Split api/analytics.ts into search telemetry and the export mutation

The file bundled two unrelated concerns. Search tracking now lives in
api/analytics/search.ts next to its only caller, and the export
mutation in api/analytics/export.ts. The analytics/ directory satisfies
the no-analytics-import-outside-analytics-files rule that pinned the
old filename.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.claude/skills/_shared/clojure-style-guide.md

@@ -27,9 +27,28 @@ This guide covers Clojure and ClojureScript coding conventions for Metabase. See
 - Format using Markdown conventions
 - Reference other vars with `[[other-var]]` not backticks
 
+A docstring states the *contract*: what it returns (including when it returns nil), what its
+params mean, what it throws versus swallows, and any precondition or invariant the caller must
+respect. A params block for non-obvious or optional args is good documentation — length is not
+the problem.
+
+These seven things are, and each is a reason to cut or relocate:
+
+| Anti-pattern | Why | Where it goes instead |
+| --- | --- | --- |
+| **Facts you don't own** — how a *callee*, another namespace, or another repo works internally | Drifts silently; nothing fails when it goes stale | Cut. Name the callee and let its own docstring say it |
+| **Said twice** — ns docstring restating its vars', a caller restating its callee's, sibling fns repeating boilerplate | Two copies means one is already wrong | Cut the copy. One fact, one owner |
+| **Design rationale** — why this approach, why it lives in this module, what the alternative was | The caller can't act on it | Commit message, or an inline comment on the specific line it constrains |
+| **Development history** — "matching master", "the X branch", "currently", "for now", "used to" | Stale by construction | Cut |
+| **Instructions to the reader** — "callers should trust this", "don't bother checking", "you should use X" | State the contract; the caller decides | Cut, keeping any actual guarantee as a plain statement |
+| **Invented precision** — score bands, thresholds, or tables no code enforces | Reads as spec, isn't | Cut, or make the code enforce it |
+| **A note on the wrong var** — describing how overrides behave, on the base/default impl | Nobody reading the override sees it | Move to the overrides it describes |
+
 **Comments:**
 
 - `TODO` format: `;; TODO (Name YYYY-MM-DD) -- description`
+- Prefer an inline comment over docstring prose for anything that explains *the body*. Put it on
+  the line it explains, not at the top of the function.
 
 ## Code Organization
 

.claude/skills/_shared/development-workflow.md

@@ -6,3 +6,4 @@
 - Run targeted tests, and lint continuously during development
 - Prioritize understanding existing patterns before implementing
 - Don't commit changes, leave it for the user to review and make commits
+- Minimize comments. Document only non-obvious intent, trade-offs, or constraints that the code itself cannot convey. Do not narrate what the code does — keep code self-descriptive through naming and structure.

.claude/skills/analytics-events/SKILL.md

@@ -10,23 +10,23 @@ This skill helps you add product analytics (Snowplow) events to track user inter
 
 ## Quick Reference
 
-Analytics events in Metabase use Snowplow with typed event schemas. All events must be defined in TypeScript types before use.
+Analytics events in Metabase use Snowplow with typed event schemas. Simple events are declared **where they are used** — `trackSimpleEvent` is generic and validates the payload at the call site.
 
 **Key Files:**
-- `frontend/src/metabase-types/analytics/event.ts` - Event type definitions
-- `frontend/src/metabase-types/analytics/schema.ts` - Schema registry
-- `frontend/src/metabase/analytics/` - Core tracking functions (import from `metabase/analytics`)
-- Feature-specific `analytics.ts` files - Tracking function wrappers
+- `frontend/src/metabase/analytics/event.ts` - Core tracking functions, `trackSimpleEvent` / `trackSchemaEvent` (import from `metabase/analytics`)
+- `frontend/src/metabase-types/analytics/event.ts` - The shared `SimpleEventSchema` only. **Do not add event types here** (see below)
+- `frontend/src/metabase-types/analytics/schema.ts` - Schema registry (custom/legacy schemas only)
+- Feature-specific `analytics.ts` files - Where your tracking functions and any local types live
 
 ## Quick Checklist
 
 When adding a new analytics event:
 
-- [ ] Define event type in `frontend/src/metabase-types/analytics/event.ts`
-- [ ] Add event to appropriate union type (e.g., `DataStudioEvent`, `SimpleEvent`)
-- [ ] Create tracking function in feature's `analytics.ts` file
-- [ ] Import and call tracking function at the interaction point
-- [ ] Use `trackSimpleEvent()` for basic events (most common)
+- [ ] Pick an event name (snake_case, past tense)
+- [ ] Add a tracking function to the feature's `analytics.ts` file, calling `trackSimpleEvent()`
+- [ ] Keep any field unions (e.g. `"success" | "failure"`) as local types in that same file
+- [ ] Import and call the tracking function at the interaction point
+- [ ] Do **not** add an event type to `metabase-types/analytics/event.ts` or to any union
 
 ## Event Schema Types
 
@@ -47,6 +47,25 @@ type SimpleEventSchema = {
 
 **When to use:** 90% of events fit this schema. Use for clicks, opens, closes, creates, deletes, etc.
 
+`trackSimpleEvent` is generic and enforces this schema on the object literal you pass it:
+
+```typescript
+// frontend/src/metabase/analytics/event.ts
+export function trackSimpleEvent<
+  T extends SimpleEventSchema &
+    Record<Exclude<keyof T, keyof SimpleEventSchema>, never>,
+>(event: T) {
+  trackSchemaEvent("simple_event", event);
+}
+```
+
+That means a missing `event` or any field outside `SimpleEventSchema` is a compile error at the call
+site. There is no separate event type to declare and no `satisfies` clause to add — the old
+`ValidateEvent<...>` helper is no longer exported and is not part of the workflow.
+
+`trackSchemaEvent` is generic too: it correlates the schema name with the payload type, so you can't
+send a dashboard event under the `simple_event` schema.
+
 ### 2. Custom Schemas (legacy, no events are being added)
 
 Consider adding new event schema only in very special cases.
@@ -57,36 +76,7 @@ Consider adding new event schema only in very special cases.
 
 ### Example: Track when a user applies filters in a table picker
 
-#### Step 1: Define Event Types
-
-Add event type definitions to `frontend/src/metabase-types/analytics/event.ts`:
-
-```typescript
-export type DataStudioTablePickerFiltersAppliedEvent = ValidateEvent<{
-  event: "data_studio_table_picker_filters_applied";
-}>;
-
-export type DataStudioTablePickerFiltersClearedEvent = ValidateEvent<{
-  event: "data_studio_table_picker_filters_cleared";
-}>;
-```
-
-#### Step 2: Add to Union Type
-
-Find or create the appropriate union type and add your events:
-
-```typescript
-export type DataStudioEvent =
-  | DataStudioLibraryCreatedEvent
-  | DataStudioTablePublishedEvent
-  | DataStudioGlossaryCreatedEvent
-  | DataStudioGlossaryEditedEvent
-  | DataStudioGlossaryDeletedEvent
-  | DataStudioTablePickerFiltersAppliedEvent  // <- Add here
-  | DataStudioTablePickerFiltersClearedEvent; // <- Add here
-```
-
-#### Step 3: Create Tracking Functions
+#### Step 1: Create Tracking Functions
 
 In your feature's `analytics.ts` file (e.g., `enterprise/frontend/src/metabase-enterprise/data-studio/analytics.ts`):
 
@@ -106,7 +96,7 @@ export const trackDataStudioTablePickerFiltersCleared = () => {
 };
 ```
 
-#### Step 4: Use in Components
+#### Step 2: Use in Components
 
 Import and call the tracking function at the interaction point:
 
@@ -138,16 +128,11 @@ function FilterPopover({ filters, onSubmit }) {
 
 ## Using SimpleEventSchema Fields
 
+All examples below live in the feature's own `analytics.ts` — nothing is registered centrally.
+
 ### Example: Event with target_id
 
 ```typescript
-// Type definition
-export type DataStudioLibraryCreatedEvent = ValidateEvent<{
-  event: "data_studio_library_created";
-  target_id: number | null;
-}>;
-
-// Tracking function
 export const trackDataStudioLibraryCreated = (id: CollectionId) => {
   trackSimpleEvent({
     event: "data_studio_library_created",
@@ -162,14 +147,10 @@ trackDataStudioLibraryCreated(newLibrary.id);
 ### Example: Event with triggered_from
 
 ```typescript
-// Type definition
-export type NewButtonClickedEvent = ValidateEvent<{
-  event: "new_button_clicked";
-  triggered_from: "app-bar" | "empty-collection";
-}>;
+// Local union, exported only if another feature needs to pass the same value
+export type NewButtonLocation = "app-bar" | "empty-collection";
 
-// Tracking function
-export const trackNewButtonClicked = (location: "app-bar" | "empty-collection") => {
+export const trackNewButtonClicked = (location: NewButtonLocation) => {
   trackSimpleEvent({
     event: "new_button_clicked",
     triggered_from: location,
@@ -187,44 +168,31 @@ export const trackNewButtonClicked = (location: "app-bar" | "empty-collection")
 
 ### Example: Event with event_detail
 
-```typescript
-// Type definition
-export type MetadataEditEvent = ValidateEvent<{
-  event: "metadata_edited";
-  event_detail: "type_casting" | "semantic_type_change" | "visibility_change";
-  triggered_from: "admin" | "data_studio";
-}>;
+Real example — `frontend/src/metabase/metadata/pages/shared/analytics.ts`:
 
-// Tracking function
-export const trackMetadataChange = (
-  detail: "type_casting" | "semantic_type_change" | "visibility_change",
-  location: "admin" | "data_studio"
-) => {
+```typescript
+export type MetadataEditEventDetail =
+  | "type_casting"
+  | "semantic_type_change"
+  | "visibility_change";
+
+export const trackMetadataChange = (detail: MetadataEditEventDetail) => {
   trackSimpleEvent({
     event: "metadata_edited",
     event_detail: detail,
-    triggered_from: location,
+    triggered_from: "admin",
   });
 };
 
 // Usage
-trackMetadataChange("semantic_type_change", "data_studio");
+trackMetadataChange("semantic_type_change");
 ```
 
 ### Example: Event with result and duration
 
-```typescript
-// Type definition
-export type MoveToTrashEvent = ValidateEvent<{
-  event: "moved-to-trash";
-  target_id: number | null;
-  triggered_from: "collection" | "detail_page" | "cleanup_modal";
-  duration_ms: number | null;
-  result: "success" | "failure";
-  event_detail: "question" | "model" | "metric" | "dashboard";
-}>;
+See `frontend/src/metabase/archive/analytics.ts` for the real version of this.
 
-// Tracking function
+```typescript
 export const trackMoveToTrash = (params: {
   targetId: number | null;
   triggeredFrom: "collection" | "detail_page" | "cleanup_modal";
@@ -280,17 +248,16 @@ try {
 "filters-applied"            // Use underscore, not hyphen
 ```
 
-### Event Type Names (PascalCase with "Event" suffix)
+### Local Field Types (PascalCase, named after the field)
+
+There is usually no `...Event` type to name anymore. When you do need a union for a field, name it
+after the field it feeds:
 
 ```typescript
 // Good
-DataStudioLibraryCreatedEvent
-TablePickerFiltersAppliedEvent
-MetabotChatOpenedEvent
-
-// Bad
-dataStudioLibraryCreated      // Wrong case
-DataStudioLibraryCreated      // Missing "Event" suffix
+type MetricDimensionResult = "success" | "failure";     // -> result
+export type MetadataEditEventDetail = "type_casting";   // -> event_detail
+type NewButtonLocation = "app-bar" | "empty-collection"; // -> triggered_from
 ```
 
 ### Tracking Function Names (camelCase with "track" prefix)
@@ -309,29 +276,28 @@ logLibraryCreated             // Use "track" prefix
 
 ## Common Patterns
 
-### Pattern 1: Feature-Specific Union Types
+### Pattern 1: Sharing Field Types Across Features
 
-Group related events together:
+When two features send the same event with a different `triggered_from`, export the field union from
+the owning feature's `analytics.ts` and import it — don't hoist anything into `metabase-types`:
 
 ```typescript
-export type DataStudioEvent =
-  | DataStudioLibraryCreatedEvent
-  | DataStudioTablePublishedEvent
-  | DataStudioGlossaryCreatedEvent;
+// frontend/src/metabase/data-studio/data-model/analytics.ts
+import { trackSimpleEvent } from "metabase/analytics";
+import type { MetadataEditEventDetail } from "metabase/metadata/pages/shared/analytics";
 
-export type MetabotEvent =
-  | MetabotChatOpenedEvent
-  | MetabotRequestSentEvent
-  | MetabotFixQueryClickedEvent;
-
-// Then add to SimpleEvent union
-export type SimpleEvent =
-  | /* other events */
-  | DataStudioEvent
-  | MetabotEvent
-  | /* more events */;
+export function trackMetadataChange(detail: MetadataEditEventDetail) {
+  trackSimpleEvent({
+    event: "metadata_edited",
+    event_detail: detail,
+    triggered_from: "data_studio",
+  });
+}
 ```
 
+This is the point of the extensible-events design: enterprise and feature-tier types stay in their
+own module instead of being imported down into a shared union.
+
 ### Pattern 2: Conditional Tracking
 
 Track different events based on user action:
@@ -350,10 +316,10 @@ const handleSave = async () => {
 
 ## Common Pitfalls
 
-### Don't: Add custom fields to SimpleEvent
+### Don't: Add custom fields to a simple event
 
 ```typescript
-// WRONG - SimpleEvent doesn't support custom fields
+// WRONG - SimpleEventSchema doesn't support custom fields (this is a compile error)
 export const trackFiltersApplied = (filters: FilterState) => {
   trackSimpleEvent({
     event: "filters_applied",
@@ -379,23 +345,43 @@ export const trackFilterApplied = (filterType: string) => {
 };
 ```
 
-### Don't: Forget to add event to union type
+### Don't: Add event types to `metabase-types/analytics/event.ts`
+
+The central `SimpleEvent` union was removed — it forced feature-tier types to be imported down into
+shared code, causing module-boundary violations. `trackSimpleEvent` is generic now, so the type adds
+nothing but duplication.
 
 ```typescript
-// Define the event
+// ❌ WRONG - central declaration + re-import for a `satisfies` clause
+// frontend/src/metabase-types/analytics/event.ts
 export type NewFeatureClickedEvent = ValidateEvent<{
   event: "new_feature_clicked";
+  target_id: number;
 }>;
 
-// ❌ WRONG - Forgot to add to SimpleEvent union
-// Event won't be recognized by TypeScript
+// frontend/src/metabase/my-feature/analytics.ts
+import type { NewFeatureClickedEvent } from "metabase-types/analytics";
 
-// ✓ RIGHT - Add to appropriate union
-export type SimpleEvent =
-  | /* other events */
-  | NewFeatureClickedEvent;
+export const trackNewFeatureClicked = (id: number) => {
+  trackSimpleEvent({
+    event: "new_feature_clicked",
+    target_id: id,
+  } satisfies NewFeatureClickedEvent);
+};
+
+// ✓ RIGHT - the object literal is already checked by the generic
+// frontend/src/metabase/my-feature/analytics.ts
+export const trackNewFeatureClicked = (id: number) => {
+  trackSimpleEvent({
+    event: "new_feature_clicked",
+    target_id: id,
+  });
+};
 ```
 
+A few `...Event` types still sit in `metabase-types/analytics/event.ts`. They are leftovers from PRs
+that landed around the refactor — don't copy them, and don't add to them.
+
 ### Don't: Mix up event name formats
 
 ```typescript
@@ -463,41 +449,44 @@ Example console output:
 ### Where to put tracking functions:
 
 ```
-Feature-specific analytics functions:
+Tracking functions AND their local field types (this is where new events live):
 frontend/src/metabase/{feature}/analytics.ts
 enterprise/frontend/src/metabase-enterprise/{feature}/analytics.ts
 
-Event type definitions (all in one place):
-frontend/src/metabase-types/analytics/event.ts
-
 Core tracking utilities:
 frontend/src/metabase/analytics/ (import from `metabase/analytics`)
+
+Shared SimpleEventSchema only — nothing new goes here:
+frontend/src/metabase-types/analytics/event.ts
 ```
 
+In embedding SDK code, use `trackSdkSimpleEvent`
+(`frontend/src/embedding-sdk-bundle/analytics/snowplow.ts`) instead — the main-app `"sp"` tracker
+isn't initialized in the customer's page, so `trackSimpleEvent`'s Snowplow leg is a no-op there.
+
 ## Real-World Examples
 
 See these files for reference:
 
-- **Simple events**: `enterprise/frontend/src/metabase-enterprise/data-studio/analytics.ts`
-- **Events with variants**: `frontend/src/metabase/dashboard/analytics.ts`
-- **Complex events**: `frontend/src/metabase/query_builder/analytics.js`
-- **Event type examples**: `frontend/src/metabase-types/analytics/event.ts`
+- **Simple events + local field union**: `frontend/src/metabase/metadata/pages/shared/analytics.ts`
+- **Reusing another feature's field type**: `frontend/src/metabase/data-studio/data-model/analytics.ts`
+- **Result + duration timing**: `frontend/src/metabase/archive/analytics.ts`
+- **Enterprise feature events**: `enterprise/frontend/src/metabase-enterprise/google_drive/analytics.ts`
 
 ## Workflow Summary
 
 1. **Identify the user interaction** to track
 2. **Decide on event name** (snake_case, descriptive)
-3. **Define event type** in `event.ts` using `ValidateEvent`
-4. **Add to union type** (create feature union if needed)
-5. **Create tracking function** in feature's `analytics.ts`
-6. **Import and call** at the interaction point
-7. **Test** that events fire correctly
+3. **Create tracking function** in feature's `analytics.ts`, calling `trackSimpleEvent()`
+4. **Add local field unions** in that same file if a field has a fixed set of values
+5. **Import and call** at the interaction point
+6. **Test** that events fire correctly
 
 ## Tips
 
 - **Be specific** - `filters_applied` is better than `action_performed`
 - **Use past tense** - `library_created` not `create_library`
-- **Group related events** - Create feature-specific event union types
+- **Group related events** - Keep a feature's tracking functions together in its `analytics.ts`
 - **Track meaningful actions** - Not every click needs tracking
 - **Consider the data** - What would you want to analyze later?
 - **Stay consistent** - Follow existing naming patterns in the codebase

.claude/skills/clojure-review/SKILL.md

@@ -56,6 +56,11 @@ Use this to scan through changes efficiently:
 - [ ] References use `[[other-var]]` not backticks
 - [ ] `TODO` comments include author and date: `;; TODO (Name 2025-01-01) -- description`
 
+Docstring content — check every new or rewritten docstring against the anti-pattern table in the
+style guide above. Read the diff's docstrings on their own, separately from the code: prose is
+where review attention slides off, and a long docstring reads as diligence rather than as the
+liability it usually is.
+
 ### Code Organization
 
 - [ ] Everything `^:private` unless used elsewhere
@@ -135,6 +140,17 @@ Quick scan for common issues:
 
 > This public var needs a docstring explaining its purpose, inputs, and outputs.
 
+**For docstrings documenting code they don't own:**
+
+> This describes how `lib` decides binning strategies internally. Nothing here fails when that
+> changes, so it will go stale silently — drop it and let `available-binning-strategies` answer
+> for its own behavior.
+
+**For docstring content that belongs in the body:**
+
+> This paragraph explains why the branches are ordered this way, which is what someone editing
+> the `cond` needs — but a caller can't act on it. Move it to an inline comment above the `cond`.
+
 **For organization issues:**
 
 > This function is only used in this namespace, so it should be marked `^:private`.

.claude/skills/clojure-write/SKILL.md

@@ -82,10 +82,29 @@ either a bug, or it means callers must handle each case themselves — and
 in *that* case it is the *absence* of the property that must be
 documented. Document deviations from expectation, not conformance to it.
 
-Heuristic: if a sentence would still be true after a full rewrite of the
-body, it may belong in the docstring. If it describes *how the current
-body works*, it belongs in the body — as an inline comment, if it is
-non-obvious.
+Heuristic — a sentence earns its place in the docstring only if it
+passes both tests:
+
+1. Rewrite test (necessary, not sufficient): if rewriting the body to a
+   different implementation with an identical contract could make the
+   sentence false, it describes the implementation, not the contract.
+   Relocate it to an inline comment at the point in the body where it
+   applies.
+
+2. Ownership test: if the sentence states a fact about code this
+   function does not own — a callee's behavior, a library's guarantee —
+   it survives any rewrite trivially, which is exactly why the rewrite
+   test alone is not enough. If this body *relies* on that fact, it is
+   implementation context: relocate it to the call site. If nothing here
+   relies on it, it is blather about someone else's code: delete it, and
+   let the callee's own docstring answer for it.
+
+Say each fact once. Duplicated prose is a stale comment in advance: when
+the fact changes, one copy gets updated and the rest quietly rot. This
+holds even within code you own — a namespace docstring that
+re-summarizes its own multimethods, three sibling functions carrying the
+same paragraph about retry behavior. Give the fact one home, and have
+the other places name it rather than restate it.
 
 Multi-line docstrings are not banned — a genuinely non-obvious constraint
 the code had to deal with can be worth explaining. But be prudent; the

.clj-kondo/config.edn

@@ -7,7 +7,6 @@
 
   :aliased-namespace-symbol     {:level :warning}
   :case-symbol-test             {:level :warning}
-  :condition-always-true        {:level :warning}
   :def-fn                       {:level :warning}
   :dynamic-var-not-earmuffed    {:level :warning}
   :equals-expected-position     {:level :warning, :only-in-test-assertion true}
@@ -50,9 +49,11 @@
   ;; disabled linters
   ;;
 
+  :constant-condition {:level :off} ; TODO (sashko): too confused by defenterprises, some hook/config is needed
   :redundant-ignore {:level :off} ; lots of false positives, see https://github.com/clj-kondo/clj-kondo/issues/2414
   :unexpected-recur {:level :off} ; TODO (cam): I think we just need to tell it how to handle MBQL match and we can enable this?
   :redundant-primitive-coercion {:level :off} ; there are many defensive boolean coercions, kondo looks too much into it
+  :type-mismatch {:level :off} ; Still quite raw, can sometimes give useful insights, but sometimes is just confused
 
   ;;
   ;; globally-enabled custom linters
@@ -503,7 +504,9 @@
   metabase.query-processor.pipeline-queries-test/mbql5-query                            clojure.core/->
   metabase.query-processor.pipeline-queries-test/run-mbql5-query                        clojure.core/->
   metabase.query-processor.error-type/deferror                                          clojure.core/def
+  metabase.query-processor.core/with-reducible-deserialized-results                     clojure.core/let
   metabase.query-processor.middleware.cache.impl/with-reducible-deserialized-results    clojure.core/let
+  metabase.query-processor.result-serialization/with-reducible-deserialized-results     clojure.core/let
   metabase.query-processor.middleware.process-userland-query-test/with-query-execution! clojure.core/let
   metabase.query-processor.setup/with-qp-setup                                          clojure.core/let
   metabase.search.api-test/do-test-users                                                clojure.core/let
@@ -520,7 +523,6 @@
   metabase.test.data.interface/defdataset                                               clojure.core/def
   metabase.test.data.interface/defdataset-edn                                           clojure.core/def
   metabase.test.embedded-postgres.core/with-system                                      clojure.core/let
-  metabase.test.gentest/defgentest                                                      clojure.test/deftest
   metabase.test/defdataset                                                              clojure.core/def
   metabase.test/let-url                                                                 clojure.core/let
   metabase.test/with-actions                                                            clojure.core/let
@@ -679,7 +681,6 @@
    metabase.test.data/dataset                                                                                                hooks.metabase.test.data/dataset
    metabase.test.data/mbql-query                                                                                             hooks.metabase.test.data/mbql-query
    metabase.test.data/run-mbql-query                                                                                         hooks.metabase.test.data/mbql-query
-   metabase.test.gentest/iterate                                                                                             hooks.metabase.test.gentest/iterate*
    metabase.test.util.async/with-open-channels                                                                               hooks.common/let-with-optional-value-for-last-binding
    metabase.test.util.generators.jvm/with-random-cards                                                                       hooks.metabase.test.util.generators.jvm/with-random-cards
    metabase.test.util.log/with-log-level                                                                                     hooks.common/with-ignored-first-arg
@@ -859,6 +860,11 @@
   metabase.util.time-test
   {:linters {:metabase/prefer-with-dynamic-fn-redefs {:level :off}}}
 
+  ;; classloader sits below `util` in the module graph, so it can't use `metabase.util.log` without creating
+  ;; a cycle; it gets to use tools.logging directly.
+  metabase.classloader.impl
+  {:linters {:discouraged-namespace {clojure.tools.logging {:level :off}}}}
+
   source-namespaces
   {:linters
    {:metabase/discourage-millis-duration               {:level :warning}

.clj-kondo/config/modules/config.edn

@@ -302,6 +302,7 @@
                     :model/Database
                     :model/Dimension
                     :model/Document
+                    :model/Exploration
                     :model/Measure
                     :model/ModelIndexValue
                     :model/NativeQuerySnippet
@@ -445,7 +446,8 @@
    :model-imports #{:model/Card
                     :model/Collection
                     :model/Dashboard
-                    :model/Document}}
+                    :model/Document
+                    :model/Exploration}}
 
   bug-reporting
   {:team "UX West"
@@ -539,7 +541,7 @@
   {:team "DevEx"
    :api  #{metabase.classloader.core
            metabase.classloader.init}
-   :uses #{util}}
+   :uses #{}}
 
   cloud-migration
   {:team "UX West"
@@ -610,6 +612,7 @@
                     :model/DashboardCard
                     :model/DashboardCardSeries
                     :model/Document
+                    :model/Exploration
                     :model/NativeQuerySnippet
                     :model/Permissions
                     :model/Pulse
@@ -644,6 +647,7 @@
                     :model/Collection
                     :model/Dashboard
                     :model/Document
+                    :model/Exploration
                     :model/NativeQuerySnippet
                     :model/Pulse
                     :model/Table
@@ -663,7 +667,7 @@
            users
            util}
    :model-exports #{:model/Comment}
-   :model-imports #{:model/Document :model/User}}
+   :model-imports #{:model/Document :model/Exploration :model/User}}
 
   ;; technically this 'uses' `enterprise/core` and `test` since it tries to load them to see if they exists so we know
   ;; if EE/test code is available; however we can ignore them since they're not real usages.
@@ -695,6 +699,14 @@
    :model-exports #{:model/ModerationReview}
    :model-imports #{:model/Card :model/Dashboard}}
 
+  contextual-interestingness
+  {:team "UX West"
+   :api  #{metabase.contextual-interestingness.core}
+   :uses #{interestingness
+           metabot
+           query-processor
+           util}}
+
   core
   {:team "UX West"
    :api  #{}
@@ -924,6 +936,7 @@
                     :model/DashboardTab
                     :model/Dimension
                     :model/Document
+                    :model/Exploration
                     :model/Measure
                     :model/NativeQuerySnippet
                     :model/PermissionsGroup
@@ -998,6 +1011,47 @@
                     :model/Table
                     :model/User}}
 
+  explorations
+  {:team "UX West"
+   :api  #{metabase.explorations.api
+           metabase.explorations.core
+           metabase.explorations.init}
+   :uses #{analytics
+           analytics-interface
+           api
+           app-db
+           collections
+           contextual-interestingness
+           events
+           interestingness
+           lib
+           lib-be
+           lib-metric
+           metrics
+           models
+           mq
+           permissions
+           queries
+           query-permissions
+           query-processor
+           request
+           search
+           settings
+           task
+           task-history
+           timeline
+           types
+           util}
+   :model-exports #{:model/Exploration}
+   :model-imports #{:model/Card
+                    :model/Collection
+                    :model/Comment
+                    :model/Segment
+                    :model/StoredResult
+                    :model/StoredResultUse
+                    :model/Timeline
+                    :model/User}}
+
   formatter
   {:team "UX West"
    :api  #{metabase.formatter.core}
@@ -1152,7 +1206,6 @@
            metabase.lib.schema.ref
            metabase.lib.schema.template-tag
            metabase.lib.schema.temporal-bucketing
-           metabase.lib.schema.test-spec
            metabase.lib.schema.util
            metabase.lib.schema.validate
            metabase.lib.types.isa
@@ -1208,6 +1261,7 @@
            metabase.llm.startup}
    :uses #{analytics
            api
+           config
            driver
            lib
            lib-be
@@ -1216,6 +1270,7 @@
            premium-features
            request
            settings
+           setup
            sql-tools
            sync
            util
@@ -1322,8 +1377,8 @@
               driver
               entity-retrieval
               events
+              explorations
               interestingness
-              legacy-mbql
               lib
               lib-be
               llm
@@ -1347,6 +1402,7 @@
               sync
               system
               task
+              timeline
               transforms
               transforms-base
               util
@@ -1378,7 +1434,6 @@
    :api  #{metabase.metrics.api
            metabase.metrics.core}
    :uses #{api
-           collections
            events
            lib
            lib-be
@@ -1386,6 +1441,7 @@
            models
            parameters
            permissions
+           queries
            query-processor
            request
            server
@@ -1449,7 +1505,8 @@
 
   mq
   {:team "UX West"
-   :api  #{metabase.mq.init}
+   :api  #{metabase.mq.core
+           metabase.mq.init}
    :uses #{analytics-interface
            app-db
            classloader
@@ -1734,6 +1791,7 @@
            lib
            models
            notification
+           parameters
            permissions
            premium-features
            query-processor
@@ -1800,7 +1858,9 @@
    :model-exports #{:model/Card
                     :model/Query
                     :model/QueryExecution
-                    :model/QueryTable}
+                    :model/QueryTable
+                    :model/StoredResult
+                    :model/StoredResultUse}
    :model-imports #{:model/Action
                     :model/CardBookmark
                     :model/Collection
@@ -1930,6 +1990,7 @@
    :model-imports #{:model/Card
                     :model/DashboardCardSeries
                     :model/Database
+                    :model/NativeQuerySnippet
                     :model/QueryCache
                     :model/QueryExecution
                     :model/Table}}
@@ -1939,6 +2000,7 @@
    :api  #{metabase.remote-sync.core
            metabase.remote-sync.init}
    :uses #{api
+           events
            models
            premium-features}
    :model-imports #{:model/Collection}}
@@ -1982,6 +2044,7 @@
                     :model/DashboardCard
                     :model/DashboardTab
                     :model/Document
+                    :model/Exploration
                     :model/Measure
                     :model/Segment
                     :model/Transform}}
@@ -2046,6 +2109,7 @@
    :model-imports #{:model/Card
                     :model/Collection
                     :model/Dashboard
+                    :model/Database
                     :model/Table
                     :model/User}}
 
