Regenerate SDK host app lockfiles with npm 11

fix literal coercion

.claude/skills/fe-modularization/SKILL.md

@@ -0,0 +1,248 @@
+---
+name: fe-modularization
+description: Deciding where frontend code lives — tier model, move mechanics, extension points, side effects, naming, and the traps. Use when moving code between modules, carving new modules, fixing boundary violations, adding a barrel or an endpoint, or reviewing module-shape decisions.
+---
+
+# Frontend modularization
+
+The module is the unit of blast radius: dependency direction, test selection,
+bundle cones, and review scope all follow module boundaries. Every decision
+here serves one goal: **make the file locations tell the truth about who owns
+what and who may depend on whom.**
+
+## Hard rules (check these before anything else)
+
+- NEVER add an `export … from` re-export at an old path, and NEVER `export *`
+  from a barrel. Move the code, codemod every call site, delete the old path,
+  all in the same PR.
+- NEVER import past a module's `index.ts` when that module has
+  `enforcePublicApi: true`, and never past `metabase/ui`'s index at all. If
+  the barrel is heavy, the fix is making the module side-effect free (below),
+  not a deep import.
+- NEVER rewrite a consumer to a lower-level idiom to make the linter pass. If
+  the fix makes the consumer worse, the plan is wrong.
+- NEVER give a new module `enforceSharedTiers: false`; new modules ship
+  enforced with `enforcePublicApi: true` and an explicit `index.ts`.
+- NEVER move code without the consumer-tier check (procedure step 2).
+- ALWAYS delete a module's `enforceSharedTiers: false` line in the PR that
+  takes it to zero violations.
+- ALWAYS measure `bun run module-boundaries` before and after, and report the
+  numbers.
+- ALWAYS import `dayjs` from `metabase/dayjs`, routing from `metabase/router`,
+  Mantine from `metabase/ui`, react-redux hooks from `metabase/redux`; the
+  raw specifiers are lint-forbidden.
+
+## Files that are ground truth
+
+| what | where |
+|---|---|
+| module elements, tiers, `enforceSharedTiers`, `enforcePublicApi` | `frontend/lint/module-boundaries.mjs` |
+| shared sub-tiers and levels, cluster rules | `frontend/lint/shared-tiers.mjs` |
+| standalone boundaries lint (all violations, incl. grandfathered) | `bun run module-boundaries` (config `eslint.config.module-boundaries.mjs`) |
+| PR lint (only enforced modules fail CI) | `bun run lint-eslint-pure` |
+| side-effect-free directories and their exceptions | `frontend/build/shared/rspack/side-effect-free-modules.js` (`SIDE_EFFECT_FREE_PATHS`, `SIDE_EFFECT_PATHS`) |
+| the lint rules that enforce that promise | `metabase/no-module-side-effects`, `metabase/no-base-api-access` in `frontend/lint/eslint-plugin-metabase/rules/` |
+| public-api enforcement | `metabase/enforce-module-public-api` rule, driven by `getPublicApiModules()` |
+
+## The model
+
+Tiers: `lib < basic < shared < feature < app`. Imports point downward, never
+sideways at feature tier (features may not import features; app and EE may
+import anything). The shared tier is subdivided in `shared-tiers.mjs` into
+shared-utils (U0…), shared-platform (P0…), and shared-domain, each ordered
+into levels. A module imports only *strictly lower* levels of its sub-tier
+plus the sub-tiers below; same-level peers are deliberately forbidden, which
+is what makes cycles structurally impossible. A domain may hold two seats
+when consumers demand it: a low core and a high surface (metabase-lib below
+questions below query_builder; viz-core below visualizations).
+
+Enforcement is per module: `enforceSharedTiers: false` on an element exempts
+it from the level rules (counted by `bun run module-boundaries`, invisible to
+PR lint). Modules with `enforcePublicApi: true` may only be imported from
+outside via `metabase/<module>`, and import relatively inside.
+
+## Deciding where code lives (apply in order; first decisive test wins)
+
+1. **Who owns the concept?** Code lives with the module that owns its
+   concept, not the module that renders or calls it. A mode encoding dashboard
+   click behaviour is dashboard code even if viz executes it. Metabot
+   conversation state is metabot state even though the store registers it.
+2. **Consumer-tier check.** The destination must sit at or below the file's
+   *lowest* consumer. A single consumer below the proposed home vetoes the
+   move; report it, don't force it.
+3. **Only four legitimate fixes** for a bad edge: move the code to its
+   terminal home; invert through a designed extension point (a prop, an
+   injected component, a contract type owned by the socket); fix the tier
+   placement when the declared level is wrong; delete a thin wrapper (a rename
+   with no derivation isn't an abstraction — deleting it *is* the migration).
+4. **A bridge lives above the lower endpoint.** Code that needs both sides of
+   a boundary belongs in or above the higher module.
+5. **"Genuinely shared" is proven by consumers.** A shared address needs two
+   or more consumers the tier rules can't serve another way. One consumer
+   pretending to be shared is a feature module at the wrong address.
+
+## Extension points
+
+The socket's owner defines the contract; every plug lives with its extender.
+Visualization owns the `mode` prop and click interfaces, each surface supplies
+its mode; the editor owns its extension contract, metabot supplies tiptap
+extensions; querying owns `TemplateTagsSidebarProps`, parameters implements
+it.
+
+- Prefer plain props/injection at composition sites. `PLUGIN_*` registries are
+  for edition gating; single-reader slots move out to their reading module;
+  slots with many readers live in the module that owns the concept (every
+  slot the whitelabel plugin fills lives in `whitelabel`), tier permitting.
+  Keep contracts type-light so implementations can load lazily.
+- Identical injection at every callsite is acceptable until a fourth consumer
+  or second slot appears; then the composition deserves its own module above
+  both parts. Don't pre-build the wrapper.
+
+## Store shape
+
+A module that has redux state owns it:
+
+- `store/` is private: reducer, plain creators/action types, and selectors,
+  typed against the module's own state (`QueryBuilderStoreState`), never the
+  global `State`. Thunks live in `actions/` and import `store/`, never the
+  reverse.
+- The barrel is the state API: selectors for reads, creators/thunks for
+  writes.
+- Store roots (`reducers-main`, `reducers-public`, the SDK store) import each
+  slice from its module barrel and derive their own state type; no slice
+  registry, no `declare module` merging.
+- Cross-module writes: a callback prop when a composition point exists;
+  otherwise dispatch the owner's exported creator; an event only when the
+  emitter must not know its listeners. Raw `dispatch({ type: "…" })` strings
+  are banned. A reducer or listener matching another module's *internal*
+  action is the coupling to remove.
+- Slices that mirror one endpoint get deleted (the RTK cache is the state); a
+  fold over many sources with one writer (the metadata store) is kept as a
+  module-private slice behind the barrel.
+
+## Endpoints
+
+Endpoints migrate to their owning module via `Api.injectEndpoints` from the
+module's `api/` file (settings, metabot, transforms precedents); `metabase/api`
+trends toward the client only. There is one `Api` object per backend because
+tag invalidation only works within one instance. Consumers reach endpoints
+only through the owner's exports (`useGetCardQuery`, `cardApi.endpoints.…`),
+never by name through the base object; `metabase/no-base-api-access` allows
+injection only in `metabase/api` and `**/api/**` / `**/api.ts`, and reaching by
+name only in `metabase/api` and test support (`invalidateTags` /
+`resetApiState` are fine anywhere). Each endpoint move carries its
+metadata-store hookup: the owner calls `entitiesFetched` from its own
+`onQueryStarted`.
+
+## Import-time side effects
+
+Directories in `SIDE_EFFECT_FREE_PATHS` are marked `sideEffects: false` for
+rspack, so importing one export from their barrel no longer drags the whole
+barrel into a bundle. The price: nothing in those directories may do work at
+import time, or production silently drops it. `metabase/no-module-side-effects`
+enforces this over every listed directory (module-scope calls, writes to
+imported objects or globals, bare imports, control flow at import; escape
+hatches are `/* #__PURE__ */` and the rule's pure-callee list). Files that
+must run at import are listed in `SIDE_EFFECT_PATHS` (files or directories).
+
+- **A library the app configures gets a facade module** owning the vendor
+  import, the registrations, and the types, with the raw specifier
+  lint-forbidden outside it: `metabase/router`, `metabase/ui`,
+  `metabase/redux`, `metabase/dayjs`. Facades are the effect, so they never
+  enter `SIDE_EFFECT_FREE_PATHS`. Never re-register a vendor plugin locally
+  (`dayjs.extend`, `echarts` `use`).
+- **A patch a component needs is an explicit registration module,
+  bare-imported by the provider that needs it** and listed in
+  `SIDE_EFFECT_PATHS` (Mantine's `Popover.Dropdown` replacement, imported by
+  `ThemeProvider`).
+- **Effects with no value to import** (global CSS, polyfills, the CSP nonce,
+  EE plugin bootstrap) live in the entry's side-effects file and nowhere else.
+- **Registries are filled from the composition root at boot**
+  (`initializePlugins`, `registerVisualizations`), never by a module
+  registering itself at import.
+- **RTK injection stays at import**; when a module with an `api/` folder is
+  declared side-effect free, list `<module>/api/` in `SIDE_EFFECT_PATHS`.
+
+## Naming
+
+The feature keeps the plain product-surface name; a shared carve is named for
+what the shared part actually is: the concept when the concept is the shared
+thing (`settings`, `current-user`, `whitelabel`, `dayjs`), or a qualified
+capability when the plain noun is taken (`search-ui`, `metrics-ui`,
+`viz-core`, `data-studio-ui`). Never two modules distinguished only by tier
+prefix; never generic `-shared` / `-feature` suffixes.
+
+## Procedure for a move
+
+1. **Enumerate consumers honestly** (hook-name greps miss the last three):
+   ```
+   grep -rn "metabase/<module>" frontend/src enterprise/frontend/src frontend/test e2e
+   grep -rn "jest.mock(\"metabase/<module>" frontend enterprise/frontend
+   grep -rn "addMatcher(.*<endpoint>" frontend/src enterprise/frontend/src
+   ```
+   plus sibling files importing the moved file relatively. Classify each by
+   module and tier from `module-boundaries.mjs` / `shared-tiers.mjs`.
+2. **Consumer-tier check**: destination at or below the lowest consumer. If
+   not, stop and report the blocking consumer.
+3. **Measure before**: `bun run module-boundaries 2>&1 | tail -1` on the base
+   (write the number down).
+4. **Move**: `git mv`; codemod every importer to `metabase/<module>` (outside)
+   or a relative path (inside); add named exports to the destination barrel
+   for every symbol an outside consumer needs (each must have a real
+   consumer). Delete the old path. If the module didn't exist: add its element
+   in `module-boundaries.mjs` (ordered before any element it's carved from,
+   first match wins), its level in `shared-tiers.mjs`, `enforcePublicApi:
+   true`, an `index.ts`. If the move empties a module's violations, delete
+   its `enforceSharedTiers: false` line. If the module has an `api/` folder
+   and is side-effect free, list `<module>/api/` in `SIDE_EFFECT_PATHS`.
+5. **Verify** (all of these, report the numbers):
+   ```
+   grep -rn "<old path>" frontend enterprise/frontend e2e        # must be empty
+   bunx eslint --no-warn-ignored <touched files>
+   bun run lint-eslint-pure                                       # enforce-module-public-api included
+   bun run type-check-pure
+   bun run test-unit-keep-cljs <touched folders' specs>
+   bun run module-boundaries 2>&1 | tail -1                       # after; no violation may name the new files
+   bun run build-release:static-viz                               # only if viz/static-viz/ui/dayjs touched; hard 3.5 MiB budget
+   ```
+6. **Report**: count before/after (state count-neutral explicitly), the edges
+   removed by file, flags/rules deleted, barrel exports added, anything you
+   skipped and why, and any consumer you found that vetoed part of the move.
+
+## Traps (each has bitten at least once)
+
+- **Late binding.** A bare function reference in a `createSelector` input
+  array, a component identity captured for comparison, a `PLUGIN_*` object
+  read at module scope: all capture at import time and dodge jest spies, EE
+  overrides, and lazy loading. Read at call time (`(_state) => fn()`), or
+  inject.
+- **Plans go stale.** Verify every recipe against current code before
+  executing; things get merged, renamed, or turn out never to have existed.
+  Skip-and-report beats force.
+- **The linter's blind spots**: `export … from` re-exports, bare-specifier
+  packages (custom-viz), pre-seeded caches that never register tags. A grep
+  for the old path is the stronger claim than a green lint run.
+- **Path-keyed baselines reset on rename**: a generated per-file ledger
+  silently loses a file's history when it moves.
+- **A heavy barrel is a bundle hazard until its module is side-effect free.**
+  One constant imported from the `metabase/ui` barrel pulled Mantine into the
+  static-viz bundle and broke its budget; the fix was `SIDE_EFFECT_FREE_PATHS`,
+  never a deep import.
+- **Type augmentation is program-wide.** `declare module "dayjs"` (and
+  similar) makes plugin types available to any file in the same tsconfig, so
+  a passing type-check never proves the setup ran; only importing the facade
+  does.
+- **Environment before diagnosis**: after a dependency-touching merge,
+  `bun install` before declaring a failure real; worktrees share staleness
+  through the node_modules symlink, and a stale `target/cljs_dev` makes
+  `type-check-pure` fail on `metabase-lib/metric/core.ts` (rebuild cljs in the
+  worktree).
+
+## PR shape
+
+One logical change per PR; the body names the specific edges removed (files,
+imports, before/after count) and gives each move's ownership reason in plain
+language a reviewer outside the effort can follow, without campaign labels.
+Stack only for semantic dependency or same-hot-file serialisation, and say
+so. Consider codeowner surface when chunking. Open as a draft until measured
+and green.

.claude/skills/typescript-write/SKILL.md

@@ -75,10 +75,6 @@ description: Write TypeScript and JavaScript code following Metabase coding stan
 - **No comments by default**. Well-named identifiers carry the `what`.
 - **Comments should be concise**. Add a short, concise comment only when the `why` is non-obvious: a workaround, a hidden invariant, a subtle ordering constraint, a clever reduction. Never document the actual implementation, focus on the intent and the why.
 
-## TypeScript Migration
-
-**When touching existing JavaScript files, propose to convert them to TypeScript first**. Create a separate PR for the conversion, then implement the changes.
-
 ## Verify before done
 
 - **Run the project type-check** when finished (see the shared TypeScript commands above).

.clj-kondo/config.edn

@@ -403,6 +403,7 @@
     metabase.channel.render.core              channel.render
     metabase.cloud-migration.core             cloud-migration
     metabase.eid-translation.core             eid-translation
+    metabase.llm.test-util                    llm.tu
     metabase.login-history.core               login-history
     metabase.model-persistence.core           model-persistence
     metabase.notification.core                notification
@@ -799,7 +800,7 @@
    :name    test-namespaces}
   {:pattern "^(?!.*-test(?:\\..*)?$)(?!.*test-util)(?!^metabase\\.test.*).*$"
    :name    source-namespaces}
-  {:pattern "(?:(?:^metabase\\.cmd.*)|(?:^build.*)|(?:^metabuild-common.*)|(?:^release.*)|(?:^i18n.*)|(?:^lint-migrations-file$))|(?:^mage.*)"
+  {:pattern "(?:(?:^metabase\\.cmd.*)|(?:^build.*)|(?:^metabuild-common.*)|(?:^release.*)|(?:^i18n.*)|(?:^lint-migrations-file$))|(?:^mage.*)|(?:^load-namespaces.*)"
    :name    printable-namespaces}
   {:pattern "^metabase\\.(?:(?:lib)|(?:legacy-mbql))\\..*"
    :name    metabase-lib}

.clj-kondo/config/modules/config.edn

@@ -878,6 +878,7 @@
    :uses #{analytics-interface
            app-db
            appearance
+           audit-app
            auth-provider
            classloader
            config
@@ -990,6 +991,11 @@
            util}
    :model-imports #{:model/Card :model/Dashboard :model/DashboardCard :model/EmbeddingTheme}}
 
+  embeddings
+  {:team "Metabot"
+   :api  #{metabase.embeddings.provider metabase.embeddings.startup}
+   :uses #{plugins util}}
+
   entity-retrieval
   {:team "Metabot"
    :api  #{metabase.entity-retrieval.core
@@ -1263,6 +1269,7 @@
   {:team "Metabot"
    :api  #{metabase.llm.api
            metabase.llm.init
+           metabase.llm.provider
            metabase.llm.settings
            metabase.llm.startup}
    :uses #{analytics
@@ -1273,6 +1280,8 @@
            lib-be
            metabot
            models
+           parameters
+           permissions
            premium-features
            request
            settings
@@ -1356,7 +1365,6 @@
   metabot
   {:team    "Metabot"
    :api     #{metabase.metabot.api
-              metabase.metabot.api.entity-analysis
               metabase.metabot.config
               metabase.metabot.core
               metabase.metabot.init
@@ -2044,6 +2052,7 @@
            dashboards
            events
            lib
+           lib-be
            models
            parameters
            queries
@@ -2269,6 +2278,7 @@
               channel
               formatter
               lib
+              llm
               metabot
               permissions
               query-processor
@@ -3111,7 +3121,7 @@
 
   enterprise/cloud-add-ons
   {:team "Cloud"
-   :api  #{metabase-enterprise.cloud-add-ons.api}
+   :api  #{metabase-enterprise.cloud-add-ons.api metabase-enterprise.cloud-add-ons.core}
    :uses #{api
            events
            premium-features
@@ -3201,6 +3211,7 @@
            collections
            config
            driver
+           embeddings
            metabot
            models
            premium-features
@@ -3314,6 +3325,11 @@
            settings
            util}}
 
+  enterprise/embedder
+  {:team "Metabot"
+   :api  #{}
+   :uses #{classloader embeddings util}}
+
   enterprise/embedding-hub
   {:team "Embedding"
    :api  #{metabase-enterprise.embedding-hub.api}
@@ -3407,7 +3423,7 @@
            warehouse-schema
            enterprise/sandbox}
    :model-exports #{:model/ConnectionImpersonation}
-   :model-imports #{:model/DataPermissions :model/PermissionsGroupMembership}}
+   :model-imports #{:model/DataPermissions :model/Database :model/PermissionsGroupMembership}}
 
   enterprise/internal-stats
   {:team "UX West"
@@ -3459,6 +3475,7 @@
               metabot}
    :uses    #{api
               lib-be
+              llm
               metabot
               models
               permissions
@@ -3466,6 +3483,7 @@
               settings
               task
               util
+              enterprise/cloud-add-ons
               enterprise/dependencies
               enterprise/transforms-python}
    :model-imports #{:model/AiUsageLog
@@ -3687,6 +3705,7 @@
            collections
            config
            connection-pool
+           embeddings
            events
            health-inspector
            lib-be
@@ -3706,7 +3725,10 @@
 
   enterprise/serialization
   {:team "Graphy"
-   :api  #{metabase-enterprise.serialization.api metabase-enterprise.serialization.cmd metabase-enterprise.serialization.core}
+   :api  #{metabase-enterprise.serialization.api
+           metabase-enterprise.serialization.cmd
+           metabase-enterprise.serialization.core
+           metabase-enterprise.serialization.init}
    :friends #{enterprise/memoize-monitor}
    :uses #{analytics
            api
@@ -3721,6 +3743,7 @@
            premium-features
            search
            server
+           settings
            setup
            util}
    :model-imports :bypass}
@@ -3747,6 +3770,7 @@
            embedding
            premium-features
            request
+           server
            session
            settings
            sso

.clj-kondo/ratchets.edn

@@ -5,15 +5,15 @@
 ;; to defend in your PR.
 ;; :all is the vector-less ignore form, which suppresses every linter on the next form.
 {:ignore-counts {:aliased-namespace-symbol                                            3
-                 :all                                                                 49
+                 :all                                                                 48
                  :case-symbol-test                                                    1
                  :clojure-lsp/unused-public-var                                       9
                  :def-fn                                                              1
                  :deprecated-namespace                                                95
                  :deprecated-var                                                      84
                  :discouraged-java-method                                             3
-                 :discouraged-namespace                                               80
-                 :discouraged-var                                                     107
+                 :discouraged-namespace                                               81
+                 :discouraged-var                                                     111
                  :equals-true                                                         1
                  :main-without-gen-class                                              1
                  :metabase/defsetting-namespace                                       2
@@ -24,8 +24,8 @@
                  :metabase/namespace-name                                             4
                  :metabase/prefer-with-dynamic-fn-redefs                              28
                  :metabase/test-helpers-use-non-thread-safe-functions                 17
-                 :metabase/validate-defendpoint-has-response-schema                   441
-                 :metabase/validate-defendpoint-query-params-use-kebab-case           47
+                 :metabase/validate-defendpoint-has-response-schema                   440
+                 :metabase/validate-defendpoint-query-params-use-kebab-case           50
                  :metabase/validate-defendpoint-route-uses-kebab-case                 44
                  :metabase/validate-deftest                                           9
                  :missing-docstring                                                   10

.clj-kondo/src/hooks/clojure/core/ns.clj

@@ -71,6 +71,24 @@
   (some-> (ns-form-node->ns-symb-node ns-form-node)
           hooks/sexpr))
 
+(defn- lint-test-parallel-metadata [ns-form-node]
+  (when-let [ns-symb-node (ns-form-node->ns-symb-node ns-form-node)]
+    (let [ns-metadata (meta (hooks/sexpr ns-symb-node))]
+      (cond
+        (:synchronous ns-metadata)
+        (hooks/reg-finding!
+         (assoc (meta ns-symb-node)
+                :message (str "Use `^:synchronized` to mark this namespace explicitly non-parallel; "
+                              "`^:synchronous` is ignored by Hawk. [:metabase/validate-deftest]")
+                :type :metabase/validate-deftest))
+
+        (and (contains? ns-metadata :parallel)
+             (false? (:parallel ns-metadata)))
+        (hooks/reg-finding!
+         (assoc (meta ns-symb-node)
+                :message "Use `^:synchronized` instead of `^{:parallel false}`. [:metabase/validate-deftest]"
+                :type :metabase/validate-deftest))))))
+
 (defn- lint-modules [ns-form-node config]
   (let [ns-symb (ns-form-node->ns-symb ns-form-node)]
     (when-not (modules/ignored-namespace? config ns-symb)
@@ -140,6 +158,7 @@
     lint-requires-on-new-lines
     (lint-modules (modules/config x))
     lint-namespace-name
+    lint-test-parallel-metadata
     lint-jsqlparser-imports)
   x)
 

.clj-kondo/src/hooks/clojure/test.clj

@@ -28,11 +28,11 @@
     (walk form)))
 
 (defn- deftest-check-parallel
-  "1. Check if test is marked ^:parallel / ^:synchronized correctly.
+  "1. Check if test is marked `^:parallel` / `^:synchronized` correctly.
    2. Make sure disallowed forms are not used in ^:parallel tests.
-   3. Disallow ^:parallel tests in namespaces marked ^:synchronous -- the
-      ns marker is the author's blanket promise that nothing inside runs
-      in parallel, so an individual ^:parallel deftest contradicts it."
+   3. Disallow `^:parallel` tests in namespaces marked `^:synchronized` --
+      the ns marker is the author's blanket promise that nothing inside runs
+      in parallel, so an individual `^:parallel` deftest contradicts it."
   [{[_ test-name & body] :children, :as _node} ns-sym config]
   (let [test-metadata     (:meta test-name)
         metadata-sexprs   (map hooks/sexpr test-metadata)
@@ -44,28 +44,48 @@
                            (completing merge)
                            {}
                            metadata-sexprs)
-        parallel?     (:parallel combined-metadata)
-        synchronized? (:synchronized combined-metadata)
-        ns-synchronous? (boolean (:synchronous (meta ns-sym)))]
+        parallel?                  (true? (:parallel combined-metadata))
+        synchronized?              (true? (:synchronized combined-metadata))
+        explicitly-nonparallel?    (or synchronized?
+                                       (and (contains? combined-metadata :parallel)
+                                            (false? (:parallel combined-metadata))))
+        ns-metadata                (meta ns-sym)
+        ns-explicitly-nonparallel? (or (true? (:synchronized ns-metadata))
+                                       (and (contains? ns-metadata :parallel)
+                                            (false? (:parallel ns-metadata))))]
+    (when (and (contains? combined-metadata :parallel)
+               (false? (:parallel combined-metadata)))
+      (hooks/reg-finding! (assoc (meta test-name)
+                                 :message (str "Use `^:synchronized` instead of `^{:parallel false}`. "
+                                               "[:metabase/validate-deftest]")
+                                 :type :metabase/validate-deftest)))
+    (when (:sequential combined-metadata)
+      (hooks/reg-finding! (assoc (meta test-name)
+                                 :message (str "Use `^:synchronized` to mark this test explicitly non-parallel; "
+                                               "`^:sequential` is ignored by Hawk. "
+                                               "[:metabase/validate-deftest]")
+                                 :type :metabase/validate-deftest)))
     (when (and parallel? synchronized?)
       (hooks/reg-finding! (assoc (meta test-name)
-                                 :message "Test should not be marked both ^:parallel and ^:synchronized"
+                                 :message "Test should not be marked both `^:parallel` and `^:synchronized`"
                                  :type :metabase/validate-deftest)))
-    (when (and parallel? ns-synchronous?)
+    (when (and parallel? ns-explicitly-nonparallel?)
       (hooks/reg-finding!
        (assoc (meta test-name)
-              :message (str "Test should not be marked ^:parallel in a namespace marked ^:synchronous -- "
+              :message (str "Test should not be marked `^:parallel` in a namespace marked "
+                            "`^:synchronized` -- "
                             "the ns marker promises no parallel execution. "
-                            "Drop ^:parallel from the deftest, or drop ^:synchronous from the ns. "
+                            "Drop `^:parallel` from the deftest, or drop `^:synchronized` from the ns. "
                             "[:metabase/validate-deftest]")
               :type :metabase/validate-deftest)))
-    ;; only when the custom `:metabase/deftest-not-marked-parallel-or-synchronized` is enabled: complain if tests are
-    ;; not explicitly marked `^:parallel` or `^:synchronized`. This is mostly to encourage people to mark everything
-    ;; `^:parallel` in places like `metabase.lib` tests unless there is a really good reason not to.
-    (when-not (or parallel? synchronized?)
+    ;; Only when the custom `:metabase/deftest-not-marked-parallel-or-synchronized` is enabled:
+    ;; complain if tests are not explicitly marked `^:parallel` or `^:synchronized`. This is
+    ;; mostly to encourage people to mark everything `^:parallel` in places like `metabase.lib`
+    ;; tests unless there is a really good reason not to.
+    (when-not (or parallel? explicitly-nonparallel?)
       (hooks/reg-finding!
        (assoc (meta test-name)
-              :message "Test should be marked either ^:parallel or ^:synchronized"
+              :message "Test should be marked either `^:parallel` or `^:synchronized`"
               :type :metabase/deftest-not-marked-parallel-or-synchronized)))
     (when parallel?
       (doseq [form body]
@@ -153,6 +173,7 @@
          "build."
          "i18n." ; bin/i18n
          "lint-migrations-file-test"
+         "load-namespaces." ; bin/load-namespaces
          "mage."
          "main-test" ; bin/release-list
          "metabase.deps-edn-test"
@@ -232,18 +253,20 @@
 
 (defn use-fixtures
   "Flag `:parallel/unsafe` forms inside fixtures. Skipped when the surrounding
-  namespace is marked `^:synchronous` -- the ns marker is the author's
+  namespace is marked `^:synchronized` -- the ns marker is the author's
   explicit opt-in to a single-threaded test ns where destructive setup is
   safe. Without that opt-in, kondo can't know whether sibling deftests will
   be `^:parallel`, so the conservative default is to flag.
 
