version.outputs.result }}
-      timeout-minutes: 5
-    - name: Wait for Metabase to start
-      run: while ! curl -s 'http://localhost:3000/api/health' | grep '{"status":"ok"}'; do sleep 1; done
-      timeout-minutes: 3
-
-    - name: Determine the target Docker Hub repository
-      run: |
-        if [[ "${{ matrix.edition }}" == "ee" ]]; then
-          echo "Metabase EE: image is going to be pushed to ${{ github.repository_owner }}/metabase-enterprise"
-          echo "DOCKERHUB_REPO=${{ github.repository_owner }}/metabase-enterprise" >> $GITHUB_ENV
-        else
-          echo "Metabase OSS: image is going to be pushed to ${{ github.repository_owner }}/metabase"
-          echo "DOCKERHUB_REPO=${{ github.repository_owner }}/metabase" >> $GITHUB_ENV
-        fi
-
-    - name: Login to Docker Hub
-      uses: docker/login-action@v2
-      with:
-        username: ${{ secrets.DOCKERHUB_RELEASE_USERNAME }}
-        password: ${{ secrets.DOCKERHUB_RELEASE_TOKEN }}
-    - name: Retag and push container image to Docker Hub
-      run: |
-        echo "Pushing ${{ steps.canonical_version.outputs.result }} to ${{ env.DOCKERHUB_REPO }} ..."
-        docker tag localhost:5000/local-metabase:${{ steps.canonical_version.outputs.result }} ${{ env.DOCKERHUB_REPO }}:${{ steps.canonical_version.outputs.result }}
-        docker push ${{ env.DOCKERHUB_REPO }}:${{ steps.canonical_version.outputs.result }}
-        echo "Finished!"
-
-  verify-docker-pull:
-    runs-on: ubuntu-22.04
-    needs: containerize
-    timeout-minutes: 15
-    strategy:
-      matrix:
-        edition: [oss, ee]
-    steps:
-    - name: Login to Docker Hub # authenticated, to avoid being rate-throttled
-      uses: docker/login-action@v2
-      with:
-        username: ${{ secrets.DOCKERHUB_RELEASE_USERNAME }}
-        password: ${{ secrets.DOCKERHUB_RELEASE_TOKEN }}
-    - name: Determine the container image to pull
-      run: |
-        if [[ "${{ matrix.edition }}" = "ee" ]]; then
-          echo "DOCKERHUB_REPO=${{ github.repository_owner }}/metabase-enterprise" >> $GITHUB_ENV
-        else
-          echo "DOCKERHUB_REPO=${{ github.repository_owner }}/metabase" >> $GITHUB_ENV
-        fi
-    - name: Determine the docker version tag
-      uses: actions/github-script@v7
-      id: canonical_version
-      with:
-        result-encoding: string
-        script: |
-          const version = '${{ inputs.version }}';
-          const edition = '${{ matrix.edition }}';
-
-          const canonical_version = edition === "ee"
-            ? version.replace(/^v0\./, "v1.") // always e.g. v1.47.2
-            : version.replace(/^v1\./, "v0."); // always e.g. v0.47.2
-
-          console.log("The canonical version of this Metabase", edition, "edition is", canonical_version);
-
-          return canonical_version;
-    - name: Pull the container image
-      run: |
-        echo "Pulling container image ${{ env.DOCKERHUB_REPO }}:${{ steps.canonical_version.outputs.result }} ..."
-        docker pull ${{ env.DOCKERHUB_REPO }}:${{ steps.canonical_version.outputs.result }}
-        echo "Successful!"
-    - name: Launch container
-      run: docker run --rm -dp 3000:3000 ${{ env.DOCKERHUB_REPO }}:${{ steps.canonical_version.outputs.result }}
-      timeout-minutes: 5
-    - name: Wait for Metabase to start
-      run: while ! curl -s 'http://localhost:3000/api/health' | grep '{"status":"ok"}'; do sleep 1; done
-      timeout-minutes: 3
+  containerize-ee:
+    needs: check-version
+    uses: ./.github/workflows/containerize-jar.yml
+    secrets: inherit
+    with:
+      artifact-name: metabase-release-ee-${{ inputs.commit }}-uberjar
+      commit: ${{ inputs.commit }}
+      repo: ${{ vars.DOCKERHUB_OWNER }}/${{ vars.DOCKERHUB_REPO }}-enterprise
+      tag: ${{ needs.check-version.outputs.ee }}
 