@@ -2080,7 +2144,8 @@
            metabase.server.middleware.session
            metabase.server.settings
            metabase.server.streaming-response} ; TODO -- too many API namespaces
-   :uses #{analytics
+   :uses #{agent-api
+           analytics
            analytics-interface
            api
            api-keys
@@ -2229,7 +2294,8 @@
            lib
            settings
            sql-parsing
-           util}}
+           util}
+   :model-imports #{:model/Table}}
 
   sso
   {:team "UX West"
@@ -2511,9 +2577,8 @@
 
   typed-schemas
   {:team "Embedding"
-   :api  #{metabase.typed-schemas.api}
+   :api  #{metabase.typed-schemas.core}
    :uses #{actions
-           api
            collections
            lib
            lib-be
@@ -2532,6 +2597,13 @@
                     :model/Measure
                     :model/Table}}
 
+  typed-schemas-rest
+  {:team "Embedding"
+   :api  #{metabase.typed-schemas-rest.api}
+   :uses #{api
+           typed-schemas
+           util}}
+
   types
   {:team "Querying Platform"
    :api  #{metabase.types.core
@@ -2653,8 +2725,7 @@
    :api  :any
    :uses #{classloader
            config
-           settings
-           system}}
+           settings}}
 
   version
   {:team "UX West"
@@ -2826,6 +2897,7 @@
            lib
            lib-be
            models
+           permissions
            queries
            query-permissions
            query-processor
@@ -3071,6 +3143,7 @@
   enterprise/custom-viz-plugin
   {:team "Gadget"
    :api  #{metabase-enterprise.custom-viz-plugin.api
+           metabase-enterprise.custom-viz-plugin.api.sandbox-host
            metabase-enterprise.custom-viz-plugin.init
            metabase-enterprise.custom-viz-plugin.settings}
    :uses #{api
@@ -3276,6 +3349,7 @@
    :api  #{metabase-enterprise.erd.api}
    :uses #{api
            models
+           permissions
            util
            warehouse-schema}
    :model-imports #{:model/Database
@@ -3408,6 +3482,7 @@
            config
            events
            premium-features
+           request
            settings
            sso
            util}
@@ -3770,6 +3845,7 @@
    :api  #{metabase-enterprise.upload-management.api}
    :uses #{api
            models
+           permissions
            premium-features
            upload
            util}

.clj-kondo/ratchets.edn

@@ -5,35 +5,36 @@
 ;; to defend in your PR.
 ;; :all is the vector-less ignore form, which suppresses every linter on the next form.
 {:ignore-counts {:aliased-namespace-symbol                                            3
-                 :all                                                                 50
+                 :all                                                                 49
                  :case-symbol-test                                                    1
                  :clojure-lsp/unused-public-var                                       9
                  :def-fn                                                              1
                  :deprecated-namespace                                                95
-                 :deprecated-var                                                      81
+                 :deprecated-var                                                      79
                  :discouraged-java-method                                             3
-                 :discouraged-namespace                                               80
-                 :discouraged-var                                                     106
+                 :discouraged-namespace                                               79
+                 :discouraged-var                                                     107
                  :equals-true                                                         1
                  :main-without-gen-class                                              1
-                 :metabase/defsetting-namespace                                       7
+                 :metabase/defsetting-namespace                                       2
                  :metabase/disallow-hardcoded-driver-names-in-tests                   34
                  :metabase/discourage-millis-duration                                 1
                  :metabase/i-like-making-cams-eyes-bleed-with-horrifically-long-tests 13
-                 :metabase/modules                                                    8
+                 :metabase/modules                                                    7
                  :metabase/namespace-name                                             4
-                 :metabase/prefer-with-dynamic-fn-redefs                              27
+                 :metabase/prefer-with-dynamic-fn-redefs                              28
                  :metabase/test-helpers-use-non-thread-safe-functions                 17
                  :metabase/validate-defendpoint-has-response-schema                   441
-                 :metabase/validate-defendpoint-query-params-use-kebab-case           40
+                 :metabase/validate-defendpoint-query-params-use-kebab-case           47
                  :metabase/validate-defendpoint-route-uses-kebab-case                 44
-                 :metabase/validate-deftest                                           8
+                 :metabase/validate-deftest                                           9
                  :missing-docstring                                                   10
                  :missing-protocol-method                                             3
                  :non-arg-vec-return-type-hint                                        1
                  :reduce-without-init                                                 3
                  :redundant-fn-wrapper                                                1
                  :syntax                                                              2
+                 :uninitialized-var                                                   1
                  :unquote-not-syntax-quoted                                           1
                  :unresolved-namespace                                                3
                  :unresolved-require                                                  1

.clj-kondo/src/hooks/metabase/test/gentest.clj

@@ -1,14 +0,0 @@
-(ns hooks.metabase.test.gentest
-  (:require
-   [clj-kondo.hooks-api :as hooks]))
-
-(defn iterate*
-  "(iterate {:as limit-spec} [s1 val1 & more] body-form body-form...)"
-  [{{:keys [children] :as node} :node :as orig}]
-  (let [[token limit-spec bindings & body-nodes] children
-        node* (-> (hooks/list-node
-                   (list token limit-spec
-                         (hooks/list-node (list* (hooks/token-node 'let) bindings
-                                                 body-nodes))))
-                  (with-meta (meta node)))]
-    (assoc orig :node node*)))

.github/actionlint.yaml

@@ -0,0 +1,13 @@
+self-hosted-runner:
+  # Custom runner labels that actionlint cannot know about. Everything else is
+  # selected through `vars.DEFAULT_RUNNER_KEY` and is not checked.
+  labels:
+    - arm-ubuntu-24-2core
+
+paths:
+  # GitHub added parallel steps (`parallel`, `background`, `wait`, `wait-all`,
+  # `cancel`) in June 2026, and actionlint 1.7.12 does not know the schema yet:
+  # https://github.blog/changelog/2026-06-25-actions-steps-can-now-be-run-in-parallel/
+  .github/workflows/lint.yml:
+    ignore:
+      - 'step must run script with "run" section or run action with "uses" section'

.github/actions/create-backport/action.yml

@@ -1,4 +1,5 @@
 name: Create Backport PR
+description: Cherry-picks a commit onto a release branch and opens the backport pull request.
 
 inputs:
   target-version: # major version number like 34 or 86
@@ -42,7 +43,7 @@ runs:
           git cherry-pick --abort
 
           echo "Could not cherry pick because of a conflict"
-          echo "has-conflicts=true" >> $GITHUB_OUTPUT
+          echo "has-conflicts=true" >> "$GITHUB_OUTPUT"
 
           # Add a shell script for resolving conflicts
           echo "git reset HEAD~1" > ./backport.sh
@@ -66,7 +67,7 @@ runs:
         END
           )
         else
-          echo "has-conflicts=false" >> $GITHUB_OUTPUT
+          echo "has-conflicts=false" >> "$GITHUB_OUTPUT"
           PR_BODY="#${ORIGINAL_PULL_REQUEST_NUMBER}"
         fi
 
@@ -80,7 +81,7 @@ runs:
         BACKPORT_PR_URL=$(gh pr create "${PR_ARGS[@]}")
         BACKPORT_PR_NUMBER=${BACKPORT_PR_URL##*/}
 
-        echo "backport_pr_number=$BACKPORT_PR_NUMBER" >> $GITHUB_OUTPUT
+        echo "backport_pr_number=$BACKPORT_PR_NUMBER" >> "$GITHUB_OUTPUT"
         echo "New PR has been created: #${BACKPORT_PR_NUMBER}"
 
         git checkout ${{ github.sha }}

.github/actions/cross-branch-migration-test/action.yml

@@ -1,4 +1,7 @@
 name: Cross-branch migration test
+description: >-
+  Boot Metabase on the base branch to migrate the app db, then boot the PR branch against the
+  same db, verifying the PR's migrations apply cleanly on top of the base branch's schema.
 
 inputs:
   base-ref: ## Base branch PR came from

.github/actions/fetch-artifact/action.yml

@@ -113,9 +113,9 @@ runs:
 
         # Set the JAR_PATH environment variable
         if [ "$EXTRACT_PATH" == "." ]; then
-          echo "JAR_PATH=$OUTPUT_NAME" >> $GITHUB_ENV
+          echo "JAR_PATH=$OUTPUT_NAME" >> "$GITHUB_ENV"
         else
-          echo "JAR_PATH=$EXTRACT_PATH/$OUTPUT_NAME" >> $GITHUB_ENV
+          echo "JAR_PATH=$EXTRACT_PATH/$OUTPUT_NAME" >> "$GITHUB_ENV"
         fi
 
     - name: Verify that this is a valid JAR file

.github/actions/find-squashed-commit/action.yml

@@ -22,7 +22,7 @@ runs:
         COMMIT=$(env -i git log $BASE_REF --grep="(#$PULL_REQUEST_NUMBER)" --format="%H")
         echo "commit SHA $COMMIT"
 
-        echo "commit=$COMMIT" >> $GITHUB_OUTPUT
+        echo "commit=$COMMIT" >> "$GITHUB_OUTPUT"
       id: find-squashed-commit
       shell: bash
       env:

.github/actions/get-cache-keys/action.yml

@@ -36,10 +36,10 @@ runs:
         WEEK_OF_YEAR=$(/bin/date "+%G-%V")
         CACHE_SUFFIX="${{ runner.os }}-$WEEK_OF_YEAR"
 
-        echo "m2-cache-key=$M2_CACHE_PREFIX-$CACHE_SUFFIX" >> $GITHUB_OUTPUT
-        echo "m2-restore-key=$M2_CACHE_PREFIX-" >> $GITHUB_OUTPUT
-        echo "node-cache-key=$NODE_CACHE_PREFIX-$CACHE_SUFFIX" >> $GITHUB_OUTPUT
-        echo "node-restore-key=$NODE_CACHE_PREFIX-" >> $GITHUB_OUTPUT
-        echo "eslint-cache-key=$ESLINT_CACHE_PREFIX-$CACHE_SUFFIX" >> $GITHUB_OUTPUT
-        echo "cypress-cache-key=$CYPRESS_CACHE_PREFIX-$CACHE_SUFFIX" >> $GITHUB_OUTPUT
+        echo "m2-cache-key=$M2_CACHE_PREFIX-$CACHE_SUFFIX" >> "$GITHUB_OUTPUT"
+        echo "m2-restore-key=$M2_CACHE_PREFIX-" >> "$GITHUB_OUTPUT"
+        echo "node-cache-key=$NODE_CACHE_PREFIX-$CACHE_SUFFIX" >> "$GITHUB_OUTPUT"
+        echo "node-restore-key=$NODE_CACHE_PREFIX-" >> "$GITHUB_OUTPUT"
+        echo "eslint-cache-key=$ESLINT_CACHE_PREFIX-$CACHE_SUFFIX" >> "$GITHUB_OUTPUT"
+        echo "cypress-cache-key=$CYPRESS_CACHE_PREFIX-$CACHE_SUFFIX" >> "$GITHUB_OUTPUT"
       shell: bash

.github/actions/prepare-frontend/action.yml

@@ -35,7 +35,7 @@ runs:
       run: |
         BUN_CACHE_DIR=$(bun pm cache)
         echo "Bun cache directory: $BUN_CACHE_DIR"
-        echo "dir=$BUN_CACHE_DIR" >> $GITHUB_OUTPUT
+        echo "dir=$BUN_CACHE_DIR" >> "$GITHUB_OUTPUT"
       shell: bash
 
     - name: Restore node_modules cache
@@ -53,7 +53,13 @@ runs:
     # If a job wants to patch packages, it does so explicitly in the CI. This setting is opt-out.
     # For example, we never want to cache node_modules with patches already applied so cache-generator.yml skips that step.
     - name: Clean install
-      run: bun install --frozen-lockfile
+      # Remove the restored node_modules before installing. The os-week cache can
+      # carry a stale tree (for example a different React major), and
+      # `--frozen-lockfile` alone does not prune it. Rebuilding from the cached bun
+      # store gives an exact, lockfile-correct node_modules with no extra download.
+      run: |
+        rm -rf node_modules
+        bun install --frozen-lockfile
       shell: bash
     - name: Patch frontend dependencies
       if: inputs.apply-patches == 'true'

.github/actions/prepare-shoppy-e2e/action.yml

@@ -88,9 +88,9 @@ runs:
         REPO_URL="https://github.com/metabase/shoppy.git"
         echo "Checking if branch '${SAMPLE_APP_BRANCH_NAME}' exists in ${REPO_URL}..."
         if git ls-remote --exit-code --heads "$REPO_URL" "${SAMPLE_APP_BRANCH_NAME}"; then
-          echo "sample_app_branch_exists=true" >> $GITHUB_OUTPUT
+          echo "sample_app_branch_exists=true" >> "$GITHUB_OUTPUT"
         else
-          echo "sample_app_branch_exists=false" >> $GITHUB_OUTPUT
+          echo "sample_app_branch_exists=false" >> "$GITHUB_OUTPUT"
         fi
 
     - name: Configure AWS credentials

.github/actions/prepare-uberjar-artifact/action.yml

@@ -1,26 +0,0 @@
-name: Prepare Uberjar Artifact
-description: Prepare and upload Metabase JAR as a GitHub artifact.
-
-inputs:
-  edition:
-    required: false
-    default: "ee"
-    description: Metabase edition (ee or oss)
-
-runs:
-  using: "composite"
-  steps:
-    - name: Mark with the commit hash
-      run: git rev-parse --short HEAD > COMMIT-ID
-      shell: bash
-    - name: Calculate SHA256 checksum
-      run: sha256sum ./target/uberjar/metabase.jar > SHA256.sum
-      shell: bash
-    - name: Upload JARs as artifact
-      uses: actions/upload-artifact@v7
-      with:
-        name: metabase-${{ inputs.edition }}-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
-        path: |
-          ./target/uberjar/metabase.jar
-          ./COMMIT-ID
-          ./SHA256.sum

.github/actions/test-driver/action.yml

@@ -9,20 +9,26 @@ inputs:
   build-static-viz:
     required: true
     default: false
-  logs-artifact-suffix:
+  artifact-suffix:
     required: false
-    description: Suffix to append to the test logs artifact name to avoid conflicts in matrix jobs
+    description: >-
+      Discriminator appended to this job's artifact names (test logs, granular-rerun failed
+      tests). A job whose matrix runs several concurrent legs MUST set a per-leg-unique value,
+      or the legs collide on one artifact — for the rerun artifact that means a leg restores
+      another leg's failed set. Must be stable across attempts of the same job.
   edition:
     required: false
     default: "ee"
     description: Edition to test (oss or ee)
   quarantine-engine:
     required: false
-  driver-status:
+  granular-rerun:
     required: false
-    default: ""
+    default: "true"
     description: >-
-      Configured status for this driver ("info", "skip", "required", or empty), as reported by `mage driver-decisions`.
+      When "true" (default), a re-run of a failed job runs only the tests that failed on the
+      previous attempt (hawk `:only`). Stress workflows set this to "false": they intentionally
+      run a fixed test set `:times N`, and narrowing to failures would drop that repetition.
 
 outputs:
   test-outcome:
@@ -48,12 +54,63 @@ runs:
       env:
         MB_EDITION: ${{ inputs.edition }}
 
+    # Granular rerun: on a re-run of a failed job, restore the list
+    # of tests that failed on the previous attempt (uploaded below) so the test
+    # step can target only those instead of the whole suite. Best-effort: a
+    # missing/empty artifact leaves no file and the run falls back to the full
+    # suite. First attempts skip this entirely.
+    #
+    # Scoped to the IMMEDIATELY preceding attempt: an attempt that passed, or
+    # that failed with nothing attributable to a var, uploads no artifact, and a
+    # narrow set must not outlive it. Reading `attempt - 1` means "only what the
+    # last attempt actually recorded" — anything else falls back to the full suite.
+    # Workflow expressions have no arithmetic, so the shell computes it.
+    #
+    # run-tests.yml calls app-db.yml, backend.yml, drivers.yml and semantic-search.yml
+    # as part of ONE run, so all four share an artifact namespace. `junit-name` alone is not
+    # unique there — app-db.yml and drivers.yml both derive `be-tests-postgres-ee` — so
+    # `artifact-suffix` carries the rest of the discriminator.
+    - name: Resolve rerun artifact names
+      if: ${{ inputs.granular-rerun == 'true' }}
+      shell: bash
+      env:
+        RERUN_ARTIFACT_BASE: ${{ format('failed-tests-{0}{1}', inputs.junit-name, inputs.artifact-suffix && format('-{0}', inputs.artifact-suffix) || '') }}
+      run: |
+        echo "RERUN_ARTIFACT=$RERUN_ARTIFACT_BASE-attempt-$GITHUB_RUN_ATTEMPT" >> "$GITHUB_ENV"
+        echo "RERUN_PREV_ARTIFACT=$RERUN_ARTIFACT_BASE-attempt-$((GITHUB_RUN_ATTEMPT - 1))" >> "$GITHUB_ENV"
+
+    # `pattern` (not `name`) because the artifact is legitimately absent whenever the
+    # previous attempt recorded nothing: `name` treats that as an error, `pattern`
+    # downloads nothing and moves on. The value is a literal — no glob metacharacters —
+    # so it matches exactly one artifact, which lands at `target/failed-tests`. A pattern
+    # that ever matched two would nest them under their artifact names instead, leaving
+    # the file absent and falling back to the full suite.
+    - name: Restore previously-failed tests
+      if: ${{ inputs.granular-rerun == 'true' && github.run_attempt != '1' }}
+      continue-on-error: true
+      uses: actions/download-artifact@v8
+      with:
+        pattern: ${{ env.RERUN_PREV_ARTIFACT }}
+        path: target
+
     - name: Test database driver
-      run: clojure -X:dev:ci:${{ inputs.edition }}:${{ inputs.edition }}-dev:drivers:drivers-dev:test ${{ inputs.test-args }}
+      # On a rerun with a non-empty failed-tests file, target only those vars via
+      # hawk `:only` (a var-level selector bypasses `:only-tags`, which is fine —
+      # every listed var already passed that filter on the first attempt).
+      # Otherwise run exactly as before. Quote the file so the whole `[ns/var ...]`
+      # vector reaches clojure -X as a single argument.
+      run: |
+        BASE="clojure -X:dev:ci:${{ inputs.edition }}:${{ inputs.edition }}-dev:drivers:drivers-dev:test"
+        if [ "${{ inputs.granular-rerun }}" = "true" ] && [ "${{ github.run_attempt }}" != "1" ] && [ -s target/failed-tests ]; then
+          echo "Granular rerun of previously-failed tests: $(cat target/failed-tests)"
+          $BASE :only "$(cat target/failed-tests)"
+        else
+          $BASE ${{ inputs.test-args }}
+        fi
       shell: bash
       id: run-test
-      # Keep this step continue-on-error because the quarantine logic controls whether it ultimately fails.
-      # Driver "info" status can affect this logic. See below.
+      # Keep this step continue-on-error because the quarantine gate below controls whether it
+      # ultimately fails.
       continue-on-error: true
 
     - name: Report failed tests to ci-conductor
@@ -65,6 +122,30 @@ runs:
         test-suite: ${{ inputs.junit-name }}
         adapter: backend
 
+    # Granular rerun: record which tests failed so a re-run of this
+    # job targets only those (restored above). Reuses the backend JUnit adapter
+    # from the ci-conductor sources the report step just prepared. Best-effort:
+    # writes nothing unless every failure is attributable to a var, so an
+    # unattributable failure falls back to a full rerun.
+    - name: Collect failed tests for rerun
+      if: ${{ inputs.granular-rerun == 'true' && !cancelled() && steps.run-test.outcome == 'failure' }}
+      continue-on-error: true
+      shell: bash
+      # Clear the restored set first, so a collector that dies before deciding
+      # can't leave the previous attempt's file to be uploaded as this one's.
+      run: |
+        rm -f target/failed-tests
+        bun release/ci-conductor/src/collect-failed-backend.ts
+
+    - name: Upload failed tests for rerun
+      if: ${{ inputs.granular-rerun == 'true' && !cancelled() && steps.run-test.outcome == 'failure' }}
+      continue-on-error: true
+      uses: actions/upload-artifact@v7
+      with:
+        name: ${{ env.RERUN_ARTIFACT }}
+        path: target/failed-tests
+        if-no-files-found: ignore
+
     - name: Publish Test Report (JUnit)
       uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
       # As per the documentation: https://docs.github.com/en/actions/reference/workflows-and-actions/contexts#steps-context
@@ -83,7 +164,7 @@ runs:
       if: always() && steps.run-test.outcome != 'success'
       uses: actions/upload-artifact@v7
       with:
-        name: ${{ format('test-logs-{0}{1}', github.job, inputs.logs-artifact-suffix && format('-{0}', inputs.logs-artifact-suffix) || '') }}
+        name: ${{ format('test-logs-{0}{1}', github.job, inputs.artifact-suffix && format('-{0}', inputs.artifact-suffix) || '') }}
         path: logs/test-log.json
         retention-days: 1
       # Failing to upload the artifact should never affect the outcome of the whole test run.
@@ -92,13 +173,7 @@ runs:
     # Last, because this is the only step allowed to fail the job: everything above it reports the
     # failure (JUnit report, logs, ci-conductor) and must run regardless of the verdict below.
     - name: Quarantine gate
-      # Off master and release branches an "info" driver is data-collection only - the test always passes!
-      # On master and release branches "info" carries no weight - the quarantine logic applies.
-      if: |
-        !cancelled()
-        && steps.run-test.outcome == 'failure'
-        && !(inputs.driver-status == 'info'
-             && !(github.ref_name == 'master' || startsWith(github.ref_name, 'release-x')))
+      if: ${{ !cancelled() && steps.run-test.outcome == 'failure' }}
       uses: ./.github/actions/quarantine-gate
       with:
         adapter: backend

.github/actions/upgrade-backend-deps/action.yml

@@ -1,4 +1,5 @@
 name: Create Backend Dep Bump PRs
+description: Opens a pull request for each backend dependency that has a newer version available.
 
 inputs:
   github-token:

.github/actions/upload-test-results/action.yml

@@ -1,185 +0,0 @@
-name: Upload Test Results to s3
-description: Uploads test results files to s3
-
-inputs:
-  input-path:
-    required: true
-  output-name:
-    required: true
-    default: test
-  role-to-assume:
-    required: true
-  aws-region:
-    required: true
-    default: us-east-1
-  bucket:
-    required: true
-  trunk-api-token:
-    required: true
-  variant:
-    required: false
-    default: ""
-  previous-step-outcome:
-    required: true
-  driver-status:
-    required: false
-    default: ""
-    description: >-
-      Configured status for this driver ("info", "skip", "required", or empty). When
-      "info", the job is reported as passing regardless of the real test outcome, and
-      that outcome is surfaced via a job summary and (on PRs) a comment instead.
-  report-variant:
-    required: false
-    default: ""
-    description: >-
-      Optional label disambiguating matrix legs of the same job, so the info-driver
-      job summary and PR comment stay distinct per leg.
-  run-trunk:
-    required: false
-    default: "true"
-    description: Whether to run the Trunk step at all.
-
-runs:
-  using: "composite"
-  steps:
-    - name: Configure AWS credentials
-      uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885
-      with:
-        role-to-assume: ${{ inputs.role-to-assume }}
-        aws-region: ${{ inputs.aws-region }}
-    - name: zip test results
-      env:
-        INPUT_DIR: ${{ inputs.input-path }}
-        OUTPUT_FILE: ${{ inputs.output-name }}
-      shell: bash
-      run: | # sh
-        zip ${OUTPUT_FILE}.zip $INPUT_DIR/*.xml
-    - name: Upload test results to S3
-      env:
-        BUCKET: ${{ inputs.bucket }}
-        OUTPUT_FILE: ${{ inputs.output-name }}
-      shell: bash
-      run: | # sh
-        DATE=$(date '+%Y-%m-%d')
-        aws s3 cp ${OUTPUT_FILE}.zip s3://$BUCKET/$DATE/$GITHUB_RUN_ID/$GITHUB_RUN_ATTEMPT/
-
-    - name: Upload results to Trunk
-      if: ${{ always() && github.repository_owner == 'metabase' && inputs.run-trunk == 'true' }}
-      # Important!
-      # For "info" drivers off master/release branches, our own status takes precedence: we let this
-      # step pass so the job is reported as passing regardless of the real outcome (still uploaded).
-      # On master and release branches, info status is ignored and the real outcome gates the job.
-      continue-on-error: ${{ inputs.driver-status == 'info' && !(github.ref_name == 'master' || startsWith(github.ref_name, 'release-x')) }}
-      uses: trunk-io/analytics-uploader@1198efcc0976501147b10a7e343c3fa069527526 # v2.0.9
-      env:
-        TRUNK_REPO_URL: git@github.com:metabase/metabase.git
-      with:
-        junit-paths: ${{ inputs.input-path }}
-        variant: ${{ inputs.variant || inputs.output-name }}
-        org-slug: metabase
-        dry-run: ${{ (github.event_name == 'pull_request' && github.event.pull_request.draft == true) || github.repository != 'metabase/metabase' }} # quarantine, but do not upload results
-        token: ${{ inputs.trunk-api-token }}
-        use-cache: true
-        previous-step-outcome: ${{ inputs.previous-step-outcome }}
-
-    # For "info" drivers the job is forced green above, so surface the real outcome here —
-    # but only when it did NOT pass, to avoid spamming summaries/comments for healthy runs.
-    # Never include logs or stack traces — only the real status and a link to the run.
-    - name: Report info-level driver result (job summary)
-      if: ${{ always() && inputs.driver-status == 'info' && inputs.previous-step-outcome == 'failure' }}
-      shell: bash
-      env:
-        OUTCOME: ${{ inputs.previous-step-outcome }}
-        LABEL: ${{ inputs.output-name }}
-        VARIANT: ${{ inputs.report-variant }}
-      run: | # sh
-        if [ "$OUTCOME" = "success" ]; then EMOJI="✅"; else EMOJI="❌"; fi
-        TITLE="$LABEL"
-        [ -n "$VARIANT" ] && TITLE="$LABEL ($VARIANT)"
-        RUN_URL="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID"
-        {
-          echo "### ℹ️ Info-level driver: $TITLE"
-          echo ""
-          echo "Reported as passing (non-blocking). Real result: $EMOJI \`$OUTCOME\`"
-          echo ""
-          echo "[View run]($RUN_URL)"
-        } >> "$GITHUB_STEP_SUMMARY"
-
-    # Maintain ONE PR comment per commit for all info drivers. Each leg upserts its own line
-    # (keyed by a hidden tag); a passing leg removes its line, and the comment is deleted once
-    # no failing legs remain. Comments from older commits are cleaned up. Runs on pass and fail
-    # so recoveries self-heal. Never includes logs or stack traces — only status and a run link.
-    - name: Sync info-level driver result into the PR comment
-      if: ${{ always() && inputs.driver-status == 'info' && github.event_name == 'pull_request' }}
-      uses: actions/github-script@v9
-      continue-on-error: true
-      env:
-        OUTCOME: ${{ inputs.previous-step-outcome }}
-        LABEL: ${{ inputs.output-name }}
-        VARIANT: ${{ inputs.report-variant }}
-      with:
-        script: | # js
-          const { OUTCOME, LABEL, VARIANT, GITHUB_SERVER_URL, GITHUB_REPOSITORY, GITHUB_RUN_ID } = process.env;
-          const pr = context.payload.pull_request;
-          if (!pr) return;
-          const { owner, repo } = context.repo;
-          const sha = pr.head.sha;
-          // PREFIX matches the current per-commit marker AND the older per-leg one, so legacy
-          // comments from a previous version get cleaned up on the next sync.
-          const PREFIX = "<!-- info-driver-result";
-          const marker = `<!-- info-driver-results:${sha} -->`;
-          const header = `${marker}\nℹ️ **Info-level drivers** failed (non-blocking) on \`${sha.slice(0, 7)}\` — these do not gate:`;
-          const lineKey = `${LABEL}:${VARIANT}`;
-          const title = VARIANT ? `${LABEL} (${VARIANT})` : LABEL;
-          const runUrl = `${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}`;
-          // Only real failures are reported; cancelled/skipped/success remove this leg's line.
-          // List-item line with the hidden key tag at the END so markdown (links) renders.
-          const ourLine = OUTCOME === "failure"
-            ? `- **${title}** — ❌ \`${OUTCOME}\` ([Logs](${runUrl})) <!--l:${lineKey}-->`
-            : null;
-          const linesOf = (body) => body.split("\n").filter((l) => l.includes("<!--l:"));
-
-          const sync = async () => {
-            const { data: comments } = await github.rest.issues.listComments({
-              owner, repo, issue_number: pr.number, per_page: 100,
-            });
-            const tagged = comments.filter((c) => c.body.includes(PREFIX));
-            // Drop comments left over from older commits.
-            for (const c of tagged.filter((c) => !c.body.includes(marker))) {
-              await github.rest.issues.deleteComment({ owner, repo, comment_id: c.id }).catch(() => {});
-            }
-            const mine = tagged
-              .filter((c) => c.body.includes(marker))
-              .sort((a, b) => new Date(a.created_at) - new Date(b.created_at));
-            // Merge any duplicates raced into existence; latest write of each line wins.
-            const byKey = new Map();
-            for (const c of mine) {
-              for (const l of linesOf(c.body)) {
-                const m = l.match(/<!--l:(.*?)-->/);
-                if (m) byKey.set(m[1], l);
-              }
-            }
-            if (ourLine) byKey.set(lineKey, ourLine);
-            else byKey.delete(lineKey);
-            const lines = [...byKey.values()].sort();
-            const target = mine[0];
-            for (const c of mine.slice(1)) {
-              await github.rest.issues.deleteComment({ owner, repo, comment_id: c.id }).catch(() => {});
-            }
-            if (lines.length === 0) {
-              if (target) await github.rest.issues.deleteComment({ owner, repo, comment_id: target.id }).catch(() => {});
-              return;
-            }
-            const body = [header, "", ...lines].join("\n");
-            if (target) {
-              await github.rest.issues.updateComment({ owner, repo, comment_id: target.id, body });
-            } else {
-              await github.rest.issues.createComment({ owner, repo, issue_number: pr.number, body });
-            }
-          };
-
-          // Retry to shrink the window where parallel legs clobber each other's update.
-          for (let i = 0; i < 4; i++) {
-            try { await sync(); break; }
-            catch (e) { if (i === 3) throw e; await new Promise((r) => setTimeout(r, 400 * (i + 1))); }
-          }

