bump

* Fix layout shift when switching tabs on the transform job page

The job Overview and Run history pages each rendered their own header:
Overview used an editable name input plus a `...` menu, while Run history
used a static title with no menu. The differing heights shifted the tab
row, so the clicked tab jumped when switching between the two.

Extract a shared JobHeader component (and a useJobHeaderState hook for the
readOnly/name-change logic) rendered identically by both pages, mirroring
the MetricHeader pattern. Run history now also shows the `...` menu and the
editable name, and Metabot is consistent across both tabs.

* Unify JobPage header logic with useJobHeaderState

JobPage duplicated the readOnly computation and name-change handler that
now live in useJobHeaderState. Source them from the hook instead; keep the
local useTransformPermissions call only for the page-level loading gate.

* Use strict undefined comparisons in job header code

Address review: job/jobId are never null, so compare with undefined
strictly and derive jobId from job.id in the JobHeader render.

.claude/commands/fix-flaky-test.md

@@ -1,297 +0,0 @@
----
-description: Diagnose and fix a flaky Cypress e2e test, then verify the fix with CI stress runs in a bounded loop
----
-
-Fix flaky e2e test: $ARGUMENTS
-
-You are orchestrating a **bounded flake-fix loop** with a real CI feedback signal. The
-only integration tool for the loop is `gh` (trigger the stress workflow + read results).
-The Linear issue is the input. Everything else is reasoning over files.
-
-**Hard rules — do not deviate:**
-- **Max 3 attempts.** One attempt = diagnose → fix → push → 2 stress runs → interpret.
-  After 3 failed attempts, stop and hand back.
-- **Branch existence is the go/no-go gate.** Before starting, check whether the remote branch
-  `automated-e2e-flake-fix-<LINEAR_ID>` already exists (Phase 0). If it does, a run
-  is already in flight (or already landed a fix) → **stop, do nothing**. If it doesn't,
-  proceed through the whole loop and push without pausing for confirmation. This runs
-  identically whether a human or automation triggered the command.
-- **Linear access:** prefer the Linear MCP (`mcp__linear__*`); if it's unavailable (e.g.
-  headless CI), fall back to the Linear REST/GraphQL API with a token — for both reads and
-  comment writes.
-- **Always write to the *resolved* issue, never the raw `$ARGUMENTS` ref.** Issues are born
-  `DEV-####` and **re-keyed when moved to another team** (`DEV-2180` → `UXW-4514`). `get_issue`
-  resolves the old ref (it's redirect-aware), but `list_comments`/`save_comment` with the stale
-  ref **404**. Capture the issue's UUID + current identifier in Phase 0 and use the **UUID** for
-  every Linear read/write.
-- **Heartbeat — post progress at every phase boundary.** It's the only run-visibility in
-  headless CI (the GH job log isn't streamed live), so never skip it. Prefer ONE rolling comment
-  (record its id in the state file, update it in place); if your write path can't update, post
-  terse per-phase comments instead. Update at: run start (+ `GITHUB_ACTIONS_RUN_URL` if set),
-  diagnosis done (#1 reason + hypothesis), branch pushed + **both stress run URLs**, and each
-  attempt's verdict.
-- **Each attempt triggers TWO stress runs in parallel** — `enable_network_throttling=true`
-  and `=false` — on the same branch/commit. The fix is verified only if **both** pass.
-- **CI is the source of truth.** No local Cypress runs, no `bin/` stress scripts.
-- **Branch names use `-` only, never `/`.**
-- **Persist state** to a scratch file so the loop survives `ScheduleWakeup` and context
-  summarization.
-
----
-
-## Phase 0 — Resolve the target
-
-1. Parse `$ARGUMENTS`:
-   - If it's a Linear ref (`DEV-####` or a Linear URL) → `mcp__linear__get_issue`. **Capture the
-     issue's UUID + current identifier + team** from the response and use them for all later
-     Linear ops (the ref you were handed may be stale — see the Linear-access rule). Read the
-     body for failure detail / screenshots / stack, and capture the **ranked failure reasons**
-     (Trunk lists them "most common" first) — #1 is what you fix first (Phase 1).
-   - **Derive the grep from the FULL Trunk test title, verbatim.** Trunk's `Test:` field is the
-     complete runtime title (e.g. `data model > data studio Undos allows to undo every action`).
-     Use the **whole string** as the grep — do **not** split on `>` or reduce it to the leaf
-     `it()` name. The `>` is often part of a `describe.each("… > %s")` template, not a separator,
-     and the discriminator (`data studio` vs `admin`) lives mid-title; dropping it makes the grep
-     match sibling parameterizations and burn the stress run on the wrong (non-flaky) branch.
-   - Otherwise treat it as a spec path or fuzzy test name (fallback; no Linear context).
-2. **Compute the branch name + dedup gate (this is the go decision).** `<LINEAR_ID>` is the **bare**
-   dispatched Linear identifier (e.g. `DEV-2180`) — the same value the workflow uses to build the
-   branch (`automated-e2e-flake-fix-<LINEAR_ID>`). If `$ARGUMENTS` is a Linear **URL**, extract the
-   `DEV-####` identifier from it first — a URL contains `/` and is not a valid branch component.
-   The branch name is derived **only** from `<LINEAR_ID>`, and it's the **dispatched** identifier —
-   never the re-keyed canonical id (so dedup stays stable across a team move) and never the test
-   name:
-   `automated-e2e-flake-fix-<LINEAR_ID>` (e.g. `DEV-2181` →
-   `automated-e2e-flake-fix-DEV-2181`). Check whether it already exists on the remote:
-   ```bash
-   git ls-remote --exit-code --heads origin automated-e2e-flake-fix-<LINEAR_ID>
-   ```
-   - **Exists (exit 0)** → a run is already in flight or already landed a fix → **stop, do
-     nothing.** This is the whole dedup mechanism.
-   - **Doesn't exist (exit 2)** → that's the **go** signal. Proceed without pausing for
-     confirmation.
-   (On the no-Linear fallback path there's no ref to build the name from; that path stays
-   interactive and is for local debugging only.)
-3. **Resolve the spec file** using the leaf `it()` name (just to locate the file):
-   ```bash
-   grep -rl "<leaf it() name>" e2e/test/scenarios
-   ```
-   Require **exactly one** *file* match. If 0 or >1, stop and ask the user to disambiguate. (Try
-   a shorter unique substring if the literal has special characters.) The **grep** passed to the
-   stress run is still the **full title** from step 1 — the leaf name is only for finding the file.
-   - **Watch for parameterized suites.** A single source `it()` under `describe.each(...)` /
-     `forEach` expands into **N runtime tests** (one per parameter), so one source match does
-     **not** mean one runtime test. Confirm the full-title grep targets exactly the flaky
-     parameterization (its discriminator must be present), or the stress run also executes the
-     non-flaky siblings — slow, and it dilutes `burn_in`.
-4. **Decide `qa_db`:** scan the spec / its `describe` for external-DB helpers
-   (postgres/mysql/mongo-writable) or an `@external` tag → `true`, else `false`.
-5. **Write the state file** `local/claude/e2e-flake-fix/<LINEAR_ID>.md`:
-   ```markdown
-   # Flake fix: <test name>
-   - linear_ref (dispatched): <DEV-#### or n/a>
-   - linear_uuid: <issue UUID — use for ALL Linear writes>
-   - linear_current_id: <e.g. UXW-#### — current identifier>
-   - heartbeat_comment_id: <set after the first progress comment>
-   - spec: <spec path>
-   - grep (full Trunk title): <full runtime title — NOT the leaf it() name>
-   - qa_db: <true|false>
-   - edition: ee
-   - branch: automated-e2e-flake-fix-<LINEAR_ID>
-   - attempt: 0 / 3
-
-   ## Failure reasons (Trunk, ranked — fix #1 first)
-   1. <dominant / most common>
-   2. <rarer>
-   ...
-
-   ## Attempts
-   ```
-   This file is the durable record. Re-read it on every `ScheduleWakeup` wake.
-
-## Phase 1 — Diagnose (run at the start of every attempt)
-
-- **Anchor on the #1 / most-common failure reason first.** Trunk lists the issue's failure
-  reasons ranked by frequency ("The N most common failure reasons…"). Fix the **dominant**
-  one and ignore the rarer reasons (#2, #3, …) unless the dominant one is fixed and they
-  still surface in CI. Do **not** rabbit-hole on a lower-frequency reason — that is the most
-  common way this loop wastes its 3 attempts. (Capture the ranked reasons in the state file
-  during Phase 0 so each attempt re-grounds on #1.)
-- Read the spec, focused on the failing test, its `describe`, and any `before*`/`after*`
-  hooks. Read shared helpers it calls.
-- Apply the flake anti-pattern checklist (from the `e2e-test-review` skill, as a mental
-  model — don't invoke it):
-  - numeric `cy.wait(<ms>)` instead of waiting on an alias
-  - `cy.intercept` registered **after** the action that triggers the request
-  - `.should("not.exist")` / negative assertions without a positive anchor first
-  - unscoped text selectors that can match more than one element
-  - off-by-one `.last()` / `.eq(-1)` without a length assertion
-  - JS conditionals on `cy` chains (no retry semantics)
-  - shared state / ordering assumptions between tests
-- Fold in any failure detail from the Linear issue (and, on attempts 2–3, the downloaded
-  CI artifacts from the previous attempt).
-- Write a **concrete hypothesis** to the state file's Attempts log before editing code.
-
-## Phase 2 — Fix on a branch
-
-- On **attempt 1 only**, create the branch computed in Phase 0 (dashes only, no `/`):
-  ```bash
-  git switch -c automated-e2e-flake-fix-<LINEAR_ID>
-  ```
-  On later attempts, keep committing to the same branch.
-- Apply a **minimal** fix:
-  - **Default:** test-scoped (deterministic waits via `cy.intercept` + `cy.wait("@alias")`
-    before asserting; positive anchor before a negative assertion; scoped selectors).
-  - **Source code is allowed** only when you have **high conviction** the root cause is a
-    real product defect the test merely surfaces (e.g. a genuine race or non-deterministic
-    ordering). When you do, write the evidence for that conviction in the state file and
-    keep the **blast radius minimal**.
-
-## Phase 2.5 — Share the diagnosis on Linear (before pushing)
-
-- Once you have a confirmed root cause and a fix in hand, **before** the push/CI gate, post
-  the **debugging story** to the resolved issue (this doubles as the diagnosis heartbeat).
-  Keep it a tight narrative: the observed failure, the root cause (why the request never
-  fires), and the fix. Skip silently only if there's no Linear issue (spec/test fallback path).
-- **Interactive vs headless:** when a human is driving interactively, draft it and let them
-  edit/approve first. When running **non-interactively** (headless CI, or the invocation says
-  not to ask), **just post it — never wait for an approval that can't come.**
-- This is separate from the Phase 5 closeout comment — the value here is capturing the *why*
-  while it's fresh, independent of whether CI later confirms.
-
-## Phase 3 — Push + stress (burn_in=50, fail_fast=true)
-
-**One run, `fail_fast=true`, does both jobs.** A bad fix fails on the **first** iteration
-and stops immediately (fast red + artifacts) — no need for a separate cheap sanity stage.
-A good fix runs all 50 to green (full confirmation). So every attempt is a single pair of
-runs at `burn_in=50` with `fail_fast=true` (throttle on + off).
-
-- **Push without pausing for confirmation.** The branch-existence check in Phase 0 was the
-  go decision; if you reached this phase you're clear to commit, push, and trigger (same for
-  a human or automated trigger).
-- Commit and push (first attempt only creates the branch; later attempts push the revised
-  fix), then trigger.
-
-- **Decide `build_jar` (cumulative across the branch, not per-attempt).** With
-  `build_jar=false` the run downloads a prebuilt uberjar by walking the current commit's
-  ancestors; with `build_jar=true` it builds the uberjar from this branch, so the JAR is
-  guaranteed to match your source. Rule:
-  - If **every** commit on the branch (vs. the base) touches **only** test/spec code →
-    `build_jar=false`. There is no source change for a JAR to miss, so a download is correct
-    and saves the build time.
-  - If **any** commit on the branch changed backend or frontend source — whether this attempt
-    made it or an earlier one did → `build_jar=true`, and keep it `true` on every later run
-    (including a test-only attempt 2). We build defensively: it may be redundant if a matching
-    branch JAR already exists, but it removes any doubt that the stress run tested your actual
-    source. A redundant build is far cheaper than a hard-to-debug false green from a JAR that
-    silently didn't include the fix.
-  - Check with `git diff --name-only <base>...HEAD` and treat anything outside test paths
-    (`e2e/`, `**/*_test.clj`, `**.unit.*`, etc.) as source. Record the chosen value in the
-    state file.
-
-### Trigger helper
-**Always `git push` and confirm the remote branch is at your new commit BEFORE triggering.**
-`gh workflow run --ref <branch>` resolves the ref on GitHub's side at dispatch time, so a
-trigger that races an in-flight push will run the *previous* commit. After triggering,
-verify with `gh run view <id> --json headSha` and re-trigger if it's stale.
-```bash
-git add -A && git commit -m "Fix flaky test: <test name>"
-git push -u origin <branch>          # PUSH FIRST — then trigger
-TRIGGERED_AT=$(date -u +%Y-%m-%dT%H:%M:%SZ)
-for throttle in true false; do
-  gh workflow run e2e-stress-test-flake-fix.yml --ref <branch> \
-    -f spec="<spec path>" \
-    -f grep="<full Trunk title from Phase 0 — NOT the leaf it() name>" \
-    -f burn_in="50" \
-    -f mb_edition="ee" \
-    -f qa_db="<true|false>" \
-    -f build_jar="<true|false>" \
-    -f enable_network_throttling="$throttle" \
-    -f fail_fast="true"
-done
-```
-- **Capture both run IDs**, then **verify each `headSha` matches your pushed commit**:
-  ```bash
-  gh run list --workflow=e2e-stress-test-flake-fix.yml --branch <branch> \
-    --json databaseId,status,createdAt,event,headSha --limit 10
-  ```
-  Save both run IDs + URLs to the state file, tagged `throttled` / `unthrottled`.
-
-## Phase 4 — Wait + interpret (gh only)
-
-- **Auto-poll** with `ScheduleWakeup` (~900s / 15 min cadence) until **both** runs leave
-  `queued`/`in_progress`. Pass the same `/fix-flaky-test $ARGUMENTS`
-  back so the loop resumes; re-read the state file on each wake (a manual wake must also
-  work). Don't poll faster than ~900s.
-- When both finish, read each conclusion:
-  ```bash
-  gh run view <id> --json status,conclusion
-  ```
-  - **Either `cancelled`** → assume a **human cancelled** it. Stop the whole task
-    immediately — do **not** retry, do **not** open a PR. Note it in the state file and
-    hand back. (A `cancelled` conclusion means manual cancellation; a `timed_out`
-    conclusion does **not** — treat `timed_out` like a failure below.)
-  - **Either `failure` / `timed_out`** → fix is not holding (`fail_fast` stopped at the
-    first bad iteration, so the artifact is fresh and minimal):
-    ```bash
-    gh run download <failed-id> --dir local/claude/e2e-flake-fix/<failed-id>-artifacts
-    ```
-    The Cypress error lives in the GitHub step log (`gh run view <id> --log-failed`) and the
-    screenshots/video — **not** in `logs/test.log` (that's only the backend health log).
-    Read the failure screenshot(s) (vision) and the step-log error; append findings to the
-    state file; increment `attempt`. If `attempt < 3` → loop back to **Phase 1** with the
-    new evidence. If `attempt == 3` → Phase 5 (exhausted).
-  - **Both `success`** (all 50 iterations passed, both throttle modes) → fixed → Phase 5.
-- Don't worry about CI cost.
-
-## Phase 5 — Conclude
-
-- **Fixed** — open a PR (the upfront OK already authorized the push; don't re-gate):
-  ```bash
-  gh pr create --title "Fix flaky test: <test name>" --body "<body>"
-  ```
-  **The PR can NEVER auto-merge** — it always requires at least one human approval, no
-  matter how green the stress runs are, and never enable auto-merge. A passing stress run is
-  *necessary but not sufficient*: it proves the test is stable, not that the root cause was
-  fixed rather than masked. The human owns the merge decision.
-  The PR description **must follow this exact order**: (1) the **first line is ALWAYS
-  `Resolves <current-identifier>`** (the **current** key from Phase 0, e.g. `UXW-####` — a stale
-  `DEV-####` may fail to link), then (2) the root cause / fix / stress-test sections. The PR body
-  **must always include both stress-test runs** as links with their pass results:
-  ```markdown
-  Resolves <current-identifier>
-
-  ## Root cause
-  <one paragraph>
-
-  ## Fix
-  <what changed and why; note if source code was touched and the blast radius>
-
-  ## Stress test (burn_in=50, single test via grep)
-  - ✅ network throttling ON:  <run URL>
-  - ✅ network throttling OFF: <run URL>
-  ```
-  That `Resolves <ID>` reference (in the **PR description only — NEVER in a commit message
-  or body**, which would reopen the issue) closes the Linear issue **on merge**, via
-  Linear's GitHub integration. **NEVER close the Linear issue or change its status yourself**
-  (no status edits via the Linear MCP — only comments). Linear moves it to *In Progress* when
-  the PR links and to *Done* when the PR merges. Comment the outcome on the issue (link the
-  PR), and leave a copy-pasteable summary inline AND in `local/claude/`.
-- **Exhausted (3 attempts)** — do **not** guess further. Report each hypothesis tried, the
-  fixes attempted, all 6 stress-run links, and where the artifacts are. Hand back for human
-  judgment.
-
-- **Always — attach the run log to Linear (regardless of outcome).** As the final step on
-  both the fixed and exhausted paths, post the full state file
-  `local/claude/e2e-flake-fix/<LINEAR_ID>.md` to the Linear issue as a comment titled
-  **"🤖 Flake-fix run log (audit trail)"** (fence it so it renders verbatim). This is the
-  end-to-end audit trail — every hypothesis, fix, commit, run URL, and verdict — kept for a
-  human reviewer and as a learning artifact even when the fix didn't land. Skip only on the
-  no-Linear fallback path.
-  - **Lead the comment with a run-cost line** (above the fenced log):
-    **total wall-clock time spent** on the run and **total tokens used** — e.g.
-    `⏱ 2h 14m · 🪙 1.8M tokens (N attempts)`. Compute time from the first state-file
-    timestamp to now; report tokens for the whole session (best available figure). This makes
-    the cost of each automated run visible at a glance on the issue. (Posting the markdown as a comment is sufficient; a file
-  attachment via `mcp__linear__create_attachment_from_upload` is optional if the user wants
-  a downloadable file.)

.claude/skills/clojure-write/SKILL.md

@@ -102,3 +102,7 @@ breakage keeps happening, *that* is the signal a comment was warranted.
 - End all files with a newline
 - When editing tabular code, where the columns line up, try to keep them aligned
 - Spaces on a line with nothing after it is not allowed
+- After changing module boundaries (adding/removing/renaming a `src` namespace, a cross-module `require`
+  or `:model/X` reference, or a new module), run `./bin/mage fix-modules-config` to regenerate
+  `.clj-kondo/config/modules/config.edn` and keep `metabase.core.modules-test` green. No-op when nothing
+  drifted; see "Module Boundaries" in the project `CLAUDE.md`.

.claude/skills/e2e-test-review/SKILL.md

@@ -22,10 +22,11 @@ Before starting, determine which mode to use:
 3. **(Conditional)** If after reading the spec a specific assertion or selector is **ambiguous** — you can't tell if it's the right anchor, or whether the test actually verifies what its title claims — briefly grep the related component for the test ID / role / text. **Don't read components by default.** Only do this when there's a real signal of confusion in the spec.
 4. Scan against the checklist + pattern table below.
 5. Number all issues sequentially. Skip nits — only flag what's worth fixing.
+6. **Always** finish with the honest e2e-vs-unit breakdown (see the section of that name below). It's part of every report, not an optional add-on.
 
 ### When to hand off instead of review
 
-If the spec references an issue (`metabase#NNNNN`) and the user wants to **fix** flakiness or assess whether the test still reproduces the original bug, that's outside the review skill's scope. Point them at `/fix-flakey-test` (or the dedicated flake-fixing workflow), which knows to fetch the issue and the resolving PR's diff. The review skill stays focused on "is this test well-written and conformant" — it doesn't fetch external issue context by default.
+If the spec references an issue (`metabase#NNNNN`) and the user wants to **fix** flakiness or assess whether the test still reproduces the original bug, that's outside the review skill's scope. Point them at the dedicated flake-fixing workflow, which knows to fetch the issue and the resolving PR's diff. The review skill stays focused on "is this test well-written and conformant" — it doesn't fetch external issue context by default.
 
 ## Review checklist
 
@@ -194,8 +195,41 @@ Use the pending review workflow:
 
 Each comment body starts with `**Issue N: [Brief title]**`.
 
+## Honest e2e-vs-unit breakdown (always include)
+
+Every report ends with this section. The numbered issues above are about whether the test is *well-written*; this section is about whether it should be an **e2e test at all**. They're orthogonal — a flawless spec can still be paying e2e prices for component-test value, and that's worth saying out loud.
+
+The bar is simple: **an `it()` earns its place in e2e only if it exercises a layer you cannot fake without gutting the test's value.** In this codebase that means one or more of:
+
+- a **real backend query against seeded data** (the assertion depends on the server actually filtering/sorting/bucketing rows, not on a mocked response);
+- **real rendering you then interact with** — clicking a charted ECharts SVG element at computed coordinates, drag/hit-testing, drill-through;
+- **routing across screens** — navigation, URL param round-trips that the backend then honors, browser back/forward;
+- **cross-screen traversal** — list → detail → back, where the value is the seam between screens.
+
+Conversely, a test belongs in **Jest + RTL** (the cheaper layer this repo already uses for component/unit coverage) when its real subject is frontend-only:
+
+- **pure frontend logic** — a bucketing/formatting/derivation decision (e.g. "single-day range → bucket by hour") that has one right answer independent of the backend;
+- **render assertions** — "the page mounts N titled cards and an SVG exists." A mocked dataset response + RTL verifies the titles; that an ECharts SVG renders is library behavior, not your logic;
+- **state/wiring** — tab → `aria-selected` → active-state, or select → querystring mapping. The *URL gets the param* half is component-level; only the *backend honors the param* half needs e2e.
+
+Write the breakdown in three honest buckets. Ground each call in **which layers the test actually touches**, not in how the test is named:
+
+1. **Genuinely must-be-e2e (keep)** — load-bearing. Name the layer(s) only a browser + backend can verify together.
+2. **Defensible-but-narrowable e2e** — justified as integration, but over-split or doing more boots than the coverage requires. Say what to merge.
+3. **Should be unit / component tests** — where the real savings are. Name the cheaper layer and what it would assert (often *more precisely* than the e2e test does indirectly).
+
+Then a one-paragraph **bottom line**: what to keep as e2e, what to push down, and — if you pulled CI timing from `e2e/support/timings.json` for the Performance check — roughly how much of that wall time is *earned* by the must-be-e2e set versus paid by the rest.
+
+Rules of engagement so this stays honest, not performative:
+
+- **Don't inflate the keep bucket to look balanced.** If most of the spec is component-test value paying e2e prices, say exactly that. If every test is load-bearing, say that too — a spec where all 12 tests must be e2e is a legitimate outcome, not a failure to find candidates.
+- **Be specific.** Cite the `it()` titles and line ranges. "Several tests could be unit tests" is useless; "tests 1/17/18 assert only that N titled cards mount — RTL with a mocked dataset" is actionable.
+- **This is advice to the author, not a blocking issue.** It's a recommendation, separate from the numbered issues. Don't renumber it into the issue list.
+- **Stay rooted in what exists.** The cheaper layer here is Jest + RTL component/unit tests. Don't invent infrastructure the repo doesn't have, and don't recommend deleting backend-dependent coverage just because part of the test is frontend-only — split it, keep the integration half.
+
 ## Final check
 
 1. Trim issues that won't materially help the author.
 2. Verify sequential numbering with no gaps.
 3. In PR mode, verify each issue was posted as a separate review comment.
+4. Verify the honest e2e-vs-unit breakdown is present — it's required in every report, even when the answer is "all of these need to be e2e."

.claude/skills/emotion-migrate/SKILL.md

@@ -21,7 +21,7 @@ For EACH styled component, go through every CSS property and ask: "Can this be a
 
 - `display` → `display` prop
 - `color` → `c` prop (`c="core-brand"`, `c="text-primary"`)
-- `background-color` → `bg` prop (`bg="background-primary"`)
+- `background-color` → `bg` prop (`bg="background_page-primary"`)
 - `font-size` → `fz` prop (`fz="md"`)
 - `font-weight` → `fw` prop (`fw="bold"`)
 - `line-height` → `lh` prop (`lh="md"`)
@@ -57,7 +57,7 @@ For EACH styled component, go through every CSS property and ask: "Can this be a
   align="center"            /* style prop */
   gap="sm"                  /* style prop */
   p="md"                    /* style prop */
-  bg="background-primary"   /* style prop */
+  bg="background_page-primary"   /* style prop */
 >
 ```
 
@@ -172,7 +172,7 @@ Create `ComponentName.module.css` alongside the component file:
 .root {
   border: 1px solid var(--mb-color-border-neutral);
   border-radius: var(--mantine-radius-md);
-  background-color: var(--mb-color-background-primary);
+  background-color: var(--mb-color-background_page-primary);
 }
 
 /* Conditional states as separate classes, combined with cx() */
@@ -182,7 +182,7 @@ Create `ComponentName.module.css` alongside the component file:
 }
 
 .disabled {
-  color: var(--mb-color-text-tertiary);
+  color: var(--mb-color-text-disabled);
   pointer-events: none;
 }
 
@@ -192,7 +192,7 @@ Create `ComponentName.module.css` alongside the component file:
 
   &:hover {
     color: var(--mb-color-core-brand);
-    background-color: var(--mb-color-background-hover);
+    background-color: var(--mb-color-background_surface-hover);
   }
 }
 
@@ -255,9 +255,9 @@ Remove the old styled file entirely. Remove all imports of it from other files.
 
 **Colors** (`c`, `bg`):
 
-- Text: `"text-primary"`, `"text-secondary"`, `"text-tertiary"`
-- Background: `"background-primary"`, `"background-secondary"`, `"background-hover"`
-- Brand: `"core-brand"`, `"error"`, `"success"`, `"warning"`
+- Text: `"text-primary"`, `"text-secondary"`, `"text-disabled"`
+- Background: `"background_page-primary"`, `"background_page-secondary"`, `"background_surface-hover"`
+- Brand: `"core-brand"`, `"feedback-negative"`, `"feedback-positive"`, `"feedback-warning"`
 
 **Typography** (`fz`, `fw`, `lh`, `ta`, `ff`):
 
@@ -279,11 +279,11 @@ Remove the old styled file entirely. Remove all imports of it from other files.
 
 **Colors** — `var(--mb-color-<name>)`:
 
-- `--mb-color-text-primary`, `--mb-color-text-secondary`, `--mb-color-text-tertiary`
-- `--mb-color-background-primary`, `--mb-color-background-secondary`, `--mb-color-background-hover`
-- `--mb-color-border-neutral`, `--mb-color-border-neutral-strong`, `--mb-color-border-neutral-subtle`
+- `--mb-color-text-primary`, `--mb-color-text-secondary`, `--mb-color-text-disabled`
+- `--mb-color-background_page-primary`, `--mb-color-background_page-secondary`, `--mb-color-background_surface-hover`
+- `--mb-color-border`, `--mb-color-border-strong`, `--mb-color-border-subtle`
 - `--mb-color-core-brand`, `--mb-color-core-brand-hover`
-- `--mb-color-error`, `--mb-color-success`, `--mb-color-warning`
+- `--mb-color-feedback-negative`, `--mb-color-feedback-positive`, `--mb-color-feedback-warning`
 - `--mb-color-shadow`, `--mb-color-focus`
 - `--mb-color-accent0` through `--mb-color-accent7`
 
@@ -398,7 +398,7 @@ export const Wrapper = styled.div`
 ```tsx
 export const Item = styled.div<{ isSelected: boolean; disabled: boolean }>`
   color: ${(props) =>
-    props.disabled ? color("text-tertiary") : color("text-primary")};
+    props.disabled ? color("text-disabled") : color("text-primary")};
   background-color: ${(props) =>
     props.isSelected ? color("core-brand") : "transparent"};
   cursor: ${(props) => (props.disabled ? "default" : "pointer")};
@@ -427,11 +427,11 @@ export const Item = styled.div<{ isSelected: boolean; disabled: boolean }>`
 }
 
 .disabled {
-  color: var(--mb-color-text-tertiary);
+  color: var(--mb-color-text-disabled);
   cursor: default;
 