   push-tags:
     permissions: write-all
-    needs: [verify-s3-download, verify-docker-pull, check-version]
+    needs: [verify-s3-download, containerize-oss, containerize-ee, check-version]
     runs-on: ubuntu-22.04
     timeout-minutes: 10
     steps:
@@ -429,6 +290,7 @@ jobs:
     - name: Tag Release
       uses: actions/github-script@v7
       with:
+        github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
         result-encoding: string
         script: | # js
           const { tagRelease } = require('${{ github.workspace }}/release/dist/index.cjs');
@@ -476,7 +338,8 @@ jobs:
     needs:
       - get-extra-tags
       - push-tags
-      - verify-docker-pull
+      - containerize-ee
+      - containerize-oss
       - verify-s3-download
     strategy:
       matrix:
@@ -496,6 +359,29 @@ jobs:
     runs-on: ubuntu-22.04
     timeout-minutes: 10
     steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: release
+      - name: Prepare build scripts
+        run: cd ${{ github.workspace }}/release && yarn && yarn build
+      - name: Find milestone
+        id: find-milestone
+        uses: actions/github-script@v7
+        with:
+          script: | # js
+            const { findMilestone } = require('${{ github.workspace }}/release/dist/index.cjs');
+
+            const version = '${{ inputs.version }}';
+
+            const milestone = await findMilestone({
+              github,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              version,
+            }).catch(console.error);
+
+            console.log("Milestone:", milestone.number);
+            core.setOutput('milestone', milestone.number);
       - uses: actions/github-script@v7
         with:
           github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
@@ -509,6 +395,10 @@ jobs:
               event_type: 'create-release-issues',
               client_payload: {
                 version: enterpriseVersion,
+                runId: '${{ github.run_id }}',
+                releaseSha: '${{ inputs.commit }}',
+                userName: '${{ github.actor }}',
+                milestone: '${{ steps.find-milestone.outputs.milestone }}',
               }
             });
 
@@ -550,19 +440,36 @@ jobs:
           sparse-checkout: release
       - name: prepare release scripts
         run: cd release && yarn && yarn build
-      - name: Publish draft release notes
+      - name: Publish draft release notes to github
         uses: actions/github-script@v7
         with:
+          github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
           result-encoding: string
           script: | # js
-            const { publishRelease, getCanonicalVersion } = require('${{ github.workspace }}/release/dist/index.cjs');
+            const {
+              publishRelease,
+              getCanonicalVersion,
+              getGenericVersion,
+              getMilestoneIssues,
+              getWebsiteChangelog,
+              getMajorVersion
+            } = require('${{ github.workspace }}/release/dist/index.cjs');
 
             const version = '${{ inputs.version }}';
 
+            const issues = await getMilestoneIssues({
+              version,
+              github,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+            });
+
+            // github release notes
             await publishRelease({
               github,
               owner: context.repo.owner,
               repo: context.repo.repo,
+              issues,
               version,
             }).then(() => {
               console.log('Successfully published release notes', '${{ inputs.version }}');
@@ -571,6 +478,20 @@ jobs:
               process.exit(1);
             });
 
+            // website changelog
+            const changelogText = getWebsiteChangelog({ version, issues });
+
+            await github.rest.repos.createDispatchEvent({
+              owner: context.repo.owner,
+              repo: '${{ vars.WEBSITE_REPO }}',
+              event_type: 'update-changelog',
+              client_payload: {
+                version: getGenericVersion(version),
+                majorVersion: getMajorVersion(version),
+                text: changelogText,
+              }
+            }).catch(console.warn);
+
   publish-version-info:
     runs-on: ubuntu-22.04
     needs: [push-tags, check-version]
@@ -672,7 +593,6 @@ jobs:
               version: '${{ inputs.version }}',
               runId: '${{ github.run_id }}',
               channelName: '${{ vars.SLACK_RELEASE_CHANNEL }}',
-              generalChannelName: !isAutoRelease ? '${{ vars.SLACK_GENERAL_CHANNEL }}' : '',
             }).catch(console.error);
 
   manage-milestones:

.github/workflows/run-tests.yml

@@ -15,6 +15,9 @@ jobs:
     timeout-minutes: 5
     outputs:
       e2e_all: ${{ steps.changes.outputs.e2e_all }}
+      e2e_all_files: ${{ steps.changes.outputs.e2e_all_files }}
+      e2e_specs: ${{ steps.changes.outputs.e2e_specs }}
+      e2e_specs_files: ${{ steps.changes.outputs.e2e_specs_files }}
       backend_all: ${{ steps.changes.outputs.backend_all }}
       frontend_all: ${{ steps.changes.outputs.frontend_all }}
       frontend_sources: ${{ steps.changes.outputs.frontend_sources }}
@@ -25,6 +28,8 @@ jobs:
         id: changes
         with:
           token: ${{ github.token }}
+          # comma separated list of files
+          list-files: csv
           filters: .github/file-paths.yaml
 
   static-viz-files-changed:
@@ -43,6 +48,8 @@ jobs:
           m2-cache-key: "files-changed"
       - name: Build static-viz frontend
         run: yarn build-static-viz
+        env:
+          MB_EDITION: ee
       - name: Upload Static Viz Bundle Artifact
         uses: actions/upload-artifact@v4
         with:
@@ -77,6 +84,7 @@ jobs:
     secrets: inherit
     with:
       skip: ${{ needs.files-changed.outputs.frontend_all != 'true' }}
+      skip-lint: ${{ needs.files-changed.outputs.frontend_all != 'true' && needs.files-changed.outputs.e2e_specs != 'true' }}
 
   e2e-tests:
     needs: files-changed
@@ -84,3 +92,8 @@ jobs:
     secrets: inherit
     with:
       skip: ${{ needs.files-changed.outputs.e2e_all != 'true' }}
+      # here we pass result from files-changed, which is a list of files, comma separated
+      # e.g. e2e/test/scenarios/onboarding/command-palette.cy.spec.js,e2e/test/scenarios/question/document-title.cy.spec.js
+      # e2e_all_files includes all changes which trigger all e2e tests, if the list of changes files is included in the
+      # list of changed specs files, then only specs are changed and we can run only those specs
+      specs: ${{ needs.files-changed.outputs.e2e_all_files == needs.files-changed.outputs.e2e_specs_files && needs.files-changed.outputs.e2e_specs_files || '' }}