   Sister to [[deftest-check-parallel]]: the deftest hook rejects `^:parallel`
-  tests inside a `^:synchronous` ns, so the two checks together form a
-  coherent opt-in: either the whole ns is synchronous (fixtures can be
+  tests inside a `^:synchronized` ns, so the two checks together form a
+  coherent opt-in: either the whole ns is explicitly non-parallel (fixtures can be
   anything; no parallel tests allowed) or it isn't (fixtures must be
   parallel-safe)."
   [{:keys [node config], ns-sym :ns, :as input}]
-  (when-not (:synchronous (meta ns-sym))
+  (when-not (or (true? (:synchronized (meta ns-sym)))
+                (and (contains? (meta ns-sym) :parallel)
+                     (false? (:parallel (meta ns-sym)))))
     (let [linter-config (get-in config [:linters :metabase/validate-deftest])]
       (doseq [form (rest (:children node))]
         (warn-about-disallowed-parallel-forms form linter-config))))

.clj-kondo/src/hooks/common/modules.clj

@@ -71,7 +71,7 @@
   (let [module                (module ns-symb)
         module-api-namespaces (module-api-namespaces config module)
         module-friends        (module-friends config module)]
-    (or (empty? module-api-namespaces)
+    (or (nil? module-api-namespaces)
         (contains? module-api-namespaces ns-symb)
         (contains? module-friends current-module))))
 

.clj-kondo/test/hooks/clojure/core/ns_test.clj

@@ -19,6 +19,19 @@
 (defn- lint-modules [form config]
   (lint-ns form (assoc-in config [:linters :metabase/modules :level] :warning)))
 
+(deftest ^:parallel explicit-nonparallel-namespace-metadata-test
+  (let [config {:linters {:metabase/validate-deftest {:level :warning}}}]
+    (testing "Hawk's supported namespace marker passes"
+      (is (empty? (lint-ns '(ns ^:synchronized example.test) config))))
+    (testing "the verbose Hawk spelling is not accepted as Metabase style"
+      (is (=? [{:type    :metabase/validate-deftest
+                :message #(re-find #"Use `\^:synchronized` instead" %)}]
+              (lint-ns '(ns ^{:parallel false} example.test) config))))
+    (testing "the legacy marker explains that Hawk ignores it"
+      (is (=? [{:type    :metabase/validate-deftest
+                :message #(re-find #"`\^:synchronous` is ignored by Hawk" %)}]
+              (lint-ns '(ns ^:synchronous example.test) config))))))
+
 (deftest ^:parallel module-checker-allowed-modules-test
   (are [task-namespace] (=? [{:message "Module task should not be used in the api module. [:metabase/modules api :uses]"
                               :type :metabase/modules}]
@@ -43,6 +56,16 @@
            '{:metabase/modules {api    {:uses #{search}}
                                 search {:api  #{metabase.search.core}}}}))))
 
+(deftest ^:parallel module-checker-empty-api-test
+  (is (=? [{:message "Namespace metabase.embeddings.core is not an allowed external API namespace for the embeddings module. [:metabase/modules embeddings :api]"
+            :type :metabase/modules}]
+          (lint-modules
+           '(ns metabase.metabot.core
+              (:require
+               [metabase.embeddings.core :as embeddings]))
+           '{:metabase/modules {metabot   {:uses #{embeddings}}
+                                embeddings {:api #{}}}}))))
+
 (deftest ^:parallel module-checker-friends-test
   (is (= []
          (lint-modules

.clj-kondo/test/hooks/clojure/test_test.clj

@@ -21,6 +21,54 @@
                                             #{:athena}}}}})
     (mapv :message @(:findings clj-kondo.impl.utils/*ctx*))))
 
+(defn- parallel-metadata-findings
+  ([form]
+   (parallel-metadata-findings form 'example.test))
+  ([form ns-sym]
+   (let [linters {:metabase/deftest-not-marked-parallel-or-synchronized {:level :warning}
+                  :metabase/validate-deftest                             {:level :warning}}]
+     (binding [clj-kondo.impl.utils/*ctx* {:config     {:linters linters}
+                                           :ignores    (atom nil)
+                                           :findings   (atom [])
+                                           :namespaces (atom {})}]
+       (hooks.clojure.test/deftest {:node   (api/parse-string form)
+                                    :lang   :clj
+                                    :ns     ns-sym
+                                    :config {:linters {:metabase/validate-deftest {}}}})
+       @(:findings clj-kondo.impl.utils/*ctx*)))))
+
+(deftest ^:parallel explicit-nonparallel-metadata-test
+  (testing "Hawk's supported test markers satisfy the explicit metadata linter"
+    (are [metadata] (empty? (parallel-metadata-findings
+                             (format "(deftest %s example-test (is true))" metadata)))
+      "^:parallel"
+      "^:synchronized"))
+  (testing "an unmarked test still gets the opt-in linter's guidance"
+    (is (=? [{:type    :metabase/deftest-not-marked-parallel-or-synchronized
+              :message "Test should be marked either `^:parallel` or `^:synchronized`"}]
+            (parallel-metadata-findings "(deftest example-test (is true))"))))
+  (testing "the unsupported marker explains that Hawk ignores it"
+    (is (some #(and (= (:type %) :metabase/validate-deftest)
+                    (re-find #"ignored by Hawk" (:message %)))
+              (parallel-metadata-findings
+               "(deftest ^:sequential example-test (is true))"))))
+  (testing "the verbose Hawk spelling is not accepted as Metabase style"
+    (is (some #(and (= (:type %) :metabase/validate-deftest)
+                    (re-find #"Use `\^:synchronized` instead" (:message %)))
+              (parallel-metadata-findings
+               "(deftest ^{:parallel false} example-test (is true))"))))
+  (testing "a test cannot request both execution modes"
+    (is (some #(and (= (:type %) :metabase/validate-deftest)
+                    (re-find #"both `\^:parallel` and `\^:synchronized`" (:message %)))
+              (parallel-metadata-findings
+               "(deftest ^:parallel ^:synchronized example-test (is true))"))))
+  (testing "a namespace-level non-parallel promise rejects parallel tests"
+    (is (=? [{:type    :metabase/validate-deftest
+              :message #(re-find #"namespace marked.*`\^:synchronized`" %)}]
+            (parallel-metadata-findings
+             "(deftest ^:parallel example-test (is true))"
+             (with-meta 'example.test {:synchronized true}))))))
+
 (deftest ^:parallel disallow-hardcoded-driver-names-in-tests-test
   (is (= []
          (deftest-warnings

.cljfmt.edn

@@ -12,6 +12,7 @@
   "enterprise/backend"
   "bin/build"
   "bin/lint-migrations-file"
+  "bin/load-namespaces"
   "bin/release-list"
   #_"mage/src"
   #_"mage/test"

.github/CODEOWNERS

@@ -42,6 +42,8 @@ docs/api.json # auto-generated
 docs/configuring-metabase/environment-variables.md # auto-generated
 docs/configuring-metabase/config-template.md # auto-generated
 docs/installation-and-operation/commands.md # auto-generated
+docs/embedding/sdk/api # auto-generated
+docs/embedding/eajs/snippets # auto-generated
 
 # @metabase/devexp
 .github @metabase/devexp

.github/actions/collect-profile/action.yml

@@ -0,0 +1,53 @@
+name: Collect profile
+description: >-
+  Attach a flamegraph and per-test wall times to a job whose tests ran under clj-async-profiler.
+  Does nothing when the run was not profiled.
+
+inputs:
+  profiled:
+    required: true
+    description: >-
+      "true" when the test step ran under the profiler. Passed in rather than read from the
+      environment so the decision stays recorded by the step that made it.
+  artifact-name:
+    required: true
+    description: Name for the uploaded artifact. Must be unique across the jobs of one run.
+
+runs:
+  using: "composite"
+  steps:
+    # Unlike a JUnit failure report, these run on a green build too — a suite that passes slowly is
+    # exactly what profiling is for.
+    - name: Summarize test wall times
+      if: ${{ inputs.profiled == 'true' }}
+      continue-on-error: true
+      shell: bash
+      run: |
+        {
+          echo "### Slowest test namespaces (seconds)"
+          echo '```'
+          grep -h '<testsuite' target/junit/*.xml 2>/dev/null \
+            | sed -E 's|.*<testsuite name="([^"]*)" time="([^"]*)".*|\2 \1|' \
+            | sort -rn | head -25
+          echo '```'
+          echo "### Slowest tests (seconds)"
+          echo '```'
+          grep -h '<testcase' target/junit/*.xml 2>/dev/null \
+            | sed -E 's|.*classname="([^"]*)" name="([^"]*)" time="([^"]*)".*|\3 \1/\2|' \
+            | sort -rn | head -25
+          echo '```'
+        } >> "$GITHUB_STEP_SUMMARY"
+
+    # Only the rendered flamegraph is kept: the raw collapsed stacks it was built from run to
+    # hundreds of MB on a long suite, and are reproducible locally from the same test selection.
+    - name: Upload profile
+      if: ${{ inputs.profiled == 'true' }}
+      continue-on-error: true
+      uses: actions/upload-artifact@v7
+      with:
+        name: ${{ inputs.artifact-name }}
+        path: |
+          target/clj-async-profiler/results/*flamegraph.html
+          target/junit/*.xml
+        retention-days: 14
+        if-no-files-found: warn

.github/actions/get-cache-keys/action.yml

@@ -1,45 +0,0 @@
-name: Get cache keys
-description: |
-  Get deterministic cache keys for Maven and Node.js caches based on the centrally controlled cache prefix,
-  and the suffix based on the runner OS and the current week of the year.
-
-outputs:
-  m2-cache-key:
-    description: "The cache key for the Maven cache."
-    value: ${{ steps.keys-factory.outputs.m2-cache-key }}
-  m2-restore-key:
-    description: "The fallback restore key prefix for the Maven cache."
-    value: ${{ steps.keys-factory.outputs.m2-restore-key }}
-  node-cache-key:
-    description: "The cache key for the Node.js cache."
-    value: ${{ steps.keys-factory.outputs.node-cache-key }}
-  node-restore-key:
-    description: "The fallback restore key prefix for the Node.js cache."
-    value: ${{ steps.keys-factory.outputs.node-restore-key }}
-  eslint-cache-key:
-    description: "The cache key for Eslint cache"
-    value: ${{ steps.keys-factory.outputs.eslint-cache-key }}
-  cypress-cache-key:
-    description: "The cache key for Cypress cache"
-    value: ${{ steps.keys-factory.outputs.cypress-cache-key }}
-
-runs:
-  using: "composite"
-  steps:
-    - name: Generate and output cache keys
-      id: keys-factory
-      run: |
-        M2_CACHE_PREFIX='M2'
-        NODE_CACHE_PREFIX='node-modules'
-        ESLINT_CACHE_PREFIX='eslint'
-        CYPRESS_CACHE_PREFIX='cypress'
-        WEEK_OF_YEAR=$(/bin/date "+%G-%V")
-        CACHE_SUFFIX="${{ runner.os }}-$WEEK_OF_YEAR"
-
-        echo "m2-cache-key=$M2_CACHE_PREFIX-$CACHE_SUFFIX" >> "$GITHUB_OUTPUT"
-        echo "m2-restore-key=$M2_CACHE_PREFIX-" >> "$GITHUB_OUTPUT"
-        echo "node-cache-key=$NODE_CACHE_PREFIX-$CACHE_SUFFIX" >> "$GITHUB_OUTPUT"
-        echo "node-restore-key=$NODE_CACHE_PREFIX-" >> "$GITHUB_OUTPUT"
-        echo "eslint-cache-key=$ESLINT_CACHE_PREFIX-$CACHE_SUFFIX" >> "$GITHUB_OUTPUT"
-        echo "cypress-cache-key=$CYPRESS_CACHE_PREFIX-$CACHE_SUFFIX" >> "$GITHUB_OUTPUT"
-      shell: bash

.github/actions/prepare-backend/action.yml

@@ -32,10 +32,6 @@ runs:
           exit 1
         fi
 
-    - name: Get M2 cache key
-      uses: ./.github/actions/get-cache-keys
-      id: get-cache-keys
-
     - name: Install uv (for Python package installation)
       uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
       with:
@@ -43,14 +39,14 @@ runs:
         version: "0.10.2" # keep in sync with mise.toml
         github-token: ${{ github.token }}
 
+    - name: Cache spec
+      id: cache-spec
+      shell: bash
+      run: .github/scripts/cache-keys.sh | tee -a "$GITHUB_OUTPUT"
+
     - name: Restore M2 cache
       uses: actions/cache/restore@v5
       with:
-        path: |
-          ~/.m2
-          ~/.gitlibs
-          ~/.deps.clj
-          bin/bb
-        key: ${{ steps.get-cache-keys.outputs.m2-cache-key }}
-        restore-keys: |
-          ${{ steps.get-cache-keys.outputs.m2-restore-key }}
+        path: ${{ steps.cache-spec.outputs.m2-path }}
+        key: ${{ steps.cache-spec.outputs.m2-key }}
+        restore-keys: ${{ steps.cache-spec.outputs.m2-restore-key }}

.github/actions/prepare-cypress/action.yml

@@ -25,15 +25,17 @@ runs:
         chrome-version: 144
       id: setup-chrome
 
-    - name: Get cache keys
-      uses: ./.github/actions/get-cache-keys
-      id: get-cache-keys
+    - name: Cache spec
+      id: cache-spec
+      shell: bash
+      run: .github/scripts/cache-keys.sh | tee -a "$GITHUB_OUTPUT"
 
-    - name: Get Cypress cache
+    - name: Restore Cypress binary
       uses: actions/cache/restore@v5
       with:
-        path: ~/.cache/Cypress
-        key: ${{ steps.get-cache-keys.outputs.cypress-cache-key }}
+        path: ${{ steps.cache-spec.outputs.cypress-path }}
+        key: ${{ steps.cache-spec.outputs.cypress-key }}
+        restore-keys: ${{ steps.cache-spec.outputs.cypress-restore-key }}
 
     - name: Ensure that Cypress executable is ready
       run: |

.github/actions/prepare-frontend/action.yml

@@ -16,50 +16,38 @@ runs:
       with:
         node-version: ${{ inputs.node-version }}
 
-    - name: Get cache keys
-      uses: ./.github/actions/get-cache-keys
-      id: get-cache-keys
-
-    - name: Restore M2 cache
-      uses: actions/cache/restore@v5
-      with:
-        path: |
-          ~/.m2
-          ~/.gitlibs
-        key: ${{ steps.get-cache-keys.outputs.m2-cache-key }}
-        restore-keys: |
-          ${{ steps.get-cache-keys.outputs.m2-restore-key }}
-
-    - name: Get bun cache directory
-      id: bun-cache
-      run: |
-        BUN_CACHE_DIR=$(bun pm cache)
-        echo "Bun cache directory: $BUN_CACHE_DIR"
-        echo "dir=$BUN_CACHE_DIR" >> "$GITHUB_OUTPUT"
+    - name: Cache spec
+      id: cache-spec
       shell: bash
+      run: .github/scripts/cache-keys.sh | tee -a "$GITHUB_OUTPUT"
 
-    - name: Restore node_modules cache
+    # The spec names the store path rather than discovering it, so that a job can restore the cache
+    # before bun exists. Exported job-wide rather than per-step because every later bun invocation has
+    # to resolve against the same store. Confirm bun agreed: if the variable stopped taking effect, bun
+    # would fill its default directory and the cache would silently save an empty tree.
+    - name: Point bun at the cached store
+      shell: bash
+      env:
+        STORE: ${{ steps.cache-spec.outputs.bun-store-path }}
+      run: |
+        echo "BUN_INSTALL_CACHE_DIR=$STORE" >> "$GITHUB_ENV"
+        ACTUAL=$(BUN_INSTALL_CACHE_DIR="$STORE" bun pm cache)
+        if [ "$ACTUAL" != "$STORE" ]; then
+          echo "::error::bun reports its store at $ACTUAL, not $STORE; BUN_INSTALL_CACHE_DIR is not taking effect"
+          exit 1
+        fi
+
+    - name: Restore bun store
       uses: actions/cache/restore@v5
-      id: node-modules-cache
       with:
-        path: |
-          ${{ steps.bun-cache.outputs.dir }}
-          node_modules
-        key: ${{ steps.get-cache-keys.outputs.node-cache-key }}
-        restore-keys: |
-          ${{ steps.get-cache-keys.outputs.node-restore-key }}
+        path: ${{ steps.cache-spec.outputs.bun-store-path }}
+        key: ${{ steps.cache-spec.outputs.bun-store-key }}
+        restore-keys: ${{ steps.cache-spec.outputs.bun-store-restore-key }}
 
     # postinstall lifecycle hook can be dangerous in CI so we only run it locally (see package.json)
     # If a job wants to patch packages, it does so explicitly in the CI. This setting is opt-out.
-    # For example, we never want to cache node_modules with patches already applied so cache-generator.yml skips that step.
-    - name: Clean install
-      # Remove the restored node_modules before installing. The os-week cache can
-      # carry a stale tree (for example a different React major), and
-      # `--frozen-lockfile` alone does not prune it. Rebuilding from the cached bun
-      # store gives an exact, lockfile-correct node_modules with no extra download.
-      run: |
-        rm -rf node_modules
-        bun install --frozen-lockfile
+    - name: Install front-end dependencies
+      run: bun install --frozen-lockfile
       shell: bash
     - name: Patch frontend dependencies
       if: inputs.apply-patches == 'true'

.github/actions/report-failures-to-ci-conductor/action.yml

@@ -25,6 +25,7 @@ runs:
         TARGET_BRANCH: ${{ github.event.pull_request.base.ref || github.ref_name }}
         CI_CONDUCTOR_TEST_SUITE: ${{ inputs.test-suite }}
         ADAPTER: ${{ inputs.adapter }}
+        IS_RERUN: ${{ github.run_attempt != '1' }}
       # Keep the path constrained to known entrypoints.
       run: |
         case "$ADAPTER" in

.github/actions/test-driver/action.yml

@@ -101,7 +101,21 @@ runs:
       # vector reaches clojure -X as a single argument.
       run: |
         BASE="clojure -X:dev:ci:${{ inputs.edition }}:${{ inputs.edition }}-dev:drivers:drivers-dev:test"
-        if [ "${{ inputs.granular-rerun }}" = "true" ] && [ "${{ github.run_attempt }}" != "1" ] && [ -s target/failed-tests ]; then
+        # `:profile-tests` overrides `:test`'s exec-fn, so it has to come last. See dev.profile-tests.
+        # The `profiled` output is what the collection steps below key off, so that the decision is
+        # recorded by the step that acts on it rather than re-derived from the environment.
+        if [ "$PROFILE_TESTS" = "true" ]; then
+          echo "Profiling this run; a flamegraph will be attached to the job."
+          echo "profiled=true" >> "$GITHUB_OUTPUT"
+          BASE="$BASE:profile-tests"
+        fi
+        # An explicit selection wins over the rerun narrowing below: it was asked for by hand, on this
+        # attempt. Names may be separated by commas or spaces; hawk wants them as one vector argument.
+        if [ -n "$ONLY_TESTS" ]; then
+          ONLY="[$(echo "$ONLY_TESTS" | tr ',' ' ')]"
+          echo "Running only: $ONLY"
+          $BASE :only "$ONLY"
+        elif [ "${{ inputs.granular-rerun }}" = "true" ] && [ "${{ github.run_attempt }}" != "1" ] && [ -s target/failed-tests ]; then
           echo "Granular rerun of previously-failed tests: $(cat target/failed-tests)"
           $BASE :only "$(cat target/failed-tests)"
         else
@@ -113,8 +127,15 @@ runs:
       # ultimately fails.
       continue-on-error: true
 
+    - name: Collect profile
+      if: ${{ !cancelled() }}
+      uses: ./.github/actions/collect-profile
+      with:
+        profiled: ${{ steps.run-test.outputs.profiled }}
+        artifact-name: ${{ format('profile-{0}{1}', inputs.junit-name, inputs.artifact-suffix && format('-{0}', inputs.artifact-suffix) || '') }}
+
     - name: Report failed tests to ci-conductor
-      if: ${{ !cancelled() && steps.run-test.outcome == 'failure' }}
+      if: ${{ !cancelled() && ( steps.run-test.outcome == 'failure' || github.run_attempt != '1' ) }}
       # This step should NEVER fail the job!
       continue-on-error: true
       uses: ./.github/actions/report-failures-to-ci-conductor

.github/actions/update-cache/action.yml

@@ -1,41 +0,0 @@
-name: Update cache
-description: |
-  Update a GitHub Actions cache based on a provided path and key.
-  If a cache entry already exists for the given key, it is first removed.
-  This ensures immutability of cache entries, and prevents runtime errors.
-
-inputs:
-  path:
-    description: "The path(s) to cache, separated by newlines."
-    required: true
-  key:
-    description: "The cache key to use."
-    required: true
-
-runs:
-  using: "composite"
-  steps:
-    - name: Check if the cache entry exists
-      id: cache-lookup
-      uses: actions/cache/restore@v5
-      with:
-        path: ${{ inputs.path }}
-        key: ${{ inputs.key }}
-        lookup-only: true # Important bit: the action will not fetch anything, just check for the cache existence.
-    - name: Delete the cache entry if it exists
-      if: ${{ steps.cache-lookup.outputs.cache-hit == 'true' }}
-      run: |
-        echo "Cache entry found for key '${{ inputs.key }}'. Deleting it to ensure immutability."
-        gh api \
-          --method DELETE \
-          -H "Accept: application/vnd.github+json" \
-          -H "X-GitHub-Api-Version: 2022-11-28" \
-          /repos/${{ github.repository }}/actions/caches?key=${{ inputs.key }}
-      env:
-        GH_TOKEN: ${{ github.token }}
-      shell: bash
-    - name: Save the new cache entry
-      uses: actions/cache/save@v5
-      with:
-        path: ${{ inputs.path }}
-        key: ${{ inputs.key }}

.github/file-paths.yaml

@@ -222,6 +222,28 @@ cljs:
   - ".github/workflows/cljs.yml"
   - "shadow-cljs.edn"
 
+embedder_plugin:
+  - ".github/actions/prepare-backend/**"
+  - ".github/file-paths.yaml"
+  - ".github/workflows/build-scripts.yml"
+  - "bin/build-embedder-plugin.sh"
+  - "bin/build/src/build/embedder_model.clj"
+  - "bin/build/src/build/plugin_uberjar.clj"
+  - "bin/build/src/build_embedder_plugin.clj"
+  - "deps.edn"
+  - "modules/embedder/**"
+  - "enterprise/backend/src/metabase_enterprise/data_complexity_score/complexity_embedders.clj"
+  - "enterprise/backend/src/metabase_enterprise/data_complexity_score/settings.clj"
+  - "enterprise/backend/src/metabase_enterprise/data_complexity_score/synonym_source.clj"
+  - "enterprise/backend/src/metabase_enterprise/semantic_search/embedding.clj"
+  - "enterprise/backend/src/metabase_enterprise/semantic_search/settings.clj"
+  - "enterprise/backend/test/metabase_enterprise/semantic_search/appdb_pgvector_mode_test.clj"
+  - "enterprise/backend/test/metabase_enterprise/semantic_search/embedding_test.clj"
+  - "src/metabase/embeddings/provider.clj"
+  - "src/metabase/embeddings/startup.clj"
+  - "src/metabase/plugins/**"
+  - "test/metabase/embeddings/embedder_plugin_artifact_test.clj"
+
 serialization_baseline:
   - ".github/workflows/serialization.yml"
   - "test_resources/serialization_baseline/**"

.github/instructions/e2e.instructions.md

@@ -0,0 +1,12 @@
+---
+applyTo: "e2e/**/*.cy.spec.{js,ts}"
+---
+
+# Cypress E2E Spec Review
+
+When reviewing Cypress E2E specs, apply the guidelines in these files:
+
+- `.claude/skills/_shared/cypress-conventions.md`
+- `.claude/skills/e2e-test-review/SKILL.md`
+
+These are in addition to the TypeScript/JavaScript instructions, which also match these files.