   &:hover {
-    color: var(--mb-color-text-tertiary);
+    color: var(--mb-color-text-disabled);
   }
 }
 ```
@@ -574,7 +574,7 @@ export const Spinner = styled.div`
 | -------------------------- | ----------------------------------------------------------------- | ------------------------------------- |
 | `color("core-brand")`      | `var(--mb-color-core-brand)`                                      | `c="core-brand"` or `bg="core-brand"` |
 | `color("text-primary")`    | `var(--mb-color-text-primary)`                                    | `c="text-primary"`                    |
-| `color("border-neutral")`  | `var(--mb-color-border-neutral)`                                  | N/A (use CSS module)                  |
+| `color("border-neutral")`          | `var(--mb-color-border-neutral)`                                          | N/A (use CSS module)                  |
 | `alpha("core-brand", 0.2)` | `color-mix(in srgb, var(--mb-color-core-brand), transparent 80%)` | N/A (use CSS module)                  |
 
 ### Pattern 7: Responsive Spacing/Sizing → Responsive Style Props (NOT CSS Media Queries)

.clj-kondo/config.edn

@@ -179,14 +179,26 @@
      clojure.core.async/take!
      clojure.core.async/to-chan!
      clojure.core.async/to-chan!!
+     metabase.ai-tracing.core/record!
      metabase.api.macros.defendpoint.tools-manifest/assert-optional-fields-nullable!
      metabase.channel.core/send!
+     metabase.channel.render.pdf/draw-too-large!
+     metabase.channel.render.pdf/draw-no-results!
+     metabase.channel.render.pdf/render-card-cell!
+     metabase.channel.render.pdf.font/load-fonts!
      metabase.warehouses.models.database/assert-not-h2!
      metabase.driver.sql-jdbc.execute/execute-prepared-statement!
+     metabase.mcp.usage/record-mcp-session!
+     metabase.mcp.usage/record-mcp-session-end!
+     metabase.mcp.usage/record-mcp-tool-call!
      metabase.notification.models/create-notification!
      metabase.oauth-server.core/reset-provider!
      metabase.pulse.send/send-pulse!
      metabase-enterprise.transforms-python.python-runner-test/execute!
+     ;; MCP usage tests isolate their rows by unique keys (session id / tool name / duration /
+     ;; client version) and clean up only those, so these deletes are safe in parallel.
+     metabase-enterprise.mcp.usage-test/cleanup!
+     metabase-enterprise.mcp.usage-test/cleanup-calls!
      ;; Workspace isolation functions are safe in parallel tests because they operate on
      ;; isolated, test-specific workspaces and databases that don't affect other tests
      metabase-enterprise.workspaces.isolation/destroy-workspace-isolation!
@@ -248,9 +260,6 @@
   ;; misc config for built-in linters
   ;;
 
-  :invalid-arity       {:skip-args [metabase.util.match/match-one
-                                    metabase.util.match/match-many
-                                    metabase.util.match/replace]}                    ; TODO (cam): can we fix these?
   :refer-all           {:level :warning, :exclude [clojure.test]}
   :unused-referred-var {:exclude {compojure.core [GET DELETE POST PUT]}}
 
@@ -444,7 +453,10 @@
   instaparse.core/defparser                                                             clojure.core/def
   metabase-enterprise.action-v2.test-util/with-test-tables!                             clojure.core/let
   metabase-enterprise.content-translation.routes-test/with-new-secret-key!              clojure.core/fn
-  metabase-enterprise.curated-search.reconcile-test/with-isolated-mirror                clojure.core/fn
+  metabase-enterprise.entity-retrieval.reconcile-test/with-isolated-index                 clojure.core/fn
+  metabase-enterprise.mfa.enrollment-flow-test/with-fresh-user-session!                  clojure.core/fn
+  metabase-enterprise.mfa.login-flow-test/with-enrolled-rasta!                           clojure.core/fn
+  metabase-enterprise.mfa.recovery-codes-test/with-confirmed-enrollment!                 clojure.core/fn
   metabase-enterprise.serialization.metadata-file-import.wire-format-test/with-tiny-fixture! clojure.core/fn
   metabase-enterprise.serialization.test-util/with-dbs                                  clojure.core/fn
   metabase-enterprise.serialization.test-util/with-random-dump-dir                      clojure.core/let
@@ -461,7 +473,7 @@
   metabase.channel.impl.http-test/with-captured-http-requests                           clojure.core/fn
   metabase.channel.impl.http-test/with-server                                           clojure.core/let
   metabase.collections.models.collection-test/with-collection-in-location               clojure.core/let
-  metabase.curated-search.api-test/with-test-entry                                      clojure.core/let
+  metabase.collections.test-utils/with-library                                          clojure.core/fn
   metabase.driver.mongo.connection/with-mongo-client                                    clojure.core/let
   metabase.driver.mongo.connection/with-mongo-database                                  clojure.core/let
   metabase.driver.mongo.query-processor/mongo-let                                       clojure.core/let
@@ -475,6 +487,7 @@
   metabase.notification.test-util/with-card-notification                                clojure.core/let
   metabase.notification.test-util/with-system-event-notification!                       clojure.core/let
   metabase.notification.test-util/with-temp-notification                                clojure.core/let
+  metabase.osi.ai-context.api-test/with-test-entry                                      clojure.core/let
   metabase.premium-features.core/defenterprise-schema                                   clj-kondo.lint-as/def-catch-all
   metabase.premium-features.defenterprise/defenterprise-schema                          clj-kondo.lint-as/def-catch-all
   metabase.premium-features.settings/define-premium-feature                             clojure.core/def
@@ -576,7 +589,7 @@
    metabase.api.common.internal-test/with-jetty-server                                                                       hooks.common/with-one-binding
    metabase.api.macros/defendpoint                                                                                           hooks.metabase.api.macros/defendpoint
    metabase.app-db.schema-migrations-test.impl/test-migrations                                                               hooks.metabase.app-db.schema-migrations-test.impl/test-migrations
-   metabase.channel.render.js.svg/with-static-viz-context                                                                    hooks.common/with-one-top-level-binding
+   metabase.channel.render.js.pool/with-static-viz-context                                                                   hooks.common/with-one-top-level-binding
    metabase.channel.template.handlebars-helper/defhelper                                                                     hooks.metabase.channel.template.handlebars-helper/defhelper
    metabase.channel.template.handlebars-test/with-temp-template!                                                             hooks.common/with-vec-first-binding
    metabase.classloader.core/require                                                                                         hooks.clojure.core.require/lint-require
@@ -612,6 +625,9 @@
    metabase.model-persistence.api-test/with-persistence-setup!                                                               hooks.common/with-one-top-level-binding
    metabase.model-persistence.api-test/with-setup!                                                                           hooks.common/with-one-top-level-binding
    metabase.model-persistence.test-util/with-persistence-enabled!                                                            hooks.metabase.model-persistence.test-util/with-persistence-enabled!
+   metabase.mq.core/with-queue                                                                                               hooks.common/let-second
+   metabase.mq.test-util/with-test-mq                                                                                        hooks.common/with-one-binding
+   metabase.mq.core/def-listener!                                                                                            hooks.metabase.mq.impl/def-listener
    metabase.models.interface/define-batched-hydration-method                                                                 hooks.metabase.models.interface/define-hydration-method
    metabase.models.interface/define-simple-hydration-method                                                                  hooks.metabase.models.interface/define-hydration-method
    metabase.permissions.core/allow-changing-all-users-group-members                                                          hooks.common/do*
@@ -703,6 +719,10 @@
    metabase.util.log/warn                                                                                                    hooks.metabase.util.log/info
    metabase.util.log/warnf                                                                                                   hooks.metabase.util.log/infof
    metabase.util.malli.registry/def                                                                                          hooks.metabase.util.malli.registry/def
+   metabase.util.match/match-one                                                                                             hooks.metabase.util.match/match-one
+   metabase.util.match/match-many                                                                                            hooks.metabase.util.match/match-many
+   metabase.util.match/replace                                                                                               hooks.metabase.util.match/replace
+   metabase.util.match/replace-in                                                                                            hooks.metabase.util.match/replace-in
    metabase.util/case-enum                                                                                                   hooks.metabase.util/case-enum
    metabase.util/format-color                                                                                                hooks.metabase.util/format-color
    metabase.xrays.api.automagic-dashboards-test/with-indexed-model!                                                          hooks.metabase.xrays.api.automagic-dashboards-test/with-indexed-model!
@@ -746,6 +766,7 @@
    metabase.test/with-temporary-raw-setting-values                                              macros.metabase.test.util/with-temporary-raw-setting-values
    metabase.users.models.user-test/with-groups!                                                 macros.metabase.users.models.user-test/with-groups!
    metabase.util.namespaces/import-fn                                                           macros.metabase.util.namespaces/import-fn
+   metabase.util.namespaces/import-macro                                                        macros.metabase.util.namespaces/import-macro
    metabase.xrays.related-test/with-world                                                       macros.metabase.xrays.related-test/with-world}}
 
  :config-in-comment
@@ -803,7 +824,6 @@
   ;;
   {:pattern "^metabase(?:((?:-enterprise\\.sandbox)?\\.query-processor)|(?:\\.driver\\.sql(?!server)(?!ite))).*-test$"
    :name    general-qp-and-driver-test-namespaces}
-
   {:pattern "(?:^mage.*)"
    :name    mage-namespaces}]
 

.clj-kondo/config/modules/config.edn

@@ -159,7 +159,8 @@
   {:team    "Metabot"
    :api     #{metabase.agent-api.api
               metabase.agent-api.init}
-   :uses    #{api
+   :uses    #{ai-tracing
+              api
               auth-identity
               channel
               collections
@@ -180,6 +181,8 @@
                     :model/Collection
                     :model/Dashboard
                     :model/DashboardCard
+                    :model/DashboardTab
+                    :model/Database
                     :model/Table
                     :model/User}}
 
@@ -192,6 +195,15 @@
            models
            util}}
 
+  ai-tracing
+  {:team "Metabot"
+   :api  #{metabase.ai-tracing.api
+           metabase.ai-tracing.core
+           metabase.ai-tracing.init}
+   :uses #{api
+           settings
+           util}}
+
   analytics
   {:team "UX West"
    :api  #{metabase.analytics.api
@@ -357,6 +369,7 @@
   {:team "UX West"
    :api  #{metabase.audit-app.core
            metabase.audit-app.init}
+   :friends #{enterprise/memoize-monitor}
    :uses #{api
            app-db
            events
@@ -572,6 +585,7 @@
   collections
   {:team "UX West"
    :api  #{metabase.collections.core
+           metabase.collections.curation
            metabase.collections.models.collection
            metabase.collections.models.collection.root
            metabase.collections.schema}
@@ -685,18 +699,6 @@
    :api  #{}
    :uses :any}
 
-  curated-search
-  {:team "Metabot"
-   :api  #{metabase.curated-search.api
-           metabase.curated-search.core}
-   :uses #{api
-           models
-           premium-features
-           request
-           util}
-   :model-exports #{:model/CuratedSearchEntry}
-   :model-imports #{:model/Card}}
-
   dashboards
   {:team "UX West"
    :api  #{metabase.dashboards.autoplace
@@ -712,6 +714,7 @@
            audit-app
            collections
            config
+           embedding
            events
            lib
            models
@@ -722,6 +725,7 @@
            query-processor
            search
            settings
+           staleness
            sync
            util}
    :model-exports #{:model/Dashboard
@@ -836,7 +840,6 @@
            metabase.driver.common
            metabase.driver.connection
            metabase.driver.ddl.interface
-           metabase.driver.h2
            metabase.driver.impl
            metabase.driver.init
            metabase.driver.mysql
@@ -973,6 +976,13 @@
            util}
    :model-imports #{:model/Card :model/Dashboard :model/DashboardCard :model/EmbeddingTheme}}
 
+  entity-retrieval
+  {:team "Metabot"
+   :api  #{metabase.entity-retrieval.core
+           metabase.entity-retrieval.mirror}
+   :uses #{premium-features}
+   :model-imports #{:model/OsiAiContext}}
+
   events
   {:team "DevEx"
    :api  #{metabase.events.core
@@ -1065,6 +1075,27 @@
    :model-exports #{:model/ModelIndex :model/ModelIndexValue}
    :model-imports #{:model/Card :model/Collection}}
 
+  indexes
+  {:team "Gadget"
+   :api  #{metabase.indexes.models.table-index
+           metabase.indexes.reconcile
+           metabase.indexes.schema}
+   :uses #{driver
+           models
+           util}
+   :model-exports #{:model/TableIndex}}
+
+  indexes-rest
+  {:team "Gadget"
+   :api  #{metabase.indexes-rest.api}
+   :uses #{api
+           indexes
+           transforms-base
+           util}
+   :model-imports #{:model/Database
+                    :model/TableIndex
+                    :model/Transform}}
+
   initialization-status
   {:team "UX West"
    :api  #{metabase.initialization-status.core}
@@ -1104,6 +1135,7 @@
            metabase.lib.metadata
            metabase.lib.metadata.protocols
            metabase.lib.options
+           metabase.lib.pivot
            metabase.lib.schema
            metabase.lib.schema.actions
            metabase.lib.schema.aggregation
@@ -1191,7 +1223,10 @@
            sync
            util
            warehouse-schema}
-   :model-imports #{:model/Card :model/Database :model/Field :model/Table}}
+   :model-imports #{:model/Card
+                    :model/Database
+                    :model/Field
+                    :model/Table}}
 
   logger
   {:team "DevEx"
@@ -1224,13 +1259,19 @@
    :api  #{metabase.mcp.api
            metabase.mcp.callback-api
            metabase.mcp.core
-           metabase.mcp.init}
+           metabase.mcp.init
+           metabase.mcp.usage}
+   :model-exports #{:model/McpSessionLog
+                    :model/McpToolCallLog}
    :uses #{agent-api
+           ai-tracing
            api
            app-db
            config
            llm
+           metabot
            oauth-server
+           premium-features
            request
            server
            session
@@ -1269,6 +1310,7 @@
               slackbot}
    :uses    #{activity-feed
               agent-lib
+              ai-tracing
               analytics
               analytics-interface
               api
@@ -1278,9 +1320,9 @@
               channel
               collections
               config
-              curated-search
               documents
               driver
+              entity-retrieval
               interestingness
               legacy-mbql
               lib
@@ -1300,7 +1342,6 @@
               settings
               slackbot
               sql-tools
-              store-api
               sync
               system
               task
@@ -1316,6 +1357,8 @@
    :model-imports #{:model/Card
                     :model/Collection
                     :model/Dashboard
+                    :model/DashboardCard
+                    :model/DashboardTab
                     :model/Database
                     :model/Field
                     :model/Glossary
@@ -1405,6 +1448,17 @@
                     :model/Table
                     :model/User}}
 
+  mq
+  {:team "UX West"
+   :api  #{metabase.mq.init}
+   :uses #{analytics-interface
+           app-db
+           classloader
+           settings
+           startup
+           task
+           util}}
+
   native-query-snippets
   {:team "Graphy"
    :api  #{metabase.native-query-snippets.api
@@ -1484,6 +1538,20 @@
            tracing
            util}}
 
+  osi
+  {:team "Metabot"
+   :api  #{metabase.osi.ai-context.api}
+   :uses #{api
+           app-db
+           entity-retrieval
+           models
+           request
+           util}
+   :model-exports #{:model/OsiAiContext}
+   :model-imports #{:model/Card
+                    :model/Measure
+                    :model/Segment}}
+
   ;; TODO -- too many API namespaces
   parameters
   {:team "Graphy"
@@ -1704,6 +1772,7 @@
            content-verification
            dashboards
            documents
+           embedding
            events
            graph
            lib
@@ -1719,6 +1788,8 @@
            query-processor
            request
            search
+           settings
+           staleness
            sync
            util
            view-log
@@ -1831,6 +1902,7 @@
            cache
            config
            dashboards
+           database-routing
            driver
            events
            formatter
@@ -1924,18 +1996,12 @@
   {:team "UX West"
    :api  #{metabase.sample-data.core
            metabase.sample-data.init}
-   :uses #{config
-           models
+   :uses #{driver
            plugins
            settings
            sync
            util}
-   :model-imports #{:model/Card
-                    :model/Dashboard
-                    :model/DashboardCard
-                    :model/Database
-                    :model/Field
-                    :model/Table}}
+   :model-imports #{:model/DataPermissions :model/Database :model/Table}}
 
   search
   {:team "UX West"
@@ -2049,6 +2115,7 @@
            channel
            config
            events
+           premium-features
            request
            settings
            sso
@@ -2146,8 +2213,7 @@
   sql-parsing
   {:team "DevEx"
    :api #{metabase.sql-parsing.core}
-   :uses #{analytics-interface
-           util}}
+   :uses #{analytics-interface util}}
 
   sql-tools
   {:team "DevEx"
@@ -2181,6 +2247,10 @@
               util}
    :model-imports #{:model/AuthIdentity :model/PermissionsGroupMembership}}
 
+  staleness
+  {:team "UX West"
+   :api  #{metabase.staleness.core}}
+
   startup
   {:team "DevEx"
    :api  #{metabase.startup.core}
@@ -2282,9 +2352,11 @@
            config
            lib
            lib-be
+           mcp
            permissions
            premium-features
            search
+           session
            util}
    :model-imports #{:model/AiUsageLog
                     :model/Card
@@ -2349,6 +2421,7 @@
            database-routing
            driver
            events
+           indexes
            lib
            lib-be
            models
@@ -2378,6 +2451,7 @@
                     :model/Database
                     :model/Field
                     :model/Table
+                    :model/TableIndex
                     :model/User}}
 
   transforms-base
@@ -2391,11 +2465,13 @@
    :model-imports #{:model/Database
                     :model/Field
                     :model/Table
+                    :model/TableIndex
                     :model/Transform
                     :model/TransformRun}
    :uses #{database-routing
            driver
            events
+           indexes
            lib
            lib-be
            premium-features
@@ -2822,6 +2898,7 @@
    :uses #{driver
            premium-features
            enterprise/advanced-config
+           enterprise/mfa
            enterprise/scim
            enterprise/semantic-search
            enterprise/sso}
@@ -2847,7 +2924,6 @@
            app-db
            audit-app
            classloader
-           config
            driver
            lib
            models
@@ -2976,15 +3052,6 @@
    :api  #{metabase-enterprise.core.init}
    :uses :any}
 
-  enterprise/curated-search
-  {:team "Metabot"
-   :api  #{metabase-enterprise.curated-search.init}
-   :uses #{premium-features
-           task
-           util
-           enterprise/semantic-search}
-   :model-imports #{:model/CuratedSearchEntry}}
-
   enterprise/custom-viz-plugin
   {:team "Gadget"
    :api  #{metabase-enterprise.custom-viz-plugin.api
@@ -3065,7 +3132,6 @@
   {:team "UX West"
    :api  #{metabase-enterprise.database-routing.api}
    :uses #{api
-           config
            database-routing
            driver
            events
@@ -3161,6 +3227,22 @@
    ;; make token tracking a hook). Drop this dep once the relocation lands.
    :uses #{enterprise/semantic-search}}
 
+  enterprise/entity-retrieval
+  {:team "Metabot"
+   :api  #{metabase-enterprise.entity-retrieval.init}
+   :uses #{analytics-interface
+           collections
+           entity-retrieval
+           premium-features
+           task
+           util
+           enterprise/semantic-search}
+   :model-imports #{:model/Card
+                    :model/Measure
+                    :model/OsiAiContext
+                    :model/Segment
+                    :model/Table}}
+
   enterprise/erd
   {:team "Gadget"
    :api  #{metabase-enterprise.erd.api}
@@ -3222,6 +3304,32 @@
            premium-features}
    :model-imports #{:model/Card :model/Collection :model/Table}}
 
+  enterprise/mcp
+  {:team    "Metabot"
+   :api     #{metabase-enterprise.mcp.init}
+   :uses    #{analytics
+              mcp
+              metabot
+              premium-features
+              task
+              util}
+   :model-imports #{:model/McpSessionLog
+                    :model/McpToolCallLog}}
+
+  enterprise/memoize-monitor
+  {:team "Graphy"
+   :api  #{metabase-enterprise.memoize-monitor.init}
+   :uses #{analytics
+           analytics-interface
+           audit-app
+           collections
+           driver
+           models
+           util
+           warehouse-schema
+           warehouses
+           enterprise/serialization}}
+
   enterprise/metabot
   {:team    "Metabot"
    :api     #{metabase-enterprise.metabot.api
@@ -3261,6 +3369,22 @@
            util}
    :model-imports #{:model/MetabotConversation :model/MetabotFeedback :model/MetabotMessage}}
 
+  enterprise/mfa
+  {:team "Graphy"
+   :api  #{metabase-enterprise.mfa.core
+           metabase-enterprise.mfa.init
+           metabase-enterprise.mfa.routes}
+   :uses #{api
+           appearance
+           channel
+           config
+           events
+           premium-features
+           settings
+           sso
+           util}
+   :model-imports #{:model/AuthIdentity :model/User}}
+
   enterprise/permission-debug
   {:team "UX West"
    :api  #{metabase-enterprise.permission-debug.api}
@@ -3436,8 +3560,11 @@
            analytics-interface
            api
            app-db
+           collections
            config
            connection-pool
+           events
+           lib-be
            llm
            metabot
            models
@@ -3448,7 +3575,9 @@
            task
            tracing
            util}
-   :model-imports #{:model/Collection}}
+   :model-imports #{:model/Collection
+                    :model/Dashboard
+                    :model/Table}}
 
   enterprise/serialization
   {:team "Graphy"
@@ -3458,12 +3587,12 @@
            metabase-enterprise.serialization.init
            metabase-enterprise.serialization.schema
            metabase-enterprise.serialization.v2.backfill-ids}
+   :friends #{enterprise/memoize-monitor}
    :uses #{analytics
            api
            app-db
            appearance
            collections
-           config
            events
            lib
            logger
@@ -3516,11 +3645,11 @@
    :uses #{analytics
            api
            collections
-           embedding
            premium-features
            queries
            request
            settings
+           staleness
            util}
    :model-imports #{:model/Card :model/Collection :model/Dashboard}}
 
@@ -3559,7 +3688,9 @@
   {:team "Graphy"
    :api  #{metabase-enterprise.transforms.api}
    :uses #{premium-features
-           enterprise/transforms-inspector}}
+           util
+           enterprise/transforms-inspector}
+   :model-imports #{:model/Transform}}
 
   enterprise/transforms-inspector
   {:team "Gadget"

.clj-kondo/config/test-helpers/config.edn

@@ -36,6 +36,9 @@
      ;; Definitely thread safe
      metabase.test.util.dynamic-redefs/patch-vars!
 
+     ;; test-only cleanup of in-memory throttle state (atom resets)
+     metabase.session.api/reset-throttlers-for-testing!
+
      ;; TODO: most of these symbols shouldn't be here, we should go through them and
      ;; find the functions/macros that use them and make sure their names end with !
      ;; best way to do this is try remove each of these and rely on kondo output to find places where it's used

.clj-kondo/macros/metabase/util/namespaces.clj

@@ -6,3 +6,8 @@
    `(def ~(-> sym name symbol) "docstring" ~sym))
   ([sym name]
    `(def ~name "docstring" ~sym)))
+
+(defmacro import-macro
+  "Kondo macro replacement for [[metabase.util.namespaces/import-macro]]."
+  [sym]
+  `(def ~(-> sym name symbol) "docstring" ~sym))

.clj-kondo/src/hooks/metabase/mq/impl.clj

@@ -0,0 +1,18 @@
+(ns hooks.metabase.mq.impl
+  (:require
+   [clj-kondo.hooks-api :as hooks]))
+
+(defn def-listener
+  "Kondo hook for `mq/def-listener`. Rewrites to a `fn` form so kondo can analyze bindings.
+
+   Form:
+     (mq/def-listener! :queue/bar [msgs] body...)"
+  [{:keys [node]}]
+  (let [[_ _channel-name bindings & body] (:children node)
+        ;; rewrite as: (fn [bindings...] body...)
+        new-node (hooks/list-node
+                  (list*
+                   (hooks/token-node 'fn)
+                   bindings
+                   body))]
+    {:node new-node}))

.clj-kondo/src/hooks/metabase/util/match.clj

@@ -0,0 +1,132 @@
+(ns hooks.metabase.util.match
+  (:require [clj-kondo.hooks-api :as api]))
+
+(defn- token-node? [node token-name]
+  (and (api/token-node? node)
+       (= (str (:value node)) token-name)))
+
+(defn- keyword-node? [node k]
+  (and (api/keyword-node? node)
+       (= (:k node) k)))
+
+(defn- binding-symbol?
+  "True when the token is a plain symbol that should be treated as a binding
+  (not a keyword, not a boolean literal, not nil, not a number, not `_`)."
+  [node]
+  (and (api/token-node? node)
+       (let [v (:value node)]
+         (and (symbol? v)
+              (not (contains? '#{_ nil true false} v))))))
+
+;; To establish fake let bindings, we need to bind them to something. This "something" has to be vague enough to trick
+;; kondo into not looking too much into it. E.g., if we bind everything to `nil`, Kondo linters will get fired up.
+(def opaque-node (api/list-node (list (api/token-node 'rand-nth) (api/list-node []))))
+
+(defn collect-bindings
+  "Return a list of token nodes (symbols) introduced as bindings by `pattern`."
+  [pattern]
+  (cond
+    (binding-symbol? pattern)
+    [[pattern opaque-node]]
+
+    ;; Lists: (:or ...), (:and ...), (sym :guard pred ...), or a quoted symbol.
+    (api/list-node? pattern)
+    (let [[head & rst] (:children pattern)]
+      (cond (or (keyword-node? head :or)
+                (keyword-node? head :and))
+            (mapcat collect-bindings rst)
+
+            (api/token-node? head)
+            (cond-> []
+              (binding-symbol? head) (conj [head opaque-node])
+              (keyword-node? (first rst) :guard) (conj [(api/token-node '_) (second rst)]))
+
+            ;; anything else (e.g. a function call used as predicate) — no bindings
+            :else []))
+
+    (api/vector-node? pattern)
+    (mapcat (fn [node]
+              (when-not (token-node? node "&")
+                (collect-bindings node)))
+            (:children pattern))
+
+    ;; Maps: keys are literal selectors, values are sub-patterns.
+    ;; Special value-symbols &truthy and _ are NOT user bindings.
+    (api/map-node? pattern)
+    (let [children (:children pattern)
+          pairs    (partition 2 children)]
+      (mapcat (fn [[_k v]]
+                (when-not (or (token-node? v "&truthy")
+                              (token-node? v "_"))
+                  (collect-bindings v)))
+              pairs))
+
+    ;; For sets, make sure to use them because they may reference some of the outer local bindings, so if we don't
+    ;; include them, Kondo will complain about those bindings being unused.
+    (api/set-node? pattern)
+    [[(api/token-node '_) pattern]]
+
+    ;; Anything else — no bindings.
+    :else []))
+
+(defn- dedupe-bindings
+  "Prevent Kondo complaining that we have multiple fake bindings."
+  [pairs]
+  (loop [[[sym v] & r] pairs, seen #{}, result []]
+    (cond (nil? sym) result
+          (and (seen sym) (not (token-node? sym "_"))) (recur r seen result)
+          :else (recur r (conj seen sym) (conj result sym v)))))
+
+(defn match-one
+  "clj-kondo :analyze-call hook for match-one.
+
+  Rewrites
+
+    (match-one value
+      pat1 ret1
+      pat2 ret2
+      ...)
+
+  into a `let` form that declares all binding symbols introduced by the patterns, so clj-kondo knows they are
+  legitimate and won't warn about unresolved/unused symbols:
+
+    (let [<all-bindings> (rand-nth []) ...]
+      (or ret1 ret2 ...))"
+  [{:keys [node]}]
+  (let [[_ value & clauses] (:children node)]
+    (when (odd? (count clauses))
+      (api/reg-finding!
+       {:message  "match-one/match-many/replace requires an even number of pattern/result pairs"
+        :type     :metabase/match-odd-clauses
+        :row      (:row node)
+        :col      (:col node)
+        :filename (-> node meta :filename)}))
+    (let [pairs (partition 2 clauses)
+          all-bindings (->> pairs
+                            (mapcat (fn [[pat _ret]] (collect-bindings pat)))
+                            dedupe-bindings)
+          special-bindings [(api/token-node '_)        value
+                            (api/token-node '&match)   opaque-node
+                            (api/token-node '&parents) opaque-node
+                            (api/token-node '&recur)   opaque-node
+                            ;; Pretend to use &match, &parents, and &recur so that Kondo doesn't complain about them
+                            ;; if they are not used by the user code.
+                            (api/token-node '_) (api/token-node '&match)
+                            (api/token-node '_) (api/token-node '&parents)
+                            (api/token-node '_) (api/token-node '&recur)]
+          binding-nodes (into special-bindings all-bindings)
+          result-exprs (map second pairs)
+          new-node (api/list-node
+                    (list
+                     (api/token-node 'let)
+                     (api/vector-node binding-nodes)
+                     (api/list-node
+                      (concat [(api/token-node 'clojure.core/or)] result-exprs [opaque-node]))))]
+      {:node new-node})))
+
+(def match-many match-one)
+(def replace match-one)
+
+(defn replace-in [context]
+  ;; Everything is the same as in match-one, just drop the middle argument.
+  (match-one (update-in context [:node :children] (fn [[sym value path & clauses]] (list* sym value clauses)))))

.clj-kondo/test/hooks/metabase/util/match_test.clj

@@ -0,0 +1,59 @@
+(ns hooks.metabase.util.match-test
+  (:require
