Merge branch 'master' into build-fe-parallel

* refactor: memoize getSteps selector

* screen.getXXX.click() => userEvent.click(...) to avoid missing act() warning

* use mockSettings so that MetabaseSettings.setAll is called and we avoid the unknown features warning

.clj-kondo/config.edn

@@ -28,7 +28,6 @@
   :metabase/test-helpers-use-non-thread-safe-functions                 {:level :warning}
   :metabase/validate-deftest                                           {:level :warning}
   :metabase/validate-logging                                           {:level :warning}
-  :metabase/warn-about-schema=                                         {:level :warning}
 
   ;;
   ;; disabled linters
@@ -53,7 +52,7 @@
     (clojure.core.logic/fresh)
     (clojure.core.logic/matcha)
     (clojure.core.logic/run)
-    (clojure.test/is [query= =? malli=])
+    (clojure.test/is [query= =? malli= qv=])
     (clojure.tools.macro/macrolet)
     instaparse.core/transform
     (metabase.async.streaming-response/streaming-response)
@@ -107,6 +106,7 @@
    malli.core/explainer                               {:message "Use metabase.util.malli.registry/explainer instead of malli.core/explainer"}
    me.flowthing.pp/pprint                             {:message "Use metabase.util.log instead of me.flowthing.pp/pprint"}
    medley.core/random-uuid                            {:message "Use clojure.core/random-uuid instead of medley.core/random-uuid"}
+   metabase.driver/database-supports?                 {:message "Use metabase.driver.util/supports? instead of metabase.driver/database-supports?"}
    metabase.lib.equality/find-column-indexes-for-refs {:message "Use lib.equality/closest-matches-in-metadata or lib.equality/find-closest-matches-for-refs instead of lib.equality/find-column-indexes-for-refs"}
    metabase.test/with-temp*                           {:message "Use mt/with-temp instead of mt/with-temp*"}
    toucan2.tools.with-temp                            {:message "Use mt/with-temp instead of t2.with-temp/with-temp"}}
@@ -114,6 +114,7 @@
   :discouraged-namespace
   {camel-snake-kebab.core {:message "CSK is not Turkish-safe, use the versions in metabase.util instead."}
    clojure.tools.logging  {:message "Use metabase.util.log instead of clojure.tools.logging directly"}
+   grouper.core           {:message "Use metabase.util.grouper instead of grouper.core"}
    honeysql.core          {:message "Use Honey SQL 2. Honey SQL 1 is removed as a dependency in Metabase 49+."}
    honeysql.format        {:message "Use Honey SQL 2. Honey SQL 1 is removed as a dependency in Metabase 49+."}
    honeysql.helpers       {:message "Use Honey SQL 2. Honey SQL 1 is removed as a dependency in Metabase 49+."}
@@ -135,7 +136,7 @@
    ;;    namespace(s). This is mostly a temporary placeholder until we go in and create module namespaces, which means
    ;;    you should go create one.
    ;;
-   ;; 2. A set of namespace symbols. All namespaces in other modules will only be allowed ;; to use namespaces from
+   ;; 2. A set of namespace symbols. All namespaces in other modules will only be allowed to use namespaces from
    ;;    this set. Ideally this set should only have one namespace, but restricting it to a set of several is still
    ;;    better than `:any`.
    ;;
@@ -149,7 +150,8 @@
    {metabase.actions               #{metabase.actions.core}
     metabase.analytics             #{metabase.analytics.prometheus
                                      metabase.analytics.snowplow
-                                     metabase.analytics.stats}                                      ; TODO -- consolidate these into a real API namespace.
+                                     metabase.analytics.stats
+                                     metabase.analytics.sdk}                                      ; TODO -- consolidate these into a real API namespace.
     metabase.analyze               #{metabase.analyze}
     metabase.api                   #{metabase.api.common
                                      metabase.api.dataset
@@ -158,8 +160,10 @@
     metabase.async                 #{metabase.async.streaming-response
                                      metabase.async.streaming-response.thread-pool
                                      metabase.async.util}                                           ; TODO -- consolidate these into a real API namespace.
+    metabase.audit                 #{metabase.audit}
     metabase.bootstrap             #{metabase.bootstrap}
     metabase.cmd                   #{}                                                              ; there are no namespaces here since you shouldn't be using this in any other module.
+    metabase.channel               #{metabase.channel.core}
     metabase.config                #{metabase.config}
     metabase.core                  #{metabase.core.initialization-status}                           ; TODO -- only namespace used outside of EE, this probably belongs in `metabase.server` anyway since that's the only place it's used.
     metabase.db                    #{metabase.db
@@ -186,7 +190,6 @@
     metabase.metabot               #{metabase.metabot}
     metabase.models                :any                                                             ; TODO -- scream, 62 namespaces used elsewhere, but to be fair a lot of these don't *need* to be required.
     metabase.moderation            #{metabase.moderation}
-    metabase.native-query-analyzer #{metabase.native-query-analyzer}
     metabase.permissions           #{metabase.permissions.util}                                     ; TODO -- this is currently the only namespace in this module. Give it a real API namespace?
     metabase.plugins               #{metabase.plugins
                                      metabase.plugins.classloader}                                  ; TODO -- not 100% sure the classloader belongs here
@@ -201,6 +204,8 @@
                                      metabase.pulse.render.js-svg
                                      metabase.pulse.render.style}                                   ; TODO -- consolidate these into a real API namespace.
     metabase.query-processor       :any                                                             ; TODO omg scream, 29 namespaces used outside of the module. WHAT THE HECC
+    metabase.query-analysis        #{metabase.query-analysis
+                                     metabase.query-analysis.failure-map}
     metabase.related               #{metabase.related}
     metabase.sample-data           #{metabase.sample-data}
     metabase.search                #{metabase.search}
@@ -259,9 +264,12 @@
     metabase.analyze               :any
     metabase.api                   :any
     metabase.async                 :any
+    metabase.audit                 :any
+    metabase.auth-provider         #{metabase.util}
     metabase.bootstrap             #{}
     metabase.cmd                   :any
     metabase.compatibility         :any
+    metabase.channel               :any
     metabase.config                #{metabase.plugins}
     metabase.core                  :any
     metabase.db                    :any
@@ -278,11 +286,18 @@
     metabase.metabot               :any
     metabase.models                :any
     metabase.moderation            :any
-    metabase.native-query-analyzer :any
     metabase.permissions           :any
     metabase.plugins               :any
     metabase.public-settings       :any
     metabase.pulse                 :any
+    metabase.query-analysis        #{metabase.config
+                                     metabase.driver
+                                     metabase.legacy-mbql
+                                     metabase.lib
+                                     metabase.models
+                                     metabase.public-settings
+                                     metabase.query-processor
+                                     metabase.util}
     metabase.query-processor       :any
     metabase.related               :any
     metabase.sample-data           :any
@@ -355,6 +370,7 @@
     metabase-enterprise.audit-app.pages.common                    common
     metabase-enterprise.sandbox.api.table                         table
     metabase-enterprise.test                                      met
+    metabase.analytics.sdk                                        sdk
     metabase.analytics.stats                                      stats
     metabase.analyze.query-results                                qr
     metabase.analyze.classifiers.category                         classifiers.category
@@ -409,6 +425,7 @@
     metabase.api.user                                             api.user
     metabase.api.util                                             api.util
     metabase.async.streaming-response.thread-pool                 thread-pool
+    metabase.channel.core                                         channel
     metabase.cmd.copy.h2                                          copy.h2
     metabase.config                                               config
     metabase.config.file                                          config.file
@@ -483,8 +500,8 @@
     metabase.models.setting.cache                                 setting.cache
     metabase.models.timeline                                      timeline
     metabase.models.timeline-event                                timeline-event
-    metabase.native-query-analyzer                                query-analyzer
-    metabase.native-query-analyzer.parameter-substitution         nqa.sub
+    metabase.analysis.native-query-analyzer                       nqa
+    metabase.analysis.native-query-analyzer.parameter-substitution nqa.sub
     metabase.plugins.initialize                                   plugins.init
     metabase.public-settings                                      public-settings
     metabase.public-settings.premium-features                     premium-features
@@ -566,6 +583,7 @@
     metabase.util.encryption                                      encryption
     metabase.util.encryption-test                                 encryption-test
     metabase.util.files                                           u.files
+    metabase.util.grouper                                         grouper
     metabase.util.honey-sql-2                                     h2x
     metabase.util.i18n                                            i18n
     metabase.util.i18n.impl                                       i18n.impl
@@ -592,7 +610,9 @@
     toucan.models                                                 models}}}
 
  :lint-as
- {clojure.core.logic/defne                                                             clj-kondo.lint-as/def-catch-all
+ {cljs.cache/defcache                                                                  clojure.core/deftype
+  clojure.core.cache/defcache                                                          clojure.core/deftype
+  clojure.core.logic/defne                                                             clj-kondo.lint-as/def-catch-all
   clojure.test.check.clojure-test/defspec                                              clojure.test/deftest
   clojurewerkz.quartzite.jobs/defjob                                                   clojure.core/defn
   honeysql.helpers/defhelper                                                           clj-kondo.lint-as/def-catch-all
@@ -644,12 +664,15 @@
   metabase.test/with-temp-empty-app-db                                                 clojure.core/let
   metabase.test/with-temp-file                                                         clojure.core/let
   metabase.test/with-user-in-groups                                                    clojure.core/let
+  metabase.test/with-grouper-batches!                                                  clojure.core/fn
   metabase.upload-test/with-upload-table!                                              clojure.core/let
   metabase.util.files/with-open-path-to-resource                                       clojure.core/let
   metabase.util.malli.defn/defn                                                        schema.core/defn
+  metabase.util.malli.defn/defn-                                                       schema.core/defn
   metabase.util.malli.fn/fn                                                            schema.core/fn
   metabase.util.malli/defmethod                                                        schema.core/defmethod
   metabase.util.malli/defn                                                             schema.core/defn
+  metabase.util.malli/defn-                                                            schema.core/defn
   metabase.util.malli/fn                                                               schema.core/fn
   metabase.util.ssh/with-ssh-tunnel                                                    clojure.core/let
   metabase.xrays.domain-entities.malli/defn                                            schema.core/defn
@@ -755,6 +778,7 @@
    metabase.test/with-log-messages-for-level                                                                                 hooks.common/with-ignored-first-arg
    metabase.test/with-non-admin-groups-no-root-collection-perms                                                              hooks.common/do*
    metabase.test/with-temp                                                                                                   hooks.toucan2.tools.with-temp/with-temp
+   metabase.stale-test/with-stale-items                                                                                      hooks.toucan2.tools.with-temp/with-temp
    metabase.test/with-temp-file                                                                                              hooks.metabase.test.util/with-temp-file
    metabase.test/with-temporary-setting-values                                                                               hooks.metabase.test.util/with-temporary-setting-values
    metabase.util/format-color                                                                                                hooks.metabase.util/format-color
@@ -778,9 +802,12 @@
    clojurewerkz.quartzite.schedule.simple/schedule                              macros.quartz/simple-schedule
    clojurewerkz.quartzite.triggers/build                                        macros.quartz/build-trigger
    metabase-enterprise.sandbox.test-util/with-gtaps!                            macros.metabase-enterprise.sandbox.test-util/with-gtaps!
+   metabase-enterprise.sandbox.test-util/with-gtaps-for-user!                   macros.metabase-enterprise.sandbox.test-util/with-gtaps!
    metabase-enterprise.serialization.test-util/with-world                       macros.metabase-enterprise.serialization.test-util/with-world
    metabase-enterprise.test/with-gtaps!                                         macros.metabase-enterprise.sandbox.test-util/with-gtaps!
+   metabase-enterprise.test/with-gtaps-for-user!                                macros.metabase-enterprise.sandbox.test-util/with-gtaps!
    metabase-enterprise.advanced-permissions.api.util-test/with-impersonations!  macros.metabase-enterprise.advanced-permissions.api.util-test/with-impersonations!
+   metabase-enterprise.query-reference-validation.api-test/with-test-setup      macros.metabase-enterprise.query-reference-validation.api-test/with-test-setup
    metabase.api.card-test/with-ordered-items                                    macros.metabase.api.card-test/with-ordered-items
    metabase.api.collection-test/with-collection-hierarchy                       macros.metabase.api.collection-test/with-collection-hierarchy
    metabase.api.collection-test/with-some-children-of-collection                macros.metabase.api.collection-test/with-some-children-of-collection
@@ -793,11 +820,12 @@
    metabase.lib.common/defop                                                    macros.metabase.lib.common/defop
    metabase.models.params.chain-filter-test/chain-filter                        macros.metabase.models.params.chain-filter-test/chain-filter
    metabase.models.params.chain-filter-test/chain-filter-search                 macros.metabase.models.params.chain-filter-test/chain-filter
-   metabase.models.query-field-test/with-test-setup                             macros.metabase.models.query-field-test/with-test-setup
+   metabase.models.query-analysis-test/with-test-setup                          macros.metabase.models.query-analysis-test/with-test-setup
    metabase.models.user-test/with-groups                                        macros.metabase.models.user-test/with-groups
    metabase.query-processor.streaming/streaming-response                        macros.metabase.query-processor.streaming/streaming-response
    metabase.related-test/with-world                                             macros.metabase.related-test/with-world
    metabase.shared.util.namespaces/import-fn                                    macros.metabase.shared.util.namespaces/import-fn
+   metabase.task.setup.query-analysis-setup/with-test-setup!                    macros.metabase.task.setup.query-analysis-setup/with-test-setup!
    metabase.test.data.users/with-group-for-user                                 macros.metabase.test.data.users/with-group-for-user
    metabase.test.util/with-temp-env-var-value!                                  macros.metabase.test.util/with-temp-env-var-value!
    metabase.test.util/with-temporary-raw-setting-values                         macros.metabase.test.util/with-temporary-raw-setting-values
@@ -835,7 +863,19 @@
   ;; `metabase.driver.*`, excluding `-test` namespaces.
   ;;
   {:pattern "metabase(?:(?:(?:-enterprise\\.sandbox)?\\.query-processor\\.)|(?:\\.driver\\.)).*(?<!-test)$"
-   :name    qp-and-driver-source-namespaces}]
+   :name    qp-and-driver-source-namespaces}
+  ;;
+  ;; driver namespaces
+  ;;
+  {:pattern "metabase\\.driver.*$"
+   :name    driver-namespaces}
+  ;;
+  ;; general QP tests are ones that run across multiple drivers. Anything `metabase.query-processor*-test`,
+  ;; `metabase.driver.sql*-test` (excluding SQLServer and SQLite), or
+  ;; `metabase-enterprise.sandbox.query-processor*-test`
+  ;;
+  {:pattern "^metabase(?:((?:-enterprise\\.sandbox)?\\.query-processor)|(?:\\.driver\\.sql(?!server)(?!ite))).*-test$"
+   :name    general-qp-and-driver-test-namespaces}]
 
  :config-in-ns
  {test-namespaces
@@ -843,7 +883,9 @@
    {:inline-def                              {:level :off}
     :missing-docstring                       {:level :off}
     :private-call                            {:level :off}
-    :metabase/defsetting-must-specify-export {:level :off}}
+    :metabase/defsetting-must-specify-export {:level :off}
+    :discouraged-var                         {metabase.driver/database-supports? {:level :off}}}
+
    :hooks
    {:analyze-call
     {clojure.core/defmacro hooks.clojure.core/non-thread-safe-form-should-end-with-exclamation
@@ -893,6 +935,11 @@
      toucan.util.test           {:message "Don't use application database inside MLv2 code"}
      toucan2.core               {:message "Don't use application database inside MLv2 code"}}}}
 
+  driver-namespaces
+  {:linters
+   {:discouraged-var
+    {metabase.driver/database-supports? {:level :off}}}}
+
   qp-and-driver-source-namespaces
   {:linters
    {:discouraged-namespace
@@ -906,4 +953,8 @@
     {medley.core/map-keys              {:message "Use clojure.core/update-keys"}
      medley.core/map-vals              {:message "Use clojure.core/update-vals"}
      metabase.db.query/query           {:message "Don't use application database directly in QP code; use QP Store/metadata provider"}
-     metabase.db.query/reducible-query {:message "Don't use application database directly in QP code; use QP Store/metadata provider"}}}}}}
+     metabase.db.query/reducible-query {:message "Don't use application database directly in QP code; use QP Store/metadata provider"}}}}
+
+  general-qp-and-driver-test-namespaces
+  {:linters
+   {:metabase/disallow-hardcoded-driver-names-in-tests {:level :warning}}}}}

.clj-kondo/macros/metabase/models/query_analysis_test.clj

@@ -1,4 +1,4 @@
-(ns macros.metabase.models.query-field-test
+(ns macros.metabase.models.query-analysis-test
   (:require [macros.common]))
 
 (defmacro with-test-setup [& body]

.clj-kondo/macros/metabase/task/setup/query_analysis_setup.clj

@@ -0,0 +1,12 @@
+(ns macros.metabase.task.setup.query-analysis-setup
+  (:require [macros.common]))
+
+(defmacro with-test-setup!
+  "Set up the data required to test the Query Analysis related tasks"
+  [& body]
+  `(let [~(macros.common/ignore-unused 'c1) 1
+         ~(macros.common/ignore-unused 'c2) 2
+         ~(macros.common/ignore-unused 'c3) 3
+         ~(macros.common/ignore-unused 'c4) 4
+         ~(macros.common/ignore-unused 'arch) 5]
+     ~@body))

.clj-kondo/macros/metabase_enterprise/query_reference_validation/api_test.clj

@@ -0,0 +1,12 @@
+(ns macros.metabase-enterprise.query-reference-validation.api-test
+  (:require [macros.common]))
+
+(defmacro with-test-setup [& body]
+  `(let [~(macros.common/ignore-unused 'card-1) 1
+         ~(macros.common/ignore-unused 'card-2) 2
+         ~(macros.common/ignore-unused 'card-3) 3
+         ~(macros.common/ignore-unused 'card-4) 4
+         ~(macros.common/ignore-unused 'card-5) 5
+         ~(macros.common/ignore-unused 'coll-2) 100
+         ~(macros.common/ignore-unused 'coll-3) 200]
+     ~@body))