.github/scripts/bundle-size-stats-prepare.js

@@ -1,152 +0,0 @@
-/* eslint-disable import/no-commonjs */
-// Prepares the rows the bundle-size stats logger uploads to stats.metabase.com.
-//
-// For each measured (bundle, kind) it computes the delta — raw, gzipped and
-// brotli (as-served) bytes plus percent — against the previously *plotted* data
-// point (restored from a rolling cache), so the deltas can be charted directly.
-// It also decides whether this commit is worth recording at all: a point is kept
-// when the as-served size moved by at least MIN_DELTA_PERCENT, or when a new
-// bundle/kind appears. Only master builds run through here — releases form
-// non-linear lines whose deltas are meaningless, so they're not recorded (their
-// historical sizes are backfilled separately).
-//
-// buildStatsRows is pure (data in, data out) so it can be unit-tested; main()
-// is the thin I/O wrapper that reads env/files and writes the rows, cache and
-// step outputs.
-const fs = require("fs");
-const path = require("path");
-
-const deltaPercent = (current, base) =>
-  base ? Math.round(((current - base) * 10000) / base) / 100 : "";
-
-/**
- * Turn the current measurements + the last plotted point into upload rows, the
- * slim cache rows for the next diff, and the keep/skip decision.
- *
- * The significance threshold tracks the as-served size: brotli where the build
- * ships a precompressed .br, otherwise gzip. Current measurements always carry
- * brotliBytes (estimated when no .br shipped), but a cached base point recorded
- * before brotli logging may not, so the delta still falls back to gzip per row.
- */
-function buildStatsRows({ measurements, previous, threshold, date, commit, commitMessage, version }) {
-  const previousOf = (bundle, kind) => previous.find(row => row.bundle === bundle && row.kind === kind);
-
-  let maxServedDeltaPercent = 0;
-  let hasNewSeries = false;
-
-  const rows = measurements.map(measurement => {
-    const base = previousOf(measurement.bundle, measurement.kind);
-    const hasBrotli = measurement.brotliBytes != null && base?.brotliBytes != null;
-    const gzipDeltaPercent = deltaPercent(measurement.gzipBytes, base?.gzipBytes);
-    const brotliDeltaPercent = hasBrotli ? deltaPercent(measurement.brotliBytes, base.brotliBytes) : "";
-    if (!base) {
-      hasNewSeries = true;
-    } else {
-      const servedDeltaPercent = hasBrotli ? brotliDeltaPercent : gzipDeltaPercent;
-      maxServedDeltaPercent = Math.max(maxServedDeltaPercent, Math.abs(servedDeltaPercent));
-    }
-    return {
-      "Date": date,
-      "Version": version,
-      "Commit": commit,
-      "Bundle": measurement.bundle,
-      "Kind": measurement.kind, // "initial" or "total"
-      // The stats table carries a free-text Description column; append-csv
-      // requires every table column to be present. Populate it with the commit
-      // subject so the chart's points are self-describing.
-      "Description": commitMessage,
-      "Raw bytes": measurement.rawBytes,
-      "Gzip bytes": measurement.gzipBytes,
-      "Brotli bytes": measurement.brotliBytes, // as-served (shipped .br, else estimated)
-      "File count": measurement.fileCount,
-      "Raw bytes delta": base ? measurement.rawBytes - base.rawBytes : "",
-      "Gzip bytes delta": base ? measurement.gzipBytes - base.gzipBytes : "",
-      "Brotli bytes delta": hasBrotli ? measurement.brotliBytes - base.brotliBytes : "",
-      "Raw delta %": deltaPercent(measurement.rawBytes, base?.rawBytes),
-      "Gzip delta %": gzipDeltaPercent,
-      "Brotli delta %": brotliDeltaPercent,
-    };
-  });
-
-  const firstPoint = previous.length === 0;
-  const significant = firstPoint || hasNewSeries || maxServedDeltaPercent >= threshold;
-
-  // Slim rows the next run diffs against. The workflow only persists this to the
-  // cache when we actually push, so the cached reference always stays the last
-  // *plotted* point (cumulative drift is caught).
-  const cacheRows = measurements.map(({ bundle, kind, rawBytes, gzipBytes, brotliBytes }) => ({
-    bundle,
-    kind,
-    rawBytes,
-    gzipBytes,
-    brotliBytes,
-  }));
-
-  const reason = firstPoint
-    ? "first point"
-    : hasNewSeries
-      ? "new bundle/kind series"
-      : `max served Δ ${maxServedDeltaPercent.toFixed(2)}% (threshold ${threshold}%)`;
-
-  return { rows, cacheRows, significant, reason, maxServedDeltaPercent, firstPoint, hasNewSeries };
-}
-
-module.exports = { buildStatsRows };
-
-const readJson = filePath => (filePath && fs.existsSync(filePath) ? JSON.parse(fs.readFileSync(filePath, "utf8")) : null);
-const writeJson = (filePath, value) => {
-  fs.mkdirSync(path.dirname(filePath), { recursive: true });
-  fs.writeFileSync(filePath, JSON.stringify(value));
-};
-const setOutput = (env, name, value) => {
-  if (env.GITHUB_OUTPUT) {
-    fs.appendFileSync(env.GITHUB_OUTPUT, `${name}=${value}\n`);
-  }
-};
-
-// version.properties (extracted from the uberjar) carries the build's tag.
-// Non-release (master) builds report tag=vUNKNOWN, so leave Version empty there.
-function readVersion(versionPropsPath) {
-  const raw =
-    versionPropsPath && fs.existsSync(versionPropsPath)
-      ? (fs.readFileSync(versionPropsPath, "utf8").match(/^tag=(.*)$/m)?.[1]?.trim() ?? "")
-      : "";
-  return raw === "vUNKNOWN" ? "" : raw;
-}
-
-function main() {
-  const env = process.env;
-
-  const measurements = readJson(env.CURRENT);
-  if (!Array.isArray(measurements) || measurements.length === 0) {
-    console.error(`::error::No bundle measurements found at ${env.CURRENT}`);
-    process.exit(1);
-  }
-
-  const result = buildStatsRows({
-    measurements,
-    // The last plotted point, as slim rows: [{ bundle, kind, rawBytes, gzipBytes, brotliBytes }].
-    previous: readJson(env.LAST) || [],
-    threshold: Number(env.MIN_DELTA_PERCENT ?? 1),
-    date: new Date().toISOString().slice(0, 10), // YYYY-MM-DD
-    commit: (env.HEAD_SHA || "").slice(0, 12),
-    commitMessage: (env.COMMIT_MESSAGE || "").split("\n")[0], // subject line only
-    version: readVersion(env.VERSION_PROPS),
-  });
-
-  writeJson(env.ROWS_OUT, result.rows);
-  writeJson(env.CACHE_OUT, result.cacheRows);
-
-  console.log(`${result.significant ? "RECORD" : "SKIP"} — ${result.reason}`);
-
-  setOutput(env, "significant", result.significant ? "true" : "false");
-  setOutput(
-    env,
-    "max_delta_percent",
-    result.firstPoint || result.hasNewSeries ? "" : result.maxServedDeltaPercent.toFixed(2),
-  );
-}
-
-if (require.main === module) {
-  main();
-}

.github/scripts/bundle-size-stats-prepare.ts

@@ -0,0 +1,225 @@
+// Prepares the rows the bundle-size stats logger imports into eng-stats-importer.
+//
+// For each measured (bundle, kind) it computes the delta — raw, gzipped and
+// brotli (as-served) bytes plus percent — against the previously *plotted* data
+// point (restored from a rolling cache), so the deltas can be charted directly.
+// It also decides whether this commit is worth recording at all: a point is kept
+// when the as-served size moved by at least MIN_DELTA_PERCENT, or when a new
+// bundle/kind appears. Only master builds run through here — releases form
+// non-linear lines whose deltas are meaningless, so they're not recorded (their
+// historical sizes are backfilled separately).
+//
+// buildStatsRows is pure (data in, data out) so it can be unit-tested; main()
+// is the thin I/O wrapper that reads env/files and writes the rows, cache and
+// step outputs.
+import {
+  appendFileSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  writeFileSync,
+} from "node:fs";
+import { dirname } from "node:path";
+
+/** One measurement emitted by measure-bundle-sizes. */
+export interface Measurement {
+  bundle: string;
+  kind: "initial" | "total";
+  rawBytes: number;
+  gzipBytes: number;
+  brotliBytes: number;
+  fileCount: number;
+}
+
+/**
+ * The slim row cached between runs, holding the last *plotted* point.
+ * `brotliBytes` is optional because a point cached before brotli logging
+ * landed does not carry it — see buildStatsRows' per-row gzip fallback.
+ */
+export type CacheRow = Pick<Measurement, "bundle" | "kind" | "rawBytes" | "gzipBytes"> & {
+  brotliBytes?: number;
+};
+
+export interface BuildStatsRowsInput {
+  measurements: Measurement[];
+  previous: CacheRow[];
+  threshold: number;
+  date: string;
+  commit: string;
+  commitMessage: string;
+  version: string;
+}
+
+/** An upload row, keyed by the importer's column display names. */
+export type StatsRow = Record<string, string | number | null>;
+
+export interface BuildStatsRowsResult {
+  rows: StatsRow[];
+  cacheRows: CacheRow[];
+  significant: boolean;
+  reason: string;
+  maxServedDeltaPercent: number;
+  firstPoint: boolean;
+  hasNewSeries: boolean;
+}
+
+// null, not "", for an absent delta: the stats importer coerces values
+// strictly and rejects "" for a numeric column.
+const deltaPercent = (current: number, base: number | undefined | null): number | null =>
+  base ? Math.round(((current - base) * 10000) / base) / 100 : null;
+
+/**
+ * Turn the current measurements + the last plotted point into upload rows, the
+ * slim cache rows for the next diff, and the keep/skip decision.
+ *
+ * The significance threshold tracks the as-served size: brotli where the build
+ * ships a precompressed .br, otherwise gzip. Current measurements always carry
+ * brotliBytes (estimated when no .br shipped), but a cached base point recorded
+ * before brotli logging may not, so the delta still falls back to gzip per row.
+ */
+export function buildStatsRows({
+  measurements,
+  previous,
+  threshold,
+  date,
+  commit,
+  commitMessage,
+  version,
+}: BuildStatsRowsInput): BuildStatsRowsResult {
+  const previousOf = (bundle: string, kind: string) =>
+    previous.find((row) => row.bundle === bundle && row.kind === kind);
+
+  let maxServedDeltaPercent = 0;
+  let hasNewSeries = false;
+
+  const rows = measurements.map((measurement): StatsRow => {
+    const base = previousOf(measurement.bundle, measurement.kind);
+    // Non-null only when BOTH sides carry brotli: a point cached before brotli
+    // logging landed has none, and that row falls back to the gzip delta.
+    const baseBrotli =
+      measurement.brotliBytes != null && base?.brotliBytes != null ? base.brotliBytes : null;
+    const gzipDeltaPercent = deltaPercent(measurement.gzipBytes, base?.gzipBytes);
+    const brotliDeltaPercent =
+      baseBrotli != null ? deltaPercent(measurement.brotliBytes, baseBrotli) : null;
+    if (!base) {
+      hasNewSeries = true;
+    } else {
+      const servedDeltaPercent = baseBrotli != null ? brotliDeltaPercent : gzipDeltaPercent;
+      maxServedDeltaPercent = Math.max(maxServedDeltaPercent, Math.abs(servedDeltaPercent ?? 0));
+    }
+    return {
+      Date: date,
+      Version: version,
+      Commit: commit,
+      Bundle: measurement.bundle,
+      Kind: measurement.kind, // "initial" or "total"
+      // The stats table carries a free-text Description column. Populate it
+      // with the commit subject so the chart's points are self-describing.
+      Description: commitMessage,
+      "Raw bytes": measurement.rawBytes,
+      "Gzip bytes": measurement.gzipBytes,
+      "Brotli bytes": measurement.brotliBytes, // as-served (shipped .br, else estimated)
+      "File count": measurement.fileCount,
+      "Raw bytes delta": base ? measurement.rawBytes - base.rawBytes : null,
+      "Gzip bytes delta": base ? measurement.gzipBytes - base.gzipBytes : null,
+      "Brotli bytes delta": baseBrotli != null ? measurement.brotliBytes - baseBrotli : null,
+      "Raw delta %": deltaPercent(measurement.rawBytes, base?.rawBytes),
+      "Gzip delta %": gzipDeltaPercent,
+      "Brotli delta %": brotliDeltaPercent,
+    };
+  });
+
+  const firstPoint = previous.length === 0;
+  const significant = firstPoint || hasNewSeries || maxServedDeltaPercent >= threshold;
+
+  // Slim rows the next run diffs against. The workflow only persists this to the
+  // cache when we actually push, so the cached reference always stays the last
+  // *plotted* point (cumulative drift is caught).
+  const cacheRows = measurements.map(
+    ({ bundle, kind, rawBytes, gzipBytes, brotliBytes }): CacheRow => ({
+      bundle,
+      kind,
+      rawBytes,
+      gzipBytes,
+      brotliBytes,
+    }),
+  );
+
+  const reason = firstPoint
+    ? "first point"
+    : hasNewSeries
+      ? "new bundle/kind series"
+      : `max served Δ ${maxServedDeltaPercent.toFixed(2)}% (threshold ${threshold}%)`;
+
+  return {
+    rows,
+    cacheRows,
+    significant,
+    reason,
+    maxServedDeltaPercent,
+    firstPoint,
+    hasNewSeries,
+  };
+}
+
+const readJson = <T,>(filePath: string | undefined): T | null =>
+  filePath && existsSync(filePath) ? (JSON.parse(readFileSync(filePath, "utf8")) as T) : null;
+
+const writeJson = (filePath: string, value: unknown) => {
+  mkdirSync(dirname(filePath), { recursive: true });
+  writeFileSync(filePath, JSON.stringify(value));
+};
+
+const setOutput = (name: string, value: string) => {
+  if (process.env.GITHUB_OUTPUT) {
+    appendFileSync(process.env.GITHUB_OUTPUT, `${name}=${value}\n`);
+  }
+};
+
+// version.properties (extracted from the uberjar) carries the build's tag.
+// Non-release (master) builds report tag=vUNKNOWN, so leave Version empty there.
+function readVersion(versionPropsPath: string | undefined): string {
+  const raw =
+    versionPropsPath && existsSync(versionPropsPath)
+      ? (readFileSync(versionPropsPath, "utf8").match(/^tag=(.*)$/m)?.[1]?.trim() ?? "")
+      : "";
+  return raw === "vUNKNOWN" ? "" : raw;
+}
+
+export function main() {
+  const env = process.env;
+
+  const measurements = readJson<Measurement[]>(env.CURRENT);
+  if (!Array.isArray(measurements) || measurements.length === 0) {
+    console.error(`::error::No bundle measurements found at ${env.CURRENT}`);
+    process.exit(1);
+  }
+
+  const result = buildStatsRows({
+    measurements,
+    // The last plotted point, as slim rows: [{ bundle, kind, rawBytes, gzipBytes, brotliBytes }].
+    previous: readJson<CacheRow[]>(env.LAST) || [],
+    threshold: Number(env.MIN_DELTA_PERCENT ?? 1),
+    date: new Date().toISOString().slice(0, 10), // YYYY-MM-DD
+    commit: (env.HEAD_SHA || "").slice(0, 12),
+    commitMessage: (env.COMMIT_MESSAGE || "").split("\n")[0], // subject line only
+    version: readVersion(env.VERSION_PROPS),
+  });
+
+  writeJson(env.ROWS_OUT!, result.rows);
+  writeJson(env.CACHE_OUT!, result.cacheRows);
+
+  console.log(`${result.significant ? "RECORD" : "SKIP"} — ${result.reason}`);
+
+  setOutput("significant", result.significant ? "true" : "false");
+  setOutput(
+    "max_delta_percent",
+    result.firstPoint || result.hasNewSeries ? "" : result.maxServedDeltaPercent.toFixed(2),
+  );
+}
+
+// Only run the I/O wrapper when invoked directly, so importing buildStatsRows
+// (from the spec) has no side effects.
+if ((import.meta as ImportMeta & { main?: boolean }).main) {
+  main();
+}

.github/scripts/bundle-size-stats-prepare.unit.spec.ts

@@ -1,7 +1,16 @@
-const { buildStatsRows } = require("./bundle-size-stats-prepare");
+import {
+  buildStatsRows,
+  type CacheRow,
+  type Measurement,
+} from "./bundle-size-stats-prepare";
 
-const meta = { date: "2026-06-30", commit: "abc123", commitMessage: "Fix the thing (#123)", version: "" };
-const measurement = (over = {}) => ({
+const meta = {
+  date: "2026-06-30",
+  commit: "abc123",
+  commitMessage: "Fix the thing (#123)",
+  version: "",
+};
+const measurement = (over: Partial<Measurement> = {}): Measurement => ({
   bundle: "embedding-sdk-chunked",
   kind: "total",
   rawBytes: 1000,
@@ -23,8 +32,8 @@ describe("buildStatsRows", () => {
     expect(result.firstPoint).toBe(true);
     expect(result.significant).toBe(true);
     expect(result.reason).toBe("first point");
-    expect(result.rows[0]["Gzip bytes delta"]).toBe("");
-    expect(result.rows[0]["Brotli delta %"]).toBe("");
+    expect(result.rows[0]["Gzip bytes delta"]).toBeNull();
+    expect(result.rows[0]["Brotli delta %"]).toBeNull();
     expect(result.rows[0]["Description"]).toBe("Fix the thing (#123)");
     expect(result.cacheRows[0]).toEqual({
       bundle: "embedding-sdk-chunked",
@@ -49,7 +58,15 @@ describe("buildStatsRows", () => {
   });
 
   it("gates significance on the brotli (as-served) delta when both sides have it", () => {
-    const previous = [{ bundle: "embedding-sdk-chunked", kind: "total", rawBytes: 1000, gzipBytes: 400, brotliBytes: 300 }];
+    const previous: CacheRow[] = [
+      {
+        bundle: "embedding-sdk-chunked",
+        kind: "total",
+        rawBytes: 1000,
+        gzipBytes: 400,
+        brotliBytes: 300,
+      },
+    ];
 
     const big = buildStatsRows({
       ...meta,
@@ -75,13 +92,14 @@ describe("buildStatsRows", () => {
     const result = buildStatsRows({
       ...meta,
       measurements: [measurement({ gzipBytes: 440, brotliBytes: 300 })], // gzip +10%
+      // No brotliBytes: this point was cached before brotli logging landed.
       previous: [{ bundle: "embedding-sdk-chunked", kind: "total", rawBytes: 1000, gzipBytes: 400 }],
       threshold: 1,
     });
 
     expect(result.maxServedDeltaPercent).toBeCloseTo(10);
     expect(result.significant).toBe(true);
-    expect(result.rows[0]["Brotli bytes delta"]).toBe(""); // no base brotli to diff against
+    expect(result.rows[0]["Brotli bytes delta"]).toBeNull(); // no base brotli to diff against
     expect(result.rows[0]["Gzip delta %"]).toBeCloseTo(10);
   });
 });

.github/scripts/cache-keys.sh

@@ -0,0 +1,145 @@
+#!/usr/bin/env bash
+# Single definition of every CI dependency cache: what it holds, what identifies it, what it falls back to.
+#
+# A GitHub cache entry is identified by its key, a hash of the declared path list, and the ref that saved
+# it. A step declaring a different path list than the one a cache was saved with computes a different
+# identity and can never match it, whatever its key says. So paths and keys are emitted together here and
+# every cache step takes both from this script.
+#
+# Emits `name=value` lines in $GITHUB_OUTPUT format:
+#
+#   .github/scripts/cache-keys.sh >> "$GITHUB_OUTPUT"
+#
+# Run it with no redirect to see the whole scheme, or pass one name to print a single value:
+#
+#   .github/scripts/cache-keys.sh
+#   .github/scripts/cache-keys.sh m2-key
+#
+# Hashes are computed here rather than with GitHub's hashFiles() so that a local run and a CI run of the
+# same commit produce the same keys, and so that an empty match can fail loudly - a hashFiles() call that
+# matches nothing silently yields "", collapsing the key onto its own restore prefix and pointing every
+# dependency set at one entry.
+
+set -euo pipefail
+
+cd "$(git rev-parse --show-toplevel)"
+
+OS="${RUNNER_OS:-$(uname -s)}"
+[ "$OS" = "Darwin" ] && OS="macOS"
+
+sha256() {
+  if command -v sha256sum >/dev/null 2>&1; then
+    sha256sum | cut -d' ' -f1
+  else
+    shasum -a 256 | cut -d' ' -f1
+  fi
+}
+
+# Digest of a set of files: hash each one, then hash the concatenation, so the result depends on every
+# file's contents and on which files exist.
+digest() {
+  local f
+  if [ "$#" -eq 0 ]; then
+    echo "::error::cache-keys.sh: no files matched; refusing to emit a key that would collide across dependency sets" >&2
+    exit 1
+  fi
+  for f in "$@"; do
+    [ -f "$f" ] || { echo "::error::cache-keys.sh: $f does not exist" >&2; exit 1; }
+    sha256 < "$f"
+  done | sha256
+}
+
+shopt -s nullglob
+DEPS_FILES=(deps.edn modules/drivers/deps.edn modules/drivers/*/deps.edn)
+shopt -u nullglob
+
+DEPS_HASH="$(digest "${DEPS_FILES[@]}")"
+LOCK_HASH="$(digest bun.lock)"
+
+# The Cypress binary depends on the Cypress version alone, so keying it on the whole lockfile would
+# throw away a 200MB download every time any frontend dependency moved.
+#
+# Reading a version out of a lockfile with a regex is only safe while exactly one line matches. Insist
+# on that rather than taking the first of several: a second match means the format moved under us, and
+# picking one at random would key the binary under a version it is not.
+CYPRESS_VERSIONS="$(sed -n 's/.*"cypress": \["cypress@\([^"]*\)".*/\1/p' bun.lock)"
+CYPRESS_MATCHES="$(printf '%s\n' "$CYPRESS_VERSIONS" | grep -c . || true)"
+if [ "$CYPRESS_MATCHES" != "1" ]; then
+  echo "::error::cache-keys.sh: expected exactly one resolved cypress version in bun.lock, found $CYPRESS_MATCHES" >&2
+  exit 1
+fi
+CYPRESS_VERSION="$CYPRESS_VERSIONS"
+
+# An incremental lint cache is only ever an accelerator, so it keys on the commit and always falls back
+# to the newest entry on the prefix. The exact key never pre-exists, which keeps the entry current.
+ESLINT_SHA="${GITHUB_SHA:-$(git rev-parse HEAD)}"
+
+emit_multiline() {
+  local name="$1"; shift
+  printf '%s<<CACHE_KEYS_EOF\n' "$name"
+  printf '%s\n' "$@"
+  printf 'CACHE_KEYS_EOF\n'
+}
+
+# Paths under the home directory are emitted absolute rather than as `~/...`. actions/cache would expand
+# a tilde, but a shell assigning one of these to a variable would not, and would go on to create a
+# directory named `~`. Paths inside the checkout stay relative; actions/cache resolves those against the
+# workspace.
+spec() {
+  emit_multiline m2-path "$HOME/.m2" "$HOME/.gitlibs" "$HOME/.deps.clj" 'bin/bb'
+  echo "m2-key=M2-$OS-$DEPS_HASH"
+  echo "m2-restore-key=M2-$OS-"
+
+  # Pinned rather than discovered via `bun pm cache` so that the path is known before bun is installed;
+  # prepare-frontend exports BUN_INSTALL_CACHE_DIR to match and fails if bun disagrees.
+  echo "bun-store-path=$HOME/.bun/install/cache"
+  echo "bun-store-key=bun-store-$OS-$LOCK_HASH"
+  echo "bun-store-restore-key=bun-store-$OS-"
+
+  echo "cypress-path=$HOME/.cache/Cypress"
+  echo "cypress-key=cypress-$OS-$CYPRESS_VERSION"
+  echo "cypress-restore-key=cypress-$OS-"
+
+  echo "eslint-path=.eslintcache"
+  echo "eslint-key=eslint-$OS-$ESLINT_SHA"
+  echo "eslint-restore-key=eslint-$OS-"
+}
+
+# Print one output's value, including the multiline form, and fail on a name that does not exist. A
+# caller that silently received "" would go on to build a key with a hole in it.
+query() {
+  local want="$1" line delim found=0 in_block=0
+  while IFS= read -r line; do
+    if [ "$in_block" = 1 ]; then
+      if [ "$line" = "$delim" ]; then
+        in_block=0
+      else
+        printf '%s\n' "$line"
+      fi
+      continue
+    fi
+    case "$line" in
+      "$want="*)
+        printf '%s\n' "${line#*=}"
+        found=1
+        ;;
+      "$want<<"*)
+        delim="${line#*<<}"
+        in_block=1
+        found=1
+        ;;
+    esac
+  done <<EOF
+$(spec)
+EOF
+  if [ "$found" = 0 ]; then
+    echo "::error::cache-keys.sh: no output named '$want'" >&2
+    exit 1
+  fi
+}
+
+if [ "$#" -eq 0 ]; then
+  spec
+else
+  query "$1"
+fi

.github/scripts/cache-keys.unit.spec.ts

@@ -0,0 +1,80 @@
+import { execFileSync } from "child_process";
+import { join } from "path";
+
+const SCRIPT = join(__dirname, "cache-keys.sh");
+
+const CACHES = ["m2", "bun-store", "cypress", "eslint"];
+
+// stderr is inherited by default, so the deliberate-failure case below would print a literal
+// `::error::` line - which GitHub Actions reads as an annotation directive, making a passing run
+// annotate itself with an error.
+const run = (args: string[] = [], env: NodeJS.ProcessEnv = {}, quiet = false) =>
+  execFileSync(SCRIPT, args, {
+    encoding: "utf8",
+    stdio: quiet ? ["ignore", "pipe", "ignore"] : "pipe",
+    env: { ...process.env, RUNNER_OS: "Linux", GITHUB_SHA: "abc123", ...env },
+  });
+
+const get = (name: string, env: NodeJS.ProcessEnv = {}) =>
+  run([name], env).trimEnd();
+
+describe("cache-keys.sh", () => {
+  it("is deterministic for a given tree", () => {
+    expect(run()).toEqual(run());
+  });
+
+  it("emits every cache's path, key and restore key", () => {
+    for (const cache of CACHES) {
+      expect(get(`${cache}-path`)).not.toEqual("");
+      expect(get(`${cache}-key`)).not.toEqual("");
+      expect(get(`${cache}-restore-key`)).not.toEqual("");
+    }
+  });
+
+  // Silently returning "" for a name that does not exist is how a caller ends up building a key with a
+  // hole in it.
+  it("fails on an unknown output name", () => {
+    expect(() => run(["no-such-output"], {}, true)).toThrow();
+  });
+
+  // A key equal to its own restore prefix points every dependency set at one entry, and nothing reports
+  // it. This is the failure the script exists to prevent.
+  it("never emits a key equal to its own restore prefix", () => {
+    for (const cache of CACHES) {
+      const key = get(`${cache}-key`);
+      const prefix = get(`${cache}-restore-key`);
+      expect(key.startsWith(prefix)).toBe(true);
+      expect(key.length).toBeGreaterThan(prefix.length);
+    }
+  });
+
+  it("scopes every key to the runner OS", () => {
+    for (const cache of CACHES) {
+      expect(get(`${cache}-key`, { RUNNER_OS: "Linux" })).not.toEqual(
+        get(`${cache}-key`, { RUNNER_OS: "macOS" }),
+      );
+    }
+  });
+
+  // Home paths must be absolute: actions/cache expands a tilde but a shell assigning one to a variable
+  // does not, and would create a directory literally named `~`.
+  it("emits absolute paths for home directory locations", () => {
+    expect(get("bun-store-path").startsWith("/")).toBe(true);
+    expect(get("cypress-path").startsWith("/")).toBe(true);
+    for (const line of get("m2-path").split("\n")) {
+      expect(line.startsWith("~")).toBe(false);
+    }
+  });
+
+  // The Cypress binary depends on the Cypress version alone, so an unrelated dependency bump must not
+  // invalidate a 200MB download.
+  it("keys the Cypress binary on the resolved version, not the lockfile", () => {
+    expect(get("cypress-key")).toMatch(/^cypress-Linux-\d+\.\d+\.\d+/);
+  });
+
+  it("keys the ESLint cache on the commit", () => {
+    expect(get("eslint-key", { GITHUB_SHA: "deadbeef" })).toEqual(
+      "eslint-Linux-deadbeef",
+    );
+  });
+});

.github/scripts/check-preresolve-aliases.sh

@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+# Fails when a `clojure` invocation under .github/ uses an alias combination that cache-warm does not
+# pre-resolve.
+#
+# tools.deps selects dependency versions globally per classpath, so two alias combinations can resolve
+# the same transitive library to different versions. A combination the warm job never resolved is
+# therefore not merely absent from the cache - the cache holds *a* version of those libraries, just not
+# the one this classpath wants, and the job fetches its delta straight from Maven Central on every run.
+# That is the intermittent-403 failure of DEV-2094, and it is invisible: the build still passes.
+#
+# Nothing about a missing combination shows up at runtime, so this check is the only thing standing
+# between a newly added alias combination and a permanently half-cold cache.
+#
+#   .github/scripts/check-preresolve-aliases.sh
+
+set -euo pipefail
+
+cd "$(git rev-parse --show-toplevel)"
+
+WARM=.github/workflows/cache-warm.yml
+
+# Invocations deliberately left out of the warm job. Each needs a reason, because the default answer is
+# to add the combination to the list instead.
+WAIVED="$(
+  cat <<'EOF'
+:deps
+:outdated
+EOF
+)"
+# :deps      - tools.deps built-in used by write-poms.sh; contributes no dependencies of its own.
+# :outdated  - scheduled dependency-bump workflow only; a cold resolve there costs nothing anyone waits on.
+
+# Alias combinations the warm job pre-resolves.
+declared="$(sed -n '/combos=(/,/^ *)/p' "$WARM" | grep -oE '":[^"]*"' | tr -d '"' | sort -u)"
+if [ -z "$declared" ]; then
+  echo "::error::check-preresolve-aliases.sh: found no combos=( ... ) list in $WARM" >&2
+  exit 1
+fi
+
+# Expressions we know how to expand. An unrecognised one has to stop the check rather than be skipped:
+# silently ignoring it is how a whole matrix of combinations would go unchecked.
+unknown="$(grep -rhoE '\$\{\{[^}]*\}\}' --include='*' \
+             --exclude='*.png' --exclude='*.jpg' .github/ 2>/dev/null \
+           | sort -u | grep -v 'edition' || true)"
+
+scan() { # scan <edition>: alias strings used by clojure invocations, with expressions substituted
+  grep -rhE 'clojure[[:space:]]+(-P[[:space:]]+)?-[XMATP]?:' \
+       --include='*' --exclude='*.png' --exclude='*.jpg' .github/ 2>/dev/null \
+    | sed "s/\\\${{[^}]*edition[^}]*}}/$1/g" \
+    | grep -oE 'clojure[[:space:]]+(-P[[:space:]]+)?-[XMATP]?:[A-Za-z0-9:_.-]+' \
+    | grep -oE ':[A-Za-z0-9:_.-]+' \
+    | sed 's/:$//'
+}
+
+found="$( { scan ee; scan oss; } | sort -u )"
+
+covered="$(printf '%s\n%s\n' "$declared" "$WAIVED" | sort -u)"
+missing="$(comm -23 <(printf '%s\n' "$found") <(printf '%s\n' "$covered") || true)"
+
+if [ -n "$missing" ]; then
+  echo "::error::Alias combinations used under .github/ that cache-warm does not pre-resolve:" >&2
+  printf '%s\n' "$missing" | sed 's/^/  /' >&2
+  echo >&2
+  echo "Add each to the combos list in $WARM, or waive it in this script with a reason." >&2
+  echo "Leaving it uncovered means those jobs re-fetch their version deltas from Maven on every run." >&2
+  exit 1
+fi
+
+echo "All $(printf '%s\n' "$found" | grep -c .) clojure alias combinations under .github/ are pre-resolved."