.github/actions/verify-membership/action.yml

@@ -1,22 +0,0 @@
-name: 'Verify Organization Membership'
-description: 'Check if a user is a member of a GitHub organization'
-inputs:
-  github_token:
-    description: 'Token with access to the organization'
-    required: true
-  organization_name:
-    description: 'Organization name'
-    required: true
-  username:
-    description: 'Username'
-    required: true
-outputs:
-  is_member:
-    value: ${{ steps.verify-membership.outputs.is_member }}
-    description: "Is the user a member of the organization"
-runs:
-  using: "composite"
-  steps:
-    - run: bash ${{ github.action_path }}/verify_membership.sh ${{ inputs.github_token }} ${{ inputs.organization_name }} ${{ inputs.username }}
-      id: verify-membership
-      shell: bash

.github/actions/verify-membership/verify_membership.sh

@@ -1,25 +0,0 @@
-#!/bin/bash
-
-TOKEN=$1
-ORG_NAME=$2
-USERNAME=$3
-
-response=$(curl -L -o /dev/null -w "%{http_code}" \
-  -H "Accept: application/vnd.github+json" \
-  -H "Authorization: Bearer $TOKEN" \
-  -H "X-GitHub-Api-Version: 2022-11-28" \
-  "https://api.github.com/orgs/$ORG_NAME/members/$USERNAME")
-
-# Github returns an empty response with 204 status if user is a member and 404 status otherwise
-# See: https://docs.github.com/en/rest/orgs/members?apiVersion=2022-11-28#check-organization-membership-for-a-user
-if [ "$response" == "204" ]; then
-    echo "The user $USERNAME is a member of $ORG_NAME"
-    echo "is_member=true" >> $GITHUB_OUTPUT
-elif [ "$response" == "404" ]; then
-    echo "The user $USERNAME is not a member of $ORG_NAME"
-    echo "is_member=false" >> $GITHUB_OUTPUT
-else
-    echo "Failed to determine the membership status for $USERNAME in $ORG_NAME"
-    echo "is_member=false" >> $GITHUB_OUTPUT
-    exit 1
-fi

.github/file-paths.yaml

@@ -106,13 +106,6 @@ backend_ci: &backend_ci
   - ".github/workflows/backend.yml"
   - ".github/workflows/drivers.yml"
 
-backend_presto_kerberos:
-  - "**/presto_jdbc/**"
-  - "**/presto-jdbc/**" # the driver module has a hyphen. underscores are classpaths
-  - "**/presto_jdbc.clj"
-  - "**/presto_jdbc_test.clj"
-  - ".github/workflows/presto-kerberos-integration-test.yml"
-
 backend_sources: &backend_sources
   - *shared_sources
   - "**deps.edn"
@@ -150,7 +143,7 @@ custom_viz_all:
 
 e2e_ci: &e2e_ci
   - *shared_ci
-  - ".github/actions/prepare-uberjar-artifact/**"
+  - ".github/workflows/uberjar.yml"
   - ".github/actions/fetch-artifact/action.yml"
   - ".github/actions/e2e-prepare-containers/**"
   - ".github/actions/prepare-cypress/**"
@@ -161,7 +154,7 @@ e2e_specs: &e2e_specs
 
 embedding_sdk_ci: &embedding_sdk_ci
   - *shared_ci
-  - ".github/actions/prepare-uberjar-artifact/**"
+  - ".github/workflows/uberjar.yml"
   - ".github/actions/fetch-artifact/action.yml"
   - ".github/actions/prepare-cypress/**"
   - ".github/workflows/embedding-sdk*.yml"
@@ -183,7 +176,7 @@ embedding_sdk_host_sample_apps:
   - "e2e/test-host-app/**/*.cy.*.{js,ts}"
 
 snowplow: &snowplow
-  - ".github/workflows/snowplow.yml"
+  - ".github/workflows/lint.yml"
   - "snowplow/**"
   - "bin/lint-snowplow-schemas.bb"
   - "bin/lint-snowplow-schemas-test.bb"
@@ -212,7 +205,7 @@ yaml:
   - "**/*.yaml"
 
 codeql:
-  - ".github/workflows/codeql.yml"
+  - ".github/workflows/lint.yml"
   - "frontend/src/**"
   - "enterprise/frontend/src/**"
 
@@ -220,14 +213,9 @@ i18n:
   - *default
   - ".github/actions/prepare-frontend/**"
   - ".github/actions/prepare-backend/**"
-  - ".github/workflows/i18n.yml"
+  - ".github/workflows/lint.yml"
   - *sources
 
-visualizations:
-  - "frontend/src/metabase/visualizations/**"
-  - "frontend/src/metabase/static-viz/**"
-  - "src/metabase/pulse/**"
-
 cljs:
   - *shared_sources
   - *shared_specs
@@ -239,7 +227,7 @@ serialization_baseline:
   - "test_resources/serialization_baseline/**"
 
 openapi:
-  - ".github/workflows/openapi.yml"
+  - ".github/workflows/lint.yml"
   - "src/metabase/api/**"
   - "src/metabase/api_routes/**"
   - "src/metabase/*_rest/api.clj"

.github/scripts/affected-modules.ts

@@ -1,7 +1,12 @@
 import micromatch from "micromatch";
 
 export type ModuleDef = { type: string; pattern: string };
-export type Rule = { from: string[]; allow: string[] };
+
+export type Rule = {
+  from: string[];
+  allow?: string[];
+  disallow?: string[];
+};
 
 export type ModuleNode = { type: string; regex: RegExp };
 
@@ -203,8 +208,11 @@ export function buildModuleGraph(
     allTypes.map((type) => [type, new Set()]),
   );
   for (const rule of rules) {
+    // Grandfathered imports that break the disallow rules still exist in the code,
+    // and selection must cover every import that actually exists.
+    // So disallow rules are ignored, at the cost of a looser graph.
     const fromTypes = rule.from.flatMap(expandPattern);
-    const allowTypes = rule.allow.flatMap(expandPattern);
+    const allowTypes = (rule.allow ?? []).flatMap(expandPattern);
     for (const target of allowTypes) {
       for (const importer of fromTypes) {
         if (importer !== target) {

.github/scripts/fix-yarn-lock-aliases.ts

@@ -0,0 +1,66 @@
+/**
+ * Renames aliased dependency keys in a bun-generated yarn.lock.
+ *
+ * Yarn names an alias entry after the alias, for example
+ * `"typescript7@npm:typescript@7.0.2"`. Bun names it after the aliased package
+ * instead, for example `"typescript@npm:typescript@7.0.2"`. Snyk follows the
+ * yarn convention and fails to resolve the dependency.
+ */
+
+import { readFile, writeFile } from "node:fs/promises";
+
+async function main() {
+  const packageJsonPath = `${process.cwd()}/package.json`;
+  const lockPath = `${process.cwd()}/yarn.lock`;
+
+  const packageJson = JSON.parse(await readFile(packageJsonPath, "utf8"));
+
+  const dependencies = Object.entries<string>(
+    Object.assign(
+      {},
+      packageJson.dependencies,
+      packageJson.devDependencies,
+      packageJson.optionalDependencies,
+    ),
+  );
+
+  let lock = await readFile(lockPath, "utf8");
+  const renamedKeys: string[] = [];
+
+  for (const [alias, specifier] of dependencies) {
+    if (!specifier.startsWith("npm:")) {
+      continue;
+    }
+
+    const aliasedPackage = specifier
+      .slice("npm:".length)
+      .replace(/@[^@]*$/, "");
+
+    if (aliasedPackage === alias) {
+      continue;
+    }
+
+    const bunKey = `"${aliasedPackage}@${specifier}"`;
+    const yarnKey = `"${alias}@${specifier}"`;
+
+    if (lock.includes(bunKey)) {
+      lock = lock.replaceAll(bunKey, yarnKey);
+      renamedKeys.push(`${bunKey} -> ${yarnKey}`);
+    }
+  }
+
+  if (renamedKeys.length > 0) {
+    await writeFile(lockPath, lock);
+  }
+
+  process.stdout.write(
+    renamedKeys.length > 0
+      ? `Renamed alias keys in yarn.lock:\n${renamedKeys.join("\n")}\n`
+      : "No alias keys to rename in yarn.lock\n",
+  );
+}
+
+main().catch((error) => {
+  process.stderr.write(`Failed to rename alias keys in yarn.lock: ${error}\n`);
+  process.exit(1);
+});

.github/scripts/get-issue-data.js

@@ -1,84 +0,0 @@
-const githubSlackMap = require("../../release/github-slack-map.json");
-
-async function getIssueData({ context, github, manualIssueNumber }) {
-  let issueNumber;
-  let issueData;
-  let prReviews = [];
-  const triggerType = context.eventName;
-
-  if (context.eventName === "issues") {
-    issueNumber = context.payload.issue.number;
-    issueData = context.payload.issue;
-  } else if (context.eventName === "workflow_dispatch") {
-    issueNumber = parseInt(manualIssueNumber);
-    const { data } = await github.rest.issues.get({
-      owner: context.repo.owner,
-      repo: context.repo.repo,
-      issue_number: issueNumber,
-    });
-    issueData = data;
-  } else if (context.eventName === "pull_request_review") {
-    const prNumber = context.payload.pull_request.number;
-    const { data: prData } = await github.rest.pulls.get({
-      owner: context.repo.owner,
-      repo: context.repo.repo,
-      pull_number: prNumber,
-    });
-
-    // Extract issue number from branch name (e.g., "claude-fix/issue-12345-some-title")
-    const branchMatch = prData.head.ref.match(/claude-fix\/issue-(\d+)/);
-    if (!branchMatch) {
-      throw new Error(
-        `Could not extract issue number from branch name: ${prData.head.ref}`,
-      );
-    }
-
-    issueNumber = parseInt(branchMatch[1]);
-
-    const { data } = await github.rest.issues.get({
-      owner: context.repo.owner,
-      repo: context.repo.repo,
-      issue_number: issueNumber,
-    });
-    issueData = data;
-
-    const { data: reviews } = await github.rest.pulls.listReviews({
-      owner: context.repo.owner,
-      repo: context.repo.repo,
-      pull_number: prNumber,
-    });
-
-    prReviews = reviews.filter(
-      (review) =>
-        review.state === "CHANGES_REQUESTED" &&
-        isMetabaseMember(review.user.login),
-    );
-  }
-
-  const { data: comments } = await github.rest.issues.listComments({
-    owner: context.repo.owner,
-    repo: context.repo.repo,
-    issue_number: issueNumber,
-  });
-
-  const employeeComments = comments.filter((comment) =>
-    isMetabaseMember(comment.user.login),
-  );
-
-  return {
-    issueNumber,
-    issueData,
-    employeeComments,
-    prReviews,
-    triggerType,
-    isIssueAuthorEmployee: isMetabaseMember(issueData.user.login),
-  };
-}
-
-function isMetabaseMember(username) {
-  return username in githubSlackMap;
-}
-
-module.exports = {
-  getIssueData,
-};

.github/scripts/run-presto-kerberos-integration-test.sh

@@ -1,65 +0,0 @@
-#! /usr/bin/env bash
-# runs one or more Metabase test(s) against a Kerberized Presto instance
-set -eo pipefail
-
-# Need Java commands on $PATH, which apparently is not yet the case
-export JAVA_HOME="/usr/lib/jvm/msopenjdk-current"
-export PATH="$PATH:$JAVA_HOME/bin"
-
-# ensure java commmand is available
-which java
-
-# install clojure version needed for Metabase
-curl -O https://download.clojure.org/install/linux-install-1.12.0.1488.sh
-chmod +x linux-install-1.12.0.1488.sh
-./linux-install-1.12.0.1488.sh
-
-RESOURCES_DIR=/app/source/resources
-
-# ensure the expected files are in place, in the resources dir
-if [ ! -f "$RESOURCES_DIR/ssl_keystore.jks" ]; then
-  echo "$RESOURCES_DIR/ssl_keystore.jks does not exist; cannot run test" >&2
-  exit 11
-fi
-
-if [ ! -f "$RESOURCES_DIR/krb5.conf" ]; then
-  echo "$RESOURCES_DIR/krb5.conf does not exist; cannot run test" >&2
-  exit 12
-fi
-
-if [ ! -f "$RESOURCES_DIR/client.keytab" ]; then
-  echo "$RESOURCES_DIR/client.keytab does not exist; cannot run test" >&2
-  exit 13
-fi
-
-# Copy the JDK cacerts file to our resources
-cp $JAVA_HOME/lib/security/cacerts $RESOURCES_DIR/cacerts-with-presto-ca.jks
-
-# Capture the Presto server self signed CA in PEM format
-openssl s_client -showcerts -connect presto-kerberos:7778 </dev/null \
-  | openssl x509 -outform PEM >$RESOURCES_DIR/presto-ssl-root-ca.pem
-
-# Convert the Presto server self signed CA to DER format
-openssl x509 -outform der -in $RESOURCES_DIR/presto-ssl-root-ca.pem  -out $RESOURCES_DIR/presto-ssl-root-ca.der
-
-# Add Presto's self signed CA to the truststore
-keytool -noprompt -import -alias presto-kerberos -keystore $RESOURCES_DIR/cacerts-with-presto-ca.jks \
-        -storepass changeit -file $RESOURCES_DIR/presto-ssl-root-ca.der -trustcacerts
-
-# Set up the environment variables pointing to all of this, and run some tests
-DRIVERS=presto-jdbc \
-MB_ENABLE_PRESTO_JDBC_DRIVER=true \
-MB_PRESTO_JDBC_TEST_HOST=presto-kerberos \
-MB_PRESTO_JDBC_TEST_PORT=7778 \
-MB_PRESTO_JDBC_TEST_SSL=true \
-MB_PRESTO_JDBC_TEST_SSL_KEYSTORE_PATH=$RESOURCES_DIR/ssl_keystore.jks \
-MB_PRESTO_JDBC_TEST_SSL_KEYSTORE_PASSWORD=presto \
-MB_PRESTO_JDBC_TEST_SSL_TRUSTSTORE_PATH=$RESOURCES_DIR/cacerts-with-presto-ca.jks \
-MB_PRESTO_JDBC_TEST_SSL_TRUSTSTORE_PASSWORD=changeit \
-MB_PRESTO_JDBC_TEST_KERBEROS=true \
-MB_PRESTO_JDBC_TEST_USER=bob@EXAMPLE.COM \
-MB_PRESTO_JDBC_TEST_KERBEROS_PRINCIPAL=bob@EXAMPLE.COM \
-MB_PRESTO_JDBC_TEST_KERBEROS_REMOTE_SERVICE_NAME=HTTP \
-MB_PRESTO_JDBC_TEST_KERBEROS_KEYTAB_PATH=$RESOURCES_DIR/client.keytab \
-MB_PRESTO_JDBC_TEST_KERBEROS_CONFIG_PATH=$RESOURCES_DIR/krb5.conf \
-clojure -X:dev:test:drivers:drivers-dev :only metabase.driver.presto-jdbc-test

.github/team.json

@@ -64,7 +64,9 @@
         "lbrdnk",
         "piranha",
         "crisptrutski",
-        "undrfined"
+        "undrfined",
+        "andreis",
+        "prascuna"
       ]
     },
     {

.github/workflows/actionlint.yml

@@ -1,44 +0,0 @@
-name: Actionlint
-
-on:
-  push:
-    branches:
-      - 'master'
-      - 'release-**'
-    paths:
-      - '.github/workflows/**'
-  pull_request:
-    paths:
-      - '.github/workflows/**'
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
-  cancel-in-progress: true
-
-jobs:
-  actionlint:
-    name: Lint Github Actions Workflows
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    steps:
-      - uses: actions/checkout@v6
-      - name: Get changed Github actions
-        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
-        id: changes
-        with:
-          token: ${{ github.token }}
-          filters: .github/file-paths.yaml
-          list-files: shell
-      - name: Setup actionlint
-        if: steps.changes.outputs.actionlint == 'true'
-        id: download
-        shell: bash
-        run: |
-          if command -v actionlint; then
-            echo "executable=actionlint" >> "$GITHUB_OUTPUT"
-          else
-            # script sets executable output, for details see: https://github.com/rhysd/actionlint/blob/main/docs/usage.md#use-actionlint-on-github-actions
-            bash <(curl -fsSL https://raw.githubusercontent.com/rhysd/actionlint/v1.7.12/scripts/download-actionlint.bash)
-          fi
-      - name: Run actionlint
-        if: steps.changes.outputs.actionlint == 'true'
-        run: ${{ steps.download.outputs.executable }} --color --verbose ${{ steps.changes.outputs.actionlint_files }}

.github/workflows/app-db.yml

@@ -61,6 +61,9 @@ jobs:
     services:
       mysql:
         image: ${{ matrix.version.image }}
+        # disposable CI database: a RAM-backed datadir makes the ~90k fsyncs of a full
+        # migration chain free (measured: setup-db! 59s -> 16s)
+        options: --tmpfs /var/lib/mysql:rw
         ports:
           - "3306:3306"
         env:
@@ -117,22 +120,11 @@ jobs:
         with:
           build-static-viz: ${{ matrix.job.build-static-viz }}
           junit-name: ${{ matrix.version.junit-name }}
+          artifact-suffix: ${{ matrix.job.name }}
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[ ${{ matrix.job.exclude-tag }} ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
           quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-      - name: Upload Test Results
-        uses: ./.github/actions/upload-test-results
-        if: always()
-        with:
-          input-path: ./target/junit/
-          output-name: ${{ github.job }}
-          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-          aws-region: ${{ vars.AWS_REGION }}
-          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-mysql:
     if: ${{ !inputs.skip }}
@@ -187,6 +179,9 @@ jobs:
     services:
       mysql:
         image: ${{ matrix.version.image }}
+        # disposable CI database: a RAM-backed datadir makes the ~90k fsyncs of a full
+        # migration chain free (measured: setup-db! 59s -> 16s)
+        options: --tmpfs /var/lib/mysql:rw
         ports:
           - "3306:3306"
         env:
@@ -251,22 +246,11 @@ jobs:
         with:
           build-static-viz: ${{ matrix.job.build-static-viz }}
           junit-name: ${{ matrix.version.junit-name }}
+          artifact-suffix: ${{ matrix.job.name }}
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[ ${{ matrix.job.exclude-tag }} ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
           quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-      - name: Upload Test Results
-        uses: ./.github/actions/upload-test-results
-        if: always()
-        with:
-          input-path: ./target/junit/
-          output-name: ${{ github.job }}
-          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-          aws-region: ${{ vars.AWS_REGION }}
-          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-postgres:
     if: ${{ !inputs.skip }}
@@ -363,22 +347,11 @@ jobs:
         with:
           build-static-viz: ${{ matrix.job.build-static-viz }}
           junit-name: 'be-tests-${{ matrix.version.junit-name }}'
+          artifact-suffix: ${{ matrix.job.name }}
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[ ${{ matrix.job.exclude-tag }} ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
           quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-      - name: Upload Test Results
-        uses: ./.github/actions/upload-test-results
-        if: always()
-        with:
-          input-path: ./target/junit/
-          output-name: ${{ github.job }}
-          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-          aws-region: ${{ vars.AWS_REGION }}
-          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   app-db-tests-result:
     needs:

.github/workflows/auto-backport.yml

@@ -99,6 +99,36 @@ jobs:
       )
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     steps:
+      - name: "!! double-backport and triple-backport label deprecation warning !!"
+        if:
+          |
+          github.event.pull_request.merged == true && (
+            github.event.action == 'closed' && (
+              contains(github.event.pull_request.labels.*.name, 'double-backport') ||
+              contains(github.event.pull_request.labels.*.name, 'triple-backport')
+            ) ||
+            github.event.action == 'labeled' && (
+              github.event.label.name == 'double-backport' ||
+              github.event.label.name == 'triple-backport'
+            )
+          )
+        env:
+          REPO: ${{ github.repository }}
+          PR: ${{ github.event.pull_request.number }}
+          GH_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+        run: |
+          msg="🚨🚨 Backport failed because \`double-backport\` and \`triple-backport\` labels are **deprecated**! Use the \`backport\` label to port changes to all supported releases instead. 🚨🚨"
+
+          gh api \
+            --silent \
+            --method POST \
+            -H "Accept: application/vnd.github+json" \
+            -H "X-GitHub-Api-Version: 2026-03-10" \
+            /repos/"$REPO"/issues/"$PR"/comments \
+            -f "body=$msg"
+
+          echo "::error::$msg"
+          exit 1
       - uses: actions/checkout@v6
         with:
           fetch-depth: 0
@@ -110,29 +140,6 @@ jobs:
           pull-request-number: ${{ github.event.pull_request.number }}
           base-ref: ${{ github.event.pull_request.base.ref }}
 
-      - name: how many backports?
-        id: how-many-backports
-        uses: actions/github-script@v9
-        with:
-          script: | # js
-            const labels = [
-              ...${{ toJson(github.event.pull_request.labels) }},
-              { name:"${{ github.event.label.name }}" }
-            ];
-
-            const backportLabelNames = labels.filter(label => label.name.includes('backport')).map(label => label.name);
-
-            let result = 1;
-
-            if (backportLabelNames.includes("triple-backport")) {
-              result = 3;
-            } else if (backportLabelNames.includes("double-backport")) {
-              result = 2;
-            }
-
-            console.log("backports", result);
-            return result;
-
       - name: get release versions
         id: get-latest-release-version
         uses: actions/github-script@v9
@@ -157,21 +164,3 @@ jobs:
           backport-commit: ${{ steps.find_commit.outputs.commit }}
           github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
           github-token-2: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Double Backport
-        if: ${{ always() && fromJson(steps.how-many-backports.outputs.result) >= 2 }}
-        uses: ./.github/actions/create-backport
-        with:
-          target-version: ${{ fromJson(steps.get-latest-release-version.outputs.result).secondLatest }}
-          backport-commit: ${{ steps.find_commit.outputs.commit }}
-          github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
-          github-token-2: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Triple Backport
-        if: ${{ always() && fromJson(steps.how-many-backports.outputs.result) >= 3 }}
-        uses: ./.github/actions/create-backport
-        with:
-          target-version: ${{ fromJson(steps.get-latest-release-version.outputs.result).thirdLatest }}
-          backport-commit: ${{ steps.find_commit.outputs.commit }}
-          github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
-          github-token-2: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/backend-cloverage.yml

@@ -24,8 +24,8 @@ jobs:
       - uses: actions/checkout@v6
       - id: get-modules
         run: |
-          modules=$(ls -1d src/metabase/*/ | xargs -n1 basename | tr '_' '-' | jq -R -s -c 'split("\n") | map(select(length > 0))')
-          echo "modules=$modules" >> $GITHUB_OUTPUT
+          modules=$(for d in src/metabase/*/; do basename "$d"; done | tr '_' '-' | jq -R -s -c 'split("\n") | map(select(length > 0))')
+          echo "modules=$modules" >> "$GITHUB_OUTPUT"
 
   be-linter-cloverage:
     needs: setup-oss
@@ -71,8 +71,8 @@ jobs:
       - uses: actions/checkout@v6
       - id: get-modules
         run: |
-          modules=$(ls -1d enterprise/backend/src/metabase_enterprise/*/ | xargs -n1 basename | tr '_' '-' | jq -R -s -c 'split("\n") | map(select(length > 0))')
-          echo "modules=$modules" >> $GITHUB_OUTPUT
+          modules=$(for d in enterprise/backend/src/metabase_enterprise/*/; do basename "$d"; done | tr '_' '-' | jq -R -s -c 'split("\n") | map(select(length > 0))')
+          echo "modules=$modules" >> "$GITHUB_OUTPUT"
 
   be-linter-cloverage-enterprise:
     needs: setup-ee

.github/workflows/backend.yml

@@ -191,12 +191,51 @@ jobs:
         # below can link failures to this exact job. Best-effort.
         uses: ./.github/actions/resolve-job-id
 
+      # Granular rerun: on a re-run of a failed job, restore the list of tests
+      # that failed on the previous attempt (uploaded below) so the test step
+      # can target only those instead of the whole partition. Best-effort: a
+      # missing/empty artifact leaves no file and the run falls back to the full
+      # partition. First attempts skip this entirely.
+      #
+      # Scoped to the IMMEDIATELY preceding attempt: an attempt that passed, or
+      # that failed with nothing attributable to a var, uploads no artifact, and
+      # a narrow set must not outlive it. Reading `attempt - 1` means "only what
+      # the last attempt actually recorded" — anything else falls back to the
+      # full partition. Workflow expressions have no arithmetic, so the shell
+      # computes it.
+      - name: Resolve previous attempt
+        if: ${{ github.run_attempt != '1' }}
+        run: echo "RERUN_PREV_ATTEMPT=$((GITHUB_RUN_ATTEMPT - 1))" >> "$GITHUB_ENV"
+
+      # `pattern` (not `name`) because the artifact is legitimately absent whenever the
+      # previous attempt recorded nothing: `name` treats that as an error, `pattern`
+      # downloads nothing and moves on. The value is a literal — no glob metacharacters —
+      # so it matches exactly one artifact, which lands at `target/failed-tests`. A pattern
+      # that ever matched two would nest them under their artifact names instead, leaving
+      # the file absent and falling back to the full partition.
+      - name: Restore previously-failed tests
+        if: ${{ github.run_attempt != '1' }}
+        continue-on-error: true
+        uses: actions/download-artifact@v8
+        with:
+          pattern: failed-tests-be-tests-java-${{ matrix.java-version }}-${{ matrix.job.test-group-name }}-attempt-${{ env.RERUN_PREV_ATTEMPT }}
+          path: target
+
       - name: "Test Java ${{ matrix.java-version }} ${{ matrix.job.name }}"
         id: run-java-tests
-        run: >-
-          clojure -X:dev:ci:test:${{ matrix.job.edition }}:${{ matrix.job.edition }}-dev
-          :exclude-tags '[:mb/driver-tests ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
-          ${{ matrix.job.test-args }}
+        # On a rerun with a non-empty failed-tests file, target only those vars
+        # via hawk `:only`, dropping the tag/partition args — the listed vars are
+        # exactly this job's failures, already filtered and partitioned on the
+        # first attempt. Otherwise run exactly as before. Quote the file so the
+        # whole `[ns/var ...]` vector reaches clojure -X as a single argument.
+        run: |
+          BASE="clojure -X:dev:ci:test:${{ matrix.job.edition }}:${{ matrix.job.edition }}-dev"
+          if [ "${{ github.run_attempt }}" != "1" ] && [ -s target/failed-tests ]; then
+            echo "Granular rerun of previously-failed tests: $(cat target/failed-tests)"
+            $BASE :only "$(cat target/failed-tests)"
+          else
+            $BASE :exclude-tags '[:mb/driver-tests ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]' ${{ matrix.job.test-args }}
+          fi
         # Keep this step continue-on-error because the quarantine logic controls whether it ultimately fails.
         continue-on-error: true
 