+   [clj-kondo.hooks-api :as hooks]
+   [clj-kondo.impl.utils]
+   [clojure.test :refer :all]
+   [hooks.metabase.util.match :as sut]))
+
+(defn- expand [src]
+  (-> (sut/match-one {:node (hooks/parse-string (pr-str src))})
+      :node
+      hooks/sexpr))
+
+(defn- lint [src]
+  (binding [clj-kondo.impl.utils/*ctx* {:config     {:linters {:metabase/match-odd-clauses {:level :warning}}}
+                                        :ignores    (atom nil)
+                                        :findings   (atom [])
+                                        :namespaces (atom {})}]
+    (expand src)
+    @(:findings clj-kondo.impl.utils/*ctx*)))
+
+(deftest odd-clauses-triggers-warning-test
+  (is (=? [{:type :metabase/match-odd-clauses}]
+          (lint '(metabase.util.match/match-one [] [a b c])))))
+
+(deftest expansion-test
+  (testing "simple expansion example"
+    (is (= '(let [_ []
+                  &match (rand-nth ())
+                  &parents (rand-nth ())
+                  &recur (rand-nth ())
+                  _ &match
+                  _ &parents
+                  _ &recur
+                  a (rand-nth ())
+                  b (rand-nth ())
+                  c (rand-nth ())]
+              (clojure.core/or (+ a b) (rand-nth ())))
+           (expand '(match-one [] [a b c] (+ a b))))))
+  (testing "complicated expansion example that uses most match-one macro features, and also binding deduplication by the rewriter"
+    (is (= '(let [_ []
+                  &match (rand-nth ())
+                  &parents (rand-nth ())
+                  &recur (rand-nth ())
+                  _ &match
+                  _ &parents
+                  _ &recur
+                  val1 (rand-nth ())
+                  a (rand-nth ())
+                  _ #{maybe important}
+                  rst (rand-nth ())
+                  x (rand-nth ())
+                  _ (= x 3)
+                  b (rand-nth ())]
+              (clojure.core/or (+ a val1) (rand-nth ())))
+           (expand '(match-one []
+                               (:or [{:key1 val1, :key2 &truthy, :key3 _} _ a #{maybe important} & rst]
+                                    (:and (x :guard (= x 3))
+                                          [a b]))
+                               (+ a val1)))))))

.coderabbit.yaml

@@ -0,0 +1,28 @@
+# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
+reviews:
+  high_level_summary: false
+  review_status: false
+
+  auto_review:
+    enabled: false
+    drafts: true
+    labels:
+      - "coderabbit"
+
+  path_filters:
+    - "!**/*.snap"
+    - "!**/*.po"
+    - "!**/bun.lock"
+    - "!**/package-lock.json"
+
+  tools:
+    eslint:
+      enabled: false
+
+knowledge_base:
+  code_guidelines:
+    filePatterns:
+      - ".claude/skills/clojure-review/SKILL.md"
+      - ".claude/skills/typescript-review/SKILL.md"
+      - ".claude/skills/e2e-test-review/SKILL.md"
+      - ".claude/skills/docs-review/SKILL.md"

.dependency-cruiser.cjs

@@ -0,0 +1,32 @@
+// dependency-cruiser config for the actual frontend import graph (what's
+// imported, vs the *allowed* edges in module-boundaries.mjs). Consumed by
+// .github/scripts/create-test-plan.ts.
+//
+//   bunx depcruise frontend/src enterprise/frontend/src \
+//     --config .dependency-cruiser.cjs --output-type json > dependency-graph.json
+
+/** @type {import('dependency-cruiser').IConfiguration} */
+module.exports = {
+  options: {
+    // Keep only edges between our own source files (drops node_modules etc.),
+    // which keeps the JSON small.
+    includeOnly: "^(frontend/src|enterprise/frontend/src)/",
+
+    doNotFollow: { path: "node_modules" },
+
+    // Resolve the `"*": ["./frontend/src/*", ...]` aliases so bare imports like
+    // `metabase/lib/foo` map back to a real file.
+    tsConfig: { fileName: "tsconfig.json" },
+
+    // Keep type-only imports: a type-only dependent still breaks on a type change.
+    tsPreCompilationDeps: true,
+
+    moduleSystems: ["es6", "cjs", "tsd"],
+
+    enhancedResolveOptions: {
+      exportsFields: ["exports"],
+      conditionNames: ["import", "require", "node", "default", "types"],
+      extensions: [".js", ".jsx", ".ts", ".tsx", ".json"],
+    },
+  },
+};

.devcontainer/Dockerfile

@@ -1,4 +1,4 @@
-FROM mcr.microsoft.com/vscode/devcontainers/java:21
+FROM mcr.microsoft.com/vscode/devcontainers/java:25
 
 # Set up nodesource, install node, bun, fontconfig for static viz, rlwrap for dev ergonomics
 

.dockerignore

@@ -1,5 +1,6 @@
+.git
 .babel_cache
-target/*
+target
 .circleci
 .cpcache
 .devcontainer
@@ -15,6 +16,7 @@ test_config/*
 test_modules/*
 test_resources/*
 node_modules
+**/node_modules
 **metabase.jar
 
 *.db

.gitattributes

@@ -7,3 +7,9 @@
 #
 # TODO (Bryan 12/12/25) -- reenable this when we can completely verify correctness
 # resources/migrations/*_update_migrations.yaml merge=yaml-migrations
+
+# Generated API documentation/specs — regenerated by the "Auto-update documentation for master"
+# CI automation, not edited by hand. Mark generated so tools/humans don't review or diff them as source.
+docs/api.json                  linguist-generated
+docs/api.html                  linguist-generated
+resources/openapi/openapi.json linguist-generated

.github/CODEOWNERS

@@ -12,13 +12,27 @@ enterprise/backend/src/metabase_enterprise/dependencies @metabase/graphy
 enterprise/frontend/src/metabase-enterprise/dependencies @metabase/graphy
 
 # @metabase/embedding
-enterprise/frontend/src/embedding-sdk-package @metabase/embedding
-enterprise/frontend/src/embedding-sdk-bundle @metabase/embedding
-enterprise/frontend/src/embedding-sdk-shared @metabase/embedding
+
+frontend/src/metabase/embedding @metabase/embedding
 frontend/src/metabase/embedding-sdk @metabase/embedding
+frontend/src/embedding-sdk-bundle @metabase/embedding
+frontend/src/embedding-sdk-shared @metabase/embedding
 frontend/src/metabase/public/containers/PublicOrEmbeddedQuestion @metabase/embedding
 frontend/src/metabase/public/containers/PublicOrEmbeddedDashboard @metabase/embedding
 
+enterprise/frontend/src/embedding @metabase/embedding
+enterprise/frontend/src/embedding-sdk-ee @metabase/embedding
+enterprise/frontend/src/embedding-sdk-package @metabase/embedding
+
+enterprise/frontend/src/metabase-enterprise/embedding @metabase/embedding
+enterprise/frontend/src/metabase-enterprise/embedding_iframe_sdk @metabase/embedding
+enterprise/frontend/src/metabase-enterprise/embedding_iframe_sdk_setup @metabase/embedding
+enterprise/frontend/src/metabase-enterprise/embedding-sdk @metabase/embedding
+
+e2e/test-component @metabase/embedding
+e2e/test/scenarios/embedding @metabase/embedding
+e2e/embedding-sdk-host-apps @metabase/embedding
+
 # @metabase/tech-writers
 docs @metabase/tech-writers
 docs/developers-guide # exclude from tech-writer ownership

.github/actions/create-test-plan/action.yml

@@ -0,0 +1,131 @@
+name: Create test plan
+description: Cruise the frontend import graph and compute the affected-tests plan.
+
+inputs:
+  changed-files:
+    description: All changed files (CSV).
+    required: true
+  fe-changed-files:
+    description: Changed frontend_sources files (CSV).
+    required: true
+  be-changed-files:
+    description: Changed backend_sources files (CSV).
+    required: true
+  unit-infra-touched:
+    description: Whether FE unit infra changed.
+    required: true
+  loki-infra-touched:
+    description: Whether Loki infra changed.
+    required: true
+  e2e-infra-touched:
+    description: Whether e2e harness/support code changed.
+    required: true
+  shared-sources-touched:
+    description: Whether cljc/cljs/package.json changed.
+    required: true
+
+outputs:
+  stats:
+    description: FE Affected Tests stats row (JSON).
+    value: ${{ steps.compute.outputs.stats }}
+  fe_unit_specs_to_run:
+    description: Unit specs to run (JSON array).
+    value: ${{ steps.compute.outputs.fe_unit_specs_to_run }}
+  loki_stories_to_run:
+    description: Loki stories to run (JSON array).
+    value: ${{ steps.compute.outputs.loki_stories_to_run }}
+  e2e_specs_to_run:
+    description: E2E specs to run (JSON array).
+    value: ${{ steps.compute.outputs.e2e_specs_to_run }}
+
+runs:
+  using: composite
+  steps:
+    - name: Prepare Node + Bun
+      uses: ./.github/actions/prepare-node-bun
+    - name: Resolve closest-ancestor e2e coverage manifest
+      id: manifest
+      uses: actions/github-script@v9
+      with:
+        script: | # js
+          const { pathToFileURL } = require("url");
+          const { resolveCoverageManifest } = await import(
+            pathToFileURL(
+              `${process.env.GITHUB_WORKSPACE}/.github/scripts/resolve-coverage-manifest.mjs`,
+            ).href,
+          );
+          const result = await resolveCoverageManifest({
+            github,
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+            headSha: context.payload.pull_request?.head?.sha ?? context.sha,
+          });
+          core.setOutput("path", result?.path ?? "");
+    - name: Build dependency graph
+      shell: bash
+      run: |
+        # Quiet on success; surface output only if install fails.
+        bun install --frozen-lockfile > /tmp/bun-install.log 2>&1 \
+          || { echo "bun install issues (continuing):"; tail -20 /tmp/bun-install.log; }
+        bunx depcruise frontend/src enterprise/frontend/src \
+          --config .dependency-cruiser.cjs \
+          --output-type json > dependency-graph.json || true
+
+    - name: Create test plan
+      id: compute
+      shell: bash
+      env:
+        CHANGED_FILES: ${{ inputs.changed-files }}
+        FE_CHANGED_FILES: ${{ inputs.fe-changed-files }}
+        BE_CHANGED_FILES: ${{ inputs.be-changed-files }}
+        UNIT_INFRA_TOUCHED: ${{ inputs.unit-infra-touched }}
+        LOKI_INFRA_TOUCHED: ${{ inputs.loki-infra-touched }}
+        E2E_INFRA_TOUCHED: ${{ inputs.e2e-infra-touched }}
+        SHARED_SOURCES_TOUCHED: ${{ inputs.shared-sources-touched }}
+        DEP_GRAPH_JSON: dependency-graph.json
+        E2E_SPEC_MANIFEST: ${{ steps.manifest.outputs.path }}
+      run: |
+        # stdout is the plan JSON; the planner's own info logs go to stderr.
+        bun .github/scripts/create-test-plan.ts > test-plan.json
+        echo "stats=$(jq -c '.stats' test-plan.json)" >> "$GITHUB_OUTPUT"
+        echo "fe_unit_specs_to_run=$(jq -c '.fe_unit_specs_to_run' test-plan.json)" >> "$GITHUB_OUTPUT"
+        echo "loki_stories_to_run=$(jq -c '.loki_stories_to_run' test-plan.json)" >> "$GITHUB_OUTPUT"
+        echo "e2e_specs_to_run=$(jq -c '.e2e_specs_to_run' test-plan.json)" >> "$GITHUB_OUTPUT"
+
+    - name: Report test plan
+      shell: bash
+      run: |
+        plan=test-plan.json
+        row() { # name, selected, total
+          if [ "$2" -eq "$3" ]; then echo "| $1 | all ($3) | $3 |"; else echo "| $1 | $2 | $3 |"; fi
+        }
+        {
+          echo "## Affected test plan"
+          echo
+          echo "| Suite | Selected | Total |"
+          echo "|---|---:|---:|"
+          row "Unit" "$(jq '.stats.unit_specs_to_run_usage' "$plan")" "$(jq '.stats.unit_specs_all' "$plan")"
+          row "Loki" "$(jq '.stats.loki_stories_to_run_usage' "$plan")" "$(jq '.stats.loki_stories_all' "$plan")"
+          row "E2E"  "$(jq '.stats.e2e_specs_to_run_usage' "$plan")"  "$(jq '.stats.e2e_specs_all' "$plan")"
+          echo
+          echo "Changed: $(jq '.stats.fe_files_changed' "$plan") FE / $(jq '.stats.be_files_changed' "$plan") BE file(s) · $(jq '.stats.fe_modules_affected_usage' "$plan") FE module(s) affected"
+          echo
+          e2e_run=$(jq '.stats.e2e_specs_to_run_usage' "$plan")
+          e2e_all=$(jq '.stats.e2e_specs_all' "$plan")
+          if [ "$e2e_run" -eq "$e2e_all" ]; then
+            echo "**E2E: full run** — no manifest, or a change the coverage manifest can't scope (backend, e2e infra, cljc/cljs)."
+          else
+            echo "<details><summary><b>E2E specs to run ($e2e_run)</b></summary>"
+            echo
+            jq -r '.e2e_specs_to_run[]' "$plan" | sed 's/^/- /'
+            echo
+            echo "</details>"
+          fi
+          echo
+          echo "<details><summary>Full stats (rules vs usage graph)</summary>"
+          echo
+          echo '```json'
+          jq '.stats' "$plan"
+          echo '```'
+          echo "</details>"
+        } | tee -a "${GITHUB_STEP_SUMMARY:-/dev/null}"

.github/actions/prepare-backend/action.yml

@@ -4,7 +4,7 @@ description: |
 inputs:
   java-version:
     required: true
-    default: "21"
+    default: "25"
   clojure-version:
     required: true
     default: "1.12.0.1488"

.github/actions/prepare-ci-conductor/action.yml

@@ -0,0 +1,52 @@
+name: Prepare CI Conductor
+description: >-
+  Make the ci-conductor sources runnable in the workspace.
+  Unless the checkout is headed for master, they are overlaid from master, so every
+  branch runs the latest scripts while its workflow wiring stays branch-historical.
+
+runs:
+  using: composite
+  steps:
+    - name: Detect bun
+      id: bun
+      shell: bash
+      run: |
+        if command -v bun >/dev/null; then
+          echo "present=true" >> "$GITHUB_OUTPUT"
+        else
+          echo "present=false" >> "$GITHUB_OUTPUT"
+        fi
+
+    - name: Install bun
+      if: steps.bun.outputs.present != 'true'
+      uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+      with:
+        bun-version-file: "package.json"
+        token: ${{ github.token }}
+
+    # Anything headed for master runs master's own sources, so a PR can test its own changes.
+    - name: Fetch ci-conductor sources from master
+      if: ${{ github.base_ref != 'master' && github.ref_name != 'master' }}
+      uses: actions/checkout@v6
+      with:
+        repository: metabase/metabase
+        ref: master
+        path: .ci-conductor-master
+        persist-credentials: false
+        sparse-checkout-cone-mode: false
+        sparse-checkout: |
+          release/ci-conductor
+          e2e/support/ci_conductor.ts
+
+    # e2e/support/config.js and e2e/support/ci_conductor.ts resolve these by relative
+    # path at bundle time, so the sources have to land where the branch expects them.
+    - name: Overlay ci-conductor sources from master
+      if: ${{ github.base_ref != 'master' && github.ref_name != 'master' }}
+      shell: bash
+      run: |
+        set -euo pipefail
+        rm -rf release/ci-conductor
+        mv .ci-conductor-master/release/ci-conductor release/ci-conductor
+        mv .ci-conductor-master/e2e/support/ci_conductor.ts e2e/support/ci_conductor.ts
+        rm -rf .ci-conductor-master
+        echo "Overlaid ci-conductor sources from master."

.github/actions/prepare-cypress/action.yml

@@ -15,6 +15,10 @@ outputs:
 runs:
   using: "composite"
   steps:
+    # e2e/support/config.js imports the reporter, so it has to be in place before Cypress bundles.
+    - name: Prepare CI Conductor
+      uses: ./.github/actions/prepare-ci-conductor
+
     - name: Install Chrome v144
       uses: browser-actions/setup-chrome@2e1d749697dd1612b833dba4a722266286fbefcd # v2.1.2
       with:

.github/actions/prepare-node-bun/action.yml

@@ -16,5 +16,5 @@ runs:
     - name: Install bun
       uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
       with:
-        bun-version: "1.3.14"
+        bun-version-file: 'package.json'
         token: ${{ github.token }}

.github/actions/prepare-release-scripts/action.yml

@@ -6,7 +6,7 @@ runs:
   steps:
     - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
       with:
-        bun-version: "1.3.14"
+        bun-version-file: 'package.json'
         token: ${{ github.token }}
 
     - name: Build release scripts

.github/actions/quarantine-gate/action.yml

@@ -0,0 +1,38 @@
+name: CI Conductor quarantine gate
+description: >-
+  Check this job's test failures against ci-conductor's quarantine list.
+  Either enforces the quarantine or only prints a verdict (dry run).
+  Fails closed when enforcing but the `CI_CONDUCTOR_BASE_URL` is missing or unreachable.
+
+inputs:
+  adapter:
+    description: Which gate to run — one of `backend`, `frontend`, `e2e`.
+    required: true
+  test-suite:
+    description: >-
+      Suite label to gate (CI_CONDUCTOR_TEST_SUITE). MUST match the label this
+      job reports under, or the gate checks the wrong quarantine list.
+    required: true
+  enforce-quarantine:
+    description: >-
+      Whether the gate actually gates the job. When "false", it only prints a verdict.
+    required: false
+    default: "false"
+
+runs:
+  using: composite
+  steps:
+    - name: Prepare CI Conductor
+      uses: ./.github/actions/prepare-ci-conductor
+    - name: Check failures against the quarantine list
+      shell: bash
+      env:
+        CI_CONDUCTOR_TEST_SUITE: ${{ inputs.test-suite }}
+        ADAPTER: ${{ inputs.adapter }}
+        QUARANTINE_DRY_RUN: ${{ inputs.enforce-quarantine != 'true' }}
+      run: |
+        case "$ADAPTER" in
+          backend|frontend|e2e) ;;
+          *) echo "::error::quarantine-gate: unknown adapter '$ADAPTER' (expected backend|frontend|e2e)"; exit 1 ;;
+        esac
+        bun "release/ci-conductor/src/check-${ADAPTER}-quarantine.ts"

.github/actions/report-failures-to-ci-conductor/action.yml

@@ -0,0 +1,34 @@
+name: Report failures to CI Conductor
+description: >-
+  Report this job's test failures to ci-conductor. Best-effort; no-ops unless
+  CI_CONDUCTOR_BASE_URL is set. Gate it at the call site with continue-on-error
+  and an `if:` on the test step's outcome.
+
+inputs:
+  test-suite:
+    description: Per-job identity label (CI_CONDUCTOR_TEST_SUITE); unique per job/leg.
+    required: true
+  adapter:
+    description: Which reporter to run; resolves to report-<adapter>.ts. backend or frontend.
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Prepare CI Conductor
+      uses: ./.github/actions/prepare-ci-conductor
+    - name: Report failed tests to ci-conductor
+      shell: bash
+      env:
+        REPO_ID: ${{ github.event.repository.id }}
+        COMMIT_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+        TARGET_BRANCH: ${{ github.event.pull_request.base.ref || github.ref_name }}
+        CI_CONDUCTOR_TEST_SUITE: ${{ inputs.test-suite }}
+        ADAPTER: ${{ inputs.adapter }}
+      # Keep the path constrained to known entrypoints.
+      run: |
+        case "$ADAPTER" in
+          backend|frontend) ;;
+          *) echo "::error::Unknown ci-conductor adapter '$ADAPTER'"; exit 1 ;;
+        esac
+        bun "release/ci-conductor/src/report-${ADAPTER}.ts"

.github/actions/sdk-bundle-size-check/action.yml

@@ -1,15 +1,17 @@
 name: Embedding SDK Bundle Size Check
 description: |
-  Downloads the current branch's uberjar and builds the base ref's
-  embedding-sdk.js from source, compares their sizes,
-  and sets output if the size change exceeds the threshold.
+  Measures app + embedding SDK bundle sizes from the current and base-ref
+  uberjars (reusing the builds that already ran) plus their bundle-stats
+  artifacts, and flags changes to the chunked SDK's reachable, gzipped size
+  beyond the threshold. Skips when the base-ref artifacts aren't available
+  rather than rebuilding from source (which would compare across pipelines).
 
 inputs:
   edition:
     description: 'Metabase edition (ee or oss)'
     required: true
   base-ref-commit:
-    description: 'Commit SHA of the base ref (e.g. merge base).'
+    description: 'Commit SHA of the base ref.'
     required: true
   threshold-percent:
     description: 'Percent threshold for bundle size change'
@@ -26,51 +28,73 @@ outputs:
 runs:
   using: "composite"
   steps:
-    - name: Prepare backend
-      uses: ./.github/actions/prepare-backend
-    - name: Prepare frontend
-      uses: ./.github/actions/prepare-frontend
     - name: Download current uberjar
       uses: ./.github/actions/fetch-artifact
       with:
         commit: ${{ github.event.pull_request.head.sha || github.sha }}
         edition: ${{ inputs.edition }}
         extract-path: temp/current-uberjar
-    - name: Extract embedding-sdk bundles from current uberjar
-      shell: bash
-      run: |
-        # Extract preserving the jar's internal paths under resources/ so the
-        # shared measure script sees the same layout as a source build. Both the
-        # new (embedding-sdk/legacy + chunks) and old (embedding-sdk.js) layouts
-        # are pulled; whichever exists is what gets measured.
-        mkdir -p temp/current/resources
-        unzip -o temp/current-uberjar/metabase.jar \
-          "frontend_client/app/embedding-sdk/*" \
-          -d temp/current/resources 2>/dev/null || true
-        unzip -o temp/current-uberjar/metabase.jar \
-          "frontend_client/app/embedding-sdk.js" \
-          -d temp/current/resources 2>/dev/null || true
-    - name: Checkout base ref
-      uses: actions/checkout@v6
+    - name: Download base-ref uberjar
+      id: base-jar
+      continue-on-error: true
+      uses: ./.github/actions/fetch-artifact
       with:
-        ref: ${{ inputs.base-ref-commit }}
-        path: temp/base-ref-src
-    - name: Build base-ref embedding-sdk.js
-      shell: bash
-      run: |
-        cd temp/base-ref-src
-        bun install
-        MB_EDITION=${{ inputs.edition }} bun run build-release
-    - name: Measure current and base bundle sizes
-      shell: bash
-      env:
-        MEASURE_BUNDLES: embedding-sdk-legacy,embedding-sdk-chunked
-      run: |
-        MEASURE_ROOT=temp/current node ./.github/scripts/measure-bundle-sizes.js > temp/current-sizes.json
-        MEASURE_ROOT=temp/base-ref-src node ./.github/scripts/measure-bundle-sizes.js > temp/base-sizes.json
-    - name: Compare sizes and set output
+        commit: ${{ inputs.base-ref-commit }}
+        edition: ${{ inputs.edition }}
+        extract-path: temp/base-uberjar
+    - name: Measure and compare bundle sizes
       id: compare
       shell: bash
       env:
+        GH_TOKEN: ${{ github.token }}
+        EDITION: ${{ inputs.edition }}
+        HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+        BASE_SHA: ${{ inputs.base-ref-commit }}
         THRESHOLD: ${{ inputs.threshold-percent }}
-      run: node ./.github/actions/sdk-bundle-size-check/compare.js temp/current-sizes.json temp/base-sizes.json
+        MEASURE_BUNDLES: app,embedding-sdk-legacy,embedding-sdk-chunked
+      run: |
+        set -uo pipefail
+
+        skip() {
+          echo "::notice::Embedding SDK bundle-size check skipped: $1"
+          echo "status=stable" >> "$GITHUB_OUTPUT"
+          echo "size_change_percent=0" >> "$GITHUB_OUTPUT"
+          exit 0
+        }
+
+        # The base ref needs an already-built uberjar. Rebuilding it from source
+        # would compare across two build pipelines (the bug this check used to
+        # have), so skip instead when it — or its stats — isn't available.
+        [ -f temp/base-uberjar/metabase.jar ] || skip "base-ref uberjar not found for ${BASE_SHA}"
+
+        extract_js() { # $1=jar  $2=dest-root
+          mkdir -p "$2/resources"
+          unzip -o "$1" \
+            "frontend_client/app/dist/*" \
+            "frontend_client/app/embed.js" \
+            "frontend_client/app/embedding-sdk/*" \
+            -d "$2/resources" >/dev/null || true
+        }
+
+        fetch_stats() { # $1=sha  $2=dest-dir
+          local name="metabase-bundle-stats-${EDITION}-$1"
+          local id
+          id=$(gh api "/repos/${GITHUB_REPOSITORY}/actions/artifacts?name=${name}" --jq '.artifacts[0].id // empty' 2>/dev/null)
+          [ -n "${id}" ] || return 1
+          mkdir -p "$2"
+          gh api "/repos/${GITHUB_REPOSITORY}/actions/artifacts/${id}/zip" > "$2.zip" 2>/dev/null || return 1
+          unzip -o "$2.zip" -d "$2" >/dev/null || return 1
+        }
+
+        extract_js temp/current-uberjar/metabase.jar temp/current
+        extract_js temp/base-uberjar/metabase.jar temp/base
+
+        fetch_stats "${HEAD_SHA}" temp/current/artifacts || skip "bundle stats not found for current ${HEAD_SHA}"
+        fetch_stats "${BASE_SHA}" temp/base/artifacts || skip "bundle stats not found for base ${BASE_SHA}"
+
+        MEASURE_ROOT=temp/current node ./.github/scripts/measure-bundle-sizes.js > temp/current-sizes.json \
+          || { echo "::error::Failed to measure current bundle sizes"; exit 1; }
+        MEASURE_ROOT=temp/base node ./.github/scripts/measure-bundle-sizes.js > temp/base-sizes.json \
+          || { echo "::error::Failed to measure base bundle sizes"; exit 1; }
+
+        node ./.github/actions/sdk-bundle-size-check/compare.js temp/current-sizes.json temp/base-sizes.json

.github/actions/sdk-bundle-size-check/compare.js

@@ -1,16 +1,72 @@
 /* eslint-disable import/no-commonjs */
-// Diffs the embedding SDK bundle sizes produced by measure-bundle-sizes.js for
-// the current build and the base ref. The gate is driven by the legacy
-// (monolithic) bundle's raw bytes; the chunked delivery is reported for context.
+// Diffs the bundle sizes produced by measure-bundle-sizes.js for the current
+// build and the base ref. Every (bundle, kind) is compared strictly against the
+// same (bundle, kind) — never one bundle type against another — using gzipped
+// (served) bytes. The gate is driven by the chunked SDK's reachable total, which
+// is what the SDK actually delivers.
+//
+// compareBundles is pure (data in, data out) so it can be unit-tested; main()
+// is the thin I/O wrapper that reads the size files, prints the report and sets
+// the step outputs / exit code.
 const fs = require("fs");
 
-const [, , currentPath, basePath] = process.argv;
-const threshold = Number(process.env.THRESHOLD ?? 2);
-
-const current = JSON.parse(fs.readFileSync(currentPath, "utf8"));
-const base = JSON.parse(fs.readFileSync(basePath, "utf8"));
-
 const pick = (rows, bundle, kind) => rows.find(row => row.bundle === bundle && row.kind === kind);
+const keyOf = row => `${row.bundle}/${row.kind}`;
+const mb = bytes => (bytes / 1024 / 1024).toFixed(2);
+const percentOf = (currentBytes, baseBytes) =>
+  baseBytes ? Math.trunc(((currentBytes - baseBytes) * 100) / baseBytes) : 0;
+
+/**
+ * Compare two measurement sets and decide the gate. Returns a human-readable
+ * `report` (always), and exactly one of:
+ *  - `gate`  { status, percent }: the chunked SDK total moved by `percent`.
+ *  - `skip`  reason: the gate is non-actionable (report stable, no comment).
+ *  - `error` reason: the gate inputs are missing (hard failure).
+ */
+function compareBundles({ current, base, threshold }) {
+  const report = ["=== Bundle sizes (gzipped, current vs base) ==="];
+  const keys = [...new Set([...current, ...base].map(keyOf))].sort();
+  for (const key of keys) {
+    const [bundle, kind] = key.split("/");
+    const currentRow = pick(current, bundle, kind);
+    const baseRow = pick(base, bundle, kind);
+    if (!currentRow || !baseRow) {
+      report.push(`${key}: present only in ${currentRow ? "current" : "base"} build`);
+      continue;
+    }
+    const diff = currentRow.gzipBytes - baseRow.gzipBytes;
+    const percent = percentOf(currentRow.gzipBytes, baseRow.gzipBytes);
+    report.push(`${key}: ${mb(currentRow.gzipBytes)}MB vs ${mb(baseRow.gzipBytes)}MB (${percent}%, ${diff} bytes)`);
+  }
+
+  // Gate on the chunked SDK's reachable total (gzipped) — what the SDK ships.
+  const gateCurrent = pick(current, "embedding-sdk-chunked", "total");
+  const gateBase = pick(base, "embedding-sdk-chunked", "total");
+  if (!gateCurrent || !gateBase || !gateBase.gzipBytes) {
+    return { report, error: "Could not find embedding-sdk-chunked total (gzip) in both builds" };
+  }
+
+  // Both sides must measure "total" the same way. A base ref built before the
+  // reachableAssets enrichment collapses its total to the initial set, so
+  // comparing it against the current reachable total reports a phantom jump
+  // (~30%). Skip until the base ref also carries reachable stats (i.e. once
+  // this change is on the base).
+  if (Boolean(gateCurrent.reachable) !== Boolean(gateBase.reachable)) {
+    return {
+      report,
+      skip:
+        `chunked "total" measured differently on each side ` +
+        `(current reachable=${Boolean(gateCurrent.reachable)}, base reachable=${Boolean(gateBase.reachable)}); ` +
+        `the base ref predates the reachable-chunk stats. Resolves once this change is on the base ref.`,
+    };
+  }
+
+  const percent = percentOf(gateCurrent.gzipBytes, gateBase.gzipBytes);
+  const status = percent > threshold ? "increased" : percent < -threshold ? "decreased" : "stable";
+  return { report, gate: { status, percent } };
+}
+
+module.exports = { compareBundles };
 
 const setOutput = (name, value) => {
   if (process.env.GITHUB_OUTPUT) {
@@ -18,37 +74,37 @@ const setOutput = (name, value) => {
   }
 };
 
-const mb = bytes => (bytes / 1024 / 1024).toFixed(2);
+function main() {
+  const [, , currentPath, basePath] = process.argv;
+  const threshold = Number(process.env.THRESHOLD ?? 2);
 
-const legacyCurrent = pick(current, "embedding-sdk-legacy", "total");
-const legacyBase = pick(base, "embedding-sdk-legacy", "total");
+  const current = JSON.parse(fs.readFileSync(currentPath, "utf8"));
+  const base = JSON.parse(fs.readFileSync(basePath, "utf8"));
 
-if (!legacyCurrent || !legacyBase || !legacyBase.rawBytes) {
-  console.error("::error::Could not find embedding-sdk-legacy size in both builds");
-  process.exit(1);
-}
+  const { report, gate, skip, error } = compareBundles({ current, base, threshold });
+  console.log(report.join("\n"));
 
-const diff = legacyCurrent.rawBytes - legacyBase.rawBytes;
-const percent = Math.trunc((diff * 100) / legacyBase.rawBytes);
+  if (error) {
+    console.error(`::error::${error}`);
+    process.exit(1);
+  }
 
-const status = percent > threshold ? "increased" : percent < -threshold ? "decreased" : "stable";
+  if (skip) {
+    // Treat the gate as non-actionable: report stable so no regression comment
+    // is posted, mirroring the shell skip() for missing artifacts.
+    console.log(`::notice::Embedding SDK bundle-size gate skipped: ${skip}`);
+    setOutput("status", "stable");
+    setOutput("size_change_percent", "0");
+    process.exit(0);
+  }
 
-console.log("=== Embedding SDK legacy (monolithic) bundle ===");
-console.log(`Current:  ${legacyCurrent.rawBytes} bytes raw / ${mb(legacyCurrent.gzipBytes)}MB gzip`);
-console.log(`Base ref: ${legacyBase.rawBytes} bytes raw / ${mb(legacyBase.gzipBytes)}MB gzip`);
-console.log(`Difference: ${diff} bytes (${percent}%), threshold ${threshold}%`);
-console.log(`Status: ${status}`);
-
-const chunkedCurrent = pick(current, "embedding-sdk-chunked", "total");
-const chunkedBase = pick(base, "embedding-sdk-chunked", "total");
-if (chunkedCurrent && chunkedBase) {
-  const chunkedDiff = chunkedCurrent.rawBytes - chunkedBase.rawBytes;
   console.log("");
-  console.log("=== Embedding SDK chunked (informational) ===");
-  console.log(`Current:  ${chunkedCurrent.rawBytes} bytes raw / ${mb(chunkedCurrent.gzipBytes)}MB gzip`);
-  console.log(`Base ref: ${chunkedBase.rawBytes} bytes raw / ${mb(chunkedBase.gzipBytes)}MB gzip`);
-  console.log(`Difference: ${chunkedDiff} bytes`);
+  console.log(`Gate: embedding-sdk-chunked total ${gate.percent}% (threshold ${threshold}%) → ${gate.status}`);
+
+  setOutput("status", gate.status);
+  setOutput("size_change_percent", gate.percent);
 }
 
-setOutput("status", status);
-setOutput("size_change_percent", percent);
+if (require.main === module) {
+  main();
+}

.github/actions/sdk-bundle-size-check/compare.unit.spec.js

@@ -0,0 +1,65 @@
+const { compareBundles } = require("./compare");
+
+const total = (gzipBytes, over = {}) => ({
+  bundle: "embedding-sdk-chunked",
+  kind: "total",
+  gzipBytes,
+  reachable: true,
+  ...over,
+});
+
+describe("compareBundles", () => {
+  it("gates on the chunked SDK total and flags an increase past the threshold", () => {
+    const { gate, report } = compareBundles({
+      current: [total(110)],
+      base: [total(100)],
+      threshold: 2,
+    });
+
+    expect(gate).toEqual({ status: "increased", percent: 10 });
+    expect(report[0]).toContain("current vs base");
+  });
+
+  it("flags a decrease and stays stable within the threshold", () => {
+    expect(compareBundles({ current: [total(90)], base: [total(100)], threshold: 2 }).gate).toEqual({
+      status: "decreased",
+      percent: -10,
+    });
+    expect(compareBundles({ current: [total(101)], base: [total(100)], threshold: 2 }).gate).toEqual({
+      status: "stable",
+      percent: 1,
+    });
+  });
+
+  it("skips when the two sides measured total differently (reachable mismatch)", () => {
+    const result = compareBundles({
+      current: [total(130, { reachable: true })],
+      base: [total(100, { reachable: false })],