.github/scripts/csv-to-mb.js

@@ -1,91 +0,0 @@
-/**
- * jsonData must be in the format:
- * [
- *   { column1: value1, column2: value2, ... },
- *   { column1: value3, column2: value4, ... },
- *   ...
- * ]
- */
-function jsonToCsvFormData(jsonData) {
-  const formData = new FormData();
-  const csvHeader = Object.keys(jsonData[0]).join(',') + '\n';
-  const csvContent = jsonData.map(row =>
-    Object.values(row).map(value => `"${String(value).replace(/"/g, '""')}"`).join(',')
-  ).join('\n');
-
-  const blob = new Blob([csvHeader + csvContent], { type: 'text/csv' });
-  formData.append('file', blob, 'data.csv');
-
-  return formData;
-}
-
-// Transient failures worth retrying: throttling and server-side errors. A 4xx
-// (bad request, auth) won't succeed on retry, so those fail fast.
-const RETRYABLE_STATUS = new Set([429, 500, 502, 503, 504]);
-
-class UploadError extends Error {
-  constructor(message, { retryable }) {
-    super(message);
-    this.retryable = retryable;
-  }
-}
-
-async function attemptUpload(url, jsonData, timeoutMs) {
-  let response;
-  try {
-    response = await fetch(url, {
-      method: 'POST',
-      headers: {
-        "x-api-key": process.env.API_KEY
-      },
-      // Rebuilt per attempt: a consumed request body can't be reused.
-      body: jsonToCsvFormData(jsonData),
-      // Without this the request can hang indefinitely on a stalled server,
-      // eating the whole job timeout. An abort surfaces below as a retryable
-      // network error, so it retries with backoff instead.
-      signal: AbortSignal.timeout(timeoutMs)
-    });
-  } catch (networkError) {
-    throw new UploadError(networkError.message, { retryable: true });
-  }
-
-  if (response.ok) {
-    return;
-  }
-
-  const body = await response.text().catch(() => '');
-  throw new UploadError(
-    `Upload failed: ${response.status} ${response.statusText} ${body}`.trim(),
-    { retryable: RETRYABLE_STATUS.has(response.status) }
-  );
-}
-
-const sleep = ms => new Promise(resolve => setTimeout(resolve, ms));
-
-/**
- * Uploads jsonData as CSV, retrying transient API errors with exponential
- * backoff. `retries` is the number of extra attempts after the first (so the
- * default 2 means up to 3 tries). `timeoutMs` is a per-attempt total deadline
- * (default 60s) that aborts a stalled request. Throws the last error once
- * attempts are exhausted or the error is non-retryable.
- */
-async function uploadCsvToMb({ baseUrl, tableId, jsonData, mode = 'append', retries = 2, retryDelayMs = 1000, timeoutMs = 60_000 }) {
-  const operation = mode === 'replace' ? 'replace-csv' : 'append-csv';
-  const url = `${baseUrl}/api/table/${tableId}/${operation}`;
-
-  for (let attempt = 0; ; attempt++) {
-    try {
-      await attemptUpload(url, jsonData, timeoutMs);
-      return { success: true };
-    } catch (error) {
-      if (!error.retryable || attempt >= retries) {
-        throw error;
-      }
-      const delay = retryDelayMs * 2 ** attempt;
-      console.warn(`Upload attempt ${attempt + 1} failed (${error.message}); retrying in ${delay}ms`);
-      await sleep(delay);
-    }
-  }
-}
-
-module.exports = { uploadCsvToMb };

.github/scripts/csv-to-mb.unit.spec.js

@@ -1,50 +0,0 @@
-const { uploadCsvToMb } = require("./csv-to-mb");
-
-const ok = () => ({ ok: true });
-const fail = status => ({ ok: false, status, statusText: "err", text: async () => "" });
-
-const upload = (over = {}) =>
-  uploadCsvToMb({
-    baseUrl: "https://stats.example.com",
-    tableId: 1,
-    jsonData: [{ a: 1 }],
-    retryDelayMs: 1,
-    ...over,
-  });
-
-describe("uploadCsvToMb retries", () => {
-  afterEach(() => {
-    delete global.fetch;
-  });
-
-  it("retries transient server errors then succeeds", async () => {
-    global.fetch = jest.fn().mockResolvedValueOnce(fail(503)).mockResolvedValueOnce(fail(500)).mockResolvedValueOnce(ok());
-
-    await expect(upload({ retries: 2 })).resolves.toEqual({ success: true });
-    expect(global.fetch).toHaveBeenCalledTimes(3);
-  });
-
-  it("retries network errors", async () => {
-    global.fetch = jest
-      .fn()
-      .mockRejectedValueOnce(new Error("ECONNRESET"))
-      .mockResolvedValueOnce(ok());
-
-    await expect(upload({ retries: 2 })).resolves.toEqual({ success: true });
-    expect(global.fetch).toHaveBeenCalledTimes(2);
-  });
-
-  it("gives up after exhausting retries and throws the last error", async () => {
-    global.fetch = jest.fn().mockResolvedValue(fail(500));
-
-    await expect(upload({ retries: 2 })).rejects.toThrow("Upload failed: 500");
-    expect(global.fetch).toHaveBeenCalledTimes(3); // 1 initial + 2 retries
-  });
-
-  it("does not retry a non-transient 4xx", async () => {
-    global.fetch = jest.fn().mockResolvedValue(fail(400));
-
-    await expect(upload({ retries: 2 })).rejects.toThrow("Upload failed: 400");
-    expect(global.fetch).toHaveBeenCalledTimes(1);
-  });
-});

.github/scripts/find-linear-issue.js

@@ -1,40 +0,0 @@
-async function findLinearIssue({ githubIssueUrl, linearApiKey }) {
-  const response = await fetch("https://api.linear.app/graphql", {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/json",
-      Authorization: linearApiKey,
-    },
-    body: JSON.stringify({
-      query: `
-        query {
-          attachmentsForURL(url: "${githubIssueUrl}") {
-            nodes {
-              issue { identifier }
-            }
-          }
-        }
-      `,
-    }),
-  });
-
-  const data = await response.json();
-
-  if (!response.ok) {
-    return { success: false, message: `Linear API error: ${response.status}` };
-  }
-
-  if (!data.data?.attachmentsForURL?.nodes?.length) {
-    return {
-      success: false,
-      message: `No Linear issue linked to ${githubIssueUrl}`,
-    };
-  }
-
-  return {
-    success: true,
-    issue: data.data.attachmentsForURL.nodes[0].issue.identifier,
-  };
-}
-
-module.exports = { findLinearIssue };

.github/scripts/linear-issues.js

@@ -0,0 +1,109 @@
+async function findLinearIssue({ githubIssueUrl, linearApiKey }) {
+  const response = await fetch("https://api.linear.app/graphql", {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: linearApiKey,
+    },
+    body: JSON.stringify({
+      query: `
+        query {
+          attachmentsForURL(url: "${githubIssueUrl}") {
+            nodes {
+              issue { identifier }
+            }
+          }
+        }
+      `,
+    }),
+  });
+
+  const data = await response.json();
+
+  if (!response.ok) {
+    return { success: false, message: `Linear API error: ${response.status}` };
+  }
+
+  if (!data.data?.attachmentsForURL?.nodes?.length) {
+    return {
+      success: false,
+      message: `No Linear issue linked to ${githubIssueUrl}`,
+    };
+  }
+
+  return {
+    success: true,
+    issue: data.data.attachmentsForURL.nodes[0].issue.identifier,
+  };
+}
+
+async function createLinearIssue({
+  teamId,
+  title,
+  description,
+  projectId,
+  labelIds,
+  linearApiKey,
+}) {
+  const response = await fetch("https://api.linear.app/graphql", {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: linearApiKey,
+    },
+    body: JSON.stringify({
+      query: `
+        mutation CreateIssue($input: IssueCreateInput!) {
+          issueCreate(input: $input) {
+            success
+            issue {
+              id
+              identifier
+              title
+              url
+            }
+          }
+        }
+      `,
+      variables: {
+        input: {
+          teamId,
+          title,
+          ...(description ? { description } : {}),
+          ...(projectId ? { projectId } : {}),
+          ...(labelIds?.length ? { labelIds } : {}),
+        },
+      },
+    }),
+  });
+
+  if (!response.ok) {
+    return { success: false, message: `Linear API error: ${response.status}` };
+  }
+
+  const data = await response.json();
+
+  if (data.errors?.length) {
+    return {
+      success: false,
+      message: `Linear API error: ${data.errors.map((e) => e.message).join(", ")}`,
+    };
+  }
+
+  if (!data.data?.issueCreate?.success) {
+    return {
+      success: false,
+      message: `Failed to create Linear issue "${title}"`,
+    };
+  }
+
+  return {
+    success: true,
+    issue: data.data.issueCreate.issue,
+  };
+}
+
+module.exports = {
+  findLinearIssue,
+  createLinearIssue,
+};

.github/scripts/stats-import.ts

@@ -0,0 +1,140 @@
+// Pushes stats rows to eng-stats-importer, which writes them to Postgres.
+//
+// The importer's origin comes from ENG_STATS_URL and its key from API_KEY, both
+// repository secrets — this repo is public, so neither is hardcoded here. Visit
+// the importer to see the tables and mint keys.
+
+// Transient failures worth retrying: throttling and server-side errors. A 4xx
+// (bad request, auth, unknown table) won't succeed on retry, so those fail fast.
+const RETRYABLE_STATUS = new Set([429, 500, 502, 503, 504]);
+
+/**
+ * One row, keyed by column. Values are `unknown` rather than a scalar union
+ * because a `json` column takes arbitrary nested data.
+ */
+export type StatsRow = Record<string, unknown>;
+
+export interface ImportStatsOptions {
+  /** Table name as it appears in `/api/import/{table}`, e.g. `emotion_files`. */
+  table: string;
+  rows: StatsRow[];
+  /** Importer origin. Defaults to ENG_STATS_URL. */
+  baseUrl?: string;
+  /** Extra attempts after the first, so the default 2 means up to 3 tries. */
+  retries?: number;
+  retryDelayMs?: number;
+  /** Per-attempt total deadline; aborts a stalled request. */
+  timeoutMs?: number;
+}
+
+export interface ImportStatsResult {
+  success: true;
+  inserted?: number;
+  /** Payload keys with no matching column, when `ignoreUnknown` is in play. */
+  ignoredKeys?: string[];
+}
+
+class ImportError extends Error {
+  retryable: boolean;
+
+  constructor(message: string, { retryable }: { retryable: boolean }) {
+    super(message);
+    this.retryable = retryable;
+  }
+}
+
+async function attemptImport(
+  url: string,
+  rows: StatsRow[],
+  timeoutMs: number,
+): Promise<ImportStatsResult> {
+  let response: Response;
+  try {
+    response = await fetch(url, {
+      method: "PUT",
+      headers: {
+        "x-api-key": process.env.API_KEY ?? "",
+        "content-type": "application/json",
+      },
+      body: JSON.stringify(rows),
+      // Without this the request can hang indefinitely on a stalled server,
+      // eating the whole job timeout. An abort surfaces below as a retryable
+      // network error, so it retries with backoff instead.
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+  } catch (networkError) {
+    const message =
+      networkError instanceof Error ? networkError.message : String(networkError);
+    throw new ImportError(message, { retryable: true });
+  }
+
+  if (!response.ok) {
+    // Failures carry an `{ error }` body naming the offending row and column,
+    // which is the only way to tell a type mismatch from a typo'd key.
+    const body = await response.text().catch(() => "");
+    throw new ImportError(
+      `Import failed: ${response.status} ${response.statusText} ${body}`.trim(),
+      { retryable: RETRYABLE_STATUS.has(response.status) },
+    );
+  }
+
+  // Best-effort: the row count is for logging, so a body that doesn't parse
+  // shouldn't turn a successful import into a failure.
+  const result = (await response.json().catch(() => ({}))) as {
+    inserted?: number;
+    ignoredKeys?: string[];
+  };
+  return { success: true, inserted: result.inserted, ignoredKeys: result.ignoredKeys };
+}
+
+const sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));
+
+/**
+ * Imports `rows` into the `table` table, retrying transient API errors with
+ * exponential backoff.
+ *
+ * Keys are matched leniently against the table's columns -- `Emotion Files`,
+ * `emotionFiles` and `emotion_files` all land in `emotion_files` -- but values
+ * are matched strictly, and a key matching no column is an error rather than a
+ * silent drop. Rows are appended; the importer has no replace mode.
+ *
+ * Throws the last error once attempts are exhausted or the error is
+ * non-retryable.
+ */
+export async function importStats({
+  table,
+  rows,
+  baseUrl = process.env.ENG_STATS_URL,
+  retries = 2,
+  retryDelayMs = 1000,
+  timeoutMs = 60_000,
+}: ImportStatsOptions): Promise<ImportStatsResult> {
+  // The importer accepts an empty payload, but there's no point spending a
+  // request (and a rate-limit slot) to insert nothing.
+  if (rows.length === 0) {
+    return { success: true, inserted: 0 };
+  }
+
+  if (!baseUrl) {
+    throw new Error("ENG_STATS_URL is not set, so there is no importer to push to");
+  }
+
+  // Tolerate a trailing slash: the origin comes from a hand-entered secret.
+  const url = `${baseUrl.replace(/\/+$/, "")}/api/import/${table}`;
+
+  for (let attempt = 0; ; attempt++) {
+    try {
+      return await attemptImport(url, rows, timeoutMs);
+    } catch (error) {
+      const importError = error as ImportError;
+      if (!importError.retryable || attempt >= retries) {
+        throw error;
+      }
+      const delay = retryDelayMs * 2 ** attempt;
+      console.warn(
+        `Import attempt ${attempt + 1} failed (${importError.message}); retrying in ${delay}ms`,
+      );
+      await sleep(delay);
+    }
+  }
+}

.github/scripts/stats-import.unit.spec.ts

@@ -0,0 +1,160 @@
+import { importStats } from "./stats-import";
+
+const ok = (body: unknown = { inserted: 1 }) => ({ ok: true, json: async () => body });
+const fail = (status: number) => ({
+  ok: false,
+  status,
+  statusText: "err",
+  text: async () => "",
+});
+
+const load = (over: Record<string, unknown> = {}) =>
+  importStats({
+    baseUrl: "https://stats.example.com",
+    table: "emotion_files",
+    rows: [{ a: 1 }],
+    retryDelayMs: 1,
+    ...over,
+  });
+
+describe("importStats requests", () => {
+  afterEach(() => {
+    // @ts-expect-error -- removing the stub the tests installed
+    delete global.fetch;
+    delete process.env.API_KEY;
+    delete process.env.ENG_STATS_URL;
+  });
+
+  it("defaults the origin to ENG_STATS_URL", async () => {
+    const fetchMock = jest.fn().mockResolvedValue(ok());
+    global.fetch = fetchMock;
+    process.env.ENG_STATS_URL = "https://importer.example.com";
+
+    await load({ baseUrl: undefined });
+
+    expect(fetchMock.mock.calls[0][0]).toBe(
+      "https://importer.example.com/api/import/emotion_files",
+    );
+  });
+
+  it("tolerates a trailing slash on the origin", async () => {
+    const fetchMock = jest.fn().mockResolvedValue(ok());
+    global.fetch = fetchMock;
+
+    await load({ baseUrl: "https://importer.example.com/" });
+
+    expect(fetchMock.mock.calls[0][0]).toBe(
+      "https://importer.example.com/api/import/emotion_files",
+    );
+  });
+
+  it("fails loudly when no origin is configured", async () => {
+    const fetchMock = jest.fn();
+    global.fetch = fetchMock;
+
+    await expect(load({ baseUrl: undefined })).rejects.toThrow("ENG_STATS_URL is not set");
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it("PUTs the rows as JSON to the table's import endpoint", async () => {
+    const fetchMock = jest.fn().mockResolvedValue(ok());
+    global.fetch = fetchMock;
+    process.env.API_KEY = "secret";
+
+    await expect(load({ rows: [{ a: 1 }, { a: 2 }] })).resolves.toEqual({
+      success: true,
+      inserted: 1,
+      ignoredKeys: undefined,
+    });
+
+    const [url, options] = fetchMock.mock.calls[0];
+    expect(url).toBe("https://stats.example.com/api/import/emotion_files");
+    expect(options.method).toBe("PUT");
+    expect(options.headers).toMatchObject({
+      "x-api-key": "secret",
+      "content-type": "application/json",
+    });
+    expect(JSON.parse(options.body)).toEqual([{ a: 1 }, { a: 2 }]);
+  });
+
+  it("skips the request entirely when there are no rows", async () => {
+    const fetchMock = jest.fn();
+    global.fetch = fetchMock;
+
+    await expect(load({ rows: [] })).resolves.toEqual({ success: true, inserted: 0 });
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it("succeeds even if the response body does not parse", async () => {
+    global.fetch = jest.fn().mockResolvedValue({
+      ok: true,
+      json: async () => {
+        throw new Error("not json");
+      },
+    });
+
+    await expect(load()).resolves.toMatchObject({ success: true });
+  });
+});
+
+describe("importStats retries", () => {
+  afterEach(() => {
+    // @ts-expect-error -- removing the stub the tests installed
+    delete global.fetch;
+  });
+
+  it("retries transient server errors then succeeds", async () => {
+    const fetchMock = jest
+      .fn()
+      .mockResolvedValueOnce(fail(503))
+      .mockResolvedValueOnce(fail(500))
+      .mockResolvedValueOnce(ok());
+    global.fetch = fetchMock;
+
+    await expect(load({ retries: 2 })).resolves.toMatchObject({ success: true });
+    expect(fetchMock).toHaveBeenCalledTimes(3);
+  });
+
+  it("retries throttling", async () => {
+    const fetchMock = jest.fn().mockResolvedValueOnce(fail(429)).mockResolvedValueOnce(ok());
+    global.fetch = fetchMock;
+
+    await expect(load({ retries: 2 })).resolves.toMatchObject({ success: true });
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+  });
+
+  it("retries network errors", async () => {
+    const fetchMock = jest
+      .fn()
+      .mockRejectedValueOnce(new Error("ECONNRESET"))
+      .mockResolvedValueOnce(ok());
+    global.fetch = fetchMock;
+
+    await expect(load({ retries: 2 })).resolves.toMatchObject({ success: true });
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+  });
+
+  it("gives up after exhausting retries and throws the last error", async () => {
+    const fetchMock = jest.fn().mockResolvedValue(fail(500));
+    global.fetch = fetchMock;
+
+    await expect(load({ retries: 2 })).rejects.toThrow("Import failed: 500");
+    expect(fetchMock).toHaveBeenCalledTimes(3); // 1 initial + 2 retries
+  });
+
+  it("does not retry a non-transient 4xx", async () => {
+    const fetchMock = jest.fn().mockResolvedValue(fail(400));
+    global.fetch = fetchMock;
+
+    await expect(load({ retries: 2 })).rejects.toThrow("Import failed: 400");
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+  });
+
+  it("does not retry an unknown table", async () => {
+    const fetchMock = jest.fn().mockResolvedValue(fail(404));
+    global.fetch = fetchMock;
+
+    await expect(load({ retries: 2 })).rejects.toThrow("Import failed: 404");
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+  });
+});

.github/scripts/upload-affected-tests-stats.ts

@@ -1,11 +1,11 @@
 // Appends the test-plan stats row produced by create-test-plan.ts to the
-// "FE Affected Tests" table on stats.metabase.com.
-// Reads STATS_JSON, TRIGGERED_BY, PR_NUMBER, HEAD_SHA, BASE_SHA, API_KEY from env.
+// "FE Affected Tests" table in eng-stats-importer.
+// Reads STATS_JSON, PR_NUMBER, HEAD_SHA, BASE_SHA, API_KEY from env.
 