@@ -209,6 +248,29 @@ jobs:
           test-suite: be-tests-java-${{ matrix.java-version }}-${{ matrix.job.test-group-name }}
           adapter: backend
 
+      # Granular rerun: record which tests failed so a re-run of this job targets
+      # only those (restored above). Reuses the backend JUnit adapter from the
+      # ci-conductor sources the report step just prepared. Best-effort: writes
+      # nothing unless every failure is attributable to a var, so an
+      # unattributable failure falls back to a full partition rerun.
+      - name: Collect failed tests for rerun
+        if: ${{ !cancelled() && steps.run-java-tests.outcome == 'failure' }}
+        continue-on-error: true
+        # Clear the restored set first, so a collector that dies before deciding
+        # can't leave the previous attempt's file to be uploaded as this one's.
+        run: |
+          rm -f target/failed-tests
+          bun release/ci-conductor/src/collect-failed-backend.ts
+
+      - name: Upload failed tests for rerun
+        if: ${{ !cancelled() && steps.run-java-tests.outcome == 'failure' }}
+        continue-on-error: true
+        uses: actions/upload-artifact@v7
+        with:
+          name: failed-tests-be-tests-java-${{ matrix.java-version }}-${{ matrix.job.test-group-name }}-attempt-${{ github.run_attempt }}
+          path: target/failed-tests
+          if-no-files-found: ignore
+
       - name: Quarantine gate
         if: ${{ !cancelled() && steps.run-java-tests.outcome == 'failure' }}
         continue-on-error: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
@@ -219,19 +281,6 @@ jobs:
           test-suite: be-tests-java-${{ matrix.java-version }}-${{ matrix.job.test-group-name }}
           enforce-quarantine: ${{ vars.QUARANTINE_ENGINE == 'ci-conductor' }}
 
-      - name: Upload Test Results
-        uses: ./.github/actions/upload-test-results
-        if: always()
-        with:
-          input-path: ./target/junit/
-          output-name: be-tests-java-${{ matrix.java-version }}-${{ matrix.job.edition }}
-          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-          aws-region: ${{ vars.AWS_REGION }}
-          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-          previous-step-outcome: ${{ steps.run-java-tests.outcome }}
-          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
-
       - name: Publish Test Report (JUnit)
         uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
         if: failure()

.github/workflows/block-master-source-branch-prs.yml

@@ -5,10 +5,10 @@ on:
 
 jobs:
   check-source-branch:
+    if: github.head_ref == 'master'
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     steps:
       - name: Block master branch PRs
-        if: github.head_ref == 'master'
         run: |
-          echo "PRs from `master` branches are not allowed, please use a new branch name for your PR."
+          echo "PRs from \`master\` branches are not allowed, please use a new branch name for your PR."
           exit 1

.github/workflows/build-for-release.yml

@@ -1,270 +0,0 @@
-# Builds a fresh release JAR from scratch at a given commit.
-#
-# You should almost never have to use this. The normal release flow relies on a
-# commit that has already been built and tested on its branch — see
-# `tag-for-release.yml`, which tags that existing JAR. Building from scratch
-# here is only for exceptional cases.
-name: Release 0 - Build Release Artifact
-run-name: Build ${{ inputs.version }}
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: 'Metabase version (e.g. v0.46.3)'
-        type: string
-        required: true
-      commit:
-        description: 'A full-length commit SHA-1 hash'
-        required: true
-
-jobs:
-  start-message:
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          sparse-checkout: |
-            release
-            .github
-      - name: Prepare release scripts
-        uses: ./.github/actions/prepare-release-scripts
-      - name: Send build start message
-        uses: actions/github-script@v9
-        env:
-          SLACK_RELEASE_CHANNEL: ${{ vars.SLACK_RELEASE_CHANNEL }}
-          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
-        with:
-          script: | # js
-            const { sendPreReleaseMessage } = require('${{ github.workspace }}/release/dist/index.cjs');
-
-            await sendPreReleaseMessage({
-              github,
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              version: '${{ inputs.version }}',
-              runId: '${{ github.run_id }}',
-              releaseSha: '${{ inputs.commit }}',
-              userName: '${{ github.actor }}',
-              channelName: '${{ vars.SLACK_RELEASE_CHANNEL }}',
-            }).catch(console.error);
-
-  trigger-milestone-check:
-    # Posts a Slack FYI about issues that still need review for this release.
-    # Informational only — nothing depends on it, so it never blocks the release.
-    needs: [check-version, check-commit]
-    permissions:
-      contents: read
-      issues: read
-    uses: ./.github/workflows/release-milestone-check.yml
-    secrets: inherit
-    with:
-      version: ${{ inputs.version }}
-      commit: ${{ inputs.commit }}
-
-  check-version:
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 10
-    outputs:
-      ee: ${{ fromJson(steps.canonical_version.outputs.result).ee }}
-      oss: ${{ fromJson(steps.canonical_version.outputs.result).oss }}
-    steps:
-    - name: Fail early on the incorrect version format
-      if: ${{ !(startsWith(inputs.version,'v0.') || startsWith(inputs.version,'v1.')) }}
-      run: |
-        echo "The version format is invalid!"
-        echo "It must start with either 'v0.' or 'v1.'."
-        echo "Please, try again."
-        exit 1
-    - uses: actions/checkout@v6
-      with:
-        sparse-checkout: |
-          release
-          .github
-    - name: Prepare release scripts
-      uses: ./.github/actions/prepare-release-scripts
-    - name: Get Release Version
-      uses: actions/github-script@v9
-      id: canonical_version
-      with:
-        script: | # js
-          const { isValidVersionString, getCanonicalVersion, hasBeenReleased } = require('${{ github.workspace }}/release/dist/index.cjs');
-
-          const version = '${{ inputs.version }}';
-
-          if (!isValidVersionString(version)) {
-            throw new Error("The version format is invalid! It must start with either 'v0.' or 'v1.'.");
-          }
-
-          const versions = {
-            ee: getCanonicalVersion(version, 'ee'),
-            oss: getCanonicalVersion(version, 'oss'),
-          };
-
-          const released = await hasBeenReleased({
-            github,
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-            version: versions.oss,
-          });
-
-          if (released) {
-            throw new Error("This version has already been released!", version);
-          }
-
-          return versions;
-
-  check-commit:
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 10
-    steps:
-    - name: Check out the code to verify the release branch
-      uses: actions/checkout@v6
-      with:
-        fetch-depth: 0  # IMPORTANT! to get all the branches
-        sparse-checkout: |
-          release
-          .github
-    - name: Prepare release scripts
-      uses: ./.github/actions/prepare-release-scripts
-    - name: Get Release Branch
-      uses: actions/github-script@v9
-      id: release_branch
-      with:
-        result-encoding: string
-        script: | # js
-          const { getReleaseBranch } = require('${{ github.workspace }}/release/dist/index.cjs');
-          const version = '${{ inputs.version }}';
-          const releaseBranch = getReleaseBranch(version);
-          return releaseBranch;
-    - name: Ensure that the specified commit exists in the ${{ steps.release_branch.outputs.result }} release branch
-      run: | # bash
-        RELEASE_BRANCH=${{ steps.release_branch.outputs.result }}
-        git checkout $RELEASE_BRANCH
-        git branch --contains ${{ inputs.commit }} | grep -q $RELEASE_BRANCH \
-          && echo "Commit found in correct release branch" \
-          || (echo "Commit not found in correct release branch" && exit 1)
-        git checkout -
-
-  get-build-requirements:
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 10
-    outputs:
-      java_version: ${{ fromJson(steps.dependencies.outputs.result).java_version }}
-      node_version: ${{ fromJson(steps.dependencies.outputs.result).node_version }}
-      build_process: ${{ fromJson(steps.dependencies.outputs.result).build_process }}
-    steps:
-    - uses: actions/checkout@v6
-      with:
-        sparse-checkout: |
-          release
-          .github
-    - name: Prepare release scripts
-      uses: ./.github/actions/prepare-release-scripts
-    - name: Get build dependencies
-      uses: actions/github-script@v9
-      id: dependencies
-      with:
-        script: | # js
-          const { getBuildRequirements, getMajorVersion } = require('${{ github.workspace }}/release/dist/index.cjs');
-
-          const version = '${{ inputs.version }}';
-
-          const requirements = getBuildRequirements(version);
-          const build_process = getMajorVersion(version) < 46 ? 'legacy' : 'new';
-          console.log('Build process:', build_process);
-
-          return {
-            java_version: requirements.java,
-            node_version: requirements.node,
-            build_process,
-          };
-
-  manage-milestones:
-    # Close the milestone we're about to ship and open the next one BEFORE building,
-    # so any PRs that merge while the build is in flight are tagged with the next
-    # milestone (not the one about to be released).
-    #
-    # Sequenced after trigger-milestone-check so that the check sees the milestone
-    # in its open state. milestone-check is informational and must never block, so
-    # we run regardless of its outcome; only preflight failures suppress this.
-    needs: [check-version, check-commit, trigger-milestone-check]
-    if: ${{ !cancelled() && needs.check-version.result == 'success' && needs.check-commit.result == 'success' }}
-    permissions:
-      contents: read
-      issues: write
-    uses: ./.github/workflows/release-milestone-manage.yml
-    with:
-      version: ${{ inputs.version }}
-
-  build-uberjar-for-release:
-    needs: [check-version, check-commit, get-build-requirements]
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 50
-    strategy:
-      matrix:
-        edition: [oss, ee]
-    env:
-      INTERACTIVE: false
-    steps:
-    - name: Get correct version number
-      run: | # bash
-        if [ '${{matrix.edition}}' == 'ee' ]; then
-          version='${{ needs.check-version.outputs.ee }}'
-        else
-          version='${{ needs.check-version.outputs.oss }}'
-        fi
-
-        echo "VERSION=$version" >> $GITHUB_ENV
-    - name: Setup Java ${{ needs.get-build-requirements.outputs.java_version }}
-      uses: actions/setup-java@v5.2.0
-      with:
-        distribution: 'temurin'
-        java-version: ${{ needs.get-build-requirements.outputs.java_version }}
-    - name: Setup Node.js ${{ needs.get-build-requirements.outputs.node_version }}
-      uses: actions/setup-node@v6.4.0
-      with:
-        node-version: ${{ needs.get-build-requirements.outputs.node_version }}.x
-    - name: Check out the code
-      uses: actions/checkout@v6
-      with:
-        ref: ${{ github.event.inputs.commit }}
-    - name: Prepare front-end environment
-      uses: ./.github/actions/prepare-frontend
-
-    - name: Prepare back-end environment
-      uses: ./.github/actions/prepare-backend
-
-    - name: Build Metabase
-      if: ${{ needs.get-build-requirements.outputs.build_process != 'legacy' }}
-      run: ./bin/build.sh :edition :${{ matrix.edition }} :version $VERSION
-
-    - name: Build Metabase (legacy)
-      if: ${{ needs.get-build-requirements.outputs.build_process == 'legacy' }}
-      run: cd ./bin/build-mb && clojure -X build/build! :edition :${{ matrix.edition }} :version $VERSION
-
-    - name: Store commit's SHA-1 hash
-      run:  echo ${{ inputs.commit }} > COMMIT-ID
-      shell: bash
-    - run: mv ./target/uberjar/metabase.jar ./metabase.jar
-    - name: Calculate SHA256 checksum
-      run: sha256sum ./metabase.jar > SHA256.sum
-      shell: bash
-    - name: Upload JARs as artifact
-      uses: actions/upload-artifact@v7
-      with:
-        name: metabase-release-${{ matrix.edition }}-${{ inputs.commit }}-uberjar
-        path: |
-          ./metabase.jar
-          ./COMMIT-ID
-          ./SHA256.sum
-
-  run-pre-release-tests:
-    name: Run pre-release tests for ${{ inputs.version }}
-    needs: build-uberjar-for-release
-    uses: ./.github/workflows/pre-release.yml
-    secrets: inherit
-    with:
-      commit: ${{ inputs.commit }}
-      version: ${{ inputs.version }}

.github/workflows/cache-generator.yml

@@ -93,10 +93,10 @@ jobs:
             ":dev:ee:ee-dev:drivers:drivers-dev:test:eastwood"  # backend.yml (eastwood + eastwood/test)
             ":dev:ci:ee:ee-dev:drivers:drivers-dev:test"        # test-driver.yml (ee) -> covers data.json:2.4.0
             ":dev:ci:oss:oss-dev:drivers:drivers-dev:test"      # test-driver.yml (oss)
-            ":dev:ci:test:ee:ee-dev"                            # backend.yml matrix (ee) + generative-query-test.yml
+            ":dev:ci:test:ee:ee-dev"                            # backend.yml matrix (ee)
             ":dev:ci:test:oss:oss-dev"                          # backend.yml matrix (oss)
             ":dev:ci:ee:ee-dev:test:cloverage"                  # backend-cloverage.yml
-            ":dev:drivers:drivers-dev:test"                     # reset-cloud-test-dataset.yml + presto script
+            ":dev:drivers:drivers-dev:test"                     # reset-cloud-test-dataset.yml
             ":dev:drivers:build:build-dev:build-test:ci"        # build-scripts.yml
             ":ee:drivers:check"                                 # backend.yml (check; git dep athos/clj-check)
             ":ee:doc"                                           # docs-generate-base.yml
@@ -135,7 +135,7 @@ jobs:
         run: |
           BUN_CACHE_DIR=$(bun pm cache)
           echo "Bun cache directory: $BUN_CACHE_DIR"
-          echo "dir=$BUN_CACHE_DIR" >> $GITHUB_OUTPUT
+          echo "dir=$BUN_CACHE_DIR" >> "$GITHUB_OUTPUT"
 
       - name: Ensure that Cypress executable is ready
         run: |

.github/workflows/codeql.yml

@@ -1,39 +0,0 @@
-name: "CodeQL"
-
-on:
-  push:
-    branches:
-      - 'master'
-      - 'release-**'
-  pull_request:
-
-jobs:
-  files-changed:
-    name: Check which files changed
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 3
-    outputs:
-      codeql: ${{ steps.changes.outputs.codeql }}
-    steps:
-      - uses: actions/checkout@v6
-      - name: Test which files changed
-        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
-        id: changes
-        with:
-          token: ${{ github.token }}
-          filters: .github/file-paths.yaml
-  analyze:
-    needs: files-changed
-    if: needs.files-changed.outputs.codeql == 'true'
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v6
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4
-      with:
-        languages: javascript
-        config-file: ./.github/codeql/codeql-config.yml
-        trap-caching: false
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4

.github/workflows/codespell.yml

@@ -27,7 +27,7 @@ jobs:
 
       - name: Get current date
         id: date
-        run: echo "date=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT
+        run: echo "date=$(date +'%Y-%m-%d')" >> "$GITHUB_OUTPUT"
 
       - name: Run codespell check
         id: codespell_check

.github/workflows/containerize-jar.yml

@@ -16,8 +16,8 @@ on:
       commit:
         type: string
       release:
-        type: string
-        default: 'false'
+        type: boolean
+        default: false
       build-args:
         type: string
   workflow_dispatch:
@@ -40,11 +40,8 @@ on:
         type: string
       release:
         description: Whether this is a release artifact (uses metabase-release- prefix)
-        type: choice
-        options:
-          - "false"
-          - "true"
-        default: "false"
+        type: boolean
+        default: false
 
 jobs:
   containerize:
@@ -88,8 +85,8 @@ jobs:
     - name: Login to Docker Hub
       uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
       with:
-        username: ${{ inputs.release == 'true' && secrets.DOCKERHUB_RELEASE_USERNAME || secrets.DOCKERHUB_USERNAME }}
-        password: ${{ inputs.release == 'true' && secrets.DOCKERHUB_RELEASE_TOKEN || secrets.DOCKERHUB_TOKEN }}
+        username: ${{ inputs.release && secrets.DOCKERHUB_RELEASE_USERNAME || secrets.DOCKERHUB_USERNAME }}
+        password: ${{ inputs.release && secrets.DOCKERHUB_RELEASE_TOKEN || secrets.DOCKERHUB_TOKEN }}
     - name: Set up QEMU
       if: contains(steps.platforms.outputs.result, 'arm')
       uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
@@ -126,8 +123,8 @@ jobs:
     - name: Login to Docker Hub
       uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
       with:
-        username: ${{ inputs.release == 'true' && secrets.DOCKERHUB_RELEASE_USERNAME || secrets.DOCKERHUB_USERNAME }}
-        password: ${{ inputs.release == 'true' && secrets.DOCKERHUB_RELEASE_TOKEN || secrets.DOCKERHUB_TOKEN }}
+        username: ${{ inputs.release && secrets.DOCKERHUB_RELEASE_USERNAME || secrets.DOCKERHUB_USERNAME }}
+        password: ${{ inputs.release && secrets.DOCKERHUB_RELEASE_TOKEN || secrets.DOCKERHUB_TOKEN }}
     - name: Pull the container image
       run: docker pull ${{ inputs.repo }}:${{ inputs.tag }}
     - name: Launch container
@@ -146,8 +143,8 @@ jobs:
     - name: Login to Docker Hub
       uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
       with:
-        username: ${{ inputs.release == 'true' && secrets.DOCKERHUB_RELEASE_USERNAME || secrets.DOCKERHUB_USERNAME }}
-        password: ${{ inputs.release == 'true' && secrets.DOCKERHUB_RELEASE_TOKEN || secrets.DOCKERHUB_TOKEN }}
+        username: ${{ inputs.release && secrets.DOCKERHUB_RELEASE_USERNAME || secrets.DOCKERHUB_USERNAME }}
+        password: ${{ inputs.release && secrets.DOCKERHUB_RELEASE_TOKEN || secrets.DOCKERHUB_TOKEN }}
     - name: Pull the container image
       run: docker pull ${{ inputs.repo }}:${{ inputs.tag }}
     - name: Launch container

.github/workflows/containerize-uberjar.yml

@@ -3,6 +3,10 @@ name: Containerize Uberjar
 on:
   workflow_call:
   workflow_dispatch:
+    inputs:
+      commit:
+        description: the full commit hash to containerize (defaults to the triggering commit)
+        type: string
 
 jobs:
   get-container-info:
@@ -59,7 +63,7 @@ jobs:
       commit: ${{ github.event.inputs.commit || github.event.pull_request.head.sha || github.sha }}
       repo: ${{ fromJson(needs.get-container-info.outputs[matrix.edition]).repo }}
       tag: ${{ fromJson(needs.get-container-info.outputs[matrix.edition]).tag }}
-      release: "false"
+      release: false
       build-args: |
         GIT_COMMIT_SHA=${{ github.event.inputs.commit || github.event.pull_request.head.sha || github.sha }}
 

.github/workflows/cross-branch-migrations.yml

@@ -103,6 +103,8 @@ jobs:
     services:
       mysql:
         image: mysql:8.0
+        # disposable CI database: a RAM-backed datadir makes migration fsyncs free
+        options: --tmpfs /var/lib/mysql:rw
         ports:
           - "3306:3306"
         env:
@@ -129,6 +131,8 @@ jobs:
     services:
       mysql:
         image: mysql:9
+        # disposable CI database: a RAM-backed datadir makes migration fsyncs free
+        options: --tmpfs /var/lib/mysql:rw
         env:
           MYSQL_ALLOW_EMPTY_PASSWORD: true
           MYSQL_DATABASE: mb_test
@@ -183,6 +187,8 @@ jobs:
     services:
       mariadb:
         image: metabase/mariadb:10.6 # https://github.com/metabase/metabase-mariadb-docker-image
+        # disposable CI database: a RAM-backed datadir makes migration fsyncs free
+        options: --tmpfs /var/lib/mysql:rw
         ports:
           - "3306:3306"
         env:
@@ -208,6 +214,8 @@ jobs:
     services:
       mariadb:
         image: mariadb:latest
+        # disposable CI database: a RAM-backed datadir makes migration fsyncs free
+        options: --tmpfs /var/lib/mysql:rw
         ports:
           - "3306:3306"
         env:

.github/workflows/disabled-drivers-slack-notification.yml

@@ -34,18 +34,18 @@ jobs:
             const lastUpdated = config.metadata?.last_updated || 'unknown';
             const reason = config.metadata?.reason || 'No reason provided';
 
+            // "skip" is the only status CI reads: the driver is not run at all. A driver that
+            // runs but must not gate is expressed as a suite-level rule in CI Conductor, which
+            // reports it in its own UI.
             const skipped = drivers.filter(d => d.status === 'skip').map(d => d.name);
-            const info = drivers.filter(d => d.status === 'info').map(d => d.name);
 
-            if (skipped.length === 0 && info.length === 0) {
-              console.log('No drivers are disabled or collecting data. Skipping Slack notification.');
+            if (skipped.length === 0) {
+              console.log('No drivers are disabled. Skipping Slack notification.');
               return;
             }
 
             const list = (names) => names.map(d => `\`${d}\``).join('  ');
-            const lines = [];
-            if (skipped.length) lines.push(`:no_entry: *Disabled (not run):* ${list(skipped)}`);
-            if (info.length) lines.push(`:information_source: *Collecting data (non-blocking):* ${list(info)}`);
+            const lines = [`:no_entry: *Disabled (not run):* ${list(skipped)}`];
 
             if (!process.env.SLACK_BOT_TOKEN) {
               throw new Error('SLACK_BOT_TOKEN is required');

.github/workflows/docs-generate-base.yml

@@ -79,10 +79,10 @@ jobs:
         id: check_changes
         run: |
           if git diff --quiet docs/; then
-            echo "changes=false" >> $GITHUB_OUTPUT
+            echo "changes=false" >> "$GITHUB_OUTPUT"
             echo "No changes detected in docs directory"
           else
-            echo "changes=true" >> $GITHUB_OUTPUT
+            echo "changes=true" >> "$GITHUB_OUTPUT"
             echo "Changes detected in docs directory"
           fi
 
@@ -109,7 +109,7 @@ jobs:
           git commit -m "Update generated docs (${{ inputs.target_branch }})" --no-verify
           git push -u origin "$BRANCH_NAME"
 
-          echo "branch_name=$BRANCH_NAME" >> $GITHUB_OUTPUT
+          echo "branch_name=$BRANCH_NAME" >> "$GITHUB_OUTPUT"
           echo "Successfully created and pushed branch"
 
       - name: Create pull request
@@ -155,7 +155,7 @@ jobs:
               break
             else
               echo "PR creation failed on attempt $i"
-              if [ $i -eq 3 ]; then
+              if [ "$i" -eq 3 ]; then
                 echo "All attempts failed. Exiting with error."
                 exit 1
               fi
@@ -172,22 +172,24 @@ jobs:
       - name: Workflow summary
         if: always()
         run: |
-          if [ "${{ steps.check_changes.outputs.changes }}" == "true" ]; then
-            if [ "${{ steps.commit_and_push.outcome }}" == "success" ]; then
-              if [ "${{ steps.create_pr.outcome }}" == "success" ]; then
-                echo "## ✅ Documentation Updated Successfully" >> $GITHUB_STEP_SUMMARY
-                echo "- Branch: \`${{ steps.commit_and_push.outputs.branch_name }}\`" >> $GITHUB_STEP_SUMMARY
-                echo "- PR created targeting **${{ inputs.target_branch }}**" >> $GITHUB_STEP_SUMMARY
+          {
+            if [ "${{ steps.check_changes.outputs.changes }}" == "true" ]; then
+              if [ "${{ steps.commit_and_push.outcome }}" == "success" ]; then
+                if [ "${{ steps.create_pr.outcome }}" == "success" ]; then
+                  echo "## ✅ Documentation Updated Successfully"
+                  echo "- Branch: \`${{ steps.commit_and_push.outputs.branch_name }}\`"
+                  echo "- PR created targeting **${{ inputs.target_branch }}**"
+                else
+                  echo "## ⚠️ Branch Created but PR Failed"
+                  echo "- Branch: \`${{ steps.commit_and_push.outputs.branch_name }}\`"
+                  echo "- Manual PR creation required"
+                fi
               else
-                echo "## ⚠️ Branch Created but PR Failed" >> $GITHUB_STEP_SUMMARY
-                echo "- Branch: \`${{ steps.commit_and_push.outputs.branch_name }}\`" >> $GITHUB_STEP_SUMMARY
-                echo "- Manual PR creation required" >> $GITHUB_STEP_SUMMARY
+                echo "## ❌ Failed to Create Branch"
+                echo "- Check workflow logs for details"
               fi
             else
-              echo "## ❌ Failed to Create Branch" >> $GITHUB_STEP_SUMMARY
-              echo "- Check workflow logs for details" >> $GITHUB_STEP_SUMMARY
+              echo "## ℹ️ No Changes Detected"
+              echo "- Documentation is up to date on **${{ inputs.target_branch }}**"
             fi
-          else
-            echo "## ℹ️ No Changes Detected" >> $GITHUB_STEP_SUMMARY
-            echo "- Documentation is up to date on **${{ inputs.target_branch }}**" >> $GITHUB_STEP_SUMMARY
-          fi
+          } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/docs-links.yml

@@ -27,7 +27,7 @@ jobs:
 
       - name: Run link checker
         id: link-check
-        uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2.8.0
+        uses: lycheeverse/lychee-action@e7477775783ea5526144ba13e8db5eec57747ce8 # v2.9.0
         with:
           fail: true
           args: docs --config ./.lychee/config.toml --offline

.github/workflows/drivers-stress-test.yml

@@ -69,6 +69,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-athena-ee'
+        granular-rerun: 'false'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-bigquery-cloud-sdk-ee:
@@ -91,6 +92,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-bigquery-cloud-sdk-ee'
+        granular-rerun: 'false'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-druid-ee:
@@ -113,6 +115,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-druid-ee'
+        granular-rerun: 'false'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-mariadb-10-6-ee:
@@ -142,6 +145,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-mariadb-10-6-ee'
+        granular-rerun: 'false'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-mariadb-latest-ee:
@@ -171,6 +175,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-mariadb-latest-ee'
+        granular-rerun: 'false'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-mongo-4-4-ee:
@@ -193,6 +198,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-mongo-4-4-ee'
+        granular-rerun: 'false'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-mongo-4-4-ssl-ee:
@@ -227,6 +233,7 @@ jobs:
         uses: ./.github/actions/test-driver
         with:
           junit-name: 'be-tests-mongo-4-4-ee'
+          granular-rerun: 'false'
           test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-mongo-5-0-ee:
@@ -249,6 +256,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-mongo-5-0-ee'
+        granular-rerun: 'false'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-mongo-5-0-ssl-ee:
@@ -283,6 +291,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-mongo-5-0-ee'
+        granular-rerun: 'false'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-mongo-latest-ee:
@@ -308,6 +317,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-mongo-latest-ee'
+        granular-rerun: 'false'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-mysql-8-0-ee:
@@ -337,6 +347,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-mysql-8-0-ee'
+        granular-rerun: 'false'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-mysql-9-ee:
@@ -366,6 +377,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-mysql-9-ee'
+        granular-rerun: 'false'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-mysql-latest-ee:
@@ -404,6 +416,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-mysql-latest-ee'
+        granular-rerun: 'false'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-oracle-18-4-ee:
@@ -430,6 +443,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-oracle-18-4-ee'
+        granular-rerun: 'false'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-oracle-21-3-ee:
@@ -465,6 +479,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-oracle-21-3-ee'
+        granular-rerun: 'false'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-postgres-ee:
@@ -495,6 +510,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-postgres-ee'
+        granular-rerun: 'false'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-postgres-latest-ee:
@@ -528,6 +544,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-postgres-latest-ee'
+        granular-rerun: 'false'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-presto-jdbc-ee:
@@ -558,7 +575,7 @@ jobs:
       run: while ! nc -z localhost ${{ env.MB_PRESTO_JDBC_TEST_PORT }}; do sleep 0.1; done
       timeout-minutes: 15
     - name: Create temp cacerts file based on bundled JDK one
-      run: cp $JAVA_HOME/lib/security/cacerts /tmp/cacerts-with-presto-ssl.jks
+      run: cp "$JAVA_HOME/lib/security/cacerts" /tmp/cacerts-with-presto-ssl.jks
     - name: Capture Presto server self signed CA
       run: |
           while [[ ! -s /tmp/presto-ssl-ca.pem ]];
@@ -577,6 +594,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-presto-jdbc-ee'
+        granular-rerun: 'false'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-redshift-ee:
@@ -596,6 +614,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-redshift-ee'
+        granular-rerun: 'false'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-snowflake-ee:
@@ -627,6 +646,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-snowflake-ee'
+        granular-rerun: 'false'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-sparksql-ee:
@@ -647,6 +667,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-sparksql-ee'
+        granular-rerun: 'false'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-sqlite-ee:
@@ -662,6 +683,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-sqlite-ee'
+        granular-rerun: 'false'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-sqlserver-2017-ee:
@@ -689,6 +711,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-sqlserver-ee'
+        granular-rerun: 'false'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-sqlserver-2022-ee:
@@ -716,6 +739,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-sqlserver-2022-ee'
+        granular-rerun: 'false'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-starburst-ee:
@@ -741,6 +765,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-starburst-ee'
+        granular-rerun: 'false'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   login-to-ecr:
@@ -764,9 +789,11 @@ jobs:
 