.clj-kondo/src/hooks/clojure/core.clj

@@ -2,19 +2,8 @@
   (:require
    [clj-kondo.hooks-api :as hooks]
    [clojure.set :as set]
-   [clojure.string :as str]))
-
-(defn- node->qualified-symbol [node]
-  (try
-   (when (hooks/token-node? node)
-     (let [sexpr (hooks/sexpr node)]
-       (when (symbol? sexpr)
-         (let [resolved (hooks/resolve {:name sexpr})]
-           (when-not (= :clj-kondo/unknown-namespace (:ns resolved))
-             (symbol (name (:ns resolved)) (name (:name resolved))))))))
-   ;; some symbols like `*count/Integer` aren't resolvable.
-   (catch Exception _
-     nil)))
+   [clojure.string :as str]
+   [hooks.common]))
 
 (def ^:private symbols-allowed-in-fns-not-ending-in-an-exclamation-point
   '#{;; these toucan methods might actually set global values if it's used outside of a transaction,
@@ -159,7 +148,7 @@
               (doseq [child (:children form)]
                 (walk f child)))]
       (walk (fn [form]
-              (when-let [qualified-symbol (node->qualified-symbol form)]
+              (when-let [qualified-symbol (hooks.common/node->qualified-symbol form)]
                 (when (and (not (contains? symbols-allowed-in-fns-not-ending-in-an-exclamation-point qualified-symbol))
                            (end-with-exclamation? qualified-symbol))
                   (hooks/reg-finding! (assoc (meta form-name)

.clj-kondo/src/hooks/clojure/test.clj

@@ -179,6 +179,64 @@
                                                    "Split it up into smaller tests! 🥰")
                                      :type :metabase/i-like-making-cams-eyes-bleed-with-horrifically-long-tests)))))))
 
+;;; don't include `:h2` since that will probably lead to a mountain of tests where we are specifically testing
+;;; middleware or compilation behavior with just H2 since it's the default.
+(def driver-keywords
+  #{;; core drivers
+    #_:h2
+    :postgres
+    :mysql
+    ;; module drivers
+    :athena
+    :bigquery-cloud-sdk
+    :druid
+    :druid-jdbc
+    :googleanalytics
+    :mongo
+    :oracle
+    :presto-jdbc
+    :redshift
+    :snowflake
+    :sparksql
+    :sqlite
+    :sqlserver
+    :vertica})
+
+(defn- ignore? [node error-type]
+  (when-let [ignores (some-> node meta :clj-kondo/ignore hooks/sexpr)]
+    (when-let [ignores (cond
+                         (coll? ignores)    (set ignores)
+                         (keyword? ignores) #{ignores})]
+      (contains? ignores error-type))))
+
+(defn deftest-check-no-driver-keywords [node]
+  ;; fail fast after we see the first error, where we see one hardcoded driver name there are likely several more and we
+  ;; don't need multiple warnings for a single test.
+  (letfn [(f [node]
+            (when (and (hooks/keyword-node? node)
+                       (driver-keywords (hooks/sexpr node)))
+              (hooks/reg-finding! (assoc (meta node)
+                                         :message (format "Do not hardcode driver name %s in driver tests! [:metabase/disallow-hardcoded-driver-names-in-tests]"
+                                                          (hooks/sexpr node))
+                                         :type    :metabase/disallow-hardcoded-driver-names-in-tests))
+              ::error))
+          (walk [node]
+            (cond
+              (ignore? node :metabase/disallow-hardcoded-driver-names-in-tests)
+              nil
+
+              (= (f node) ::error)
+              ::error
+
+              :else
+              (reduce
+               (fn [_acc child]
+                 (when (= (walk child) ::error)
+                   (reduced ::error)))
+               nil
+               (:children node))))]
+    (walk node)))
+
 (defn deftest [{:keys [node cljc lang]}]
   ;; run [[deftest-check-parallel]] only once... if this is a `.cljc` file only run it for the `:clj` analysis, no point
   ;; in running it twice.
@@ -186,6 +244,7 @@
             (= lang :clj))
     (deftest-check-parallel node))
   (deftest-check-not-horrifically-long node)
+  (deftest-check-no-driver-keywords node)
   {:node node})
 
 ;;; this is a hacky way to determine whether these namespaces are required in the `ns` form or not... basically `:ns`
@@ -222,18 +281,9 @@
 
               nil)))))))
 
-(defn- warn-about-schema= [{[_is assertion-node] :children, :as _is-node}]
-  (let [{[assertion-symb-node] :children} assertion-node]
-    (when (and (hooks/token-node? assertion-symb-node)
-               (= (hooks/sexpr assertion-symb-node) 'schema=))
-      (hooks/reg-finding! (assoc (meta assertion-symb-node)
-                                 :message "Use =? or malli= instead of schema="
-                                 :type :metabase/warn-about-schema=)))))
-
 (defn is [{:keys [node lang]}]
   (when (= lang :cljs)
     (warn-about-missing-test-expr-requires-in-cljs node))
-  (warn-about-schema= node)
   {:node node})
 
 (defn use-fixtures [{:keys [node]}]

.clj-kondo/src/hooks/metabase/test/data.clj

@@ -11,6 +11,10 @@
   []
   (not-empty (set (keys (:clj (hooks/ns-analysis 'metabase.test.data.dataset-definitions))))))
 
+(defn- local-def?
+  [ns* sexpr]
+  (= ns* (:ns (hooks/resolve {:name sexpr}))))
+
 (defn- dataset-type
   "`dataset` can be one of:
 
@@ -21,7 +25,7 @@
 
   We can only determine if an unqualified symbol refers to something in the dataset definitions namespace if there are
   cached results available from [[global-dataset-symbols]]."
-  [dataset]
+  [this-ns dataset]
   (let [sexpr       (hooks/sexpr dataset)
         global-defs (global-dataset-symbols)]
     (cond
@@ -31,20 +35,19 @@
       (namespace sexpr)
       :qualified
 
-      (empty? global-defs)
-      :unqualified/unknown
-
       (contains? global-defs sexpr)
       :unqualified/from-dataset-defs-namespace
 
-      ;; either something defined in the current namespace or let-bound in the current scope.
+      (local-def? this-ns sexpr)
+      :unqualified/local-def
+
       :else
-      :unqualified/local-def)))
+      :unqualified/unknown)))
 
 (defn dataset
-  [{{[_ dataset & body] :children} :node}]
+  [{{[_ dataset & body] :children} :node this-ns :ns}]
   (let [noop (constantly nil)
-        body (case (dataset-type dataset)
+        body (case (dataset-type this-ns dataset)
                ;; non-symbol, qualified symbols, and unqualified symbols from the current namespace/let-bound can all
                ;; get converted from something like
                ;;

.clj-kondo/test/hooks/clojure/test_test.clj

@@ -0,0 +1,44 @@
+(ns hooks.clojure.test-test
+  (:require
+   [clj-kondo.hooks-api :as api]
+   [clj-kondo.impl.utils]
+   [clojure.java.io :as io]
+   [clojure.test :refer :all]
+   [hooks.clojure.test]))
+
+(set! *warn-on-reflection* true)
+
+(defn- deftest-warnings
+  [form]
+  (binding [clj-kondo.impl.utils/*ctx* {:config     {:linters {:metabase/disallow-hardcoded-driver-names-in-tests {:level :warning}}}
+                                        :ignores    (atom nil)
+                                        :findings   (atom [])
+                                        :namespaces (atom {})}]
+    (hooks.clojure.test/deftest {:node (api/parse-string form)})
+    (mapv :message @(:findings clj-kondo.impl.utils/*ctx*))))
+
+(deftest disallow-hardcoded-driver-names-in-tests-test
+  (is (= []
+         (deftest-warnings
+           "(mt/test-drivers (mt/normal-drivers)
+              (do-something))")))
+  (is (= ["Do not hardcode driver name :athena in driver tests! [:metabase/disallow-hardcoded-driver-names-in-tests]"]
+         (deftest-warnings
+           "(mt/test-drivers (mt/normal-drivers)
+              (when-not (= driver/*driver* :athena)
+                (do-something)))")))
+  (testing "make sure :clj-kondo/ignore is propagated correctly"
+    (is (= []
+           (deftest-warnings
+             "(mt/test-drivers (mt/normal-drivers)
+                #_{:clj-kondo/ignore [:metabase/disallow-hardcoded-driver-names-in-tests]}
+                (when-not (= driver/*driver* :athena)
+                  (do-something)))")))))
+
+(deftest check-driver-keywords-test
+  (testing "Make sure we keep hooks.clojure.test/driver-keywords up to date"
+    (doseq [^java.io.File file (.listFiles (io/file "modules/drivers"))
+            :when (.isDirectory file)
+            :let [driver (keyword (.getName file))]]
+      (is (contains? hooks.clojure.test/driver-keywords driver)
+          (format "hooks.clojure.test/driver-keywords should contain %s, please add it" driver)))))

.dir-locals.el

@@ -59,6 +59,7 @@
   (eval . (put-clojure-indent 'mt/query 1))
   (eval . (put-clojure-indent 'mt/test-driver 1))
   (eval . (put-clojure-indent 'mt/test-drivers 1))
+  (eval . (put-clojure-indent 'mt/with-anaphora 1))
   (eval . (put-clojure-indent 'prop/for-all 1))
   (eval . (put-clojure-indent 'qp.streaming/streaming-response 1))
   (eval . (put-clojure-indent 'tc/quick-check 1))

.eslintrc.js

@@ -78,9 +78,10 @@ module.exports = {
     "react/forbid-component-props": [2, { forbid: ["sx"] }],
     "react-hooks/exhaustive-deps": [
       "warn",
-      { additionalHooks: "(useSyncedQueryString|useSafeAsyncFunction)" },
+      { additionalHooks: "(useSafeAsyncFunction)" },
     ],
     "prefer-const": [1, { destructuring: "all" }],
+    "no-restricted-globals": ["error", "close"],
     "no-useless-escape": 0,
     "no-only-tests/no-only-tests": [
       "error",
@@ -133,6 +134,7 @@ module.exports = {
     "plugin:import/errors",
     "plugin:import/warnings",
     "plugin:import/typescript",
+    "plugin:depend/recommended",
   ],
   settings: {
     "import/internal-regex": "^metabase/|^metabase-lib/",
@@ -160,6 +162,17 @@ module.exports = {
       rules: {
         "no-unconditional-metabase-links-render": "error",
         "no-literal-metabase-strings": "error",
+        "depend/ban-dependencies": [
+          "error",
+          {
+            allowed: [
+              "underscore",
+              "moment",
+              "lodash.orderby",
+              "lodash.debounce",
+            ],
+          },
+        ],
       },
     },
     {
@@ -189,7 +202,13 @@ module.exports = {
         "@typescript-eslint/no-inferrable-types": "off",
         "@typescript-eslint/no-explicit-any": "off",
         "@typescript-eslint/no-this-alias": "off",
-        "@typescript-eslint/consistent-type-imports": "error",
+        "@typescript-eslint/consistent-type-imports": [
+          "error",
+          {
+            fixStyle: "inline-type-imports",
+          },
+        ],
+        "@typescript-eslint/no-import-type-side-effects": "error",
         "@typescript-eslint/no-unused-vars": [
           "error",
           {

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,9 +1,5 @@
 > [!IMPORTANT]
-> For those employed by Metabase: if you are merging into master, please add either a `backport` or a `no-backport` label
-> to this PR. You will not be able to merge until you do this step. Refer to the section [Do I need to backport this
-> PR?](https://www.notion.so/metabase/Metabase-Branching-Strategy-6eb577d5f61142aa960a626d6bbdfeb3?pvs=4#89f80d6f17714a0198aeb66c0efd1b71)
-> in the Metabase Branching Strategy document for more details. If you're not employed by Metabase, this section does not
-> apply to you, and the label will be taken care of by your reviewer.
+> For those employed by Metabase: if you are merging into master, please add either a `backport` or a `no-backport` label to this PR. You will not be able to merge until you do this step. Refer to the section [Do I need to backport this PR?](https://www.notion.so/metabase/Metabase-Branching-Strategy-6eb577d5f61142aa960a626d6bbdfeb3?pvs=4#89f80d6f17714a0198aeb66c0efd1b71) in the Metabase Branching Strategy document for more details. If you're not employed by Metabase, this section does not apply to you, and the label will be taken care of by your reviewer.
 
 > **Warning**
 >

.github/actions/build-e2e-matrix/action.yml

@@ -35,6 +35,7 @@ runs:
             ["dashboard-cards", {} ],
             ["dashboard-filters", {} ],
             ["embedding", {} ],
+            ["embedding-sdk", { context: "embedding-sdk" } ],
             ["filters", {} ],
             ["filters-reproductions", {}],
             ["joins", {} ],

.github/actions/cross-branch-migration-test/action.yml

@@ -0,0 +1,67 @@
+name: Cross-branch migration test
+
+inputs:
+  base-ref:
+    required: true
+
+runs:
+  using: "composite"
+  steps:
+    - name: Check out base branch
+      uses: actions/checkout@v4
+      with:
+        ref: ${{ inputs.base-ref }}
+
+    - name: Prepare backend environment
+      uses: ./.github/actions/prepare-backend
+      with:
+        m2-cache-key: cross-branch-migrations
+
+    - name: Run backend on base branch
+      run: |
+        clojure -M:run:ee > metabase.log 2>&1 & echo $! > metabase_pid
+        tail -F metabase.log &
+      shell: bash
+
+    - name: Wait for Metabase to start
+      run: |
+        while ! curl -s 'http://localhost:3000/api/health' | grep '{"status":"ok"}' > /dev/null; do
+          if ! kill -0 $(cat metabase_pid) 2>/dev/null; then
+            cat metabase.log
+            echo "Metabase process has exited."
+            exit 1
+          fi
+          sleep 1
+        done
+      shell: bash
+
+    - name: Stop Metabase on base branch
+      run: kill $(cat metabase_pid)
+      shell: bash
+
+    - name: Check out pull request branch
+      uses: actions/checkout@v4
+      with:
+        ref: ${{ github.head_ref }}
+
+    - name: Run backend on pull request branch
+      run: |
+        clojure -M:run:ee > metabase.log 2>&1 & echo $! > metabase_pid
+        tail -F metabase.log &
+      shell: bash
+
+    - name: Wait for Metabase to start
+      run: |
+        while ! curl -s 'http://localhost:3000/api/health' | grep '{"status":"ok"}' > /dev/null; do
+          if ! kill -0 $(cat metabase_pid) 2>/dev/null; then
+            cat metabase.log
+            echo "Metabase process has exited. Check that your migration changes work on an instance that has been previously initialized on your PR's target branch."
+            exit 1
+          fi
+          sleep 1
+        done
+      shell: bash
+
+    - name: Stop Metabase on pull request branch
+      run: kill $(cat metabase_pid)
+      shell: bash

.github/actions/prepare-cypress/action.yml

@@ -1,12 +1,20 @@
 name: Prepare cypress environment
 description: Cypress preparation steps
 
+outputs:
+  chrome-path:
+    description: Path to the custom Chrome executable
+    value: ${{ steps.setup-chrome.outputs.chrome-path }}
+
 runs:
   using: "composite"
   steps:
-    - name: Install Replay.io browser
-      run: npx @replayio/cypress install
-      shell: bash
+    - name: Install Chrome v111
+      uses: browser-actions/setup-chrome@v1
+      with:
+        # https://chromium.cypress.io/linux/stable/111.0.5563.146
+        chrome-version: 1097615
+      id: setup-chrome
 
     - name: Check to see if dependencies should be cached
       if: ${{ contains(github.event.head_commit.message, '[ci nocache]') }}

.github/actions/prepare-frontend/action.yml

@@ -1,11 +1,17 @@
 name: Prepare front-end environment
+inputs:
+  node-version:
+    description: "The version of Node.js to use, overriding .nvmrc"
+    required: false
 runs:
   using: "composite"
   steps:
     - name: Prepare Node.js
       uses: actions/setup-node@v4
       with:
+        node-version: ${{ inputs.node-version }} # this overrides, if present
         node-version-file: ".nvmrc"
+
     - name: Check to see if dependencies should be cached
       if: ${{ contains(github.event.head_commit.message, '[ci nocache]') }}
       run: |
@@ -18,11 +24,27 @@ runs:
       with:
         path: ~/.m2
         key: ${{ runner.os }}-cljs-${{ hashFiles('**/shadow-cljs.edn') }}
+
     - name: Get node_modules cache
       uses: actions/cache@v4
+      id: node-modules-cache
       if: ${{ !contains(github.event.head_commit.message, '[ci nocache]') }}
       with:
         path: node_modules
         key: ${{ runner.os }}-node-modules-${{ hashFiles('**/yarn.lock', '**/patches/*.patch') }}
+
+    - name: Get yarn cache directory path
+      id: yarn-cache-dir-path
+      if: steps.node-modules-cache.outputs.cache-hit != 'true'
+      run: echo "dir=$(yarn cache dir)" >> $GITHUB_OUTPUT
+      shell: bash
+
+    - uses: actions/cache@v4
+      if: steps.node-modules-cache.outputs.cache-hit != 'true'
+      with:
+        path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
+        key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
+        restore-keys: ${{ runner.os }}-yarn-
+
     - run: yarn install --frozen-lockfile --prefer-offline
       shell: bash

.github/actions/run-embedding-sdk-storybook/action.yml

@@ -0,0 +1,33 @@
+name: Run Embedding SDK Storybook
+runs:
+  using: "composite"
+  steps:
+    - name: Prepare frontend environment
+      uses: ./.github/actions/prepare-frontend
+
+    - name: Prepare back-end environment
+      uses: ./.github/actions/prepare-backend
+      with:
+        m2-cache-key: "cljs"
+
+    - name: Compile CLJS
+      run: yarn build-pure:cljs
+      shell: bash
+
+    - name: Build Storybook
+      run: yarn build-storybook-embedding-sdk
+      shell: bash
+
+    - name: Serve Storybook
+      run: yarn http-server storybook-static -p 6006 &
+      shell: bash
+
+    - name: Wait for Storybook to become available
+      run: |
+        echo "Waiting for Storybook to be served..."
+        while ! curl --silent --fail http://localhost:6006; do
+          sleep 5
+          echo "Retrying..."
+        done
+        echo "Storybook is being served!"
+      shell: bash

.github/actions/test-driver/action.yml

@@ -2,7 +2,7 @@ name: Test database driver
 inputs:
   junit-name:
     required: true
-    default: 'driver'
+    default: "driver"
   test-args:
     required: false
 