+      threshold: 2,
+    });
+
+    expect(result.gate).toBeUndefined();
+    expect(result.skip).toContain("predates the reachable-chunk stats");
+  });
+
+  it("errors when the gate bundle is missing on either side", () => {
+    const result = compareBundles({
+      current: [{ bundle: "app", kind: "total", gzipBytes: 1 }],
+      base: [total(100)],
+      threshold: 2,
+    });
+
+    expect(result.gate).toBeUndefined();
+    expect(result.error).toContain("embedding-sdk-chunked total");
+  });
+
+  it("reports a bundle/kind present on only one side without erroring", () => {
+    const { report } = compareBundles({
+      current: [total(100), { bundle: "app", kind: "total", gzipBytes: 50 }],
+      base: [total(100)],
+      threshold: 2,
+    });
+
+    expect(report.some(line => line.includes("present only in current build"))).toBe(true);
+  });
+});

.github/actions/test-driver/action.yml

@@ -14,8 +14,15 @@ inputs:
     description: Suffix to append to the test logs artifact name to avoid conflicts in matrix jobs
   edition:
     required: false
-    default: 'ee'
+    default: "ee"
     description: Edition to test (oss or ee)
+  quarantine-engine:
+    required: false
+  driver-status:
+    required: false
+    default: ""
+    description: >-
+      Configured status for this driver ("info", "skip", "required", or empty), as reported by `mage driver-decisions`.
 
 outputs:
   test-outcome:
@@ -27,6 +34,10 @@ runs:
   steps:
     - name: Prepare back-end environment
       uses: ./.github/actions/prepare-backend
+    - name: Resolve current job id
+      # Resolve JOB_ID early (before the long test step) so the ci-conductor
+      # reporter below can link failures to this exact job. Best-effort.
+      uses: ./.github/actions/resolve-job-id
     - name: Prepare front-end environment
       if: ${{ inputs.build-static-viz == 'true' }}
       uses: ./.github/actions/prepare-frontend
@@ -35,15 +46,25 @@ runs:
       run: bun run build-static-viz
       shell: bash
       env:
-        MB_EDITION: ee
+        MB_EDITION: ${{ inputs.edition }}
+
     - name: Test database driver
       run: clojure -X:dev:ci:${{ inputs.edition }}:${{ inputs.edition }}-dev:drivers:drivers-dev:test ${{ inputs.test-args }}
       shell: bash
       id: run-test
-      # Trunk Quarantine controls the final state of the run in the CI!
-      # Even if this step fails we let it pass, and then `trunk-io/analytics-uploader` determines
-      # whether to fail or to pass the whole job, based on the quarantine list.
+      # Keep this step continue-on-error because the quarantine logic controls whether it ultimately fails.
+      # Driver "info" status can affect this logic. See below.
       continue-on-error: true
+
+    - name: Report failed tests to ci-conductor
+      if: ${{ !cancelled() && steps.run-test.outcome == 'failure' }}
+      # This step should NEVER fail the job!
+      continue-on-error: true
+      uses: ./.github/actions/report-failures-to-ci-conductor
+      with:
+        test-suite: ${{ inputs.junit-name }}
+        adapter: backend
+
     - name: Publish Test Report (JUnit)
       uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
       # As per the documentation: https://docs.github.com/en/actions/reference/workflows-and-actions/contexts#steps-context
@@ -57,6 +78,7 @@ runs:
         list-suites: failed
         list-tests: failed
         fail-on-error: false
+
     - name: Upload Logs on Failure
       if: always() && steps.run-test.outcome != 'success'
       uses: actions/upload-artifact@v7
@@ -66,3 +88,20 @@ runs:
         retention-days: 1
       # Failing to upload the artifact should never affect the outcome of the whole test run.
       continue-on-error: true
+
+    # Last, because this is the only step allowed to fail the job: everything above it reports the
+    # failure (JUnit report, logs, ci-conductor) and must run regardless of the verdict below.
+    - name: Quarantine gate
+      # Off master and release branches an "info" driver is data-collection only - the test always passes!
+      # On master and release branches "info" carries no weight - the quarantine logic applies.
+      if: |
+        !cancelled()
+        && steps.run-test.outcome == 'failure'
+        && !(inputs.driver-status == 'info'
+             && !(github.ref_name == 'master' || startsWith(github.ref_name, 'release-x')))
+      continue-on-error: ${{ inputs.quarantine-engine != 'ci-conductor' }}
+      uses: ./.github/actions/quarantine-gate
+      with:
+        adapter: backend
+        test-suite: ${{ inputs.junit-name }}
+        enforce-quarantine: ${{ inputs.quarantine-engine == 'ci-conductor' }}

.github/actions/upload-test-results/action.yml

@@ -34,6 +34,10 @@ inputs:
     description: >-
       Optional label disambiguating matrix legs of the same job, so the info-driver
       job summary and PR comment stay distinct per leg.
+  run-trunk:
+    required: false
+    default: "true"
+    description: Whether to run the Trunk step at all.
 
 runs:
   using: "composite"
@@ -60,13 +64,12 @@ runs:
         aws s3 cp ${OUTPUT_FILE}.zip s3://$BUCKET/$DATE/$GITHUB_RUN_ID/$GITHUB_RUN_ATTEMPT/
 
     - name: Upload results to Trunk
+      if: ${{ always() && github.repository_owner == 'metabase' && inputs.run-trunk == 'true' }}
       # Important!
-      # 1. This step must always run because it controls job's exit code.
-      # 2. There's no point in running this outside the organization
-      # 3. For "info" drivers our own status takes precedence: we let this step pass so
-      #    the job is reported as passing regardless of the real outcome (still uploaded).
-      if: always() && github.repository_owner == 'metabase'
-      continue-on-error: ${{ inputs.driver-status == 'info' }}
+      # For "info" drivers off master/release branches, our own status takes precedence: we let this
+      # step pass so the job is reported as passing regardless of the real outcome (still uploaded).
+      # On master and release branches, info status is ignored and the real outcome gates the job.
+      continue-on-error: ${{ inputs.driver-status == 'info' && !(github.ref_name == 'master' || startsWith(github.ref_name, 'release-x')) }}
       uses: trunk-io/analytics-uploader@1198efcc0976501147b10a7e343c3fa069527526 # v2.0.9
       env:
         TRUNK_REPO_URL: git@github.com:metabase/metabase.git

.github/file-paths.yaml

@@ -7,6 +7,10 @@ default: &default
   - "locales/**"
   - "bin/**/!(*.md)"
 
+actionlint:
+  - ".github/workflows/*.yml"
+  - ".github/workflows/*.yaml"
+
 shared_sources: &shared_sources
   - "src/**/*.cljc"
   - "src/**/*.cljs"
@@ -95,6 +99,12 @@ frontend_loki_infra: &frontend_loki_infra
   - *shared_ci
   - *frontend_loki_ci
 
+# e2e harness/support code (commands, support file, runner). Not in the
+# instrumented bundle, so it maps to no covered module — a change here forces a
+# full e2e run (see create-test-plan / e2eInfraTouched).
+e2e_infra: &e2e_infra
+  - *shared_e2e
+
 backend_ci: &backend_ci
   - *shared_ci
   - ".github/actions/test-driver/**"

.github/scripts/affected-modules.ts

@@ -1,32 +1,191 @@
+import micromatch from "micromatch";
+
 export type ModuleDef = { type: string; pattern: string };
 export type Rule = { from: string[]; allow: string[] };
 
-type ModuleNode = { type: string; regex: RegExp };
+export type ModuleNode = { type: string; regex: RegExp };
+
+export type FileDependency = { source: string; dependencies: string[] };
+
+/** First match wins, so element order matters for nested patterns. */
+export function buildNodes(elements: ModuleDef[]): ModuleNode[] {
+  return elements.map((el) => ({
+    type: el.type,
+    // dot:true so files in dot-directories (e.g. .storybook) still match.
+    regex: micromatch.makeRe(el.pattern, { dot: true }),
+  }));
+}
+
+export function mapFileToModule(
+  nodes: ModuleNode[],
+  path: string,
+): string | null {
+  for (const node of nodes) {
+    if (node.regex.test(path)) {
+      return node.type;
+    }
+  }
+  return null;
+}
+
+export function getChangedModules(
+  nodes: ModuleNode[],
+  changedFiles: string[],
+): Set<string> {
+  const direct = new Set<string>();
+  for (const file of changedFiles) {
+    const module = mapFileToModule(nodes, file);
+    if (module) {
+      direct.add(module);
+    }
+  }
+  return direct;
+}
+
+export type FileGraph = {
+  nodes: ModuleNode[];
+  fileDependents: Map<string, Set<string>>;
+};
+
+/** Drops unresolvable imports (e.g. ambient types) that point at no real file. */
+export function parseCruiseModules(
+  modules: Array<{
+    source: string;
+    dependencies?: Array<{ resolved: string; couldNotResolve?: boolean }>;
+  }>,
+): FileDependency[] {
+  return modules.map((module) => ({
+    source: module.source,
+    dependencies: (module.dependencies ?? [])
+      .filter((dep) => !dep.couldNotResolve)
+      .map((dep) => dep.resolved),
+  }));
+}
+
+/** Inverts the import edges into the `fileDependents` reverse graph. */
+export function buildFileGraph(
+  elements: ModuleDef[],
+  fileDependencies: FileDependency[],
+): FileGraph {
+  const fileDependents = new Map<string, Set<string>>();
+  for (const { source, dependencies } of fileDependencies) {
+    for (const target of dependencies) {
+      let importers = fileDependents.get(target);
+      if (!importers) {
+        importers = new Set();
+        fileDependents.set(target, importers);
+      }
+      importers.add(source);
+    }
+  }
+  return { nodes: buildNodes(elements), fileDependents };
+}
+
+/** Changed files plus every file that transitively imports them. */
+export function getAffectedFiles(
+  fileGraph: FileGraph,
+  changedFiles: string[],
+): Set<string> {
+  const affected = new Set(changedFiles);
+  const queue = [...changedFiles];
+  while (queue.length > 0) {
+    const file = queue.shift()!;
+    for (const importer of fileGraph.fileDependents.get(file) ?? []) {
+      if (!affected.has(importer)) {
+        affected.add(importer);
+        queue.push(importer);
+      }
+    }
+  }
+  return affected;
+}
 
 export type ModuleGraph = {
   nodes: ModuleNode[];
+  /**
+   * dependents.get(M) is every module affected when M changes — the full
+   * transitive closure, so getAffectedModules only needs a single hop.
+   */
   dependents: Map<string, Set<string>>;
 };
 
+/** Expands a direct-dependents map into its transitive closure. */
+function transitiveClosure(
+  direct: Map<string, Set<string>>,
+): Map<string, Set<string>> {
+  const closure = new Map<string, Set<string>>();
+  for (const start of direct.keys()) {
+    const reached = new Set<string>();
+    const queue = [...(direct.get(start) ?? [])];
+    while (queue.length > 0) {
+      const node = queue.shift()!;
+      if (reached.has(node)) {
+        continue;
+      }
+      reached.add(node);
+      for (const next of direct.get(node) ?? []) {
+        queue.push(next);
+      }
+    }
+    reached.delete(start);
+    closure.set(start, reached);
+  }
+  return closure;
+}
+
 /**
- * Compiles a glob pattern to an anchored RegExp.
+ * Builds a module graph from the actual import graph. Reachability is computed
+ * per module at the file level and then collapsed to modules.
  */
-export function globToRegex(glob: string): RegExp {
-  const escapeSegment = (seg: string) =>
-    seg.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, "[^/]*");
-  const body = glob.split("**").map(escapeSegment).join(".*");
-  return new RegExp(`^${body}$`);
+export function buildUsageModuleGraph(
+  elements: ModuleDef[],
+  fileDependencies: FileDependency[],
+): ModuleGraph {
+  const nodes = buildNodes(elements);
+  const fileGraph = buildFileGraph(elements, fileDependencies);
+
+  const filesByModule = new Map<string, string[]>();
+  const allFiles = new Set<string>();
+  for (const { source, dependencies } of fileDependencies) {
+    allFiles.add(source);
+    for (const target of dependencies) {
+      allFiles.add(target);
+    }
+  }
+  for (const file of allFiles) {
+    const module = mapFileToModule(nodes, file);
+    if (module) {
+      const files = filesByModule.get(module);
+      if (files) {
+        files.push(file);
+      } else {
+        filesByModule.set(module, [file]);
+      }
+    }
+  }
+
+  const dependents = new Map<string, Set<string>>(
+    elements.map((el) => [el.type, new Set()]),
+  );
+  for (const [module, files] of filesByModule) {
+    const affected = new Set<string>();
+    for (const file of getAffectedFiles(fileGraph, files)) {
+      const owner = mapFileToModule(nodes, file);
+      if (owner && owner !== module) {
+        affected.add(owner);
+      }
+    }
+    dependents.set(module, affected);
+  }
+
+  return { nodes, dependents };
 }
 
 export function buildModuleGraph(
   elements: ModuleDef[],
   rules: Rule[],
 ): ModuleGraph {
-  const nodes = elements.map((el) => ({
-    type: el.type,
-    regex: globToRegex(el.pattern),
-  }));
-
+  const nodes = buildNodes(elements);
   const allTypes = elements.map((e) => e.type);
 
   function expandPattern(pattern: string): string[] {
@@ -40,9 +199,7 @@ export function buildModuleGraph(
     return allTypes.includes(pattern) ? [pattern] : [];
   }
 
-  // dependents.get(M) is the set of modules that depend on M
-  // i.e. modules that are affected when M changes
-  const dependents = new Map<string, Set<string>>(
+  const directDependents = new Map<string, Set<string>>(
     allTypes.map((type) => [type, new Set()]),
   );
   for (const rule of rules) {
@@ -51,46 +208,13 @@ export function buildModuleGraph(
     for (const target of allowTypes) {
       for (const importer of fromTypes) {
         if (importer !== target) {
-          dependents.get(target)?.add(importer);
+          directDependents.get(target)?.add(importer);
         }
       }
     }
   }
 
-  return { nodes, dependents };
-}
-
-/**
- * Returns the module type that owns the given file.
- * First match wins, so element ordering matters for nested patterns.
- */
-export function mapFileToModule(
-  moduleGraph: ModuleGraph,
-  path: string,
-): string | null {
-  for (const el of moduleGraph.nodes) {
-    if (el.regex.test(path)) {
-      return el.type;
-    }
-  }
-  return null;
-}
-
-/**
- * Returns the set of module types containing any of the changed files.
- */
-export function getChangedModules(
-  moduleGraph: ModuleGraph,
-  changedFiles: string[],
-): Set<string> {
-  const direct = new Set<string>();
-  for (const file of changedFiles) {
-    const module = mapFileToModule(moduleGraph, file);
-    if (module) {
-      direct.add(module);
-    }
-  }
-  return direct;
+  return { nodes, dependents: transitiveClosure(directDependents) };
 }
 
 /**
@@ -100,16 +224,10 @@ export function getAffectedModules(
   moduleGraph: ModuleGraph,
   changedFiles: string[],
 ): Set<string> {
-  const direct = getChangedModules(moduleGraph, changedFiles);
-  const affected = new Set(direct);
-  const queue = [...direct];
-  while (queue.length > 0) {
-    const module = queue.shift()!;
+  const affected = getChangedModules(moduleGraph.nodes, changedFiles);
+  for (const module of [...affected]) {
     for (const dep of moduleGraph.dependents.get(module) ?? []) {
-      if (!affected.has(dep)) {
-        affected.add(dep);
-        queue.push(dep);
-      }
+      affected.add(dep);
     }
   }
   return affected;

.github/scripts/affected-modules.unit.spec.ts

@@ -1,8 +1,13 @@
 import {
+  buildFileGraph,
   buildModuleGraph,
+  buildNodes,
+  buildUsageModuleGraph,
+  getAffectedFiles,
   getAffectedModules,
   getChangedModules,
   mapFileToModule,
+  parseCruiseModules,
 } from "./affected-modules";
 
 const ELEMENTS = [
@@ -31,6 +36,7 @@ const RULES = [
   { from: ["app/*"], allow: ["lib/*", "feature/*", "app/*"] },
 ];
 
+const nodes = buildNodes(ELEMENTS);
 const graph = buildModuleGraph(ELEMENTS, RULES);
 
 describe("affected modules", () => {
@@ -49,19 +55,19 @@ describe("affected modules", () => {
       ["external/lib/foo.ts", "feature/external"],
       ["src/embed.tsx", "app/main"],
     ])("should map %s to %s", (path, expected) => {
-      expect(mapFileToModule(graph, path)).toBe(expected);
+      expect(mapFileToModule(nodes, path)).toBe(expected);
     });
 
     it("should return null for files outside any pattern", () => {
-      expect(mapFileToModule(graph, "docs/foo.md")).toBe(null);
-      expect(mapFileToModule(graph, "README.md")).toBe(null);
-      expect(mapFileToModule(graph, "external/notlib/foo.ts")).toBe(null);
+      expect(mapFileToModule(nodes, "docs/foo.md")).toBe(null);
+      expect(mapFileToModule(nodes, "README.md")).toBe(null);
+      expect(mapFileToModule(nodes, "external/notlib/foo.ts")).toBe(null);
     });
   });
 
   describe("getChangedModules", () => {
     it("should return the unique set of modules whose files changed", () => {
-      const result = getChangedModules(graph, [
+      const result = getChangedModules(nodes, [
         "src/utils/colors.ts",
         "src/foo/x.ts",
         "src/foo/y.ts",
@@ -71,11 +77,81 @@ describe("affected modules", () => {
     });
 
     it("should return an empty set when no file maps to a module", () => {
-      expect(getChangedModules(graph, ["docs/foo.md"]).size).toBe(0);
+      expect(getChangedModules(nodes, ["docs/foo.md"]).size).toBe(0);
     });
   });
 
-  describe("getAffectedModules", () => {
+  describe("parseCruiseModules", () => {
+    it("should flatten to source + resolved-paths and drop unresolved deps", () => {
+      expect(
+        parseCruiseModules([
+          {
+            source: "src/foo/foo.tsx",
+            dependencies: [
+              { resolved: "src/utils/colors.ts" },
+              { resolved: "ambient/types", couldNotResolve: true },
+            ],
+          },
+          { source: "src/bar/bar.tsx" }, // no dependencies key
+        ]),
+      ).toEqual([
+        { source: "src/foo/foo.tsx", dependencies: ["src/utils/colors.ts"] },
+        { source: "src/bar/bar.tsx", dependencies: [] },
+      ]);
+    });
+  });
+
+  const FILE_DEPS = [
+    { source: "src/app.js", dependencies: ["src/foo/foo.tsx"] },
+    { source: "src/bar/bar.tsx", dependencies: ["src/embed.tsx"] },
+    { source: "src/foo/foo.tsx", dependencies: ["src/utils/colors.ts"] },
+  ];
+  const fileGraph = buildFileGraph(ELEMENTS, FILE_DEPS);
+
+  describe("getAffectedFiles", () => {
+    it("should return the changed file and everything that imports it", () => {
+      expect(
+        [...getAffectedFiles(fileGraph, ["src/utils/colors.ts"])].sort(),
+      ).toEqual(["src/app.js", "src/foo/foo.tsx", "src/utils/colors.ts"]);
+    });
+
+    it("should include a changed file with no importers (itself only)", () => {
+      // Nothing imports the app.js entry point.
+      expect([...getAffectedFiles(fileGraph, ["src/app.js"])]).toEqual([
+        "src/app.js",
+      ]);
+    });
+  });
+
+  describe("buildUsageModuleGraph + getAffectedModules", () => {
+    const usageGraph = buildUsageModuleGraph(ELEMENTS, FILE_DEPS);
+
+    it("should expand a changed module to its file-level affected modules", () => {
+      expect(
+        [...getAffectedModules(usageGraph, ["src/utils/colors.ts"])].sort(),
+      ).toEqual(["app/main", "feature/foo", "lib/utils"]);
+    });
+
+    it("should NOT pull in feature/bar via the app/main hub", () => {
+      const affected = getAffectedModules(usageGraph, ["src/foo/foo.tsx"]);
+      expect([...affected].sort()).toEqual(["app/main", "feature/foo"]);
+      expect(affected.has("feature/bar")).toBe(false);
+    });
+
+    it("should treat the whole changed module as changed", () => {
+      // app.js itself has no importers, but app/main also owns embed.tsx, which
+      // feature/bar imports so changing any app/main file flags feature/bar.
+      expect(
+        [...getAffectedModules(usageGraph, ["src/app.js"])].sort(),
+      ).toEqual(["app/main", "feature/bar"]);
+    });
+
+    it("should return empty when no file maps to a module", () => {
+      expect(getAffectedModules(usageGraph, ["docs/foo.md"]).size).toBe(0);
+    });
+  });
+
+  describe("getAffectedModules (rules graph)", () => {
     it("should affect feature/super and app/main but not feature/bar when feature/foo changes", () => {
       const result = getAffectedModules(graph, ["src/foo/x.ts"]);
       expect([...result].sort()).toEqual([

.github/scripts/affected-tests.ts

@@ -1,36 +1,40 @@
-// Per-suite affected-tests logic: combines module-affected closure with
-// per-suite "infra-touched" booleans (computed by dorny/paths-filter against
-// the `frontend_unit_infra` / `frontend_loki_infra` anchors in file-paths.yaml).
-// When infra files change, the whole suite runs in full.
+// Builds the affected-tests plan from raw inputs: computes the rules and usage
+// affected-module sets and selects, per suite, which specs to run under each.
+import { getFeatureModules } from "../../frontend/lint/module-boundaries.mjs";
 
 import {
+  type FileDependency,
   type ModuleDef,
-  type ModuleGraph,
+  type ModuleNode,
   type Rule,
   buildModuleGraph,
+  buildUsageModuleGraph,
   getAffectedModules,
   getChangedModules,
   mapFileToModule,
 } from "./affected-modules";
 
-export type TestSuiteDef = {
-  statsPrefix: string;
-  runAllTests?: boolean;
-};
-
 export type TestPlanStats = {
-  modules_changed: number;
-  modules_affected: number;
-  modules_affected_list: string[];
-  fe_unit_specs_total: number;
-  fe_unit_specs_run: number;
-  fe_unit_specs_skipped: number;
-  loki_stories_total: number;
-  loki_stories_run: number;
-  loki_stories_skipped: number;
-  e2e_specs_total: number;
-  e2e_specs_run: number;
-  e2e_specs_skipped: number;
+  fe_files_changed: number;
+  fe_files_total: number;
+  be_files_changed: number;
+  be_files_total: number;
+  unit_infra_touched: boolean;
+  loki_infra_touched: boolean;
+  shared_sources_touched: boolean;
+  fe_modules_total: number;
+  fe_modules_changed: number;
+  fe_modules_affected_rules: number;
+  fe_modules_affected_usage: number;
+  unit_specs_all: number;
+  unit_specs_to_run_rules: number;
+  unit_specs_to_run_usage: number;
+  loki_stories_all: number;
+  loki_stories_to_run_rules: number;
+  loki_stories_to_run_usage: number;
+  e2e_specs_all: number;
+  e2e_specs_to_run_rules: number;
+  e2e_specs_to_run_usage: number;
 };
 
 export type TestPlan = {
@@ -40,101 +44,187 @@ export type TestPlan = {
   e2e_specs_to_run: string[];
 };
 
-export const TEST_SUITES = {
-  unit: {
-    statsPrefix: "fe_unit_specs",
-  },
-  loki: {
-    statsPrefix: "loki_stories",
-  },
-  e2e: {
-    statsPrefix: "e2e_specs",
-    // We don't map changed files to e2e tests yet, so for now just run them all
-    runAllTests: true,
-  },
-} satisfies Record<string, TestSuiteDef>;
-
-export function createTestPlan({
-  elements,
-  rules,
-  testSuites,
-  changedFiles,
-  testFilesBySuite,
-  infraTouchedBySuite,
-}: {
+export type CreateTestPlanInput = {
   elements: ModuleDef[];
   rules: Rule[];
-  testSuites: Record<string, TestSuiteDef>;
   changedFiles: string[];
-  testFilesBySuite: Record<string, string[]>;
-  infraTouchedBySuite: Record<string, boolean>;
-}): TestPlan {
-  const moduleGraph = buildModuleGraph(elements, rules);
+  // Parsed dependency-cruiser edges, or null to fall back to the rules graph.
+  fileDependencies: FileDependency[] | null;
+  testFilesBySuite: { unit: string[]; loki: string[]; e2e: string[] };
+  e2eSpecFiles: Record<string, string[]> | null;
+  unitInfraTouched: boolean;
+  lokiInfraTouched: boolean;
+  e2eInfraTouched: boolean;
+  sharedSourcesTouched: boolean;
+  feFilesChanged: number;
+  beFilesChanged: number;
+  feFilesTotal: number;
+  beFilesTotal: number;
+};
 
-  const changedModules = getChangedModules(moduleGraph, changedFiles);
-  const modulesAffected = getAffectedModules(moduleGraph, changedFiles);
-  const modulesAffectedList = [...modulesAffected].sort();
-
-  const specsToRun: Record<string, string[]> = {};
-  const stats: Record<string, number | string[]> = {
-    modules_changed: changedModules.size,
-    modules_affected: modulesAffected.size,
-    modules_affected_list: modulesAffectedList,
-  };
-
-  for (const [name, testSuite] of Object.entries(testSuites)) {
-    const files = testFilesBySuite[name] ?? [];
-    const tests = createTestPlanForSuite(
-      moduleGraph,
-      testSuite,
-      infraTouchedBySuite[name] ?? false,
-      changedFiles,
-      files,
-    );
-    specsToRun[name] = tests;
-    stats[`${testSuite.statsPrefix}_total`] = files.length;
-    stats[`${testSuite.statsPrefix}_run`] = tests.length;
-    stats[`${testSuite.statsPrefix}_skipped`] = files.length - tests.length;
-  }
-
-  return {
-    stats: stats as TestPlanStats,
-    fe_unit_specs_to_run: specsToRun.unit ?? [],
-    loki_stories_to_run: specsToRun.loki ?? [],
-    e2e_specs_to_run: specsToRun.e2e ?? [],
-  };
-}
-
-/**
- * Computes the test plan for one test suite
- *
- * Runs the full suite when `runAllTests` is set or `infraTouched` is true,
- * otherwise runs the tests based on affected-modules.
- */
-export function createTestPlanForSuite(
-  moduleGraph: ModuleGraph,
-  testSuite: TestSuiteDef,
-  infraTouched: boolean,
-  changedFiles: string[],
-  allTestFiles: string[],
-): string[] {
-  if (testSuite.runAllTests || infraTouched) {
-    return allTestFiles;
-  }
-  const affected = getAffectedModules(moduleGraph, changedFiles);
-  return filterAffectedTests(moduleGraph, affected, allTestFiles);
-}
-
-/**
- * Filters the test-file list down to tests whose owning module is affected.
- */
+// Tests whose owning module is affected.
 export function filterAffectedTests(
-  moduleGraph: ModuleGraph,
+  nodes: ModuleNode[],
   affected: Set<string>,
   testFiles: string[],
 ): string[] {
   return testFiles.filter((file) => {
-    const module = mapFileToModule(moduleGraph, file);
+    const module = mapFileToModule(nodes, file);
     return module !== null && affected.has(module);
   });
 }
+
+// Collapse each spec's covered files to the *feature* modules it exercises,
+// once, for reuse across the rules/usage selects. Non-feature tiers
+// (shared/lib/...) are intentionally dropped: the manifest is a stale nightly
+// artifact, so its coupling to the module graph stays minimal ("does this spec
+// touch feature X?"). Accuracy comes from the fresh `affected` set, which
+// already expands a shared/infra change into the feature modules that depend on
+// it.
+export function specFeatureModules(
+  nodes: ModuleNode[],
+  featureModules: Set<string>,
+  specFiles: Record<string, string[]>,
+): Map<string, Set<string>> {
+  const moduleCache = new Map<string, string | null>();
+  const moduleOf = (file: string): string | null => {
+    let module = moduleCache.get(file);
+    if (module === undefined) {
+      module = mapFileToModule(nodes, file);
+      moduleCache.set(file, module);
+    }
+    return module;
+  };
+
+  const result = new Map<string, Set<string>>();
+  for (const [spec, files] of Object.entries(specFiles)) {
+    const features = new Set<string>();
+    for (const file of files) {
+      const module = moduleOf(file);
+      if (module !== null && featureModules.has(module)) {
+        features.add(module);
+      }
+    }
+    result.set(spec, features);
+  }
+  return result;
+}
+
+// A spec runs if any feature module it covers is affected.
+// A spec doesn't map to any feature module always runs because its scope is unknown
+export function filterAffectedE2eSpecs(
+  specFeatures: Map<string, Set<string>>,
+  affected: Set<string>,
+  e2eSpecs: string[],
+): string[] {
+  return e2eSpecs.filter((spec) => {
+    const features = specFeatures.get(spec);
+    if (!features || features.size === 0) {
+      return true;
+    }
+    return [...features].some((module) => affected.has(module));
+  });
+}
+
+export function createTestPlan({
+  elements,
+  rules,
+  changedFiles,
+  fileDependencies,
+  testFilesBySuite,
+  e2eSpecFiles,
+  unitInfraTouched,
+  lokiInfraTouched,
+  e2eInfraTouched,
+  sharedSourcesTouched,
+  feFilesChanged,
+  beFilesChanged,
+  feFilesTotal,
+  beFilesTotal,
+}: CreateTestPlanInput): TestPlan {
+  const rulesGraph = buildModuleGraph(elements, rules);
+  const usageGraph = fileDependencies
+    ? buildUsageModuleGraph(elements, fileDependencies)
+    : rulesGraph;
+
+  const nodes = rulesGraph.nodes;
+  // Distinct module types (an element type can span several patterns).
+  const totalModules = new Set(elements.map((el) => el.type)).size;
+  const changedModules = getChangedModules(nodes, changedFiles);
+  const rulesAffected = getAffectedModules(rulesGraph, changedFiles);
+  const usageAffected = getAffectedModules(usageGraph, changedFiles);
+
+  // The coarse "feature" tier is the only set the e2e manifest is ever
+  // collapsed to (see filterAffectedE2eSpecs).
+  const featureModules = new Set(getFeatureModules(elements));
+
+  // cljc/cljs compile into the FE bundle, so they force a full run that module
+  // selection can't narrow — same effect as a suite's own infra changing.
+  const unitForceAll = unitInfraTouched || sharedSourcesTouched;
+  const lokiForceAll = lokiInfraTouched || sharedSourcesTouched;
+  // e2e is integration-level, so anything the FE-coverage manifest can't see
+  // forces a full run: cljc/cljs in the bundle (sharedSourcesTouched), a backend
+  // change that can break the UI (beFilesChanged), an e2e harness/support change
+  // (e2eInfraTouched), or no manifest at all.
+  const e2eForceAll =
+    sharedSourcesTouched ||
+    e2eInfraTouched ||
+    beFilesChanged > 0 ||
+    e2eSpecFiles === null;
+
+  const select = (forceAll: boolean, affected: Set<string>, files: string[]) =>
+    forceAll ? files : filterAffectedTests(nodes, affected, files);
+
+  const { unit, loki, e2e } = testFilesBySuite;
+  const unitRules = select(unitForceAll, rulesAffected, unit);
+  const unitUsage = select(unitForceAll, usageAffected, unit);
+  const lokiRules = select(lokiForceAll, rulesAffected, loki);
+  const lokiUsage = select(lokiForceAll, usageAffected, loki);
+
+  // Precompute spec -> feature modules once (null when e2e runs in full).
+  const specFeatures =
+    e2eForceAll || e2eSpecFiles === null
+      ? null
+      : specFeatureModules(nodes, featureModules, e2eSpecFiles);
+  // A spec that was itself edited always runs, even when no app module changed.
+  const changedSet = new Set(changedFiles);
+  const selectE2e = (affected: Set<string>): string[] => {
+    if (specFeatures === null) {
+      return e2e;
+    }
+    const narrowed = new Set(
+      filterAffectedE2eSpecs(specFeatures, affected, e2e),
+    );
+    return e2e.filter((spec) => narrowed.has(spec) || changedSet.has(spec));
+  };
+  const e2eRules = selectE2e(rulesAffected);
+  const e2eUsage = selectE2e(usageAffected);
+
+  return {
+    stats: {
+      fe_files_changed: feFilesChanged,
+      fe_files_total: feFilesTotal,
+      be_files_changed: beFilesChanged,
+      be_files_total: beFilesTotal,
+      unit_infra_touched: unitInfraTouched,
+      loki_infra_touched: lokiInfraTouched,
+      shared_sources_touched: sharedSourcesTouched,
+      fe_modules_total: totalModules,
+      fe_modules_changed: changedModules.size,
+      fe_modules_affected_rules: rulesAffected.size,
+      fe_modules_affected_usage: usageAffected.size,
+      unit_specs_all: unit.length,
+      unit_specs_to_run_rules: unitRules.length,
+      unit_specs_to_run_usage: unitUsage.length,
+      loki_stories_all: loki.length,
+      loki_stories_to_run_rules: lokiRules.length,
+      loki_stories_to_run_usage: lokiUsage.length,
+      e2e_specs_all: e2e.length,
+      e2e_specs_to_run_rules: e2eRules.length,
+      e2e_specs_to_run_usage: e2eUsage.length,
+    },
+    fe_unit_specs_to_run: unitUsage,
+    loki_stories_to_run: lokiUsage,
+    e2e_specs_to_run: e2eUsage,
+  };
+}

.github/scripts/affected-tests.unit.spec.ts

@@ -1,9 +1,5 @@
-import { buildModuleGraph } from "./affected-modules";
-import {
-  createTestPlan,
-  createTestPlanForSuite,
-  filterAffectedTests,
-} from "./affected-tests";
+import { buildNodes } from "./affected-modules";
+import { createTestPlan, filterAffectedTests } from "./affected-tests";
 
 const ELEMENTS = [
   { type: "lib/utils", pattern: "src/utils/**" },
@@ -18,12 +14,6 @@ const RULES = [
   { from: ["feature/*"], allow: ["lib/*"] },
 ];
 
-const TEST_SUITE_DEFS = {
-  unit: { statsPrefix: "fe_unit_specs" },
-  loki: { statsPrefix: "loki_stories" },
-  e2e: { statsPrefix: "e2e_specs", runAllTests: true },
-};
-
 const UNIT_FILES = [
   "src/foo/foo.unit.spec.ts",
   "src/foo/bar.unit.spec.ts",
@@ -33,158 +23,227 @@ const UNIT_FILES = [
 const LOKI_FILES = ["src/foo/Foo.stories.tsx", "src/bar/Bar.stories.tsx"];
 const E2E_FILES = ["e2e/test/scenarios/a.cy.spec.ts"];
 