         REGISTRY="$(aws sts get-caller-identity --query Account --output text).dkr.ecr.us-east-1.amazonaws.com"
 
-        echo "docker_username=AWS" >> $GITHUB_OUTPUT
-        echo "docker_password=$PASSWORD" >> $GITHUB_OUTPUT
-        echo "registry=$REGISTRY" >> $GITHUB_OUTPUT
+        {
+          echo "docker_username=AWS"
+          echo "docker_password=$PASSWORD"
+          echo "registry=$REGISTRY"
+        } >> "$GITHUB_OUTPUT"
     outputs:
       registry: ${{ steps.login-ecr.outputs.registry }}
       docker_username: ${{ steps.login-ecr.outputs.docker_username }}
@@ -796,4 +823,5 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-vertica-ee'
+        granular-rerun: 'false'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"

.github/workflows/drivers.yml

@@ -45,26 +45,6 @@ jobs:
       sqlite-should-run: ${{ steps.driver-decisions.outputs.sqlite-should-run }}
       sqlserver-should-run: ${{ steps.driver-decisions.outputs.sqlserver-should-run }}
       vertica-should-run: ${{ steps.driver-decisions.outputs.vertica-should-run }}
-      # Per-driver configured status from ci-test-config (skip | info | required)
-      h2-status: ${{ steps.driver-decisions.outputs.h2-status }}
-      athena-status: ${{ steps.driver-decisions.outputs.athena-status }}
-      bigquery-status: ${{ steps.driver-decisions.outputs.bigquery-status }}
-      clickhouse-status: ${{ steps.driver-decisions.outputs.clickhouse-status }}
-      databricks-status: ${{ steps.driver-decisions.outputs.databricks-status }}
-      druid-jdbc-status: ${{ steps.driver-decisions.outputs.druid-jdbc-status }}
-      mongo-status: ${{ steps.driver-decisions.outputs.mongo-status }}
-      mongo-ssl-status: ${{ steps.driver-decisions.outputs.mongo-ssl-status }}
-      mongo-sharded-cluster-status: ${{ steps.driver-decisions.outputs.mongo-sharded-cluster-status }}
-      mysql-mariadb-status: ${{ steps.driver-decisions.outputs.mysql-mariadb-status }}
-      oracle-status: ${{ steps.driver-decisions.outputs.oracle-status }}
-      postgres-status: ${{ steps.driver-decisions.outputs.postgres-status }}
-      presto-jdbc-status: ${{ steps.driver-decisions.outputs.presto-jdbc-status }}
-      redshift-status: ${{ steps.driver-decisions.outputs.redshift-status }}
-      snowflake-status: ${{ steps.driver-decisions.outputs.snowflake-status }}
-      sparksql-status: ${{ steps.driver-decisions.outputs.sparksql-status }}
-      sqlite-status: ${{ steps.driver-decisions.outputs.sqlite-status }}
-      sqlserver-status: ${{ steps.driver-decisions.outputs.sqlserver-status }}
-      vertica-status: ${{ steps.driver-decisions.outputs.vertica-status }}
       # Per-driver quarantine conflict flags (set when driver is quarantined but has file changes)
       athena-quarantine-conflict: ${{ steps.driver-decisions.outputs.athena-quarantine-conflict }}
       bigquery-quarantine-conflict: ${{ steps.driver-decisions.outputs.bigquery-quarantine-conflict }}
@@ -86,28 +66,6 @@ jobs:
       sqlserver-quarantine-conflict: ${{ steps.driver-decisions.outputs.sqlserver-quarantine-conflict }}
       vertica-quarantine-conflict: ${{ steps.driver-decisions.outputs.vertica-quarantine-conflict }}
     steps:
-      # Up front (before any driver job), drop info-driver comments from older commits so a
-      # superseded comment disappears immediately rather than waiting for this run's drivers.
-      # Keeps this commit's comment (if any) so a re-run doesn't flicker.
-      - name: Remove stale info-driver comments
-        if: ${{ github.event_name == 'pull_request' }}
-        uses: actions/github-script@v9
-        continue-on-error: true
-        with:
-          script: | # js
-            const pr = context.payload.pull_request;
-            if (!pr) return;
-            const { owner, repo } = context.repo;
-            const PREFIX = "<!-- info-driver-result";
-            const keep = `<!-- info-driver-results:${pr.head.sha} -->`;
-            const { data: comments } = await github.rest.issues.listComments({
-              owner, repo, issue_number: pr.number, per_page: 100,
-            });
-            for (const c of comments) {
-              if (c.body.includes(PREFIX) && !c.body.includes(keep)) {
-                await github.rest.issues.deleteComment({ owner, repo, comment_id: c.id }).catch(() => {});
-              }
-            }
       - name: Checkout repository
         uses: actions/checkout@v6
       - name: Fetch base branch
@@ -180,20 +138,6 @@ jobs:
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
         quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.athena-status }}
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
-        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.athena-status }}
-        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-bigquery-cloud-sdk-ee:
     needs: determine-driver-skips
@@ -256,23 +200,8 @@ jobs:
       with:
         junit-name: 'be-tests-bigquery-cloud-sdk-ee'
         test-args: ${{ matrix.job.test-args }}
-        logs-artifact-suffix: ${{ matrix.job.name }}
+        artifact-suffix: ${{ matrix.job.name }}
         quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.bigquery-status }}
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
-        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.bigquery-status }}
-        report-variant: ${{ matrix.job.name }}
-        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -344,22 +273,8 @@ jobs:
       with:
         junit-name: 'be-tests-clickhouse-ee'
         test-args: ${{ matrix.job.test-args }}
-        logs-artifact-suffix: ${{ matrix.job.name }}
+        artifact-suffix: ${{ matrix.job.name }}
         quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.clickhouse-status }}
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
-        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.clickhouse-status }}
-        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -404,20 +319,6 @@ jobs:
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
         quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.druid-jdbc-status }}
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
-        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.druid-jdbc-status }}
-        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-databricks-ee:
     needs: determine-driver-skips
@@ -477,23 +378,9 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-databricks-ee'
+        artifact-suffix: ${{ matrix.job.name }}
         test-args: ${{ matrix.job.test-args }}
         quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.databricks-status }}
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
-        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.databricks-status }}
-        report-variant: ${{ matrix.job.name }}
-        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-databricks-multi-catalog-ee:
     needs: determine-driver-skips
@@ -554,23 +441,9 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-databricks-multi-catalog-ee'
+        artifact-suffix: ${{ matrix.job.name }}
         test-args: ${{ matrix.job.test-args }}
         quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.databricks-status }}
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
-        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.databricks-status }}
-        report-variant: ${{ matrix.job.name }}
-        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-h2:
     needs: determine-driver-skips
@@ -591,20 +464,6 @@ jobs:
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
         quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.h2-status }}
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
-        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.h2-status }}
-        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-h2-oss:
     needs: determine-driver-skips
@@ -626,20 +485,6 @@ jobs:
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
         quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.h2-status }}
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
-        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.h2-status }}
-        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-mysql-mariadb:
     needs: determine-driver-skips
@@ -696,6 +541,8 @@ jobs:
     services:
       mysql:
         image: ${{ matrix.version.image }}
+        # disposable CI database: a RAM-backed datadir makes DDL/insert fsyncs free
+        options: --tmpfs /var/lib/mysql:rw
         ports:
           - "3306:3306"
         env:
@@ -764,25 +611,11 @@ jobs:
         uses: ./.github/actions/test-driver
         with:
           junit-name: ${{ matrix.version.junit-name }}
-          logs-artifact-suffix: ${{ matrix.version.name }}
+          artifact-suffix: ${{ matrix.version.name }}-${{ matrix.job.name }}
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[ ${{ matrix.job.exclude-tag }} ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
           quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-          driver-status: ${{ needs.determine-driver-skips.outputs.mysql-mariadb-status }}
-      - name: Upload Test Results
-        uses: ./.github/actions/upload-test-results
-        if: always()
-        with:
-          input-path: ./target/junit/
-          output-name: ${{ github.job }}
-          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-          aws-region: ${{ vars.AWS_REGION }}
-          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-          driver-status: ${{ needs.determine-driver-skips.outputs.mysql-mariadb-status }}
-          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
       - name: Cleanup python-runner
         if: always()
         uses: ./.github/actions/cleanup-python-runner
@@ -851,22 +684,8 @@ jobs:
       with:
         junit-name: ${{ matrix.version.junit-name }}
         test-args: ${{ matrix.job.test-args }}
-        logs-artifact-suffix: ${{ matrix.job.name }}
+        artifact-suffix: ${{ matrix.version.name }}-${{ matrix.job.name }}
         quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.mongo-status }}
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
-        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.mongo-status }}
-        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -939,20 +758,6 @@ jobs:
             :exclude-tags '[:mongo-sharded-cluster-tests :mb/transforms-python-test]'
             :only-tags [:mb/driver-tests]
           quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-          driver-status: ${{ needs.determine-driver-skips.outputs.mongo-ssl-status }}
-      - name: Upload Test Results
-        uses: ./.github/actions/upload-test-results
-        if: always()
-        with:
-          input-path: ./target/junit/
-          output-name: ${{ github.job }}
-          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-          aws-region: ${{ vars.AWS_REGION }}
-          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-          driver-status: ${{ needs.determine-driver-skips.outputs.mongo-ssl-status }}
-          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-mongo-sharded-cluster-ee:
     needs: determine-driver-skips
@@ -988,20 +793,6 @@ jobs:
         test-args: >-
           :only metabase.driver.mongo.sharded-cluster-test
         quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.mongo-sharded-cluster-status }}
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
-        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.mongo-sharded-cluster-status }}
-        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-oracle:
     needs: determine-driver-skips
@@ -1072,25 +863,11 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: ${{ matrix.version.junit-name }}
-        logs-artifact-suffix: ${{ matrix.version.name }}
+        artifact-suffix: ${{ matrix.version.name }}
         test-args: >-
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
         quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.oracle-status }}
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
-        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.oracle-status }}
-        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-postgres:
     needs: determine-driver-skips
@@ -1180,26 +957,11 @@ jobs:
         uses: ./.github/actions/test-driver
         with:
           junit-name: 'be-tests-${{ matrix.version.junit-name }}'
-          logs-artifact-suffix: ${{ matrix.version.name }}-${{ matrix.job.name }}
+          artifact-suffix: ${{ matrix.version.name }}-${{ matrix.job.name }}
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[ ${{ matrix.job.exclude-tag }} ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
           quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-          driver-status: ${{ needs.determine-driver-skips.outputs.postgres-status }}
-      - name: Upload Test Results
-        uses: ./.github/actions/upload-test-results
-        if: always()
-        with:
-          input-path: ./target/junit/
-          output-name: ${{ github.job }}
-          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-          aws-region: ${{ vars.AWS_REGION }}
-          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-          driver-status: ${{ needs.determine-driver-skips.outputs.postgres-status }}
-          report-variant: ${{ matrix.version.name }}-${{ matrix.job.name }}
-          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
       - name: Cleanup python-runner
         if: always()
         uses: ./.github/actions/cleanup-python-runner
@@ -1277,20 +1039,6 @@ jobs:
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
         quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.presto-jdbc-status }}
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
-        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.presto-jdbc-status }}
-        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-redshift-ee:
     needs: determine-driver-skips
@@ -1363,23 +1111,8 @@ jobs:
         junit-name: 'be-tests-redshift-ee'
         test-args: >-
           ${{ matrix.job.test-args }}
-        logs-artifact-suffix: ${{ matrix.job.name }}
+        artifact-suffix: ${{ matrix.job.name }}
         quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.redshift-status }}
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: ${{ !matrix.job.skip && !cancelled() }}
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
-        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.redshift-status }}
-        report-variant: ${{ matrix.job.name }}
-        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -1451,23 +1184,8 @@ jobs:
       with:
         junit-name: 'be-tests-snowflake-ee'
         test-args: ${{ matrix.job.test-args }}
-        logs-artifact-suffix: ${{ matrix.job.name }}
+        artifact-suffix: ${{ matrix.job.name }}
         quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.snowflake-status }}
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
-        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.snowflake-status }}
-        report-variant: ${{ matrix.job.name }}
-        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -1510,20 +1228,6 @@ jobs:
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
         quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.sparksql-status }}
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
-        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.sparksql-status }}
-        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-sqlite-ee:
     needs: determine-driver-skips
@@ -1555,20 +1259,6 @@ jobs:
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
         quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.sqlite-status }}
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
-        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.sqlite-status }}
-        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-sqlserver:
     needs: determine-driver-skips
@@ -1633,22 +1323,8 @@ jobs:
       with:
         junit-name: ${{ matrix.version.junit-name }}
         test-args: ${{ matrix.job.test-args }}
-        logs-artifact-suffix: ${{ matrix.version.name }}
+        artifact-suffix: ${{ matrix.version.name }}-${{ matrix.job.name }}
         quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.sqlserver-status }}
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
-        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.sqlserver-status }}
-        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -1683,16 +1359,6 @@ jobs:
   #       junit-name: 'be-tests-starburst-ee'
   #       test-args: >-
   #         :only-tags [:mb/driver-tests]
-  #   - name: Upload Test Results
-  #     uses: ./.github/actions/upload-test-results
-  #     if: always()
-  #     with:
-  #       input-path: ./target/junit/
-  #       output-name: ${{ github.job }}
-  #       bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-  #       role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-  #       aws-region: ${{ vars.AWS_REGION }}
-  #       trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
   login-to-ecr:
     needs: determine-driver-skips
@@ -1766,34 +1432,13 @@ jobs:
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
         quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.vertica-status }}
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
-        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.vertica-status }}
-        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   drivers-tests-result:
     needs:
-      # Supplies each driver's configured status (info/skip/required) so this gate can ignore
-      # "info" drivers regardless of their result -- including cancelled or timed-out runs, which
-      # the per-job continue-on-error cannot force green because the controlling step never
-      # completes. Not a driver job; it is filtered out of the pass/fail check below.
       - determine-driver-skips
       # if you add a driver job, you must add it to this list for it to be a required check
       - be-tests-h2
       - be-tests-athena-ee
-      # Listed unconditionally; ci-test-config controls their effect via per-driver status.
-      # An "info" driver is reported as passing, so it never blocks this check; flip it to
-      # "required" in the config to make a real failure gate, with no change here.
       - be-tests-snowflake-ee
       - be-tests-bigquery-cloud-sdk-ee
       - be-tests-databricks-ee
@@ -1822,46 +1467,18 @@ jobs:
         uses: actions/github-script@v9
         env:
           needs: ${{ toJson(needs) }}
-          # Job name -> configured driver status, from determine-driver-skips. An "info" driver is
-          # data-collection only and must never gate; a cancelled/timed-out info job lands here as
-          # cancelled/failure (its own continue-on-error can't force it green), so we drop info jobs
-          # from the gate entirely. Empty/unknown status falls back to "required" (gates as before).
-          statuses: |
-            {
-              "be-tests-athena-ee": "${{ needs.determine-driver-skips.outputs.athena-status }}",
-              "be-tests-bigquery-cloud-sdk-ee": "${{ needs.determine-driver-skips.outputs.bigquery-status }}",
-              "be-tests-clickhouse-ee": "${{ needs.determine-driver-skips.outputs.clickhouse-status }}",
-              "be-tests-databricks-ee": "${{ needs.determine-driver-skips.outputs.databricks-status }}",
-              "be-tests-druid-jdbc-ee": "${{ needs.determine-driver-skips.outputs.druid-jdbc-status }}",
-              "be-tests-h2": "${{ needs.determine-driver-skips.outputs.h2-status }}",
-              "be-tests-mongo": "${{ needs.determine-driver-skips.outputs.mongo-status }}",
-              "be-tests-mongo-ssl": "${{ needs.determine-driver-skips.outputs.mongo-ssl-status }}",
-              "be-tests-mongo-sharded-cluster-ee": "${{ needs.determine-driver-skips.outputs.mongo-sharded-cluster-status }}",
-              "be-tests-mysql-mariadb": "${{ needs.determine-driver-skips.outputs.mysql-mariadb-status }}",
-              "be-tests-oracle": "${{ needs.determine-driver-skips.outputs.oracle-status }}",
-              "be-tests-postgres": "${{ needs.determine-driver-skips.outputs.postgres-status }}",
-              "be-tests-presto-jdbc-ee": "${{ needs.determine-driver-skips.outputs.presto-jdbc-status }}",
-              "be-tests-redshift-ee": "${{ needs.determine-driver-skips.outputs.redshift-status }}",
-              "be-tests-snowflake-ee": "${{ needs.determine-driver-skips.outputs.snowflake-status }}",
-              "be-tests-sparksql-ee": "${{ needs.determine-driver-skips.outputs.sparksql-status }}",
-              "be-tests-sqlite-ee": "${{ needs.determine-driver-skips.outputs.sqlite-status }}",
-              "be-tests-sqlserver": "${{ needs.determine-driver-skips.outputs.sqlserver-status }}"
-            }
         with:
           script: | # js
             const needs = JSON.parse(process.env.needs);
-            const statuses = JSON.parse(process.env.statuses);
 
-            // Drop the determine-driver-skips bookkeeping job, then drop "info" drivers: they are
-            // non-gating, so their result (including cancelled/timed-out) must not fail this check.
+            // Drop the determine-driver-skips bookkeeping job; every remaining job is a driver
+            // job whose result gates this check.
             const jobs = Object.entries(needs)
               .filter(([jobName]) => jobName !== 'determine-driver-skips')
               .map(([jobName, jobValues]) => ({
                 name: jobName,
-                result: jobValues.result,
-                status: statuses[jobName] || 'required'
-              }))
-              .filter(job => job.status !== 'info');
+                result: jobValues.result
+              }));
 
             // are all jobs skipped or successful?
             if (jobs.every(job => (job.result === 'skipped' || job.result === 'success'))) {

.github/workflows/e2e-coverage-manifest.yml

@@ -48,6 +48,18 @@ jobs:
           name: instrumented-uberjar
           path: target/uberjar/metabase.jar
           retention-days: 1
+      # Regenerate the OpenAPI spec from this SHA's defendpoint definitions so
+      # route normalization in the merge job matches against the endpoints
+      # that actually served this run, not the checked-in file (which is only
+      # refreshed by the label-gated openapi-check workflow and drifts).
+      - name: Generate OpenAPI route table
+        run: bun run generate-openapi
+      - name: Upload OpenAPI route table
+        uses: actions/upload-artifact@v7
+        with:
+          name: openapi-spec
+          path: resources/openapi/openapi.json
+          retention-days: 1
 
   # Fixed-N sharding — coverage doesn't need the PR matrix-builder's tag/edition
   # groups, just an even split of the regular spec set. The shard count lives in
@@ -130,6 +142,15 @@ jobs:
       - name: Unzip previous manifest
         if: steps.prev.outputs.found == 'true'
         run: unzip -o prev-manifest.zip -d prev-manifest
+      # Overwrites the checked-out resources/openapi/openapi.json with the one
+      # generated from this run's SHA. If the artifact is somehow missing, the
+      # checked-in file is still there and the builder falls back to it.
+      - name: Download OpenAPI route table
+        continue-on-error: true
+        uses: actions/download-artifact@v8
+        with:
+          name: openapi-spec
+          path: resources/openapi
       # GITHUB_SHA (the master commit this nightly built from) is stamped into
       # the manifest as `builtAt`, so a PR can later pick the manifest closest
       # to its own point in history. See resolve-coverage-manifest.mjs.
@@ -137,9 +158,25 @@ jobs:
         env:
           PREV_MANIFEST: ${{ steps.prev.outputs.found == 'true' && 'prev-manifest/spec-file-manifest.json' || '' }}
         run: node e2e/coverage/build-coverage-manifest.mjs
-      - name: Upload manifest
+      # Manifest routes are stored table-independent; consumers match them
+      # against an endpoint spec at selection time. Ship this run's generated
+      # spec alongside so they can choose it over their checkout's copy.
+      # Copied into e2e/coverage so the artifact stays flat — the backfill
+      # step expects the manifests at the archive root.
+      - name: Include OpenAPI spec in artifact
+        run: |
+          if [ -f resources/openapi/openapi.json ]; then
+            cp resources/openapi/openapi.json e2e/coverage/openapi.json
+          fi
+      # All files share one artifact so the per-test manifest always travels
+      # with the spec manifest it was built from (backfill and PR-side
+      # resolution read them as siblings).
+      - name: Upload manifests
         uses: actions/upload-artifact@v7
         with:
           name: spec-file-manifest
-          path: e2e/coverage/spec-file-manifest.json
+          path: |
+            e2e/coverage/spec-file-manifest.json
+            e2e/coverage/spec-test-manifest.json
+            e2e/coverage/openapi.json
           retention-days: 30

.github/workflows/e2e-coverage-shard.yml

@@ -3,7 +3,7 @@ name: E2E Coverage Shard
 # Reusable per-shard worker for the coverage manifest run. Trimmed extract of
 # e2e-test.yml: runs one cypress-split shard against an instrumented build and
 # uploads that shard's per-spec coverage. Intentionally omits the PR-only
-# concerns (failed-spec retry, Trunk quarantine, S3 result upload, timing
+# concerns (failed-spec retry, quarantine, S3 result upload, timing
 # output) since this is a nightly, non-blocking job.
 
 on:

.github/workflows/e2e-matrix-builder.yml

@@ -4,7 +4,7 @@ on:
   workflow_call:
     inputs:
       chunks:
-        required: true
+        required: false
         type: number
         default: 30
       specs:

.github/workflows/e2e-stress-test-flake-fix.yml

@@ -98,9 +98,9 @@ jobs:
         run: |
           SPEC='${{ inputs.spec }}'
           if [[ "$SPEC" == e2e/test-component/scenarios/embedding-sdk/* ]]; then
-            echo "type=component" >> $GITHUB_OUTPUT
+            echo "type=component" >> "$GITHUB_OUTPUT"
           else
-            echo "type=e2e" >> $GITHUB_OUTPUT
+            echo "type=e2e" >> "$GITHUB_OUTPUT"
           fi
 
   workflow-summary:
@@ -110,20 +110,33 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Generate workflow summary
+        env:
+          BRANCH: ${{ github.ref_name }}
+          SPEC: ${{ inputs.spec }}
+          TEST_TYPE: ${{ needs.determine-test-type.outputs.type }}
+          BURN_IN: ${{ inputs.burn_in }}
+          GREP: ${{ inputs.grep }}
+          QA_DB: ${{ inputs.qa_db }}
+          ENABLE_NETWORK_THROTTLING: ${{ inputs.enable_network_throttling }}
+          FAIL_FAST: ${{ inputs.fail_fast }}
+          BUILD_JAR: ${{ inputs.build_jar }}
+          SENDER: ${{ github.event.sender.login }}
         run: |
-          echo '**Inputs:**' >> $GITHUB_STEP_SUMMARY
-          echo '' >> $GITHUB_STEP_SUMMARY
-          echo '- `branch`: ${{ github.ref_name }}' >> $GITHUB_STEP_SUMMARY
-          echo '- `spec`: ${{ inputs.spec }}' >> $GITHUB_STEP_SUMMARY
-          echo '- `test_type` (inferred): ${{ needs.determine-test-type.outputs.type }}' >> $GITHUB_STEP_SUMMARY
-          echo '- `burn_in`: ${{ inputs.burn_in }}' >> $GITHUB_STEP_SUMMARY
-          echo '- `grep`: "${{ inputs.grep }}"' >> $GITHUB_STEP_SUMMARY
-          echo '- `qa_db`: "${{ inputs.qa_db }}"' >> $GITHUB_STEP_SUMMARY
-          echo '- `enable_network_throttling`: "${{ inputs.enable_network_throttling }}"' >> $GITHUB_STEP_SUMMARY
-          echo '- `fail_fast`: "${{ inputs.fail_fast }}"' >> $GITHUB_STEP_SUMMARY
-          echo '- `build_jar`: "${{ inputs.build_jar }}"' >> $GITHUB_STEP_SUMMARY
-          echo '' >> $GITHUB_STEP_SUMMARY
-          echo 'triggered by: @${{ github.event.sender.login }}' >> $GITHUB_STEP_SUMMARY
+          {
+            echo '**Inputs:**'
+            echo ''
+            echo "- \`branch\`: $BRANCH"
+            echo "- \`spec\`: $SPEC"
+            echo "- \`test_type\` (inferred): $TEST_TYPE"
+            echo "- \`burn_in\`: $BURN_IN"
+            echo "- \`grep\`: \"$GREP\""
+            echo "- \`qa_db\`: \"$QA_DB\""
+            echo "- \`enable_network_throttling\`: \"$ENABLE_NETWORK_THROTTLING\""
+            echo "- \`fail_fast\`: \"$FAIL_FAST\""
+            echo "- \`build_jar\`: \"$BUILD_JAR\""
+            echo ''
+            echo "triggered by: @$SENDER"
+          } >> "$GITHUB_STEP_SUMMARY"
 
   stress-test-flake-fix:
     needs: [determine-test-type]

.github/workflows/e2e-stress-test-flaky-pr.yml

@@ -63,14 +63,14 @@ jobs:
           fi
 
           echo "Changed e2e Cypress specs:"
-          echo "$FILES" | sed 's/^/  - /'
+          echo "$FILES" | awk '{ print "  - " $0 }'
 
           # Compact JSON array for the matrix, e.g. ["e2e/test/scenarios/a.cy.spec.js"].
           SPECS_JSON=$(echo "$FILES" | jq -R . | jq -cs .)
           echo "specs=${SPECS_JSON}" >> "$GITHUB_OUTPUT"
           echo "should_run=true" >> "$GITHUB_OUTPUT"
 
-          echo "Note: you can use the burn-50 or burn-100 labels to increase the burn-in count from the default of 20." >> $GITHUB_STEP_SUMMARY
+          echo "Note: you can use the burn-50 or burn-100 labels to increase the burn-in count from the default of 20." >> "$GITHUB_STEP_SUMMARY"
 
   stress-test:
     name: Stress test

.github/workflows/e2e-test.yml

@@ -68,6 +68,7 @@ jobs:
       # deleted in after:spec so recording is ~5-10% slowdown per shard and almost
       # never yields an artifact. Failure screenshots are unaffected, and the
       # stress-test workflows have their own config and keep video.
+      # Re-run attempts override this on the run steps below.
       CYPRESS_VIDEO: "false"
       # Sensitive env vars (tokens, secrets) starting with `CYPRESS_` are accessed via async `cy.env()`
       # Example: `cy.env(["FOO"]).then(({ FOO }) => ...)`
@@ -173,6 +174,8 @@ jobs:
           # do not write cypress-split summary to github
           SPLIT_SUMMARY: false
           SPEC_PATH: ${{ env.specs || inputs.specs }}
+          # Re-run attempts run only the previously-failed specs (env.specs), so record them.
+          CYPRESS_VIDEO: ${{ env.specs && 'true' || 'false' }}
           CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
         shell: bash
         run: |
@@ -189,6 +192,8 @@ jobs:
         shell: bash
         env:
           SPEC_PATH: ${{ env.specs || inputs.specs }}
+          # Re-run attempts run only the previously-failed specs (env.specs), so record them.
+          CYPRESS_VIDEO: ${{ env.specs && 'true' || 'false' }}
           CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
         run: |
           echo "Running tests with specs: $SPEC_PATH"
@@ -211,22 +216,6 @@ jobs:
             echo "No ./target/junit directory; nothing to process."
           fi
 
-      - name: Upload Test Results
-        uses: ./.github/actions/upload-test-results
-        if: always()
-        with:
-          input-path: ./target/junit
-          # Related to our custom upload to S3
-          output-name: e2e-${{ inputs.name }}
-          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-          aws-region: ${{ vars.AWS_REGION }}
-          # Related to Trunk uploader
-          variant: e2e-tests
-          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-          previous-step-outcome: ${{ inputs.specs && steps.tagged-e2e.outcome || steps.split-e2e.outcome }}
-          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
-
       - name: Quarantine gate
         # Only one of the two run steps executes; the other reports `skipped`. Only gate on actual failure.
         if: ${{ !cancelled() && (steps.split-e2e.outcome == 'failure' || steps.tagged-e2e.outcome == 'failure') }}