@@ -14,7 +14,7 @@ runs:
     - name: Prepare back-end environment
       uses: ./.github/actions/prepare-backend
       with:
-        m2-cache-key: driver-${{ inputs.junit-name }}
+        m2-cache-key: driver
     - name: Build static viz frontend
       run: yarn build-static-viz
       shell: bash
@@ -25,7 +25,7 @@ runs:
       uses: dorny/test-reporter@v1
       if: failure()
       with:
-        path: 'target/junit/**/*_test.xml'
+        path: "target/junit/**/*_test.xml"
         name: JUnit Test Report ${{ inputs.junit-name }}
         reporter: java-junit
         list-suites: failed

.github/auto_request_review.yml

@@ -0,0 +1,17 @@
+# The reviewers configuration for the auto_request_review workflow
+# See https://github.com/necojackarc/auto-request-review/tree/master?tab=readme-ov-file#reviewers-configuration
+# for the spec
+
+files:
+  # migrations related files
+  'resources/migrations/**':
+    - team:core-backend-components
+  'src/metabase/db/custom_migrations.clj':
+    - team:core-backend-components
+
+options:
+  ignore_draft: true
+  ignored_keywords:
+    - DO NOT REVIEW
+    - WIP
+  enable_group_assignment: false

.github/file-paths.yaml

@@ -35,14 +35,22 @@ frontend_specs: &frontend_specs
   - "frontend/test/**"
   - "frontend/**/tests/**"
   - "frontend/**/*.unit.*"
-  - "jest.config.json"
+  - "jest.config.js"
   - "jest.tz.unit.conf.json"
 
+release_source: &release_sources
+  - "release/**"
+
 frontend_all: &frontend_all
   - *frontend_ci
   - *frontend_sources
   - *frontend_specs
 
+frontend_loki_ci: &frontend_loki_ci
+  - ".github/workflows/loki.yml"
+  - ".loki/**"
+  - ".storybook/**"
+
 backend_ci: &backend_ci
   - ".github/actions/prepare-frontend/**"
   - ".github/actions/prepare-backend/**"
@@ -53,6 +61,7 @@ backend_ci: &backend_ci
 backend_presto_kerberos:
   - "**/presto_jdbc/**"
   - "**/presto_jdbc.clj"
+  - ".github/workflows/presto-kerberos-integration-test.yml"
 
 backend_sources: &backend_sources
   - *shared_sources
@@ -100,6 +109,10 @@ e2e_specs: &e2e_specs
   - "e2e/support/**"
   - "e2e/snapshot*/**"
 
+e2e_cross_version: &e2e_cross_version
+  - ".github/workflows/e2e-cross-version.yml"
+  - "e2e/test/scenarios/cross-version/**"
+
 e2e_all:
   - *default
   - *e2e_ci

.github/scripts/conventional-commit-pr-title-reminder/utils.js

@@ -0,0 +1,68 @@
+exports.updateComment = updateComment;
+
+/** @param {import('@types/github-script').AsyncFunctionArguments} AsyncFunctionArguments */
+async function updateComment({ github, context }) {
+  const githubUsername = context.payload.sender.login;
+  const comment = `${CONVENTIONAL_COMMIT_REMINDER_COMMENT_IDENTIFIER}
+@${githubUsername} You have modified embedding SDK code. Please make sure the PR title follows [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/) style.
+Here are all the supported types that will be shown in the changelog:
+- \`feat\`
+- \`fix\`
+- \`perf\`
+
+These types \`docs\`, \`style\`, \`refactor\`, \`test\`, \`build\`, and \`ci\` are also encouraged for non-changelog related tasks.
+
+Please also make sure to include \`sdk\` scope, otherwise, the changelog will not include this task.
+
+For example, these are valid PR titles:
+- \`feat(sdk): Add interactive dashboard component\`
+- \`feat(sdk): Support theming pie chart\`
+- \`fix(sdk): Fix static dashboard crash\``;
+
+  const owner = context.repo.owner;
+  const repo = context.repo.repo;
+  const pullRequestNumber = context.issue.number;
+  const comments = await github.rest.issues.listComments({
+    owner,
+    repo,
+    issue_number: pullRequestNumber,
+  });
+
+  const existingComment = getExistingConventionalCommitReminderComment(
+    comments.data,
+  );
+
+  if (existingComment) {
+    return await github.rest.issues.updateComment({
+      owner,
+      repo,
+      comment_id: existingComment.id,
+      body: comment,
+    });
+  } else {
+    return await github.rest.issues.createComment({
+      owner,
+      repo,
+      issue_number: pullRequestNumber,
+      body: comment,
+    });
+  }
+}
+
+const CONVENTIONAL_COMMIT_REMINDER_COMMENT_IDENTIFIER =
+  "<!---conventional commit reminder comment ID-->";
+/**
+ * @typedef Comment
+ * @property {string} body
+ *
+ * @param {Comment[]} comments
+ */
+function getExistingConventionalCommitReminderComment(comments) {
+  for (const comment of comments) {
+    if (
+      comment.body.startsWith(CONVENTIONAL_COMMIT_REMINDER_COMMENT_IDENTIFIER)
+    ) {
+      return comment;
+    }
+  }
+}

.github/team.json

@@ -3,9 +3,9 @@
     {
       "name": "Querying Components",
       "label": ".Team/QueryingComponents",
+      "projectUrl": "https://github.com/orgs/metabase/projects/97/views/1",
       "members": [
         "ranquild",
-        "uladzimirdev",
         "kamilmielnik",
         "nemanjaglumac",
         "romeovs"
@@ -33,7 +33,7 @@
       "name": "Query Processor",
       "label": ".Team/QueryProcessor",
       "projectUrl": "https://github.com/orgs/metabase/projects/83/views/8",
-      "members": ["camsaul", "snoe", "bshepherdson", "metamben", "lbrdnk"]
+      "members": ["camsaul", "snoe", "bshepherdson", "metamben", "lbrdnk", "appleby"]
     },
     {
       "name": "Admin Webapp",
@@ -41,11 +41,11 @@
       "members": [
         "noahmoss",
         "escherize",
-        "iethree",
         "npfitz",
         "johnswanson",
         "rafpaf",
-        "sloansparger"
+        "sloansparger",
+        "iethree"
       ]
     },
     {
@@ -58,6 +58,13 @@
         "kulyk",
         "adam-james-v"
       ]
+    },
+    {
+      "name": "DevEx",
+      "label": ".Team/DevEx",
+      "members": [
+        "uladzimirdev"
+      ]
     }
   ]
 }

.github/workflows/auto-backport.yml

@@ -92,7 +92,7 @@ jobs:
         if: ${{ steps.create_backport_pull_request.outputs.has-conflicts == 'false' }}
         uses: peter-evans/enable-pull-request-automerge@v2
         with:
-          token: ${{ steps.generate-token.outputs.token }}
+          token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
           pull-request-number: ${{ steps.create_backport_pull_request.outputs.backport_pr_number }}
           merge-method: squash
 

.github/workflows/auto-request-review.yml

@@ -0,0 +1,21 @@
+# Config is in .github/auto_request_review.yml
+name: Auto Request Review
+
+on:
+  pull_request:
+    types: [opened, ready_for_review, reopened, synchronize]
+
+jobs:
+  auto-request-review:
+    # Don't run on forked repos
+    if: ${{ !github.event.pull_request.head.repo.fork }}
+    permissions:
+      contents: read
+      pull-requests: write
+    name: Auto Request Review
+    runs-on: ubuntu-latest
+    steps:
+      - name: Request review based on files changes and/or groups the author belongs to
+        uses: necojackarc/auto-request-review@v0.13.0
+        with:
+          token: '${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}'

.github/workflows/backend-cloverage.yml

@@ -0,0 +1,27 @@
+name: Backend-Cloverage
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 10 * * 1-5' # every weekday at 5am US eastern time
+
+jobs:
+  be-linter-cloverage:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 90
+    steps:
+      - uses: actions/checkout@v4
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: "cloverage"
+      - name: Build static viz frontend
+        run: yarn build-static-viz
+      - name: Collect the test coverage
+        run: clojure -X:dev:ci:ee:ee-dev:test:cloverage
+      - name: Upload coverage to codecov.io
+        uses: codecov/codecov-action@v4
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          files: ./target/coverage/codecov.json
+          flags: back-end

.github/workflows/backend.yml

@@ -63,29 +63,6 @@ jobs:
           token: ${{ github.token }}
           filters: .github/static-viz-sources.yaml
 
-  be-linter-cloverage:
-    needs: files-changed
-    if: (github.ref_name == 'master' && needs.files-changed.outputs.backend_all == 'true')
-        || contains(github.event.pull_request.labels.*.name, 'run-cloverage')
-    runs-on: ubuntu-22.04
-    timeout-minutes: 90
-    steps:
-      - uses: actions/checkout@v4
-      - name: Prepare back-end environment
-        uses: ./.github/actions/prepare-backend
-        with:
-          m2-cache-key: "cloverage"
-      - name: Build static viz frontend
-        run: yarn build-static-viz
-      - name: Collect the test coverage
-        run: clojure -X:dev:ci:ee:ee-dev:test:cloverage
-      - name: Upload coverage to codecov.io
-        uses: codecov/codecov-action@v4
-        with:
-          token: ${{ secrets.CODECOV_TOKEN }}
-          files: ./target/coverage/codecov.json
-          flags: back-end
-
   be-linter-clj-kondo:
     needs: [files-changed, static-viz-files-changed]
     if: |

.github/workflows/backport.yml

@@ -107,8 +107,23 @@ jobs:
             echo "PR has been merged, searching for a squashed commit in the base branch"
             echo "searching for a commit in a ${ORIGINAL_BASE_REF} that contains pull request number ${ORIGINAL_PULL_REQUEST_NUMBER}"
             SQUASHED_COMMIT=$(env -i git log ${ORIGINAL_BASE_REF} --grep="(#${ORIGINAL_PULL_REQUEST_NUMBER})" --format="%H")
-            echo "found commit ${SQUASHED_COMMIT}"
-            git cherry-pick ${SQUASHED_COMMIT}
+
+            if [ -n "${SQUASHED_COMMIT}" ]; then
+              echo "found commit ${SQUASHED_COMMIT}"
+              git cherry-pick ${SQUASHED_COMMIT}
+            else
+              echo "probably a PR wasn't merged with Squash And Merge button, searching again"
+              SQUASHED_COMMIT=$(env -i git log ${ORIGINAL_BASE_REF} --grep="#${ORIGINAL_PULL_REQUEST_NUMBER}" --format="%H")
+
+              if [ -n "${SQUASHED_COMMIT}" ]; then
+                echo "found commit ${SQUASHED_COMMIT}"
+                git cherry-pick ${SQUASHED_COMMIT}
+              else
+                echo "No squashed commit found for PR #${ORIGINAL_PULL_REQUEST_NUMBER}"
+                exit 1
+              fi
+            fi
+
           else
             echo "PR has not been merged, copying all commits"
             git cherry-pick ${ORIGINAL_BASE_SHA}..${ORIGINAL_HEAD_SHA}

.github/workflows/build-for-release.yml

@@ -17,30 +17,52 @@ jobs:
     runs-on: ubuntu-22.04
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
         with:
           sparse-checkout: release
       - name: Prepare build scripts
         run: cd ${{ github.workspace }}/release && yarn && yarn build
       - name: Send build start message
-        uses: actions/github-script@v6
+        uses: actions/github-script@v7
         env:
           SLACK_RELEASE_CHANNEL: ${{ vars.SLACK_RELEASE_CHANNEL }}
           SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
         with:
           script: | # js
-            const { sendReleaseMessage } = require('${{ github.workspace }}/release/dist/index.cjs');
+            const { sendPreReleaseMessage } = require('${{ github.workspace }}/release/dist/index.cjs');
 
-            await sendReleaseMessage({
-              stage: 'build-start',
+            await sendPreReleaseMessage({
               github,
               owner: context.repo.owner,
               repo: context.repo.repo,
               version: '${{ inputs.version }}',
               runId: '${{ github.run_id }}',
               releaseSha: '${{ inputs.commit }}',
+              userName: '${{ github.actor }}',
+              channelName: '${{ vars.SLACK_RELEASE_CHANNEL }}',
             }).catch(console.error);
 
+  trigger-milestone-check:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    needs: start-message
+    steps:
+      - name: trigger pre-release milestone check
+        uses: actions/github-script@v7
+        with:
+          script: | # js
+            await github.rest.actions.createWorkflowDispatch({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              workflow_id: 'release-milestone-check.yml',
+              ref: '${{ github.ref }}',
+              inputs: {
+                commit: '${{ inputs.commit }}',
+                version: '${{ inputs.version }}',
+              }
+            });
+
+
   check-version:
     runs-on: ubuntu-22.04
     timeout-minutes: 10

.github/workflows/check-milestone.yml

@@ -1,80 +1,41 @@
-name: Milestone Reminder
+name: Automatically set milestone
+run-name: Set milestone for ${{ github.event.head_commit.message }}
 
 on:
-  pull_request:
-    types: [closed]
+  push:
     branches:
-      - "master"
+      - release-x.**
 
 jobs:
-  milestone-reminder:
-    if: github.event.pull_request.merged == true
-    name: Remind to set milestone
+  set-milestone:
+    name: Automatically set milestone
     runs-on: ubuntu-22.04
     timeout-minutes: 5
     permissions:
       pull-requests: write
-      issues: read
+      issues: write
+      contents: read
     steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: release
+          ref: master # we want the logic from master, even though we're triggering on a release branch
+      - name: Prepare build scripts
+        run: cd ${{ github.workspace }}/release && yarn && yarn build
       - uses: actions/github-script@v7
         with:
           script: | # js
+            const { setMilestoneForCommits } = require('${{ github.workspace }}/release/dist/index.cjs');
             const owner = context.repo.owner;
             const repo = context.repo.repo;
 
-            const pullNumber = '${{ github.event.pull_request.number }}';
+            const branchName = `${{ github.ref }}`;
+            const commitMessage = context?.payload?.head_commit?.message ?? '';
 
-            // the github API doesn't expose linked issues, so we have to parse the body ourselves
-            function getLinkedIssueId(pull) {
-              // https://regexr.com/7sk94
-              const match = pull.data.body.match(/(close(s|d)?|fixe?(s|d)?|resolve(s|d)?) (#|https?:\/\/github.com\/.+\/issues\/)(\d+)/i);
-              return match && match?.[2];
-            }
-
-            function getMilestone(pullOrIssue) {
-              // pull has pull.data.milestone, issue has issue.milestone
-              return pullOrIssue?.data?.milestone || pullOrIssue?.milestone;
-            }
-
-            const pull = await github.rest.pulls.get({
+            await setMilestoneForCommits({
+              github,
               owner,
               repo,
-              pull_number: pullNumber,
-            });
-
-            if (getMilestone(pull)) {
-              console.log("Pull request has milestone", pull.data.milestone?.title);
-              process.exit(0);
-            }
-
-            const issueId = getLinkedIssueId(pull);
-
-            if (issueId) {
-              console.log('linked issue found', issueId);
-
-              const issue = await github.rest.issues.get({
-                owner,
-                repo,
-                issue_number: issueId,
-              });
-
-              const milestone = getMilestone(issue);
-
-              if (milestone) {
-                console.log("Linked issue has milestone", milestone.title);
-                process.exit(0);
-              }
-            }
-
-            console.log("No milestone found");
-
-            const author = pull.data.user.login;
-            const guideLink = "https://www.notion.so/metabase/Metabase-Branching-Strategy-6eb577d5f61142aa960a626d6bbdfeb3?pvs=4#3dea255ffa3b4f74942a227844e889fa";
-            const message = `@${author} Did you forget to add a milestone to the issue for this PR? _[When and where should I add a milestone?](${guideLink})_`;
-
-            await github.rest.issues.createComment({
-              owner,
-              repo,
-              issue_number: pullNumber,
-              body: message,
+              branchName,
+              commitMessages: [commitMessage],
             });

.github/workflows/conventional-commit-pr-title-reminder.yml

@@ -0,0 +1,42 @@
+name: Conventional commit PR Title Reminder
+
+on:
+  pull_request:
+    branches:
+      - master
+    paths:
+      - enterprise/frontend/src/embedding-sdk/**
+
+jobs:
+  pr-title-reminder:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    permissions:
+      pull-requests: write
+    steps:
+      - name: Check if the PR title is already following Conventional Commits style
+        uses: actions/github-script@v7
+        id: is-conventional-commit
+        with:
+          result-encoding: string
+          script: | # js
+            const pullRequestTitle = context.payload.pull_request.title
+            const conventionalCommitRegex = /^(?<type>\w+)\((?<scope>\w+)\):/
+            const match = pullRequestTitle.match(conventionalCommitRegex)
+            if (match) {
+              const { type, scope } = match.groups
+              return ['feat', 'fix', 'perf', 'docs', 'style', 'refactor', 'test', 'build', 'ci'].includes(type) && scope === 'sdk'
+            }
+
+      - name: Checkout repository so `gh` CLI works
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.head_ref }}
+
+      - name: Remind PR authors to use conventional commit in the title
+        if: ${{ steps.is-conventional-commit.outputs.result != 'true' }}
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const { updateComment } = require(".github/scripts/conventional-commit-pr-title-reminder/utils.js")
+            await updateComment({github, context})