.github/workflows/snyk.yml

@@ -29,12 +29,23 @@ jobs:
       - uses: snyk/actions/setup@0.4.0
       - name: Generate all pom.xml
         run: .github/scripts/write-poms.sh
-      - name: Run snyk
+      - name: Run snyk main project
         env:
           SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
         continue-on-error: true
-        run: snyk test --all-projects --sarif-file-output=snyk.sarif
+        run: snyk test --all-projects --exclude="modules" --sarif-file-output=snyk-main.sarif
       - name: Upload result to GitHub Code Scanning
         uses: github/codeql-action/upload-sarif@v3
         with:
-          sarif_file: snyk.sarif
+          sarif_file: snyk-main.sarif
+          category: main-project
+      - name: Run snyk drivers
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        continue-on-error: true
+        run: cd modules && snyk test --all-projects --sarif-file-output=snyk-drivers.sarif
+      - name: Upload result to GitHub Code Scanning
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: modules/snyk-drivers.sarif
+          category: drivers

.github/workflows/tag-for-release.yml

@@ -135,6 +135,9 @@ jobs:
     env:
       INTERACTIVE: false
     steps:
+    - uses: actions/checkout@v4
+      with:
+        sparse-checkout: .github
     - name: Get correct version number
       run: | # bash
         if [ '${{matrix.edition}}' == 'ee' ]; then
@@ -151,54 +154,9 @@ jobs:
         java-version: 21
 
     - name: Retrieve test build uberjar artifact for ${{ matrix.edition }}
-      id: find_release_artifact
-      uses: actions/github-script@v7
+      uses: ./.github/actions/fetch-artifact
       with:
-        result-encoding: string
-        script: | # js
-          const fs = require('fs');
-
-          const artifacts = await github.rest.actions.listArtifactsForRepo({
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-            name: `metabase-${{ matrix.edition }}-${{ inputs.commit }}-uberjar`,
-            per_page: 1,
-          });
-
-          if (!artifacts.data?.artifacts?.[0]?.id) {
-            console.warn(`No existing artifacts found for ${{ inputs.commit }}, need to build jar`);
-
-            if ("${{matrix.edition}}" === 'oss') {
-              // only trigger the build job on OSS, otherwise we'll get double builds
-              github.rest.actions.createWorkflowDispatch({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                workflow_id: 'build-for-release.yml',
-                ref: 'refs/heads/master',
-                inputs: {
-                  commit: '${{ inputs.commit }}',
-                  version: '${{ inputs.version }}',
-                }
-              });
-            }
-
-            throw new Error('aborting in favor of build script');
-          }
-
-          const artifact_id = artifacts.data.artifacts[0].id;
-
-          const download = await github.rest.actions.downloadArtifact({
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-            artifact_id: artifact_id,
-            archive_format: 'zip',
-          });
-
-          fs.writeFileSync(`${process.env.GITHUB_WORKSPACE}/mb.zip`, Buffer.from(download.data));
-    - name: Unzip Metabase artifact containing an uberjar
-      run: |
-        unzip mb.zip
-        mv target/uberjar/metabase.jar metabase.jar
+        name: metabase-${{ matrix.edition }}-${{ inputs.commit }}-uberjar
 
     - name: Update version.properties in jar
       run: | # sh

.github/workflows/translation-update.yml

@@ -1,134 +1,119 @@
-name: Update Translations
-run-name: Update Translations for v${{ inputs.version }} - ${{ inputs.step }}
+name: Synchronize Translations
 on:
+  schedule:
+    - cron: 30 5 * * 2 # tuesday morning, UTC
   workflow_dispatch:
-    inputs:
-      step:
-        type: choice
-        description: Upload untranslated strings | Download translated strings
-        options:
-          - upload
-          - download
-        required: true
-      version:
-        type: string
-        description: "The version number for which to update translations (e.g. 43, 58.7)"
-        required: true
 
 permissions:
   contents: write
   pull-requests: write
 
 jobs:
-  upload-translations:
-    name: Upload Translations
-    if: ${{ inputs.step  == 'upload' }}
+  synchronize-translations:
+    name: Synchronize Translations
+    env:
+      BRANCH_NAME: update-translations-${{ github.run_id }}
+      CROWDIN_PROJECT_ID: ${{ secrets.CROWDIN_PROJECT_ID }}
+      CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_TOKEN }}
+      GITHUB_TOKEN: ${{ github.token }}
+      GH_TOKEN: ${{ github.token }}
     runs-on: ubuntu-22.04
     timeout-minutes: 20
-    env:
-      POEDITOR_API_TOKEN: ${{ secrets.POEDITOR_API_TOKEN }}
-      POEDITOR_PROJECT_ID: 200535
-      VERSION: ${{ inputs.version }}
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v4
-    - name: Prepare front-end environment
-      uses: ./.github/actions/prepare-frontend
-    - name: Prepare back-end environment
-      uses: ./.github/actions/prepare-backend
-      with:
-        m2-cache-key: manage-translations
-    - name: install gettext
-      run: sudo apt-get install gettext
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: manage-translations
+      - name: install gettext
+        run: sudo apt-get install gettext
 