.github/workflows/embedding-sdk-component-tests.yml

@@ -111,19 +111,6 @@ jobs:
             echo "No ./target/junit directory; nothing to process."
           fi
 
-      - name: Upload Test Results
-        uses: ./.github/actions/upload-test-results
-        if: always()
-        with:
-          input-path: ./target/junit
-          output-name: e2e-embedding-sdk-react-${{ matrix.react-version }}
-          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-          aws-region: ${{ vars.AWS_REGION }}
-          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-          previous-step-outcome: ${{ steps.run-tests.outcome }}
-          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
-
       - name: Quarantine gate
         if: ${{ !cancelled() && steps.run-tests.outcome == 'failure' }}
         continue-on-error: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
@@ -293,19 +280,6 @@ jobs:
             echo "No ./target/junit directory; nothing to process."
           fi
 
-      - name: Upload Test Results
-        uses: ./.github/actions/upload-test-results
-        if: always()
-        with:
-          input-path: ./target/junit
-          output-name: e2e-embedding-sdk
-          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-          aws-region: ${{ vars.AWS_REGION }}
-          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-          previous-step-outcome: ${{ steps.run-tests.outcome }}
-          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
-
       - name: Quarantine gate
         if: ${{ !cancelled() && steps.run-tests.outcome == 'failure' }}
         continue-on-error: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}

.github/workflows/emotion-stats-update.yml

@@ -40,9 +40,9 @@ jobs:
               | wc -l || true
           )
 
-          echo "$(($oss+$ee)) files importing @emotion/*"
+          echo "$((oss + ee)) files importing @emotion/*"
 
-          echo "EMOTION_FILES=$(($oss+$ee))" >> $GITHUB_OUTPUT
+          echo "EMOTION_FILES=$((oss + ee))" >> "$GITHUB_OUTPUT"
       - name: Upload count to Stats
         uses: actions/github-script@v9
         env:

.github/workflows/escalation-slack-notification.yml

@@ -1,36 +0,0 @@
-name: Escalation Slack Notification
-
-on:
-  issues:
-    types:
-      - labeled
-jobs:
-  on-escalation-label:
-    if: github.event.label.name == '.Escalation'
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 10
-    steps:
-      - name: Format issue title (escape quotes)
-        uses: actions/github-script@v9
-        id: vars
-        with:
-          script: |
-            core.setOutput('issue_title', ${{ toJson(github.event.issue.title) }}.replaceAll(/"/g, '\\"'));
-      - name: Send escalated issue ${{ github.event.issue.number }} to Slack
-        id: slack
-        uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
-        with:
-          webhook: ${{ secrets.SLACK_ESCALATIONS_WEBHOOK_URL }}
-          webhook-type: incoming-webhook
-          payload: |
-            {
-              "blocks": [
-                {
-                  "type": "section",
-                  "text": {
-                    "type": "mrkdwn",
-                    "text": "🔥🔥🔥 ${{ steps.vars.outputs.issue_title }}\n${{ github.event.issue.html_url }}"
-                  }
-                }
-              ]
-            }

.github/workflows/frontend-unit-test-stress-test-flake-fix.yml

@@ -23,15 +23,23 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Generate workflow summary
+        env:
+          BRANCH: ${{ github.ref_name }}
+          SPEC: ${{ inputs.spec }}
+          BURN_IN: ${{ inputs.burn_in }}
+          GREP: ${{ inputs.grep }}
+          SENDER: ${{ github.event.sender.login }}
         run: |
-          echo '**Inputs:**' >> $GITHUB_STEP_SUMMARY
-          echo '' >> $GITHUB_STEP_SUMMARY
-          echo '- `branch`: ${{ github.ref_name }}' >> $GITHUB_STEP_SUMMARY
-          echo '- `spec`: ${{ inputs.spec }}' >> $GITHUB_STEP_SUMMARY
-          echo '- `burn_in`: ${{ inputs.burn_in }}' >> $GITHUB_STEP_SUMMARY
-          echo '- `grep`: "${{ inputs.grep }}"' >> $GITHUB_STEP_SUMMARY
-          echo '' >> $GITHUB_STEP_SUMMARY
-          echo 'triggered by: @${{ github.event.sender.login }}' >> $GITHUB_STEP_SUMMARY
+          {
+            echo '**Inputs:**'
+            echo ''
+            echo "- \`branch\`: $BRANCH"
+            echo "- \`spec\`: $SPEC"
+            echo "- \`burn_in\`: $BURN_IN"
+            echo "- \`grep\`: \"$GREP\""
+            echo ''
+            echo "triggered by: @$SENDER"
+          } >> "$GITHUB_STEP_SUMMARY"
 
   frontend-unit-test-stress-test-flake-fix:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
@@ -48,10 +56,9 @@ jobs:
       - name: Stress-test ${{ github.event.inputs.spec }} ${{ github.event.inputs.burn_in }} times
         run: |
           for ((i=1; i<=BURN_IN; i++)); do
-            bun run jest --runInBand --ci --silent --no-cache \
+            if ! bun run jest --runInBand --ci --silent --no-cache \
               --testPathPatterns "${SPEC}" \
-              --testNamePattern "${GREP}"
-            if [[ "$?" != 0 ]]; then
+              --testNamePattern "${GREP}"; then
               echo "Failed after $i attempts" && break;
             fi
           done

.github/workflows/frontend.yml

@@ -129,18 +129,6 @@ jobs:
           adapter: frontend
           test-suite: fe-tests-unit
           enforce-quarantine: ${{ vars.QUARANTINE_ENGINE == 'ci-conductor' }}
-      - name: Upload Test Results
-        uses: ./.github/actions/upload-test-results
-        if: always() && github.event_name != 'workflow_dispatch'
-        with:
-          input-path: ./target/junit
-          output-name: frontend-unit
-          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-          aws-region: ${{ vars.AWS_REGION }}
-          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-          previous-step-outcome: ${{ steps.fe-tests.outcome }}
-          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   fe-tests-timezones:
     if: ${{ !inputs.skip }}

.github/workflows/generative-query-test.yml

@@ -1,58 +0,0 @@
-name: Generative Query Test
-
-on:
-  workflow_dispatch:
-    inputs:
-      context-seed:
-        description: 'Context seed (empty = random)'
-        type: number
-      iteration-seed:
-        description: 'Iteration seed (for iteration replay, empty = dependent on Context seed)'
-        type: number
-      iterations:
-        description: 'Iterations (number of test iterations, overrides seconds)'
-        type: number
-      seconds:
-        description: 'Seconds (Number of seconds after which next iteration will not start)'
-      test:
-        description: 'Test or namespace to run'
-        default: metabase.query-processor.generative-test/execution-with-cards-test
-      ref:
-        description: 'Ref to run generative tests on'
-        default: qgen-ms2
-
-# TODO: Consider renaming the job in next milestones
-jobs:
-  generative-query-test:
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 90
-    name: Generative Query Test
-    env:
-      CI: 'true'
-      MB_GENTEST_CONTEXT_SEED: ${{ inputs.context-seed }}
-      MB_GENTEST_ITERATION_SEED: ${{ inputs.iteration-seed }}
-      MB_GENTEST_LIMIT_ITERATIONS: ${{ inputs.iterations }}
-      MB_GENTEST_LIMIT_SECONDS: ${{ inputs.seconds }}
-      MB_GENTEST_RUN: true
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          ref: ${{ inputs.ref }}
-      - name: Prepare back-end environment
-        uses: ./.github/actions/prepare-backend
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-
-      - name: Run test
-        run: clojure -X:dev:ci:test:ee:ee-dev :only '${{ inputs.test }}'
-
-      - name: Publish Test Report (JUnit)
-        uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
-        if: failure()
-        with:
-          path: "target/junit/**/*_test.xml"
-          name: JUnit Test Report (Generative Query test)
-          reporter: java-junit
-          list-suites: failed
-          list-tests: failed
-          fail-on-error: false

.github/workflows/i18n.yml

@@ -1,51 +0,0 @@
-name: i18n
-
-on:
-  push:
-    branches:
-      - 'master'
-      - 'release-**'
-  pull_request:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
-  cancel-in-progress: true
-
-jobs:
-  files-changed:
-    name: Check which files changed
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 3
-    outputs:
-      i18n: ${{ steps.changes.outputs.i18n }}
-    steps:
-      - uses: actions/checkout@v6
-      - name: Test which files changed
-        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
-        id: changes
-        with:
-          token: ${{ github.token }}
-          filters: .github/file-paths.yaml
-
-  verify-i18n-files:
-    needs: files-changed
-    if: needs.files-changed.outputs.i18n == 'true'
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@v6
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-      - name: Prepare back-end environment
-        uses: ./.github/actions/prepare-backend
-      - name: Install xgettext if necessary
-        run: |
-          if ! command -v xgettext > /dev/null; then
-            sudo apt install gettext
-          fi
-      - name: Check xgettext version
-        run: xgettext --version
-      - name: Check i18n tags/make sure template can be built
-        run: ./bin/i18n/update-translation-template
-      - name: Verify i18n translations (.po files)
-        run: ./bin/i18n/build-translation-resources

.github/workflows/js-stats-update.yml

@@ -18,9 +18,9 @@ jobs:
           oss=$(find ./frontend/src/metabase -type f -name "*.js" -o -name "*.jsx" | wc -l)
           ee=$(find ./enterprise/frontend/src/metabase-enterprise -type f -name "*.js" -o -name "*.jsx" | wc -l)
 
-          echo $(($oss+$ee)) javascript files
+          echo $((oss + ee)) javascript files
 
-          echo "JS_FILES=$(($oss+$ee))" >> $GITHUB_OUTPUT
+          echo "JS_FILES=$((oss + ee))" >> "$GITHUB_OUTPUT"
       - name: Upload count to Stats
         uses: actions/github-script@v9
         env:

.github/workflows/lint.yml

@@ -0,0 +1,184 @@
+name: Lint
+
+on:
+  push:
+    branches:
+      - 'master'
+      - 'release-**'
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  files-changed:
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 10
+    outputs:
+      actionlint: ${{ steps.changes.outputs.actionlint }}
+      actionlint_files: ${{ steps.changes.outputs.actionlint_files }}
+      codeql: ${{ steps.changes.outputs.codeql }}
+      i18n: ${{ steps.changes.outputs.i18n }}
+      openapi: ${{ steps.changes.outputs.openapi }}
+      snowplow: ${{ steps.changes.outputs.snowplow }}
+      yaml: ${{ steps.changes.outputs.yaml }}
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Test which files changed
+        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+        id: changes
+        with:
+          token: ${{ github.token }}
+          filters: .github/file-paths.yaml
+          list-files: shell
+
+  lint:
+    needs: files-changed
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Setup frontend env
+        if: |
+          needs.files-changed.outputs.yaml == 'true' ||
+          needs.files-changed.outputs.openapi == 'true'
+        uses: ./.github/actions/prepare-frontend
+
+      # Always required by whitespace linter, also used by OpenAPI spec validation
+      - name: Setup backend env
+        uses: ./.github/actions/prepare-backend
+
+      - name: Setup actionlint
+        if: needs.files-changed.outputs.actionlint == 'true'
+        id: download
+        shell: bash
+        run: |
+          if command -v actionlint; then
+            echo "executable=actionlint" >> "$GITHUB_OUTPUT"
+          else
+            # script sets executable output, for details see: https://github.com/rhysd/actionlint/blob/main/docs/usage.md#use-actionlint-on-github-actions
+            bash <(curl -fsSL https://raw.githubusercontent.com/rhysd/actionlint/v1.7.12/scripts/download-actionlint.bash)
+          fi
+
+      - parallel:
+        # Lint whitespace, always runs
+        - name: Run Whitespace Linter
+          run: clojure -T:whitespace-linter lint :whitespace-linter/progress-bar false
+
+        # Lint YAML
+        - name: Lint YAML files
+          if: needs.files-changed.outputs.yaml == 'true'
+          run: bun run lint-yaml
+
+        # Lint Github Actions
+        - name: Run actionlint
+          if: needs.files-changed.outputs.actionlint == 'true'
+          run: ${{ steps.download.outputs.executable }} --color --verbose ${{ needs.files-changed.outputs.actionlint_files }}
+
+        # Generate and Lint OpenAPI spec
+        - name: Generate OpenAPI spec
+          if: needs.files-changed.outputs.openapi == 'true'
+          run: bun run generate-openapi
+
+      # Parallel steps run asynchronously, and explicitly waiting for a parallel step means "if" statements are ignored.
+      # Move OpenAPI validation outside the parallel block so that spec generation happens asynchronously without requiring
+      # an explicit "wait".
+      - name: Validate OpenAPI spec
+        if: needs.files-changed.outputs.openapi == 'true'
+        run: bun run lint-openapi
+
+  codeql:
+    if: needs.files-changed.outputs.codeql == 'true'
+    needs: files-changed
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: javascript
+          config-file: ./.github/codeql/codeql-config.yml
+          trap-caching: false
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
+
+  i18n:
+    needs: files-changed
+    if: needs.files-changed.outputs.i18n == 'true'
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v6
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+      - name: Install xgettext if necessary
+        run: |
+          if ! command -v xgettext > /dev/null; then
+            sudo apt install gettext
+          fi
+      - name: Check xgettext version
+        run: xgettext --version
+      - name: Check i18n tags/make sure template can be built
+        run: ./bin/i18n/update-translation-template
+      - name: Verify i18n translations (.po files)
+        run: ./bin/i18n/build-translation-resources
+
+  snowplow:
+    needs: files-changed
+    if: needs.files-changed.outputs.snowplow == 'true'
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+      - name: Set up Java
+        uses: actions/setup-java@v5.2.0
+        with:
+          distribution: temurin
+          java-version: 25
+      - name: Set up Babashka
+        uses: turtlequeue/setup-babashka@d78ec6570aea3b614bc695cafcceb82eb45c2af9 # v1.8.0
+        with:
+          babashka-version: 1.12.197
+      - name: Install igluctl
+        run: |
+          set -euo pipefail
+          curl -fsSL -o "$RUNNER_TEMP/igluctl.zip" https://github.com/snowplow/igluctl/releases/download/0.13.0/igluctl_0.13.0.zip
+          echo "0eac19121fca1431dec44738ada8eacc4242811a95d015ee71e00deec2b4d748  $RUNNER_TEMP/igluctl.zip" | sha256sum -c -
+          unzip -q "$RUNNER_TEMP/igluctl.zip" -d "$RUNNER_TEMP/igluctl"
+          chmod +x "$RUNNER_TEMP/igluctl/igluctl"
+          echo "$RUNNER_TEMP/igluctl" >> "$GITHUB_PATH"
+      - name: Lint (igluctl)
+        # igluctl recursively parses every file as JSON, so it chokes on colocated
+        # *.md docs and on two schemas whose internal `self.version` doesn't match
+        # the filename version (pending Snowcat audit). Stage a filtered copy and
+        # patch only the `self.version` mismatch so igluctl still lints the rest
+        # of those schemas.
+        run: |
+          set -euo pipefail
+          LINT_ROOT="$RUNNER_TEMP/iglu-lint"
+          rm -rf "$LINT_ROOT"
+          mkdir -p "$LINT_ROOT"
+          cp -r snowplow/iglu-client-embedded/schemas "$LINT_ROOT/"
+          find "$LINT_ROOT" -name '*.md' -delete
+          # TODO(BOT-1403): drop these patches once the Snowcat audit fixes the
+          # internal `self.version` mismatch on these two schemas. We rewrite
+          # only `self.version` in the staged copy so the file's path version
+          # matches what igluctl expects; every other lint rule still runs.
+          # Each `sed` invocation uses the schema's wrong/right pair, so it
+          # silently no-ops once the underlying schema is fixed.
+          sed -i 's/"version": "1-0-1"/"version": "1-0-2"/' \
+            "$LINT_ROOT/schemas/com.metabase/embed_share/jsonschema/1-0-2"
+          sed -i 's/"version": "1-0-0"/"version": "1-0-1"/' \
+            "$LINT_ROOT/schemas/com.metabase/serialization/jsonschema/1-0-1"
+          igluctl lint "$LINT_ROOT/schemas"
+      - name: Lint (Metabase schema rules)
+        run: ./bin/lint-snowplow-schemas.bb
+      - name: Test linter rules
+        run: ./bin/lint-snowplow-schemas-test.bb

.github/workflows/loki-stress-test-flake-fix.yml

@@ -53,8 +53,8 @@ jobs:
             if ! validate_paths "$FILES"; then
               exit 1
             fi
-            echo "story_files=$FILES" >> $GITHUB_OUTPUT
-            echo "should_run=true" >> $GITHUB_OUTPUT
+            echo "story_files=$FILES" >> "$GITHUB_OUTPUT"
+            echo "should_run=true" >> "$GITHUB_OUTPUT"
             exit 0
           fi
 
@@ -70,7 +70,7 @@ jobs:
 
           if [[ -z "$FILES" ]]; then
             echo "No changed story files found"
-            echo "should_run=false" >> $GITHUB_OUTPUT
+            echo "should_run=false" >> "$GITHUB_OUTPUT"
             exit 0
           fi
 
@@ -79,8 +79,8 @@ jobs:
           fi
 
           echo "Changed story files: $FILES"
-          echo "story_files=$FILES" >> $GITHUB_OUTPUT
-          echo "should_run=true" >> $GITHUB_OUTPUT
+          echo "story_files=$FILES" >> "$GITHUB_OUTPUT"
+          echo "should_run=true" >> "$GITHUB_OUTPUT"
 
   workflow-summary:
     name: Summary
@@ -99,22 +99,24 @@ jobs:
           PR_ACTOR: ${{ github.event.pull_request.user.login }}
           ACTOR: ${{ github.actor }}
         run: |
-          echo '## Loki Stress Test' >> $GITHUB_STEP_SUMMARY
-          echo '' >> $GITHUB_STEP_SUMMARY
-          echo "**Branch:** \`${BRANCH_NAME}\`" >> $GITHUB_STEP_SUMMARY
-          echo '' >> $GITHUB_STEP_SUMMARY
-          echo '**Story files:**' >> $GITHUB_STEP_SUMMARY
-          echo "${STORY_FILES}" | tr ',' '\n' | while read -r file; do
-            echo "- \`$file\`" >> $GITHUB_STEP_SUMMARY
-          done
-          echo '' >> $GITHUB_STEP_SUMMARY
-          echo "**Burn-in:** ${BURN_IN} runs" >> $GITHUB_STEP_SUMMARY
-          echo '' >> $GITHUB_STEP_SUMMARY
-          if [[ "${EVENT_NAME}" == "pull_request" ]]; then
-            echo "Triggered by PR #${PR_NUMBER} from @${PR_ACTOR}" >> $GITHUB_STEP_SUMMARY
-          else
-            echo "Triggered manually by @${ACTOR}" >> $GITHUB_STEP_SUMMARY
-          fi
+          {
+            echo '## Loki Stress Test'
+            echo ''
+            echo "**Branch:** \`${BRANCH_NAME}\`"
+            echo ''
+            echo '**Story files:**'
+            echo "${STORY_FILES}" | tr ',' '\n' | while read -r file; do
+              echo "- \`$file\`"
+            done
+            echo ''
+            echo "**Burn-in:** ${BURN_IN} runs"
+            echo ''
+            if [[ "${EVENT_NAME}" == "pull_request" ]]; then
+              echo "Triggered by PR #${PR_NUMBER} from @${PR_ACTOR}"
+            else
+              echo "Triggered manually by @${ACTOR}"
+            fi
+          } >> "$GITHUB_STEP_SUMMARY"
 
   stress-test-loki:
     needs: detect-changed-stories
@@ -175,8 +177,8 @@ jobs:
               echo "❌ Run $i FAILED"
               FAILED=$((FAILED + 1))
 
-              mkdir -p .loki/failures/run-$i
-              cp -r .loki/difference/* .loki/failures/run-$i/ 2>/dev/null || true
+              mkdir -p ".loki/failures/run-$i"
+              cp -r .loki/difference/* ".loki/failures/run-$i/" 2>/dev/null || true
             fi
             echo ""
           done

.github/workflows/loki-update.yml

@@ -31,9 +31,9 @@ jobs:
         id: check-changes
         run: |
           if [[ -n "$(git status --porcelain .loki/reference/)" ]]; then
-            echo "has_changes=true" >> $GITHUB_OUTPUT
+            echo "has_changes=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has_changes=false" >> $GITHUB_OUTPUT
+            echo "has_changes=false" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Commit and Push Changes

.github/workflows/main.yml

@@ -1,37 +0,0 @@
-name: Slack Notification for New Feature Requests
-
-on:
-  issues:
-    types:
-      - labeled
-jobs:
-  on-issue-labeled:
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 5
-    if: |
-      contains(github.event.issue.labels.*.name, 'Type:New Feature')
-    steps:
-      - name: Setting title
-        uses: actions/github-script@v9
-        id: vars
-        with:
-          script: |
-            core.setOutput('issue_title', ${{ toJson(github.event.issue.title) }}.replaceAll(/"/g, '\\"'));
-      - name: Send the issue ${{ github.event.issue.number }} to Slack
-        id: slack
-        uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
-        with:
-          webhook: ${{ secrets.SLACK_FEATURE_REQUEST_TRIAGE_WEBHOOK_URL }}
-          webhook-type: incoming-webhook
-          payload: |
-            {
-              "blocks": [
-                {
-                  "type": "section",
-                  "text": {
-                    "type": "mrkdwn",
-                    "text": "New incoming feature request: ${{ steps.vars.outputs.issue_title }}\n${{ github.event.issue.html_url }}"
-                  }
-                }
-              ]
-            }

.github/workflows/mbql-library-changelog.yml

@@ -27,6 +27,6 @@ jobs:
           else
             echo "metabase.lib.js namespace changed but docs/developers/guide/mbql-library-changelog.md did not"
             echo "Update the changelog with the changes made to the library's API."
-            echo "If the edits did not change the API, add the `.metabase-lib/no-change` label."
+            echo "If the edits did not change the API, add the \`.metabase-lib/no-change\` label."
             exit 1
           fi

.github/workflows/minimal-tests.yml

@@ -9,7 +9,6 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
-  id-token: write
   contents: read
   checks: write
   actions: read
@@ -26,9 +25,9 @@ jobs:
         id: check
         run: |
           if [[ "${{ contains(github.event.pull_request.labels.*.name, 'minimal-tests') }}" == "true" ]]; then
-            echo "result=true" >> $GITHUB_OUTPUT
+            echo "result=true" >> "$GITHUB_OUTPUT"
           else
-            echo "result=false" >> $GITHUB_OUTPUT
+            echo "result=false" >> "$GITHUB_OUTPUT"
           fi
 
   # Postgres app-db tests - single version, single job
@@ -64,22 +63,12 @@ jobs:
         with:
           build-static-viz: true
           junit-name: "minimal-be-tests-postgres-ee"
+          quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
           test-args: >-
             :only '["test" "enterprise/backend/test"]'
             :exclude-tags '[:mb/driver-tests :mb/transforms-python-test]'
             :partition/total 2
             :partition/index 0
-      - name: Upload Test Results
-        uses: ./.github/actions/upload-test-results
-        if: always()
-        with:
-          input-path: ./target/junit/
-          output-name: ${{ github.job }}
-          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-          aws-region: ${{ vars.AWS_REGION }}
-          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   # Postgres driver tests
   postgres-driver-test:
@@ -113,20 +102,10 @@ jobs:
         uses: ./.github/actions/test-driver
         with:
           junit-name: "minimal-be-tests-postgres-driver-ee"
+          quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
           test-args: >-
             :only-tags [:mb/driver-tests]
             :exclude-tags [:mb/transforms-python-test]
-      - name: Upload Test Results
-        uses: ./.github/actions/upload-test-results
-        if: always()
-        with:
-          input-path: ./target/junit/
-          output-name: ${{ github.job }}
-          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-          aws-region: ${{ vars.AWS_REGION }}
-          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   # Frontend unit tests
   frontend-unit-tests:
@@ -144,21 +123,32 @@ jobs:
         uses: ./.github/actions/prepare-frontend
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
+      - name: Resolve current job id
+        # Resolve JOB_ID before the long test step so the ci-conductor reporter
+        # below can link failures to this exact job. Best-effort.
+        uses: ./.github/actions/resolve-job-id
       - name: Run frontend unit tests
         id: run-tests
         run: bun run test-unit --silent
+        # Keep this step continue-on-error because the quarantine logic controls whether it ultimately fails.
         continue-on-error: true
-      - name: Upload Test Results
-        uses: ./.github/actions/upload-test-results
-        if: always()
+      - name: Report failed tests to ci-conductor
+        if: ${{ !cancelled() && steps.run-tests.outcome == 'failure' }}
+        # This step should NEVER fail the job!
+        continue-on-error: true
+        uses: ./.github/actions/report-failures-to-ci-conductor
         with:
-          input-path: ./target/junit
-          output-name: frontend-unit
-          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-          aws-region: ${{ vars.AWS_REGION }}
-          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-          previous-step-outcome: ${{ steps.run-tests.outcome }}
+          test-suite: fe-tests-unit
+          adapter: frontend
+      - name: Quarantine gate
+        if: ${{ !cancelled() && steps.run-tests.outcome == 'failure' }}
+        continue-on-error: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
+        timeout-minutes: 3
+        uses: ./.github/actions/quarantine-gate
+        with:
+          adapter: frontend
+          test-suite: fe-tests-unit
+          enforce-quarantine: ${{ vars.QUARANTINE_ENGINE == 'ci-conductor' }}
 