.github/workflows/cross-branch-migrations.yml

@@ -0,0 +1,162 @@
+name: Cross-branch migration tests
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+    paths:
+      - "resources/migrations/**"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  migrations-h2-ee:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    env:
+      CI: 'true'
+      MB_DB_TYPE: h2
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/cross-branch-migration-test
+        with:
+          base-ref: ${{ github.base_ref }}
+
+  migrations-postgres-12-ee:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    env:
+      CI: 'true'
+      MB_DB_TYPE: postgres
+      MB_DB_PORT: 5432
+      MB_DB_HOST: localhost
+      MB_DB_DBNAME: circle_test
+      MB_DB_USER: circle_test
+    services:
+      postgres:
+        image: postgres:12-alpine
+        ports:
+          - "5432:5432"
+        env:
+          POSTGRES_USER: circle_test
+          POSTGRES_DB: circle_test
+          POSTGRES_HOST_AUTH_METHOD: trust
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/cross-branch-migration-test
+        with:
+          base-ref: ${{ github.base_ref }}
+
+  migrations-postgres-latest-ee:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    env:
+      CI: 'true'
+      MB_DB_TYPE: postgres
+      MB_DB_PORT: 5432
+      MB_DB_HOST: localhost
+      MB_DB_DBNAME: circle_test
+      MB_DB_USER: circle_test
+    services:
+      postgres:
+        image: circleci/postgres:latest
+        ports:
+          - "5432:5432"
+        env:
+          POSTGRES_USER: circle_test
+          POSTGRES_DB: circle_test
+          POSTGRES_HOST_AUTH_METHOD: trust
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/cross-branch-migration-test
+        with:
+          base-ref: ${{ github.base_ref }}
+
+  migrations-mysql-8-0-ee:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    env:
+      CI: 'true'
+      MB_DB_TYPE: mysql
+      MB_DB_HOST: localhost
+      MB_DB_PORT: 3306
+      MB_DB_DBNAME: circle_test
+      MB_DB_USER: root
+    services:
+      mysql:
+        image: cimg/mysql:8.0
+        ports:
+          - "3306:3306"
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/cross-branch-migration-test
+        with:
+          base-ref: ${{ github.base_ref }}
+
+  migrations-mysql-latest-ee:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    env:
+      CI: 'true'
+      MB_DB_TYPE: mysql
+      MB_DB_HOST: localhost
+      MB_DB_PORT: 3306
+      MB_DB_DBNAME: circle_test
+      MB_DB_USER: root
+      MB_MYSQL_TEST_USER: root
+    services:
+      mysql:
+        image: mysql:latest
+        env:
+          MYSQL_ALLOW_EMPTY_PASSWORD: true
+          MYSQL_DATABASE: circle_test
+        ports:
+          - "3306:3306"
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/cross-branch-migration-test
+        with:
+          base-ref: ${{ github.base_ref }}
+
+  migrations-mariadb-10-2-ee:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    env:
+      CI: 'true'
+      MB_DB_TYPE: mysql
+      MB_DB_HOST: localhost
+      MB_DB_PORT: 3306
+      MB_DB_DBNAME: circle_test
+      MB_DB_USER: root
+    services:
+      mariadb:
+        image: circleci/mariadb:10.2.23
+        ports:
+          - "3306:3306"
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/cross-branch-migration-test
+        with:
+          base-ref: ${{ github.base_ref }}
+
+  migrations-mariadb-latest-ee:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    env:
+      CI: 'true'
+      MB_DB_TYPE: mysql
+      MB_DB_HOST: localhost
+      MB_DB_PORT: 3306
+      MB_DB_DBNAME: circle_test
+      MB_DB_USER: root
+    services:
+      mariadb:
+        image: circleci/mariadb:latest
+        ports:
+          - "3306:3306"
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/cross-branch-migration-test
+        with:
+          base-ref: ${{ github.base_ref }}

.github/workflows/drivers.yml

@@ -40,6 +40,9 @@ jobs:
       MB_ATHENA_TEST_ACCESS_KEY: ${{ secrets.MB_ATHENA_TEST_ACCESS_KEY }}
       MB_ATHENA_TEST_SECRET_KEY: ${{ secrets.MB_ATHENA_TEST_SECRET_KEY }}
       MB_ATHENA_TEST_S3_STAGING_DIR: ${{ secrets.MB_ATHENA_TEST_S3_STAGING_DIR }}
+      # These credentials are used to test the driver when the user does not have the athena:GetTableMetadata permission
+      MB_ATHENA_TEST_WITHOUT_GET_TABLE_METADATA_ACCESS_KEY: ${{ secrets.MB_ATHENA_TEST_WITHOUT_GET_TABLE_METADATA_ACCESS_KEY }}
+      MB_ATHENA_TEST_WITHOUT_GET_TABLE_METADATA_SECRET_KEY: ${{ secrets.MB_ATHENA_TEST_WITHOUT_GET_TABLE_METADATA_SECRET_KEY }}
     steps:
     - uses: actions/checkout@v4
     - name: Test Athena driver
@@ -806,6 +809,11 @@ jobs:
       MB_SNOWFLAKE_TEST_WAREHOUSE: ${{ secrets.MB_SNOWFLAKE_TEST_WAREHOUSE }}
       MB_SNOWFLAKE_TEST_PK_USER: METABASE PK
       MB_SNOWFLAKE_TEST_PK_PRIVATE_KEY: ${{ secrets.MB_SNOWFLAKE_TEST_PK_PRIVATE_KEY }}
+      # RSA Role testing:
+      MB_SNOWFLAKE_TEST_RSA_ROLE_TEST_DEFAULT_USER: RSA_ROLE_TEST_DEFAULT_USER
+      MB_SNOWFLAKE_TEST_RSA_ROLE_TEST_CUSTOM_USER: RSA_ROLE_TEST_CUSTOM_USER
+      MB_SNOWFLAKE_TEST_RSA_ROLE_TEST_ROLE: RSA_ROLE_TEST_ROLE
+      MB_SNOWFLAKE_TEST_RSA_ROLE_TEST_DB: RSA_ROLE_TEST_DB
     steps:
     - uses: actions/checkout@v4
     - name: Test Snowflake driver

.github/workflows/e2e-cross-version.yml

@@ -2,12 +2,31 @@ name: E2E Cross-version Tests
 
 on:
   schedule:
-    - cron: '0 9 * * 0'
+    - cron: '0 9 * * 1-5'
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
 
 jobs:
-  cross-version-testing:
+  files-changed:
+    name: Check which files changed
     runs-on: ubuntu-22.04
-    timeout-minutes: 60
+    timeout-minutes: 3
+    outputs:
+      e2e_cross_version: ${{ steps.changes.outputs.e2e_cross_version }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Test which files changed
+        uses: dorny/paths-filter@v3.0.0
+        id: changes
+        with:
+          token: ${{ github.token }}
+          filters: .github/file-paths.yaml
+
+  cross-version-testing:
+    needs: files-changed
+    if: ${{ needs.files-changed.outputs.e2e_cross_version == 'true' || github.event_name == 'schedule'}}
+    runs-on: ubuntu-22.04
+    timeout-minutes: 20
     strategy:
       matrix:
         version: [
@@ -52,11 +71,12 @@ jobs:
     - name: Wait for Metabase to start on port 3000
       run: while ! curl -s 'http://localhost:3000/api/health' | grep '{"status":"ok"}'; do sleep 1; done
     - name: Prepare Cypress environment
+      id: cypress-prep
       uses: ./.github/actions/prepare-cypress
     - name: Run Cypress on the source
       run: |
         yarn cypress run \
-          --browser chrome \
+          --browser ${{ steps.cypress-prep.outputs.chrome-path }} \
           --config-file e2e/test/scenarios/cross-version/source/shared/cross-version-source.config.js \
           --spec e2e/test/scenarios/cross-version/source/**/*.cy.spec.js
     - name: Stop Metabase ${{ matrix.version.source }}
@@ -84,7 +104,7 @@ jobs:
     - name: Run Cypress on the target
       run: |
         yarn cypress run \
-          --browser chrome \
+          --browser ${{ steps.cypress-prep.outputs.chrome-path }} \
           --config-file e2e/test/scenarios/cross-version/target/shared/cross-version-target.config.js \
           --spec e2e/test/scenarios/cross-version/target/**/*.cy.spec.js
     - name: Upload Cypress Artifacts upon failure
@@ -97,20 +117,11 @@ jobs:
         if-no-files-found: ignore
   notify-on-failure:
     needs: cross-version-testing
-    if: ${{ always() && contains(needs.*.result, 'failure') }}
+    if: ${{ always() && contains(needs.*.result, 'failure') && github.event_name == 'schedule' }}
     name: Cross-version test failure
     runs-on: ubuntu-22.04
-    env:
-      BRANCH_NAME: ${{ github.event.workflow_run.head_branch }}
-      AUTHOR_NAME: ${{ github.event.workflow_run.head_commit.author.name }}
+    timeout-minutes: 5
     steps:
-      - name: Generate job summary
-        run: |
-          echo "# ${{ github.event.workflow_run.name }} workflow failed! :x:" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "View the failed run attempt (#${{ github.event.workflow_run.run_attempt }}) using the following link:" >> $GITHUB_STEP_SUMMARY
-          echo "${{ github.event.workflow_run.html_url }}" >> $GITHUB_STEP_SUMMARY
-
       - uses: actions/setup-node@v4
         with:
           node-version: lts/Hydrogen # 18.x.x
@@ -119,11 +130,8 @@ jobs:
         uses: actions/github-script@v7
         with:
           script: | # js
-            const FAILED_RUN_URL = "${{ github.event.workflow_run.html_url }}";
-            const FAILED_RUN_NAME = "${{ github.event.workflow_run.name }}";
-            const BREAKING_COMMIT = "${{ github.event.workflow_run.head_sha }}";
-            const AUTHOR = process.env.AUTHOR_NAME;
-            const BRANCH = process.env.BRANCH_NAME;
+            const FAILED_RUN_URL = "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}";
+            const REF_NAME = "${{ github.ref_name }}";
 
             // notify slack of failure
             const { WebClient } = require('@slack/web-api');
@@ -137,7 +145,7 @@ jobs:
                   "type": "header",
                   "text": {
                     "type": "plain_text",
-                    "text": `:broken_heart:   Cross-version tests are failing on ${BRANCH}`,
+                    "text": `:broken_heart:   Cross-version tests are failing on ${REF_NAME}`,
                     "emoji": true,
                   }
                 },
@@ -149,7 +157,7 @@ jobs:
                     "type": "section",
                     "text": {
                       "type": "mrkdwn",
-                      "text": `Commit <https://github.com/metabase/metabase/commit/${BREAKING_COMMIT}|${BREAKING_COMMIT.slice(0,7)}> has failing <${FAILED_RUN_URL}|${FAILED_RUN_NAME}> tests on the <https://github.com/metabase/metabase/commits/${BRANCH}|\`${BRANCH}\`> branch.`
+                      "text": `See <${FAILED_RUN_URL}|failing run details>.`
                     }
                   },
                 ]

.github/workflows/e2e-stress-test-flake-fix.yml

@@ -20,6 +20,15 @@ on:
         type: string
         required: false
         default: "ee"
+      qa_db:
+        description: 'Select the type of Database you want to run your tests with'
+        type: choice
+        required: true
+        default: "none"
+        options:
+          - none
+          - sql
+          - mongo
 
 jobs:
   workflow-summary:
@@ -35,6 +44,7 @@ jobs:
           echo '- `spec`: ${{ inputs.spec }}' >> $GITHUB_STEP_SUMMARY
           echo '- `burn_in`: ${{ inputs.burn_in }}' >> $GITHUB_STEP_SUMMARY
           echo '- `grep`: "${{ inputs.grep }}"' >> $GITHUB_STEP_SUMMARY
+          echo '- `qa_db`: "${{ inputs.qa_db }}"' >> $GITHUB_STEP_SUMMARY
           echo '' >> $GITHUB_STEP_SUMMARY
           echo 'triggered by: @${{ github.event.sender.login }}' >> $GITHUB_STEP_SUMMARY
 
@@ -44,9 +54,8 @@ jobs:
     name: Stress test E2E flake fix
     env:
       DISPLAY: ""
-      QA_DB_ENABLED: true
-      CYPRESS_QA_DB_MONGO: true
-      CYPRESS_REPLAYIO_ENABLED: 1
+      QA_DB_ENABLED: ${{ contains(fromJSON('["sql", "mongo"]'), inputs.qa_db) }}
+      CYPRESS_QA_DB_MONGO: ${{ inputs.qa_db == 'mongo' }}
       CYPRESS_ALL_FEATURES_TOKEN: ${{ secrets.ENTERPRISE_TOKEN }}
       CYPRESS_NO_FEATURES_TOKEN: ${{ secrets.E2E_STARTER_TOKEN }}
       MB_SNOWPLOW_AVAILABLE: true
@@ -67,9 +76,9 @@ jobs:
           password: ${{ secrets.DOCKERHUB_TOKEN }}
           maildev: true
           openldap: true
-          postgres: true
-          mysql: true
-          mongo: true
+          postgres: ${{ inputs.qa_db == 'sql' }}
+          mysql: ${{ inputs.qa_db == 'sql' }}
+          mongo: ${{ inputs.qa_db == 'mongo' }}
 
       - name: Download Metabase ${{ matrix.edition }} uberjar
         uses: ./.github/actions/e2e-download-uberjar
@@ -84,6 +93,7 @@ jobs:
           java-version: 11
           distribution: "temurin"
       - name: Prepare Cypress environment
+        id: cypress-prep
         uses: ./.github/actions/prepare-cypress
       - name: Run Snowplow micro
         uses: ./.github/actions/run-snowplow-micro
@@ -96,7 +106,7 @@ jobs:
           --spec '${{ github.event.inputs.spec }}' \
           --env burn=${{ github.event.inputs.burn_in }},grep='${{ github.event.inputs.grep }}' \
           --config-file e2e/support/cypress-stress-test.config.js \
-          --browser 'replay-chromium'
+          --browser ${{ steps.cypress-prep.outputs.chrome-path }}
 
       - name: Upload Cypress Artifacts upon failure
         uses: actions/upload-artifact@v4

.github/workflows/e2e-tests.yml

@@ -39,8 +39,39 @@ jobs:
         id: e2e-matrix
         uses: ./.github/actions/build-e2e-matrix
 
+  # if this is a test on a release branch, we need to check the build requirements
+  get-build-requirements:
+    if: |
+      !cancelled() &&
+      contains(github.ref, 'release-x')
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    outputs:
+      java_version: ${{ fromJson(steps.dependencies.outputs.result).java_version }}
+      node_version: ${{ fromJson(steps.dependencies.outputs.result).node_version }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: release
+      - name: Prepare build scripts
+        run: cd ${{ github.workspace }}/release && yarn && yarn build
+      - name: Get build dependencies
+        uses: actions/github-script@v7
+        id: dependencies
+        with:
+          script: | # js
+            const { getBuildRequirements, getVersionFromReleaseBranch } = require('${{ github.workspace }}/release/dist/index.cjs');
+
+            const version = getVersionFromReleaseBranch('${{ github.ref }}');
+            const requirements = getBuildRequirements(version);
+
+            return {
+              java_version: requirements.java,
+              node_version: requirements.node,
+            };
+
   build:
-    needs: [files-changed, e2e-matrix-builder]
+    needs: [files-changed, e2e-matrix-builder, get-build-requirements]
     if: |
       !cancelled() &&
       github.event.pull_request.draft == false &&
@@ -54,14 +85,19 @@ jobs:
     env:
       MB_EDITION: ${{ matrix.edition }}
       INTERACTIVE: false
+      # make sure that builds on release branches get licenses, because we use them for releases
+      SKIP_LICENSES: ${{ github.event_name == 'pull_request' }}
     steps:
       - uses: actions/checkout@v4
       - name: Prepare front-end environment
         uses: ./.github/actions/prepare-frontend
+        with:
+          node-version: "${{ needs.get-build-requirements.outputs.node_version }}"
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
         with:
-          m2-cache-key: e2e-tests
+          m2-cache-key: uberjar
+          java-version: "${{ needs.get-build-requirements.outputs.java_version || 11 }}"
 
       - name: Build uberjar with ./bin/build.sh
         run: ./bin/build.sh
@@ -90,11 +126,6 @@ jobs:
       COMMIT_INFO_MESSAGE: ${{ github.event.pull_request.title || github.event.head_commit.message || github.even.head.sha }}
       MB_SNOWPLOW_AVAILABLE: true
       MB_SNOWPLOW_URL: "http://localhost:9090" # Snowplow micro
-      CYPRESS_REPLAYIO_ENABLED: 1
-      CYPRESS_REPLAYIO_ENABLE_UPLOAD: 1
-      RECORD_REPLAY_METADATA_FILE: /tmp/replay-metadata.json
-      RECORD_REPLAY_METADATA_TEST_RUN_ID: ${{ github.run_id }}
-      REPLAY_API_KEY: ${{ secrets.REPLAY_IO_TOKEN }}
       TZ: US/Pacific # to make node match the instance tz
     strategy:
       fail-fast: false
@@ -134,6 +165,7 @@ jobs:
           distribution: "temurin"
 
       - name: Prepare Cypress environment
+        id: cypress-prep
         uses: ./.github/actions/prepare-cypress
 
       - name: Run Snowplow micro
@@ -145,7 +177,7 @@ jobs:
           yarn run test-cypress-run \
           --env grepTags=@OSS,grepOmitFiltered=true \
           --spec './e2e/test/scenarios/**/*.cy.spec.(js|ts)' \
-          --browser 'replay-chromium'
+          --browser ${{ steps.cypress-prep.outputs.chrome-path }}
 
       - name: Run slow and resource-intensive Cypress tests
         if: matrix.name == 'slow' && github.event_name != 'schedule'
@@ -153,7 +185,7 @@ jobs:
           yarn run test-cypress-run \
           --env grepTags="@slow",grepOmitFiltered=true \
           --spec './e2e/test/scenarios/**/*.cy.spec.(js|ts)' \
-          --browser 'replay-chromium'
+          --browser ${{ steps.cypress-prep.outputs.chrome-path }}
 
       - name: Run Flaky Cypress tests
         if: matrix.name == 'flaky' && github.event_name != 'schedule'
@@ -161,7 +193,7 @@ jobs:
           yarn run test-cypress-run \
           --env grepTags="@flaky --@quarantine",grepOmitFiltered=true \
           --spec './e2e/test/scenarios/**/*.cy.spec.(js|ts)' \
-          --browser 'replay-chromium'
+          --browser ${{ steps.cypress-prep.outputs.chrome-path }}
 
       - name: Run EE Cypress tests on ${{ matrix.name }}
         if: matrix.context == 'folder' && github.event_name != 'schedule'
@@ -169,7 +201,7 @@ jobs:
           yarn run test-cypress-run \
           --env grepTags="-@slow+-@mongo+-@flaky --@quarantine",grepOmitFiltered=true \
           --folder ${{ matrix.name }} \
-          --browser 'replay-chromium'
+          --browser ${{ steps.cypress-prep.outputs.chrome-path }}
 
       - name: Run E2E tests that depend on Mongo
         if: matrix.name == 'mongo'
@@ -177,10 +209,25 @@ jobs:
           yarn run test-cypress-run \
           --env grepTags="@mongo --@quarantine",grepOmitFiltered=true \
           --spec './e2e/test/scenarios/**/*.cy.spec.(js|ts)' \
-          --browser 'replay-chromium'
+          --browser ${{ steps.cypress-prep.outputs.chrome-path }}
         env:
           CYPRESS_QA_DB_MONGO: true
 