-    # TODO: check for untranslated strings
+      - name: Crowdin download
+        uses: crowdin/github-action@v2
+        id: crowdin-download
+        with:
+          config: locales/crowdin.yml
+          command: download
+          command_args: |
+            --config locales/crowdin.yml
+            -e=el
+            -e=es-MX
+            -e=gu-IN
+            -e=hr
+            -e=lt
+            -e=km
+            -e=pt-PT
+            -e=ro
+            -e=th
+            -e=uz
 
-    - name: Upload strings to be translated
-      run: | # sh
-        ./bin/i18n/update-translation-template
-        ./bin/i18n/export-pot-to-poeditor
-        echo "Strings uploaded to POEditor"
+      - name: Prepare translation resources
+        env:
+          GITHUB_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+        run: | # sh
+          git config user.name github-actions
+          git config user.email github-actions@github.com
+          git checkout -b $BRANCH_NAME
 
-    - name: Commit changes
-      env:
-        GH_TOKEN: ${{ github.token }}
-      run: | # sh
-        git config user.name github-actions
-        git config user.email github-actions@github.com
+          DATE=$(date +'%Y-%m-%d')
 
-        BRANCH_NAME="update-translations-v$VERSION"
+          ./bin/i18n/update-translation-template
 
-        git checkout -b $BRANCH_NAME
-        git add locales/
+          git add locales/metabase.po
+          git commit -m "Update translation sources $DATE" --no-verify
 
-        git commit -m "Add new strings for v$VERSION"
-        git push -u origin $BRANCH_NAME
+          ./bin/i18n/build-translation-resources
 
-        gh pr create \
-        --reviewer "${GITHUB_ACTOR}" \
-        --assignee "${GITHUB_ACTOR}" \
-        --title "Update Translations for v$VERSION" \
-        --body "Update translations from POEditor for v$VERSION
+          git add locales/
+          git commit -a -m "Update translations $Date" --allow-empty --no-verify
+          git push -u origin $BRANCH_NAME
 
-        See [translation update documentation](https://www.notion.so/metabase/Process-for-updating-translations-421db70048fe400da1153ad0b61102f4)
+      - name: Crowdin upload
+        uses: crowdin/github-action@v2
+        id: crowdin-upload
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          CROWDIN_PROJECT_ID: ${{ secrets.CROWDIN_PROJECT_ID }}
+          CROWDIN_PERSONAL_TOKEN: ${{ secrets.CROWDIN_TOKEN }}
+        with:
+          config: locales/crowdin.yml
+          command: upload
+          command_args: --config locales/crowdin.yml
 
-        ## To Do
+      - name: Open PR
+        id: create_pr
+        env:
+          GITHUB_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+        run: | # sh
+          DATE=$(date +'%Y-%m-%d')
 
-        - [x] Upload new strings to POEditor
-        - [ ] Message contributors on POEditor (manual)
-        - [ ] Copy source strings to english language (manual)
-        - [ ] Download translations from POEditor (github action)
-        - [ ] Merge this PR and backport to the release branch (manual)
-        " \
-        --label "backport" \
-        --label "Customization/i18n"
+          URL=$(gh pr create \
+            --base master \
+            --head $BRANCH_NAME \
+            --title "Update translations $DATE" \
+            --body "Synchronize translations with Crowdin" \
+            --label "no-backport" \
+            --label "Customization/i18n")
 
-    # TODO: notify contributors
-    # TODO: copy source strings to english language
+          PR_NUMBER=${URL##*/}
 
-  download-translations:
-    name: Download Translations
-    if: ${{ inputs.step == 'download' }}
-    runs-on: ubuntu-22.04
-    timeout-minutes: 20
-    env:
-      POEDITOR_API_TOKEN: ${{ secrets.POEDITOR_API_TOKEN }}
-      POEDITOR_PROJECT_ID: 200535
-      VERSION: ${{ inputs.version }}
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v4
-      with:
-        # assumes there's already a branch with that name from the upload step
-        ref: update-translations-v${{inputs.VERSION}}
-    - name: Prepare back-end environment
-      uses: ./.github/actions/prepare-backend
-      with:
-        m2-cache-key: manage-translations
+          echo "::set-output name=pr_number::$PR_NUMBER"
 
-    - name: Prepare build scripts
-      run: cd ${{ github.workspace }}/release && yarn && yarn build
-    - name: Automatically translate untranslated strings
-      uses: actions/github-script@v7
-      with:
-        script: | # js
-          const { autoTranslateSupportedLanguages } = require('${{ github.workspace }}/release/dist/index.cjs');
+      - name: Auto approve PR
+        uses: juliangruber/approve-pull-request-action@v1
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          number: ${{ steps.create_pr.outputs.pr_number }}
 
-          await autoTranslateSupportedLanguages();
-
-    - name: Download translated strings
-      run: | # sh
-        cd ${{ github.workspace }}
-        ./bin/i18n/import-po-from-poeditor
-        ./bin/i18n/build-translation-resources
-    - name: Commit changes
-      run: | # sh
-        git config user.name github-actions
-        git config user.email github-actions@github.com
-
-        BRANCH_NAME="update-translations-v$VERSION"
-
-        git add locales/
-
-        git commit -m "Update translations"
-        git push -u origin $BRANCH_NAME
+      - name: Enable Pull Request Automerge
+        uses: peter-evans/enable-pull-request-automerge@v2
+        with:
+          token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+          pull-request-number: ${{ steps.create_pr.outputs.pr_number }}
+          merge-method: squash