   # Summary job
   minimal-tests-result:

.github/workflows/notify.issue-labeled.yml

@@ -0,0 +1,208 @@
+# Send Slack and/or PagerDuty notifications when labels are added to a Github issue.
+name: Notify on Issue Labeled
+
+on:
+  issues:
+    types:
+      - labeled
+
+jobs:
+  on-escalation-label:
+    if: github.event.label.name == '.Escalation'
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 5
+    steps:
+      - name: Format issue title (escape quotes)
+        uses: actions/github-script@v9
+        id: vars
+        env:
+          ISSUE_TITLE: ${{ github.event.issue.title }}
+        with:
+          script: |
+            core.setOutput('issue_title', process.env.ISSUE_TITLE.replaceAll(/"/g, '\\"'));
+      - name: Send escalated issue ${{ github.event.issue.number }} to Slack
+        id: slack
+        uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
+        with:
+          webhook: ${{ secrets.SLACK_ESCALATIONS_WEBHOOK_URL }}
+          webhook-type: incoming-webhook
+          payload: |
+            {
+              "blocks": [
+                {
+                  "type": "section",
+                  "text": {
+                    "type": "mrkdwn",
+                    "text": "🔥🔥🔥 ${{ steps.vars.outputs.issue_title }}\n${{ github.event.issue.html_url }}"
+                  }
+                }
+              ]
+            }
+
+  on-security-label:
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 5
+    if: github.event.label.name == 'SECURITY'
+    steps:
+      - name: Setting title
+        uses: actions/github-script@v9
+        id: vars
+        env:
+          ISSUE_TITLE: ${{ github.event.issue.title }}
+        with:
+          script: |
+            core.setOutput('issue_title', process.env.ISSUE_TITLE.replaceAll(/"/g, '\\"'));
+      - name: Send the issue ${{ github.event.issue.number }} to Slack
+        id: slack
+        uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
+        with:
+          webhook: ${{ secrets.SLACK_SECURITY_WEBHOOK_URL }}
+          webhook-type: incoming-webhook
+          payload: |
+            {
+              "blocks": [
+                {
+                  "type": "section",
+                  "text": {
+                    "type": "mrkdwn",
+                    "text": "${{ steps.vars.outputs.issue_title }}\n${{ github.event.issue.html_url }}"
+                  }
+                }
+              ]
+            }
+
+  # Note: this only triggers if a issue is already labeled with `Type:Bug` and `flaky-test-fix` and then a team label is added.
+  on-team-label:
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 5
+    if: |
+      contains(github.event.label.name, '.Team/') &&
+       ( contains(github.event.issue.labels.*.name, 'Type:Bug') ||
+         contains(github.event.issue.labels.*.name, 'flaky-test-fix') )
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          sparse-checkout: .github/scripts
+
+      - name: Build Slack message (with Linear link if available)
+        uses: actions/github-script@v9
+        id: vars
+        env:
+          LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}
+        with:
+          script: |
+            const { findLinearIssue } = require('./.github/scripts/find-linear-issue.js');
+
+            const title = context.payload.issue.title;
+            const issueUrl = context.payload.issue.html_url;
+
+            let text = title + '\n' + issueUrl;
+
+            // The Linear issue is usually already synced by the time the
+            // team label lands at triage, but retry briefly just in case.
+            try {
+              const delaysSeconds = [0, 15, 30];
+              let result = null;
+
+              for (const delay of delaysSeconds) {
+                if (delay) await new Promise((r) => setTimeout(r, delay * 1000));
+                result = await findLinearIssue({
+                  githubIssueUrl: issueUrl,
+                  linearApiKey: process.env.LINEAR_API_KEY,
+                });
+                if (result.success) break;
+              }
+
+              if (result && result.success) {
+                const id = result.issue; // e.g. "GIT-1234"
+                text += `\nLinear: <https://linear.app/metabase/issue/${id}|${id}>`;
+              } else {
+                core.info(`No Linear issue found for ${issueUrl}; posting without link.`);
+              }
+            } catch (e) {
+              // Never block the notification on a Linear lookup failure
+              core.warning(`Linear lookup failed: ${e.message}`);
+            }
+
+            core.setOutput('message', JSON.stringify(text));
+
+      - name: Extracting team name
+        id: team_name
+        env:
+          LABEL_NAME: ${{ github.event.label.name }}
+        run: |
+          team_label="${LABEL_NAME//&/$}"
+          echo "$team_label"
+          team_name=${team_label#*.Team/}
+          echo "$team_name"
+          echo "team_name=${team_name^^}_SLACK_ISSUES_WEBHOOK_URL" >> "$GITHUB_OUTPUT"
+      - name: Check webhook secret exists
+        id: check_secret
+        env:
+          WEBHOOK_URL: ${{ secrets[steps.team_name.outputs.team_name] }}
+        run: |
+          if [ -z "$WEBHOOK_URL" ]; then
+            echo "Secret ${{ steps.team_name.outputs.team_name }} is not set, skipping Slack notification"
+            echo "exists=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "exists=true" >> "$GITHUB_OUTPUT"
+          fi
+      - name: Send the issue ${{ github.event.issue.number }} to Slack
+        if: steps.check_secret.outputs.exists == 'true'
+        id: slack
+        uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
+        with:
+          webhook: ${{ secrets[steps.team_name.outputs.team_name] }}
+          webhook-type: incoming-webhook
+          payload: |
+            {
+              "blocks": [
+                {
+                  "type": "section",
+                  "text": {
+                    "type": "mrkdwn",
+                    "text": ${{ steps.vars.outputs.message }}
+                  }
+                }
+              ]
+            }
+
+  on-escalation-and-team-querying-label:
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 5
+    if: |
+      (github.event.label.name == 'Priority:P0' || github.event.label.name == 'Priority:P1' || github.event.label.name == '.Escalation') &&
+      contains(github.event.issue.labels.*.name, '.Team/Querying')
+    steps:
+      - name: Trigger PagerDuty Incident
+        env:
+          ROUTING_KEY: ${{ secrets.QUERYING_PAGERDUTY_INTEGRATION_KEY }}
+          ISSUE_TITLE: ${{ github.event.issue.title }}
+          LABEL_NAME: ${{ github.event.label.name }}
+          ISSUE_NUMBER: ${{ github.event.issue.number }}
+          ISSUE_URL: ${{ github.event.issue.html_url }}
+          REPO: ${{ github.repository }}
+          ALL_LABELS: ${{ join(github.event.issue.labels.*.name, ', ') }}
+        run: |
+          payload=$(jq -n \
+            --arg rk  "$ROUTING_KEY" \
+            --arg dk  "github-issue-$ISSUE_NUMBER" \
+            --arg sum "[$LABEL_NAME] $ISSUE_TITLE" \
+            --arg src "GitHub Issues - $REPO" \
+            --arg lbl "$ALL_LABELS" \
+            --arg url "$ISSUE_URL" \
+            '{
+              routing_key: $rk,
+              event_action: "trigger",
+              dedup_key: $dk,
+              payload: {
+                summary: $sum,
+                source: $src,
+                severity: "critical",
+                custom_details: { Labels: $lbl }
+              },
+              links: [{ href: $url, text: "View GitHub Issue" }]
+            }')
+          curl -X POST https://events.pagerduty.com/v2/enqueue \
+            -H 'Content-Type: application/json' \
+            -d "$payload"

.github/workflows/openapi-check.yml

@@ -31,7 +31,7 @@ jobs:
       - name: Get latest base branch commit
         run: |
           git fetch origin ${{ github.event.pull_request.base.ref }}
-          echo "LATEST_BASE_SHA=$(git rev-parse origin/${{ github.event.pull_request.base.ref }})" >> $GITHUB_ENV
+          echo "LATEST_BASE_SHA=$(git rev-parse origin/${{ github.event.pull_request.base.ref }})" >> "$GITHUB_ENV"
       - name: Check OpenAPI specs are up to date
         env:
           AUTO_COMMIT: "true"

.github/workflows/openapi.yml

@@ -1,44 +0,0 @@
-name: Validate OpenAPI
-
-on:
-  push:
-    branches:
-      - 'master'
-      - 'release-**'
-  pull_request:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
-  cancel-in-progress: true
-
-jobs:
-  files-changed:
-    name: Check which files changed
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 3
-    outputs:
-      openapi: ${{ steps.changes.outputs.openapi }}
-    steps:
-      - uses: actions/checkout@v6
-      - name: Test which files changed
-        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
-        id: changes
-        with:
-          token: ${{ github.token }}
-          filters: .github/file-paths.yaml
-
-  validate-openapi:
-    needs: files-changed
-    if: needs.files-changed.outputs.openapi == 'true'
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@v6
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-      - name: Prepare back-end environment
-        uses: ./.github/actions/prepare-backend
-      - name: Generate OpenAPI spec
-        run: bun run generate-openapi
-      - name: Validate OpenAPI spec
-        run: bun run lint-openapi

.github/workflows/optimize-images.yml

@@ -63,10 +63,12 @@ jobs:
         total_saved=$((total_before - total_after))
 
         # Output results for use in commit message
-        echo "files_optimized=${total_files}" >> "$GITHUB_OUTPUT"
-        echo "bytes_saved=${total_saved}" >> "$GITHUB_OUTPUT"
-        echo "total_before=${total_before}" >> "$GITHUB_OUTPUT"
-        echo "total_after=${total_after}" >> "$GITHUB_OUTPUT"
+        {
+          echo "files_optimized=${total_files}"
+          echo "bytes_saved=${total_saved}"
+          echo "total_before=${total_before}"
+          echo "total_after=${total_after}"
+        } >> "$GITHUB_OUTPUT"
 
         echo "Optimization complete"
         echo "Files processed: ${total_files}"

.github/workflows/perf-test.yml

@@ -70,7 +70,7 @@ jobs:
           export OIDC_URL_WITH_AUDIENCE="$ACTIONS_ID_TOKEN_REQUEST_URL&audience=${PR_ENV_K8S_AUDIENCE}"
           IDTOKEN=$(curl -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" -H "Accept: application/json; api-version=2.0" "$OIDC_URL_WITH_AUDIENCE" | jq -r .value)
           echo "::add-mask::${IDTOKEN}"
-          echo "idToken=${IDTOKEN}" >>$GITHUB_OUTPUT
+          echo "idToken=${IDTOKEN}" >>"$GITHUB_OUTPUT"
         env:
           PR_ENV_K8S_AUDIENCE: ${{ secrets.PR_ENV_K8S_AUDIENCE }}
       - name: Setup Kube Context
@@ -108,7 +108,7 @@ jobs:
         env:
           SHA: ${{ github.event.pull_request.head.sha || github.sha }}
         id: split
-        run: echo "fragment=${SHA:5}" >> $GITHUB_OUTPUT
+        run: echo "fragment=${SHA:5}" >> "$GITHUB_OUTPUT"
       - name: Render Deployment YAML
         uses: nowactions/envsubst@c4b8e3977354d294659a7ec164279ce8fba5c2e1 # v1.0.1
         with:

.github/workflows/pr-env-destroy-manual.yml

@@ -18,7 +18,10 @@ jobs:
     environment: pr-env-admin
     steps:
       - name: Approved
-        run: echo "Destroying PR environment for PR #${{ inputs.pr_number }}"
+        env:
+          PR_NUMBER: ${{ inputs.pr_number }}
+        run: |
+          echo "Destroying PR environment for PR #${PR_NUMBER}"
 
   destroy:
     needs: approve

.github/workflows/pr-env-destroy.yml

@@ -42,7 +42,7 @@ jobs:
           export OIDC_URL_WITH_AUDIENCE="$ACTIONS_ID_TOKEN_REQUEST_URL&audience=${PR_ENV_K8S_AUDIENCE}"
           IDTOKEN=$(curl -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" -H "Accept: application/json; api-version=2.0" "$OIDC_URL_WITH_AUDIENCE" | jq -r .value)
           echo "::add-mask::${IDTOKEN}"
-          echo "idToken=${IDTOKEN}" >>$GITHUB_OUTPUT
+          echo "idToken=${IDTOKEN}" >>"$GITHUB_OUTPUT"
         env:
           PR_ENV_K8S_AUDIENCE: ${{ secrets.PR_ENV_K8S_AUDIENCE }}
       - name: Setup Kube Context

.github/workflows/pr-env.yml

@@ -249,7 +249,7 @@ jobs:
           export OIDC_URL_WITH_AUDIENCE="$ACTIONS_ID_TOKEN_REQUEST_URL&audience=${PR_ENV_K8S_AUDIENCE}"
           IDTOKEN=$(curl -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" -H "Accept: application/json; api-version=2.0" "$OIDC_URL_WITH_AUDIENCE" | jq -r .value)
           echo "::add-mask::${IDTOKEN}"
-          echo "idToken=${IDTOKEN}" >>$GITHUB_OUTPUT
+          echo "idToken=${IDTOKEN}" >>"$GITHUB_OUTPUT"
         env:
           PR_ENV_K8S_AUDIENCE: ${{ secrets.PR_ENV_K8S_AUDIENCE }}
       - name: Setup Kube Context

.github/workflows/pre-release.yml

@@ -95,14 +95,14 @@ jobs:
         id: version-properties
         run: |
           cat version.properties
-          echo "commit=$(cat ./COMMIT-ID)" >> $GITHUB_OUTPUT
+          echo "commit=$(cat ./COMMIT-ID)" >> "$GITHUB_OUTPUT"
 
           version=$(grep -o '^tag=.*' version.properties | cut -d'=' -f2)
 
           if [[ "${{ matrix.edition }}" == "ee" ]]; then
-            echo "ee_version=$version" >> $GITHUB_OUTPUT
+            echo "ee_version=$version" >> "$GITHUB_OUTPUT"
           else
-            echo "oss_version=$version" >> $GITHUB_OUTPUT
+            echo "oss_version=$version" >> "$GITHUB_OUTPUT"
           fi
         shell: bash
       - name: Upload Metabase ${{ matrix.edition }} JAR as artifact
@@ -223,7 +223,7 @@ jobs:
           CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
         run: |
           node e2e/runner/run_cypress_ci.js e2e \
-            $CYPRESS_GREP_FLAG grepTags="@prerelease+-@EE" \
+            "$CYPRESS_GREP_FLAG" grepTags="@prerelease+-@EE" \
             --spec './e2e/test/scenarios/**/*.cy.spec.(js|ts)'
 
       - name: Run a few important EE Cypress tests as sanity check
@@ -232,7 +232,7 @@ jobs:
           CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
         run: |
           node e2e/runner/run_cypress_ci.js e2e \
-            $CYPRESS_GREP_FLAG grepTags="@prerelease+-@OSS" \
+            "$CYPRESS_GREP_FLAG" grepTags="@prerelease+-@OSS" \
             --spec './e2e/test/scenarios/**/*.cy.spec.(js|ts)'
 
       - name: Upload Cypress Artifacts upon failure
@@ -254,7 +254,7 @@ jobs:
       commit: ${{ inputs.commit }}
       repo: ${{ vars.DOCKERHUB_OWNER }}/${{ vars.DOCKERHUB_STAGING_REPO }}
       tag: ${{ needs.release-artifact.outputs.oss_version }}-${{ inputs.commit }}
-      release: "true"
+      release: true
 
   containerize-ee:
     needs: release-artifact
@@ -265,7 +265,7 @@ jobs:
       commit: ${{ inputs.commit }}
       repo: ${{ vars.DOCKERHUB_OWNER }}/${{ vars.DOCKERHUB_STAGING_REPO }}
       tag: ${{ needs.release-artifact.outputs.ee_version }}-${{ inputs.commit }}
-      release: "true"
+      release: true
 
   tests-complete-message:
     if: always()

.github/workflows/presto-kerberos-integration-test.yml

@@ -1,109 +0,0 @@
-# this file uses MBA https://github.com/metabase/mba to spin up a Metabase
-# instance then runs the test script in the MBA instance sharing the same
-# network to interact with presto container
-# TODO: get rid of MBA and use actions/prepare-backend instead
-
-name: Kerberized Presto Integration Test
-
-on:
-  pull_request:
-  push:
-    branches:
-      - master
-      - "release**"
-      - "feature**"
-    tags:
-      - "**"
-
-jobs:
-  files-changed:
-    name: Check which files changed
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 3
-    outputs:
-      backend_presto_kerberos: ${{ steps.changes.outputs.backend_presto_kerberos }}
-    steps:
-      - uses: actions/checkout@v6
-      - name: Test which files changed
-        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
-        id: changes
-        with:
-          token: ${{ github.token }}
-          filters: .github/file-paths.yaml
-
-  run-presto-kerberos-test:
-    needs: files-changed
-    if: needs.files-changed.outputs.backend_presto_kerberos == 'true'
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 40
-    steps:
-      - name: Install babashka
-        run: >
-          mkdir -p /tmp/babashka-install \
-            && cd /tmp/babashka-install \
-            && curl -sLO https://raw.githubusercontent.com/babashka/babashka/master/install \
-            && chmod +x install \
-            && sudo ./install \
-            && cd -
-      - name: Checkout Metabase repository
-        uses: actions/checkout@v6
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-      - name: Check out Presto Kerberos Docker Compose
-        uses: actions/checkout@v6
-        with:
-          repository: metabase/presto-kerberos-docker
-          ref: master
-          token: ${{ secrets.GITHUB_TOKEN }}
-          path: presto-kerberos-docker
-      - name: Bring up Presto+Kerberos cluster
-        run: cd presto-kerberos-docker && docker compose up -d && cd ..
-      - name: Run Presto test query from command line (sanity check)
-        run: cd presto-kerberos-docker && ./test.sh && cd ..
-      # Since we are managing the Docker containers from the GitHub action container, we need to copy all the
-      # relevant resources now, into the resources dir for later consumption by the app
-      - name: Copy Presto SSL keystore to resources
-        run: docker cp presto-kerberos:/tmp/ssl_keystore.jks resources
-      - name: Copy krb5.conf file to resources
-        run: docker cp presto-kerberos:/etc/krb5.conf resources
-      - name: Copy client.keytab file to resources
-        run: docker cp presto-kerberos:/home/presto/client.keytab resources
-
-      - name: Checkout mba
-        uses: actions/checkout@v6
-        with:
-          repository: metabase/mba
-          ref: master
-          token: ${{ secrets.GITHUB_TOKEN }}
-          path: mba-src
-      - name: ls mba
-        run: ls -latr mba-src
-      - name: Symlink mba
-        run: cd mba-src && sudo ln -s $(pwd)/src/main.clj /usr/local/bin/mba && chmod +x /usr/local/bin/mba && cd ..
-
-      - name: Ensure mba
-        run: which mba
-
-      - name: Run Metabase via MBA
-        run: mba --mb . --data-db postgres-data -n example.com compose config > mba-compose.yml
-
-      - name: Adjust generated docker-compose config
-        uses: actions/github-script@v9
-        with:
-          script: | #js
-            const fs = require("fs");
-            const config = fs.readFileSync("mba-compose.yml", "utf8");
-            const newConfig = config.replace(
-              /name:\s+example.com/,
-              "name: example.com\n    external: true",
-            );
-            fs.writeFileSync("mba-compose.yml", newConfig);
-
-      - name: Print compose config
-        run: cat mba-compose.yml
-
-      - name: Run mba
-        run: docker compose -f mba-compose.yml up -d
-
-      - name: Run test script in MBA instance
-        run: docker compose -f mba-compose.yml exec metabase .github/scripts/run-presto-kerberos-integration-test.sh

.github/workflows/querying-team-pagerduty.yml

@@ -1,47 +0,0 @@
-name: Querying On-call PagerDuty Alert
-
-on:
-  issues:
-    types:
-      - labeled
-
-jobs:
-  notify-querying-on-call:
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 5
-    if: |
-      (github.event.label.name == 'Priority:P0' || github.event.label.name == 'Priority:P1' || github.event.label.name == '.Escalation') &&
-      contains(github.event.issue.labels.*.name, '.Team/Querying')
-    steps:
-      - name: Trigger PagerDuty Incident
-        env:
-          ROUTING_KEY: ${{ secrets.QUERYING_PAGERDUTY_INTEGRATION_KEY }}
-          ISSUE_TITLE: ${{ github.event.issue.title }}
-          LABEL_NAME: ${{ github.event.label.name }}
-          ISSUE_NUMBER: ${{ github.event.issue.number }}
-          ISSUE_URL: ${{ github.event.issue.html_url }}
-          REPO: ${{ github.repository }}
-          ALL_LABELS: ${{ join(github.event.issue.labels.*.name, ', ') }}
-        run: |
-          payload=$(jq -n \
-            --arg rk  "$ROUTING_KEY" \
-            --arg dk  "github-issue-$ISSUE_NUMBER" \
-            --arg sum "[$LABEL_NAME] $ISSUE_TITLE" \
-            --arg src "GitHub Issues - $REPO" \
-            --arg lbl "$ALL_LABELS" \
-            --arg url "$ISSUE_URL" \
-            '{
-              routing_key: $rk,
-              event_action: "trigger",
-              dedup_key: $dk,
-              payload: {
-                summary: $sum,
-                source: $src,
-                severity: "critical",
-                custom_details: { Labels: $lbl }
-              },
-              links: [{ href: $url, text: "View GitHub Issue" }]
-            }')
-          curl -X POST https://events.pagerduty.com/v2/enqueue \
-            -H 'Content-Type: application/json' \
-            -d "$payload"

.github/workflows/release-embedding-sdk.yml

@@ -17,14 +17,11 @@ on:
   workflow_dispatch:
     inputs:
       read_first:
-        description: |
-          ⚠️ To cut a release, use the "SDK Version Bump PR" workflow instead — it bumps the version and opens a PR; merging that PR publishes.
-          This publishes the version already committed in package.template.json. It never bumps. Pick the branch in "Use workflow from" above.
-          Use it only when neither the bump PR nor re-running the failed jobs will do.
+        description: "⚠️ Manual override. Publishes whatever version is already committed in package.template.json; it never bumps. Normally you want the SDK Version Bump PR workflow, where merging the PR publishes."
         type: choice
         required: false
         options:
-          - Publish the committed version from the branch picked in "Use workflow from" above
+          - Publishes the branch picked above
   # Step 2 of the new release process: merging a version-bump PR (opened by
   # sdk-version-bump-pr.yml, labeled `sdk-release-trigger`) triggers a release
   # of whatever branch that PR targeted. See `prepare-release` below.

.github/workflows/release-log.yml

@@ -71,12 +71,12 @@ jobs:
       - name: generate release Log
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: cd release && tsx ./src/release-log-run.ts $VERSION > v$VERSION.html
+        run: cd release && tsx ./src/release-log-run.ts "$VERSION" > "v$VERSION.html"
       - name: upload release log to the web
         run: |
           aws s3 cp \
-          release/v$VERSION.html \
-          s3://${{ vars.AWS_S3_STATIC_BUCKET }}/release-log/v$VERSION.html
+          "release/v$VERSION.html" \
+          "s3://${{ vars.AWS_S3_STATIC_BUCKET }}/release-log/v$VERSION.html"
 
       - name: Create cloudfront invalidation
         run: |

.github/workflows/release-tag.yml

@@ -238,12 +238,12 @@ jobs:
       run: | # sh
         if [[ "${{ matrix.edition }}" == "ee" ]]; then
           echo "Metabase EE: image is going to be pushed to ${{ github.repository_owner }}/metabase-enterprise"
-          echo "DOCKERHUB_REPO=${{ github.repository_owner }}/metabase-enterprise" >> $GITHUB_ENV
-          echo "DOCKERHUB_VERSION=${{ needs.check-version.outputs.ee }}" >> $GITHUB_ENV
+          echo "DOCKERHUB_REPO=${{ github.repository_owner }}/metabase-enterprise" >> "$GITHUB_ENV"
+          echo "DOCKERHUB_VERSION=${{ needs.check-version.outputs.ee }}" >> "$GITHUB_ENV"
         else
           echo "Metabase OSS: image is going to be pushed to ${{ github.repository_owner }}/metabase"
-          echo "DOCKERHUB_REPO=${{ github.repository_owner }}/metabase" >> $GITHUB_ENV
-          echo "DOCKERHUB_VERSION=${{ needs.check-version.outputs.oss }}" >> $GITHUB_ENV
+          echo "DOCKERHUB_REPO=${{ github.repository_owner }}/metabase" >> "$GITHUB_ENV"
+          echo "DOCKERHUB_VERSION=${{ needs.check-version.outputs.oss }}" >> "$GITHUB_ENV"
         fi
 
     - name: Login to Docker Hub
@@ -255,8 +255,8 @@ jobs:
     - name: Tag the docker image
       run: | # sh
         docker buildx imagetools create --tag \
-          $DOCKERHUB_REPO\:$TAG_NAME \
-          $DOCKERHUB_REPO\:$DOCKERHUB_VERSION
+          "$DOCKERHUB_REPO:$TAG_NAME" \
+          "$DOCKERHUB_REPO:$DOCKERHUB_VERSION"
 
   push-git-tags:
     permissions:

.github/workflows/release.yml

@@ -281,7 +281,7 @@ jobs:
       commit: ${{ inputs.commit }}
       repo: ${{ vars.DOCKERHUB_OWNER }}/${{ vars.DOCKERHUB_REPO }}
       tag: ${{ needs.check-version.outputs.oss }}
-      release: ${{ 'true' }}
+      release: true
 
   containerize-ee:
     needs: check-version
@@ -292,7 +292,7 @@ jobs:
       commit: ${{ inputs.commit }}
       repo: ${{ vars.DOCKERHUB_OWNER }}/${{ vars.DOCKERHUB_REPO }}-enterprise
       tag: ${{ needs.check-version.outputs.ee }}
-      release: ${{ 'true' }}
+      release: true
 
   push-tags:
     needs: [verify-s3-download, containerize-oss, containerize-ee, check-version]
@@ -381,7 +381,8 @@ jobs:
       dot-x-tag: ${{ startsWith(matrix.tag, 'v') }}
 
   trigger-cloud-issues:
-    if: ${{ needs.check-version.outputs.kind == 'minor' || needs.check-version.outputs.kind == 'major' }}
+    # Only create issues in the cloud ops repository if this release happens in https://github.com/metabase/metabase.
+    if: ${{ github.repository == 'metabase/metabase' && (needs.check-version.outputs.kind == 'minor' || needs.check-version.outputs.kind == 'major') }}
     needs: [push-tags, check-version]
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 10

.github/workflows/repro-bot.yml

@@ -37,7 +37,7 @@ jobs:
           else
             ISSUE_NUMBER="${{ github.event.issue.number }}"
           fi
-          echo "number=$ISSUE_NUMBER" >> $GITHUB_OUTPUT
+          echo "number=$ISSUE_NUMBER" >> "$GITHUB_OUTPUT"
           echo "Issue: https://github.com/${{ github.repository }}/issues/$ISSUE_NUMBER"
 
         env:
@@ -58,7 +58,7 @@ jobs:
         run: git clone --bare "https://github.com/${{ github.repository }}.git" repro-bot/git/metabase
 
       - name: Capture Node.js path for MCP subprocesses
-        run: echo "NODE_BIN_DIR=$(dirname $(which node))" >> $GITHUB_ENV
+        run: echo "NODE_BIN_DIR=$(dirname "$(which node)")" >> "$GITHUB_ENV"
 
       - name: Pre-install MCP server dependencies
         run: uv sync --directory repro-bot/mcp
@@ -90,7 +90,7 @@ jobs:
             --main-opts '["-m" "clojure-mcp-light.nrepl-eval"]'
 
           # Add to PATH for the rest of the workflow
-          echo "$HOME/.bbin/bin" >> $GITHUB_PATH
+          echo "$HOME/.bbin/bin" >> "$GITHUB_PATH"
 
           # Verify
           clj-nrepl-eval --help | head -3

.github/workflows/resolve-backport-conflicts.yml

@@ -63,9 +63,9 @@ jobs:
         id: pkg
         run: |
           if [ -f "bun.lock" ] || [ -f "bun.lockb" ]; then
-            echo "mgr=bun" >> $GITHUB_OUTPUT
+            echo "mgr=bun" >> "$GITHUB_OUTPUT"
           else
-            echo "mgr=yarn" >> $GITHUB_OUTPUT
+            echo "mgr=yarn" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Validate backport PR
@@ -92,13 +92,15 @@ jobs:
           # Check if we're in a cherry-pick state with conflicts
           CONFLICTED=$(git diff --name-only --diff-filter=U || true)
           if [ -n "$CONFLICTED" ]; then
-            echo "has_conflicts=true" >> $GITHUB_OUTPUT
-            echo "conflicted_files<<EOF" >> $GITHUB_OUTPUT
-            echo "$CONFLICTED" >> $GITHUB_OUTPUT
-            echo "EOF" >> $GITHUB_OUTPUT
+            {
+              echo "has_conflicts=true"
+              echo "conflicted_files<<EOF"
+              echo "$CONFLICTED"
+              echo "EOF"
+            } >> "$GITHUB_OUTPUT"
             echo "::notice::Found conflicts in: $CONFLICTED"
           else
-            echo "has_conflicts=false" >> $GITHUB_OUTPUT
+            echo "has_conflicts=false" >> "$GITHUB_OUTPUT"
             echo "::notice::Cherry-pick applied cleanly, no conflicts to resolve"
           fi
 
@@ -208,23 +210,25 @@ jobs:
           if [ -f "${{ steps.claude.outputs.execution_file }}" ]; then
             SUBTYPE=$(jq -r '.[] | select(.type == "result") | .subtype' "${{ steps.claude.outputs.execution_file }}" | tail -1)
             if [ "$SUBTYPE" = "error_max_turns" ]; then
-              echo "max_turns_exceeded=true" >> $GITHUB_OUTPUT
+              echo "max_turns_exceeded=true" >> "$GITHUB_OUTPUT"
             else
-              echo "max_turns_exceeded=false" >> $GITHUB_OUTPUT
+              echo "max_turns_exceeded=false" >> "$GITHUB_OUTPUT"
             fi
           else
-            echo "max_turns_exceeded=false" >> $GITHUB_OUTPUT
+            echo "max_turns_exceeded=false" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Get commit details
         if: always() && steps.claude.outcome == 'success' && steps.check-failure.outputs.max_turns_exceeded != 'true'
         id: commit-info
         run: |
-          echo "sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
           FILES=$(git diff --name-only HEAD~1)
-          echo "changed_files<<EOF" >> $GITHUB_OUTPUT
-          echo "$FILES" >> $GITHUB_OUTPUT
-          echo "EOF" >> $GITHUB_OUTPUT
+          {
+            echo "sha=$(git rev-parse HEAD)"
+            echo "changed_files<<EOF"
+            echo "$FILES"
+            echo "EOF"
+          } >> "$GITHUB_OUTPUT"
 
       - name: Comment on PR (success)
         if: always() && steps.claude.outcome == 'success' && steps.check-failure.outputs.max_turns_exceeded != 'true'

.github/workflows/sdk-version-bump-pr.yml

@@ -3,6 +3,19 @@
 # package.template.json, then open a PR labeled `sdk-release-trigger`.
 # Merging that PR is what actually triggers a release, via the
 # `pull_request` trigger on release-embedding-sdk.yml.
+#
+# Release types (the dispatch form lists them in release-cycle order):
+#   beta     - release branch, before gold: publish a beta.
+#   patch    - release branch: graduate the beta to 0.N.0 at gold,
+#              then ship 0.N.1, 0.N.2 and so on after gold.
+#   preminor - master, at gold: move master to the next major.
+#   alpha    - master, any time: bump the development version.
+#   custom   - one-off branch (esbuild, data-apps): publish under its
+#              own prerelease id, which is reused on later bumps.
+#
+# The dispatch form's descriptions render as the input's label, which is a
+# single plain text node - newlines collapse to spaces and no markdown is
+# parsed. Keep them short and single-line; put detail here instead.
 name: SDK Version Bump PR
 run-name: Bump Embedding SDK version (${{ inputs.release_type }}) on ${{ github.ref_name }}
 
@@ -14,32 +27,26 @@ on:
         type: choice
         required: false
         options:
-          - Pick the branch in "Use workflow from" above
+          - Bumps the branch picked above
       release_type:
-        description: |
-          Before gold:
-          • beta — release branch: publish a beta
-
-          At gold:
-          • patch — release branch: graduate the beta to 0.N.0
-          • preminor — master: move master to the next major
-
-          After gold:
-          • patch — release branch: ship a patch (0.N.1, 0.N.2, ...)
-
-          Any time:
-          • alpha — master: bump the development version
-          • custom — one-off branch (esbuild, data-apps): publish under its own prerelease id
+        # Option names are capitalised for emphasis only - the values stay
+        # lowercase. The label renders as plain text, so caps is the only
+        # emphasis available (same reason prerelease_id below shouts FIRST).
+        description: "BETA - before gold, on a release branch. PATCH - at gold and after, on a release branch. PREMINOR - at gold, on master. ALPHA - any time, on master. CUSTOM - any time, on a one-off branch."
         type: choice
         required: true
+        # Pinned so the release-cycle ordering below does not decide the
+        # preselection: without a default, GitHub preselects the first option.
+        default: alpha
         options:
-          - alpha
           - beta
+          - patch # one entry, two phases: the version decides 0.N.0 vs 0.N.1
           - preminor
-          - patch
+          - alpha
           - custom
       prerelease_id:
-        description: "release_type=custom only, and only on the FIRST cut of a one-off branch (e.g. data-apps). Becomes the prerelease id in the version (0.62.5-data-apps.0) and the npm dist-tag (62-data-apps). Leave empty on later bumps - the id is reused from the current version."
+        # Left empty on later bumps, the id is reused from the current version.
+        description: "For release_type=custom only, and only on the FIRST cut of a one-off branch. Enter a name like data-apps: the version becomes 0.62.5-data-apps.0 and the dist-tag 62-data-apps. Leave empty on later bumps."
         type: string
         required: false
 
@@ -155,7 +162,10 @@ jobs:
           # --reviewer tags the team so a release is visible, not because anything
           # waits on a review. It needs the automation PAT: GITHUB_TOKEN cannot
           # resolve an org team.
-          gh pr create --base "$BRANCH" \
+          #
+          # gh prints the new PR's URL on stdout; capture it so the job summary
+          # can link the PR that this run opened.
+          pr_url=$(gh pr create --base "$BRANCH" \
                        --assignee "${GITHUB_ACTOR}" \
                        --reviewer metabase/embedding \
                        --label sdk-release-trigger \
@@ -163,7 +173,7 @@ jobs:
                        --body "$(cat <<'BODY'
           Bumps the Embedding SDK version in `package.template.json` and updates its `sdkRelease` metadata.
 