-const { uploadCsvToMb } = require("./csv-to-mb.js");
+import type { TestPlanStats } from "./affected-tests";
+import { importStats } from "./stats-import";
 
-// "FE Affected Tests" uploaded table on stats.metabase.com.
-const TABLE_ID = 81818;
+const TABLE = "fe_affected_tests";
 
 async function main() {
   // create-test-plan doesn't always produce stats (e.g. on release branches
@@ -16,13 +16,13 @@ async function main() {
     return;
   }
 
-  const s = JSON.parse(raw);
+  const s = JSON.parse(raw) as TestPlanStats;
   console.log("stats", s);
 
   const row = {
     Date: new Date().toISOString(),
-    // "pr_update" or "merge_to_master". ("Trigger" is a reserved SQL word.)
-    "Triggered By": process.env.TRIGGERED_BY,
+    // ("Trigger" is a reserved SQL word.)
+    "Triggered By": "pr_update",
     PR: Number(process.env.PR_NUMBER),
     "Head SHA": process.env.HEAD_SHA,
     "Base SHA": process.env.BASE_SHA,
@@ -43,17 +43,15 @@ async function main() {
     "Loki Stories All": s.loki_stories_all,
     "Loki Stories To Run (Rules)": s.loki_stories_to_run_rules,
     "Loki Stories To Run (Usage)": s.loki_stories_to_run_usage,
-    "E2E Specs All": s.e2e_specs_all,
-    "E2E Specs To Run (Rules)": s.e2e_specs_to_run_rules,
-    "E2E Specs To Run (Usage)": s.e2e_specs_to_run_usage,
+    // Spelled as the column name rather than a display name: the importer
+    // splits a digit-then-capital run, so "E2E Specs All" would normalize to
+    // `e2_e_specs_all` instead of `e2e_specs_all`.
+    e2e_specs_all: s.e2e_specs_all,
+    e2e_specs_to_run_rules: s.e2e_specs_to_run_rules,
+    e2e_specs_to_run_usage: s.e2e_specs_to_run_usage,
   };
 
-  await uploadCsvToMb({
-    baseUrl: "https://stats.metabase.com",
-    tableId: TABLE_ID,
-    jsonData: [row],
-    mode: "append",
-  });
+  await importStats({ table: TABLE, rows: [row] });
   console.log("Data uploaded successfully");
 }
 

.github/scripts/upload-bundle-size-stats.ts

@@ -0,0 +1,38 @@
+// Appends the measured bundle sizes (with deltas) to the "Bundle Sizes" table
+// in eng-stats-importer. Reads ROWS (a JSON file of rows) and API_KEY from env,
+// and reports whether the import landed via the `uploaded` step output.
+
+import { appendFileSync, readFileSync } from "node:fs";
+
+import { importStats, type StatsRow } from "./stats-import";
+
+/** `core.setOutput` without the github-script runtime. */
+function setOutput(name: string, value: string) {
+  const file = process.env.GITHUB_OUTPUT;
+  if (file) {
+    appendFileSync(file, `${name}=${value}\n`);
+  }
+}
+
+async function main() {
+  const rowsPath = process.env.ROWS || "artifacts/upload-rows.json";
+  const rows = JSON.parse(readFileSync(rowsPath, "utf8")) as StatsRow[];
+
+  console.table(rows);
+
+  try {
+    await importStats({ table: "bundle_sizes", rows });
+    console.log("Bundle sizes uploaded successfully");
+    setOutput("uploaded", "true");
+  } catch (error) {
+    // Stats logging is best-effort: if the importer is still unreachable after
+    // the client's retries, keep the run green. The last-plotted cache is only
+    // saved on a successful upload, so this point is re-attempted on the next
+    // master build and nothing is silently dropped.
+    const message = error instanceof Error ? error.message : String(error);
+    console.log(`::warning::Bundle-size upload failed after retries; leaving run green: ${message}`);
+    setOutput("uploaded", "false");
+  }
+}
+
+main();

.github/scripts/upload-emotion-stats.ts

@@ -0,0 +1,25 @@
+// Appends the weekly @emotion/* importer count to the "Emotion Files" table in
+// eng-stats-importer. Reads EMOTION_FILES and API_KEY from env.
+
+import { importStats } from "./stats-import";
+
+async function main() {
+  console.log("EMOTION_FILES", Number(process.env.EMOTION_FILES));
+
+  // Keys must match the target table's columns (the importer normalizes both
+  // sides, so casing/spacing is forgiving).
+  const rows = [
+    {
+      Date: new Date().toISOString().slice(0, 10), // YYYY-MM-DD
+      "Emotion Files": Number(process.env.EMOTION_FILES),
+    },
+  ];
+
+  await importStats({ table: "emotion_stats", rows });
+  console.log("Data uploaded successfully");
+}
+
+main().catch((error) => {
+  console.error("Error uploading data:", error);
+  process.exit(1);
+});

.github/scripts/upload-module-boundaries-stats.ts

@@ -0,0 +1,30 @@
+// Appends the weekly module-boundary counts to the "Module Boundaries" table in
+// eng-stats-importer. Reads NAMED_MODULES, ENFORCED_MODULES, UNMODULED,
+// VIOLATIONS and API_KEY from env.
+
+import { importStats } from "./stats-import";
+
+async function main() {
+  console.log("NAMED_MODULES", Number(process.env.NAMED_MODULES));
+  console.log("ENFORCED_MODULES", Number(process.env.ENFORCED_MODULES));
+  console.log("UNMODULED", Number(process.env.UNMODULED));
+  console.log("VIOLATIONS", Number(process.env.VIOLATIONS));
+
+  const rows = [
+    {
+      Date: new Date().toISOString().slice(0, 10), // YYYY-MM-DD
+      Modules: Number(process.env.NAMED_MODULES),
+      "Enforced modules": Number(process.env.ENFORCED_MODULES),
+      "Unmoduled folders": Number(process.env.UNMODULED),
+      Violations: Number(process.env.VIOLATIONS),
+    },
+  ];
+
+  await importStats({ table: "module_boundaries", rows });
+  console.log("Data uploaded successfully");
+}
+
+main().catch((error) => {
+  console.error("Error uploading data:", error);
+  process.exit(1);
+});

.github/workflows/app-db.yml

@@ -6,6 +6,34 @@ on:
       skip:
         type: boolean
         default: false
+      force-run:
+        description: Run the full suite regardless of the diff (master / release branches).
+        type: boolean
+        default: false
+
+  # Run one app-DB job on demand, against the ref you dispatch on, optionally under a profiler.
+  # Everything else about the job -- services, matrix legs, test args, quarantine gating -- is
+  # whatever the normal CI run uses, because it is the same job.
+  workflow_dispatch:
+    inputs:
+      app-db:
+        description: 'Which app-DB job to run. Only this one runs; the others are skipped.'
+        type: choice
+        required: true
+        options:
+          - mariadb
+          - mysql
+          - postgres
+      tests:
+        description: 'Optional: run only these tests, comma- or space-separated, e.g. metabase.db.custom-migrations-test/some-test. Bare namespaces work too. Blank runs the job''s usual set.'
+        type: string
+        required: false
+        default: ''
+      profile:
+        description: 'Profile the test run and attach a flamegraph to the job. Adds sampling overhead.'
+        type: boolean
+        required: false
+        default: false
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}-app-db
@@ -15,8 +43,16 @@ concurrency:
 # ci-conductor (secrets: inherit is already set on the app-db call in
 # run-tests.yml). See DEV-2224.
 env:
-  CI_CONDUCTOR_BASE_URL: ${{ secrets.CI_CONDUCTOR_BASE_URL }}
+  CI_CONDUCTOR_BASE_URL: ${{ vars.CI_CONDUCTOR_BASE_URL }}
   CI_CONDUCTOR_WEBHOOK_SECRET: ${{ secrets.CI_CONDUCTOR_WEBHOOK_SECRET }}
+  # Both read by the test-driver action, which is what actually runs the tests. Set here rather than
+  # passed as inputs to each job so that turning either on is one line, not one line per job.
+  # Empty (and so off) on workflow_call, where neither input exists.
+  #
+  # ONLY_TESTS replaces the job's own test selection, so every matrix leg of the chosen job runs the
+  # whole list -- each app DB has three.
+  PROFILE_TESTS: ${{ inputs.profile }}
+  ONLY_TESTS: ${{ inputs.tests }}
 
 jobs:
   app-db-matrix:
@@ -33,11 +69,10 @@ jobs:
         id: versions
         uses: actions/github-script@v9
         env:
-          REF_NAME: ${{ github.ref_name }}
+          RUN_ALL: ${{ inputs.force-run }}
         with:
           script: | # js
-            const refName = process.env.REF_NAME;
-            const runAll = refName === 'master' || refName.startsWith('release-x');
+            const runAll = process.env.RUN_ALL === 'true';
 
             const versions = {
               mariadb: [
@@ -100,7 +135,7 @@ jobs:
 
   be-tests-mariadb:
     needs: app-db-matrix
-    if: ${{ !inputs.skip }}
+    if: ${{ !inputs.skip && (inputs.app-db == '' || inputs.app-db == 'mariadb') }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     strategy:
@@ -140,21 +175,9 @@ jobs:
           MARIADB_ALLOW_EMPTY_ROOT_PASSWORD: true
           MARIADB_DATABASE: mb_test
     env:
-      # Only run old migrations tests on pushes to master or release branches. All other branches should skip tests
-      # with the tag `mb/old-migrations-test`. `__ADDITIONAL_EXCLUDED_TAG__` is not used anywhere outside of splicing
-      # it in to the command below.
-      __ADDITIONAL_EXCLUDED_TAG__: >-
-        ${{
-          (
-            github.event_name == 'push' &&
-            (
-              github.ref_name == 'master' ||
-              startsWith(github.ref_name, 'release-x')
-            ) &&
-            ''
-          ) ||
-          ':mb/old-migrations-test'
-        }}
+      # __ADDITIONAL_EXCLUDED_TAG__: ${{ !inputs.force-run && ':mb/old-migrations-test' || '' }}
+      # GDGT-3126: re-enable and properly fix old migrations tests
+      __ADDITIONAL_EXCLUDED_TAG__: ':mb/old-migrations-test'
       # actual serious env vars below
       CI: 'true'
       DRIVERS: mysql
@@ -198,7 +221,7 @@ jobs:
 
   be-tests-mysql:
     needs: app-db-matrix
-    if: ${{ !inputs.skip }}
+    if: ${{ !inputs.skip && (inputs.app-db == '' || inputs.app-db == 'mysql') }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     strategy:
@@ -238,21 +261,9 @@ jobs:
           MYSQL_ALLOW_EMPTY_PASSWORD: true
           MYSQL_DATABASE: mb_test
     env:
-      # Only run old migrations tests on pushes to master or release branches. All other branches should skip tests
-      # with the tag `mb/old-migrations-test`. `__ADDITIONAL_EXCLUDED_TAG__` is not used anywhere outside of splicing
-      # it in to the command below.
-      __ADDITIONAL_EXCLUDED_TAG__: >-
-        ${{
-          (
-            github.event_name == 'push' &&
-            (
-              github.ref_name == 'master' ||
-              startsWith(github.ref_name, 'release-x')
-            ) &&
-            ''
-          ) ||
-          ':mb/old-migrations-test'
-        }}
+      # __ADDITIONAL_EXCLUDED_TAG__: ${{ !inputs.force-run && ':mb/old-migrations-test' || '' }}
+      # GDGT-3126: re-enable and properly fix old migrations tests
+      __ADDITIONAL_EXCLUDED_TAG__: ':mb/old-migrations-test'
       # actual serious env vars below
       CI: 'true'
       DRIVERS: mysql
@@ -304,7 +315,7 @@ jobs:
 
   be-tests-postgres:
     needs: app-db-matrix
-    if: ${{ !inputs.skip }}
+    if: ${{ !inputs.skip && (inputs.app-db == '' || inputs.app-db == 'postgres') }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     strategy:
@@ -334,21 +345,9 @@ jobs:
             exclude-tag: ':mb/driver-tests :mb/transforms-python-test'
     name: "${{ matrix.version.name }} ${{ matrix.job.name }}"
     env:
-      # Only run old migrations tests on pushes to master or release branches. All other branches should skip tests
-      # with the tag `mb/old-migrations-test`. `__ADDITIONAL_EXCLUDED_TAG__` is not used anywhere outside of splicing
-      # it in to the command below.
-      __ADDITIONAL_EXCLUDED_TAG__: >-
-        ${{
-          (
-            github.event_name == 'push' &&
-            (
-              github.ref_name == 'master' ||
-              startsWith(github.ref_name, 'release-x')
-            ) &&
-            ''
-          ) ||
-          ':mb/old-migrations-test'
-        }}
+      # __ADDITIONAL_EXCLUDED_TAG__: ${{ !inputs.force-run && ':mb/old-migrations-test' || '' }}
+      # GDGT-3126: re-enable and properly fix old migrations tests
+      __ADDITIONAL_EXCLUDED_TAG__: ':mb/old-migrations-test'
       # actual serious env vars below
       CI: 'true'
       DRIVERS: postgres

.github/workflows/backend.yml

@@ -6,6 +6,26 @@ on:
       skip:
         type: boolean
         default: false
+      force-run:
+        description: Run the full suite regardless of the diff (master / release branches).
+        type: boolean
+        default: false
+
+  # Run the backend test suite on demand, against the ref you dispatch on, optionally under a
+  # profiler. Everything else about the jobs -- matrix legs, tag filters, quarantine gating -- is
+  # whatever the normal CI run uses, because they are the same jobs.
+  workflow_dispatch:
+    inputs:
+      tests:
+        description: 'Optional: run only these tests, comma- or space-separated, e.g. metabase.query-processor-test/some-test. Bare namespaces work too. Blank runs each leg''s usual set.'
+        type: string
+        required: false
+        default: ''
+      profile:
+        description: 'Profile the test run and attach a flamegraph to the job. Adds sampling overhead.'
+        type: boolean
+        required: false
+        default: false
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}-backend
@@ -15,8 +35,15 @@ concurrency:
 # (secrets: inherit is already set on the backend call in run-tests.yml).
 # See DEV-2224.
 env:
-  CI_CONDUCTOR_BASE_URL: ${{ secrets.CI_CONDUCTOR_BASE_URL }}
+  CI_CONDUCTOR_BASE_URL: ${{ vars.CI_CONDUCTOR_BASE_URL }}
   CI_CONDUCTOR_WEBHOOK_SECRET: ${{ secrets.CI_CONDUCTOR_WEBHOOK_SECRET }}
+  # Both read by the be-tests run step below. Set here rather than passed per job so that turning
+  # either on is one line. Empty (and so off) on workflow_call, where neither input exists.
+  #
+  # ONLY_TESTS replaces the leg's own test selection, so every matrix leg runs the whole list: the
+  # partition args no longer apply, and legs that hold none of the named tests run nothing.
+  PROFILE_TESTS: ${{ inputs.profile }}
+  ONLY_TESTS: ${{ inputs.tests }}
 
 jobs:
   be-linter-clj-kondo:
@@ -45,7 +72,7 @@ jobs:
 
   be-linter-eastwood-test:
     # Master / release safety net: lint every backend test namespace.
-    if: ${{ !inputs.skip && github.event_name == 'push' && (github.ref_name == 'master' || startsWith(github.ref_name, 'release-x')) }}
+    if: ${{ !inputs.skip && inputs.force-run }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 45
     name: Eastwood (tests only)
@@ -57,8 +84,8 @@ jobs:
         name: Run Eastwood linter on our backend tests
 
   be-linter-eastwood-test-changed:
-    # PR / merge queue: lint only the test namespaces touched by the diff.
-    if: ${{ !inputs.skip && (github.event_name == 'pull_request' || github.event_name == 'merge_group') }}
+    # Lint only the test namespaces touched by the diff.
+    if: ${{ !inputs.skip && !inputs.force-run && github.event_name == 'pull_request' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 15
     name: Eastwood (changed tests only)
@@ -72,8 +99,8 @@ jobs:
       - name: Compute changed test namespaces
         id: changed
         env:
-          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.event.merge_group.head_sha || github.sha }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
         run: |
           set -euo pipefail
 
@@ -158,21 +185,9 @@ jobs:
               :partition/index 1
     name: "Java ${{ matrix.java-version }} ${{ matrix.job.name }}"
     env:
-      # Only run old migrations tests on pushes to master or release branches. All other branches should skip tests
-      # with the tag `mb/old-migrations-test`. `__ADDITIONAL_EXCLUDED_TAG__` is not used anywhere outside of splicing
-      # it in to the command below.
-      __ADDITIONAL_EXCLUDED_TAG__: >-
-        ${{
-          (
-            github.event_name == 'push' &&
-            (
-              github.ref_name == 'master' ||
-              startsWith(github.ref_name, 'release-x')
-            ) &&
-            ''
-          ) ||
-          ':mb/old-migrations-test'
-        }}
+      # __ADDITIONAL_EXCLUDED_TAG__: ${{ !inputs.force-run && ':mb/old-migrations-test' || '' }}
+      # GDGT-3126: re-enable and properly fix old migrations tests
+      __ADDITIONAL_EXCLUDED_TAG__: ':mb/old-migrations-test'
     steps:
       - uses: actions/checkout@v6
       - name: Prepare front-end environment
@@ -230,7 +245,21 @@ jobs:
         # whole `[ns/var ...]` vector reaches clojure -X as a single argument.
         run: |
           BASE="clojure -X:dev:ci:test:${{ matrix.job.edition }}:${{ matrix.job.edition }}-dev"
-          if [ "${{ github.run_attempt }}" != "1" ] && [ -s target/failed-tests ]; then
+          # `:profile-tests` overrides `:test`'s exec-fn, so it has to come last. See dev.profile-tests.
+          # The `profiled` output is what the collection steps below key off, so that the decision is
+          # recorded by the step that acts on it rather than re-derived from the environment.
+          if [ "$PROFILE_TESTS" = "true" ]; then
+            echo "Profiling this run; a flamegraph will be attached to the job."
+            echo "profiled=true" >> "$GITHUB_OUTPUT"
+            BASE="$BASE:profile-tests"
+          fi
+          # An explicit selection wins over the rerun narrowing below: it was asked for by hand, on this
+          # attempt. Names may be separated by commas or spaces; hawk wants them as one vector argument.
+          if [ -n "$ONLY_TESTS" ]; then
+            ONLY="[$(echo "$ONLY_TESTS" | tr ',' ' ')]"
+            echo "Running only: $ONLY"
+            $BASE :only "$ONLY"
+          elif [ "${{ github.run_attempt }}" != "1" ] && [ -s target/failed-tests ]; then
             echo "Granular rerun of previously-failed tests: $(cat target/failed-tests)"
             $BASE :only "$(cat target/failed-tests)"
           else
@@ -239,8 +268,15 @@ jobs:
         # Keep this step continue-on-error because the quarantine logic controls whether it ultimately fails.
         continue-on-error: true
 
+      - name: Collect profile
+        if: ${{ !cancelled() }}
+        uses: ./.github/actions/collect-profile
+        with:
+          profiled: ${{ steps.run-java-tests.outputs.profiled }}
+          artifact-name: profile-be-tests-java-${{ matrix.java-version }}-${{ matrix.job.test-group-name }}
+
       - name: Report failed tests to ci-conductor
-        if: ${{ !cancelled() && steps.run-java-tests.outcome == 'failure' }}
+        if: ${{ !cancelled() && ( steps.run-java-tests.outcome == 'failure' || github.run_attempt != '1' ) }}
         # This step should NEVER fail the job!
         continue-on-error: true
         uses: ./.github/actions/report-failures-to-ci-conductor
@@ -316,7 +352,7 @@ jobs:
         uses: ./.github/actions/prepare-backend
       # TODO -- we should probably also check WITHOUT ee -- do a check with only OSS namespaces on the classpath
       - name: Check namespaces
-        run: clojure -M:ee:drivers:check
+        run: clojure -M:ee:drivers:load-namespaces
 
   be-cljfmt:
     if: ${{ !inputs.skip }}

.github/workflows/build-scripts.yml

@@ -9,6 +9,74 @@ on:
 
 jobs:
 
+  files-changed:
+    name: Check which files changed
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 3
+    permissions:
+      contents: read
+    outputs:
+      embedder_plugin: ${{ steps.changes.outputs.embedder_plugin }}
+    steps:
+      - uses: actions/checkout@v6
+      - name: Test which files changed
+        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+        id: changes
+        with:
+          token: ${{ github.token }}
+          filters: .github/file-paths.yaml
+
+  test-embedder-plugin:
+    needs: files-changed
+    if: needs.files-changed.outputs.embedder_plugin == 'true'
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 20
+    permissions:
+      contents: read
+    services:
+      postgres:
+        image: pgvector/pgvector:pg17
+        env:
+          POSTGRES_USER: mb_test
+          POSTGRES_DB: mb_test
+          POSTGRES_HOST_AUTH_METHOD: trust
+        ports:
+          - 5432:5432
+    steps:
+    - uses: actions/checkout@v6
+    - name: Prepare back-end environment
+      uses: ./.github/actions/prepare-backend
+    - name: Build embedder plugin
+      run: ./bin/build-embedder-plugin.sh
+    - name: Verify packaged plugin resources
+      run: |
+        jar tf modules/embedder/target/metabase-embedder-plugin.jar | grep -Fx metabase/embedder/metabase-plugin.yaml
+        jar tf modules/embedder/target/metabase-embedder-plugin.jar | grep -Fx metabase/embedder-model-catalog.edn
+        jar tf modules/embedder/target/metabase-embedder-plugin.jar | grep -Fx metabase-embedder/snowflake-arctic-embed-xs-d8c86521100d3556476a063fc2342036d45c106f-arm64.zip
+        jar tf modules/embedder/target/metabase-embedder-plugin.jar | grep -Fx metabase-embedder/snowflake-arctic-embed-xs-d8c86521100d3556476a063fc2342036d45c106f-avx2.zip
+        jar tf modules/embedder/target/metabase-embedder-plugin.jar | grep -Fx metabase-embedder/all-minilm-l6-v2-1110a243fdf4706b3f48f1d95db1a4f5529b4d41-arm64.zip
+        jar tf modules/embedder/target/metabase-embedder-plugin.jar | grep -Fx metabase-embedder/all-minilm-l6-v2-1110a243fdf4706b3f48f1d95db1a4f5529b4d41-avx2.zip
+    - name: Run artifact-only plugin smoke test
+      env:
+        MB_EMBEDDER_ARTIFACT_TEST: "true"
+        MB_PLUGINS_DIR: modules/embedder/target
+      run: >-
+        ./bin/test-agent --oss :only
+        '[metabase.embeddings.embedder-plugin-artifact-test]'
+    - name: Run in-process semantic-search round trip
+      env:
+        MB_DB_TYPE: postgres
+        MB_DB_PORT: 5432
+        MB_DB_HOST: localhost
+        MB_DB_DBNAME: mb_test
+        MB_DB_USER: mb_test
+        MB_APPDB_PGVECTOR_MODE_TEST: "true"
+        MB_IN_PROCESS_EMBEDDER_SEMANTIC_SEARCH_TEST: "true"
+        MB_PLUGINS_DIR: modules/embedder/target
+      run: >-
+        ./bin/test-agent --drivers=postgres :only
+        '[metabase-enterprise.semantic-search.appdb-pgvector-mode-test/appdb-pgvector-in-process-embedder-round-trip-test]'
+
   test-build-scripts:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     steps:
@@ -24,3 +92,7 @@ jobs:
       run: clojure -M:test
       working-directory: bin/lint-migrations-file
       timeout-minutes: 15
+    - name: Run load-namespaces tests
+      run: clojure -M:test
+      working-directory: bin/load-namespaces
+      timeout-minutes: 15

.github/workflows/bundle-size-stats.yml

@@ -2,7 +2,7 @@ name: Bundle Size Stats
 
 # Reuses the uberjar built on every master merge: downloads the jar (for the
 # emitted JS) plus the bundle-stats and embedding-sdk artifacts, measures
-# initial/total bundle sizes, and appends them to stats.metabase.com.
+# initial/total bundle sizes, and appends them to eng-stats-importer.
 
 on:
   workflow_run:
@@ -32,6 +32,7 @@ jobs:
         uses: actions/checkout@v6
         with:
           ref: ${{ github.event.workflow_run.head_sha }}
+      - uses: ./.github/actions/prepare-node-bun
       - name: Download EE uberjar
         uses: ./.github/actions/fetch-artifact
         with:
@@ -104,42 +105,15 @@ jobs:
           # Passed via env (not interpolated into the shell) so the commit
           # message can't inject commands; the script keeps only the subject.
           COMMIT_MESSAGE: ${{ github.event.workflow_run.head_commit.message }}
-        run: node ./.github/scripts/bundle-size-stats-prepare.js
-      - name: Upload sizes (with deltas) to Stats
+        run: bun ./.github/scripts/bundle-size-stats-prepare.ts
+      - name: Import sizes (with deltas) into Stats
         id: upload
         if: steps.prepare.outputs.significant == 'true'
-        uses: actions/github-script@v9
         env:
-          API_KEY: ${{ secrets.STATS_API_KEY }}
-        with:
-          script: | # js
-            const fs = require("fs");
-            const { uploadCsvToMb } = require("${{ github.workspace }}/.github/scripts/csv-to-mb.js");
-
-            const data = JSON.parse(
-              fs.readFileSync("${{ github.workspace }}/artifacts/upload-rows.json", "utf8"),
-            );
-
-            console.table(data);
-
-            try {
-              await uploadCsvToMb({
-                baseUrl: "https://stats.metabase.com",
-                tableId: 79702,
-                jsonData: data,
-                mode: "append",
-              });
-              console.log("Bundle sizes uploaded successfully");
-              core.setOutput("uploaded", "true");
-            } catch (error) {
-              // Stats logging is best-effort: if stats.metabase.com is still
-              // unreachable after the client's retries, keep the run green. The
-              // last-plotted cache is only saved on a successful upload (below),
-              // so this point is re-attempted on the next master build and
-              // nothing is silently dropped.
-              core.warning(`Bundle-size upload failed after retries; leaving run green: ${error.message}`);
-              core.setOutput("uploaded", "false");
-            }
+          ROWS: artifacts/upload-rows.json
+          ENG_STATS_URL: ${{ secrets.ENG_STATS_URL }}
+          API_KEY: ${{ secrets.ENG_STATS_API_KEY }}
+        run: bun .github/scripts/upload-bundle-size-stats.ts
       - name: Remember this as the last plotted point
         if: steps.upload.outputs.uploaded == 'true'
         uses: actions/cache/save@v4