.github/workflows/uberjar.yml

@@ -1,355 +1,174 @@
 name: Build + Docker Uberjar
 
+# This workflow builds an uberjar and pushes it to dockerhub for any branch, either on-demand,
+# or automatically for the listed branches
+
 on:
   push:
     branches:
-      - "master"
-      - metabot-v3-second-try
+      - master
+      - metabot-v3-main
       - feature-visualizer
+      - internal-tools
     paths-ignore:
       # config files
       - ".**"
       # documentation
-      - 'docs/**'
+      - "docs/**"
       - "**.md"
       # this covers both BE and FE unit tests, as well as E2E tests
-      - '**test/**'
+      - "**test/**"
       - "**_test.clj"
       - "**/frontend/**.unit.*"
   workflow_dispatch:
     inputs:
       commit:
-        description: 'Optional full-length commit SHA-1 hash'
+        description: "Optional full-length commit SHA-1 hash"
 
 jobs:
+  get-container-info:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    name: Get container info
+    outputs:
+      editions: ${{ toJson(fromJson(steps.info.outputs.result).editions) }}
+      ee: ${{ toJson(fromJson(steps.info.outputs.result).ee) }}
+      oss: ${{ toJson(fromJson(steps.info.outputs.result).oss) }}
+    steps:
+      - name: Get docker repo and tag
+        id: info
+        uses: actions/github-script@v7
+        with:
+          script: | # js
+            const branch = '${{ github.head_ref || github.ref_name }}';
+            const owner = '${{ github.repository_owner }}';
+
+            console.log(`Branch: ${branch}`);
+
+            if (branch === "master") {
+              return {
+                editions: ["ee", "oss"],
+                ee: {
+                  repo: `${owner}/metabase-enterprise-head`,
+                  tag: "latest"
+                },
+                oss: {
+                  repo: `${owner}/metabase-head`,
+                  tag: "latest"
+                }
+              };
+            }
+
+            return {
+              editions: ["ee"],
+              ee: {
+                repo: `${owner}/metabase-dev`,
+                tag: branch.replaceAll("/", "-"), // slashes make docker sad
+              },
+            };
+
+      - name: Print output
+        run: |
+          echo "${{ steps.info.outputs.result }}"
+
   build:
+    needs: get-container-info
     name: Build MB ${{ matrix.edition }}
     runs-on: ubuntu-22.04
-    timeout-minutes: 40
+    timeout-minutes: 15
     strategy:
       matrix:
-        edition: [ee, oss]
+        edition: ${{ fromJson(needs.get-container-info.outputs.editions) }}
     env:
       MB_EDITION: ${{ matrix.edition }}
       INTERACTIVE: false
+      SKIP_LICENSES: true # faster builds for dev
     steps:
-    - name: Check out the code
-      uses: actions/checkout@v4
-      with:
-        ref: ${{ github.event.inputs.commit }}
-    - name: Prepare front-end environment
-      uses: ./.github/actions/prepare-frontend
-    - name: Prepare back-end environment
-      uses: ./.github/actions/prepare-backend
-      with:
-        m2-cache-key: uberjar
-        java-version: 21
-    - name: Build
-      run: ./bin/build.sh
-    - name: Prepare uberjar artifact
-      uses: ./.github/actions/prepare-uberjar-artifact
-      with:
-        name: metabase-${{ matrix.edition }}-${{ github.sha }}-uberjar
-
-  check_jar_health:
-    runs-on: ubuntu-22.04
-    name: Is ${{ matrix.edition }} (java ${{ matrix.java-version }}) healthy?
-    needs: build
-    timeout-minutes: 10
-    strategy:
-      matrix:
-        edition: [ee, oss]
-        java-version: [21]
-    steps:
-    - name: Prepare JRE (Java Run-time Environment)
-      uses: actions/setup-java@v4
-      with:
-        java-package: jre
-        java-version: ${{ matrix.java-version }}
-        distribution: 'temurin'
-    - run: java -version
-    - uses: actions/download-artifact@v4
-      name: Retrieve uberjar artifact
-      with:
-        name: metabase-${{ matrix.edition }}-${{ github.sha }}-uberjar
-    - name: Launch uberjar
-      run: >-
-        java --add-opens java.base/java.nio=ALL-UNNAMED -jar ./target/uberjar/metabase.jar &
-    - name: Wait for Metabase to start
-      run: while ! curl 'http://localhost:3000/api/health' | grep '{"status":"ok"}'; do sleep 1; done
-
-  containerize_test_and_push_container:
-    runs-on: ubuntu-22.04
-    name: Containerize ${{ matrix.edition }}
-    needs: check_jar_health
-    strategy:
-      matrix:
-        edition: [ee, oss, ee-extra]
-    services:
-      registry:
-        image: registry:2
-        ports:
-          - 5000:5000
-    permissions:
-      id-token: write
-      contents: read
-      security-events: write
-    steps:
-    - name: Extract and clean branch name
-      shell: bash
-      run: echo "branch=$(echo $GITHUB_REF_NAME | sed 's/[^-._a-zA-Z0-9]/-/g')" >> $GITHUB_OUTPUT
-      id: extract_branch
-    - name: Verify the intended tag of the container image