+      - name: Run Embedding SDK Storybook
+        if: matrix.context == 'embedding-sdk' && github.event_name != 'schedule'
+        uses: ./.github/actions/run-embedding-sdk-storybook
+
+      - name: Run E2E tests for Embedding SDK
+        if: matrix.context == 'embedding-sdk' && github.event_name != 'schedule'
+        run: |
+          yarn run test-cypress-run \
+          --env grepTags="-@slow+-@flaky --@quarantine",grepOmitFiltered=true \
+          --folder 'embedding-sdk' \
+          --browser ${{ steps.cypress-prep.outputs.chrome-path }}
+        env:
+          CYPRESS_IS_EMBEDDING_SDK: true
+        shell: bash
+
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
         if: always()
@@ -217,3 +264,11 @@ jobs:
     steps:
       - run: |
           echo "Didn't run due to conditional filtering"
+
+  pr-env:
+    needs: [build]
+    if: |
+      !cancelled() &&
+      contains(github.event.pull_request.labels.*.name, 'PR-Env')
+    uses: ./.github/workflows/pr-env.yml
+    secrets: inherit

.github/workflows/flake-issue-creator.yml

@@ -0,0 +1,34 @@
+name: Flake Issue Creator
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 6 * * 1-5' # every weekday at 1am US eastern time
+
+jobs:
+  flake-issue-creator:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        sparse-checkout: release
+    - name: Prepare build scripts
+      run: cd ${{ github.workspace }}/release && yarn --frozen-lockfile && yarn build
+    - name: Update flake issues
+      uses: actions/github-script@v7
+      env:
+        SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+      with:
+        script: | # js
+          const { updateFlakeIssues } = require('${{ github.workspace }}/release/dist/index.cjs');
+
+          if (!process.env.SLACK_BOT_TOKEN) {
+            throw new Error('SLACK_BOT_TOKEN is required');
+          }
+
+          await updateFlakeIssues({
+            github,
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+          });

.github/workflows/flake-status.yml

@@ -0,0 +1,35 @@
+name: Flake Status Report
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 6 * * 2,5' # Tuesdays and Fridays at 1am US eastern time
+
+jobs:
+  flake-status-report:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        sparse-checkout: release
+    - name: Prepare build scripts
+      run: cd ${{ github.workspace }}/release && yarn --frozen-lockfile && yarn build
+    - name: Post Flake Status Report
+      uses: actions/github-script@v7
+      env:
+        SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+      with:
+        script: | # js
+          const { summarizeFlakes } = require('${{ github.workspace }}/release/dist/index.cjs');
+
+          if (!process.env.SLACK_BOT_TOKEN) {
+            throw new Error('SLACK_BOT_TOKEN is required');
+          }
+
+          await summarizeFlakes({
+            github,
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+            channelName: 'engineering-ci'
+          });

.github/workflows/frontend-unit-test-stress-test-flake-fix.yml

@@ -4,15 +4,15 @@ on:
   workflow_dispatch:
     inputs:
       spec:
-        description: 'Relative path of the target spec'
+        description: "Relative path of the target spec"
         type: string
         required: true
       burn_in:
-        description: 'Number of times to run the test (e.g. 20)'
+        description: "Number of times to run the test (e.g. 20)"
         type: string
         required: true
       grep:
-        description: 'Grep and filter tests to run in isolation'
+        description: "Grep and filter tests to run in isolation"
         type: string
         required: false
 
@@ -45,10 +45,12 @@ jobs:
         uses: ./.github/actions/prepare-backend
         with:
           m2-cache-key: "cljs"
+      - name: Build cljs
+        run: yarn build:cljs
       - name: Stress-test ${{ github.event.inputs.spec }} ${{ github.event.inputs.burn_in }} times
         run: |
           for i in {1..${{ github.event.inputs.burn_in }}}; do
-            yarn test-unit \
+            yarn jest --runInBand --ci --silent --no-cache \
               --testPathPattern '${{ github.event.inputs.spec }}' \
               --testNamePattern '${{ github.event.inputs.grep }}'
             if [[ "$?" != 0 ]]; then

.github/workflows/loki-update.yml

@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
         with:
           token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
           ref: ${{ github.head_ref }}
@@ -27,7 +27,9 @@ jobs:
         run: yarn build-pure:cljs
 
       - name: Build Storybook
-        run: yarn build-storybook
+        # We won't be able to use Storybook play's `userEvent` with production build
+        # see https://github.com/storybookjs/storybook/issues/19758
+        run: NODE_ENV=development yarn build-storybook
 
       - name: Serve Storybook
         run: yarn http-server storybook-static -p 6006 &
@@ -55,7 +57,7 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
       - name: Remove 'loki-update' label
-        uses: actions/github-script@v3
+        uses: actions/github-script@v7
         with:
           github-token: ${{secrets.METABASE_AUTOMATION_USER_TOKEN}}
           script: |

.github/workflows/loki.yml

@@ -3,7 +3,26 @@ name: Loki Visual Regression Testing
 on: [pull_request]
 
 jobs:
+  files-changed:
+    name: Check which files changed
+    runs-on: ubuntu-22.04
+    timeout-minutes: 3
+    outputs:
+      frontend_ci: ${{ steps.changes.outputs.frontend_ci }}
+      frontend_sources: ${{ steps.changes.outputs.frontend_sources }}
+      frontend_loki_ci: ${{ steps.changes.outputs.frontend_loki_ci }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Test which files changed
+        uses: dorny/paths-filter@v3.0.0
+        id: changes
+        with:
+          token: ${{ github.token }}
+          filters: .github/file-paths.yaml
+
   visual-test:
+    needs: files-changed
+    if: needs.files-changed.outputs.frontend_ci == 'true' || needs.files-changed.outputs.frontend_sources == 'true' || needs.files-changed.outputs.frontend_loki_ci == 'true'
     runs-on: ubuntu-latest
     services:
       docker:
@@ -19,7 +38,7 @@ jobs:
 
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Prepare frontend environment
         uses: ./.github/actions/prepare-frontend
@@ -33,7 +52,9 @@ jobs:
         run: yarn build-pure:cljs
 
       - name: Build Storybook
-        run: yarn build-storybook
+        # We won't be able to use Storybook play's `userEvent` with production build
+        # see https://github.com/storybookjs/storybook/issues/19758
+        run: NODE_ENV=development yarn build-storybook
 
       - name: Serve Storybook
         run: yarn http-server storybook-static -p 6006 &
@@ -50,7 +71,7 @@ jobs:
 
       - name: Run Loki Visual Tests
         run: |
-          yarn loki test
+          yarn test-visual:loki
 
       - name: Generate Visual Report on Failure
         if: failure()

.github/workflows/migrations.yml

@@ -1,4 +1,4 @@
-name: Migrations
+name: Lint migrations
 
 on:
   push:
@@ -9,14 +9,14 @@ on:
 
 jobs:
 
-  check-migrations:
+  lint-migrations:
     runs-on: ubuntu-22.04
     timeout-minutes: 15
     steps:
-    - uses: actions/checkout@v4
-    - name: Prepare back-end environment
-      uses: ./.github/actions/prepare-backend
-      with:
-        m2-cache-key: check-migrations
-    - name: Verify Liquibase Migrations
-      run: ./bin/lint-migrations-file.sh
+      - uses: actions/checkout@v4
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: lint-migrations
+      - name: Verify Liquibase Migrations
+        run: ./bin/lint-migrations-file.sh

.github/workflows/perf-test-labeled.yml

@@ -0,0 +1,17 @@
+name: Perf test command
+
+on:
+  pull_request:
+    types: [ labeled ]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  run-perf-test:
+    if: ${{ github.event.label.name == 'Run-perf' }}
+    uses: ./.github/workflows/perf-test.yml
+    with:
+      wait_for_uberjar: true
+    secrets: inherit

.github/workflows/perf-test.yml

@@ -0,0 +1,150 @@
+name: CI for Perf tests
+run-name: Run perf test for ${{ github.ref_name }} by @${{ github.actor }}
+
+on:
+  workflow_call:
+    inputs:
+      wait_for_uberjar:
+        description: "Wait for uberjar build"
+        required: false
+        type: boolean
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    if: github.event.pull_request.head.repo.full_name == github.repository
+    name: Build Metabase Docker image
+    timeout-minutes: 60
+    permissions:
+      id-token: write
+      contents: read
+      actions: read
+    steps:
+      - name: Checkout source code
+        uses: actions/checkout@v4
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.PR_ENV_IAM_ROLE }}
+          role-session-name: GitHub_to_AWS_via_FederatedOIDC
+          aws-region: us-east-1
+      - name: Login to Amazon ECR
+        uses: aws-actions/amazon-ecr-login@v2
+        with:
+          registries: "${{ secrets.PR_ENV_AWS_ACCOUNT_ID }}"
+      - name: Wait for uberjar
+        id: wait_for_uberjar
+        if: ${{ inputs.wait_for_uberjar == true }}
+        run: |
+          ## Get workflow run id for uberjar build
+          curl -Ls --output e2e-tests.json \
+          -H "Accept: application/vnd.github+json" \
+          -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
+          -H "X-GitHub-Api-Version: 2022-11-28" \
+          https://api.github.com/repos/${{ github.repository }}/actions/workflows/e2e-tests.yml/runs?head_sha=${{ github.event.pull_request.head.sha || github.sha }}
+          ID=$(jq -r '.workflow_runs[0].id' e2e-tests.json)
+          ## Wait for uberjar build to complete
+          while [ true ]; do
+            curl -Ls --output uberjar.json \
+            -H "Accept: application/vnd.github+json" \
+            -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            https://api.github.com/repos/${{ github.repository }}/actions/runs/${ID}/jobs?filter=latest
+            jq -r '.jobs[] | select(.name == "build (ee)") | .steps[] | select(.name == "Prepare uberjar artifact") | .status' uberjar.json | grep -q "completed" && break
+            echo "Waiting for uberjar build..."
+            sleep 10
+          done
+          echo "run_id=$(jq -r '.workflow_runs[0].id' e2e-tests.json)" >> $GITHUB_OUTPUT
+      - name: Retrieve uberjar artifact for ee
+        uses: actions/download-artifact@v4
+        with:
+          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          run-id: ${{ inputs.wait_for_uberjar && steps.wait_for_uberjar.outputs.run_id || github.run_id }}
+      - name: Move uberjar to bin/docker
+        run: |
+          jar xf target/uberjar/metabase.jar
+          mv target/uberjar/metabase.jar bin/docker/metabase.jar
+      - name: Build container
+        uses: docker/build-push-action@v6
+        with:
+          context: bin/docker/
+          platforms: linux/amd64
+          network: host
+          tags: ${{ secrets.PR_ENV_AWS_ACCOUNT_ID }}.dkr.ecr.us-east-1.amazonaws.com/metabase-enterprise:pr${{ github.event.number }}
+          push: true
+  launch_perf_test:
+    needs: [ build ]
+    runs-on: ubuntu-latest
+    name: Launch Perf Test
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - name: Checkout source code
+        uses: actions/checkout@v4
+      - name: Tailscale
+        uses: tailscale/github-action@v2
+        with:
+          oauth-client-id: ${{ secrets.PR_ENV_TAILSCALE_OAUTH_CLIENT_ID }}
+          oauth-secret: ${{ secrets.PR_ENV_TAILSCALE_OAUTH_SECRET }}
+          tags: tag:ci
+          version: 1.50.1
+          sha256sum: d9fe6b480fb5078f0aa57dace686898dda7e2a768884271159faa74846bfb576
+      - name: Create OIDC Token
+        id: create-oidc-token
+        shell: bash
+        run: |
+          export OIDC_URL_WITH_AUDIENCE="$ACTIONS_ID_TOKEN_REQUEST_URL&audience=${{ secrets.PR_ENV_K8S_AUDIENCE }}"
+          IDTOKEN=$(curl -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" -H "Accept: application/json; api-version=2.0" "$OIDC_URL_WITH_AUDIENCE" | jq -r .value)
+          echo "::add-mask::${IDTOKEN}"
+          echo "idToken=${IDTOKEN}" >>$GITHUB_OUTPUT
+      - name: Setup Kube Context
+        uses: azure/k8s-set-context@v2
+        with:
+          method: kubeconfig
+          kubeconfig: |
+            kind: Config
+            apiVersion: v1
+            current-context: default
+            clusters:
+            - name: default
+              cluster:
+                certificate-authority-data: ${{ secrets.PR_ENV_K8S_CERTIFICATE_AUTHORITY_DATA }}
+                server: ${{ secrets.PR_ENV_K8S_SERVER }}
+            users:
+            - name: oidc-token
+              user:
+                token: ${{ steps.create-oidc-token.outputs.IDTOKEN }}
+            contexts:
+            - name: default
+              context:
+                cluster: default
+                namespace: default
+                user: oidc-token
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.PR_ENV_IAM_ROLE }}
+          role-session-name: GitHub_to_AWS_via_FederatedOIDC
+          aws-region: us-east-1
+      - name: Download Deployment YAML template
+        run: aws s3 cp s3://metabase-pr-env/perf-test-pr.yml.tmpl ./perf-test-pr.yml.tmpl
+      - name: Trim SHA
+        env:
+          SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+        id: split
+        run: echo "::set-output name=fragment::${SHA:5}"
+      - name: Render Deployment YAML
+        uses: nowactions/envsubst@v1
+        with:
+          input: ./perf-test-pr.yml.tmpl
+          output: ./perf-test-pr.yml
+        env:
+          IMAGE_TAG: pr${{ github.event.number }}
+          PR_NUMBER: ${{ github.event.number }}
+          RUN_ID: ${{ steps.split.outputs.fragment }}
+          SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+          TEST_NAME: test
+      - name: Deploy PR Review ENV
+        run: |
+          kubectl apply -f ./perf-test-pr.yml

.github/workflows/pr-env-close-unlabel.yml

@@ -0,0 +1,15 @@
+name: PR Closed or Unlabeled
+
+on:
+  pull_request:
+    types: [ closed, unlabeled ]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  pr-env:
+    if: ${{ github.event.action == 'closed' && contains(github.event.pull_request.labels.*.name, 'PR-Env') || github.event.label.name == 'PR-Env' }}
+    uses: ./.github/workflows/pr-env-destroy.yml
+    secrets: inherit

.github/workflows/pr-env-destroy.yml

@@ -0,0 +1,71 @@
+name: CI for PR Review ENV Destroy
+run-name: Destroying Dynamic PR Environment for ${{ github.ref_name }} by @${{ github.actor }}
+
+on:
+  workflow_call:
+
+jobs:
+  destroy_pr:
+    runs-on: ubuntu-latest
+    name: PR Review ENV Destroy
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - name: Checkout source code
+        uses: actions/checkout@v4
+      - name: Tailscale
+        uses: tailscale/github-action@v2
+        with:
+          oauth-client-id: ${{ secrets.PR_ENV_TAILSCALE_OAUTH_CLIENT_ID }}
+          oauth-secret: ${{ secrets.PR_ENV_TAILSCALE_OAUTH_SECRET }}
+          tags: tag:ci
+          version: 1.50.1
+          sha256sum: d9fe6b480fb5078f0aa57dace686898dda7e2a768884271159faa74846bfb576
+      - name: Create OIDC Token
+        id: create-oidc-token
+        shell: bash
+        run: |
+          export OIDC_URL_WITH_AUDIENCE="$ACTIONS_ID_TOKEN_REQUEST_URL&audience=${{ secrets.PR_ENV_K8S_AUDIENCE }}"
+          IDTOKEN=$(curl -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" -H "Accept: application/json; api-version=2.0" "$OIDC_URL_WITH_AUDIENCE" | jq -r .value)
+          echo "::add-mask::${IDTOKEN}"
+          echo "idToken=${IDTOKEN}" >>$GITHUB_OUTPUT
+      - name: Setup Kube Context
+        uses: azure/k8s-set-context@v2
+        with:
+          method: kubeconfig
+          kubeconfig: |
+            kind: Config
+            apiVersion: v1
+            current-context: default
+            clusters:
+            - name: default
+              cluster:
+                certificate-authority-data: ${{ secrets.PR_ENV_K8S_CERTIFICATE_AUTHORITY_DATA }}
+                server: ${{ secrets.PR_ENV_K8S_SERVER }}
+            users:
+            - name: oidc-token
+              user:
+                token: ${{ steps.create-oidc-token.outputs.IDTOKEN }}
+            contexts:
+            - name: default
+              context:
+                cluster: default
+                namespace: default
+                user: oidc-token
+      - name: Destroy PR Review ENV
+        run: |
+          kubectl delete metabase -n hosting-pr${{ github.event.number }} hosting-pr${{ github.event.number }}
+          kubectl delete ns hosting-pr${{ github.event.number }}
+      - name: Setup psql client
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y postgresql-client
+      - name: Drop app database if exists
+        run: |
+          PGPASSWORD='${{ secrets.PR_ENV_DB_PASSWORD }}' \
+          psql \
+          -h ${{ secrets.PR_ENV_DB_HOST }} \
+          -U ${{ secrets.PR_ENV_DB_USER }} \
+          -d ${{ secrets.PR_ENV_DB_NAME }} \
+          -c "DROP DATABASE IF EXISTS hosting_pr${{ github.event.number }};"

.github/workflows/pr-env-labeled.yml

@@ -0,0 +1,17 @@
+name: PR-Env labeled
+
+on:
+  pull_request:
+    types: [ labeled ]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  pr-env:
+    if: ${{ github.event.label.name == 'PR-Env' }}
+    uses: ./.github/workflows/pr-env.yml
+    with:
+      wait_for_uberjar: true
+    secrets: inherit