.github/workflows/cache-generator.yml

@@ -1,185 +0,0 @@
-# This workflow is the single source of truth for generating and updating various caches used by our CI pipeline.
-# It sets the fresh cache each Monday but provides a manual trigger to update it on-demand.
-#
-# All other jobs only restore from this cache; *they never update it*!
-# They should always use `actions/cache/restore@vX` because `actions/cache@vX` would attempt to save the cache.
-#
-# Our agreed-upon strategy is to use a deterministic cache key based on the week of the year.
-# Jobs can utilize the prior week's cache if the current week's cache is not found.
-#
-#
-# PRINCIPLES:
-#   - The cache is never wrong!
-#   - Caches are immutable once created.
-#   - Caches are for speeding up builds, not for correctness.
-#   - It is faster to download a large cache than to re-resolve missing dependencies.
-#
-#
-# DESIGN:
-#
-# 1. Prepare
-#     - A job first prepares the local environment (e.g., installs JDK, Clojure, Node.js, etc.)
-#     - This fetches the dependencies from the cache (if it exists) and warms up the local cache for this workflow.
-# 2. Resolve
-#     - The next step pre-resolves all dependencies, ensuring that the local cache is fully populated and up-to-date.
-# 3. Update
-#     - The final step saves the local cache back to GitHub Actions cache with a deterministic key.
-#     - If a cache entry already exists for that key, it is deleted first to ensure immutability.
-#
-name: Cache Generator
-
-on:
-  schedule:
-    - cron: "0 3 * * 1" # Mondays at 03:00 UTC
-  workflow_dispatch: # manually update the cache
-
-concurrency:
-  group: cache-generator
-  cancel-in-progress: true
-
-jobs:
-  get-cache-keys:
-    if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
-    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@v6
-      - name: Get cache keys
-        uses: ./.github/actions/get-cache-keys
-        id: get-cache-keys
-    outputs:
-      m2-cache-key: ${{ steps.get-cache-keys.outputs.m2-cache-key }}
-      node-cache-key: ${{ steps.get-cache-keys.outputs.node-cache-key }}
-      eslint-cache-key: ${{ steps.get-cache-keys.outputs.eslint-cache-key }}
-      cypress-cache-key: ${{ steps.get-cache-keys.outputs.cypress-cache-key }}
-
-  generate-caches:
-    # Prevent a workflow_dispatch triggered from any branch besides master. This would overwrite the default
-    # cache keys but the cache would be innacessible to other branches since Github prevents cross-branch
-    # cache hits (except for the default branch), breaking the cache entirely.
-    if: ${{ github.ref_name == 'master' }}
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 30
-    needs: get-cache-keys
-    env:
-      M2_CACHE_KEY: ${{ needs.get-cache-keys.outputs.m2-cache-key }}
-      NODE_CACHE_KEY: ${{ needs.get-cache-keys.outputs.node-cache-key }}
-      CYPRESS_CACHE_KEY: ${{ needs.get-cache-keys.outputs.cypress-cache-key }}
-      ESLINT_CACHE_KEY: ${{ needs.get-cache-keys.outputs.eslint-cache-key }}
-    steps:
-      - uses: actions/checkout@v6
-
-      # Backend preparation and cache
-      - name: Prepare backend
-        uses: ./.github/actions/prepare-backend
-
-      # Pre-resolve every Clojure dependency classpath CI actually uses, so the
-      # saved cache is a SUPERSET of what each job resolves at runtime.
-      #
-      # Why a single `-P` is not enough: tools.deps selects dependency *versions*
-      # globally per classpath, so different alias combinations can resolve the
-      # same transitive lib to different versions (e.g. `org.clojure/data.json`
-      # 2.4.0 vs 2.5.x, `org.ow2.asm/asm` 9.2 vs newer). Resolving only one combo
-      # leaves the others to fetch their version-deltas straight from Maven
-      # Central / Clojars on every run -> intermittent 403s. See DEV-2094.
-      #
-      # Keep this list in sync with the `clojure` invocations across .github/.
-      # Each entry notes its consumer. We resolve the FULL alias strings (not a
-      # hand-reduced set) on purpose: if a currently dep-less alias later gains a
-      # dependency, this still covers it instead of silently drifting back into a
-      # cache gap.
-      - name: Pre-resolve Clojure dependencies
-        shell: bash
-        run: |
-          set -euo pipefail
-          combos=(
-            ":build:dev:ee:ee-dev:drivers:drivers-dev:cljs"     # build + uberjar (combined classpath)
-            ":cljs"                                             # shadow-cljs (build:cljs); resolves :cljs alone -> covers asm:9.2
-            ":dev:ee:ee-dev:drivers:drivers-dev:test:eastwood"  # backend.yml (eastwood + eastwood/test)
-            ":dev:ci:ee:ee-dev:drivers:drivers-dev:test"        # test-driver.yml (ee) -> covers data.json:2.4.0
-            ":dev:ci:oss:oss-dev:drivers:drivers-dev:test"      # test-driver.yml (oss)
-            ":dev:ci:test:ee:ee-dev"                            # backend.yml matrix (ee)
-            ":dev:ci:test:oss:oss-dev"                          # backend.yml matrix (oss)
-            ":dev:ci:ee:ee-dev:test:cloverage"                  # backend-cloverage.yml
-            ":dev:drivers:drivers-dev:test"                     # reset-cloud-test-dataset.yml
-            ":dev:drivers:build:build-dev:build-test:ci"        # build-scripts.yml
-            ":ee:drivers:check"                                 # backend.yml (check; git dep athos/clj-check)
-            ":ee:doc"                                           # docs-generate-base.yml
-            ":kondo"                                            # resolve-backport-conflicts.yml (replace-deps)
-            ":run:ee"                                           # cross-branch-migration-test
-            ":dev:ee:migrate"                                   # cross-branch-migration-test
-            ":whitespace-linter"                                # whitespace linter
-          )
-          for combo in "${combos[@]}"; do
-            echo "::group::clojure -P -A${combo}"
-            clojure -P -A"${combo}"
-            echo "::endgroup::"
-          done
-
-          echo "::group::./bin/mage"
-          ./bin/mage
-          echo "::endgroup::"
-
-      - name: Update M2 cache
-        uses: ./.github/actions/update-cache
-        with:
-          path: |
-            ~/.m2
-            ~/.gitlibs
-            ~/.deps.clj
-            bin/bb
-          key: ${{ env.M2_CACHE_KEY }}
-
-      # Frontend preparation and caches
-      # `prepare-frontend` action (1) prepares Node.js and (2) fetches the node_modules cache if it exists.
-      # It then (3) runs `bun install --frozen-lockfile` which ensures the local cache is fully populated.
-      # IMPORTANT: Caching node_modules after patches are already applied will break any PR that attempts to either:
-      #   - upgrade a patched library
-      #   - change a patch
-      # Hence why we explicitly exclude patches from the cache (controlled by the `apply-patches` action input).
-      - name: Install front-end dependencies
-        uses: ./.github/actions/prepare-frontend
-        with:
-          apply-patches: "false"
-
-      - name: Get bun cache directory
-        id: bun-cache
-        run: |
-          BUN_CACHE_DIR=$(bun pm cache)
-          echo "Bun cache directory: $BUN_CACHE_DIR"
-          echo "dir=$BUN_CACHE_DIR" >> "$GITHUB_OUTPUT"
-
-      - name: Ensure that Cypress executable is ready
-        run: |
-          bun run cypress install
-          bun run cypress cache path
-          bun run cypress cache list
-          bun run cypress verify
-        shell: bash
-
-      - name: Update node_modules cache
-        uses: ./.github/actions/update-cache
-        with:
-          path: |
-            ${{ steps.bun-cache.outputs.dir }}
-            node_modules
-          key: ${{ env.NODE_CACHE_KEY }}
-
-      - name: Update Cypress cache
-        uses: ./.github/actions/update-cache
-        with:
-          path: ~/.cache/Cypress
-          key: ${{ env.CYPRESS_CACHE_KEY }}
-
-      # ESLint cache (requires both backend and frontend)
-      - name: Compile CLJS
-        run: bun run build-pure:cljs
-
-      - name: Run ESLint to populate cache
-        run: bun run lint-eslint-pure
-
-      - name: Update eslint cache
-        uses: ./.github/actions/update-cache
-        with:
-          path: ${{ github.workspace}}/.eslintcache
-          key: ${{ env.ESLINT_CACHE_KEY }}

.github/workflows/cache-warm.yml

@@ -0,0 +1,172 @@
+# Writes the three large dependency caches. Every other job restores them and none of them writes.
+#
+# A single writer rather than the usual let-every-job-save arrangement, because a pull request here fans
+# out to roughly 200 jobs, ~75 of which install Cypress. Letting each of those save would have them all
+# build a 200MB archive and race for one reservation on every lockfile change, and all pull the Cypress
+# binary at once on a version bump.
+#
+# The ESLint cache is the exception and saves from the lint job itself: it is under a megabyte and only a
+# couple of jobs write it, so there is no herd to avoid.
+#
+# A cache is readable from the ref that saved it, from that ref's pull requests, and - for every ref -
+# from the default branch. Warming on push to each merge target therefore serves the pull requests aimed
+# at it, and master's copy backs up every ref that has none of its own.
+#
+# Keys are content-derived (see .github/scripts/cache-keys.sh), so a push whose dependencies already have
+# an entry does nothing but three lookups. There is no cron: nothing here is keyed by date.
+#
+#
+# PRINCIPLES:
+#   - The cache is never wrong!
+#   - Caches are immutable once created.
+#   - Caches are for speeding up builds, not for correctness.
+#   - It is faster to download a large cache than to re-resolve missing dependencies.
+
+name: Cache Warm
+
+on:
+  push:
+    branches:
+      - master
+      - "release-x.*.x"
+  workflow_dispatch:
+
+concurrency:
+  group: cache-warm-${{ github.ref }}
+  # Pushes to master land a median of 27 minutes apart and a full resolve takes longer, so cancelling in
+  # progress would abort most warms before they save and a ref could stay cold indefinitely. Queueing
+  # costs one wait instead: the queued run finds every key present and exits in about a minute.
+  cancel-in-progress: false
+
+jobs:
+  warm:
+    # Forks read the upstream default branch's caches and cannot usefully write their own, so warming
+    # there would burn a runner for nothing.
+    if: ${{ github.repository == 'metabase/metabase' }}
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Cache spec
+        id: cache-spec
+        run: .github/scripts/cache-keys.sh | tee -a "$GITHUB_OUTPUT"
+
+      # `lookup-only` with no restore-keys asks whether this exact dependency set is already cached.
+      # Paths come from the spec, the same ones the save below declares - a lookup that named different
+      # paths would compute a different cache identity and report a miss every time.
+      - name: Look up M2 cache
+        id: m2-lookup
+        uses: actions/cache/restore@v5
+        with:
+          path: ${{ steps.cache-spec.outputs.m2-path }}
+          key: ${{ steps.cache-spec.outputs.m2-key }}
+          lookup-only: true
+      - name: Look up bun store
+        id: bun-lookup
+        uses: actions/cache/restore@v5
+        with:
+          path: ${{ steps.cache-spec.outputs.bun-store-path }}
+          key: ${{ steps.cache-spec.outputs.bun-store-key }}
+          lookup-only: true
+      - name: Look up Cypress binary
+        id: cypress-lookup
+        uses: actions/cache/restore@v5
+        with:
+          path: ${{ steps.cache-spec.outputs.cypress-path }}
+          key: ${{ steps.cache-spec.outputs.cypress-key }}
+          lookup-only: true
+
+      - name: Prepare backend
+        if: steps.m2-lookup.outputs.cache-hit != 'true'
+        uses: ./.github/actions/prepare-backend
+
+      # Pre-resolve every Clojure dependency classpath CI actually uses, so the saved cache is a SUPERSET
+      # of what each job resolves at runtime.
+      #
+      # Why a single `-P` is not enough: tools.deps selects dependency *versions* globally per classpath,
+      # so different alias combinations can resolve the same transitive lib to different versions (e.g.
+      # `org.clojure/data.json` 2.4.0 vs 2.5.x, `org.ow2.asm/asm` 9.2 vs newer). Resolving only one combo
+      # leaves the others to fetch their version-deltas straight from Maven Central / Clojars on every
+      # run -> intermittent 403s. See DEV-2094.
+      #
+      # Keep this list in sync with the `clojure` invocations across .github/. Each entry notes its
+      # consumer. We resolve the FULL alias strings (not a hand-reduced set) on purpose: if a currently
+      # dep-less alias later gains a dependency, this still covers it instead of silently drifting back
+      # into a cache gap.
+      - name: Pre-resolve Clojure dependencies
+        if: steps.m2-lookup.outputs.cache-hit != 'true'
+        shell: bash
+        run: |
+          set -euo pipefail
+          combos=(
+            ":build:dev:ee:ee-dev:drivers:drivers-dev:cljs"     # build + uberjar (combined classpath)
+            ":cljs"                                             # shadow-cljs (build:cljs); resolves :cljs alone -> covers asm:9.2
+            ":dev:ee:ee-dev:drivers:drivers-dev:test:eastwood"  # backend.yml (eastwood + eastwood/test)
+            ":dev:ci:ee:ee-dev:drivers:drivers-dev:test"        # test-driver.yml (ee) -> covers data.json:2.4.0
+            ":dev:ci:oss:oss-dev:drivers:drivers-dev:test"      # test-driver.yml (oss)
+            ":dev:ci:test:ee:ee-dev"                            # backend.yml matrix (ee)
+            ":dev:ci:test:oss:oss-dev"                          # backend.yml matrix (oss)
+            ":dev:ci:ee:ee-dev:test:cloverage"                  # backend-cloverage.yml
+            ":dev:drivers:drivers-dev:test"                     # reset-cloud-test-dataset.yml
+            ":dev:drivers:build:build-dev:build-test:ci"        # build-scripts.yml
+            ":test"                                             # build-scripts.yml (bin/build unit tests)
+            ":ee:drivers:load-namespaces"                       # backend.yml (load-namespaces)
+            ":ee:doc"                                           # docs-generate-base.yml
+            ":kondo"                                            # resolve-backport-conflicts.yml (replace-deps)
+            ":run:ee"                                           # cross-branch-migration-test
+            ":dev:ee:migrate"                                   # cross-branch-migration-test
+            ":whitespace-linter"                                # whitespace linter
+          )
+          for combo in "${combos[@]}"; do
+            echo "::group::clojure -P -A${combo}"
+            clojure -P -A"${combo}"
+            echo "::endgroup::"
+          done
+
+          echo "::group::./bin/mage"
+          ./bin/mage
+          echo "::endgroup::"
+
+      - name: Save M2 cache
+        if: steps.m2-lookup.outputs.cache-hit != 'true'
+        uses: actions/cache/save@v5
+        with:
+          path: ${{ steps.cache-spec.outputs.m2-path }}
+          key: ${{ steps.cache-spec.outputs.m2-key }}
+
+      # `prepare-frontend` installs bun, points it at the store path, and runs a frozen-lockfile install,
+      # which is what fills the store. Patches are deliberately not applied: a store cached with patches
+      # already in place breaks any pull request that changes or upgrades a patched dependency.
+      #
+      # This also runs when only the Cypress cache is missing, because `bun run cypress install` below
+      # needs the node_modules this step creates. Narrowing the condition to the bun store alone would
+      # leave that step with no Cypress binary to run.
+      - name: Install front-end dependencies
+        if: steps.bun-lookup.outputs.cache-hit != 'true' || steps.cypress-lookup.outputs.cache-hit != 'true'
+        uses: ./.github/actions/prepare-frontend
+        with:
+          apply-patches: "false"
+
+      - name: Save bun store
+        if: steps.bun-lookup.outputs.cache-hit != 'true'
+        uses: actions/cache/save@v5
+        with:
+          path: ${{ steps.cache-spec.outputs.bun-store-path }}
+          key: ${{ steps.cache-spec.outputs.bun-store-key }}
+
+      - name: Ensure that Cypress executable is ready
+        if: steps.cypress-lookup.outputs.cache-hit != 'true'
+        shell: bash
+        run: |
+          bun run cypress install
+          bun run cypress cache path
+          bun run cypress cache list
+          bun run cypress verify
+
+      - name: Save Cypress binary
+        if: steps.cypress-lookup.outputs.cache-hit != 'true'
+        uses: actions/cache/save@v5
+        with:
+          path: ${{ steps.cache-spec.outputs.cypress-path }}
+          key: ${{ steps.cache-spec.outputs.cypress-key }}

.github/workflows/check-backport-script.yml

@@ -3,7 +3,6 @@ name: Prevent backport.sh from being merged
 on:
   pull_request:
     types: [opened, synchronize, reopened]
-  merge_group:
 
 jobs:
   check-backport-script:

.github/workflows/cross-version.yml

@@ -98,9 +98,12 @@ jobs:
       - name: Show logs on failure
         if: failure()
         run: |
-          cd cross-version
-          docker compose logs metabase || true
-          docker compose logs postgres || true
+          for f in cross-version/logs/*.log; do
+            [ -e "$f" ] || continue
+            echo "::group::$f"
+            cat "$f"
+            echo "::endgroup::"
+          done
 
   # Notify Slack on nightly failures
   notify-on-failure:
@@ -222,6 +225,9 @@ jobs:
       - name: Show logs on failure
         if: failure()
         run: |
-          cd cross-version
-          docker compose logs metabase || true
-          docker compose logs postgres || true
+          for f in cross-version/logs/*.log; do
+            [ -e "$f" ] || continue
+            echo "::group::$f"
+            cat "$f"
+            echo "::endgroup::"
+          done

.github/workflows/disabled-drivers-slack-notification.yml

@@ -1,88 +0,0 @@
-name: Disabled Drivers Slack Notification
-
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: "0 9 * * 1" # every Monday at 9:00 UTC
-
-jobs:
-  notify-disabled-drivers:
-    if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
-    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
-    timeout-minutes: 5
-    steps:
-      - uses: actions/setup-node@v6.4.0
-        with:
-          node-version: lts/Jod
-
-      - name: Install Slack SDK
-        run: npm install @slack/web-api
-
-      - name: Check disabled drivers and notify Slack
-        uses: actions/github-script@v9
-        env:
-          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
-        with:
-          script: |
-            const { WebClient } = require('@slack/web-api');
-
-            // Fetch the config
-            const response = await fetch('https://raw.githubusercontent.com/metabase/ci-test-config/refs/heads/master/ci-test-config.json');
-            const config = await response.json();
-
-            const drivers = config.drivers || [];
-            const lastUpdated = config.metadata?.last_updated || 'unknown';
-            const reason = config.metadata?.reason || 'No reason provided';
-
-            // "skip" is the only status CI reads: the driver is not run at all. A driver that
-            // runs but must not gate is expressed as a suite-level rule in CI Conductor, which
-            // reports it in its own UI.
-            const skipped = drivers.filter(d => d.status === 'skip').map(d => d.name);
-
-            if (skipped.length === 0) {
-              console.log('No drivers are disabled. Skipping Slack notification.');
-              return;
-            }
-
-            const list = (names) => names.map(d => `\`${d}\``).join('  ');
-            const lines = [`:no_entry: *Disabled (not run):* ${list(skipped)}`];
-
-            if (!process.env.SLACK_BOT_TOKEN) {
-              throw new Error('SLACK_BOT_TOKEN is required');
-            }
-
-            const slack = new WebClient(process.env.SLACK_BOT_TOKEN);
-
-            await slack.chat.postMessage({
-              channel: 'engineering-ci',
-              text: 'CI Driver Status Report',
-              blocks: [
-                {
-                  type: 'section',
-                  text: {
-                    type: 'mrkdwn',
-                    text: `*CI Driver Status*\n${lines.join('\n')}`
-                  },
-                  accessory: {
-                    type: 'button',
-                    text: {
-                      type: 'plain_text',
-                      text: 'View Config',
-                      emoji: true
-                    },
-                    url: 'https://github.com/metabase/ci-test-config/blob/master/ci-test-config.json'
-                  }
-                },
-                {
-                  type: 'context',
-                  elements: [
-                    {
-                      type: 'mrkdwn',
-                      text: `${reason} · :clock1: *${lastUpdated}*`
-                    }
-                  ]
-                }
-              ]
-            });
-
-            console.log('Slack notification sent successfully');

.github/workflows/docs-generate-base.yml

@@ -33,6 +33,9 @@ jobs:
       - name: Prepare backend environment
         uses: ./.github/actions/prepare-backend
 
+      - name: Prepare frontend environment
+        uses: ./.github/actions/prepare-frontend
+
       - name: Set up Babashka
         uses: turtlequeue/setup-babashka@d78ec6570aea3b614bc695cafcceb82eb45c2af9 # v1.8.0
         with:
@@ -75,6 +78,22 @@ jobs:
       - name: Generate usage analytics documentation
         run: ./bin/generate-usage-analytics-docs.bb
 
+      - name: Generate embedding SDK documentation
+        id: generate_embedding_sdk_docs
+        run: |
+          set -e  # Exit on any error
+          echo "Generating embedding SDK documentation..."
+          bun run embedding-sdk:docs:generate
+        continue-on-error: false
+
+      - name: Generate embedding EAJS documentation
+        id: generate_embedding_eajs_docs
+        run: |
+          set -e  # Exit on any error
+          echo "Generating embedding EAJS documentation..."
+          bun run embedding-eajs:docs:generate
+        continue-on-error: false
+
       - name: Check for changes
         id: check_changes
         run: |
@@ -146,6 +165,8 @@ jobs:
           - \`clojure -M:ee:doc api-documentation\`
           - \`clojure -M:ee:doc command-documentation\`
           - \`./bin/generate-usage-analytics-docs.bb\`
+          - \`bun run embedding-sdk:docs:generate\`
+          - \`bun run embedding-eajs:docs:generate\`
 
           Please review the changes and merge if they look correct." \
               --label "Type:Documentation" \

.github/workflows/drivers.yml

@@ -6,6 +6,49 @@ on:
       skip:
         type: boolean
         default: false
+      force-run:
+        description: Run the full suite regardless of the diff (master / release branches, ci:run-all label).
+        type: boolean
+        default: false
+  # Run one driver job on demand, against the ref you dispatch on, optionally under a profiler.
+  # Everything else about the job -- credentials, services, test args, quarantine gating -- is
+  # whatever the normal CI run uses, because it is the same job.
+  workflow_dispatch:
+    inputs:
+      driver:
+        description: 'Which driver job to run. Only this one runs; the usual decision rules are bypassed.'
+        type: choice
+        required: true
+        options:
+          - athena
+          - bigquery
+          - clickhouse
+          - databricks
+          - druid-jdbc
+          - h2
+          - mongo
+          - mongo-sharded-cluster
+          - mongo-ssl
+          - mysql-mariadb
+          - oracle
+          - postgres
+          - presto-jdbc
+          - redshift
+          - snowflake
+          - sparksql
+          - sqlite
+          - sqlserver
+          - vertica
+      tests:
+        description: 'Optional: run only these tests, comma- or space-separated, e.g. metabase.driver.bigquery-cloud-sdk-test/sync-test. Bare namespaces work too. Blank runs the job''s usual set.'
+        type: string
+        required: false
+        default: ''
+      profile:
+        description: 'Profile the test run and attach a flamegraph to the job. Adds sampling overhead.'
+        type: boolean
+        required: false
+        default: false
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}-drivers
@@ -15,8 +58,16 @@ concurrency:
 # ci-conductor (secrets: inherit is already set on the drivers call in
 # run-tests.yml). See DEV-2224.
 env:
-  CI_CONDUCTOR_BASE_URL: ${{ secrets.CI_CONDUCTOR_BASE_URL }}
+  CI_CONDUCTOR_BASE_URL: ${{ vars.CI_CONDUCTOR_BASE_URL }}
   CI_CONDUCTOR_WEBHOOK_SECRET: ${{ secrets.CI_CONDUCTOR_WEBHOOK_SECRET }}
+  # Both read by the test-driver action, which is what actually runs the tests. Set here rather than
+  # passed as inputs to each job so that turning either on is one line, not one line per driver.
+  # Empty (and so off) on workflow_call, where neither input exists.
+  #
+  # ONLY_TESTS replaces the job's own test selection, so every matrix leg of the chosen driver runs
+  # the whole list -- BigQuery, for instance, has three legs.
+  PROFILE_TESTS: ${{ inputs.profile }}
+  ONLY_TESTS: ${{ inputs.tests }}
 
 jobs:
   # This job determines which driver tests should run based on PR context.
@@ -62,9 +113,10 @@ jobs:
           # branch context, labels, and file changes to decide what runs.
           MAGE_ARGS=(
             --git-ref="${BASE_REF}"
-            --is-master-or-release="${IS_MASTER_OR_RELEASE}"
+            --force-run="${FORCE_RUN}"
             --pr-labels="${{ join(github.event.pull_request.labels.*.name, ',') }}"
             --skip="${{ inputs.skip }}"
+            --only-driver="${ONLY_DRIVER}"
           )
           echo "Running:"
           echo "./bin/mage -driver-decisions ${MAGE_ARGS[*]}"
@@ -78,7 +130,8 @@ jobs:
           ./bin/mage -driver-decisions "${MAGE_ARGS[@]}" --github-output-only >> "$GITHUB_OUTPUT"
         env:
           BASE_REF: ${{ github.event.pull_request.base.ref || github.ref_name }}
-          IS_MASTER_OR_RELEASE: ${{ github.ref_name == 'master' || startsWith(github.ref_name, 'release-x') }}
+          FORCE_RUN: ${{ inputs.force-run }}
+          ONLY_DRIVER: ${{ inputs.driver }}
         shell: bash
 
   be-tests-athena-ee:
@@ -471,21 +524,9 @@ jobs:
           MYSQL_ALLOW_EMPTY_PASSWORD: true
           MYSQL_DATABASE: mb_test
     env:
-      # Only run old migrations tests on pushes to master or release branches. All other branches should skip tests
-      # with the tag `mb/old-migrations-test`. `__ADDITIONAL_EXCLUDED_TAG__` is not used anywhere outside of splicing
-      # it in to the command below.
-      __ADDITIONAL_EXCLUDED_TAG__: >-
-        ${{
-          (
-            github.event_name == 'push' &&
-            (
-              github.ref_name == 'master' ||
-              startsWith(github.ref_name, 'release-x')
-            ) &&
-            ''
-          ) ||
-          ':mb/old-migrations-test'
-        }}
+      # __ADDITIONAL_EXCLUDED_TAG__: ${{ !inputs.force-run && ':mb/old-migrations-test' || '' }}
+      # GDGT-3126: re-enable and properly fix old migrations tests
+      __ADDITIONAL_EXCLUDED_TAG__: ':mb/old-migrations-test'
       # actual serious env vars below
       CI: 'true'
       DRIVERS: mysql
@@ -783,21 +824,9 @@ jobs:
             needs-python-runner: true
     name: "${{ matrix.version.name }} ${{ matrix.job.name }}"
     env:
-      # Only run old migrations tests on pushes to master or release branches. All other branches should skip tests
-      # with the tag `mb/old-migrations-test`. `__ADDITIONAL_EXCLUDED_TAG__` is not used anywhere outside of splicing
-      # it in to the command below.
-      __ADDITIONAL_EXCLUDED_TAG__: >-
-        ${{
-          (
-            github.event_name == 'push' &&
-            (
-              github.ref_name == 'master' ||
-              startsWith(github.ref_name, 'release-x')
-            ) &&
-            ''
-          ) ||
-          ':mb/old-migrations-test'
-        }}
+      # __ADDITIONAL_EXCLUDED_TAG__: ${{ !inputs.force-run && ':mb/old-migrations-test' || '' }}
+      # GDGT-3126: re-enable and properly fix old migrations tests
+      __ADDITIONAL_EXCLUDED_TAG__: ':mb/old-migrations-test'
       # actual serious env vars below
       CI: 'true'
       DRIVERS: postgres
@@ -1249,27 +1278,28 @@ jobs:
     needs:
       - determine-driver-skips
       # if you add a driver job, you must add it to this list for it to be a required check
-      - be-tests-h2
       - be-tests-athena-ee
-      - be-tests-snowflake-ee
       - be-tests-bigquery-cloud-sdk-ee
+      - be-tests-clickhouse-ee
       - be-tests-databricks-ee
+      - be-tests-databricks-multi-catalog-ee
       - be-tests-druid-jdbc-ee
-      - be-tests-mysql-mariadb
+      - be-tests-h2
+      - be-tests-h2-oss
       - be-tests-mongo
-      - be-tests-mongo-ssl
       - be-tests-mongo-sharded-cluster-ee
+      - be-tests-mongo-ssl
+      - be-tests-mysql-mariadb
       - be-tests-oracle
       - be-tests-postgres
       - be-tests-presto-jdbc-ee
       - be-tests-redshift-ee
+      - be-tests-snowflake-ee
       - be-tests-sparksql-ee
       - be-tests-sqlite-ee
       - be-tests-sqlserver
+      - be-tests-vertica-ee
       # - be-tests-starburst-ee
-      # TODO(rileythomp, 2025-08-20): Re-enable vertica tests once the docker image is updated
-      # - be-tests-vertica-ee
-      - be-tests-clickhouse-ee
     runs-on: ${{ vars.SLIM_RUNNER_KEY }}
     timeout-minutes: 5
     name: drivers-tests-result

.github/workflows/e2e-matrix-builder.yml

@@ -35,7 +35,7 @@ jobs:
           sparse-checkout-cone-mode: false
       - uses: actions/setup-node@v6.4.0
         with:
-          node-version: lts/Jod # 22.x.x
+          node-version: lts/Krypton # 24.x.x
       - name: Build e2e matrix
         uses: actions/github-script@v9
         id: matrix

.github/workflows/e2e-test.yml

@@ -41,7 +41,7 @@ env:
   # (e.g. "https://conductor.<host>"); each consumer appends the path it needs
   # (the reporter POSTs to "/webhooks/failed-tests"). Callers pass
   # `secrets: inherit`; reporting no-ops when it's unset.
-  CI_CONDUCTOR_BASE_URL: ${{ secrets.CI_CONDUCTOR_BASE_URL }}
+  CI_CONDUCTOR_BASE_URL: ${{ vars.CI_CONDUCTOR_BASE_URL }}
   # Shared secret sent as the `x-internal-secret` header to authenticate.
   CI_CONDUCTOR_WEBHOOK_SECRET: ${{ secrets.CI_CONDUCTOR_WEBHOOK_SECRET }}
   REPO_ID: ${{ github.event.repository.id }}