-const moduleGraph = buildModuleGraph(ELEMENTS, RULES);
+const baseInput = {
+  elements: ELEMENTS,
+  rules: RULES,
+  fileDependencies: null,
+  testFilesBySuite: { unit: UNIT_FILES, loki: LOKI_FILES, e2e: E2E_FILES },
+  e2eSpecFiles: null,
+  unitInfraTouched: false,
+  lokiInfraTouched: false,
+  e2eInfraTouched: false,
+  sharedSourcesTouched: false,
+  feFilesChanged: 0,
+  beFilesChanged: 0,
+  feFilesTotal: 0,
+  beFilesTotal: 0,
+};
 
-describe("affected tests", () => {
-  describe("createTestPlanForSuite", () => {
-    it("should run all tests when infra is touched", () => {
-      const result = createTestPlanForSuite(
-        moduleGraph,
-        TEST_SUITE_DEFS.unit,
-        true, // infraTouched
-        ["src/foo/x.ts"],
-        UNIT_FILES,
-      );
-      expect(result).toEqual(UNIT_FILES);
-    });
+describe("createTestPlan", () => {
+  it("runs only specs in affected modules (rules graph)", () => {
+    const plan = createTestPlan({ ...baseInput, changedFiles: ["src/foo/x.ts"] });
 
-    it("should fall back to affected-tests filtering when infra not touched", () => {
-      const result = createTestPlanForSuite(
-        moduleGraph,
-        TEST_SUITE_DEFS.unit,
-        false, // infraTouched
-        ["src/foo/x.ts"],
-        UNIT_FILES,
-      );
-      expect(result.sort()).toEqual([
-        "src/foo/bar.unit.spec.ts",
-        "src/foo/foo.unit.spec.ts",
-      ]);
-    });
-
-    it("should return nothing when infra not touched and no file maps to a module", () => {
-      const result = createTestPlanForSuite(
-        moduleGraph,
-        TEST_SUITE_DEFS.unit,
-        false,
-        ["docs/foo.md"],
-        UNIT_FILES,
-      );
-      expect(result).toEqual([]);
-    });
-
-    it("should run all tests for runAllTests suites regardless of inputs", () => {
-      expect(
-        createTestPlanForSuite(
-          moduleGraph,
-          TEST_SUITE_DEFS.e2e,
-          false,
-          ["docs/foo.md"],
-          E2E_FILES,
-        ),
-      ).toEqual(E2E_FILES);
-      expect(
-        createTestPlanForSuite(
-          moduleGraph,
-          TEST_SUITE_DEFS.e2e,
-          false,
-          ["src/foo/x.ts"],
-          E2E_FILES,
-        ),
-      ).toEqual(E2E_FILES);
-    });
+    expect(plan.stats.fe_modules_changed).toBe(1);
+    expect(plan.stats.fe_modules_affected_rules).toBe(1);
+    expect(plan.fe_unit_specs_to_run.sort()).toEqual([
+      "src/foo/bar.unit.spec.ts",
+      "src/foo/foo.unit.spec.ts",
+    ]);
+    expect(plan.stats.unit_specs_to_run_rules).toBe(2);
+    expect(plan.stats.loki_stories_to_run_rules).toBe(1);
+    // With no file deps, usage falls back to rules.
+    expect(plan.stats.unit_specs_to_run_usage).toBe(2);
   });
 
-  describe("createTestPlan", () => {
-    it("should return run lists and stats together", () => {
-      const result = createTestPlan({
-        elements: ELEMENTS,
-        rules: RULES,
-        testSuites: TEST_SUITE_DEFS,
-        changedFiles: ["src/foo/x.ts"],
-        testFilesBySuite: {
-          unit: UNIT_FILES,
-          loki: LOKI_FILES,
-          e2e: E2E_FILES,
-        },
-        infraTouchedBySuite: { unit: false, loki: false, e2e: false },
-      });
-
-      expect(result.fe_unit_specs_to_run.sort()).toEqual([
-        "src/foo/bar.unit.spec.ts",
-        "src/foo/foo.unit.spec.ts",
-      ]);
-      expect(result.loki_stories_to_run).toEqual(["src/foo/Foo.stories.tsx"]);
-      expect(result.e2e_specs_to_run).toEqual(E2E_FILES);
-
-      expect(result.stats).toEqual({
-        modules_changed: 1,
-        modules_affected: 1,
-        modules_affected_list: ["feature/foo"],
-        fe_unit_specs_total: 4,
-        fe_unit_specs_run: 2,
-        fe_unit_specs_skipped: 2,
-        loki_stories_total: 2,
-        loki_stories_run: 1,
-        loki_stories_skipped: 1,
-        e2e_specs_total: 1,
-        e2e_specs_run: 1,
-        e2e_specs_skipped: 0,
-      });
+  it("narrows further with the usage graph than the rules graph", () => {
+    const plan = createTestPlan({
+      ...baseInput,
+      changedFiles: ["src/utils/colors.ts"],
+      // Only feature/foo actually imports lib/utils.
+      fileDependencies: [
+        { source: "src/foo/foo.tsx", dependencies: ["src/utils/colors.ts"] },
+      ],
     });
 
-    it("should run all unit specs when unit infra is touched", () => {
-      const result = createTestPlan({
-        elements: ELEMENTS,
-        rules: RULES,
-        testSuites: TEST_SUITE_DEFS,
-        changedFiles: ["docs/foo.md"],
-        testFilesBySuite: {
-          unit: UNIT_FILES,
-          loki: LOKI_FILES,
-          e2e: E2E_FILES,
-        },
-        infraTouchedBySuite: { unit: true, loki: false, e2e: false },
-      });
-      expect(result.stats.fe_unit_specs_run).toBe(UNIT_FILES.length);
-      expect(result.stats.fe_unit_specs_skipped).toBe(0);
-      // Only the unit suite was triggered.
-      expect(result.stats.loki_stories_run).toBe(0);
-    });
-
-    it("should not run anything when no infra is touched and no modules affected", () => {
-      const result = createTestPlan({
-        elements: ELEMENTS,
-        rules: RULES,
-        testSuites: TEST_SUITE_DEFS,
-        changedFiles: ["docs/foo.md"],
-        testFilesBySuite: {
-          unit: UNIT_FILES,
-          loki: LOKI_FILES,
-          e2e: E2E_FILES,
-        },
-        infraTouchedBySuite: { unit: false, loki: false, e2e: false },
-      });
-      expect(result.stats.fe_unit_specs_run).toBe(0);
-      expect(result.stats.loki_stories_run).toBe(0);
-      // e2e is runAllTests, so it still reports run = total.
-      expect(result.stats.e2e_specs_run).toBe(E2E_FILES.length);
-    });
+    // Rules allow both features to import lib/utils, so both are "affected".
+    expect(plan.stats.fe_modules_affected_rules).toBe(3);
+    // Usage sees only feature/foo + lib/utils.
+    expect(plan.stats.fe_modules_affected_usage).toBe(2);
+    expect(plan.stats.unit_specs_to_run_rules).toBe(4);
+    expect(plan.stats.unit_specs_to_run_usage).toBe(3);
   });
 
-  describe("filterAffectedTests", () => {
-    it("should keep only tests inside affected modules", () => {
-      const affected = new Set(["feature/foo", "lib/utils"]);
-      const tests = [
-        "src/foo/foo.unit.spec.ts",
-        "src/utils/colors.unit.spec.ts",
-        "src/bar/bar.unit.spec.ts",
-        "docs/unrelated.unit.spec.ts",
-      ];
-      expect(filterAffectedTests(moduleGraph, affected, tests)).toEqual([
-        "src/foo/foo.unit.spec.ts",
-        "src/utils/colors.unit.spec.ts",
-      ]);
+  it("forces a full FE run on a shared-sources (cljc) change with no affected modules", () => {
+    const plan = createTestPlan({
+      ...baseInput,
+      changedFiles: ["docs/readme.md"],
+      sharedSourcesTouched: true,
     });
+
+    expect(plan.stats.fe_modules_affected_rules).toBe(0);
+    expect(plan.stats.unit_specs_to_run_rules).toBe(UNIT_FILES.length);
+    expect(plan.stats.unit_specs_to_run_usage).toBe(UNIT_FILES.length);
+    expect(plan.stats.loki_stories_to_run_rules).toBe(LOKI_FILES.length);
+  });
+
+  it("forces only the suite whose infra changed", () => {
+    const plan = createTestPlan({
+      ...baseInput,
+      changedFiles: ["docs/readme.md"],
+      unitInfraTouched: true,
+    });
+
+    expect(plan.stats.unit_specs_to_run_rules).toBe(UNIT_FILES.length);
+    expect(plan.stats.loki_stories_to_run_rules).toBe(0);
+  });
+
+  it("runs the full e2e suite when no coverage manifest is available", () => {
+    const plan = createTestPlan({ ...baseInput, changedFiles: ["src/foo/x.ts"] });
+
+    expect(plan.stats.e2e_specs_to_run_rules).toBe(E2E_FILES.length);
+    expect(plan.stats.e2e_specs_to_run_usage).toBe(E2E_FILES.length);
+    expect(plan.e2e_specs_to_run).toEqual(E2E_FILES);
+  });
+
+  it("narrows e2e to specs covering affected feature modules", () => {
+    const e2e = [
+      "e2e/test/scenarios/foo.cy.spec.ts",
+      "e2e/test/scenarios/bar.cy.spec.ts",
+      "e2e/test/scenarios/new.cy.spec.ts",
+    ];
+    const plan = createTestPlan({
+      ...baseInput,
+      changedFiles: ["src/foo/x.ts"], // affects feature/foo only
+      testFilesBySuite: { unit: UNIT_FILES, loki: LOKI_FILES, e2e },
+      e2eSpecFiles: {
+        "e2e/test/scenarios/foo.cy.spec.ts": ["src/foo/a.ts"], // feature/foo
+        "e2e/test/scenarios/bar.cy.spec.ts": ["src/bar/b.ts"], // feature/bar
+        // new.cy.spec.ts intentionally absent from the manifest
+      },
+    });
+
+    // foo's feature module is affected; bar's is not; the unmapped new spec
+    // always runs.
+    expect(plan.e2e_specs_to_run.sort()).toEqual([
+      "e2e/test/scenarios/foo.cy.spec.ts",
+      "e2e/test/scenarios/new.cy.spec.ts",
+    ]);
+    expect(plan.stats.e2e_specs_all).toBe(3);
+  });
+
+  it("runs a spec that maps to no feature module (unknown scope)", () => {
+    const e2e = ["e2e/test/scenarios/lib-only.cy.spec.ts"];
+    const plan = createTestPlan({
+      ...baseInput,
+      changedFiles: ["src/foo/x.ts"], // affects feature/foo, NOT lib/utils
+      testFilesBySuite: { unit: UNIT_FILES, loki: LOKI_FILES, e2e },
+      e2eSpecFiles: {
+        // Covers only a non-feature module (e.g. a home/auth spec whose feature
+        // the baseline subtracted), so its feature scope is unknown.
+        "e2e/test/scenarios/lib-only.cy.spec.ts": ["src/utils/colors.ts"],
+      },
+    });
+
+    // No feature module to gate on -> can't bound scope -> always runs.
+    expect(plan.e2e_specs_to_run).toEqual(e2e);
+  });
+
+  it("force-runs all e2e on a backend change (invisible to FE coverage)", () => {
+    const e2e = ["e2e/test/scenarios/foo.cy.spec.ts"];
+    const plan = createTestPlan({
+      ...baseInput,
+      changedFiles: ["src/metabase/api/card.clj"],
+      beFilesChanged: 1,
+      testFilesBySuite: { unit: UNIT_FILES, loki: LOKI_FILES, e2e },
+      e2eSpecFiles: { "e2e/test/scenarios/bar.cy.spec.ts": ["src/bar/b.ts"] },
+    });
+
+    expect(plan.e2e_specs_to_run).toEqual(e2e);
+  });
+
+  it("force-runs all e2e when e2e infra (support/runner) changes", () => {
+    const e2e = ["e2e/test/scenarios/foo.cy.spec.ts"];
+    const plan = createTestPlan({
+      ...baseInput,
+      changedFiles: ["e2e/support/commands/api/createQuestion.js"],
+      e2eInfraTouched: true,
+      testFilesBySuite: { unit: UNIT_FILES, loki: LOKI_FILES, e2e },
+      e2eSpecFiles: { "e2e/test/scenarios/bar.cy.spec.ts": ["src/bar/b.ts"] },
+    });
+
+    expect(plan.e2e_specs_to_run).toEqual(e2e);
+  });
+
+  it("runs an edited spec even when no app module changed", () => {
+    const spec = "e2e/test/scenarios/foo.cy.spec.ts";
+    const e2e = [spec, "e2e/test/scenarios/bar.cy.spec.ts"];
+    const plan = createTestPlan({
+      ...baseInput,
+      changedFiles: [spec], // only the spec itself changed
+      testFilesBySuite: { unit: UNIT_FILES, loki: LOKI_FILES, e2e },
+      e2eSpecFiles: {
+        [spec]: ["src/bar/b.ts"], // covers feature/bar, which is NOT affected
+        "e2e/test/scenarios/bar.cy.spec.ts": ["src/bar/b.ts"],
+      },
+    });
+
+    // No module is affected, but the edited spec must still run.
+    expect(plan.e2e_specs_to_run).toEqual([spec]);
+  });
+
+  it("runs a spec whose coverage was fully baseline-subtracted (empty files)", () => {
+    const e2e = ["e2e/test/scenarios/empty.cy.spec.ts"];
+    const plan = createTestPlan({
+      ...baseInput,
+      changedFiles: ["src/foo/x.ts"], // affects feature/foo
+      testFilesBySuite: { unit: UNIT_FILES, loki: LOKI_FILES, e2e },
+      e2eSpecFiles: { "e2e/test/scenarios/empty.cy.spec.ts": [] },
+    });
+
+    // Empty coverage means unknown scope, so the spec runs.
+    expect(plan.e2e_specs_to_run).toEqual(e2e);
+  });
+
+  it("forces a full e2e run when shared (cljc) sources change", () => {
+    const e2e = ["e2e/test/scenarios/foo.cy.spec.ts"];
+    const plan = createTestPlan({
+      ...baseInput,
+      changedFiles: ["src/foo/x.ts"],
+      sharedSourcesTouched: true,
+      testFilesBySuite: { unit: UNIT_FILES, loki: LOKI_FILES, e2e },
+      e2eSpecFiles: { "e2e/test/scenarios/bar.cy.spec.ts": ["src/bar/b.ts"] },
+    });
+
+    // Manifest is present but cljc is invisible to JS coverage, so run all.
+    expect(plan.e2e_specs_to_run).toEqual(e2e);
+  });
+
+  it("passes the FE/BE file counts through to stats", () => {
+    const plan = createTestPlan({
+      ...baseInput,
+      changedFiles: [],
+      feFilesChanged: 5,
+      beFilesChanged: 3,
+    });
+
+    expect(plan.stats.fe_files_changed).toBe(5);
+    expect(plan.stats.be_files_changed).toBe(3);
+  });
+});
+
+describe("filterAffectedTests", () => {
+  it("keeps only tests inside affected modules", () => {
+    const nodes = buildNodes(ELEMENTS);
+    const affected = new Set(["feature/foo", "lib/utils"]);
+    const tests = [
+      "src/foo/foo.unit.spec.ts",
+      "src/utils/colors.unit.spec.ts",
+      "src/bar/bar.unit.spec.ts",
+      "docs/unrelated.unit.spec.ts",
+    ];
+    expect(filterAffectedTests(nodes, affected, tests)).toEqual([
+      "src/foo/foo.unit.spec.ts",
+      "src/utils/colors.unit.spec.ts",
+    ]);
   });
 });

.github/scripts/bundle-size-stats-prepare.js

@@ -0,0 +1,152 @@
+/* eslint-disable import/no-commonjs */
+// Prepares the rows the bundle-size stats logger uploads to stats.metabase.com.
+//
+// For each measured (bundle, kind) it computes the delta — raw, gzipped and
+// brotli (as-served) bytes plus percent — against the previously *plotted* data
+// point (restored from a rolling cache), so the deltas can be charted directly.
+// It also decides whether this commit is worth recording at all: a point is kept
+// when the as-served size moved by at least MIN_DELTA_PERCENT, or when a new
+// bundle/kind appears. Only master builds run through here — releases form
+// non-linear lines whose deltas are meaningless, so they're not recorded (their
+// historical sizes are backfilled separately).
+//
+// buildStatsRows is pure (data in, data out) so it can be unit-tested; main()
+// is the thin I/O wrapper that reads env/files and writes the rows, cache and
+// step outputs.
+const fs = require("fs");
+const path = require("path");
+
+const deltaPercent = (current, base) =>
+  base ? Math.round(((current - base) * 10000) / base) / 100 : "";
+
+/**
+ * Turn the current measurements + the last plotted point into upload rows, the
+ * slim cache rows for the next diff, and the keep/skip decision.
+ *
+ * The significance threshold tracks the as-served size: brotli where the build
+ * ships a precompressed .br, otherwise gzip. Current measurements always carry
+ * brotliBytes (estimated when no .br shipped), but a cached base point recorded
+ * before brotli logging may not, so the delta still falls back to gzip per row.
+ */
+function buildStatsRows({ measurements, previous, threshold, date, commit, commitMessage, version }) {
+  const previousOf = (bundle, kind) => previous.find(row => row.bundle === bundle && row.kind === kind);
+
+  let maxServedDeltaPercent = 0;
+  let hasNewSeries = false;
+
+  const rows = measurements.map(measurement => {
+    const base = previousOf(measurement.bundle, measurement.kind);
+    const hasBrotli = measurement.brotliBytes != null && base?.brotliBytes != null;
+    const gzipDeltaPercent = deltaPercent(measurement.gzipBytes, base?.gzipBytes);
+    const brotliDeltaPercent = hasBrotli ? deltaPercent(measurement.brotliBytes, base.brotliBytes) : "";
+    if (!base) {
+      hasNewSeries = true;
+    } else {
+      const servedDeltaPercent = hasBrotli ? brotliDeltaPercent : gzipDeltaPercent;
+      maxServedDeltaPercent = Math.max(maxServedDeltaPercent, Math.abs(servedDeltaPercent));
+    }
+    return {
+      "Date": date,
+      "Version": version,
+      "Commit": commit,
+      "Bundle": measurement.bundle,
+      "Kind": measurement.kind, // "initial" or "total"
+      // The stats table carries a free-text Description column; append-csv
+      // requires every table column to be present. Populate it with the commit
+      // subject so the chart's points are self-describing.
+      "Description": commitMessage,
+      "Raw bytes": measurement.rawBytes,
+      "Gzip bytes": measurement.gzipBytes,
+      "Brotli bytes": measurement.brotliBytes, // as-served (shipped .br, else estimated)
+      "File count": measurement.fileCount,
+      "Raw bytes delta": base ? measurement.rawBytes - base.rawBytes : "",
+      "Gzip bytes delta": base ? measurement.gzipBytes - base.gzipBytes : "",
+      "Brotli bytes delta": hasBrotli ? measurement.brotliBytes - base.brotliBytes : "",
+      "Raw delta %": deltaPercent(measurement.rawBytes, base?.rawBytes),
+      "Gzip delta %": gzipDeltaPercent,
+      "Brotli delta %": brotliDeltaPercent,
+    };
+  });
+
+  const firstPoint = previous.length === 0;
+  const significant = firstPoint || hasNewSeries || maxServedDeltaPercent >= threshold;
+
+  // Slim rows the next run diffs against. The workflow only persists this to the
+  // cache when we actually push, so the cached reference always stays the last
+  // *plotted* point (cumulative drift is caught).
+  const cacheRows = measurements.map(({ bundle, kind, rawBytes, gzipBytes, brotliBytes }) => ({
+    bundle,
+    kind,
+    rawBytes,
+    gzipBytes,
+    brotliBytes,
+  }));
+
+  const reason = firstPoint
+    ? "first point"
+    : hasNewSeries
+      ? "new bundle/kind series"
+      : `max served Δ ${maxServedDeltaPercent.toFixed(2)}% (threshold ${threshold}%)`;
+
+  return { rows, cacheRows, significant, reason, maxServedDeltaPercent, firstPoint, hasNewSeries };
+}
+
+module.exports = { buildStatsRows };
+
+const readJson = filePath => (filePath && fs.existsSync(filePath) ? JSON.parse(fs.readFileSync(filePath, "utf8")) : null);
+const writeJson = (filePath, value) => {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, JSON.stringify(value));
+};
+const setOutput = (env, name, value) => {
+  if (env.GITHUB_OUTPUT) {
+    fs.appendFileSync(env.GITHUB_OUTPUT, `${name}=${value}\n`);
+  }
+};
+
+// version.properties (extracted from the uberjar) carries the build's tag.
+// Non-release (master) builds report tag=vUNKNOWN, so leave Version empty there.
+function readVersion(versionPropsPath) {
+  const raw =
+    versionPropsPath && fs.existsSync(versionPropsPath)
+      ? (fs.readFileSync(versionPropsPath, "utf8").match(/^tag=(.*)$/m)?.[1]?.trim() ?? "")
+      : "";
+  return raw === "vUNKNOWN" ? "" : raw;
+}
+
+function main() {
+  const env = process.env;
+
+  const measurements = readJson(env.CURRENT);
+  if (!Array.isArray(measurements) || measurements.length === 0) {
+    console.error(`::error::No bundle measurements found at ${env.CURRENT}`);
+    process.exit(1);
+  }
+
+  const result = buildStatsRows({
+    measurements,
+    // The last plotted point, as slim rows: [{ bundle, kind, rawBytes, gzipBytes, brotliBytes }].
+    previous: readJson(env.LAST) || [],
+    threshold: Number(env.MIN_DELTA_PERCENT ?? 1),
+    date: new Date().toISOString().slice(0, 10), // YYYY-MM-DD
+    commit: (env.HEAD_SHA || "").slice(0, 12),
+    commitMessage: (env.COMMIT_MESSAGE || "").split("\n")[0], // subject line only
+    version: readVersion(env.VERSION_PROPS),
+  });
+
+  writeJson(env.ROWS_OUT, result.rows);
+  writeJson(env.CACHE_OUT, result.cacheRows);
+
+  console.log(`${result.significant ? "RECORD" : "SKIP"} — ${result.reason}`);
+
+  setOutput(env, "significant", result.significant ? "true" : "false");
+  setOutput(
+    env,
+    "max_delta_percent",
+    result.firstPoint || result.hasNewSeries ? "" : result.maxServedDeltaPercent.toFixed(2),
+  );
+}
+
+if (require.main === module) {
+  main();
+}

.github/scripts/bundle-size-stats-prepare.unit.spec.js

@@ -0,0 +1,87 @@
+const { buildStatsRows } = require("./bundle-size-stats-prepare");
+
+const meta = { date: "2026-06-30", commit: "abc123", commitMessage: "Fix the thing (#123)", version: "" };
+const measurement = (over = {}) => ({
+  bundle: "embedding-sdk-chunked",
+  kind: "total",
+  rawBytes: 1000,
+  gzipBytes: 400,
+  brotliBytes: 300,
+  fileCount: 3,
+  ...over,
+});
+
+describe("buildStatsRows", () => {
+  it("records the first point and leaves every delta empty", () => {
+    const result = buildStatsRows({
+      ...meta,
+      measurements: [measurement()],
+      previous: [],
+      threshold: 1,
+    });
+
+    expect(result.firstPoint).toBe(true);
+    expect(result.significant).toBe(true);
+    expect(result.reason).toBe("first point");
+    expect(result.rows[0]["Gzip bytes delta"]).toBe("");
+    expect(result.rows[0]["Brotli delta %"]).toBe("");
+    expect(result.rows[0]["Description"]).toBe("Fix the thing (#123)");
+    expect(result.cacheRows[0]).toEqual({
+      bundle: "embedding-sdk-chunked",
+      kind: "total",
+      rawBytes: 1000,
+      gzipBytes: 400,
+      brotliBytes: 300,
+    });
+  });
+
+  it("records a never-seen bundle/kind as a new series", () => {
+    const result = buildStatsRows({
+      ...meta,
+      measurements: [measurement({ bundle: "app", kind: "initial" })],
+      previous: [{ bundle: "app", kind: "total", rawBytes: 1, gzipBytes: 1, brotliBytes: 1 }],
+      threshold: 99,
+    });
+
+    expect(result.hasNewSeries).toBe(true);
+    expect(result.significant).toBe(true);
+    expect(result.reason).toBe("new bundle/kind series");
+  });
+
+  it("gates significance on the brotli (as-served) delta when both sides have it", () => {
+    const previous = [{ bundle: "embedding-sdk-chunked", kind: "total", rawBytes: 1000, gzipBytes: 400, brotliBytes: 300 }];
+
+    const big = buildStatsRows({
+      ...meta,
+      measurements: [measurement({ brotliBytes: 315, gzipBytes: 400 })], // brotli +5%, gzip 0%
+      previous,
+      threshold: 1,
+    });
+    expect(big.maxServedDeltaPercent).toBeCloseTo(5);
+    expect(big.significant).toBe(true);
+    expect(big.rows[0]["Brotli delta %"]).toBeCloseTo(5);
+
+    const small = buildStatsRows({
+      ...meta,
+      measurements: [measurement({ brotliBytes: 301, gzipBytes: 999 })], // brotli +0.33%, gzip ignored
+      previous,
+      threshold: 1,
+    });
+    expect(small.significant).toBe(false);
+    expect(small.reason).toContain("threshold 1%");
+  });
+
+  it("falls back to the gzip delta when the cached base predates brotli logging", () => {
+    const result = buildStatsRows({
+      ...meta,
+      measurements: [measurement({ gzipBytes: 440, brotliBytes: 300 })], // gzip +10%
+      previous: [{ bundle: "embedding-sdk-chunked", kind: "total", rawBytes: 1000, gzipBytes: 400 }],
+      threshold: 1,
+    });
+
+    expect(result.maxServedDeltaPercent).toBeCloseTo(10);
+    expect(result.significant).toBe(true);
+    expect(result.rows[0]["Brotli bytes delta"]).toBe(""); // no base brotli to diff against
+    expect(result.rows[0]["Gzip delta %"]).toBeCloseTo(10);
+  });
+});

.github/scripts/create-test-plan.ts

@@ -1,67 +1,112 @@
-// Changed files come from dorny/paths-filter's `all_changed_files` output
+// I/O entrypoint: gather inputs (env vars, the cruise graph, the test-file
+// lists) and hand them to createTestPlan, which does the computing.
 
 import { execFileSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+
+import micromatch from "micromatch";
 
 import { elements, rules } from "../../frontend/lint/module-boundaries.mjs";
 
-import { TEST_SUITES, createTestPlan } from "./affected-tests";
+import { type FileDependency, parseCruiseModules } from "./affected-modules";
+import { createTestPlan } from "./affected-tests";
+import { listSpecFiles } from "./e2e-spec-globs.mjs";
 
+const UNIT_ROOTS = ["frontend/src", "enterprise/frontend/src"];
 const UNIT_GLOBS = [
-  "frontend/src/**/*.unit.spec.js",
-  "frontend/src/**/*.unit.spec.jsx",
-  "frontend/src/**/*.unit.spec.ts",
-  "frontend/src/**/*.unit.spec.tsx",
-  "enterprise/frontend/src/**/*.unit.spec.js",
-  "enterprise/frontend/src/**/*.unit.spec.jsx",
-  "enterprise/frontend/src/**/*.unit.spec.ts",
-  "enterprise/frontend/src/**/*.unit.spec.tsx",
+  "frontend/src/**/*.unit.spec.{js,jsx,ts,tsx}",
+  "enterprise/frontend/src/**/*.unit.spec.{js,jsx,ts,tsx}",
 ];
 
+const STORY_ROOTS = ["frontend", "enterprise/frontend"];
 const STORY_GLOBS = [
-  "frontend/**/*.stories.js",
-  "frontend/**/*.stories.jsx",
-  "frontend/**/*.stories.ts",
-  "frontend/**/*.stories.tsx",
-  "enterprise/frontend/**/*.stories.js",
-  "enterprise/frontend/**/*.stories.jsx",
-  "enterprise/frontend/**/*.stories.ts",
-  "enterprise/frontend/**/*.stories.tsx",
+  "frontend/**/*.stories.{js,jsx,ts,tsx}",
+  "enterprise/frontend/**/*.stories.{js,jsx,ts,tsx}",
 ];
 
-const E2E_GLOBS = [
-  "e2e/test/scenarios/**/*.cy.spec.js",
-  "e2e/test/scenarios/**/*.cy.spec.jsx",
-  "e2e/test/scenarios/**/*.cy.spec.ts",
-  "e2e/test/scenarios/**/*.cy.spec.tsx",
-];
-
-function listFiles(globs: string[]): string[] {
-  return execFileSync("git", ["ls-files", "--", ...globs], { encoding: "utf8" })
+// Returns the tracked files under `roots` that match `globs`. The `dot: true`
+// option means files inside dot-directories such as `.storybook` are included.
+function listFiles(roots: string[], globs: string[]): string[] {
+  const tracked = execFileSync("git", ["ls-files", "--", ...roots], {
+    encoding: "utf8",
+  })
     .split("\n")
     .map((line) => line.trim())
     .filter(Boolean);
+  return micromatch(tracked, globs, { dot: true });
 }
 
-const changedFiles = (process.env.CHANGED_FILES ?? "")
-  .split(",")
-  .map((s) => s.trim())
-  .filter(Boolean);
+// dorny outputs comma-separated lists; CHANGED_FILES is `all_changed_files`.
+const csvToList = (csv: string | undefined) =>
+  (csv ?? "")
+    .split(",")
+    .map((s) => s.trim())
+    .filter(Boolean);
+
+// Reads the dependency-cruiser graph (DEP_GRAPH_JSON). Null falls back to the
+// rules graph, so a missing or unparseable file never breaks the plan.
+function readFileDependencies(): FileDependency[] | null {
+  const path = process.env.DEP_GRAPH_JSON;
+  if (path && existsSync(path)) {
+    try {
+      const { modules } = JSON.parse(readFileSync(path, "utf8"));
+      process.stderr.write(`Using usage graph from ${path}.\n`);
+      return parseCruiseModules(modules);
+    } catch (error) {
+      process.stderr.write(
+        `Failed to read ${path}; falling back to rules graph: ${error}\n`,
+      );
+    }
+  } else {
+    process.stderr.write(
+      "No DEP_GRAPH_JSON found; falling back to rules graph.\n",
+    );
+  }
+  return null;
+}
+
+// Reads the nightly coverage manifest (E2E_SPEC_MANIFEST): { builtAt, specs:
+// { spec -> files } }. Returns the specs map, or null so e2e falls back to a
+// full run when the manifest is missing/unparseable.
+function readE2eSpecFiles(): Record<string, string[]> | null {
+  const path = process.env.E2E_SPEC_MANIFEST;
+  if (path && existsSync(path)) {
+    try {
+      const { specs } = JSON.parse(readFileSync(path, "utf8"));
+      if (specs && typeof specs === "object") {
+        process.stderr.write(`Using e2e coverage manifest from ${path}.\n`);
+        return specs;
+      }
+    } catch (error) {
+      process.stderr.write(
+        `Failed to read ${path}; e2e will run in full: ${error}\n`,
+      );
+    }
+  } else {
+    process.stderr.write("No E2E_SPEC_MANIFEST found; e2e will run in full.\n");
+  }
+  return null;
+}
 
 const testPlan = createTestPlan({
   elements,
   rules,
-  testSuites: TEST_SUITES,
-  changedFiles,
+  changedFiles: csvToList(process.env.CHANGED_FILES),
+  fileDependencies: readFileDependencies(),
   testFilesBySuite: {
-    unit: listFiles(UNIT_GLOBS),
-    loki: listFiles(STORY_GLOBS),
-    e2e: listFiles(E2E_GLOBS),
-  },
-  infraTouchedBySuite: {
-    unit: process.env.UNIT_INFRA_TOUCHED === "true",
-    loki: process.env.LOKI_INFRA_TOUCHED === "true",
-    e2e: false,
+    unit: listFiles(UNIT_ROOTS, UNIT_GLOBS),
+    loki: listFiles(STORY_ROOTS, STORY_GLOBS),
+    e2e: listSpecFiles(),
   },
+  e2eSpecFiles: readE2eSpecFiles(),
+  unitInfraTouched: process.env.UNIT_INFRA_TOUCHED === "true",
+  lokiInfraTouched: process.env.LOKI_INFRA_TOUCHED === "true",
+  e2eInfraTouched: process.env.E2E_INFRA_TOUCHED === "true",
+  sharedSourcesTouched: process.env.SHARED_SOURCES_TOUCHED === "true",
+  feFilesChanged: csvToList(process.env.FE_CHANGED_FILES).length,
+  beFilesChanged: csvToList(process.env.BE_CHANGED_FILES).length,
+  feFilesTotal: listFiles(["frontend", "enterprise/frontend"], ["**"]).length,
+  beFilesTotal: listFiles(["src", "enterprise/backend"], ["**"]).length,
 });
 
 process.stdout.write(JSON.stringify(testPlan) + "\n");

.github/scripts/csv-to-mb.js

@@ -19,23 +19,73 @@ function jsonToCsvFormData(jsonData) {
   return formData;
 }
 
-async function uploadCsvToMb({ baseUrl, tableId, jsonData, mode = 'append' }) {
-  const formData = jsonToCsvFormData(jsonData);
-  const operation = mode === 'replace' ? 'replace-csv' : 'append-csv';
+// Transient failures worth retrying: throttling and server-side errors. A 4xx
+// (bad request, auth) won't succeed on retry, so those fail fast.
+const RETRYABLE_STATUS = new Set([429, 500, 502, 503, 504]);
 
-  const response = await fetch(`${baseUrl}/api/table/${tableId}/${operation}`, {
-    method: 'POST',
-    headers: {
-      "x-api-key": process.env.API_KEY
-    },
-    body: formData
-  });
-
-  if (!response.ok) {
-    const body = await response.text().catch(() => '');
-    throw new Error(`Upload failed: ${response.status} ${response.statusText} ${body}`.trim());
+class UploadError extends Error {
+  constructor(message, { retryable }) {
+    super(message);
+    this.retryable = retryable;
+  }
+}
+
+async function attemptUpload(url, jsonData, timeoutMs) {
+  let response;
+  try {
+    response = await fetch(url, {
+      method: 'POST',
+      headers: {
+        "x-api-key": process.env.API_KEY
+      },
+      // Rebuilt per attempt: a consumed request body can't be reused.
+      body: jsonToCsvFormData(jsonData),
+      // Without this the request can hang indefinitely on a stalled server,
+      // eating the whole job timeout. An abort surfaces below as a retryable
+      // network error, so it retries with backoff instead.
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+  } catch (networkError) {
+    throw new UploadError(networkError.message, { retryable: true });
+  }
+
+  if (response.ok) {
+    return;
+  }
+
+  const body = await response.text().catch(() => '');
+  throw new UploadError(
+    `Upload failed: ${response.status} ${response.statusText} ${body}`.trim(),
+    { retryable: RETRYABLE_STATUS.has(response.status) }
+  );
+}
+
+const sleep = ms => new Promise(resolve => setTimeout(resolve, ms));
+
+/**
+ * Uploads jsonData as CSV, retrying transient API errors with exponential
+ * backoff. `retries` is the number of extra attempts after the first (so the
+ * default 2 means up to 3 tries). `timeoutMs` is a per-attempt total deadline
+ * (default 60s) that aborts a stalled request. Throws the last error once
+ * attempts are exhausted or the error is non-retryable.
+ */
+async function uploadCsvToMb({ baseUrl, tableId, jsonData, mode = 'append', retries = 2, retryDelayMs = 1000, timeoutMs = 60_000 }) {
+  const operation = mode === 'replace' ? 'replace-csv' : 'append-csv';
+  const url = `${baseUrl}/api/table/${tableId}/${operation}`;
+
+  for (let attempt = 0; ; attempt++) {
+    try {
+      await attemptUpload(url, jsonData, timeoutMs);
+      return { success: true };
+    } catch (error) {
+      if (!error.retryable || attempt >= retries) {
+        throw error;
+      }
+      const delay = retryDelayMs * 2 ** attempt;
+      console.warn(`Upload attempt ${attempt + 1} failed (${error.message}); retrying in ${delay}ms`);
+      await sleep(delay);
+    }
   }
-  return { success: true };
 }
 
 module.exports = { uploadCsvToMb };

.github/scripts/csv-to-mb.unit.spec.js

@@ -0,0 +1,50 @@
+const { uploadCsvToMb } = require("./csv-to-mb");
+
+const ok = () => ({ ok: true });
+const fail = status => ({ ok: false, status, statusText: "err", text: async () => "" });
+
+const upload = (over = {}) =>
+  uploadCsvToMb({
+    baseUrl: "https://stats.example.com",
+    tableId: 1,
+    jsonData: [{ a: 1 }],
+    retryDelayMs: 1,
+    ...over,
+  });
+
+describe("uploadCsvToMb retries", () => {
+  afterEach(() => {
+    delete global.fetch;
+  });
+
+  it("retries transient server errors then succeeds", async () => {
+    global.fetch = jest.fn().mockResolvedValueOnce(fail(503)).mockResolvedValueOnce(fail(500)).mockResolvedValueOnce(ok());
+
+    await expect(upload({ retries: 2 })).resolves.toEqual({ success: true });
+    expect(global.fetch).toHaveBeenCalledTimes(3);
+  });
+
+  it("retries network errors", async () => {
+    global.fetch = jest
+      .fn()