.github/workflows/pr-env.yml

@@ -0,0 +1,169 @@
+name: CI for PR Review ENV
+run-name: Building Dynamic PR Environment for ${{ github.ref_name }} by @${{ github.actor }}
+
+on:
+  workflow_call:
+    inputs:
+      wait_for_uberjar:
+        description: "Wait for uberjar build"
+        required: false
+        type: boolean
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    if: github.event.pull_request.head.repo.full_name == github.repository
+    name: Build Metabase Docker image
+    timeout-minutes: 60
+    permissions:
+      id-token: write
+      contents: read
+      actions: read
+    steps:
+      - name: Checkout source code
+        uses: actions/checkout@v4
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.PR_ENV_IAM_ROLE }}
+          role-session-name: GitHub_to_AWS_via_FederatedOIDC
+          aws-region: us-east-1
+      - name: Login to Amazon ECR
+        uses: aws-actions/amazon-ecr-login@v2
+        with:
+          registries: "${{ secrets.PR_ENV_AWS_ACCOUNT_ID }}"
+      - name: Wait for uberjar
+        id: wait_for_uberjar
+        if: ${{ inputs.wait_for_uberjar == true }}
+        run: |
+          ## Get workflow run id for uberjar build
+          curl -Ls --output e2e-tests.json \
+          -H "Accept: application/vnd.github+json" \
+          -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
+          -H "X-GitHub-Api-Version: 2022-11-28" \
+          https://api.github.com/repos/${{ github.repository }}/actions/workflows/e2e-tests.yml/runs?head_sha=${{ github.event.pull_request.head.sha || github.sha }}
+          ID=$(jq -r '.workflow_runs[0].id' e2e-tests.json)
+          ## Wait for uberjar build to complete
+          while [ true ]; do
+            curl -Ls --output uberjar.json \
+            -H "Accept: application/vnd.github+json" \
+            -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            https://api.github.com/repos/${{ github.repository }}/actions/runs/${ID}/jobs?filter=latest
+            jq -r '.jobs[] | select(.name == "build (ee)") | .steps[] | select(.name == "Prepare uberjar artifact") | .status' uberjar.json | grep -q "completed" && break
+            echo "Waiting for uberjar build..."
+            sleep 10
+          done
+          echo "run_id=$(jq -r '.workflow_runs[0].id' e2e-tests.json)" >> $GITHUB_OUTPUT
+      - name: Retrieve uberjar artifact for ee
+        uses: actions/download-artifact@v4
+        with:
+          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          run-id: ${{ inputs.wait_for_uberjar && steps.wait_for_uberjar.outputs.run_id || github.run_id }}
+      - name: Move uberjar to bin/docker
+        run: |
+          jar xf target/uberjar/metabase.jar
+          mv target/uberjar/metabase.jar bin/docker/metabase.jar
+      - name: Build container
+        uses: docker/build-push-action@v6
+        with:
+          context: bin/docker/
+          platforms: linux/amd64
+          network: host
+          tags: ${{ secrets.PR_ENV_AWS_ACCOUNT_ID }}.dkr.ecr.us-east-1.amazonaws.com/metabase-enterprise:pr${{ github.event.number }}
+          push: true
+  deploy_pr:
+    needs: [ build ]
+    runs-on: ubuntu-latest
+    name: PR Review ENV
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - name: Checkout source code
+        uses: actions/checkout@v4
+      - name: Tailscale
+        uses: tailscale/github-action@v2
+        with:
+          oauth-client-id: ${{ secrets.PR_ENV_TAILSCALE_OAUTH_CLIENT_ID }}
+          oauth-secret: ${{ secrets.PR_ENV_TAILSCALE_OAUTH_SECRET }}
+          tags: tag:ci
+          version: 1.50.1
+          sha256sum: d9fe6b480fb5078f0aa57dace686898dda7e2a768884271159faa74846bfb576
+      - name: Create OIDC Token
+        id: create-oidc-token
+        shell: bash
+        run: |
+          export OIDC_URL_WITH_AUDIENCE="$ACTIONS_ID_TOKEN_REQUEST_URL&audience=${{ secrets.PR_ENV_K8S_AUDIENCE }}"
+          IDTOKEN=$(curl -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" -H "Accept: application/json; api-version=2.0" "$OIDC_URL_WITH_AUDIENCE" | jq -r .value)
+          echo "::add-mask::${IDTOKEN}"
+          echo "idToken=${IDTOKEN}" >>$GITHUB_OUTPUT
+      - name: Setup Kube Context
+        uses: azure/k8s-set-context@v2
+        with:
+          method: kubeconfig
+          kubeconfig: |
+            kind: Config
+            apiVersion: v1
+            current-context: default
+            clusters:
+            - name: default
+              cluster:
+                certificate-authority-data: ${{ secrets.PR_ENV_K8S_CERTIFICATE_AUTHORITY_DATA }}
+                server: ${{ secrets.PR_ENV_K8S_SERVER }}
+            users:
+            - name: oidc-token
+              user:
+                token: ${{ steps.create-oidc-token.outputs.IDTOKEN }}
+            contexts:
+            - name: default
+              context:
+                cluster: default
+                namespace: default
+                user: oidc-token
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.PR_ENV_IAM_ROLE }}
+          role-session-name: GitHub_to_AWS_via_FederatedOIDC
+          aws-region: us-east-1
+      - name: Setup psql client
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y postgresql-client
+      - name: Create app database if not exists
+        run: |
+          export PGPASSWORD='${{ secrets.PR_ENV_DB_PASSWORD }}'
+          export PGUSER=${{ secrets.PR_ENV_DB_USER }}
+          export PGHOST=${{ secrets.PR_ENV_DB_HOST }}
+          export PGDATABASE=${{ secrets.PR_ENV_DB_NAME }}
+          psql -tc "SELECT 1 FROM pg_database WHERE datname = 'hosting_pr${{ github.event.number }}'" \
+          | grep -q 1 \
+          || psql -c "CREATE DATABASE hosting_pr${{ github.event.number }}"
+      - name: Download Deployment YAML template
+        run: aws s3 cp s3://metabase-pr-env/metabase.yml.tmpl ./metabase.yml.tmpl
+      - name: Render Deployment YAML
+        uses: nowactions/envsubst@v1
+        with:
+          input: ./metabase.yml.tmpl
+          output: ./metabase.yml
+        env:
+          IMAGE_TAG: pr${{ github.event.number }}
+          PR_NUMBER: ${{ github.event.number }}
+          MB_PREMIUM_EMBEDDING_TOKEN: ${{ secrets.PR_ENV_MB_PREMIUM_EMBEDDING_TOKEN }}
+          SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+      - name: Deploy PR Review ENV
+        run: |
+          kubectl apply -f ./metabase.yml
+  preview_links:
+    runs-on: ubuntu-latest
+    needs: [ deploy_pr ]
+    steps:
+      - uses: marocchino/sticky-pull-request-comment@v2
+        with:
+          recreate: true
+          message: |
+            👋 Deploying a preview environment for commit ${{ github.event.pull_request.head.sha || github.sha }}.
+            ✅ Preview:
+                https://pr${{ github.event.number }}.coredev.metabase.com
+            🗒️ [login instructions](https://www.notion.so/metabase/Ephemeral-PR-Environments-c74a3710c87a460dbf4fc0007a001458)

.github/workflows/pre-release.yml

@@ -11,6 +11,10 @@ on:
       commit:
         description: "A full-length commit SHA-1 hash"
         required: true
+      auto:
+        description: 'auto-patch release DO NOT SET MANUALLY'
+        type: boolean
+        default: false
 
 jobs:
   release-artifact:
@@ -110,37 +114,32 @@ jobs:
   run-sanity-check:
     runs-on: ubuntu-22.04
     timeout-minutes: 30
-    needs: [release-artifact, check-uberjar-health]
+    needs: [release-artifact]
     strategy:
       matrix:
         edition: [oss, ee]
-        folder: [onboarding, search]
     env:
       MB_EDITION: ${{ matrix.edition }}
       DISPLAY: ""
       CYPRESS_ALL_FEATURES_TOKEN: ${{ secrets.ENTERPRISE_TOKEN }}
       CYPRESS_NO_FEATURES_TOKEN: ${{ secrets.E2E_STARTER_TOKEN }}
-      CYPRESS_REPLAYIO_ENABLED: 1
       # disabled because of out of memory issues
       # probably related to https://github.com/cypress-io/cypress/issues/27415
       CYPRESS_NO_COMMAND_LOG: 1
       MB_SNOWPLOW_AVAILABLE: true
       MB_SNOWPLOW_URL: "http://localhost:9090" # Snowplow micro
       TERM: xterm
-    services:
-      maildev:
-        image: maildev/maildev:2.0.5
-        ports:
-          - "1080:1080"
-          - "1025:1025"
-        credentials:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
     steps:
       - name: Check out the code
         uses: actions/checkout@v4
         with:
           ref: ${{ needs.release-artifact.outputs.commit }}
+      - name: Prepare Docker containers
+        uses: ./.github/actions/e2e-prepare-containers
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          maildev: true
       - name: Prepare front-end environment
         uses: ./.github/actions/prepare-frontend
       - name: Prepare JDK 11
@@ -149,6 +148,7 @@ jobs:
           java-version: 11
           distribution: "temurin"
       - name: Prepare Cypress environment
+        id: cypress-prep
         uses: ./.github/actions/prepare-cypress
       - name: Run Snowplow micro
         uses: ./.github/actions/run-snowplow-micro
@@ -163,7 +163,10 @@ jobs:
       - name: Run a few important Cypress tests as sanity check
         run: |
           mkdir -p ./target/uberjar && cp metabase.jar ./target/uberjar/metabase.jar
-          yarn test-cypress-run --folder ${{ matrix.folder }}
+          yarn test-cypress-run \
+            --env grepTags="@smoke",grepOmitFiltered=true \
+            --spec './e2e/test/scenarios/**/*.cy.spec.(js|ts)' \
+            --browser ${{ steps.cypress-prep.outputs.chrome-path }}
 
       - name: Upload Cypress Artifacts upon failure
         uses: actions/upload-artifact@v4
@@ -176,7 +179,7 @@ jobs:
           if-no-files-found: ignore
 
   containerize:
-    needs: [release-artifact, run-sanity-check]
+    needs: [release-artifact]
     runs-on: ubuntu-22.04
     timeout-minutes: 15
     strategy:
@@ -285,3 +288,61 @@ jobs:
       - name: Wait for Metabase to start
         run: while ! curl -s 'http://localhost:3000/api/health' | grep '{"status":"ok"}'; do sleep 1; done
         timeout-minutes: 3
+
+  trigger-auto-publish:
+    if: ${{ inputs.auto }}
+    needs: [run-sanity-check, check-uberjar-health, verify-docker-pull]
+    permissions:
+      actions: write
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: trigger auto publish
+        uses: actions/github-script@v7
+        with:
+          script: | # js
+            await github.rest.actions.createWorkflowDispatch({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              workflow_id: 'release.yml',
+              ref: '${{ github.ref }}',
+              inputs: {
+                commit: '${{ inputs.commit }}',
+                version: '${{ inputs.version }}',
+                auto: true,
+              }
+            });
+
+  tests-complete-message:
+    if: always()
+    runs-on: ubuntu-22.04
+    needs: [run-sanity-check, check-uberjar-health, verify-docker-pull]
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: release
+      - name: Prepare build scripts
+        run: cd ${{ github.workspace }}/release && yarn && yarn build
+      - name: Send tests complete message
+        uses: actions/github-script@v7
+        env:
+          SLACK_RELEASE_CHANNEL: ${{ vars.SLACK_RELEASE_CHANNEL }}
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+        with:
+          script: | # js
+            const { sendTestsCompleteMessage } = require('${{ github.workspace }}/release/dist/index.cjs');
+
+            const allJobsSuccessful =
+              '${{ needs.run-sanity-check.result }}' === 'success' &&
+              '${{ needs.check-uberjar-health.result }}' === 'success' &&
+              '${{ needs.verify-docker-pull.result }}' === 'success';
+
+            await sendTestsCompleteMessage({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              version: '${{ inputs.version }}',
+              runId: '${{ github.run_id }}',
+              channelName: '${{ vars.SLACK_RELEASE_CHANNEL }}',
+              testStatus: allJobsSuccessful ? 'success' : 'failure',
+            }).catch(console.error);

.github/workflows/presto-kerberos-integration-test.yml

@@ -1,3 +1,8 @@
+# this file uses MBA https://github.com/metabase/mba to spin up a Metabase
+# instance then runs the test script in the MBA instance sharing the same
+# network to interact with presto container
+# TODO: get rid of MBA and use actions/prepare-backend instead
+
 name: Kerberized Presto Integration Test
 
 on:
@@ -5,10 +10,10 @@ on:
   push:
     branches:
       - master
-      - 'release**'
-      - 'feature**'
+      - "release**"
+      - "feature**"
     tags:
-      - '**'
+      - "**"
 
 jobs:
   files-changed:
@@ -52,7 +57,7 @@ jobs:
           token: ${{ secrets.GITHUB_TOKEN }}
           path: presto-kerberos-docker
       - name: Bring up Presto+Kerberos cluster
-        run: cd presto-kerberos-docker && docker-compose up -d && cd ..
+        run: cd presto-kerberos-docker && docker compose up -d && cd ..
       - name: Run Presto test query from command line (sanity check)
         run: cd presto-kerberos-docker && ./test.sh && cd ..
       # Since we are managing the Docker containers from the GitHub action container, we need to copy all the
@@ -63,6 +68,7 @@ jobs:
         run: docker cp presto-kerberos:/etc/krb5.conf resources
       - name: Copy client.keytab file to resources
         run: docker cp presto-kerberos:/home/presto/client.keytab resources
+
       - name: Checkout mba
         uses: actions/checkout@v4
         with:
@@ -74,11 +80,30 @@ jobs:
         run: ls -latr mba-src
       - name: Symlink mba
         run: cd mba-src && sudo ln -s $(pwd)/src/main.clj /usr/local/bin/mba && chmod +x /usr/local/bin/mba && cd ..
+
       - name: Ensure mba
         run: which mba
+
       - name: Run Metabase via MBA
-        run: /home/runner/work/metabase/metabase/mba-src/src/main.clj --mb . --data-db postgres-data -n example.com up
+        run: mba --mb . --data-db postgres-data -n example.com compose config > mba-compose.yml
+
+      - name: Adjust generated docker-compose config
+        uses: actions/github-script@v7
+        with:
+          script: | #js
+            const fs = require("fs");
+            const config = fs.readFileSync("mba-compose.yml", "utf8");
+            const newConfig = config.replace(
+              /name:\s+example.com/,
+              "name: example.com\n    external: true",
+            );
+            fs.writeFileSync("mba-compose.yml", newConfig);
+
+      - name: Print compose config
+        run: cat mba-compose.yml
+
+      - name: Run mba
+        run: docker compose -f mba-compose.yml up -d
+
       - name: Run test script in MBA instance
-        run: >
-          mba --mb . --data-db postgres-data -n example.com \
-           run .github/scripts/run-presto-kerberos-integration-test.sh
+        run: docker compose -f mba-compose.yml exec metabase .github/scripts/run-presto-kerberos-integration-test.sh

.github/workflows/release-embedding-sdk.yml

@@ -9,7 +9,7 @@ on:
         type: string
         required: true
       git_ref:
-        description: 'Valid git reference e.g. branches, tags, hashes'
+        description: 'A git commit hash that will be used to build the SDK'
         type: string
         required: true
 
@@ -35,7 +35,7 @@ jobs:
 
       - name: check tags
         run: |
-          if [ $(git tag -l | grep $tag) ]
+          if [ $(git tag -l | grep $tag$) ]
           then
             echo "::error::Tag '${{ env.tag }}' already exists. If you expect to run this workflow with the same tag, please remove the tag first and rerun this workflow again."
             exit 1
@@ -89,19 +89,13 @@ jobs:
           ./bin/embedding-sdk/release_utils.bash update_readme ${{ inputs.sdk_version }}
 
       - name: Bump published npm package version
+        # NOTE: this should happen before "Build SDK bundle" as we inject SDK version into the code during build step
         run: |
           ./bin/embedding-sdk/release_utils.bash update_package_json_template ${{ inputs.sdk_version }}
 
-      # TODO: Remove this step after the build utils script is merged to master
-      - name: Upload release utils script, so it can be used later on when checking out `master` branch
-        uses: actions/upload-artifact@v4
-        with:
-          name: release-util
-          path: ./bin/embedding-sdk/release_utils.bash
-
       - name: Update changelog
         run: |
-          yarn embedding-sdk:generate-changelog
+          yarn embedding-sdk:generate-changelog -o changelog-diff
 
       - name: Build SDK bundle
         run: yarn run build-embedding-sdk
@@ -115,11 +109,11 @@ jobs:
           name: metabase-sdk
           path: ./resources/embedding-sdk
 
-      - name: Upload changelog
+      - name: Upload changelog diff
         uses: actions/upload-artifact@v4
         with:
-          name: sdk-changelog
-          path: ./enterprise/frontend/src/embedding-sdk/CHANGELOG.md
+          name: sdk-changelog-diff
+          path: ./changelog-diff
 
   build-jar:
     needs: test
@@ -168,15 +162,8 @@ jobs:
 
       - name: Setup git user
         run: |
-          git config --global user.email "metabase-bot@metabase.com"
-          git config --global user.name "Metabase bot"
-
-      # TODO: Remove this step after the build utils script is merged to master
-      - name: Download release utils script
-        uses: actions/download-artifact@v4
-        with:
-          name: release-util
-          path: ./bin/embedding-sdk/
+          git config --global user.email "github-automation@metabase.com"
+          git config --global user.name "Metabase Automation"
 
       - name: Update readme
         run: |
@@ -186,23 +173,17 @@ jobs:
         run: |
           bash ./bin/embedding-sdk/release_utils.bash update_package_json_template ${{ inputs.sdk_version }}
 
-      - name: Retrieve SDK changelog
+      - name: Retrieve SDK changelog diff
         uses: actions/download-artifact@v4
         with:
-          name: sdk-changelog
+          name: sdk-changelog-diff
 
-      # We need to do this because it's impossible to download an artifact to an existing location
-      - name: Move over the downloaded changelog
+      - name: Update changelog
         run: |
-          mv CHANGELOG.md ./enterprise/frontend/src/embedding-sdk/CHANGELOG.md
+          cat changelog-diff enterprise/frontend/src/embedding-sdk/CHANGELOG.md > new-changelog
+          mv new-changelog enterprise/frontend/src/embedding-sdk/CHANGELOG.md
 