-          | | |
+          | Setting | Value |
           |---|---|
           | Branch | `${{ github.ref_name }}` |
           | Release type | `${{ inputs.release_type }}` |
@@ -177,4 +187,14 @@ jobs:
 
           _Opened by the [SDK Version Bump PR workflow](../actions/workflows/sdk-version-bump-pr.yml), triggered by @${{ github.event.sender.login }}._
           BODY
-          )"
+          )")
+
+          echo "pr_url=$pr_url" >> "$GITHUB_OUTPUT"
+
+      # Separate from "Append workflow summary" above: that step runs before the
+      # PR exists, so the link has to be appended after this one opens it.
+      - name: Append the PR link to the workflow summary
+        env:
+          PR_URL: ${{ steps.open-pr.outputs.pr_url }}
+        run: |
+          printf '\n**Version-bump PR:** %s\n' "$PR_URL" >> "$GITHUB_STEP_SUMMARY"

.github/workflows/security-slack-notification.yml

@@ -1,37 +0,0 @@
-name: Security Issue Slack Notification
-
-on:
-  issues:
-    types:
-      - labeled
-
-jobs:
-  on-issue-opened:
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 5
-    if: github.event.label.name == 'SECURITY'
-    steps:
-      - name: Setting title
-        uses: actions/github-script@v9
-        id: vars
-        with:
-          script: |
-            core.setOutput('issue_title', ${{ toJson(github.event.issue.title) }}.replaceAll(/"/g, '\\"'));
-      - name: Send the issue ${{ github.event.issue.number }} to Slack
-        id: slack
-        uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
-        with:
-          webhook: ${{ secrets.SLACK_SECURITY_WEBHOOK_URL }}
-          webhook-type: incoming-webhook
-          payload: |
-            {
-              "blocks": [
-                {
-                  "type": "section",
-                  "text": {
-                    "type": "mrkdwn",
-                    "text": "${{ steps.vars.outputs.issue_title }}\n${{ github.event.issue.html_url }}"
-                  }
-                }
-              ]
-            }

.github/workflows/semantic-search.yml

@@ -58,22 +58,11 @@ jobs:
         with:
           build-static-viz: ${{ matrix.job.build-static-viz }}
           junit-name: ${{ matrix.version.junit-name }}
+          artifact-suffix: ${{ matrix.job.name }}
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[${{ matrix.job.exclude-tag }}]'
           quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-      - name: Upload Test Results
-        uses: ./.github/actions/upload-test-results
-        if: always()
-        with:
-          input-path: ./target/junit/
-          output-name: ${{ github.job }}
-          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-          aws-region: ${{ vars.AWS_REGION }}
-          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   semantic-search-tests-mariadb:
     if: ${{ !inputs.skip }}
@@ -109,6 +98,8 @@ jobs:
           POSTGRES_PASSWORD: postgres
       mysql:
         image: ${{ matrix.version.mariadb-image }}
+        # disposable CI database: a RAM-backed datadir makes DDL/insert fsyncs free
+        options: --tmpfs /var/lib/mysql:rw
         ports:
           - "3306:3306"
         env:
@@ -133,22 +124,11 @@ jobs:
         with:
           build-static-viz: ${{ matrix.job.build-static-viz }}
           junit-name: ${{ matrix.version.junit-name }}
+          artifact-suffix: ${{ matrix.job.name }}
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[${{ matrix.job.exclude-tag }}]'
           quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-      - name: Upload Test Results
-        uses: ./.github/actions/upload-test-results
-        if: always()
-        with:
-          input-path: ./target/junit/
-          output-name: ${{ github.job }}
-          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-          aws-region: ${{ vars.AWS_REGION }}
-          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   semantic-search-tests-mysql:
     if: ${{ !inputs.skip }}
@@ -191,6 +171,8 @@ jobs:
           POSTGRES_PASSWORD: postgres
       mysql:
         image: ${{ matrix.version.mysql-image }}
+        # disposable CI database: a RAM-backed datadir makes DDL/insert fsyncs free
+        options: --tmpfs /var/lib/mysql:rw
         ports:
           - "3306:3306"
         env:
@@ -215,22 +197,11 @@ jobs:
         with:
           build-static-viz: ${{ matrix.job.build-static-viz }}
           junit-name: ${{ matrix.version.junit-name }}
+          artifact-suffix: ${{ matrix.job.name }}
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[${{ matrix.job.exclude-tag }}]'
           quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-      - name: Upload Test Results
-        uses: ./.github/actions/upload-test-results
-        if: always()
-        with:
-          input-path: ./target/junit/
-          output-name: ${{ github.job }}
-          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-          aws-region: ${{ vars.AWS_REGION }}
-          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   semantic-search-tests-postgres:
     if: ${{ !inputs.skip }}
@@ -291,22 +262,11 @@ jobs:
         with:
           build-static-viz: ${{ matrix.job.build-static-viz }}
           junit-name: ${{ matrix.version.junit-name }}
+          artifact-suffix: ${{ matrix.job.name }}
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[${{ matrix.job.exclude-tag }}]'
           quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-      - name: Upload Test Results
-        uses: ./.github/actions/upload-test-results
-        if: always()
-        with:
-          input-path: ./target/junit/
-          output-name: ${{ github.job }}
-          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-          aws-region: ${{ vars.AWS_REGION }}
-          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   # pgvector-on-the-app-db mode: the app db itself is a pgvector-capable Postgres and
   # MB_PGVECTOR_DB_URL is deliberately unset. The dedicated-harness tests gate themselves off; the
@@ -357,22 +317,11 @@ jobs:
         with:
           build-static-viz: ${{ matrix.job.build-static-viz }}
           junit-name: ${{ matrix.version.junit-name }}
+          artifact-suffix: ${{ matrix.job.name }}
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[${{ matrix.job.exclude-tag }}]'
           quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-      - name: Upload Test Results
-        uses: ./.github/actions/upload-test-results
-        if: always()
-        with:
-          input-path: ./target/junit/
-          output-name: ${{ github.job }}
-          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-          aws-region: ${{ vars.AWS_REGION }}
-          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   semantic-search-tests-result:
     needs:

.github/workflows/set-milestone.yml

@@ -15,6 +15,8 @@ on:
 jobs:
   set-milestone:
     name: Automatically set milestone
+    # Only run set-milestone in https://github.com/metabase/metabase since this is the only place milestones are used.
+    if: github.repository == 'metabase/metabase'
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 30
     permissions:

.github/workflows/snowplow.yml

@@ -1,75 +0,0 @@
-name: Snowplow
-
-on:
-  pull_request:
-    branches:
-      - '**'
-
-jobs:
-  files-changed:
-    name: Check which files changed
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 3
-    outputs:
-      snowplow: ${{ steps.changes.outputs.snowplow }}
-    steps:
-      - uses: actions/checkout@v6
-      - name: Test which files changed
-        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
-        id: changes
-        with:
-          token: ${{ github.token }}
-          filters: .github/file-paths.yaml
-
-  lint:
-    needs: files-changed
-    if: needs.files-changed.outputs.snowplow == 'true'
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-      - name: Set up Java
-        uses: actions/setup-java@v5.2.0
-        with:
-          distribution: temurin
-          java-version: 25
-      - name: Set up Babashka
-        uses: turtlequeue/setup-babashka@d78ec6570aea3b614bc695cafcceb82eb45c2af9 # v1.8.0
-        with:
-          babashka-version: 1.12.197
-      - name: Install igluctl
-        run: |
-          set -euo pipefail
-          curl -fsSL -o "$RUNNER_TEMP/igluctl.zip" https://github.com/snowplow/igluctl/releases/download/0.13.0/igluctl_0.13.0.zip
-          echo "0eac19121fca1431dec44738ada8eacc4242811a95d015ee71e00deec2b4d748  $RUNNER_TEMP/igluctl.zip" | sha256sum -c -
-          unzip -q "$RUNNER_TEMP/igluctl.zip" -d "$RUNNER_TEMP/igluctl"
-          chmod +x "$RUNNER_TEMP/igluctl/igluctl"
-          echo "$RUNNER_TEMP/igluctl" >> "$GITHUB_PATH"
-      - name: Lint (igluctl)
-        # igluctl recursively parses every file as JSON, so it chokes on colocated
-        # *.md docs and on two schemas whose internal `self.version` doesn't match
-        # the filename version (pending Snowcat audit). Stage a filtered copy and
-        # patch only the `self.version` mismatch so igluctl still lints the rest
-        # of those schemas.
-        run: |
-          set -euo pipefail
-          LINT_ROOT="$RUNNER_TEMP/iglu-lint"
-          rm -rf "$LINT_ROOT"
-          mkdir -p "$LINT_ROOT"
-          cp -r snowplow/iglu-client-embedded/schemas "$LINT_ROOT/"
-          find "$LINT_ROOT" -name '*.md' -delete
-          # TODO(BOT-1403): drop these patches once the Snowcat audit fixes the
-          # internal `self.version` mismatch on these two schemas. We rewrite
-          # only `self.version` in the staged copy so the file's path version
-          # matches what igluctl expects; every other lint rule still runs.
-          # Each `sed` invocation uses the schema's wrong/right pair, so it
-          # silently no-ops once the underlying schema is fixed.
-          sed -i 's/"version": "1-0-1"/"version": "1-0-2"/' \
-            "$LINT_ROOT/schemas/com.metabase/embed_share/jsonschema/1-0-2"
-          sed -i 's/"version": "1-0-0"/"version": "1-0-1"/' \
-            "$LINT_ROOT/schemas/com.metabase/serialization/jsonschema/1-0-1"
-          igluctl lint "$LINT_ROOT/schemas"
-      - name: Lint (Metabase schema rules)
-        run: ./bin/lint-snowplow-schemas.bb
-      - name: Test linter rules
-        run: ./bin/lint-snowplow-schemas-test.bb

.github/workflows/snyk.yml

@@ -10,6 +10,7 @@ on:
       - "**/package.json"
       - ".github/workflows/snyk.yml"
       - ".github/scripts/write-poms.sh"
+      - ".github/scripts/fix-yarn-lock-aliases.ts"
   schedule:
     - cron: "0 5 * * *"
 
@@ -58,18 +59,22 @@ jobs:
         # Snyk doesn't support bun.lock yet, so we generate yarn.lock and scan that.
         # Bun has a bug where it normalizes "< 3.0.0" to "< 3" in alias entries
         # but not in dependency specs, causing Snyk to fail matching dependencies.
-        # The sed commands fix this inconsistency. They continue on error to let
-        # Snyk report parsing issues directly rather than failing on the workaround.
+        # The sed commands fix this inconsistency. Bun also names aliased entries
+        # after the aliased package instead of the alias, which the script fixes.
+        # Both continue on error to let Snyk report parsing issues directly rather
+        # than failing on the workaround.
       - name: Generate yarn.lock
         if: matrix.project.file == 'yarn.lock'
         run: |
           bun install --yarn
           sed -i -E 's/< ([0-9]+)\.0\.0"/< \1"/g; s/< ([0-9]+)\.0"/< \1"/g' yarn.lock || true
+          bun ${{ github.workspace }}/.github/scripts/fix-yarn-lock-aliases.ts || true
       - name: Generate release/yarn.lock
         if: matrix.project.file == 'release/yarn.lock'
         run: |
           bun install --yarn
           sed -i -E 's/< ([0-9]+)\.0\.0"/< \1"/g; s/< ([0-9]+)\.0"/< \1"/g' yarn.lock || true
+          bun ${{ github.workspace }}/.github/scripts/fix-yarn-lock-aliases.ts || true
         working-directory: release
       - uses: snyk/actions/setup@9adf32b1121593767fc3c057af55b55db032dc04 # v1.0.0
       - name: Run snyk test

.github/workflows/sync-fork.yml

@@ -24,18 +24,25 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Generate workflow summary
+        env:
+          RELEASE_BRANCH_COUNT: ${{ inputs.release_branch_count || 5 }}
+          FORCE: ${{ inputs.force || false }}
+          EVENT_NAME: ${{ github.event_name }}
+          SENDER: ${{ github.event.sender.login }}
         run: |
-          echo '**Inputs:**' >> $GITHUB_STEP_SUMMARY
-          echo '' >> $GITHUB_STEP_SUMMARY
-          echo '- `release_branch_count`: ${{ inputs.release_branch_count || 5 }}' >> $GITHUB_STEP_SUMMARY
-          echo '- `force`: ${{ inputs.force || false }}' >> $GITHUB_STEP_SUMMARY
-          echo '- `trigger`: ${{ github.event_name }}' >> $GITHUB_STEP_SUMMARY
-          echo '' >> $GITHUB_STEP_SUMMARY
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            echo 'triggered by: @${{ github.event.sender.login }}' >> $GITHUB_STEP_SUMMARY
-          else
-            echo 'triggered by: schedule' >> $GITHUB_STEP_SUMMARY
-          fi
+          {
+            echo '**Inputs:**'
+            echo ''
+            echo "- \`release_branch_count\`: $RELEASE_BRANCH_COUNT"
+            echo "- \`force\`: $FORCE"
+            echo "- \`trigger\`: $EVENT_NAME"
+            echo ''
+            if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
+              echo "triggered by: @$SENDER"
+            else
+              echo 'triggered by: schedule'
+            fi
+          } >> "$GITHUB_STEP_SUMMARY"
 
   sync-master:
     # ONLY run on internal metabase org forks — NEVER on the public repo or external forks
@@ -89,9 +96,9 @@ jobs:
           REPO: ${{ github.repository }}
         run: |
           if [ "${{ steps.sync.outcome }}" = "success" ]; then
-            echo "| [\`master\`](https://github.com/${REPO}/tree/master) | ✅ ${{ steps.sync.outputs.detail }} |" >> $GITHUB_STEP_SUMMARY
+            echo "| [\`master\`](https://github.com/${REPO}/tree/master) | ✅ ${{ steps.sync.outputs.detail }} |" >> "$GITHUB_STEP_SUMMARY"
           else
-            echo "| [\`master\`](https://github.com/${REPO}/tree/master) | ❌ failed |" >> $GITHUB_STEP_SUMMARY
+            echo "| [\`master\`](https://github.com/${REPO}/tree/master) | ❌ failed |" >> "$GITHUB_STEP_SUMMARY"
           fi
 
   list-release-branches:
@@ -190,7 +197,7 @@ jobs:
         run: |
           branch="${{ matrix.branch }}"
           if [ "${{ steps.sync.outcome }}" = "success" ]; then
-            echo "| [\`${branch}\`](https://github.com/${REPO}/tree/${branch}) | ✅ ${{ steps.sync.outputs.detail }} |" >> $GITHUB_STEP_SUMMARY
+            echo "| [\`${branch}\`](https://github.com/${REPO}/tree/${branch}) | ✅ ${{ steps.sync.outputs.detail }} |" >> "$GITHUB_STEP_SUMMARY"
           else
-            echo "| [\`${branch}\`](https://github.com/${REPO}/tree/${branch}) | ❌ failed |" >> $GITHUB_STEP_SUMMARY
+            echo "| [\`${branch}\`](https://github.com/${REPO}/tree/${branch}) | ❌ failed |" >> "$GITHUB_STEP_SUMMARY"
           fi

.github/workflows/team-issues-slack-notification.yml

@@ -1,114 +0,0 @@
-# .github/workflows/team-issues-slack-notification.yml
-#
-# Posts newly team-labeled bugs to the team's Slack channel (e.g.
-# #team-graphy-bugs), now including a link to the synced Linear issue.
-#
-# Changes from the current version:
-# - Checks out .github/scripts so we can reuse find-linear-issue.js
-# - The message-building step now queries Linear (via attachmentsForURL)
-#   with a short retry, and appends "Linear: <link|ID>" when found
-# - Degrades gracefully: if no Linear issue is attached (or the API is
-#   down), the message posts without the Linear issue link
-
-name: Team Issues Slack Notification
-
-on:
-  issues:
-    types:
-      - labeled
-
-jobs:
-  on-team-label-added:
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 5
-    if: |
-      contains(github.event.label.name, '.Team/') &&
-       ( contains(github.event.issue.labels.*.name, 'Type:Bug') ||
-         contains(github.event.issue.labels.*.name, 'flaky-test-fix') )
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          sparse-checkout: .github/scripts
-
-      - name: Build Slack message (with Linear link if available)
-        uses: actions/github-script@v9
-        id: vars
-        env:
-          LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}
-        with:
-          script: |
-            const { findLinearIssue } = require('./.github/scripts/find-linear-issue.js');
-
-            const title = context.payload.issue.title;
-            const issueUrl = context.payload.issue.html_url;
-
-            let text = title + '\n' + issueUrl;
-
-            // The Linear issue is usually already synced by the time the
-            // team label lands at triage, but retry briefly just in case.
-            try {
-              const delaysSeconds = [0, 15, 30];
-              let result = null;
-
-              for (const delay of delaysSeconds) {
-                if (delay) await new Promise((r) => setTimeout(r, delay * 1000));
-                result = await findLinearIssue({
-                  githubIssueUrl: issueUrl,
-                  linearApiKey: process.env.LINEAR_API_KEY,
-                });
-                if (result.success) break;
-              }
-
-              if (result && result.success) {
-                const id = result.issue; // e.g. "GIT-1234"
-                text += `\nLinear: <https://linear.app/metabase/issue/${id}|${id}>`;
-              } else {
-                core.info(`No Linear issue found for ${issueUrl}; posting without link.`);
-              }
-            } catch (e) {
-              // Never block the notification on a Linear lookup failure
-              core.warning(`Linear lookup failed: ${e.message}`);
-            }
-
-            core.setOutput('message', JSON.stringify(text));
-
-      - name: Extracting team name
-        id: team_name
-        env:
-          LABEL_NAME: ${{ github.event.label.name }}
-        run: |
-          team_label="${LABEL_NAME//&/$}"
-          echo "$team_label"
-          team_name=${team_label#*.Team/}
-          echo "$team_name"
-          echo "team_name=${team_name^^}_SLACK_ISSUES_WEBHOOK_URL" >> "$GITHUB_OUTPUT"
-      - name: Check webhook secret exists
-        id: check_secret
-        env:
-          WEBHOOK_URL: ${{ secrets[steps.team_name.outputs.team_name] }}
-        run: |
-          if [ -z "$WEBHOOK_URL" ]; then
-            echo "Secret ${{ steps.team_name.outputs.team_name }} is not set, skipping Slack notification"
-            echo "exists=false" >> "$GITHUB_OUTPUT"
-          else
-            echo "exists=true" >> "$GITHUB_OUTPUT"
-          fi
-      - name: Send the issue ${{ github.event.issue.number }} to Slack
-        if: steps.check_secret.outputs.exists == 'true'
-        id: slack
-        uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c # v3.0.3
-        with:
-          webhook: ${{ secrets[steps.team_name.outputs.team_name] }}
-          webhook-type: incoming-webhook
-          payload: |
-            {
-              "blocks": [
-                {
-                  "type": "section",
-                  "text": {
-                    "type": "mrkdwn",
-                    "text": ${{ steps.vars.outputs.message }}
-                  }
-                }
-              ]
-            }

.github/workflows/transforms-python-stress-test.yml

@@ -25,7 +25,6 @@ on:
           - sqlserver
 
 permissions:
-  id-token: write
   contents: read
   checks: write
   actions: read
@@ -61,18 +60,9 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-bigquery-transforms'
+        granular-rerun: 'false'
         test-args: >-
           :only-tags [:mb/transforms-python-test]
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
-        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
     - name: Cleanup python-runner
       if: always()
       uses: ./.github/actions/cleanup-python-runner
@@ -121,18 +111,9 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-clickhouse-transforms'
+        granular-rerun: 'false'
         test-args: >-
           :only-tags [:mb/transforms-python-test]
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
-        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
     - name: Cleanup python-runner
       if: always()
       uses: ./.github/actions/cleanup-python-runner
@@ -171,18 +152,9 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-mongo-transforms'
+        granular-rerun: 'false'
         test-args: >-
           :only-tags [:mb/transforms-python-test]
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
-        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
     - name: Cleanup python-runner
       if: always()
       uses: ./.github/actions/cleanup-python-runner
@@ -225,18 +197,9 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-mysql-transforms'
+        granular-rerun: 'false'
         test-args: >-
           :only-tags [:mb/transforms-python-test]
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
-        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
     - name: Cleanup python-runner
       if: always()
       uses: ./.github/actions/cleanup-python-runner
@@ -280,18 +243,9 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-postgres-transforms'
+        granular-rerun: 'false'
         test-args: >-
           :only-tags [:mb/transforms-python-test]
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
-        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
     - name: Cleanup python-runner
       if: always()
       uses: ./.github/actions/cleanup-python-runner
@@ -325,18 +279,9 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-redshift-transforms'
+        granular-rerun: 'false'
         test-args: >-
           :only-tags [:mb/transforms-python-test]
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
-        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
     - name: Cleanup python-runner
       if: always()
       uses: ./.github/actions/cleanup-python-runner
@@ -379,18 +324,9 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-snowflake-transforms'
+        granular-rerun: 'false'
         test-args: >-
           :only-tags [:mb/transforms-python-test]
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
-        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
     - name: Cleanup python-runner
       if: always()
       uses: ./.github/actions/cleanup-python-runner
@@ -431,18 +367,9 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-sqlserver-transforms'
+        granular-rerun: 'false'
         test-args: >-
           :only-tags [:mb/transforms-python-test]
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
-        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
     - name: Cleanup python-runner
       if: always()
       uses: ./.github/actions/cleanup-python-runner

.github/workflows/translation-update.yml

@@ -59,7 +59,7 @@ jobs:
         run: | # sh
           git config user.name github-actions
           git config user.email github-actions@github.com
-          git checkout -b $BRANCH_NAME
+          git checkout -b "$BRANCH_NAME"
 
           DATE=$(date +'%Y-%m-%d')
 
@@ -72,7 +72,7 @@ jobs:
 
           git add locales/
           git commit -a -m "Update translations $Date" --allow-empty --no-verify
-          git push -u origin $BRANCH_NAME
+          git push -u origin "$BRANCH_NAME"
 
       - name: Upload i18n violations report
         id: upload-violations
@@ -105,7 +105,7 @@ jobs:
 
           URL=$(gh pr create \
             --base master \
-            --head $BRANCH_NAME \
+            --head "$BRANCH_NAME" \
             --title "Update translations $DATE" \
             --body "Synchronize translations with Crowdin" \
             --label "no-backport" \
@@ -113,7 +113,7 @@ jobs:
 
           PR_NUMBER=${URL##*/}
 
-          echo "pr_number=$PR_NUMBER" >> $GITHUB_OUTPUT
+          echo "pr_number=$PR_NUMBER" >> "$GITHUB_OUTPUT"
 
       - name: Comment violations summary on PR
         if: ${{ steps.create_pr.outputs.pr_number && hashFiles('target/i18n-violations.csv') != '' }}

.github/workflows/uberjar.yml

@@ -78,7 +78,7 @@ jobs:
             echo "Skipping build: artifacts exist for this commit hash"
           fi
 
-          echo "should_build=$SHOULD_BUILD" >> $GITHUB_OUTPUT
+          echo "should_build=$SHOULD_BUILD" >> "$GITHUB_OUTPUT"
 
   # if this is on a release branch, we need to check the build requirements
   get-build-requirements:
@@ -154,10 +154,22 @@ jobs:
           name: metabase-bundle-stats-${{ matrix.edition }}-${{ github.event.inputs.commit || github.event.pull_request.head.sha || github.sha }}
           path: target/bundle-stats
           if-no-files-found: warn
-      - name: Prepare uberjar artifact
-        uses: ./.github/actions/prepare-uberjar-artifact
+      - name: Mark with the commit hash
+        run: git rev-parse --short HEAD > COMMIT-ID
+        shell: bash
+      - name: Calculate SHA256 checksum
+        run: sha256sum ./target/uberjar/metabase.jar > SHA256.sum
+        shell: bash
+      - name: Upload JARs as artifact
+        uses: actions/upload-artifact@v7
         with:
-          edition: ${{ matrix.edition }}
+          # Same key the artifact lookups use, so a build for an explicitly dispatched commit
+          # uploads where `check-existing-artifacts` and `check-jar-health` go looking for it.
+          name: metabase-${{ matrix.edition }}-${{ github.event.inputs.commit || github.event.pull_request.head.sha || github.sha }}-uberjar
+          path: |
+            ./target/uberjar/metabase.jar
+            ./COMMIT-ID
+            ./SHA256.sum
 
   check-jar-health:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}

.github/workflows/update-e2e-timings.yml

@@ -61,7 +61,7 @@ jobs:
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
           BRANCH_NAME="update-e2e-timings-$(date +%Y%m%d-%H%M%S)"
-          echo "BRANCH_NAME=$BRANCH_NAME" >> $GITHUB_ENV
+          echo "BRANCH_NAME=$BRANCH_NAME" >> "$GITHUB_ENV"
           echo "Branch name will be: $BRANCH_NAME"
 
       - name: Create Pull Request

.github/workflows/whitespace.yml

@@ -1,20 +0,0 @@
-name: Whitespace
-
-on:
-  push:
-    branches:
-      - 'master'
-      - 'release-**'
-  pull_request:
-  merge_group:
-
-jobs:
-  whitespace-linter:
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 5
-    steps:
-    - uses: actions/checkout@v6
-    - name: Prepare back-end environment
-      uses: ./.github/actions/prepare-backend
-    - run: clojure -T:whitespace-linter lint :whitespace-linter/progress-bar false
-      name: Run Whitespace Linter

.github/workflows/yaml.yml

@@ -1,34 +0,0 @@
-name: YAML
-
-on:
-  push:
-    branches:
-      - 'master'
-      - 'release-**'
-  pull_request:
-
-jobs:
-  files-changed:
-    name: Check which files changed
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 3
-    outputs:
-      yaml: ${{ steps.changes.outputs.yaml }}
-    steps:
-      - uses: actions/checkout@v6
-      - name: Test which files changed
-        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
-        id: changes
-        with:
-          token: ${{ github.token }}
-          filters: .github/file-paths.yaml
-
-  yaml-linter:
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    if: needs.files-changed.outputs.yaml == 'true'
-    timeout-minutes: 10
-    steps:
-    - uses: actions/checkout@v6
-    - name: Prepare front-end environment
-      uses: ./.github/actions/prepare-frontend
-    - run: bun run lint-yaml

.gitignore

@@ -62,6 +62,8 @@ cypress.env.json
 /e2e/coverage-manifest
 /e2e/coverage/analysis
 /e2e/coverage/spec-file-manifest.json
+/e2e/coverage/spec-test-manifest.json
+/e2e/coverage/openapi.json
 /e2e/support/.nyc_output
 /e2e/support/coverage
 /e2e/support/e2e