-      run: echo "Container image will be tagged as ${{ steps.extract_branch.outputs.branch }}-${{ matrix.edition }}"
-    - name: Check out the code (Dockerfile needed)
-      uses: actions/checkout@v4
-      with:
-        ref: ${{ github.event.inputs.commit }}
-    - name: Download uploaded artifacts to insert into container
-      if: ${{ matrix.edition != 'ee-extra' }}
-      uses: actions/download-artifact@v4
-      with:
-        name: metabase-${{ matrix.edition }}-${{ github.sha }}-uberjar
-        path: bin/docker/
-    - name: Download uploaded artifacts to insert into container
-      if: ${{ matrix.edition == 'ee-extra' }}
-      uses: actions/download-artifact@v4
-      with:
-        name: metabase-ee-${{ github.sha }}-uberjar
-        path: bin/docker/
-    - name: Move the ${{ matrix.edition }} uberjar to the context dir
-      run: mv bin/docker/target/uberjar/metabase.jar bin/docker/.
-    - name: Add partner drivers to the container
-      if: ${{ matrix.edition == 'ee-extra' }}
-      uses: ./.github/actions/build-ee-extra
-      with:
-        iam-role: ${{ secrets.METABASE_EE_EXTRA_IAM_ROLE }}
-    - name: Set up Docker Buildx
-      id: buildx
-      uses: docker/setup-buildx-action@v2.5.0
-      with:
-        driver-opts: network=host
-    - name: Build ${{ matrix.edition }} container
-      uses: docker/build-push-action@v3
-      with:
-        context: bin/docker/.
-        platforms: linux/amd64,linux/arm64
-        network: host
-        tags: localhost:5000/metabase-dev:${{ steps.extract_branch.outputs.branch }}-${{ matrix.edition }}
-        build-args: |
-          GIT_COMMIT_SHA=${{ github.sha }}
-        no-cache: true
-        push: true
-    - name: Launch ${{ matrix.edition }} container
-      run: docker run --rm -dp 3000:3000 localhost:5000/metabase-dev:${{ steps.extract_branch.outputs.branch }}-${{ matrix.edition }}
-      timeout-minutes: 5
-    - name: Is Docker running?
-      run: docker ps
-    - name: Wait for Metabase to start and reach 100% health
-      run: while ! curl 'http://localhost:3000/api/health' | grep '{"status":"ok"}'; do sleep 1; done
-      timeout-minutes: 3
-    - name: Login to Docker Hub
-      uses: docker/login-action@v2
-      with:
-        username: ${{ secrets.DOCKERHUB_USERNAME }}
-        password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-    - name: Retag and push images if master (ee) - should be cached at this point
-      if: ${{ (github.ref_name == 'master') && matrix.edition == 'ee' }}
-      uses: docker/build-push-action@v3
-      with:
-        context: bin/docker/.
-        platforms: linux/amd64,linux/arm64
-        network: host
-        tags: ${{ github.repository_owner }}/metabase-enterprise-head:latest
-        build-args: |
-          GIT_COMMIT_SHA=${{ github.sha }}
-        no-cache: false
-        push: true
-
-    # TODO: remove when we're done testing metabot
-    - name: Retag and push images if metabot-v3-second-try (ee) - should be cached at this point
-      if: ${{ (github.ref_name == 'metabot-v3-second-try') && matrix.edition == 'ee' }}
-      uses: docker/build-push-action@v3
-      with:
-        context: bin/docker/.
-        platforms: linux/amd64,linux/arm64
-        network: host
-        tags: ${{ github.repository_owner }}/metabase-enterprise-head:metabot
-        build-args: |
-          GIT_COMMIT_SHA=${{ github.sha }}
-        no-cache: false
-        push: true
-
-    - name: Retag and push images if master (oss) - should be cached at this point
-      if: ${{ (github.ref_name == 'master') && matrix.edition == 'oss' }}
-      uses: docker/build-push-action@v3
-      with:
-        context: bin/docker/.
-        platforms: linux/amd64,linux/arm64
-        network: host
-        tags: ${{ github.repository_owner }}/metabase-head:latest
-        build-args: |
-          GIT_COMMIT_SHA=${{ github.sha }}
-        no-cache: false
-        push: true
-
-    - name: Retag and push images if master (ee-extra) - should be cached at this point
-      if: ${{ (github.ref_name == 'master') && matrix.edition == 'ee-extra' }}
-      uses: docker/build-push-action@v3
-      with:
-        context: bin/docker/.
-        platforms: linux/amd64,linux/arm64
-        network: host
-        tags: ${{ secrets.METABASE_EE_EXTRA_CONTAINER_REGISTRY }}/metabase-enterprise-head:latest
-        build-args: |
-          GIT_COMMIT_SHA=${{ github.sha }}
-        no-cache: false
-        push: true
-
-    - name: Retag and push images if dev branch - should be cached at this point
-      if: ${{ !(startsWith(github.ref_name,'master') || startsWith(github.ref_name,'backport')) && matrix.edition == 'ee' }}
-      uses: docker/build-push-action@v3
-      with:
-        context: bin/docker/.
-        platforms: linux/amd64,linux/arm64
-        network: host
-        tags: ${{ github.repository_owner }}/metabase-dev:${{ steps.extract_branch.outputs.branch }}
-        build-args: |
-          GIT_COMMIT_SHA=${{ github.sha }}