-      - uses: actions/create-github-app-token@v1
-        id: app-token
-        with:
-          app-id: ${{ secrets.METABASE_BOT_APP_ID }}
-          private-key: ${{ secrets.METABASE_BOT_APP_PRIVATE_KEY }}
-
-      - name: Create a PR updating readme + published version, and changelog
+      - name: Create a PR updating readme + published version, and changelog (using GitHub Metabase Automation account)
         run: |
           git checkout -b update-sdk-version-${{ inputs.sdk_version }}
           git commit -a -m 'Update Readme version references and published npm version to ${{ inputs.sdk_version }}'
@@ -211,10 +192,33 @@ jobs:
                        --assignee "${GITHUB_ACTOR}"\
                        --title "Update SDK version to ${{ inputs.sdk_version }}"\
                        --body "Update Readme version references and published npm package version to ${{ inputs.sdk_version }}"
-          gh pr edit --add-reviewer @metabase/embedding
+        env:
+          GH_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+
+      - uses: actions/create-github-app-token@v1
+        id: app-token
+        with:
+          app-id: ${{ secrets.METABASE_BOT_APP_ID }}
+          private-key: ${{ secrets.METABASE_BOT_APP_PRIVATE_KEY }}
+
+      - name: Edit PR adding useful information (using Metabase bot app)
+        run: |
+          gh pr edit --add-reviewer @metabase/embedding --add-label no-backport
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
 
+      - name: Auto approve PR (using GitHub Actions account)
+        run: |
+          gh pr review --approve
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Enable Pull request auto-merge (using GitHub Metabase Automation account)
+        run: |
+          gh pr merge --auto --squash
+        env:
+          GH_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+
       - name: Retrieve build SDK package artifact
         uses: actions/download-artifact@v4
         with:
@@ -239,11 +243,7 @@ jobs:
         with:
           ref: ${{ inputs.git_ref }}
 
-      - name: Setup git user
-        run: |
-          git config --global user.email "metabase-bot@metabase.com"
-          git config --global user.name "Metabase bot"
-
+      # Lightweight tags don't need committer name and email
       - name: Create a new git tag
         run: |
           git tag ${{ env.tag }}

.github/workflows/release-log.yml

@@ -0,0 +1,43 @@
+name: Update Release Log
+run-name: Update Release Log ${{ inputs.version }}
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Major Metabase version (e.g. 45, 52, 68)'
+        type: number
+        required: true
+  schedule:
+    - cron: '45 * * * *' # hourly
+
+jobs:
+  update-release-log:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    env:
+      VERSION: ${{ github.event_name == 'workflow_dispatch' && inputs.version || 50 }} # Update this for the next major release
+    steps:
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-access-key-id: ${{ secrets.AWS_S3_RELEASE_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_S3_RELEASE_SECRET_ACCESS_KEY }}
+          aws-region: ${{ vars.AWS_REGION }}
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0 # we want all branches and tags
+      - name: Install Dependencies
+        run: yarn --cwd release --frozen-lockfile && npm i -g tsx
+      - name: generate release Log
+        run: cd release && tsx ./src/release-log.ts $VERSION > v$VERSION.html
+      - name: upload release log to the web
+        run: |
+          aws s3 cp \
+          release/v$VERSION.html \
+          s3://${{ vars.AWS_S3_STATIC_BUCKET }}/release-log/v$VERSION.html
+      - name: Create cloudfront invalidation
+        run: |
+          aws cloudfront create-invalidation \
+          --distribution-id ${{ vars.AWS_CLOUDFRONT_STATIC_ID }} \
+          --paths /release-log/v$VERSION.html

.github/workflows/release-milestone-check.yml

@@ -0,0 +1,52 @@
+name: Release Milestone Check
+run-name: Pre-release Milestone check for ${{ inputs.version }}
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Metabase version (e.g. v0.46.3)"
+        type: string
+        required: true
+      commit:
+        description: "A full-length commit SHA-1 hash"
+        required: true
+
+jobs:
+  check-milestone:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: release
+      - name: Prepare build scripts
+        run: yarn --cwd release --frozen-lockfile && yarn --cwd release build
+      - uses: actions/github-script@v7
+        env:
+          SLACK_RELEASE_CHANNEL: ${{ vars.SLACK_RELEASE_CHANNEL }}
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+        with:
+          script: | # js
+            const {
+              checkMilestoneForRelease,
+              sendMilestoneCheckMessage,
+            } = require('${{ github.workspace }}/release/dist/index.cjs');
+
+            const version = '${{ inputs.version }}';
+            const commitHash = '${{ inputs.commit }}';
+
+            const issueCount = await checkMilestoneForRelease({
+              github,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              version,
+              commitHash,
+            });
+
+            await sendMilestoneCheckMessage({
+              channelName: process.env.SLACK_RELEASE_CHANNEL,
+              issueCount,
+              version,
+            });

.github/workflows/release-notes-preview.yml

@@ -0,0 +1,55 @@
+name: Release Notes Preview
+run-name: Preview ${{ inputs.version }} release notes
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Metabase version (e.g. v0.46.3)'
+        type: string
+        required: true
+
+jobs:
+  preview-release-notes:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    steps:
+    - name: Fail early on the incorrect version format
+      if: ${{ !(startsWith(inputs.version,'v0.') || startsWith(inputs.version,'v1.')) }}
+      run: |
+        echo "The version format is invalid!"
+        echo "It must start with either 'v0.' or 'v1.'."
+        echo "Please, try again."
+        exit 1
+    - uses: actions/checkout@v4
+      with:
+        sparse-checkout: release
+    - name: Prepare build scripts
+      run: cd ${{ github.workspace }}/release && yarn && yarn build
+    - name: Get Release Version
+      uses: actions/github-script@v7
+      env:
+        DOCKERHUB_OWNER: test_owner
+        DOCKERHUB_REPO: test_repo
+        AWS_S3_DOWNLOADS_BUCKET: test_bucket
+      with:
+        script: | # js
+          const { getChangelog } = require('${{ github.workspace }}/release/dist/index.cjs');
+          const fs = require('fs');
+
+          const version = '${{ inputs.version }}';
+
+          const notes = await getChangelog({
+            version,
+            github,
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+          });
+
+          fs.writeFileSync(`release-notes-preview-${version}.md`, notes);
+    - name: Upload Release Notes
+      uses: actions/upload-artifact@v4
+      with:
+        name: release-notes-preview-${{inputs.version}}.md
+        path: |
+          ${{ github.workspace }}/release-notes-preview-*.md

.github/workflows/release-patch.yml

@@ -0,0 +1,91 @@
+name: Release 1b - Auto Patch
+run-name: Patch Release ${{ inputs.version }}
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Major Metabase version (e.g. 45, 52, 68)'
+        type: number
+        required: true
+  schedule:
+    - cron: '15 0 * * 2-6' # every weekday at 7/8:15 pm Eastern Time
+
+jobs:
+  auto-patch-trigger:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: release
+      - name: Prepare build scripts
+        run: yarn --cwd release --frozen-lockfile && yarn --cwd release build
+      - name: Trigger auto-patch
+        uses: actions/github-script@v7
+        with:
+          script: | # js
+            const {
+              getLatestGreenCommit,
+              getNextPatchVersion,
+              hasCommitBeenReleased,
+            } = require('${{ github.workspace }}/release/dist/index.cjs');
+
+            // Don't forget to update this for the next major release 🤞
+            const AUTO_RELEASE_VERSIONS = [49, 50];
+
+            async function releasePatchFor(majorVersion) {
+              const nextPatch = await getNextPatchVersion({
+                github,
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                majorVersion,
+              });
+
+              const goodCommit = await getLatestGreenCommit({
+                github,
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                branch: `release-x.${majorVersion}.x`,
+              });
+
+              const hasBeenReleased = await hasCommitBeenReleased({
+                github,
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                ref: goodCommit,
+                majorVersion: Number(majorVersion),
+              });
+
+              if (nextPatch && goodCommit && !hasBeenReleased) {
+                await github.rest.actions.createWorkflowDispatch({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  workflow_id: 'tag-for-release.yml',
+                  ref: 'refs/heads/master',
+                  inputs: {
+                    commit: goodCommit,
+                    version: nextPatch,
+                    auto: true,
+                  }
+                });
+              } else {
+                console.log(
+                  { nextPatch, goodCommit, hasBeenReleased }
+                );
+                console.error(`No new patch version or no green commit found for v${majorVersion}`);
+              }
+            }
+
+            if (context.eventName === 'workflow_dispatch') {
+              const inputVersion = Number(context.payload.inputs.version);
+
+              if (typeof inputVersion !== 'number') {
+                console.log('Invalid version number', inputVersion);
+                throw new Error(`Invalid version number: ${inputVersion}`);
+              }
+
+              await releasePatchFor(inputVersion);
+            } else { // scheduled release of AUTO_RELEASE_VERSIONS
+              await Promise.all(AUTO_RELEASE_VERSIONS.map(releasePatchFor));
+            }

.github/workflows/release-status.yml

@@ -1,9 +1,9 @@
-name: Release Status Check
+name: Release and Backport Status Check
 
 on:
   workflow_dispatch:
   schedule:
-    - cron: '0 11 * * 1-5' # every weekday at 6am US eastern time
+    - cron: '0 7 * * 1-5' # every weekday at 8am/9am Central European Time
 
 jobs:
   check-release-status:
@@ -38,3 +38,31 @@ jobs:
             repo: context.repo.repo,
             channelName: process.env.SLACK_RELEASE_CHANNEL,
           });
+
+  open-backport-reminder:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        sparse-checkout: release
+    - name: Prepare build scripts
+      run: cd ${{ github.workspace }}/release && yarn --frozen-lockfile && yarn build
+    - name: Check release status and post to Slack
+      uses: actions/github-script@v7
+      env:
+        SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+      with:
+        script: | # js
+          const { checkOpenBackports } = require('${{ github.workspace }}/release/dist/index.cjs');
+
+          if (!process.env.SLACK_BOT_TOKEN) {
+            throw new Error('SLACK_BOT_TOKEN is required');
+          }
+
+          const ossReleased = await checkOpenBackports({
+            github,
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+            channelName: 'engineering-ci',
+          });

.github/workflows/release-tests.yml

@@ -0,0 +1,72 @@
+name: Release Code Tests
+
+on:
+  push:
+    branches:
+      - "master"
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  files-changed:
+    name: Check which files changed
+    runs-on: ubuntu-22.04
+    timeout-minutes: 3
+    outputs:
+      release_source: ${{ steps.changes.outputs.release_source }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Test which files changed
+        uses: dorny/paths-filter@v3.0.0
+        id: changes
+        with:
+          token: ${{ github.token }}
+          filters: .github/file-paths.yaml
+
+  release-type-check:
+    needs: files-changed
+    if: needs.files-changed.outputs.release_source == 'true'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: "release"
+      - name: prepare dependencies in release directory
+        run: yarn --cwd release --frozen-lockfile
+      - name: Run frontend type-check
+        run: yarn --cwd release type-check
+
+  release-tests-unit:
+    needs: files-changed
+    if: needs.files-changed.outputs.release_source == 'true'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: "release"
+      - name: prepare dependencies in release directory
+        run: yarn --cwd release --frozen-lockfile
+      - name: Run release unit tests
+        run: yarn --cwd release test:unit
+
+  release-test-build:
+    needs: files-changed
+    if: needs.files-changed.outputs.release_source == 'true'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: "release"
+      - name: prepare dependencies in release directory
+        run: yarn --cwd release --frozen-lockfile
+      - name: Build release bundle
+        run: yarn --cwd release build
+      - name: Smoke test release bundle
+        run: node release/dist/index.cjs

.github/workflows/release.yml

@@ -31,6 +31,10 @@ on:
         description: 'Skip publishing release notes'
         type: boolean
         default: false
+      auto:
+        description: 'auto-patch release DO NOT SET MANUALLY'
+        type: boolean
+        default: false
 
 jobs:
   check-version:
@@ -90,6 +94,34 @@ jobs:
 
           return versions;
 
+  publish-start-message:
+    runs-on: ubuntu-22.04
+    needs: [check-version]
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: release
+      - name: Prepare build scripts
+        run: cd ${{ github.workspace }}/release && yarn && yarn build
+      - name: Send publish start message
+        uses: actions/github-script@v7
+        env:
+          SLACK_RELEASE_CHANNEL: ${{ vars.SLACK_RELEASE_CHANNEL }}
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+        with:
+          script: | # js
+            const { sendPublishStartMessage } = require('${{ github.workspace }}/release/dist/index.cjs');
+
+            await sendPublishStartMessage({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              version: '${{ inputs.version }}',
+              runId: '${{ github.run_id }}',
+              channelName: '${{ vars.SLACK_RELEASE_CHANNEL }}',
+            }).catch(console.error);
+
+
   download-uberjar:
     needs: check-version
     runs-on: ubuntu-22.04
@@ -228,7 +260,7 @@ jobs:
     - name: Upload to S3
       run: aws s3 cp ./metabase.jar s3://${{ vars.AWS_S3_DOWNLOADS_BUCKET }}/${{ steps.version_path.outputs.result }}/metabase.jar
     - name: Upload to s3 latest path
-      if: ${{ steps.latest_path.outputs.result != 'false' }}
+      if: ${{ !inputs.auto && steps.latest_path.outputs.result != 'false' }}
       run: aws s3 cp ./metabase.jar s3://${{ vars.AWS_S3_DOWNLOADS_BUCKET }}/${{ steps.latest_path.outputs.result }}/metabase.jar
     - name: Create cloudfront invalidation
       run: |
@@ -374,7 +406,7 @@ jobs:
         echo "Finished!"
 
     - name: Tag the container image as latest
-      if: ${{ steps.latest_version_check.outputs.result == 'latest' }}
+      if: ${{ !inputs.auto && steps.latest_version_check.outputs.result == 'latest' }}
       run: |
         echo "Pushing ${{ env.DOCKERHUB_REPO }}:latest ..."
         docker tag localhost:5000/local-metabase:${{ steps.canonical_version.outputs.result }} ${{ env.DOCKERHUB_REPO }}:latest
@@ -482,16 +514,25 @@ jobs:
         $GITHUB_WORKSPACE/release/reorder-tags.sh ${{ needs.check-version.outputs.ee }} ${{ inputs.commit }}
 
   trigger-docs-update:
-    if: ${{ inputs.skip-release-notes != true }}
-    needs: push-tags
+    if: ${{ !inputs.auto && inputs.skip-release-notes != true }}
+    needs:
+      - push-tags
+      - check-version
     runs-on: ubuntu-22.04
     timeout-minutes: 10
+    permissions:
+      contents: write
+      pull-requests: write
+    env:
+      NEW_OSS_VERSION: ${{ needs.check-version.outputs.oss }}
+      NEW_EE_VERSION: ${{ needs.check-version.outputs.ee }}
+      GH_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
     steps:
       - uses: actions/github-script@v7
         with:
-          github-token: ${{ secrets.DOCS_UPDATE_TOKEN }}
-          script: |
-            github.rest.repos.createDispatchEvent({
+          github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+          script: | # js
+            await github.rest.repos.createDispatchEvent({
               owner: '${{ github.repository_owner }}',
               repo: '${{ secrets.DOCS_REPO }}',
               event_type: 'trigger-docs-update',
@@ -499,9 +540,96 @@ jobs:
                 version: '${{ inputs.version }}'
               }
             });
+      - uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+      - name: update releases.md
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+          script: | # js
+            const fs = require('fs');
+
+            const releaseText = fs.readFileSync('./docs/releases.md', 'utf8');
+
+            const newReleaseText = releaseText
+              .replace(
+                /## Metabase Enterprise Edition releases\n\n/,
+                `## Metabase Enterprise Edition releases\n\n- [${process.env.NEW_EE_VERSION}](https://github.com/metabase/metabase/releases/tag/${process.env.NEW_EE_VERSION})\n`
+              )
+              .replace(
+                /## Metabase Open Source Edition releases\n\n/,
+                `## Metabase Open Source Edition releases\n\n- [${process.env.NEW_OSS_VERSION}](https://github.com/metabase/metabase/releases/tag/${process.env.NEW_OSS_VERSION})\n`
+              );
+
+            fs.writeFileSync('./docs/releases.md', newReleaseText);
+
+      - name: commit and push updates
+        run: | # bash
+          git config --global user.email "metabase-bot@metabase.com"
+          git config --global user.name "Metabase bot"
+
+          git checkout -b docs-add-$NEW_OSS_VERSION
+          cd docs/
+
+          git add releases.md
+          git commit -m "Add $NEW_OSS_VERSION to the list of releases"
+          git push origin docs-add-$NEW_OSS_VERSION --force
+
+      - name: open pr with updates
+        run: | # bash
+          gh pr create --fill \
+            --body "Like it says on the tin 😁" \
+            --label "Type:Documentation" \
+            --label "backport" \
+            --reviewer "jeff-bruemmer" \
+            --assignee "jeff-bruemmer"
+
+  trigger-cloud-issues:
+    needs: push-tags
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+          script: | # js
+            const version = '${{ inputs.version }}';
+            const enterpriseVersion = version.replace(/^v0\./, "v1.");
+
+            github.rest.repos.createDispatchEvent({
+              owner: '${{ github.repository_owner }}',
+              repo: '${{ vars.OPS_REPO }}',
+              event_type: 'create-release-issues',
+              client_payload: {
+                version: enterpriseVersion,
+              }
+            });
+
+  trigger-ee-extra-pr:
+    needs: verify-s3-download
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+          script: | # js
+            const version = '${{ inputs.version }}';
+            const enterpriseVersion = version.replace(/^v0\./, "v1.");
+
+            github.rest.repos.createDispatchEvent({
+              owner: '${{ github.repository_owner }}',
+              repo: 'metabase-ee-extra',
+              event_type: 'update-ee-extra-build',
+              client_payload: {
+                version: enterpriseVersion,
+                auto: '${{ inputs.auto }}',
+              }
+            });
 
   draft-release-notes:
-    if: ${{ inputs.skip-release-notes != true }}
+    if: ${{ !inputs.auto && inputs.skip-release-notes != true }}
     needs: push-tags
     runs-on: ubuntu-22.04
     timeout-minutes: 15
@@ -553,7 +681,7 @@ jobs:
             });
 
   publish-version-info:
-    if: ${{ inputs.skip-version-info != true }}
+    if: ${{ !inputs.auto && inputs.skip-version-info != true }}
     runs-on: ubuntu-22.04
     needs: [push-tags, check-version]
     timeout-minutes: 15
@@ -611,7 +739,66 @@ jobs:
         --distribution-id ${{ vars.AWS_CLOUDFRONT_STATIC_ID }} \
         --paths "/version-info.json" "/version-info-ee.json"
 