+      .mockRejectedValueOnce(new Error("ECONNRESET"))
+      .mockResolvedValueOnce(ok());
+
+    await expect(upload({ retries: 2 })).resolves.toEqual({ success: true });
+    expect(global.fetch).toHaveBeenCalledTimes(2);
+  });
+
+  it("gives up after exhausting retries and throws the last error", async () => {
+    global.fetch = jest.fn().mockResolvedValue(fail(500));
+
+    await expect(upload({ retries: 2 })).rejects.toThrow("Upload failed: 500");
+    expect(global.fetch).toHaveBeenCalledTimes(3); // 1 initial + 2 retries
+  });
+
+  it("does not retry a non-transient 4xx", async () => {
+    global.fetch = jest.fn().mockResolvedValue(fail(400));
+
+    await expect(upload({ retries: 2 })).rejects.toThrow("Upload failed: 400");
+    expect(global.fetch).toHaveBeenCalledTimes(1);
+  });
+});

.github/scripts/e2e-spec-globs.mjs

@@ -0,0 +1,32 @@
+import { execFileSync } from "node:child_process";
+
+import micromatch from "micromatch";
+
+const SPEC_DIR = "e2e/test/scenarios";
+
+// This is the nightly-only baseline helper that runs in the instrumented pass to
+// capture boot-time coverage. It is not a product spec, so it is excluded from
+// the test plan universe and from the manifest backfill reconciliation.
+export const BASELINE_SPEC = `${SPEC_DIR}/coverage-baseline.cy.spec.js`;
+
+// This glob set defines the spec "universe". The test planner
+// (create-test-plan.ts) selects which specs to run from it, and the coverage
+// manifest builder (build-coverage-manifest.mjs) reconciles against it when
+// backfilling specs that did not run.
+export const E2E_SPEC_GLOBS = [`${SPEC_DIR}/**/*.cy.spec.{js,jsx,ts,tsx}`];
+
+// Returns the tracked e2e specs as repo-relative paths, excluding the baseline
+// helper.
+export function listSpecFiles(cwd = process.cwd()) {
+  const tracked = execFileSync("git", ["ls-files", "--", SPEC_DIR], {
+    cwd,
+    encoding: "utf8",
+  })
+    .split("\n")
+    .map((line) => line.trim())
+    .filter(Boolean);
+  return micromatch(tracked, E2E_SPEC_GLOBS, {
+    ignore: [BASELINE_SPEC],
+    dot: true,
+  });
+}

.github/scripts/measure-bundle-sizes.js

@@ -1,70 +1,58 @@
 /* eslint-disable import/no-commonjs */
+// Measures the front-end bundles emitted into an extracted uberjar tree.
+//
+// Every bundle reports one or both of:
+//  - "initial": JS the browser downloads on first paint (the entry chunk plus
+//    its initial/sync split chunks). Never excludes initial chunks.
+//  - "total":   all *reachable* JS (initial plus async chunks that are actually
+//    loadable at runtime). Never includes unreachable/never-fetched chunks.
+// Reachability needs the per-entry asset list from the rspack stats file, so the
+// app and chunked SDK bundles require their stats file to be present.
+//
+// The pure pieces — the asset-name selection (initial vs reachable, runtime
+// filtering, the async-loadable flag) — are split out as select*Assets so they
+// can be unit-tested against a stats object. The measure* functions and main()
+// keep all the filesystem and env I/O, threading an explicit `config`.
 const fs = require("fs");
 const path = require("path");
 const zlib = require("zlib");
 
-// MEASURE_ROOT lets callers point at an extracted tree (e.g. the PR bundle-size
-// check measures a current and a base-ref tree); defaults to cwd for the stats
-// workflow. MEASURE_BUNDLES restricts which bundles are measured (comma-separated).
-const baseDir = process.env.MEASURE_ROOT ? path.resolve(process.env.MEASURE_ROOT) : process.cwd();
-const resolve = (...relativeParts) => path.resolve(baseDir, ...relativeParts);
-const bundleFilter = process.env.MEASURE_BUNDLES
-  ? new Set(process.env.MEASURE_BUNDLES.split(",").map(bundle => bundle.trim()))
-  : null;
-const isBundleWanted = bundle => !bundleFilter || bundleFilter.has(bundle);
-
+const APP_DIST = "resources/frontend_client/app/dist";
 const SDK_ROOT = "resources/frontend_client/app/embedding-sdk";
 
-/**
- * Async SDK chunks are unreachable today: the bootstrap manifest lists only the
- * chunked entry's INITIAL chunks and output.publicPath is "", so import() chunks
- * are emitted but never fetched. So they're excluded from "total" (which equals
- * "initial"). There's no reliable way to detect loadability from the build
- * artifacts, so this is a manual flag: flip it to true in the same change that
- * lands the publicPath fix, and "total" will include the lazy chunks while
- * "initial" stays the eager first-load set.
- */
-const SDK_ASYNC_CHUNKS_LOADABLE = false;
-
 // The chunk runtime is inlined into the bootstrap, never sent as a standalone file.
 const SDK_RUNTIME_RE = /embedding-sdk-chunk-runtime\./;
+const notRuntime = name => !SDK_RUNTIME_RE.test(name);
 
-/**
- * Simple targets measured straight from emitted files.
- * - `dir`/`file`/`altFile`: what to measure (altFile is a fallback single file).
- * - `stats`: entrypoint whose initial assets are the "initial" download.
- * - `optional`: skip (don't fail) when the output is absent.
- * The hosted SDK is split into embedding-sdk-legacy (the self-contained
- * monolith) and embedding-sdk-chunked (handled separately below).
- */
-const simpleTargets = [
-  {
-    bundle: "app",
-    dir: "resources/frontend_client/app/dist",
-    stats: { file: "artifacts/stats-main.json", entrypoint: "app-main" },
-  },
-  {
-    bundle: "embedding-sdk-legacy",
-    dir: `${SDK_ROOT}/legacy`,
-    altFile: `${SDK_ROOT}.js`,
-    optional: true,
-  },
-  {
-    bundle: "embedding-sdk-package",
-    dir: "resources/embedding-sdk/dist",
-    optional: true,
-  },
-  {
-    bundle: "embed-js",
-    file: "resources/frontend_client/app/embed.js",
-  },
-];
+const assetFiles = (root, names) => names.map(name => path.join(root, name));
+const unique = files => [...new Set(files)];
+
+// MEASURE_ROOT lets callers point at an extracted tree (e.g. the PR bundle-size
+// check measures a current and a base-ref tree); defaults to cwd for the stats
+// workflow. MEASURE_BUNDLES restricts which bundles are measured (comma-separated).
+// SDK_ASYNC_CHUNKS_LOADABLE (see selectChunkedSdkAssets) toggles whether async
+// SDK chunks count toward "total".
+function buildConfig(env) {
+  const baseDir = env.MEASURE_ROOT ? path.resolve(env.MEASURE_ROOT) : process.cwd();
+  const bundleFilter = env.MEASURE_BUNDLES
+    ? new Set(env.MEASURE_BUNDLES.split(",").map(bundle => bundle.trim()))
+    : null;
+  return {
+    resolve: (...relativeParts) => path.resolve(baseDir, ...relativeParts),
+    isBundleWanted: bundle => !bundleFilter || bundleFilter.has(bundle),
+    // Async SDK chunks are reachable once output.publicPath is set so import()
+    // chunks are actually fetched at runtime — which landed in master. Defaults
+    // to true to match master; set SDK_ASYNC_CHUNKS_LOADABLE=false to measure an
+    // older commit built before the publicPath fix (async unreachable, so
+    // "total" collapses to "initial").
+    sdkAsyncChunksLoadable: env.SDK_ASYNC_CHUNKS_LOADABLE !== "false",
+  };
+}
 
 function sizeOf(files) {
   let rawBytes = 0;
   let gzipBytes = 0;
   let brotliBytes = 0;
-  let anyBrotli = false;
   for (const file of files) {
     const contents = fs.readFileSync(file);
     rawBytes += contents.length;
@@ -72,20 +60,17 @@ function sizeOf(files) {
     gzipBytes += zlib.gzipSync(contents).length;
     // brotli: as-served — count the precompressed .br the build ships; files
     // without one (static-viz, sub-threshold chunks) are served compressed on
-    // the fly, so estimate with brotli. Null when no .br shipped at all.
+    // the fly, so estimate with brotli. Always reported (like gzip).
     const brotliPath = `${file}.br`;
-    if (fs.existsSync(brotliPath)) {
-      anyBrotli = true;
-      brotliBytes += fs.statSync(brotliPath).size;
-    } else {
-      brotliBytes += zlib.brotliCompressSync(contents).length;
-    }
+    brotliBytes += fs.existsSync(brotliPath)
+      ? fs.statSync(brotliPath).size
+      : zlib.brotliCompressSync(contents).length;
   }
   return {
     fileCount: files.length,
     rawBytes,
     gzipBytes,
-    brotliBytes: anyBrotli ? brotliBytes : null,
+    brotliBytes,
   };
 }
 
@@ -104,104 +89,170 @@ function collectJsFiles(absolutePath) {
     });
 }
 
-function readStats(statsFile) {
-  const statsPath = resolve(statsFile);
+function readStats(config, statsFile) {
+  const statsPath = config.resolve(statsFile);
   return fs.existsSync(statsPath) ? JSON.parse(fs.readFileSync(statsPath, "utf8")) : null;
 }
 
-function entrypointJsAssets(stats, name) {
+// An entrypoint's .js assets for a given field: "assets" = its initial
+// (synchronous) load; "reachableAssets" = initial plus everything it can lazily
+// import (the chunk graph walked at build time in bundle-stats.js).
+function entrypointJsAssets(stats, name, field = "assets") {
   const entry = stats && stats.entrypoints && stats.entrypoints[name];
-  if (!entry) {
+  if (!entry || !entry[field]) {
     return null;
   }
-  return entry.assets.map(asset => asset.name || asset).filter(name => name.endsWith(".js"));
-}
-
-function initialJsFiles({ file: statsFile, entrypoint, root }, joinRoot) {
-  const stats = readStats(statsFile);
-  if (!stats) {
-    console.warn(`Stats file missing (${statsFile}); reporting initial == total.`);
-    return null;
-  }
-  const assets = entrypointJsAssets(stats, entrypoint);
-  if (!assets) {
-    console.warn(`Entrypoint "${entrypoint}" missing in ${statsFile}; reporting initial == total.`);
-    return null;
-  }
-  const base = root ? resolve(root) : joinRoot;
-  return assets.map(name => path.join(base, name));
-}
-
-function measureSimpleTarget({ bundle, dir, file, altFile, stats, optional }) {
-  const candidates = [dir, file, altFile].filter(Boolean);
-  const chosen = candidates.find(c => fs.existsSync(resolve(c)));
-  if (!chosen) {
-    if (optional) {
-      console.warn(`Skipping "${bundle}": output not found (${candidates.join(", ")})`);
-      return [];
-    }
-    throw new Error(`Bundle output not found for "${bundle}": ${candidates.join(", ")}`);
-  }
-
-  const root = resolve(chosen);
-  const total = sizeOf(collectJsFiles(root));
-  const initialFiles = stats ? initialJsFiles(stats, root) : null;
-  const initial = initialFiles ? sizeOf(initialFiles) : total;
-
-  return [
-    { bundle, kind: "initial", ...initial },
-    { bundle, kind: "total", ...total },
-  ];
+  return entry[field].map(asset => asset.name || asset).filter(assetName => assetName.endsWith(".js"));
 }
 
 /**
- * Chunked SDK delivery. "Reachable" = what the bootstrap actually sends: the
- * bootstrap (with its inlined runtime) + the chunked entry's initial chunks,
- * minus the standalone runtime file. Async chunks are excluded (initial == total)
- * unless SDK_ASYNC_CHUNKS_LOADABLE is set, at which point "total" includes them.
+ * Main app = the app-main entrypoint only (app/dist also holds other pages like
+ * app-public, app-embed*, which are not the app). `reachableAssets` is null on
+ * older stats built before the chunk-graph enrichment — the caller then falls
+ * back to sizing the whole app/dist.
  */
-function measureChunkedSdk(statsFile) {
-  const chunksDir = resolve(SDK_ROOT, "chunks");
+function selectAppAssets(stats) {
+  const initialAssets = entrypointJsAssets(stats, "app-main", "assets");
+  if (!initialAssets) {
+    throw new Error('app: stats-main.json / "app-main" entrypoint missing');
+  }
+  return { initialAssets, reachableAssets: entrypointJsAssets(stats, "app-main", "reachableAssets") };
+}
+
+/**
+ * Legacy SDK: the "embedding-sdk" entry, a single eager file in legacy/. It still
+ * emits on-demand chunks (jspdf, echarts, leaflet, ...) into the shared chunks/
+ * dir via dynamic import(). initial = the eager legacy file; total = initial plus
+ * its reachable async chunks, but only when those are loadable at runtime
+ * (sdkAsyncChunksLoadable), otherwise total collapses to initial. Returns null
+ * when the stats lack the entry (older layout) so the caller can fall back.
+ */
+function selectLegacySdkAssets(stats, { sdkAsyncChunksLoadable }) {
+  const initialNames = entrypointJsAssets(stats, "embedding-sdk", "assets");
+  if (!initialNames) {
+    return null;
+  }
+  const reachableNames = entrypointJsAssets(stats, "embedding-sdk", "reachableAssets") || initialNames;
+  const initial = unique(initialNames).filter(notRuntime);
+  return {
+    initialNames: initial,
+    reachableNames: sdkAsyncChunksLoadable ? unique(reachableNames).filter(notRuntime) : initial,
+  };
+}
+
+/**
+ * Chunked SDK delivery. initial = bootstrap (minus its inlined runtime) + the
+ * chunked entry's initial chunks. total = the chunked entry's reachable set
+ * (initial + async children, from the chunk graph). includesAsyncChunks is true
+ * only when the stats carry the reachable chunk graph AND those chunks are
+ * loadable at runtime (sdkAsyncChunksLoadable). A base ref built before the
+ * reachableAssets enrichment has no graph, so its "total" must collapse to
+ * "initial" — the flag lets the comparison avoid measuring a reachable total
+ * against a collapsed one (an apples-to-oranges ~30% phantom).
+ */
+function selectChunkedSdkAssets(stats, { sdkAsyncChunksLoadable }) {
+  const chunkedInitial = entrypointJsAssets(stats, "embedding-sdk-chunked", "assets");
+  if (!chunkedInitial) {
+    throw new Error('embedding-sdk-chunked: stats-embedding-sdk.json / "embedding-sdk-chunked" entrypoint missing');
+  }
+  const bootstrapInitial = entrypointJsAssets(stats, "embedding-sdk-bootstrap", "assets") || [];
+  const chunkedReachableAssets = entrypointJsAssets(stats, "embedding-sdk-chunked", "reachableAssets");
+  const chunkedReachable = chunkedReachableAssets || chunkedInitial;
+  const bootstrapReachable = entrypointJsAssets(stats, "embedding-sdk-bootstrap", "reachableAssets") || bootstrapInitial;
+  return {
+    initialNames: unique([...bootstrapInitial, ...chunkedInitial]).filter(notRuntime),
+    reachableNames: unique([...bootstrapReachable, ...chunkedReachable]).filter(notRuntime),
+    includesAsyncChunks: chunkedReachableAssets != null && sdkAsyncChunksLoadable,
+  };
+}
+
+function measureApp(config) {
+  const dist = config.resolve(APP_DIST);
+  if (!fs.existsSync(dist)) {
+    throw new Error(`Bundle output not found for "app": ${dist}`);
+  }
+  const { initialAssets, reachableAssets } = selectAppAssets(readStats(config, "artifacts/stats-main.json"));
+  if (!reachableAssets) {
+    console.warn("app: stats has no reachableAssets; app total falls back to the whole app/dist");
+  }
+  const totalFiles = reachableAssets ? assetFiles(dist, reachableAssets) : collectJsFiles(dist);
+  return [
+    { bundle: "app", kind: "initial", ...sizeOf(assetFiles(dist, initialAssets)) },
+    { bundle: "app", kind: "total", ...sizeOf(totalFiles) },
+  ];
+}
+
+function measureLegacySdk(config) {
+  const absRoot = config.resolve(SDK_ROOT);
+  const selected = selectLegacySdkAssets(readStats(config, "artifacts/stats-embedding-sdk.json"), config);
+  if (!selected) {
+    // No stats / older layout: fall back to whatever sits in the legacy dir.
+    const candidates = [`${SDK_ROOT}/legacy`, `${SDK_ROOT}.js`];
+    const chosen = candidates.find(candidate => fs.existsSync(config.resolve(candidate)));
+    if (!chosen) {
+      console.warn(`Skipping "embedding-sdk-legacy": output not found (${candidates.join(", ")})`);
+      return [];
+    }
+    return [{ bundle: "embedding-sdk-legacy", kind: "total", ...sizeOf(collectJsFiles(config.resolve(chosen))) }];
+  }
+  return [
+    { bundle: "embedding-sdk-legacy", kind: "initial", ...sizeOf(assetFiles(absRoot, selected.initialNames)) },
+    { bundle: "embedding-sdk-legacy", kind: "total", ...sizeOf(assetFiles(absRoot, selected.reachableNames)) },
+  ];
+}
+
+function measureChunkedSdk(config) {
+  const chunksDir = config.resolve(SDK_ROOT, "chunks");
   if (!fs.existsSync(chunksDir)) {
     // pre-chunked layout (monolith only) — nothing to measure here
     return [];
   }
-
-  const absRoot = resolve(SDK_ROOT);
-  const everything = collectJsFiles(chunksDir).filter(f => !SDK_RUNTIME_RE.test(f));
-
-  const stats = readStats(statsFile);
-  const chunked = entrypointJsAssets(stats, "embedding-sdk-chunked");
-  let reachableFiles;
-  if (chunked) {
-    const bootstrap = entrypointJsAssets(stats, "embedding-sdk-bootstrap") || [];
-    const names = [...new Set([...bootstrap, ...chunked])].filter(n => !SDK_RUNTIME_RE.test(n));
-    reachableFiles = names.map(n => path.join(absRoot, n));
-  } else {
-    console.warn(`embedding-sdk-chunked: entrypoint missing in ${statsFile}; counting whole chunks/ dir`);
-    reachableFiles = everything;
-  }
-
-  const initial = sizeOf(reachableFiles);
-  const total = SDK_ASYNC_CHUNKS_LOADABLE ? sizeOf(everything) : sizeOf(reachableFiles);
-
+  const absRoot = config.resolve(SDK_ROOT);
+  const { initialNames, reachableNames, includesAsyncChunks } = selectChunkedSdkAssets(
+    readStats(config, "artifacts/stats-embedding-sdk.json"),
+    config,
+  );
+  const initial = sizeOf(assetFiles(absRoot, initialNames));
+  const total = includesAsyncChunks ? sizeOf(assetFiles(absRoot, reachableNames)) : initial;
   return [
     { bundle: "embedding-sdk-chunked", kind: "initial", ...initial },
-    { bundle: "embedding-sdk-chunked", kind: "total", ...total },
+    { bundle: "embedding-sdk-chunked", kind: "total", reachable: includesAsyncChunks, ...total },
   ];
 }
 
-function measureBundleSizes() {
-  return [
-    ...simpleTargets.filter(target => isBundleWanted(target.bundle)).flatMap(measureSimpleTarget),
-    ...(isBundleWanted("embedding-sdk-chunked")
-      ? measureChunkedSdk("artifacts/stats-embedding-sdk.json")
-      : []),
-  ];
+// Single-file/dir bundles loaded in one shot — total only.
+function measureWholeDir(config, bundle, candidates) {
+  const chosen = candidates.find(candidate => fs.existsSync(config.resolve(candidate)));
+  if (!chosen) {
+    console.warn(`Skipping "${bundle}": output not found (${candidates.join(", ")})`);
+    return [];
+  }
+  return [{ bundle, kind: "total", ...sizeOf(collectJsFiles(config.resolve(chosen))) }];
 }
 
-module.exports = { measureBundleSizes };
+const bundles = {
+  app: measureApp,
+  "embedding-sdk-legacy": measureLegacySdk,
+  "embedding-sdk-chunked": measureChunkedSdk,
+  "embedding-sdk-package": config => measureWholeDir(config, "embedding-sdk-package", ["resources/embedding-sdk/dist"]),
+  "embed-js": config => measureWholeDir(config, "embed-js", ["resources/frontend_client/app/embed.js"]),
+};
+
+function measureBundleSizes(config) {
+  return Object.entries(bundles)
+    .filter(([bundle]) => config.isBundleWanted(bundle))
+    .flatMap(([, measure]) => measure(config));
+}
+
+module.exports = {
+  measureBundleSizes,
+  buildConfig,
+  entrypointJsAssets,
+  selectAppAssets,
+  selectLegacySdkAssets,
+  selectChunkedSdkAssets,
+};
 
 if (require.main === module) {
-  console.log(JSON.stringify(measureBundleSizes(), null, 2));
+  console.log(JSON.stringify(measureBundleSizes(buildConfig(process.env)), null, 2));
 }

.github/scripts/measure-bundle-sizes.unit.spec.js

@@ -0,0 +1,87 @@
+const {
+  entrypointJsAssets,
+  selectAppAssets,
+  selectLegacySdkAssets,
+  selectChunkedSdkAssets,
+} = require("./measure-bundle-sizes");
+
+const RUNTIME = "embedding-sdk-chunk-runtime.deadbeef.js";
+
+const stats = entrypoints => ({ entrypoints });
+
+describe("entrypointJsAssets", () => {
+  it("returns the .js asset names for a field, accepting strings or {name}", () => {
+    const s = stats({ app: { assets: [{ name: "a.js" }, "b.js", { name: "c.css" }] } });
+    expect(entrypointJsAssets(s, "app", "assets")).toEqual(["a.js", "b.js"]);
+  });
+
+  it("returns null when the entrypoint or field is absent", () => {
+    expect(entrypointJsAssets(stats({}), "missing")).toBeNull();
+    expect(entrypointJsAssets(null, "app")).toBeNull();
+  });
+});
+
+describe("selectAppAssets", () => {
+  it("returns the initial set and a null reachable set on pre-enrichment stats", () => {
+    const s = stats({ "app-main": { assets: ["main.js"] } });
+    expect(selectAppAssets(s)).toEqual({ initialAssets: ["main.js"], reachableAssets: null });
+  });
+
+  it("throws when the app-main entrypoint is missing", () => {
+    expect(() => selectAppAssets(stats({}))).toThrow("app-main");
+  });
+});
+
+describe("selectChunkedSdkAssets", () => {
+  const base = {
+    "embedding-sdk-chunked": { assets: ["a.js", RUNTIME], reachableAssets: ["a.js", "b.js", RUNTIME] },
+    "embedding-sdk-bootstrap": { assets: ["boot.js"], reachableAssets: ["boot.js"] },
+  };
+
+  it("merges bootstrap + chunked, drops the inlined runtime, and counts async chunks", () => {
+    const result = selectChunkedSdkAssets(stats(base), { sdkAsyncChunksLoadable: true });
+    expect(result.initialNames).toEqual(["boot.js", "a.js"]);
+    expect(result.reachableNames).toEqual(["boot.js", "a.js", "b.js"]);
+    expect(result.includesAsyncChunks).toBe(true);
+  });
+
+  it("collapses total to initial when async chunks are not loadable", () => {
+    const result = selectChunkedSdkAssets(stats(base), { sdkAsyncChunksLoadable: false });
+    expect(result.includesAsyncChunks).toBe(false);
+  });
+
+  it("collapses total to initial when the stats carry no reachable graph", () => {
+    const noGraph = { "embedding-sdk-chunked": { assets: ["a.js"] } };
+    const result = selectChunkedSdkAssets(stats(noGraph), { sdkAsyncChunksLoadable: true });
+    expect(result.reachableNames).toEqual(["a.js"]);
+    expect(result.includesAsyncChunks).toBe(false);
+  });
+
+  it("throws when the chunked entrypoint is missing", () => {
+    expect(() => selectChunkedSdkAssets(stats({}), { sdkAsyncChunksLoadable: true })).toThrow(
+      "embedding-sdk-chunked",
+    );
+  });
+});
+
+describe("selectLegacySdkAssets", () => {
+  it("returns null when the legacy entry is absent so the caller can fall back", () => {
+    expect(selectLegacySdkAssets(stats({}), { sdkAsyncChunksLoadable: true })).toBeNull();
+  });
+
+  it("expands total to the reachable async set when loadable", () => {
+    const s = stats({ "embedding-sdk": { assets: ["legacy.js"], reachableAssets: ["legacy.js", "chunk.js"] } });
+    expect(selectLegacySdkAssets(s, { sdkAsyncChunksLoadable: true })).toEqual({
+      initialNames: ["legacy.js"],
+      reachableNames: ["legacy.js", "chunk.js"],
+    });
+  });
+
+  it("collapses total to initial when async chunks are not loadable", () => {
+    const s = stats({ "embedding-sdk": { assets: ["legacy.js"], reachableAssets: ["legacy.js", "chunk.js"] } });
+    expect(selectLegacySdkAssets(s, { sdkAsyncChunksLoadable: false })).toEqual({
+      initialNames: ["legacy.js"],
+      reachableNames: ["legacy.js"],
+    });
+  });
+});

.github/scripts/module-usage.ts

@@ -0,0 +1,123 @@
+// Builds module-level "usage" maps: for each module, the set of modules that
+// depend on it, both directly and indirectly
+//
+// Both are computed at the FILE level off the real dependency-cruiser import
+// graph, then collapsed to module granularity at the very end.
+//
+//   bunx depcruise frontend/src enterprise/frontend/src \
+//     --config .dependency-cruiser.cjs --output-type json > dependency-graph.json
+//   DEP_GRAPH_JSON=dependency-graph.json \
+//   OUT_JSON=usage.json OUT_DIRECT_JSON=usage-direct.json \
+//     bun .github/scripts/module-usage.ts
+
+import { readFileSync, writeFileSync } from "node:fs";
+
+import { elements } from "../../frontend/lint/module-boundaries.mjs";
+
+import {
+  buildFileGraph,
+  getAffectedFiles,
+  mapFileToModule,
+  parseCruiseModules,
+} from "./affected-modules";
+
+const depGraphPath = process.env.DEP_GRAPH_JSON ?? "dependency-graph.json";
+const { modules } = JSON.parse(readFileSync(depGraphPath, "utf8"));
+
+const fileDependencies = parseCruiseModules(modules);
+const fileGraph = buildFileGraph(elements, fileDependencies);
+
+// Group every known source file by its owning module. We seed from the cruise
+// output's `source` files plus everything that appears as a dependency target,
+// so files imported but never importing are still covered.
+const filesByModule = new Map<string, string[]>();
+const allFiles = new Set<string>();
+for (const { source, dependencies } of fileDependencies) {
+  allFiles.add(source);
+  for (const dep of dependencies) {
+    allFiles.add(dep);
+  }
+}
+for (const file of allFiles) {
+  const module = mapFileToModule(fileGraph.nodes, file);
+  if (!module) {
+    continue;
+  }
+  const list = filesByModule.get(module);
+  if (list) {
+    list.push(file);
+  } else {
+    filesByModule.set(module, [file]);
+  }
+}
+
+// Ensure every module appears as a key, even those nothing depends on.
+const emptyDependents = (): Record<string, Set<string>> => {
+  const map: Record<string, Set<string>> = {};
+  for (const module of filesByModule.keys()) {
+    map[module] = new Set();
+  }
+  return map;
+};
+
+// DIRECT usage: module B directly depends on module A if any file in B imports
+// any file in A — a single edge in the import graph, collapsed to modules.
+const directDependents = emptyDependents();
+for (const { source, dependencies } of fileDependencies) {
+  const importer = mapFileToModule(fileGraph.nodes, source);
+  if (!importer) {
+    continue;
+  }
+  for (const target of dependencies) {
+    const owner = mapFileToModule(fileGraph.nodes, target);
+    if (owner && owner !== importer) {
+      directDependents[owner].add(importer);
+    }
+  }
+}
+
+// TRANSITIVE usage: for each module, take all its files, walk the file-level
+// reverse graph to get every file that transitively imports them, collapse to
+// modules, and drop the module itself.
+const transitiveDependents = emptyDependents();
+for (const [module, files] of filesByModule) {
+  const affectedFiles = getAffectedFiles(fileGraph, files);
+  for (const file of affectedFiles) {
+    const owner = mapFileToModule(fileGraph.nodes, file);
+    if (owner && owner !== module) {
+      transitiveDependents[module].add(owner);
+    }
+  }
+}
+
+// Stable, sorted output for clean diffs.
+const toSorted = (
+  map: Record<string, Set<string>>,
+): Record<string, string[]> => {
+  const sorted: Record<string, string[]> = {};
+  for (const module of Object.keys(map).sort()) {
+    sorted[module] = [...map[module]].sort();
+  }
+  return sorted;
+};
+
+const writeOut = (
+  map: Record<string, Set<string>>,
+  outVar: string,
+  label: string,
+) => {
+  const sorted = toSorted(map);
+  const json = JSON.stringify(sorted, null, 2) + "\n";
+  const outPath = process.env[outVar];
+  if (outPath) {
+    writeFileSync(outPath, json);
+    process.stderr.write(
+      `Wrote ${Object.keys(sorted).length} modules (${label}) to ${outPath}.\n`,
+    );
+  } else {
+    process.stdout.write(json);
+  }
+};
+
+writeOut(transitiveDependents, "OUT_JSON", "transitive");
+writeOut(directDependents, "OUT_DIRECT_JSON", "direct");

.github/scripts/resolve-coverage-manifest.mjs

@@ -0,0 +1,94 @@
+/**
+ * Resolves the nightly e2e coverage manifest closest to a commit's point in
+ * history, so the test planner can narrow the e2e run.
+ *
+ * The whole flow lives here so callers "just get a manifest": list the retained
+ * manifest artifacts, find the one whose nightly commit is the nearest ancestor
+ * of `headSha` (via the GitHub compare API — no deep clone), download and unzip
+ * just that one, and return its parsed contents.
+ *
+ * `github` is an authenticated Octokit, as injected by actions/github-script.
+ * Returns { builtAt, specs, path, behindBy } or null when nothing is an
+ * ancestor (caller then runs e2e in full). Never throws: any API/IO failure is
+ * logged and resolves to null, because coverage resolution must not break the
+ * test plan.
+ */
+
+import { execFileSync } from "node:child_process";
+import fs from "node:fs";
+
+const ARTIFACT_NAME = "spec-file-manifest";
+const EXTRACT_DIR = "e2e/coverage";
+const MANIFEST_PATH = `${EXTRACT_DIR}/${ARTIFACT_NAME}.json`;
+
+export async function resolveCoverageManifest({
+  github,
+  owner,
+  repo,
+  headSha,
+  log = console.log,
+}) {
+  try {
+    // Every retained manifest artifact, newest first. Each carries its
+    // nightly's head_sha — the commit it was built from (== builtAt).
+    const artifacts = await github.paginate(
+      github.rest.actions.listArtifactsForRepo,
+      { owner, repo, name: ARTIFACT_NAME, per_page: 100 },
+    );
+    const candidates = artifacts
+      .filter((artifact) => !artifact.expired && artifact.workflow_run?.head_sha)
+      .sort(
+        (a, b) =>
+          new Date(b.created_at).getTime() - new Date(a.created_at).getTime(),
+      );
+
+    // First candidate that is an ancestor of head is the closest in history
+    // (master is linear, candidates are chronological). compare base...head:
+    // behind_by === 0 ⇒ base is an ancestor of head; ahead_by is the distance.
+    let chosen = null;
+    for (const artifact of candidates) {
+      const base = artifact.workflow_run.head_sha;
+      // A stale candidate (force-pushed/GC'd commit) makes compare 404 — skip
+      // it rather than lose the optimization for everyone.
+      let comparison;
+      try {
+        ({ data: comparison } =
+          await github.rest.repos.compareCommitsWithBasehead({
+            owner,
+            repo,
+            basehead: `${base}...${headSha}`,
+          }));
+      } catch {
+        continue;
+      }
+      if (comparison.behind_by === 0) {
+        chosen = { artifact, base, behindBy: comparison.ahead_by };
+        break;
+      }
+    }
+
+    if (!chosen) {
+      log("No ancestor coverage manifest found; e2e will run in full.");
+      return null;
+    }
+
+    const download = await github.rest.actions.downloadArtifact({
+      owner,
+      repo,
+      artifact_id: chosen.artifact.id,
+      archive_format: "zip",
+    });
+    fs.writeFileSync(`${ARTIFACT_NAME}.zip`, Buffer.from(download.data));
+    execFileSync("unzip", ["-o", `${ARTIFACT_NAME}.zip`, "-d", EXTRACT_DIR]);
+
+    const manifest = JSON.parse(fs.readFileSync(MANIFEST_PATH, "utf8"));
+    log(
+      `Using coverage manifest ${chosen.base.slice(0, 12)} ` +
+        `(${chosen.behindBy} commits behind HEAD).`,
+    );
+    return { ...manifest, path: MANIFEST_PATH, behindBy: chosen.behindBy };
+  } catch (error) {
+    log(`Coverage manifest resolution failed; e2e will run in full: ${error}`);
+    return null;
+  }
+}

.github/scripts/setup-python-runner.sh

@@ -19,7 +19,8 @@ while [[ $# -gt 0 ]]; do
 done
 
 echo "Cloning python-runner repository..."
-git clone --depth 1 https://${METABASE_AUTOMATION_USER_TOKEN}@github.com/metabase/python-runner-container.git python-runner
+git clone --depth 1 https://${METABASE_AUTOMATION_USER_TOKEN}@github.com/metabase/python-runner-container.git --branch seccomp python-runner
+
 
 if [ "$SKIP_START" = false ]; then
   echo "Starting python-runner..."

.github/scripts/upload-affected-tests-stats.js

@@ -1,41 +1,64 @@
-// This script is used in .github/workflows/run-tests.yml.
-// It uploads the test-plan stats row produced by create-test-plan.js to
-// the stats.metabase.com tracking table.
-// Reads STATS_JSON, PR_NUMBER, HEAD_SHA, BASE_SHA, API_KEY from env.
+// Appends the test-plan stats row produced by create-test-plan.ts to the
+// "FE Affected Tests" table on stats.metabase.com.
+// Reads STATS_JSON, TRIGGERED_BY, PR_NUMBER, HEAD_SHA, BASE_SHA, API_KEY from env.
 
 const { uploadCsvToMb } = require("./csv-to-mb.js");
 
-const stats = JSON.parse(process.env.STATS_JSON);
-console.log("stats", stats);
+// "FE Affected Tests" uploaded table on stats.metabase.com.
+const TABLE_ID = 81818;
 
-const row = {
-  Date: new Date().toISOString(),
-  PR: Number(process.env.PR_NUMBER),
-  "Head SHA": process.env.HEAD_SHA,
-  "Base SHA": process.env.BASE_SHA,
-  "Modules changed": stats.modules_changed,
-  "Modules affected": stats.modules_affected,
-  "FE Unit specs total": stats.fe_unit_specs_total,
-  "FE Unit specs run": stats.fe_unit_specs_run,
-  "FE Unit specs skipped": stats.fe_unit_specs_skipped,
-  "Loki stories total": stats.loki_stories_total,
-  "Loki stories run": stats.loki_stories_run,
-  "Loki stories skipped": stats.loki_stories_skipped,
-  "E2E specs total": stats.e2e_specs_total,
-  "E2E specs run": stats.e2e_specs_run,
-  "E2E specs skipped": stats.e2e_specs_skipped,
-};
+async function main() {
+  // create-test-plan doesn't always produce stats (e.g. on release branches
+  // running an older planner), leaving STATS_JSON empty. Nothing to upload.
+  const raw = (process.env.STATS_JSON || "").trim();
+  if (!raw || raw === "null") {
+    console.log("No STATS_JSON to upload; skipping.");
+    return;
+  }
 
-uploadCsvToMb({
-  baseUrl: "https://stats.metabase.com",