-        no-cache: false
-        push: true
-
-    - name: Run Trivy vulnerability scanner if master (ee)
-      if: ${{ (github.ref_name == 'master') && matrix.edition == 'ee' }}
-      uses: aquasecurity/trivy-action@0.29.0
-      env:
-        TRIVY_OFFLINE_SCAN: true
-      with:
-        image-ref: docker.io/${{ github.repository_owner }}/metabase-enterprise-head:latest
-        format: sarif
-        output: trivy-results.sarif
-        version: "v0.57.1"
-
-    - name: Run Trivy vulnerability scanner if master (oss)
-      if: ${{ (github.ref_name == 'master') && matrix.edition == 'oss' }}
-      uses: aquasecurity/trivy-action@0.29.0
-      env:
-        TRIVY_OFFLINE_SCAN: true
-      with:
-        image-ref: docker.io/${{ github.repository_owner }}/metabase-head:latest
-        format: sarif
-        output: trivy-results.sarif
-        version: "v0.57.1"
-
-    - name: Run Trivy vulnerability scanner if dev branch
-      if: ${{ !(startsWith(github.ref_name,'master') || startsWith(github.ref_name,'backport')) && matrix.edition == 'ee' }}
-      uses: aquasecurity/trivy-action@0.29.0
-      env:
-        TRIVY_OFFLINE_SCAN: true
-      with:
-        version: "v0.57.1"
-        image-ref: docker.io/${{ github.repository_owner }}/metabase-dev:${{ steps.extract_branch.outputs.branch }}
-        format: sarif
-        output: trivy-results.sarif
-
-    - name: Upload Trivy scan results to GitHub Security tab if master (ee)
-      if: ${{ (github.ref_name == 'master') && matrix.edition == 'ee' }}
-      uses: github/codeql-action/upload-sarif@v3
-      with:
-        sarif_file: 'trivy-results.sarif'
-
-    - name: Upload Trivy scan results to GitHub Security tab if master (oss)
-      if: ${{ (github.ref_name == 'master') && matrix.edition == 'oss' }}
-      uses: github/codeql-action/upload-sarif@v3
-      with:
-        sarif_file: 'trivy-results.sarif'
-
-    - name: Upload Trivy scan results to GitHub Security tab if dev branch
-      if: ${{ !(startsWith(github.ref_name,'master') || startsWith(github.ref_name,'backport')) && matrix.edition == 'ee' }}
-      uses: github/codeql-action/upload-sarif@v3
-      with:
-        sarif_file: 'trivy-results.sarif'
-
-  containerize_multi_arch:
-    runs-on: ubuntu-22.04
-    name: Containerize multi-arch ${{ matrix.edition }}
-    needs: check_jar_health
-    strategy:
-      matrix:
-        edition: [ee, oss]
-    services:
-      registry:
-        image: registry:2
-        ports:
-          - 5000:5000
-    steps:
-      - name: Extract and clean branch name
-        shell: bash
-        run: echo "branch=$(echo $GITHUB_REF_NAME | sed 's/[^-._a-zA-Z0-9]/-/g')" >> $GITHUB_OUTPUT
-        id: extract_branch
-      - name: Verify the intended tag of the container image
-        run: echo "Container image will be tagged as ${{ steps.extract_branch.outputs.branch }}-${{ matrix.edition }}"
-      - name: Check out the code (Dockerfile needed)
+      - name: Check out the code
         uses: actions/checkout@v4
         with:
           ref: ${{ github.event.inputs.commit }}
-      - name: Download uploaded artifacts to insert into container
-        uses: actions/download-artifact@v4
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
         with:
-          name: metabase-${{ matrix.edition }}-${{ github.sha }}-uberjar
-          path: bin/docker/
-      - name: Move the ${{ matrix.edition }} uberjar to the context dir
-        run: mv bin/docker/target/uberjar/metabase.jar bin/docker/.
-      # We need it for multi-arch build
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
+          m2-cache-key: uberjar
+          java-version: 21
+      - name: Build
+        run: ./bin/build.sh
+      - name: Prepare uberjar artifact
+        uses: ./.github/actions/prepare-uberjar-artifact
         with:
-          platforms: 'arm64'
-      - name: Set up Docker Buildx
-        id: buildx
-        uses: docker/setup-buildx-action@v2.5.0
+          name: metabase-${{ matrix.edition }}-${{ github.event.inputs.commit || github.sha  }}-uberjar
+
+  check-jar-health:
+    runs-on: ubuntu-22.04
+    name: Is ${{ matrix.edition }} (java ${{ matrix.java-version }}) healthy?
+    needs: [build, get-container-info]
+    timeout-minutes: 10
+    strategy:
+      matrix:
+        edition: ${{ fromJson(needs.get-container-info.outputs.editions) }}
+        java-version: [21]
+    steps:
+      - name: Prepare JRE (Java Run-time Environment)
+        uses: actions/setup-java@v4
         with:
-          driver-opts: network=host
-      # Build experimental ubuntu-based images only for master
-      - name: Build ${{ matrix.edition }} Ubuntu based multi-arch container
-        uses: docker/build-push-action@v3
+          java-package: jre
+          java-version: ${{ matrix.java-version }}
+          distribution: "temurin"
+      - run: java -version
+      - uses: actions/download-artifact@v4
+        name: Retrieve uberjar artifact
         with:
-          context: bin/docker/.
-          platforms: linux/amd64,linux/arm64
-          file: bin/docker/Dockerfile_ubuntu
-          network: host
-          tags: localhost:5000/metabase-dev:${{ steps.extract_branch.outputs.branch }}-${{ matrix.edition }}-ubuntu
-          build-args: |
-            GIT_COMMIT_SHA=${{ github.sha }}
-          no-cache: true
-          push: true
-      - name: Launch ${{ matrix.edition }} Ubuntu based container
-        run: docker run --rm -dp 3001:3000 localhost:5000/metabase-dev:${{ steps.extract_branch.outputs.branch }}-${{ matrix.edition }}-ubuntu
-        timeout-minutes: 5
-      - name: Is Docker with Ubuntu running?
-        run: docker ps
-      - name: Wait for Ubuntu-based Metabase container to start and reach 100% health
-        run: while ! curl 'http://localhost:3001/api/health' | grep '{"status":"ok"}'; do sleep 1; done
-        timeout-minutes: 3
-      - name: Login to Docker Hub
-        if: ${{ github.ref_name == 'master' }}
-        uses: docker/login-action@v2
+          name: metabase-${{ matrix.edition }}-${{ github.event.inputs.commit || github.sha  }}-uberjar
+      - name: Launch uberjar
+        run: >-
+          java --add-opens java.base/java.nio=ALL-UNNAMED -jar ./target/uberjar/metabase.jar &
+      - name: Wait for Metabase to start
+        run: while ! curl 'http://localhost:3000/api/health' | grep '{"status":"ok"}'; do sleep 1; done
+
+  containerize:
+    needs: [check-jar-health, get-container-info]
+    strategy:
+      matrix:
+        edition: ${{ fromJson(needs.get-container-info.outputs.editions) }}
+    uses: ./.github/workflows/containerize-jar.yml
+    secrets: inherit
+    with:
+      artifact-name: metabase-${{ matrix.edition }}-${{ github.event.inputs.commit || github.sha }}-uberjar
+      commit: ${{ github.event.inputs.commit || github.sha }}
+      repo: ${{ fromJson(needs.get-container-info.outputs[matrix.edition]).repo }}
+      tag: ${{ fromJson(needs.get-container-info.outputs[matrix.edition]).tag }}
+      release: "false"
+      build-args: |
+        GIT_COMMIT_SHA=${{ github.event.inputs.commit || github.sha }}
+
+  run-trivy:
+    needs: [get-container-info, containerize]
+    strategy:
+      matrix:
+        edition: ${{ fromJson(needs.get-container-info.outputs.editions) }}
+    runs-on: ubuntu-22.04
+    name: Run Trivy vulnerability scanner
+    steps:
+      - name: Check out the code
+        uses: actions/checkout@v4
         with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      # Push experimental ubuntu image only for versions based on a master
-      - name: Install regctl
-        if: ${{ github.ref_name == 'master' }}
-        uses: regclient/actions/regctl-installer@main
+          ref: ${{ github.event.inputs.commit || github.sha }}
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@0.29.0
+        env:
+          TRIVY_OFFLINE_SCAN: true
+          repo: ${{ fromJson(needs.get-container-info.outputs[matrix.edition]).repo }}
+          tag: ${{ fromJson(needs.get-container-info.outputs[matrix.edition]).tag }}
         with:
-          release: 'v0.4.7'
-      - name: Switch regctl to point to localhost:5000 via http
-        if: ${{ github.ref_name == 'master' }}
-        run: regctl registry set --tls disabled localhost:5000
-      - name: Retag and push ubuntu-based images if master (ee)
-        if: ${{ (matrix.edition == 'ee') && (github.ref_name == 'master') }}
-        run: regctl image copy localhost:5000/metabase-dev:${{ steps.extract_branch.outputs.branch }}-ee-ubuntu ${{ github.repository_owner }}/metabase-enterprise-head:latest-ubuntu
-      - name: Retag and push ubuntu-based images if master (oss)
-        if: ${{ (matrix.edition == 'oss') && (github.ref_name == 'master') }}
-        run: regctl image copy localhost:5000/metabase-dev:${{ steps.extract_branch.outputs.branch }}-oss-ubuntu ${{ github.repository_owner }}/metabase-head:latest-ubuntu
+          image-ref: docker.io/${{ env.repo }}:${{ env.tag }}
+          format: sarif
+          output: trivy-results.sarif
+          version: "v0.57.1"
+      - name: Upload Trivy scan results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: "trivy-results.sarif"

.github/workflows/upgrade-deps.yml

@@ -0,0 +1,35 @@
+name: Open PR to Bump Backend Deps
+
+on:
+  workflow_dispatch:
+
+  schedule:
+    # weekly on Mondays
+    - cron: '00 0 * * 1'
+
+  push:
+    branches:
+      - auto-upgrade-backend-deps-job
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  bump-deps:
+    name: Open PRs to Bump Backend Deps
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: ${{ (github.ref_name == 'master' && '1') || '0' }}
+          token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: 'update-be-deps'
+      - name: Open PRs to Upgrade Backend Deps
+        uses: ./.github/actions/upgrade-backend-deps
+        with:
+          github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}