+  publish-complete-message:
+    if: ${{ !inputs.auto }}
+    runs-on: ubuntu-22.04
+    needs: [draft-release-notes, verify-docker-pull, verify-s3-download, publish-version-info]
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: release
+      - name: Prepare build scripts
+        run: cd ${{ github.workspace }}/release && yarn && yarn build
+      - name: Send publish complete message
+        uses: actions/github-script@v7
+        env:
+          SLACK_RELEASE_CHANNEL: ${{ vars.SLACK_RELEASE_CHANNEL }}
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+        with:
+          script: | # js
+            const { sendPublishCompleteMessage } = require('${{ github.workspace }}/release/dist/index.cjs');
+
+            await sendPublishCompleteMessage({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              version: '${{ inputs.version }}',
+              runId: '${{ github.run_id }}',
+              channelName: '${{ vars.SLACK_RELEASE_CHANNEL }}',
+              generalChannelName: 'general',
+            }).catch(console.error);
+
+  auto-publish-complete-message:
+    if: ${{ inputs.auto }}
+    runs-on: ubuntu-22.04
+    needs: [push-tags, verify-docker-pull, verify-s3-download]
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: release
+      - name: Prepare build scripts
+        run: cd ${{ github.workspace }}/release && yarn && yarn build
+      - name: Send auto publish complete message
+        uses: actions/github-script@v7
+        env:
+          SLACK_RELEASE_CHANNEL: ${{ vars.SLACK_RELEASE_CHANNEL }}
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+        with:
+          script: | # js
+            const { sendPublishCompleteMessage } = require('${{ github.workspace }}/release/dist/index.cjs');
+
+            await sendPublishCompleteMessage({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              version: '${{ inputs.version }}',
+              runId: '${{ github.run_id }}',
+              channelName: '${{ vars.SLACK_RELEASE_CHANNEL }}',
+              generalChannelName: '',
+            }).catch(console.error);
+
   manage-milestones:
+    if: ${{ !inputs.auto }}
     permissions: write-all
     runs-on: ubuntu-22.04
     needs: [draft-release-notes, publish-version-info] # this will ensure that the milestone stays open until the release notes are published

.github/workflows/rerun-workflows.yml

@@ -2,7 +2,7 @@ name: Re-run Flaky Workflows
 
 on:
   workflow_run:
-    workflows: [Backend, Driver Tests, E2E Tests, Frontend]
+    workflows: [Backend, Driver Tests, E2E Tests, Frontend, Backend-Cloverage]
     types: [completed]
     branches: [master, 'release-x.**', 'backport-**']
 
@@ -10,7 +10,7 @@ jobs:
   rerun-on-failure:
     name: 'Re-run ''${{ github.event.workflow_run.name }}'' workflow'
     runs-on: ubuntu-22.04
-    # Do not re-run scheduled workflow runs. That's only Replay.io E2E tests for now.
+    # Do not re-run scheduled workflow runs
     if: github.event.workflow_run.conclusion == 'failure' && github.event.workflow_run.event != 'schedule'
     env:
       BRANCH_NAME: ${{ github.event.workflow_run.head_branch }}

.github/workflows/security-slack-notification.yml

@@ -0,0 +1,38 @@
+name: Security Issue Slack Notification
+
+on:
+  issues:
+    types:
+      - labeled
+
+jobs:
+  on-issue-opened:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    if: github.event.label.name == 'SECURITY'
+    steps:
+      - name: Setting title
+        uses: actions/github-script@v7
+        id: vars
+        with:
+          script: |
+            core.setOutput('issue_title', ${{ toJson(github.event.issue.title) }}.replaceAll(/"/g, '\\"'));
+      - name: Send the issue ${{ github.event.issue.number }} to Slack
+        id: slack
+        uses: slackapi/slack-github-action@v1.26.0
+        with:
+          payload: |
+            {
+              "blocks": [
+                {
+                  "type": "section",
+                  "text": {
+                    "type": "mrkdwn",
+                    "text": "${{ steps.vars.outputs.issue_title }}\n${{ github.event.issue.html_url }}"
+                  }
+                }
+              ]
+            }
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_SECURITY_WEBHOOK_URL }}
+          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK

.github/workflows/tag-for-release.yml

@@ -0,0 +1,257 @@
+name: Release 1a - Tag Release Artifact
+run-name: Tag ${{ inputs.version }}
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Metabase version (e.g. v0.46.3)'
+        type: string
+        required: true
+      commit:
+        description: 'A full-length commit SHA-1 hash'
+        required: true
+      auto:
+        description: 'auto-patch release DO NOT SET MANUALLY'
+        type: boolean
+        default: false
+
+jobs:
+  start-message:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: release
+      - name: Prepare build scripts
+        run: cd ${{ github.workspace }}/release && yarn && yarn build
+      - name: Send build start message
+        uses: actions/github-script@v7
+        env:
+          SLACK_RELEASE_CHANNEL: ${{ vars.SLACK_RELEASE_CHANNEL }}
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+        with:
+          script: | # js
+            const { sendPreReleaseMessage } = require('${{ github.workspace }}/release/dist/index.cjs');
+
+            await sendPreReleaseMessage({
+              github,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              version: '${{ inputs.version }}',
+              runId: '${{ github.run_id }}',
+              releaseSha: '${{ inputs.commit }}',
+              userName: '${{ github.actor }}',
+              channelName: '${{ vars.SLACK_RELEASE_CHANNEL }}',
+            }).catch(console.error);
+
+  check-version:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    outputs:
+      ee: ${{ fromJson(steps.canonical_version.outputs.result).ee }}
+      oss: ${{ fromJson(steps.canonical_version.outputs.result).oss }}
+    steps:
+    - name: Fail early on the incorrect version format
+      if: ${{ !(startsWith(inputs.version,'v0.') || startsWith(inputs.version,'v1.')) }}
+      run: |
+        echo "The version format is invalid!"
+        echo "It must start with either 'v0.' or 'v1.'."
+        echo "Please, try again."
+        exit 1
+    - uses: actions/checkout@v4
+      with:
+        sparse-checkout: release
+    - name: Prepare build scripts
+      run: cd ${{ github.workspace }}/release && yarn && yarn build
+    - name: Get Release Version
+      uses: actions/github-script@v7
+      id: canonical_version
+      with:
+        script: | # js
+          const { isValidVersionString, getCanonicalVersion, hasBeenReleased } = require('${{ github.workspace }}/release/dist/index.cjs');
+
+          const version = '${{ inputs.version }}';
+
+          if (!isValidVersionString(version)) {
+            throw new Error("The version format is invalid! It must start with either 'v0.' or 'v1.'.");
+          }
+
+          const versions = {
+            ee: getCanonicalVersion(version, 'ee'),
+            oss: getCanonicalVersion(version, 'oss'),
+          };
+
+          const ossReleased = await hasBeenReleased({
+            github,
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+            version: versions.oss,
+          });
+
+          const eeReleased = await hasBeenReleased({
+            github,
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+            version: versions.ee,
+          });
+
+          if (ossReleased || eeReleased) {
+            throw new Error("This version has already been released!", version);
+          }
+
+          return versions;
+
+  check-commit:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    steps:
+    - name: Check out the code to verify the release branch
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0  # IMPORTANT! to get all the branches
+        sparse-checkout: release
+    - name: Prepare build scripts
+      run: cd ${{ github.workspace }}/release && yarn && yarn build
+    - name: Get Release Branch
+      uses: actions/github-script@v7
+      id: release_branch
+      with:
+        result_encoding: string
+        script: | # js
+          const { getReleaseBranch } = require('${{ github.workspace }}/release/dist/index.cjs');
+          const version = '${{ inputs.version }}';
+          const releaseBranch = getReleaseBranch(version);
+          return releaseBranch;
+    - name: Ensure that the specified commit exists in the ${{ steps.release_branch.outputs.result }} release branch
+      run: |
+        RELEASE_BRANCH=${{ steps.release_branch.outputs.result }}
+        git checkout $RELEASE_BRANCH
+        git branch --contains ${{ inputs.commit }} | grep -q $RELEASE_BRANCH \
+          && echo "Commit found in correct release branch" \
+          || (echo "Commit not found in correct release branch" && exit 1)
+
+  tag-uberjar-for-release:
+    needs: [check-version, check-commit]
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    strategy:
+      matrix:
+        edition: [oss, ee]
+    env:
+      INTERACTIVE: false
+    steps:
+    - name: Get correct version number
+      run: | # bash
+        if [ '${{matrix.edition}}' == 'ee' ]; then
+          version='${{ needs.check-version.outputs.ee }}'
+        else
+          version='${{ needs.check-version.outputs.oss }}'
+        fi
+
+        echo "VERSION=$version" >> $GITHUB_ENV
+    - name: Setup Java
+      uses: actions/setup-java@v4
+      with:
+        distribution: 'temurin'
+        java-version: 17 # 11 throws an error on jar uf
+
+    - name: Retrieve test build uberjar artifact for ${{ matrix.edition }}
+      id: find_release_artifact
+      uses: actions/github-script@v7
+      with:
+        result-encoding: string
+        script: | # js
+          const fs = require('fs');
+
+          const artifacts = await github.rest.actions.listArtifactsForRepo({
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+            name: `metabase-${{ matrix.edition }}-${{ inputs.commit }}-uberjar`,
+            per_page: 1,
+          });
+
+          if (!artifacts.data?.artifacts?.[0]?.id) {
+            console.warn(`No existing artifacts found for ${{ inputs.commit }}, need to build jar`);
+
+            if ("${{matrix.edition}}" === 'oss') {
+              // only trigger the build job on OSS, otherwise we'll get double builds
+              github.rest.actions.createWorkflowDispatch({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                workflow_id: 'build-for-release.yml',
+                ref: 'refs/heads/master',
+                inputs: {
+                  commit: '${{ inputs.commit }}',
+                  version: '${{ inputs.version }}',
+                }
+              });
+            }
+
+            throw new Error('aborting in favor of build script');
+          }
+
+          const artifact_id = artifacts.data.artifacts[0].id;
+
+          const download = await github.rest.actions.downloadArtifact({
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+            artifact_id: artifact_id,
+            archive_format: 'zip',
+          });
+
+          fs.writeFileSync(`${process.env.GITHUB_WORKSPACE}/mb.zip`, Buffer.from(download.data));
+    - name: Unzip Metabase artifact containing an uberjar
+      run: |
+        unzip mb.zip
+        mv target/uberjar/metabase.jar metabase.jar
+
+    - name: Update version.properties in jar
+      run: | # sh
+        jar xf metabase.jar version.properties
+        echo "Old version.properties:"
+        cat version.properties
+        sed -i "s/^tag=.*/tag=$VERSION/" version.properties
+        echo "\n\nNew version.properties:"
+        cat version.properties
+        echo "\n\nUpdating metabase.jar with new version.properties"
+        jar uf metabase.jar version.properties
+
+    - name: Store commit's SHA-1 hash
+      run:  echo ${{ inputs.commit }} > COMMIT-ID
+      shell: bash
+    - name: Calculate SHA256 checksum
+      run: sha256sum ./metabase.jar > SHA256.sum
+      shell: bash
+    - name: Upload JARs as artifact
+      uses: actions/upload-artifact@v4
+      with:
+        name: metabase-release-${{ matrix.edition }}-${{ inputs.commit }}-uberjar
+        path: |
+          ./metabase.jar
+          ./COMMIT-ID
+          ./SHA256.sum
+
+  trigger-tests:
+    needs: [tag-uberjar-for-release]
+    permissions:
+      actions: write
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    steps:
+      - name: trigger pre-release testing
+        uses: actions/github-script@v7
+        with:
+          script: | # js
+            github.rest.actions.createWorkflowDispatch({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              workflow_id: 'pre-release.yml',
+              ref: '${{ github.ref }}',
+              inputs: {
+                commit: '${{ inputs.commit }}',
+                version: '${{ inputs.version }}',
+                auto: '${{ inputs.auto }}',
+              }
+            });

.github/workflows/translation-update.yml

@@ -0,0 +1,134 @@
+name: Update Translations
+run-name: Update Translations for v${{ inputs.version }} - ${{ inputs.step }}
+on:
+  workflow_dispatch:
+    inputs:
+      step:
+        type: choice
+        description: Upload untranslated strings | Download translated strings
+        options:
+          - upload
+          - download
+        required: true
+      version:
+        type: string
+        description: "The version number for which to update translations (e.g. 43, 58.7)"
+        required: true
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  upload-translations:
+    name: Upload Translations
+    if: ${{ inputs.step  == 'upload' }}
+    runs-on: ubuntu-22.04
+    timeout-minutes: 20
+    env:
+      POEDITOR_API_TOKEN: ${{ secrets.POEDITOR_API_TOKEN }}
+      POEDITOR_PROJECT_ID: 200535
+      VERSION: ${{ inputs.version }}
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+    - name: Prepare front-end environment
+      uses: ./.github/actions/prepare-frontend
+    - name: Prepare back-end environment
+      uses: ./.github/actions/prepare-backend
+      with:
+        m2-cache-key: manage-translations
+    - name: install gettext
+      run: sudo apt-get install gettext
+
+    # TODO: check for untranslated strings
+
+    - name: Upload strings to be translated
+      run: | # sh
+        ./bin/i18n/update-translation-template
+        ./bin/i18n/export-pot-to-poeditor
+        echo "Strings uploaded to POEditor"
+
+    - name: Commit changes
+      env:
+        GH_TOKEN: ${{ github.token }}
+      run: | # sh
+        git config user.name github-actions
+        git config user.email github-actions@github.com
+
+        BRANCH_NAME="update-translations-v$VERSION"
+
+        git checkout -b $BRANCH_NAME
+        git add locales/
+
+        git commit -m "Add new strings for v$VERSION"
+        git push -u origin $BRANCH_NAME
+
+        gh pr create \
+        --reviewer "${GITHUB_ACTOR}" \
+        --assignee "${GITHUB_ACTOR}" \
+        --title "Update Translations for v$VERSION" \
+        --body "Update translations from POEditor for v$VERSION
+
+        See [translation update documentation](https://www.notion.so/metabase/Process-for-updating-translations-421db70048fe400da1153ad0b61102f4)
+
+        ## To Do
+
+        - [x] Upload new strings to POEditor
+        - [ ] Message contributors on POEditor (manual)
+        - [ ] Copy source strings to english language (manual)
+        - [ ] Download translations from POEditor (github action)
+        - [ ] Merge this PR and backport to the release branch (manual)
+        " \
+        --label "backport" \
+        --label "Customization/i18n"
+
+    # TODO: notify contributors
+    # TODO: copy source strings to english language
+
+  download-translations:
+    name: Download Translations
+    if: ${{ inputs.step == 'download' }}
+    runs-on: ubuntu-22.04
+    timeout-minutes: 20
+    env:
+      POEDITOR_API_TOKEN: ${{ secrets.POEDITOR_API_TOKEN }}
+      POEDITOR_PROJECT_ID: 200535
+      VERSION: ${{ inputs.version }}
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+      with:
+        # assumes there's already a branch with that name from the upload step
+        ref: update-translations-v${{inputs.VERSION}}
+    - name: Prepare back-end environment
+      uses: ./.github/actions/prepare-backend
+      with:
+        m2-cache-key: manage-translations
+
+    - name: Prepare build scripts
+      run: cd ${{ github.workspace }}/release && yarn && yarn build
+    - name: Automatically translate untranslated strings
+      uses: actions/github-script@v7
+      with:
+        script: | # js
+          const { autoTranslateSupportedLanguages } = require('${{ github.workspace }}/release/dist/index.cjs');
+
+          await autoTranslateSupportedLanguages();
+
+    - name: Download translated strings
+      run: | # sh
+        cd ${{ github.workspace }}
+        ./bin/i18n/import-po-from-poeditor
+        ./bin/i18n/build-translation-resources
+    - name: Commit changes
+      run: | # sh
+        git config user.name github-actions
+        git config user.email github-actions@github.com
+
+        BRANCH_NAME="update-translations-v$VERSION"
+
+        git add locales/
+
+        git commit -m "Update translations"
+        git push -u origin $BRANCH_NAME

.github/workflows/tusk-sanity-check.yml

@@ -0,0 +1,72 @@
+# This allows Tusk to manually run workflows to check lint/build/tests before creating a PR.
+# If you have any questions, please reach out to support@usetusk.ai.
+
+name: Tusk Sanity Check
+
+on:
+  workflow_dispatch:
+    inputs:
+      taskId:
+        description: "Tusk Task ID"
+        required: true
+      runType:
+        description: "Tusk Run Type"
+        required: true
+      runId:
+        description: "Tusk Run ID"
+        required: true
+
+jobs:
+  sanity_check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Log inputs
+        run: |
+          echo "Tusk Task ID: ${{ github.event.inputs.taskId }}"
+          echo "Tusk Run Type: ${{ github.event.inputs.runType }}"
+          echo "Tusk Run ID: ${{ github.event.inputs.runId }}"
+          echo "Current Branch: ${{ github.ref }}"
+          echo "Repository default branch: ${{ github.event.repository.default_branch }}"
+
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.ref }}
+          fetch-depth: 0
+
+      - name: Check which files changed
+        uses: dorny/paths-filter@v3.0.0
+        id: changes
+        with:
+          token: ${{ github.token }}
+          filters: .github/file-paths.yaml
+
+      # Similar to .github/workflows/frontend.yml
+      - name: Prepare front-end environment
+        if: steps.changes.outputs.frontend_all == 'true'
+        uses: ./.github/actions/prepare-frontend
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: "cljs"
+      - run: yarn build-pure:cljs
+        name: Compile CLJS
+
+      - name: Run lint-staged
+        if: steps.changes.outputs.frontend_all == 'true'
+        run: |
+          BASE_COMMIT=$(git merge-base origin/${{ github.event.repository.default_branch }} HEAD)
+          npx lint-staged --shell --no-stash --diff="$BASE_COMMIT...HEAD"
+
+      # You must include this step after running all auto-fixing steps
+      - uses: stefanzweifel/git-auto-commit-action@v5
+        with:
+          commit_message: "fix(${{ github.run_id }}): auto linting" # The commit message MUST start with "fix(${{ github.run_id }}):"
+          commit_options: "--no-verify" # No verify because we already ran it above
+          skip_fetch: true
+          skip_checkout: true
+          status_options: "--untracked-files=no"
+          add_options: "--update"
+
+      - name: Check types
+        if: steps.changes.outputs.frontend_all == 'true'
+        run: yarn type-check-pure

.gitignore

@@ -112,3 +112,6 @@ modules/drivers/*/.lsp/*
 
 # airgap
 /resources/airgap/
+
+# swc
+.swc/