.github/workflows/embedding-sdk-component-tests.yml

@@ -8,7 +8,7 @@ env:
   TERM: xterm
   TZ: US/Pacific # to make Node match the instance tz
   MB_EDITION: "ee"
-  CI_CONDUCTOR_BASE_URL: ${{ secrets.CI_CONDUCTOR_BASE_URL }}
+  CI_CONDUCTOR_BASE_URL: ${{ vars.CI_CONDUCTOR_BASE_URL }}
   CI_CONDUCTOR_WEBHOOK_SECRET: ${{ secrets.CI_CONDUCTOR_WEBHOOK_SECRET }}
   REPO_ID: ${{ github.event.repository.id }}
   COMMIT_SHA: ${{ github.event.pull_request.head.sha || github.sha }}

.github/workflows/embedding-sdk-host-sample-apps-tests.yml

@@ -376,7 +376,7 @@ jobs:
       # Host apps are the only suite here running through Metabase's Cypress config,
       # whose `after:spec` hook reports failures and writes QUARANTINE_FAILURES_FILE.
       # Sample-app suites load their own config (no-op), so ci-conductor is scoped to this job.
-      CI_CONDUCTOR_BASE_URL: ${{ secrets.CI_CONDUCTOR_BASE_URL }}
+      CI_CONDUCTOR_BASE_URL: ${{ vars.CI_CONDUCTOR_BASE_URL }}
       CI_CONDUCTOR_WEBHOOK_SECRET: ${{ secrets.CI_CONDUCTOR_WEBHOOK_SECRET }}
       CI_CONDUCTOR_TEST_SUITE: embedding-sdk-host-app
       REPO_ID: ${{ github.event.repository.id }}

.github/workflows/embedding-sdk-labels-reminder.yml

@@ -5,7 +5,6 @@ on:
     types: [auto_merge_enabled, review_requested, labeled, unlabeled, synchronize]
     branches:
       - "master"
-  merge_group:
 
 jobs:
   files-changed:

.github/workflows/emotion-stats-update.yml

@@ -1,4 +1,4 @@
-# Weekly count of files importing @emotion/*, uploaded to stats.metabase.com.
+# Weekly count of files importing @emotion/*, imported into eng-stats-importer.
 # Feeds the "Emotion CSS Elimination Progress" chart tracking the migration
 # off Emotion onto Mantine (+ CSS modules as a fallback).
 name: Emotion Stats Update
@@ -15,6 +15,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v6
+      - uses: ./.github/actions/prepare-node-bun
       - name: Get Emotion file count
         id: get-emotion-file-count
         run: |
@@ -26,8 +27,6 @@ jobs:
             git grep -l -E "(from|import) ['\"]@emotion/" -- \
               'frontend/**/*.ts' \
               'frontend/**/*.tsx' \
-              'frontend/**/*.js' \
-              'frontend/**/*.jsx' \
               | wc -l || true
           )
 
@@ -35,8 +34,6 @@ jobs:
             git grep -l -E "(from|import) ['\"]@emotion/" -- \
               'enterprise/frontend/**/*.ts' \
               'enterprise/frontend/**/*.tsx' \
-              'enterprise/frontend/**/*.js' \
-              'enterprise/frontend/**/*.jsx' \
               | wc -l || true
           )
 
@@ -44,35 +41,8 @@ jobs:
 
           echo "EMOTION_FILES=$((oss + ee))" >> "$GITHUB_OUTPUT"
       - name: Upload count to Stats
-        uses: actions/github-script@v9
         env:
           EMOTION_FILES: ${{ steps.get-emotion-file-count.outputs.EMOTION_FILES }}
-          API_KEY: ${{ secrets.STATS_API_KEY }}
-        with:
-          script: | # js
-            const { uploadCsvToMb } = require('${{ github.workspace }}/.github/scripts/csv-to-mb.js');
-
-            console.log("EMOTION_FILES", Number(process.env.EMOTION_FILES));
-
-            // Keys become CSV headers and must match the target table's columns
-            // (Metabase slugifies both sides, so casing/spacing is forgiving).
-            const data = [
-              {
-                'Date': new Date().toISOString().slice(0, 10), // YYYY-MM-DD
-                'Emotion Files': Number(process.env.EMOTION_FILES),
-              }
-            ];
-
-            // tableId 76283 = "Emotion Files" table on stats.metabase.com.
-            // Auth via x-api-key, sourced from STATS_API_KEY (see env block above).
-            uploadCsvToMb({
-              baseUrl: 'https://stats.metabase.com',
-              tableId: 76283,
-              jsonData: data,
-              mode: 'append',
-            }).then(() => {
-              console.log('Data uploaded successfully');
-            }).catch((error) => {
-              console.error('Error uploading data:', error);
-              process.exit(1);
-            });
+          ENG_STATS_URL: ${{ secrets.ENG_STATS_URL }}
+          API_KEY: ${{ secrets.ENG_STATS_API_KEY }}
+        run: bun .github/scripts/upload-emotion-stats.ts

.github/workflows/frontend.yml

@@ -35,7 +35,7 @@ env:
   # Consumed by the report-failures-to-ci-conductor step in fe-tests-unit. Absent
   # (e.g. fork PRs without secret access) the reporter no-ops. Matches the other
   # suite workflows (backend, drivers, e2e, app-db, semantic-search).
-  CI_CONDUCTOR_BASE_URL: ${{ secrets.CI_CONDUCTOR_BASE_URL }}
+  CI_CONDUCTOR_BASE_URL: ${{ vars.CI_CONDUCTOR_BASE_URL }}
   CI_CONDUCTOR_WEBHOOK_SECRET: ${{ secrets.CI_CONDUCTOR_WEBHOOK_SECRET }}
 
 jobs:
@@ -50,14 +50,17 @@ jobs:
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
 
-      - name: Get Eslint cache key
-        uses: ./.github/actions/get-cache-keys
-        id: get-cache-keys
-      - name: Restore ESLint cache
-        uses: actions/cache/restore@v5
+      - name: Cache spec
+        id: cache-spec
+        run: .github/scripts/cache-keys.sh | tee -a "$GITHUB_OUTPUT"
+      # Small enough, and written by few enough jobs, that this one reads and writes its own cache
+      # rather than waiting on cache-warm.
+      - name: ESLint cache
+        uses: actions/cache@v5
         with:
-          path: ${{ github.workspace}}/.eslintcache
-          key: ${{ steps.get-cache-keys.outputs.eslint-cache-key }}
+          path: ${{ steps.cache-spec.outputs.eslint-path }}
+          key: ${{ steps.cache-spec.outputs.eslint-key }}
+          restore-keys: ${{ steps.cache-spec.outputs.eslint-restore-key }}
 
       - name: Compile CLJS
         run: bun run build-pure:cljs
@@ -113,7 +116,7 @@ jobs:
         # Keep this step continue-on-error because the quarantine logic controls whether it ultimately fails.
         continue-on-error: true
       - name: Report failed tests to ci-conductor
-        if: ${{ !cancelled() && steps.fe-tests.outcome == 'failure' }}
+        if: ${{ !cancelled() && ( steps.fe-tests.outcome == 'failure' || github.run_attempt != '1' ) }}
         # This step should NEVER fail the job!
         continue-on-error: true
         uses: ./.github/actions/report-failures-to-ci-conductor

.github/workflows/js-stats-update.yml

@@ -1,52 +0,0 @@
-name: JS Stats Update
-
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: 40 1 * * 4 # every Thursday at 1:40
-
-jobs:
-  js-stats:
-    if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
-    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@v6
-      - name: get JS file count
-        id: get-js-file-count
-        run: |
-          oss=$(find ./frontend/src/metabase -type f -name "*.js" -o -name "*.jsx" | wc -l)
-          ee=$(find ./enterprise/frontend/src/metabase-enterprise -type f -name "*.js" -o -name "*.jsx" | wc -l)
-
-          echo $((oss + ee)) javascript files
-
-          echo "JS_FILES=$((oss + ee))" >> "$GITHUB_OUTPUT"
-      - name: Upload count to Stats
-        uses: actions/github-script@v9
-        env:
-          JS_FILES: ${{ steps.get-js-file-count.outputs.JS_FILES }}
-          API_KEY: ${{ secrets.STATS_API_KEY }}
-        with:
-          script: | # js
-            const { uploadCsvToMb } = require('${{ github.workspace }}/.github/scripts/csv-to-mb.js');
-
-            console.log("JS_FILES", Number(process.env.JS_FILES));
-
-            const data = [
-              {
-                'Date': new Date().toISOString().slice(0, 10), // YYYY-MM-DD
-                'Js files': Number(process.env.JS_FILES),
-              }
-            ];
-
-            uploadCsvToMb({
-              baseUrl: 'https://stats.metabase.com',
-              tableId: 73270,
-              jsonData: data,
-              mode: 'append',
-            }).then(() => {
-              console.log('Data uploaded successfully');
-            }).catch((error) => {
-              console.error('Error uploading data:', error);
-              process.exit(1);
-            });

.github/workflows/lint.yml

@@ -64,6 +64,12 @@ jobs:
           fi
 
       - parallel:
+        # Deliberately ungated. This guards a coupling that drifts silently, so running it only when a
+        # path filter says .github changed would reintroduce the failure it exists to catch - and the
+        # filters here cover .github/workflows only, not the actions and scripts it also reads.
+        - name: Check cache-warm pre-resolves every alias combination CI uses
+          run: .github/scripts/check-preresolve-aliases.sh
+
         # Lint whitespace, always runs
         - name: Run Whitespace Linter
           run: clojure -T:whitespace-linter lint :whitespace-linter/progress-bar false

.github/workflows/loki-stress-test-flake-fix.yml

@@ -156,6 +156,9 @@ jobs:
 
       - name: Stress-test Loki
         run: |
+          # Loki's output is piped through tee below, and a pipeline normally reports the exit status of its last command.
+          # Without this a failed loki run would look like a pass, because tee itself succeeded.
+          set -o pipefail
           BURN_IN=${{ inputs.burn_in || '10' }}
           STORY_FILES='${{ needs.detect-changed-stories.outputs.story_files }}'
 
@@ -171,8 +174,11 @@ jobs:
 
             if bun run test-visual:loki \
               --reactUri file:./storybook-static \
-              --verboseRenderer; then
+              --verboseRenderer 2>&1 | tee .loki-run.log; then
               echo "✅ Run $i passed"
+            elif grep -q 'No stories were found' .loki-run.log; then
+              echo "::notice::Every story in the changed files is loki-skipped, nothing to stress test"
+              exit 0
             else
               echo "❌ Run $i FAILED"
               FAILED=$((FAILED + 1))

.github/workflows/loki.yml

@@ -2,7 +2,6 @@ name: Loki Visual Regression Testing
 
 on:
   pull_request:
-  merge_group:
 
 jobs:
   files-changed:

.github/workflows/module-boundaries-stats.yml

@@ -21,40 +21,11 @@ jobs:
         id: get-stats
         run: node frontend/lint/module-boundaries-stats.mjs | tee -a "$GITHUB_OUTPUT"
       - name: Upload stats
-        uses: actions/github-script@v9
         env:
           NAMED_MODULES: ${{ steps.get-stats.outputs.NAMED_MODULES }}
           ENFORCED_MODULES: ${{ steps.get-stats.outputs.ENFORCED_MODULES }}
           UNMODULED: ${{ steps.get-stats.outputs.UNMODULED }}
           VIOLATIONS: ${{ steps.get-stats.outputs.VIOLATIONS }}
-          API_KEY: ${{ secrets.STATS_API_KEY }}
-        with:
-          script: | # js
-            const { uploadCsvToMb } = require('${{ github.workspace }}/.github/scripts/csv-to-mb.js');
-
-            console.log("NAMED_MODULES", Number(process.env.NAMED_MODULES));
-            console.log("ENFORCED_MODULES", Number(process.env.ENFORCED_MODULES));
-            console.log("UNMODULED", Number(process.env.UNMODULED));
-            console.log("VIOLATIONS", Number(process.env.VIOLATIONS));
-
-            const data = [
-              {
-                'Date': new Date().toISOString().slice(0, 10), // YYYY-MM-DD
-                'Modules': Number(process.env.NAMED_MODULES),
-                'Enforced modules': Number(process.env.ENFORCED_MODULES),
-                'Unmoduled folders': Number(process.env.UNMODULED),
-                'Violations': Number(process.env.VIOLATIONS),
-              }
-            ];
-
-            uploadCsvToMb({
-              baseUrl: 'https://stats.metabase.com',
-              tableId: 75146,
-              jsonData: data,
-              mode: 'append',
-            }).then(() => {
-              console.log('Data uploaded successfully');
-            }).catch((error) => {
-              console.error('Error uploading data:', error);
-              process.exit(1);
-            });
+          ENG_STATS_URL: ${{ secrets.ENG_STATS_URL }}
+          API_KEY: ${{ secrets.ENG_STATS_API_KEY }}
+        run: bun .github/scripts/upload-module-boundaries-stats.ts

.github/workflows/notify.issue-labeled.yml

@@ -91,7 +91,7 @@ jobs:
           LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}
         with:
           script: |
-            const { findLinearIssue } = require('./.github/scripts/find-linear-issue.js');
+            const { findLinearIssue } = require('./.github/scripts/linear-issues.js');
 
             const title = context.payload.issue.title;
             const issueUrl = context.payload.issue.html_url;

.github/workflows/perf-test-labeled.yml

@@ -9,13 +9,7 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  uberjar:
-    if: ${{ github.event.label.name == 'Run-perf' }}
-    uses: ./.github/workflows/uberjar.yml
-    secrets: inherit
-
   run-perf-test:
-    needs: [uberjar]
     if: ${{ github.event.label.name == 'Run-perf' }}
     uses: ./.github/workflows/perf-test.yml
     secrets: inherit

.github/workflows/perf-test.yml

@@ -5,46 +5,16 @@ on:
   workflow_call:
 jobs:
   build:
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    name: Build and dockerize Metabase image
     if: github.event.pull_request.head.repo.full_name == github.repository
-    name: Build Metabase Docker image
-    timeout-minutes: 60
     permissions:
       id-token: write
       contents: read
       actions: read
-    steps:
-      - name: Checkout source code
-        uses: actions/checkout@v6
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1
-        with:
-          role-to-assume: ${{ secrets.PR_ENV_IAM_ROLE }}
-          role-session-name: GitHub_to_AWS_via_FederatedOIDC
-          aws-region: us-east-1
-      - name: Login to Amazon ECR
-        uses: aws-actions/amazon-ecr-login@183a1442edf41672e66566b7fc560e297a290896 # v2
-        with:
-          registries: "${{ secrets.PR_ENV_AWS_ACCOUNT_ID }}"
-      - name: Retrieve uberjar artifact for ee
-        uses: ./.github/actions/fetch-artifact
-        with:
-          commit: ${{ github.event.pull_request.head.sha || github.sha }}
-          edition: ee
-          extract-path: "target/uberjar"
-          output-name: "metabase.jar"
-      - name: Move uberjar to bin/docker
-        run: |
-          jar xf target/uberjar/metabase.jar
-          mv target/uberjar/metabase.jar bin/docker/metabase.jar
-      - name: Build container
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
-        with:
-          context: bin/docker/
-          platforms: linux/amd64
-          network: host
-          tags: ${{ secrets.PR_ENV_AWS_ACCOUNT_ID }}.dkr.ecr.us-east-1.amazonaws.com/metabase-enterprise:pr${{ github.event.number }}
-          push: true
+    uses: ./.github/workflows/build-private-ee-docker-image.yml
+    secrets:
+      PR_ENV_IAM_ROLE: ${{ secrets.PR_ENV_IAM_ROLE }}
+      PR_ENV_AWS_ACCOUNT_ID: ${{ secrets.PR_ENV_AWS_ACCOUNT_ID }}
   launch_perf_test:
     needs: [build]
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
@@ -106,7 +76,7 @@ jobs:
         run: aws s3 cp s3://metabase-pr-env/perf-test-pr.yml.tmpl ./perf-test-pr.yml.tmpl
       - name: Trim SHA
         env:
-          SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+          SHA: ${{ needs.build.outputs.tag }}
         id: split
         run: echo "fragment=${SHA:5}" >> "$GITHUB_OUTPUT"
       - name: Render Deployment YAML
@@ -115,10 +85,10 @@ jobs:
           input: ./perf-test-pr.yml.tmpl
           output: ./perf-test-pr.yml
         env:
-          IMAGE_TAG: pr${{ github.event.number }}
+          IMAGE_TAG: ${{ needs.build.outputs.tag }}
           PR_NUMBER: ${{ github.event.number }}
           RUN_ID: ${{ steps.split.outputs.fragment }}
-          SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+          SHA: ${{ needs.build.outputs.tag }}
           TEST_NAME: test
       - name: Deploy PR Review ENV
         run: |

.github/workflows/rerun-workflows.yml

@@ -15,7 +15,6 @@ jobs:
     env:
       BRANCH_NAME: ${{ github.event.workflow_run.head_branch }}
       AUTHOR_NAME: ${{ github.event.workflow_run.head_commit.author.name }}
-      AUTHOR_LOGIN: ${{ github.event.workflow_run.head_commit.author.username }}
     steps:
       - name: Generate job summary
         run: |
@@ -30,15 +29,11 @@ jobs:
         with:
           sparse-checkout: |
             .github
-            release
-
-      - name: Prepare release scripts
-        uses: ./.github/actions/prepare-release-scripts
 
       - name: Trigger a re-run
         uses: actions/github-script@v9
         env:
-          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+          LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}
         with:
           script: | # js
             const MAX_ATTEMPTS = 1;
@@ -46,9 +41,10 @@ jobs:
             const FAILED_RUN_URL = "${{ github.event.workflow_run.html_url }}";
             const FAILED_RUN_NAME = "${{ github.event.workflow_run.name }}";
             const BREAKING_COMMIT = "${{ github.event.workflow_run.head_sha }}";
-            let AUTHOR = process.env.AUTHOR_NAME;
-            let AUTHOR_LOGIN = process.env.AUTHOR_LOGIN;
+            const AUTHOR = process.env.AUTHOR_NAME;
             const BRANCH = process.env.BRANCH_NAME;
+            const LINEAR_TEAM_ID = '2e3af6a2-9b19-4abd-b72c-4b5665054861'; // DevEx team
+            const CI_TRIAGE_LABEL_ID = '1af2175c-8ffa-4765-9bbd-5b6166def8a0'; // 'CI Triage' label
 
             if (ATTEMPT <= MAX_ATTEMPTS) {
               try {
@@ -65,91 +61,50 @@ jobs:
                 }
               }
             } else if (!BRANCH.includes('backport-')) {
-              // notify slack of repeated failure
-              const { mentionUserByGithubLogin, sendSlackMessage } = require('${{ github.workspace }}/release/dist/index.cjs');
+              const { createLinearIssue } = require('./.github/scripts/linear-issues.js');
 
               // find out which jobs failed
               const { owner, repo } = context.repo;
 
-              const jobInfo = await github.rest.actions.listJobsForWorkflowRun({
+              const jobs = await github.paginate(github.rest.actions.listJobsForWorkflowRun, {
                 owner,
                 repo,
                 run_id: ${{ github.event.workflow_run.id }},
                 per_page: 100,
               });
 
-              const failedJobs = jobInfo.data.jobs
+              // the `*-tests-result` jobs only aggregate the jobs they depend on, so an
+              // issue for one of them would just duplicate the real failures
+              const failedJobs = jobs
                 .filter(job => job.status === "completed" && job.conclusion === "failure" && !job.name.includes("-tests-result"));
 
-              // don't bother slack if only the flaky job failed
-              if (failedJobs.every(job => job.name.toLowerCase().includes("flaky"))) {
-                return;
-              }
+              const shortSha = BREAKING_COMMIT.slice(0, 7);
+              const commitUrl = `https://github.com/${owner}/${repo}/commit/${BREAKING_COMMIT}`;
 
-              // the workflow_run payload omits the github login when the commit
-              // author isn't matched to a github account, so look it up from
-              // the commit itself
-              if (!AUTHOR_LOGIN) {
-                try {
-                  const { data: commit } = await github.rest.repos.getCommit({
-                    owner,
-                    repo,
-                    ref: BREAKING_COMMIT,
-                  });
+              // one issue per failing job, so they can be triaged and assigned separately
+              for (const job of failedJobs) {
+                const description = [
+                  `\`${job.name}\` is failing on \`${owner}/${repo}@${BRANCH}\` after ${ATTEMPT} attempts.`,
+                  ``,
+                  `- **Author:** ${AUTHOR}`,
+                  `- **Commit:** [\`${shortSha}\`](${commitUrl})`,
+                  `- **Failed job:** [${job.name}](${job.html_url})`,
+                  `- **Failed run:** [${FAILED_RUN_NAME}](${FAILED_RUN_URL})`,
+                ].join('\n');
 
-                  AUTHOR_LOGIN = commit.author?.login ?? '';
-                  AUTHOR = AUTHOR || commit.commit?.author?.name || '';
-                } catch (error) {
-                  console.log(`Could not look up the author of ${BREAKING_COMMIT}: ${error.message}`);
+                // never fail this job over Linear — it would pollute our CI stats
+                const result = await createLinearIssue({
+                  teamId: LINEAR_TEAM_ID,
+                  labelIds: [CI_TRIAGE_LABEL_ID],
+                  title: `CI failure on ${BRANCH}: ${job.name} (${shortSha})`,
+                  description,
+                  linearApiKey: process.env.LINEAR_API_KEY,
+                }).catch(error => ({ success: false, message: error.message }));
+
+                if (result.success) {
+                  core.info(`Created Linear issue ${result.issue.identifier}: ${result.issue.url}`);
+                } else {
+                  core.warning(`Could not create a Linear issue for ${job.name}: ${result.message}`);
                 }
               }
-
-              const failedJobsList = failedJobs.map(job => ({
-                "type": "rich_text_section",
-                "elements": [
-                  {
-                    "type": "link",
-                    "text": job.name,
-                    "url": job.html_url,
-                  }
-                ]
-              }));
-
-              await sendSlackMessage({
-                channelName: 'engineering-ci',
-                message: 'Failing tests',
-                blocks: [
-                  {
-                    "type": "header",
-                    "text": {
-                      "type": "plain_text",
-                      "text": `:warning: CI is failing on ${repo}@${BRANCH}`,
-                      "emoji": true,
-                    }
-                  },
-                ],
-                attachments: [{
-                  color: BRANCH === 'master' ? '#f85149' : "#ffce33",
-                  blocks: [
-                    {
-                      "type": "section",
-                      "text": {
-                        "type": "mrkdwn",
-                        "text": `Commit <https://github.com/metabase/metabase/commit/${BREAKING_COMMIT}|${BREAKING_COMMIT.slice(0,7)}> by ${AUTHOR} (${mentionUserByGithubLogin(AUTHOR_LOGIN)}) has failing <${FAILED_RUN_URL}|${FAILED_RUN_NAME}> tests on <https://github.com/${owner}/${repo}/commits/${BRANCH}|\`${BRANCH}\`>`
-                      },
-                    },
-                    {
-                      "type": "rich_text",
-                      "block_id": "block1",
-                      "elements": [
-                        {
-                          "type": "rich_text_list",
-                          "style": "bullet",
-                          "elements": failedJobsList,
-                        },
-                      ],
-                    }
-                  ]
-                }]
-              });
             }

.github/workflows/resolve-backport-conflicts.yml

@@ -133,7 +133,7 @@ jobs:
         id: claude
         uses: anthropics/claude-code-base-action@e8132bc5e637a42c27763fc757faa37e1ee43b34 # v0.0.63
         env:
-          NODE_VERSION: "22"
+          NODE_VERSION: "24"
         with:
           # TODO: get a dedicated API key, sharing repro bot's key for now
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY_BACKPORT_FIX }}