-  tableId: 77008, // "Affected Tests Stats" table on stats.metabase.com
-  jsonData: [row],
-  mode: "append",
-})
-  .then(() => {
-    console.log("Data uploaded successfully");
-  })
-  .catch((error) => {
-    console.error("Error uploading data:", error);
-    process.exit(1);
+  const s = JSON.parse(raw);
+  console.log("stats", s);
+
+  const row = {
+    Date: new Date().toISOString(),
+    // "pr_update" or "merge_to_master". ("Trigger" is a reserved SQL word.)
+    "Triggered By": process.env.TRIGGERED_BY,
+    PR: Number(process.env.PR_NUMBER),
+    "Head SHA": process.env.HEAD_SHA,
+    "Base SHA": process.env.BASE_SHA,
+    "FE Files Changed": s.fe_files_changed,
+    "FE Files Total": s.fe_files_total,
+    "BE Files Changed": s.be_files_changed,
+    "BE Files Total": s.be_files_total,
+    "Unit Infra Touched": s.unit_infra_touched,
+    "Loki Infra Touched": s.loki_infra_touched,
+    "Shared Sources Touched": s.shared_sources_touched,
+    "FE Modules Total": s.fe_modules_total,
+    "FE Modules Changed": s.fe_modules_changed,
+    "FE Modules Affected (Rules)": s.fe_modules_affected_rules,
+    "FE Modules Affected (Usage)": s.fe_modules_affected_usage,
+    "Unit Specs All": s.unit_specs_all,
+    "Unit Specs To Run (Rules)": s.unit_specs_to_run_rules,
+    "Unit Specs To Run (Usage)": s.unit_specs_to_run_usage,
+    "Loki Stories All": s.loki_stories_all,
+    "Loki Stories To Run (Rules)": s.loki_stories_to_run_rules,
+    "Loki Stories To Run (Usage)": s.loki_stories_to_run_usage,
+    "E2E Specs All": s.e2e_specs_all,
+    "E2E Specs To Run (Rules)": s.e2e_specs_to_run_rules,
+    "E2E Specs To Run (Usage)": s.e2e_specs_to_run_usage,
+  };
+
+  await uploadCsvToMb({
+    baseUrl: "https://stats.metabase.com",
+    tableId: TABLE_ID,
+    jsonData: [row],
+    mode: "append",
   });
+  console.log("Data uploaded successfully");
+}
+
+// Best-effort: never let a telemetry failure turn the job red.
+main().catch((error) => {
+  console.error("Skipping stats upload after error:", error);
+  process.exit(0);
+});

.github/team.json

@@ -4,7 +4,6 @@
       "name": "Querying Platform",
       "label": ".Team/QueryingPlatform",
       "members": [
-        "bshepherdson",
         "metamben",
         "rileythomp",
         "camsaul",
@@ -48,7 +47,8 @@
       "members": [
         "fraserdrops",
         "nemanjaglumac",
-        "romeovs"
+        "romeovs",
+        "ChrisVandoo"
       ]
     },
     {
@@ -89,11 +89,12 @@
         "npfitz",
         "johnswanson",
         "nvoxland",
-        "edpaget",
+        "bshepherdson",
         "deniskaber",
         "andsalves",
         "kevinkelleher12",
-        "AndreyChernykh"
+        "AndreyChernykh",
+        "bowbahdoe"
       ]
     },
     {

.github/workflows/actionlint.yml

@@ -0,0 +1,42 @@
+name: Actionlint
+
+on:
+  push:
+    branches:
+      - 'master'
+      - 'release-**'
+    paths:
+      - '.github/workflows/**'
+  pull_request:
+    paths:
+      - '.github/workflows/**'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  actionlint:
+    name: Lint Github Actions Workflows
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    steps:
+      - uses: actions/checkout@v6
+      - name: Get changed Github actions
+        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+        id: changes
+        with:
+          token: ${{ github.token }}
+          filters: .github/file-paths.yaml
+          list-files: shell
+      - name: Setup actionlint
+        id: download
+        shell: bash
+        run: |
+          if command -v actionlint; then
+            echo "executable=actionlint" >> "$GITHUB_OUTPUT"
+          else
+            # script sets executable output, for details see: https://github.com/rhysd/actionlint/blob/main/docs/usage.md#use-actionlint-on-github-actions
+            bash <(curl -fsSL https://raw.githubusercontent.com/rhysd/actionlint/v1.7.12/scripts/download-actionlint.bash)
+          fi
+      - name: Run actionlint
+        run: ${{ steps.download.outputs.executable }} --color --verbose ${{ steps.changes.outputs.actionlint_files }}

.github/workflows/app-db.yml

@@ -11,6 +11,13 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}-app-db
   cancel-in-progress: true
 
+# Exposed to every job so the test-driver action can report failures to
+# ci-conductor (secrets: inherit is already set on the app-db call in
+# run-tests.yml). See DEV-2224.
+env:
+  CI_CONDUCTOR_BASE_URL: ${{ secrets.CI_CONDUCTOR_BASE_URL }}
+  CI_CONDUCTOR_WEBHOOK_SECRET: ${{ secrets.CI_CONDUCTOR_WEBHOOK_SECRET }}
+
 jobs:
   be-tests-mariadb:
     if: ${{ !inputs.skip }}
@@ -69,7 +76,7 @@ jobs:
             github.event_name == 'push' &&
             (
               github.ref_name == 'master' ||
-              startsWith(github.ref_name, 'release-')
+              startsWith(github.ref_name, 'release-x')
             ) &&
             ''
           ) ||
@@ -113,6 +120,7 @@ jobs:
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[ ${{ matrix.job.exclude-tag }} ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
+          quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
         if: always()
@@ -124,6 +132,7 @@ jobs:
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-mysql:
     if: ${{ !inputs.skip }}
@@ -184,7 +193,7 @@ jobs:
             github.event_name == 'push' &&
             (
               github.ref_name == 'master' ||
-              startsWith(github.ref_name, 'release-')
+              startsWith(github.ref_name, 'release-x')
             ) &&
             ''
           ) ||
@@ -236,6 +245,7 @@ jobs:
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[ ${{ matrix.job.exclude-tag }} ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
+          quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
         if: always()
@@ -247,6 +257,7 @@ jobs:
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-postgres:
     if: ${{ !inputs.skip }}
@@ -300,7 +311,7 @@ jobs:
             github.event_name == 'push' &&
             (
               github.ref_name == 'master' ||
-              startsWith(github.ref_name, 'release-')
+              startsWith(github.ref_name, 'release-x')
             ) &&
             ''
           ) ||
@@ -346,6 +357,7 @@ jobs:
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[ ${{ matrix.job.exclude-tag }} ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
+          quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
         if: always()
@@ -357,6 +369,7 @@ jobs:
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   app-db-tests-result:
     needs:

.github/workflows/backend.yml

@@ -11,6 +11,13 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}-backend
   cancel-in-progress: true
 
+# Exposed to the test jobs so they can report failures to ci-conductor
+# (secrets: inherit is already set on the backend call in run-tests.yml).
+# See DEV-2224.
+env:
+  CI_CONDUCTOR_BASE_URL: ${{ secrets.CI_CONDUCTOR_BASE_URL }}
+  CI_CONDUCTOR_WEBHOOK_SECRET: ${{ secrets.CI_CONDUCTOR_WEBHOOK_SECRET }}
+
 jobs:
   be-linter-clj-kondo:
     if: ${{ !inputs.skip }}
@@ -38,7 +45,7 @@ jobs:
 
   be-linter-eastwood-test:
     # Master / release safety net: lint every backend test namespace.
-    if: ${{ !inputs.skip && github.event_name == 'push' && (github.ref_name == 'master' || startsWith(github.ref_name, 'release-')) }}
+    if: ${{ !inputs.skip && github.event_name == 'push' && (github.ref_name == 'master' || startsWith(github.ref_name, 'release-x')) }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 45
     name: Eastwood (tests only)
@@ -114,7 +121,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        java-version: [21]
+        java-version: [25]
         job:
           - name: Enterprise Tests
             edition: ee
@@ -160,7 +167,7 @@ jobs:
             github.event_name == 'push' &&
             (
               github.ref_name == 'master' ||
-              startsWith(github.ref_name, 'release-')
+              startsWith(github.ref_name, 'release-x')
             ) &&
             ''
           ) ||
@@ -179,20 +186,42 @@ jobs:
         env:
           MB_EDITION: ${{ matrix.job.edition }}
 
+      - name: Resolve current job id
+        # Resolve JOB_ID before the long test step so the ci-conductor reporter
+        # below can link failures to this exact job. Best-effort.
+        uses: ./.github/actions/resolve-job-id
+
       - name: "Test Java ${{ matrix.java-version }} ${{ matrix.job.name }}"
         id: run-java-tests
         run: >-
           clojure -X:dev:ci:test:${{ matrix.job.edition }}:${{ matrix.job.edition }}-dev
           :exclude-tags '[:mb/driver-tests ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
           ${{ matrix.job.test-args }}
-        # Trunk Quarantine controls the final state of the run in the CI!
-        # Even if this step fails we let it pass, and then `trunk-io/analytics-uploader` determines
-        # whether to fail or to pass the whole job, based on the quarantine list.
+        # Keep this step continue-on-error because the quarantine logic controls whether it ultimately fails.
         continue-on-error: true
 
+      - name: Report failed tests to ci-conductor
+        if: ${{ !cancelled() && steps.run-java-tests.outcome == 'failure' }}
+        # This step should NEVER fail the job!
+        continue-on-error: true
+        uses: ./.github/actions/report-failures-to-ci-conductor
+        with:
+          test-suite: be-tests-java-${{ matrix.java-version }}-${{ matrix.job.test-group-name }}
+          adapter: backend
+
+      - name: Quarantine gate
+        if: ${{ !cancelled() && steps.run-java-tests.outcome == 'failure' }}
+        continue-on-error: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
+        timeout-minutes: 3
+        uses: ./.github/actions/quarantine-gate
+        with:
+          adapter: backend
+          test-suite: be-tests-java-${{ matrix.java-version }}-${{ matrix.job.test-group-name }}
+          enforce-quarantine: ${{ vars.QUARANTINE_ENGINE == 'ci-conductor' }}
+
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
-        if: always() && (steps.run-java-tests.conclusion != 'skipped' || steps.run-java-tests-21.conclusion != 'skipped')
+        if: always()
         with:
           input-path: ./target/junit/
           output-name: be-tests-java-${{ matrix.java-version }}-${{ matrix.job.edition }}
@@ -201,6 +230,7 @@ jobs:
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.run-java-tests.outcome }}
+          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
       - name: Publish Test Report (JUnit)
         uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
@@ -229,7 +259,7 @@ jobs:
     timeout-minutes: 10
     strategy:
       matrix:
-        java-version: [21]
+        java-version: [25]
     name: "Check Java ${{ matrix.java-version }}"
     steps:
       - uses: actions/checkout@v6

.github/workflows/bundle-size-stats.yml

@@ -8,6 +8,8 @@ on:
   workflow_run:
     workflows: ["Build Uberjar"]
     types: [completed]
+    # Master only: releases form non-linear lines whose deltas are meaningless,
+    # so their sizes are backfilled separately rather than logged here.
     branches: [master]
 
 concurrency:
@@ -21,6 +23,10 @@ jobs:
     timeout-minutes: 15
     env:
       HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
+      # Only record a data point when a bundle's as-served size (brotli where the
+      # build ships .br, else gzip) moved by at least this percent vs the last
+      # plotted point, keeping the chart to real changes.
+      MIN_DELTA_PERCENT: "0.5"
     steps:
       - name: Check out the code
         uses: actions/checkout@v6
@@ -78,9 +84,30 @@ jobs:
           mkdir -p artifacts resources/embedding-sdk
           if [ -n "$STATS_ZIP" ]; then unzip -o "$STATS_ZIP" -d artifacts; fi
           if [ -n "$PKG_ZIP" ]; then unzip -o "$PKG_ZIP" -d resources/embedding-sdk; fi
+      - name: Restore last plotted bundle sizes
+        uses: actions/cache/restore@v4
+        with:
+          path: bundle-size-cache
+          key: bundle-size-last-${{ github.run_id }}
+          restore-keys: |
+            bundle-size-last-
       - name: Measure bundle sizes
         run: node ./.github/scripts/measure-bundle-sizes.js | tee artifacts/bundle-sizes.json
-      - name: Upload sizes to Stats
+      - name: Compute deltas and decide whether to record this point
+        id: prepare
+        env:
+          CURRENT: artifacts/bundle-sizes.json
+          LAST: bundle-size-cache/last.json
+          CACHE_OUT: bundle-size-cache/last.json
+          ROWS_OUT: artifacts/upload-rows.json
+          VERSION_PROPS: artifacts/version.properties
+          # Passed via env (not interpolated into the shell) so the commit
+          # message can't inject commands; the script keeps only the subject.
+          COMMIT_MESSAGE: ${{ github.event.workflow_run.head_commit.message }}
+        run: node ./.github/scripts/bundle-size-stats-prepare.js
+      - name: Upload sizes (with deltas) to Stats
+        id: upload
+        if: steps.prepare.outputs.significant == 'true'
         uses: actions/github-script@v9
         env:
           API_KEY: ${{ secrets.STATS_API_KEY }}
@@ -89,43 +116,33 @@ jobs:
             const fs = require("fs");
             const { uploadCsvToMb } = require("${{ github.workspace }}/.github/scripts/csv-to-mb.js");
 
-            const measurements = JSON.parse(
-              fs.readFileSync("${{ github.workspace }}/artifacts/bundle-sizes.json", "utf8"),
+            const data = JSON.parse(
+              fs.readFileSync("${{ github.workspace }}/artifacts/upload-rows.json", "utf8"),
             );
 
-            const date = new Date().toISOString().slice(0, 10); // YYYY-MM-DD
-            const commit = process.env.HEAD_SHA.slice(0, 12);
-
-            // version.properties (extracted from the uberjar) carries the build's tag.
-            // Non-release (master) builds report tag=vUNKNOWN, so leave Version empty there.
-            const versionProps = "${{ github.workspace }}/artifacts/version.properties";
-            const rawVersion = fs.existsSync(versionProps)
-              ? (fs.readFileSync(versionProps, "utf8").match(/^tag=(.*)$/m)?.[1]?.trim() ?? "")
-              : "";
-            const version = rawVersion === "vUNKNOWN" ? "" : rawVersion;
-
-            const data = measurements.map(measurement => ({
-              "Date": date,
-              "Version": version,
-              "Commit": commit,
-              "Bundle": measurement.bundle,
-              "Kind": measurement.kind, // "initial" or "total"
-              "Raw bytes": measurement.rawBytes,
-              "Gzip bytes": measurement.gzipBytes,
-              "Brotli bytes": measurement.brotliBytes ?? "", // as-served; empty when no .br shipped
-              "File count": measurement.fileCount,
-            }));
-
             console.table(data);
 
-            uploadCsvToMb({
-              baseUrl: "https://stats.metabase.com",
-              tableId: 79417,
-              jsonData: data,
-              mode: "append",
-            }).then(() => {
+            try {
+              await uploadCsvToMb({
+                baseUrl: "https://stats.metabase.com",
+                tableId: 79702,
+                jsonData: data,
+                mode: "append",
+              });
               console.log("Bundle sizes uploaded successfully");
-            }).catch(error => {
-              console.error("Error uploading bundle sizes:", error);
-              process.exit(1);
-            });
+              core.setOutput("uploaded", "true");
+            } catch (error) {
+              // Stats logging is best-effort: if stats.metabase.com is still
+              // unreachable after the client's retries, keep the run green. The
+              // last-plotted cache is only saved on a successful upload (below),
+              // so this point is re-attempted on the next master build and
+              // nothing is silently dropped.
+              core.warning(`Bundle-size upload failed after retries; leaving run green: ${error.message}`);
+              core.setOutput("uploaded", "false");
+            }
+      - name: Remember this as the last plotted point
+        if: steps.upload.outputs.uploaded == 'true'
+        uses: actions/cache/save@v4
+        with:
+          path: bundle-size-cache
+          key: bundle-size-last-${{ github.run_id }}

.github/workflows/claude-e2e-flake-fix.yml

@@ -1,208 +0,0 @@
-name: "Claude E2E Flake Fix"
-
-# Runs the /fix-flaky-test command headlessly to fix a flaky e2e test tracked by a Linear
-# issue. Triggered manually or by automation (e.g. ci-conductor) via workflow_dispatch /
-# repository_dispatch. ci-conductor only dispatches this workflow — it never runs the agent
-# itself. The agent opens a green, review-ready PR; a human always reviews and merges.
-
-on:
-  workflow_dispatch:
-    inputs:
-      issue:
-        description: "Linear issue ref for the flaky test (e.g. DEV-2181)"
-        required: true
-        type: string
-  repository_dispatch:
-    types: [e2e-flake-fix]
-
-concurrency:
-  # One in-flight run per Linear issue. Belt-and-suspenders alongside the branch-existence
-  # dedup the command itself performs.
-  group: e2e-flake-fix-${{ github.event.inputs.issue || github.event.client_payload.issue }}
-  cancel-in-progress: false
-
-jobs:
-  flake-fix:
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    # 3 attempts x 2 stress runs (burn_in=50) can run for hours. If this bumps the runner's
-    # job ceiling, decompose via workflow_run completion events + --resume (see DEV-2182).
-    timeout-minutes: 360
-    permissions:
-      contents: write
-      pull-requests: write
-      id-token: write
-    steps:
-      - name: Resolve Linear issue ref
-        id: ref
-        env:
-          DISPATCH_ISSUE: ${{ github.event.inputs.issue }}
-          PAYLOAD_ISSUE: ${{ github.event.client_payload.issue }}
-        run: |
-          if [ "${{ github.event_name }}" = "repository_dispatch" ]; then
-            REF="$PAYLOAD_ISSUE"
-          else
-            REF="$DISPATCH_ISSUE"
-          fi
-          if [ -z "$REF" ]; then
-            echo "::error::No Linear issue ref supplied"
-            exit 1
-          fi
-          echo "ref=$REF" >> "$GITHUB_OUTPUT"
-          echo "branch=automated-e2e-flake-fix-$REF" >> "$GITHUB_OUTPUT"
-          echo "Flake fix for Linear issue: $REF"
-
-      # Check out metabase itself with the Metabase Automation token so the agent's
-      # git push / gh dispatch run as that user (a PAT, so it triggers the stress workflow).
-      - uses: actions/checkout@v6
-        with:
-          token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
-          fetch-depth: 0
-
-      - name: Dedup — skip if the fix branch already exists
-        id: dedup
-        env:
-          BRANCH: ${{ steps.ref.outputs.branch }}
-        run: |
-          if git ls-remote --exit-code --heads origin "$BRANCH" >/dev/null 2>&1; then
-            echo "::notice::$BRANCH already exists — a run is in flight or already landed. Skipping."
-            echo "exists=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "exists=false" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Configure git identity (Metabase Automation)
-        if: steps.dedup.outputs.exists == 'false'
-        run: |
-          git config --global user.name "Metabase Automation"
-          git config --global user.email "github-automation@metabase.com"
-
-      # Make the Linear MCP available to the agent (it prefers MCP, falls back to the
-      # REST/GraphQL API with the same key when MCP is absent).
-      - name: Register Linear MCP server
-        if: steps.dedup.outputs.exists == 'false'
-        env:
-          LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}
-        run: |
-          jq -n \
-            --arg key "$LINEAR_API_KEY" \
-            '{
-              mcpServers: {
-                "linear-server": {
-                  url: "https://mcp.linear.app/mcp",
-                  type: "http",
-                  headers: { Authorization: ("Bearer " + $key) }
-                }
-              }
-            }' > ~/.claude.json
-
-      # Fail fast if the model API is unreachable or the key is bad / over quota.
-      - name: Preflight — model API reachable & authorized
-        if: steps.dedup.outputs.exists == 'false'
-        env:
-          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY_E2E_FLAKE_FIX }}
-          LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}
-        run: |
-          code=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 15 \
-            https://api.anthropic.com/v1/models \
-            -H "x-api-key: $ANTHROPIC_API_KEY" \
-            -H "anthropic-version: 2023-06-01") \
-            || { echo "::error::Anthropic API unreachable (connect/timeout) — runner egress likely blocked"; exit 1; }
-          echo "Anthropic /v1/models -> HTTP $code"
-          case "$code" in
-            200)     ;;
-            401|403) echo "::error::Anthropic API auth failed (HTTP $code) — check ANTHROPIC_FLAKE_FIX_API_KEY"; exit 1 ;;
-            429)     echo "::error::Anthropic API rate limited / over quota (HTTP $code)"; exit 1 ;;
-            *)       echo "::error::Anthropic API unexpected status $code"; exit 1 ;;
-          esac
-
-          # Linear is non-fatal: surface egress/auth trouble without blocking an otherwise-fine run
-          # (the live path uses Bearer auth via MCP; this raw-key GraphQL probe may differ).
-          lcode=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 15 \
-            -X POST https://api.linear.app/graphql \
-            -H "Authorization: $LINEAR_API_KEY" \
-            -H "Content-Type: application/json" \
-            --data '{"query":"{ viewer { id } }"}') \
-            || { echo "::warning::Linear API unreachable (connect/timeout)"; lcode=000; }
-          echo "Linear /graphql -> HTTP $lcode"
-          [ "$lcode" = "200" ] || echo "::warning::Linear API check returned HTTP $lcode — not blocking"
-
-      - name: Run /fix-flaky-test with Claude Code
-        id: claude
-        if: steps.dedup.outputs.exists == 'false'
-        continue-on-error: true
-        uses: anthropics/claude-code-action@787c5a0ce96a9a6cfb050ea0c8f4c05f2447c251 # v1.0.133
-        env:
-          GH_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
-          GITHUB_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
-          LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}
-          GITHUB_ACTIONS_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-        timeout-minutes: 350
-        with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY_E2E_FLAKE_FIX }}
-          github_token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
-          allowed_bots: linear
-          prompt: |
-            Read and follow the instructions in .claude/commands/fix-flaky-test.md to fix the
-            flaky e2e test tracked by Linear issue ${{ steps.ref.outputs.ref }}. Treat
-            "${{ steps.ref.outputs.ref }}" as the command's $ARGUMENTS.
-
-            ## CI Environment Notes
-            - You are running headlessly in GitHub Actions as the "Metabase Automation" user.
-              git, gh, and the Linear MCP are pre-configured — no human is watching, so never
-              ask for approval. The branch-existence dedup gate in Phase 0 is the only go/no-go.
-            - The fix branch is `${{ steps.ref.outputs.branch }}`.
-            - Visibility: the dispatched ref may be a re-keyed `DEV-` issue — resolve it via
-              get_issue first, then post the per-phase heartbeat to the *resolved* issue (per the
-              command's Linear rules). It is the only progress signal in headless CI.
-            - Polling: `ScheduleWakeup` is not available here. Instead, block on the stress runs
-              with `gh run watch <run-id> --exit-status` (the job is long-lived by design).
-            - NEVER merge: do not run `gh pr merge` or enable auto-merge. Stop at a green,
-              review-ready PR. A human owns the merge.
-            - If a phase fails catastrophically, post the failure (with GITHUB_ACTIONS_RUN_URL)
-              to the Linear issue before exiting, per the command's audit-trail step.
-          claude_args: >-
-            --allowedTools
-            "Glob,
-            Grep,
-            Read,
-            ToolSearch,
-            Skill(*),
-            WebFetch(domain:github.com),
-            Edit(//./**),
-            Edit(/tmp/**),
-            Write(//./**),
-            Write(/tmp/**),
-            Bash(cat *),
-            Bash(cd *),
-            Bash(diff *),
-            Bash(echo *),
-            Bash(find *),
-            Bash(gh *),
-            Bash(git *),
-            Bash(grep *),
-            Bash(head *),
-            Bash(jq *),
-            Bash(ls *),
-            Bash(mkdir *),
-            Bash(printf *),
-            Bash(sed *),
-            Bash(sort *),
-            Bash(tail *),
-            Bash(tee *),
-            Bash(wc *),
-            Bash(which *),
-            mcp__linear-server__get_issue,
-            mcp__linear-server__list_comments,
-            mcp__linear-server__list_issues,
-            mcp__linear-server__save_comment,
-            mcp__linear-server__create_attachment_from_upload"
-            --disallowedTools "Bash(gh pr merge*),Bash(git push origin master*),Bash(rm -rf /*)"
-
-      - name: Verify the run did not crash
-        if: steps.dedup.outputs.exists == 'false'
-        run: |
-          if [ "${{ steps.claude.outcome }}" = "failure" ]; then
-            echo "::error::Claude Code crashed or exited with an error"
-            exit 1
-          fi
-          echo "Flake-fix run completed (see the Linear issue for the audit trail and PR)."

.github/workflows/cross-branch-migrations.yml

@@ -26,7 +26,7 @@ concurrency:
 jobs:
   migrations-h2-ee:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 10
+    timeout-minutes: 15
     env:
       CI: 'true'
       MB_DB_TYPE: h2
@@ -40,7 +40,7 @@ jobs:
 
   migrations-postgres-14-ee:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 10
+    timeout-minutes: 15
     env:
       CI: 'true'
       MB_DB_TYPE: postgres
@@ -66,7 +66,7 @@ jobs:
 
   migrations-postgres-latest-ee:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 10
+    timeout-minutes: 15
     env:
       CI: 'true'
       MB_DB_TYPE: postgres
@@ -92,7 +92,7 @@ jobs:
 
   migrations-mysql-8-0-ee:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 10
+    timeout-minutes: 15
     env:
       CI: 'true'
       MB_DB_TYPE: mysql
@@ -117,7 +117,7 @@ jobs:
 
   migrations-mysql-latest-ee:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 10
+    timeout-minutes: 15
     env:
       CI: 'true'
       MB_DB_TYPE: mysql
@@ -143,7 +143,7 @@ jobs:
 
   migrations-mariadb-10-6-ee:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 10
+    timeout-minutes: 15
     env:
       CI: 'true'
       MB_DB_TYPE: mysql
@@ -168,7 +168,7 @@ jobs:
 
   migrations-mariadb-latest-ee:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 10
+    timeout-minutes: 15
     env:
       CI: 'true'
       MB_DB_TYPE: mysql

.github/workflows/docs-generate-63.yml

@@ -0,0 +1,22 @@
+name: Auto-update documentation (release)
+
+on:
+  schedule:
+    - cron: "0 23 * * 1-5" # Every Monday through Friday at 11 PM UTC
+  workflow_dispatch:
+    inputs:
+      target_branch:
+        description: "Target branch for documentation update"
+        required: false
+        default: "release-x.63.x"
+        type: string
+
+jobs:
+  update-release-docs:
+    if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
+    name: Call documentation update for release branch
+    uses: ./.github/workflows/docs-generate-base.yml
+    with:
+      target_branch: ${{ inputs.target_branch || 'release-x.63.x' }}
+    secrets:
+      automation_token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}

.github/workflows/drivers.yml

@@ -11,6 +11,13 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}-drivers
   cancel-in-progress: true
 
+# Exposed to every driver job so the test-driver action can report failures to
+# ci-conductor (secrets: inherit is already set on the drivers call in
+# run-tests.yml). See DEV-2224.
+env:
+  CI_CONDUCTOR_BASE_URL: ${{ secrets.CI_CONDUCTOR_BASE_URL }}
+  CI_CONDUCTOR_WEBHOOK_SECRET: ${{ secrets.CI_CONDUCTOR_WEBHOOK_SECRET }}
+
 jobs:
   # This job determines which driver tests should run based on PR context.
   # All decision logic is consolidated in mage driver-decisions.
@@ -39,6 +46,7 @@ jobs:
       sqlserver-should-run: ${{ steps.driver-decisions.outputs.sqlserver-should-run }}
       vertica-should-run: ${{ steps.driver-decisions.outputs.vertica-should-run }}
       # Per-driver configured status from ci-test-config (skip | info | required)
+      h2-status: ${{ steps.driver-decisions.outputs.h2-status }}
       athena-status: ${{ steps.driver-decisions.outputs.athena-status }}
       bigquery-status: ${{ steps.driver-decisions.outputs.bigquery-status }}
       clickhouse-status: ${{ steps.driver-decisions.outputs.clickhouse-status }}
@@ -49,6 +57,7 @@ jobs:
       mongo-sharded-cluster-status: ${{ steps.driver-decisions.outputs.mongo-sharded-cluster-status }}
       mysql-mariadb-status: ${{ steps.driver-decisions.outputs.mysql-mariadb-status }}
       oracle-status: ${{ steps.driver-decisions.outputs.oracle-status }}
+      postgres-status: ${{ steps.driver-decisions.outputs.postgres-status }}
       presto-jdbc-status: ${{ steps.driver-decisions.outputs.presto-jdbc-status }}
       redshift-status: ${{ steps.driver-decisions.outputs.redshift-status }}
       snowflake-status: ${{ steps.driver-decisions.outputs.snowflake-status }}
@@ -129,7 +138,7 @@ jobs:
           ./bin/mage -driver-decisions "${MAGE_ARGS[@]}" --github-output-only >> $GITHUB_OUTPUT
         env:
           BASE_REF: ${{ github.event.pull_request.base.ref || github.ref_name }}
-          IS_MASTER_OR_RELEASE: ${{ github.ref_name == 'master' || startsWith(github.ref_name, 'release-') }}
+          IS_MASTER_OR_RELEASE: ${{ github.ref_name == 'master' || startsWith(github.ref_name, 'release-x') }}
         shell: bash
 
   be-tests-athena-ee:
@@ -170,6 +179,8 @@ jobs:
         test-args: >-
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.athena-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -183,6 +194,7 @@ jobs:
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
         driver-status: ${{ needs.determine-driver-skips.outputs.athena-status }}
         report-variant: ${{ matrix.job.name }}
+        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-bigquery-cloud-sdk-ee:
     needs: determine-driver-skips
@@ -246,6 +258,8 @@ jobs:
         junit-name: 'be-tests-bigquery-cloud-sdk-ee'
         test-args: ${{ matrix.job.test-args }}
         logs-artifact-suffix: ${{ matrix.job.name }}
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.bigquery-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -259,6 +273,7 @@ jobs:
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
         driver-status: ${{ needs.determine-driver-skips.outputs.bigquery-status }}
         report-variant: ${{ matrix.job.name }}
+        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -331,6 +346,8 @@ jobs:
         junit-name: 'be-tests-clickhouse-ee'
         test-args: ${{ matrix.job.test-args }}
         logs-artifact-suffix: ${{ matrix.job.name }}
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.clickhouse-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -342,6 +359,8 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.clickhouse-status }}
+        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -385,6 +404,8 @@ jobs:
         test-args: >-
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.druid-jdbc-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -396,12 +417,39 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.druid-jdbc-status }}
+        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-databricks-ee:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.databricks-should-run == 'true' || needs.determine-driver-skips.outputs.databricks-quarantine-conflict == 'true' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
+    strategy:
+      fail-fast: false
+      matrix:
+        job:
+          - name: Driver Tests Part 1
+            test-args: >-
+              :only-tags [:mb/driver-tests]
+              :exclude-tags [:mb/transforms-python-test]
+              :fail-fast? true
+              :partition/total 3
+              :partition/index 0
+          - name: Driver Tests Part 2
+            test-args: >-