.github/workflows/run-tests.yml

@@ -7,7 +7,6 @@ on:
       - "release-**"
   pull_request:
     types: [opened, synchronize, reopened]
-  merge_group:
   workflow_dispatch:
 
 permissions:
@@ -19,29 +18,59 @@ permissions:
   security-events: write
 
 jobs:
-  create-test-plan:
-    if: ${{ !contains(github.event.pull_request.labels.*.name,'ci skip') }}
-    name: Create test plan
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+  # `force-run` and `force-skip` are global overrides; `defer` means this
+  # job has no opinion and every downstream gate behaves as it always has.
+  should-run:
+    name: Decide which jobs should run
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
+    timeout-minutes: 5
+    outputs:
+      verdict: ${{ steps.decide.outputs.verdict }}
+    steps:
+      - name: Decide
+        id: decide
+        # Precedence matters for the conditions below.
+        env:
+          VERDICT: >-
+            ${{ (github.ref_name == 'master' || startsWith(github.ref_name, 'release-x.')) && 'force-run'
+            || contains(github.event.pull_request.labels.*.name, 'ci:run-all') && 'force-run'
+            || contains(github.event.pull_request.labels.*.name, 'ci:skip') && 'force-skip'
+            || 'defer' }}
+        run: echo "verdict=$VERDICT" | tee -a "$GITHUB_OUTPUT"
+
+  files-changed:
+    needs: should-run
+    name: Detect changed files
+    if: ${{ needs.should-run.outputs.verdict == 'defer' }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
     timeout-minutes: 5
     outputs:
       e2e_all: ${{ steps.changes.outputs.e2e_all }}
-      e2e_all_files: ${{ steps.changes.outputs.e2e_all_files }}
       e2e_specs: ${{ steps.changes.outputs.e2e_specs }}
-      e2e_specs_files: ${{ steps.changes.outputs.e2e_specs_files }}
+      e2e_infra: ${{ steps.changes.outputs.e2e_infra }}
       backend_all: ${{ steps.changes.outputs.backend_all }}
       frontend_all: ${{ steps.changes.outputs.frontend_all }}
       frontend_sources: ${{ steps.changes.outputs.frontend_sources }}
+      frontend_unit_infra: ${{ steps.changes.outputs.frontend_unit_infra }}
+      frontend_loki_infra: ${{ steps.changes.outputs.frontend_loki_infra }}
+      shared_sources: ${{ steps.changes.outputs.shared_sources }}
       documentation: ${{ steps.changes.outputs.documentation }}
       embedding_documentation: ${{ steps.changes.outputs.embedding_documentation }}
       embedding_sdk_components: ${{ steps.changes.outputs.embedding_sdk_components }}
       embedding_sdk_host_sample_apps: ${{ steps.changes.outputs.embedding_sdk_host_sample_apps }}
       embedding_sdk_ci: ${{ steps.changes.outputs.embedding_sdk_ci }}
       custom_viz_all: ${{ steps.changes.outputs.custom_viz_all }}
-      stats: ${{ steps.compute.outputs.stats }}
-      fe_unit_specs_to_run: ${{ steps.compute.outputs.fe_unit_specs_to_run }}
-      loki_stories_to_run: ${{ steps.compute.outputs.loki_stories_to_run }}
-      e2e_specs_to_run: ${{ steps.compute.outputs.e2e_specs_to_run }}
+      no_source_code_changes: >-
+        ${{ steps.changes.outputs.documentation == 'true'
+        && steps.changes.outputs.backend_all == 'false'
+        && steps.changes.outputs.frontend_all == 'false'
+        && steps.changes.outputs.e2e_all == 'false' }}
+
+      all_changed_files: ${{ steps.changes.outputs.all_changed_files }}
+      e2e_all_files: ${{ steps.changes.outputs.e2e_all_files }}
+      e2e_specs_files: ${{ steps.changes.outputs.e2e_specs_files }}
+      frontend_sources_files: ${{ steps.changes.outputs.frontend_sources_files }}
+      backend_sources_files: ${{ steps.changes.outputs.backend_sources_files }}
     steps:
       - uses: actions/checkout@v6
       - name: Test which files changed
@@ -52,44 +81,62 @@ jobs:
           # comma separated list of files
           list-files: csv
           filters: .github/file-paths.yaml
+
+  create-test-plan:
+    needs: files-changed
+    name: Create test plan
+    if: ${{ github.event_name == 'pull_request' }}
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 10
+    outputs:
+      stats: ${{ steps.compute.outputs.stats }}
+      fe_unit_specs_to_run: ${{ steps.compute.outputs.fe_unit_specs_to_run }}
+      loki_stories_to_run: ${{ steps.compute.outputs.loki_stories_to_run }}
+      e2e_specs_to_run: ${{ steps.compute.outputs.e2e_specs_to_run }}
+    steps:
+      - uses: actions/checkout@v6
       - name: Create test plan
         id: compute
-        if: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && github.ref == 'refs/heads/master') }}
         uses: ./.github/actions/create-test-plan
         with:
-          changed-files: ${{ steps.changes.outputs.all_changed_files }}
-          fe-changed-files: ${{ steps.changes.outputs.frontend_sources_files }}
-          be-changed-files: ${{ steps.changes.outputs.backend_sources_files }}
-          unit-infra-touched: ${{ steps.changes.outputs.frontend_unit_infra }}
-          loki-infra-touched: ${{ steps.changes.outputs.frontend_loki_infra }}
-          e2e-infra-touched: ${{ steps.changes.outputs.e2e_infra }}
-          shared-sources-touched: ${{ steps.changes.outputs.shared_sources }}
+          changed-files: ${{ needs.files-changed.outputs.all_changed_files }}
+          fe-changed-files: ${{ needs.files-changed.outputs.frontend_sources_files }}
+          be-changed-files: ${{ needs.files-changed.outputs.backend_sources_files }}
+          unit-infra-touched: ${{ needs.files-changed.outputs.frontend_unit_infra }}
+          loki-infra-touched: ${{ needs.files-changed.outputs.frontend_loki_infra }}
+          e2e-infra-touched: ${{ needs.files-changed.outputs.e2e_infra }}
+          shared-sources-touched: ${{ needs.files-changed.outputs.shared_sources }}
 
   upload-affected-tests-stats:
     needs: create-test-plan
-    # Only land rows for the upstream repo so forks don't pollute the table.
-    if: ${{ !cancelled() && needs.create-test-plan.result == 'success' && (github.event.pull_request.head.repo.full_name == 'metabase/metabase' || (github.event_name == 'push' && github.repository == 'metabase/metabase')) }}
+    # Only land rows for PRs from the upstream repo so forks don't pollute the table.
+    if: |
+      !cancelled() &&
+      needs.create-test-plan.result == 'success' &&
+      github.event.pull_request.head.repo.full_name == 'metabase/metabase'
     # Stats upload is best-effort — a failure here shouldn't fail the PR run.
     continue-on-error: true
     runs-on: ${{ vars.SLIM_RUNNER_KEY }}
     timeout-minutes: 3
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/prepare-node-bun
       - name: Upload affected tests stats
-        # On push (merge to master) there is no PR context, so fall back to the
-        # commit SHAs and a 0 PR number.
         env:
           STATS_JSON: ${{ needs.create-test-plan.outputs.stats }}
-          TRIGGERED_BY: ${{ github.event_name == 'pull_request' && 'pr_update' || 'merge_to_master' }}
-          PR_NUMBER: ${{ github.event_name == 'pull_request' && github.event.pull_request.number || 0 }}
-          HEAD_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
-          BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }}
-          API_KEY: ${{ secrets.STATS_API_KEY }}
-        run: node .github/scripts/upload-affected-tests-stats.js
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          ENG_STATS_URL: ${{ secrets.ENG_STATS_URL }}
+          API_KEY: ${{ secrets.ENG_STATS_API_KEY }}
+        run: bun .github/scripts/upload-affected-tests-stats.ts
 
   uberjar:
-    needs: [create-test-plan]
-    if: ${{ !cancelled() && !(needs.create-test-plan.outputs.documentation == 'true' && needs.create-test-plan.outputs.backend_all == 'false' && needs.create-test-plan.outputs.frontend_all == 'false' && needs.create-test-plan.outputs.e2e_all == 'false') }}
+    needs: [should-run, files-changed]
+    if: |
+      !cancelled() && needs.should-run.outputs.verdict != 'force-skip' &&
+      (needs.should-run.outputs.verdict == 'force-run' ||
+      needs.files-changed.outputs.no_source_code_changes != 'true')
     uses: ./.github/workflows/uberjar.yml
     secrets: inherit
 
@@ -97,8 +144,12 @@ jobs:
   # The compile is doesn't depend on MB_EDITION
   e2e-cljs:
     name: Compile CLJS for e2e
-    needs: [create-test-plan]
-    if: ${{ !cancelled() && needs.create-test-plan.result == 'success' && needs.create-test-plan.outputs.e2e_all == 'true' }}
+    needs: [should-run, files-changed]
+    if: |
+      !cancelled() &&
+      (needs.should-run.outputs.verdict == 'force-run' ||
+      (needs.files-changed.result == 'success' &&
+       needs.files-changed.outputs.e2e_all == 'true'))
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 15
     steps:
@@ -121,7 +172,9 @@ jobs:
 
   static-viz-files-changed:
     name: Check whether static-viz files changed
-    if: ${{ !contains(github.event.pull_request.labels.*.name,'ci skip') }}
+    needs: should-run
+    # Its only consumer is the backend skip gate, which a force-run overrides.
+    if: ${{ needs.should-run.outputs.verdict == 'defer' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 10
     outputs:
@@ -144,46 +197,83 @@ jobs:
           filters: .github/static-viz-sources.yaml
 
   backend-tests:
-    if: ${{ !cancelled() && needs.create-test-plan.result == 'success' }}
-    needs: [create-test-plan, static-viz-files-changed]
+    if: |
+      !cancelled() &&
+      (needs.should-run.outputs.verdict == 'force-run' ||
+      needs.files-changed.result == 'success')
+    needs: [should-run, files-changed, static-viz-files-changed]
     uses: ./.github/workflows/backend.yml
     secrets: inherit
     with:
-      skip: ${{ needs.create-test-plan.outputs.backend_all != 'true' && needs.static-viz-files-changed.outputs.static_viz != 'true' }}
+      skip: >-
+        ${{ needs.should-run.outputs.verdict != 'force-run' &&
+        needs.files-changed.outputs.backend_all != 'true' &&
+        needs.static-viz-files-changed.outputs.static_viz != 'true' }}
+      force-run: ${{ needs.should-run.outputs.verdict == 'force-run' }}
 
   semantic-search-tests:
-    needs: create-test-plan
+    if: |
+      !cancelled() &&
+      (needs.should-run.outputs.verdict == 'force-run' ||
+      needs.files-changed.result == 'success')
+    needs: [should-run, files-changed]
     uses: ./.github/workflows/semantic-search.yml
     secrets: inherit
     with:
-      skip: ${{ needs.create-test-plan.outputs.backend_all != 'true' }}
+      skip: >-
+        ${{ needs.should-run.outputs.verdict != 'force-run' &&
+        needs.files-changed.outputs.backend_all != 'true' }}
 
   app-db-tests:
-    needs: create-test-plan
+    if: |
+      !cancelled() &&
+      (needs.should-run.outputs.verdict == 'force-run' ||
+      needs.files-changed.result == 'success')
+    needs: [should-run, files-changed]
     uses: ./.github/workflows/app-db.yml
     secrets: inherit
     with:
-      skip: ${{ needs.create-test-plan.outputs.backend_all != 'true' }}
+      skip: >-
+        ${{ needs.should-run.outputs.verdict != 'force-run' &&
+        needs.files-changed.outputs.backend_all != 'true' }}
+      force-run: ${{ needs.should-run.outputs.verdict == 'force-run' }}
 
   driver-tests:
-    needs: create-test-plan
+    if: |
+      !cancelled() &&
+      (needs.should-run.outputs.verdict == 'force-run' ||
+      needs.files-changed.result == 'success')
+    needs: [should-run, files-changed]
     uses: ./.github/workflows/drivers.yml
     secrets: inherit
     with:
-      skip: ${{ needs.create-test-plan.outputs.backend_all != 'true' }}
+      skip: >-
+        ${{ needs.should-run.outputs.verdict != 'force-run' &&
+        needs.files-changed.outputs.backend_all != 'true' }}
+      force-run: ${{ needs.should-run.outputs.verdict == 'force-run' }}
 
   frontend-tests:
-    needs: [create-test-plan]
-    if: ${{ !cancelled() && needs.create-test-plan.result == 'success' }}
+    needs: [should-run, files-changed]
+    if: |
+      !cancelled() &&
+      (needs.should-run.outputs.verdict == 'force-run' ||
+      needs.files-changed.result == 'success')
     uses: ./.github/workflows/frontend.yml
     secrets: inherit
     with:
-      skip: ${{ needs.create-test-plan.outputs.frontend_all != 'true' }}
-      skip-lint: ${{ needs.create-test-plan.outputs.frontend_all != 'true' && needs.create-test-plan.outputs.e2e_all != 'true' }}
-      skip-custom-viz: ${{ needs.create-test-plan.outputs.custom_viz_all != 'true' }}
+      skip: >-
+        ${{ needs.should-run.outputs.verdict != 'force-run' &&
+        needs.files-changed.outputs.frontend_all != 'true' }}
+      skip-lint: >-
+        ${{ needs.should-run.outputs.verdict != 'force-run' &&
+        needs.files-changed.outputs.frontend_all != 'true' &&
+        needs.files-changed.outputs.e2e_all != 'true' }}
+      skip-custom-viz: >-
+        ${{ needs.should-run.outputs.verdict != 'force-run' &&
+        needs.files-changed.outputs.custom_viz_all != 'true' }}
 
   e2e-tests:
-    needs: [create-test-plan, uberjar]
+    needs: [should-run, files-changed, uberjar]
     # Skip e2e tests when the uberjar build failed or was cancelled — the
     # downstream tests can't fetch a missing artifact, and we don't want to
     # mask the uberjar failure with a wave of misleading e2e errors. We still
@@ -194,54 +284,74 @@ jobs:
     # branch protection blocks the merge as pending.
     if: |
       always() && !cancelled() &&
-      needs.create-test-plan.result == 'success' &&
+      (needs.should-run.outputs.verdict == 'force-run' || needs.files-changed.result == 'success') &&
       needs.uberjar.result != 'failure' &&
       needs.uberjar.result != 'cancelled'
     uses: ./.github/workflows/e2e-tests.yml
     secrets: inherit
     with:
-      skip: ${{ needs.create-test-plan.outputs.e2e_all != 'true' }}
+      skip: >-
+        ${{ needs.should-run.outputs.verdict != 'force-run' &&
+        needs.files-changed.outputs.e2e_all != 'true' }}
       # here we pass the list of changed files
       # e.g. e2e/test/scenarios/onboarding/command-palette.cy.spec.js,e2e/test/scenarios/question/document-title.cy.spec.js
       # e2e_all_files includes all changes which trigger all e2e tests, if the list of changes files is included in the
       # list of changed specs files, then only specs are changed and we can run only those specs.
-      # Only narrow to changed specs on pull requests. On push to master/release branches (and the
-      # merge queue) the paths-filter still computes these file lists, so without this guard a push
-      # that touched only specs would silently run a narrowed suite — we always want the full suite there.
-      specs: ${{ github.event_name == 'pull_request' && needs.create-test-plan.outputs.e2e_all_files == needs.create-test-plan.outputs.e2e_specs_files && needs.create-test-plan.outputs.e2e_specs_files || '' }}
+      # Only narrow to changed specs on pull requests that haven't been forced to run everything.
+      # On push to master/release branches (and the merge queue) the paths-filter still computes
+      # these file lists, so without this guard a run that touched only specs would silently run a
+      # narrowed suite — we always want the full suite there.
+      specs: >-
+        ${{ needs.should-run.outputs.verdict != 'force-run' &&
+        github.event_name == 'pull_request' &&
+        needs.files-changed.outputs.e2e_all_files == needs.files-changed.outputs.e2e_specs_files &&
+        needs.files-changed.outputs.e2e_specs_files || '' }}
 
   embedding-sdk-package:
-    needs: [create-test-plan]
+    needs: [should-run, files-changed]
     if: |
       !cancelled() &&
-      (needs.create-test-plan.outputs.embedding_sdk_components == 'true' ||
-      needs.create-test-plan.outputs.frontend_sources == 'true' ||
-      needs.create-test-plan.outputs.embedding_documentation == 'true' ||
-      needs.create-test-plan.outputs.embedding_sdk_ci == 'true' ||
-      needs.create-test-plan.outputs.embedding_sdk_host_sample_apps == 'true')
+      (needs.should-run.outputs.verdict == 'force-run' ||
+      needs.files-changed.outputs.embedding_sdk_components == 'true' ||
+      needs.files-changed.outputs.frontend_sources == 'true' ||
+      needs.files-changed.outputs.embedding_documentation == 'true' ||
+      needs.files-changed.outputs.embedding_sdk_ci == 'true' ||
+      needs.files-changed.outputs.embedding_sdk_host_sample_apps == 'true')
     uses: ./.github/workflows/embedding-sdk-package-build.yml
     secrets: inherit
 
   sdk-tests:
-    needs: [uberjar, embedding-sdk-package, create-test-plan]
+    needs: [should-run, uberjar, embedding-sdk-package, files-changed]
     if: always() && !cancelled()
     uses: ./.github/workflows/embedding-sdk.yml
     secrets: inherit
     with:
-      cli-snippets-type-check: ${{ needs.create-test-plan.outputs.frontend_sources == 'true' }}
-      docs-snippets-type-check: ${{ needs.create-test-plan.outputs.embedding_documentation == 'true' }}
-      documentation-validation: ${{ needs.create-test-plan.outputs.frontend_sources == 'true' }}
-      component-tests: ${{ needs.create-test-plan.outputs.embedding_sdk_components == 'true' }}
-      host-sample-apps-tests: ${{ needs.create-test-plan.outputs.embedding_sdk_host_sample_apps == 'true' }}
-      skip: ${{ needs.embedding-sdk-package.result != 'success' || needs.uberjar.result != 'success' }}
+      cli-snippets-type-check: >-
+        ${{ needs.should-run.outputs.verdict == 'force-run' ||
+        needs.files-changed.outputs.frontend_sources == 'true' }}
+      docs-snippets-type-check: >-
+        ${{ needs.should-run.outputs.verdict == 'force-run' ||
+        needs.files-changed.outputs.embedding_documentation == 'true' }}
+      documentation-validation: >-
+        ${{ needs.should-run.outputs.verdict == 'force-run' ||
+        needs.files-changed.outputs.frontend_sources == 'true' }}
+      component-tests: >-
+        ${{ needs.should-run.outputs.verdict == 'force-run' ||
+        needs.files-changed.outputs.embedding_sdk_components == 'true' }}
+      host-sample-apps-tests: >-
+        ${{ needs.should-run.outputs.verdict == 'force-run' ||
+        needs.files-changed.outputs.embedding_sdk_host_sample_apps == 'true' }}
+      skip: >-
+        ${{ needs.embedding-sdk-package.result != 'success' ||
+        needs.uberjar.result != 'success' }}
 
   bundle-size:
-    needs: [uberjar, create-test-plan]
+    needs: [uberjar, files-changed]
     if: |
       !cancelled() &&
       github.event_name == 'pull_request' &&
       needs.uberjar.result == 'success' &&
-      needs.create-test-plan.outputs.frontend_sources == 'true'
+      needs.files-changed.outputs.frontend_sources == 'true'
     uses: ./.github/workflows/bundle-size.yml
     secrets: inherit
 

.github/workflows/semantic-search.yml

@@ -7,6 +7,32 @@ on:
         type: boolean
         default: false
 
+  # Run one semantic-search job on demand, against the ref you dispatch on, optionally under a
+  # profiler. Everything else about the job -- services, matrix legs, test args, quarantine gating --
+  # is whatever the normal CI run uses, because it is the same job.
+  workflow_dispatch:
+    inputs:
+      suite:
+        description: 'Which semantic-search job to run. Only this one runs; the others are skipped.'
+        type: choice
+        required: true
+        options:
+          - h2
+          - mariadb
+          - mysql
+          - postgres
+          - appdb-mode
+      tests:
+        description: 'Optional: run only these tests, comma- or space-separated, e.g. metabase-enterprise.semantic-search.index-test/some-test. Bare namespaces work too. Blank runs the job''s usual set.'
+        type: string
+        required: false
+        default: ''
+      profile:
+        description: 'Profile the test run and attach a flamegraph to the job. Adds sampling overhead.'
+        type: boolean
+        required: false
+        default: false
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}-semantic-search
   cancel-in-progress: true
@@ -15,12 +41,20 @@ concurrency:
 # ci-conductor (secrets: inherit is already set on the semantic-search call in
 # run-tests.yml). See DEV-2224.
 env:
-  CI_CONDUCTOR_BASE_URL: ${{ secrets.CI_CONDUCTOR_BASE_URL }}
+  CI_CONDUCTOR_BASE_URL: ${{ vars.CI_CONDUCTOR_BASE_URL }}
   CI_CONDUCTOR_WEBHOOK_SECRET: ${{ secrets.CI_CONDUCTOR_WEBHOOK_SECRET }}
+  # Both read by the test-driver action, which is what actually runs the tests. Set here rather than
+  # passed as inputs to each job so that turning either on is one line, not one line per job.
+  # Empty (and so off) on workflow_call, where neither input exists.
+  #
+  # ONLY_TESTS replaces the job's own test selection, so every matrix leg of the chosen job runs the
+  # whole list.
+  PROFILE_TESTS: ${{ inputs.profile }}
+  ONLY_TESTS: ${{ inputs.tests }}
 
 jobs:
   semantic-search-tests-h2:
-    if: ${{ !inputs.skip }}
+    if: ${{ !inputs.skip && (inputs.suite == '' || inputs.suite == 'h2') }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     strategy:
@@ -65,7 +99,7 @@ jobs:
           quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
 
   semantic-search-tests-mariadb:
-    if: ${{ !inputs.skip }}
+    if: ${{ !inputs.skip && (inputs.suite == '' || inputs.suite == 'mariadb') }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     strategy:
@@ -131,7 +165,7 @@ jobs:
           quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
 
   semantic-search-tests-mysql:
-    if: ${{ !inputs.skip }}
+    if: ${{ !inputs.skip && (inputs.suite == '' || inputs.suite == 'mysql') }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     strategy:
@@ -204,7 +238,7 @@ jobs:
           quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
 
   semantic-search-tests-postgres:
-    if: ${{ !inputs.skip }}
+    if: ${{ !inputs.skip && (inputs.suite == '' || inputs.suite == 'postgres') }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     strategy:
@@ -272,7 +306,7 @@ jobs:
   # MB_PGVECTOR_DB_URL is deliberately unset. The dedicated-harness tests gate themselves off; the
   # appdb-pgvector-mode round trip (and the URL-independent unit tests) run for real.
   semantic-search-tests-appdb-mode:
-    if: ${{ !inputs.skip }}
+    if: ${{ !inputs.skip && (inputs.suite == '' || inputs.suite == 'appdb-mode') }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     strategy:

.github/workflows/translation-context.yml

@@ -15,7 +15,7 @@ jobs:
       - uses: actions/checkout@v6
       - uses: actions/setup-node@v6.4.0
         with:
-          node-version: 22
+          node-version: 24
       - name: Harvest and write AI context to Crowdin
         timeout-minutes: 60
         env:

.github/workflows/uberjar.yml

@@ -143,7 +143,7 @@ jobs:
       - name: Prepare front-end environment
         uses: ./.github/actions/prepare-frontend
         with:
-          node-version: "${{ needs.get-build-requirements.outputs.node_version || '22' }}"
+          node-version: "${{ needs.get-build-requirements.outputs.node_version || '24' }}"
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
         with:

.github/workflows/update-e2e-timings.yml

@@ -38,7 +38,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v6.4.0
         with:
-          node-version: 22
+          node-version: 24
 
       - name: Collect and average timing data
         id: collect-timings

.gitignore

@@ -48,8 +48,6 @@ cypress.env.json
 **/node_modules
 /docs/**/package.json
 /docs/**/yarn.lock
-/docs/embedding/sdk/api/
-/docs/embedding/eajs/snippets/
 /frontend/test/snapshots/*
 /e2e/snapshots/*
 /e2e/tmp/*
@@ -77,6 +75,9 @@ cypress.env.json
 /logs
 /modules/drivers/*/resources/namespaces.edn
 /modules/drivers/*/target
+# Generated in-process embedder model bundles and build outputs.
+/modules/embedder/resources/metabase-embedder
+/modules/embedder/target
 /plugins
 /process.yml
 /reset-password-artifacts

.lychee/config.toml

@@ -1,6 +1,6 @@
 accept = ["200..=204", "429"]
 exclude = ["\\.html(#.*)?$"]
-exclude_path = ["docs/util"]
+exclude_path = ["docs/util", "docs/embedding/sdk/api"]
 no_progress = true
 include_fragments = "full"
 verbose = "error"

.nvmrc

@@ -1 +1 @@
-v22.13.1
+v24.19.0

.storybook/main.ts

@@ -9,8 +9,8 @@ const { CSS_CONFIG } = require("../frontend/build/shared/rspack/css-config");
 
 const mainAppStories = [
   "../frontend/**/*.mdx",
-  "../frontend/*/!(embedding-sdk-bundle|embedding-sdk-shared)/**/*.stories.@(js|jsx|ts|tsx)",
-  "../enterprise/frontend/*/!(embedding-sdk-ee|embedding-sdk-package)/**/*.stories.@(js|jsx|ts|tsx)",
+  "../frontend/*/!(embedding-sdk-bundle|embedding-sdk-shared)/**/*.stories.@(ts|tsx)",
+  "../enterprise/frontend/*/!(embedding-sdk-ee|embedding-sdk-package)/**/*.stories.@(ts|tsx)",
 ];
 
 // Allow filtering to specific story files via env var (used by stress tests)

.storybook/preview.tsx

@@ -12,7 +12,6 @@ window.METABASE_REMOVE_DELAYS = true;
 
 require("metabase/css/core/index.css");
 require("metabase/css/index.module.css");
-require("metabase/utils/dayjs");
 
 // EChartsRenderer is loaded as an on-demand chunk in the app (see
 // EChartsRenderer/lazy.ts). Force it into the Storybook bundle so chart stories
@@ -30,7 +29,7 @@ import { EmotionCacheProvider } from "metabase/ui/components/theme/EmotionCacheP
 import { Global, css, useTheme } from "@emotion/react";
 
 import { loadVisualizationComponents } from "metabase/visualizations";
-import { saveDomImageStyles } from "metabase/visualizations/lib/image-exports";
+import { getSaveDomImageStyles } from "metabase/visualizations/lib/image-exports";
 
 import { initialize, mswLoader } from "msw-storybook-addon";
 
@@ -117,7 +116,7 @@ const globalStyles = css`
     ${rootStyle}
   }
 
-  ${saveDomImageStyles}
+  ${getSaveDomImageStyles(false)}
   ${baseStyle}
 `;
 

.vscode/settings.json

@@ -5,5 +5,15 @@
   "gulp.autoDetect": "off",
   "npm.autoDetect": "off",
   "typescript.tsdk": "node_modules/typescript/lib",
-  "cssVariables.lookupFiles": ["**/*.d.css", "node_modules/@mantine/core/*.css"]
+  "typescript.tsserver.maxTsServerMemory": 8192,
+  "cssVariables.lookupFiles": ["**/*.d.css", "node_modules/@mantine/core/*.css"],
+  "files.watcherExclude": {
+    "**/.claude/worktrees/**": true,
+    "**/node_modules/**": true,
+    "**/.cpcache/**": true,
+    "**/target/**": true
+  },
+  "search.exclude": {
+    "**/.claude/worktrees": true
+  }
 }

CLAUDE.md

@@ -35,7 +35,7 @@ For detailed guidance on writing and reviewing code and documentation, see the s
 
 - **[analytics-events](.claude/skills/analytics-events/SKILL.md)** - Add product analytics events to track user interactions
 
-**Important**: When working with frontend code, read [frontend/CLAUDE.md](frontend/CLAUDE.md) for project-specific guidelines on component preferences, styling, TypeScript migration, testing requirements, and available scripts.
+**Important**: When working with frontend code, read [frontend/CLAUDE.md](frontend/CLAUDE.md) for project-specific guidelines on component preferences, styling, testing requirements, and available scripts.
 
 ## Running Backend Tests
 

README.md

@@ -2,7 +2,7 @@
 
 [Metabase](https://www.metabase.com) is the easy, open-source way for everyone in your company to ask questions and learn from data.
 
-![Metabase Product Screenshot](https://www.metabase.com/images/metabase-product-screenshot-updated.png)
+![Metabase Product Screenshot](./docs/images/metabase-product-screenshot-updated.png)
 
 [![Latest Release](https://img.shields.io/github/release/metabase/metabase.svg?label=latest%20release)](https://github.com/metabase/metabase/releases)
 [![codecov](https://codecov.io/gh/metabase/metabase/branch/master/graph/badge.svg)](https://codecov.io/gh/metabase/metabase)
@@ -46,7 +46,8 @@ The [Metabase handbook](https://www.metabase.com/docs/latest/).
 
 ## Contributing
 
-To contribute to Metabase, see our [Developer docs](./docs/developers-guide/start.md).
+- To contribute to Metabase, see our [Developer docs](./docs/developers-guide/start.md).
+- Found an issue? Read our [Reporting a bug guide](https://www.metabase.com/docs/latest/troubleshooting-guide/bugs)
 
 ## Extending Metabase