+              :only-tags [:mb/driver-tests]
+              :exclude-tags [:mb/transforms-python-test]
+              :fail-fast? true
+              :partition/total 3
+              :partition/index 1
+          - name: Driver Tests Part 3
+            test-args: >-
+              :only-tags [:mb/driver-tests]
+              :exclude-tags [:mb/transforms-python-test]
+              :fail-fast? true
+              :partition/total 3
+              :partition/index 2
     env:
       CI: 'true'
       DRIVERS: databricks
@@ -430,9 +478,9 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-databricks-ee'
-        test-args: >-
-          :only-tags [:mb/driver-tests]
-          :exclude-tags [:mb/transforms-python-test]
+        test-args: ${{ matrix.job.test-args }}
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.databricks-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -446,12 +494,38 @@ jobs:
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
         driver-status: ${{ needs.determine-driver-skips.outputs.databricks-status }}
         report-variant: ${{ matrix.job.name }}
+        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-databricks-multi-catalog-ee:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.databricks-should-run == 'true' || needs.determine-driver-skips.outputs.databricks-quarantine-conflict == 'true' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
+    strategy:
+      fail-fast: false
+      matrix:
+        job:
+          - name: Driver Tests Part 1
+            test-args: >-
+              :only-tags [:mb/driver-tests]
+              :exclude-tags [:mb/transforms-python-test]
+              :fail-fast? true
+              :partition/total 3
+              :partition/index 0
+          - name: Driver Tests Part 2
+            test-args: >-
+              :only-tags [:mb/driver-tests]
+              :exclude-tags [:mb/transforms-python-test]
+              :fail-fast? true
+              :partition/total 3
+              :partition/index 1
+          - name: Driver Tests Part 3
+            test-args: >-
+              :only-tags [:mb/driver-tests]
+              :exclude-tags [:mb/transforms-python-test]
+              :fail-fast? true
+              :partition/total 3
+              :partition/index 2
     env:
       CI: 'true'
       DRIVERS: databricks
@@ -481,9 +555,9 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-databricks-multi-catalog-ee'
-        test-args: >-
-          :only-tags [:mb/driver-tests]
-          :exclude-tags [:mb/transforms-python-test]
+        test-args: ${{ matrix.job.test-args }}
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.databricks-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -497,6 +571,7 @@ jobs:
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
         driver-status: ${{ needs.determine-driver-skips.outputs.databricks-status }}
         report-variant: ${{ matrix.job.name }}
+        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-h2:
     needs: determine-driver-skips
@@ -516,6 +591,8 @@ jobs:
         test-args: >-
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.h2-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -527,6 +604,8 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.h2-status }}
+        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-h2-oss:
     needs: determine-driver-skips
@@ -547,6 +626,8 @@ jobs:
         test-args: >-
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.h2-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -558,6 +639,8 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.h2-status }}
+        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-mysql-mariadb:
     needs: determine-driver-skips
@@ -620,7 +703,7 @@ jobs:
             github.event_name == 'push' &&
             (
               github.ref_name == 'master' ||
-              startsWith(github.ref_name, 'release-')
+              startsWith(github.ref_name, 'release-x')
             ) &&
             ''
           ) ||
@@ -677,6 +760,8 @@ jobs:
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[ ${{ matrix.job.exclude-tag }} ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
+          quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
+          driver-status: ${{ needs.determine-driver-skips.outputs.mysql-mariadb-status }}
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
         if: always()
@@ -688,6 +773,8 @@ jobs:
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+          driver-status: ${{ needs.determine-driver-skips.outputs.mysql-mariadb-status }}
+          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
       - name: Cleanup python-runner
         if: always()
         uses: ./.github/actions/cleanup-python-runner
@@ -757,6 +844,8 @@ jobs:
         junit-name: ${{ matrix.version.junit-name }}
         test-args: ${{ matrix.job.test-args }}
         logs-artifact-suffix: ${{ matrix.job.name }}
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.mongo-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -768,6 +857,8 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.mongo-status }}
+        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -839,6 +930,8 @@ jobs:
           test-args: >-
             :exclude-tags '[:mongo-sharded-cluster-tests :mb/transforms-python-test]'
             :only-tags [:mb/driver-tests]
+          quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
+          driver-status: ${{ needs.determine-driver-skips.outputs.mongo-ssl-status }}
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
         if: always()
@@ -850,6 +943,8 @@ jobs:
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+          driver-status: ${{ needs.determine-driver-skips.outputs.mongo-ssl-status }}
+          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-mongo-sharded-cluster-ee:
     needs: determine-driver-skips
@@ -884,6 +979,8 @@ jobs:
         junit-name: 'be-tests-mongo-sharded-cluster-ee'
         test-args: >-
           :only metabase.driver.mongo.sharded-cluster-test
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.mongo-sharded-cluster-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -895,6 +992,8 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.mongo-sharded-cluster-status }}
+        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-oracle:
     needs: determine-driver-skips
@@ -969,6 +1068,8 @@ jobs:
         test-args: >-
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.oracle-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -980,6 +1081,8 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.oracle-status }}
+        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-postgres:
     needs: determine-driver-skips
@@ -1022,7 +1125,7 @@ jobs:
             github.event_name == 'push' &&
             (
               github.ref_name == 'master' ||
-              startsWith(github.ref_name, 'release-')
+              startsWith(github.ref_name, 'release-x')
             ) &&
             ''
           ) ||
@@ -1073,6 +1176,8 @@ jobs:
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[ ${{ matrix.job.exclude-tag }} ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
+          quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
+          driver-status: ${{ needs.determine-driver-skips.outputs.postgres-status }}
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
         if: always()
@@ -1084,6 +1189,9 @@ jobs:
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+          driver-status: ${{ needs.determine-driver-skips.outputs.postgres-status }}
+          report-variant: ${{ matrix.version.name }}-${{ matrix.job.name }}
+          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
       - name: Cleanup python-runner
         if: always()
         uses: ./.github/actions/cleanup-python-runner
@@ -1160,6 +1268,8 @@ jobs:
         test-args: >-
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.presto-jdbc-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -1171,6 +1281,8 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.presto-jdbc-status }}
+        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-redshift-ee:
     needs: determine-driver-skips
@@ -1244,6 +1356,8 @@ jobs:
         test-args: >-
           ${{ matrix.job.test-args }}
         logs-artifact-suffix: ${{ matrix.job.name }}
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.redshift-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: ${{ !matrix.job.skip && !cancelled() }}
@@ -1257,6 +1371,7 @@ jobs:
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
         driver-status: ${{ needs.determine-driver-skips.outputs.redshift-status }}
         report-variant: ${{ matrix.job.name }}
+        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -1276,8 +1391,11 @@ jobs:
           - name: Driver Tests
             test-args: >-
               :only-tags [:mb/driver-tests]
-              :exclude-tags [:mb/transforms-python-test]
+              :exclude-tags '[:mb/upload-tests :mb/transforms-python-test]'
               :fail-fast? true
+          - name: Upload Tests
+            test-args: >-
+              :only-tags [:mb/upload-tests]
           - name: Transforms Python Tests
             test-args: >-
               :only-tags [:mb/transforms-python-test]
@@ -1326,6 +1444,8 @@ jobs:
         junit-name: 'be-tests-snowflake-ee'
         test-args: ${{ matrix.job.test-args }}
         logs-artifact-suffix: ${{ matrix.job.name }}
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.snowflake-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -1339,6 +1459,7 @@ jobs:
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
         driver-status: ${{ needs.determine-driver-skips.outputs.snowflake-status }}
         report-variant: ${{ matrix.job.name }}
+        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -1380,6 +1501,8 @@ jobs:
         test-args: >-
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.sparksql-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -1391,6 +1514,8 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.sparksql-status }}
+        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-sqlite-ee:
     needs: determine-driver-skips
@@ -1421,6 +1546,8 @@ jobs:
         test-args: >-
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.sqlite-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -1432,6 +1559,8 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.sqlite-status }}
+        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   be-tests-sqlserver:
     needs: determine-driver-skips
@@ -1497,6 +1626,8 @@ jobs:
         junit-name: ${{ matrix.version.junit-name }}
         test-args: ${{ matrix.job.test-args }}
         logs-artifact-suffix: ${{ matrix.version.name }}
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.sqlserver-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -1508,6 +1639,8 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.sqlserver-status }}
+        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -1622,6 +1755,8 @@ jobs:
         test-args: >-
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.vertica-status }}
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -1633,6 +1768,8 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
         previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+        driver-status: ${{ needs.determine-driver-skips.outputs.vertica-status }}
+        run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   drivers-tests-result:
     needs:
@@ -1686,11 +1823,13 @@ jobs:
               "be-tests-clickhouse-ee": "${{ needs.determine-driver-skips.outputs.clickhouse-status }}",
               "be-tests-databricks-ee": "${{ needs.determine-driver-skips.outputs.databricks-status }}",
               "be-tests-druid-jdbc-ee": "${{ needs.determine-driver-skips.outputs.druid-jdbc-status }}",
+              "be-tests-h2": "${{ needs.determine-driver-skips.outputs.h2-status }}",
               "be-tests-mongo": "${{ needs.determine-driver-skips.outputs.mongo-status }}",
               "be-tests-mongo-ssl": "${{ needs.determine-driver-skips.outputs.mongo-ssl-status }}",
               "be-tests-mongo-sharded-cluster-ee": "${{ needs.determine-driver-skips.outputs.mongo-sharded-cluster-status }}",
               "be-tests-mysql-mariadb": "${{ needs.determine-driver-skips.outputs.mysql-mariadb-status }}",
               "be-tests-oracle": "${{ needs.determine-driver-skips.outputs.oracle-status }}",
+              "be-tests-postgres": "${{ needs.determine-driver-skips.outputs.postgres-status }}",
               "be-tests-presto-jdbc-ee": "${{ needs.determine-driver-skips.outputs.presto-jdbc-status }}",
               "be-tests-redshift-ee": "${{ needs.determine-driver-skips.outputs.redshift-status }}",
               "be-tests-snowflake-ee": "${{ needs.determine-driver-skips.outputs.snowflake-status }}",

.github/workflows/e2e-coverage-manifest.yml

@@ -0,0 +1,145 @@
+name: E2E Coverage Manifest
+
+# Nightly: builds an instrumented frontend, runs the e2e suite sharded to
+# record which source files each spec exercises, and publishes a spec -> files
+# manifest used for selective e2e runs on PRs.
+#
+# Isolated from the PR e2e path on purpose - the per-shard worker
+# (e2e-coverage-shard.yml) is a dedicated, trimmed copy so coverage runs can
+# never affect PR test results.
+
+on:
+  schedule:
+    # Nightly, after the day's merges have settled (UTC).
+    - cron: "0 7 * * *"
+  workflow_dispatch:
+    inputs:
+      edition:
+        description: "Edition to instrument"
+        type: choice
+        options: ["ee", "oss"]
+        default: "ee"
+
+concurrency:
+  group: e2e-coverage-manifest-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build-instrumented:
+    name: Build instrumented uberjar
+    runs-on: ubuntu-22.04
+    timeout-minutes: 60
+    env:
+      MB_EDITION: ${{ inputs.edition || 'ee' }}
+      INSTRUMENT_COVERAGE: "true"
+    steps:
+      - uses: actions/checkout@v6
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+      # build.clj forwards INSTRUMENT_COVERAGE to the rspack build, so only the
+      # bundled FE is instrumented; everything else builds normally.
+      - name: Build instrumented uberjar
+        run: ./bin/build.sh
+      - name: Upload instrumented uberjar
+        uses: actions/upload-artifact@v7
+        with:
+          name: instrumented-uberjar
+          path: target/uberjar/metabase.jar
+          retention-days: 1
+
+  # Fixed-N sharding — coverage doesn't need the PR matrix-builder's tag/edition
+  # groups, just an even split of the regular spec set. The shard count lives in
+  # one place (SHARDS below); the matrix is generated from it.
+  setup:
+    name: Build shard matrix
+    runs-on: ubuntu-22.04
+    outputs:
+      matrix: ${{ steps.gen.outputs.matrix }}
+      count: ${{ steps.gen.outputs.count }}
+    steps:
+      - id: gen
+        env:
+          SHARDS: 100
+        run: |
+          matrix=$(node -e "console.log(JSON.stringify({split_index:[...Array(Number(process.env.SHARDS)).keys()]}))")
+          echo "matrix=$matrix" >> "$GITHUB_OUTPUT"
+          echo "count=$SHARDS" >> "$GITHUB_OUTPUT"
+
+  shards:
+    name: Shard
+    needs: [build-instrumented, setup]
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJson(needs.setup.outputs.matrix) }}
+    uses: ./.github/workflows/e2e-coverage-shard.yml
+    secrets: inherit
+    with:
+      edition: ${{ inputs.edition || 'ee' }}
+      total_chunks: ${{ fromJson(needs.setup.outputs.count) }}
+      split_index: ${{ matrix.split_index }}
+
+  merge:
+    name: Merge and publish manifest
+    needs: shards
+    if: always()
+    runs-on: ubuntu-22.04
+    timeout-minutes: 15
+    # github-script lists/downloads the previous manifest artifact.
+    permissions:
+      actions: read
+      contents: read
+    steps:
+      - uses: actions/checkout@v6
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+      # merge-multiple unions every shard's per-spec dir into one tree; the
+      # per-spec file design means no conflict resolution is needed.
+      - name: Download all shard coverage
+        uses: actions/download-artifact@v8
+        with:
+          pattern: coverage-shard-*
+          path: e2e/coverage-manifest-raw
+          merge-multiple: true
+      # Backfill source: the newest existing manifest is the previous nightly
+      # (this run hasn't uploaded yet). build-coverage-manifest.mjs carries over
+      # any still-existing spec that didn't run today.
+      - name: Download previous manifest for backfill
+        id: prev
+        uses: actions/github-script@v9
+        with:
+          script: | # js
+            const fs = require("fs");
+            const { owner, repo } = context.repo;
+            const { data } = await github.rest.actions.listArtifactsForRepo({
+              owner, repo, name: "spec-file-manifest", per_page: 20,
+            });
+            const art = (data.artifacts ?? [])
+              .filter((a) => !a.expired)
+              .sort((a, b) => new Date(b.created_at) - new Date(a.created_at))[0];
+            if (!art) {
+              console.log("No previous manifest; nothing to backfill.");
+              return;
+            }
+            const dl = await github.rest.actions.downloadArtifact({
+              owner, repo, artifact_id: art.id, archive_format: "zip",
+            });
+            fs.writeFileSync("prev-manifest.zip", Buffer.from(dl.data));
+            core.setOutput("found", "true");
+      - name: Unzip previous manifest
+        if: steps.prev.outputs.found == 'true'
+        run: unzip -o prev-manifest.zip -d prev-manifest
+      # GITHUB_SHA (the master commit this nightly built from) is stamped into
+      # the manifest as `builtAt`, so a PR can later pick the manifest closest
+      # to its own point in history. See resolve-coverage-manifest.mjs.
+      - name: Build coverage manifest
+        env:
+          PREV_MANIFEST: ${{ steps.prev.outputs.found == 'true' && 'prev-manifest/spec-file-manifest.json' || '' }}
+        run: node e2e/coverage/build-coverage-manifest.mjs
+      - name: Upload manifest
+        uses: actions/upload-artifact@v7
+        with:
+          name: spec-file-manifest
+          path: e2e/coverage/spec-file-manifest.json
+          retention-days: 30

.github/workflows/e2e-coverage-shard.yml

@@ -0,0 +1,112 @@
+name: E2E Coverage Shard
+
+# Reusable per-shard worker for the coverage manifest run. Trimmed extract of
+# e2e-test.yml: runs one cypress-split shard against an instrumented build and
+# uploads that shard's per-spec coverage. Intentionally omits the PR-only
+# concerns (failed-spec retry, Trunk quarantine, S3 result upload, timing
+# output) since this is a nightly, non-blocking job.
+
+on:
+  workflow_call:
+    inputs:
+      edition:
+        type: string
+        default: ee
+      total_chunks:
+        type: number
+        required: true
+      split_index:
+        type: number
+        required: true
+
+env:
+  DISPLAY: ""
+  TERM: xterm
+  TZ: US/Pacific
+  INSTRUMENT_COVERAGE: "true"
+
+jobs:
+  run:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 60
+    name: coverage-shard-${{ inputs.split_index }}
+    env:
+      MB_EDITION: ${{ inputs.edition }}
+      CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
+      CYPRESS_MB_STARTER_CLOUD_TOKEN: ${{ secrets.STAGING_MB_STARTER_CLOUD_TOKEN }}
+      CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.STAGING_MB_PRO_CLOUD_TOKEN }}
+      CYPRESS_MB_PRO_SELF_HOSTED_TOKEN: ${{ secrets.STAGING_MB_PRO_SELF_HOSTED_TOKEN }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          submodules: true
+          token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+
+      - name: Prepare Docker containers
+        uses: ./.github/actions/e2e-prepare-containers
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          maildev: true
+          openldap: true
+          webhook: true
+          snowplow: true
+          postgres: true
+          mysql: true
+          mongo: true
+
+      # The orchestrator built and uploaded this in an earlier job of the same run.
+      - name: Download instrumented uberjar
+        uses: actions/download-artifact@v8
+        with:
+          name: instrumented-uberjar
+          path: target/uberjar
+
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+      - name: Prepare Cypress environment
+        id: cypress-prep
+        uses: ./.github/actions/prepare-cypress
+
+      - name: Compile CLJS
+        run: bun run build-pure:cljs
+
+      - name: Run Metabase
+        run: node e2e/runner/run_cypress_ci.js start
+
+      - name: Generate database snapshots
+        env:
+          CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
+        run: node e2e/runner/run_cypress_ci.js snapshot
+
+      # cypress-split divides the spec set by timing data; INSTRUMENT_COVERAGE
+      # makes the support hook drain __coverage__ into e2e/coverage-manifest-raw/.
+      - name: Run shard ${{ inputs.split_index }}
+        # No SPLIT_FILE: cypress-split shards evenly by spec count using
+        # SPLIT/SPLIT_INDEX alone. Omitting it means no timings are read or
+        # written, which avoids cypress-split's after:run writeback (it would
+        # otherwise try to overwrite ./e2e/support/timings.json from a cwd where
+        # that subpath isn't reachable, crashing the run). Even-by-count is fine
+        # here — every spec runs exactly once across the shards.
+        env:
+          SPLIT: ${{ inputs.total_chunks }}
+          SPLIT_INDEX: ${{ inputs.split_index }}
+          SPLIT_SUMMARY: false
+          CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
+        run: |
+          node e2e/runner/run_cypress_ci.js e2e \
+            --expose grepTags="-@mongo+-@python+-@OSS+-@skip"
+        # Don't let a single failing/flaky spec abort the shard — we still want
+        # coverage from the specs that did run.
+        continue-on-error: true
+
+      - name: Upload shard coverage
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: coverage-shard-${{ inputs.split_index }}
+          path: e2e/coverage-manifest-raw/
+          retention-days: 7
+          if-no-files-found: warn

.github/workflows/e2e-matrix-builder.yml

@@ -46,7 +46,7 @@ jobs:
             const { buildMatrix } = require('${{ github.workspace }}/.github/scripts/build-e2e-matrix.js');
             const inputSpecs = "${{ inputs.specs }}";
             const inputChunks = Number(process.env.chunks);
-            const java = 21;
+            const java = 25;
             const defaultRunner = "${{ vars.DEFAULT_RUNNER_KEY }}";
             const options = {
               java,

.github/workflows/e2e-stress-test-flaky-pr.yml

@@ -16,7 +16,13 @@ concurrency:
 jobs:
   detect-changed-specs:
     name: Detect changed e2e specs
-    if: contains(github.event.pull_request.labels.*.name, 'flaky-test-fix')
+    # The PR must carry the `flaky-test-fix` label (covers opened/reopened/synchronize), AND
+    # when this is a `labeled` event we only proceed if the label *just added* is
+    # `flaky-test-fix` — otherwise adding any unrelated label to an already-labelled
+    # PR would needlessly re-burn the whole stress matrix.
+    if: >-
+      contains(github.event.pull_request.labels.*.name, 'flaky-test-fix') &&
+      (github.event.action != 'labeled' || github.event.label.name == 'flaky-test-fix')
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     outputs:

.github/workflows/e2e-test.yml

@@ -164,9 +164,7 @@ jobs:
           node e2e/runner/run_cypress_ci.js e2e \
             --expose grepTags="-@mongo+-@python+-@OSS+-@skip" \
             --spec "$SPEC_PATH"
-        # Trunk Quarantine controls the final state of the run in the CI!
-        # Even if this step fails we let it pass, and then `trunk-io/analytics-uploader` determines
-        # whether to fail or to pass the whole job, based on the quarantine list.
+        # Keep this step continue-on-error because the quarantine logic controls whether it ultimately fails.
         continue-on-error: true
 
       - name: Run Tagged EE Cypress tests on ${{ inputs.name }}
@@ -179,11 +177,9 @@ jobs:
         run: |
           echo "Running tests with specs: $SPEC_PATH"
           node e2e/runner/run_cypress_ci.js e2e \
-          --expose grepTags="${{inputs.tags && format('{0}+-@skip', inputs.tags) || '-@skip'}}" \
+          --expose grepTags="${{inputs.tags && format('{0}+-@skip', inputs.tags) || '-@mongo+-@python+-@OSS+-@skip'}}" \
           --spec "$SPEC_PATH"
-        # Trunk Quarantine controls the final state of the run in the CI!
-        # Even if this step fails we let it pass, and then `trunk-io/analytics-uploader` determines
-        # whether to fail or to pass the whole job, based on the quarantine list.
+        # Keep this step continue-on-error because the quarantine logic controls whether it ultimately fails.
         continue-on-error: true
 
       - name: Rewrite JUnit hook failures
@@ -213,21 +209,18 @@ jobs:
           variant: e2e-tests
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ inputs.specs && steps.tagged-e2e.outcome || steps.split-e2e.outcome }}
+          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
-      # Quarantine gate (DEV-2082). Compare this job's ultimate test failures
-      # (recorded by after:spec into ./target/quarantine-failures.jsonl) against
-      # ci-conductor's quarantine list and decide whether the job should pass:
-      # pass if every failure is quarantined, fail if any isn't. This mirrors
-      # what Trunk's analytics-uploader does for us today. Runs in dry-run mode
-      # for now (QUARANTINE_DRY_RUN defaults to true) — it only prints the
-      # verdict and never fails the job. `continue-on-error` is belt-and-braces
-      # while it's observational; drop both it and the dry run to enforce.
-      - name: Quarantine gate (dry run)
-        if: always()
-        continue-on-error: true
-        timeout-minutes: 2
-        shell: bash
-        run: bun e2e/support/check-quarantine.ts
+      - name: Quarantine gate
+        # Only one of the two run steps executes; the other reports `skipped`. Only gate on actual failure.
+        if: ${{ !cancelled() && (steps.split-e2e.outcome == 'failure' || steps.tagged-e2e.outcome == 'failure') }}
+        continue-on-error: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
+        timeout-minutes: 3
+        uses: ./.github/actions/quarantine-gate
+        with:
+          adapter: e2e
+          test-suite: e2e
+          enforce-quarantine: ${{ vars.QUARANTINE_ENGINE == 'ci-conductor' }}
 
       - name: Upload Cypress Artifacts upon failure
         uses: actions/upload-artifact@v7

.github/workflows/embedding-sdk-component-tests.yml

@@ -8,6 +8,12 @@ env:
   TERM: xterm
   TZ: US/Pacific # to make Node match the instance tz
   MB_EDITION: "ee"
+  CI_CONDUCTOR_BASE_URL: ${{ secrets.CI_CONDUCTOR_BASE_URL }}
+  CI_CONDUCTOR_WEBHOOK_SECRET: ${{ secrets.CI_CONDUCTOR_WEBHOOK_SECRET }}
+  REPO_ID: ${{ github.event.repository.id }}
+  COMMIT_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+  TARGET_BRANCH: ${{ github.event.pull_request.base.ref || github.ref_name }}
+  QUARANTINE_FAILURES_FILE: ${{ github.workspace }}/target/quarantine-failures.jsonl
 
 jobs:
   sdk-component-tests:
@@ -19,6 +25,7 @@ jobs:
         react-version: [18, 19]
       fail-fast: false
     env:
+      CI_CONDUCTOR_TEST_SUITE: embedding-sdk-component-react-${{ matrix.react-version }}
       # Sensitive env vars (tokens, secrets) starting with `CYPRESS_` are accessed via async `cy.env()`
       # Example: `cy.env(["FOO"]).then(({ FOO }) => ...)`
       # For non-sensitive config, use `Cypress.expose()` in cypress config instead (synchronous)
@@ -69,6 +76,8 @@ jobs:
       - name: Run Metabase
         run: node e2e/runner/run_cypress_ci.js start
 
+      - uses: ./.github/actions/resolve-job-id
+
       - name: Make app db snapshot
         env:
           CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
@@ -86,6 +95,8 @@ jobs:
         env:
           CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
         run: node e2e/runner/run_cypress_ci.js component
+        # Keep this step continue-on-error because the quarantine logic controls whether it ultimately fails.
+        continue-on-error: true
 
       - name: Rewrite JUnit hook failures
         if: always()
@@ -111,10 +122,21 @@ jobs:
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.run-tests.outcome }}
+          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
+
+      - name: Quarantine gate
+        if: ${{ !cancelled() && steps.run-tests.outcome == 'failure' }}
+        continue-on-error: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
+        timeout-minutes: 3
+        uses: ./.github/actions/quarantine-gate
+        with:
+          adapter: e2e
+          test-suite: ${{ env.CI_CONDUCTOR_TEST_SUITE }}
+          enforce-quarantine: ${{ vars.QUARANTINE_ENGINE == 'ci-conductor' }}
 
       - name: "SDK component tests > Upload Cypress Artifacts upon failure"
         uses: actions/upload-artifact@v7
-        if: failure()
+        if: ${{ !cancelled() && steps.run-tests.outcome == 'failure' }}
         with:
           name: cypress-recording-embedding-sdk-react-${{ matrix.react-version }}
           path: |
@@ -123,7 +145,7 @@ jobs:
           if-no-files-found: ignore
 
       - name: "SDK component tests > Publish Summary"
-        if: failure()
+        if: ${{ !cancelled() && steps.run-tests.outcome == 'failure' }}
         uses: actions/github-script@v9
         with:
           script: | #js
@@ -168,6 +190,7 @@ jobs:
     env:
       MB_RUN_MODE: "e2e"
       METASTORE_DEV_SERVER_URL: ${{ secrets.METASTORE_DEV_SERVER_URL }}
+      CI_CONDUCTOR_TEST_SUITE: embedding-sdk-component-backward-compatibility
       # Sensitive env vars (tokens, secrets) starting with `CYPRESS_` are accessed via async `cy.env()`
       # Example: `cy.env(["FOO"]).then(({ FOO }) => ...)`
       # For non-sensitive config, use `Cypress.expose()` in cypress config instead (synchronous)
@@ -237,6 +260,8 @@ jobs:
       - name: Run Metabase
         run: node e2e/runner/run_cypress_ci.js start
 
+      - uses: ./.github/actions/resolve-job-id
+
       - name: Make app db snapshot
         env:
           CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
@@ -252,6 +277,8 @@ jobs:
         run: |
           node e2e/runner/run_cypress_ci.js component \
             --expose grepTags="-@skip-backward-compatibility"
+        # Keep this step continue-on-error because the quarantine logic controls whether it ultimately fails.
+        continue-on-error: true
 
       - name: Rewrite JUnit hook failures
         if: always()
@@ -277,10 +304,21 @@ jobs:
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.run-tests.outcome }}
+          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
+
+      - name: Quarantine gate
+        if: ${{ !cancelled() && steps.run-tests.outcome == 'failure' }}
+        continue-on-error: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
+        timeout-minutes: 3
+        uses: ./.github/actions/quarantine-gate
+        with:
+          adapter: e2e
+          test-suite: ${{ env.CI_CONDUCTOR_TEST_SUITE }}
+          enforce-quarantine: ${{ vars.QUARANTINE_ENGINE == 'ci-conductor' }}
 
       - name: Upload Cypress Artifacts upon failure
         uses: actions/upload-artifact@v7
-        if: failure()
+        if: ${{ !cancelled() && steps.run-tests.outcome == 'failure' }}
         with:
           name: cypress-recording-embedding-sdk-cross-version
           path: |
@@ -289,7 +327,7 @@ jobs:
           if-no-files-found: ignore
 
       - name: Publish Summary
-        if: failure()
+        if: ${{ !cancelled() && steps.run-tests.outcome == 'failure' }}
         uses: actions/github-script@v9
         with:
           script: | #js

.github/workflows/embedding-sdk-host-sample-apps-tests.yml

@@ -171,6 +171,8 @@ jobs:
       - name: Log free disk space
         run: df -h /
 
+      - uses: ./.github/actions/resolve-job-id
+
       - name: Run e2e tests for Sample App
         id: run-e2e-tests
         if: ${{ steps.check-sample-app-branch.outputs.sample_app_branch_exists == 'true' }}
@@ -238,6 +240,8 @@ jobs:
           shoppy-datadog-application-id: ${{ secrets.SHOPPY_METABASE_APP_DATADOG_APPLICATION_ID }}
           shoppy-datadog-client-token: ${{ secrets.SHOPPY_METABASE_APP_DATADOG_CLIENT_TOKEN }}
 
+      - uses: ./.github/actions/resolve-job-id
+
       - name: Run e2e tests for Shoppy
         id: run-e2e-tests
         if: ${{ steps.shoppy-prep.outputs.sample_app_branch_exists == 'true' }}
@@ -316,6 +320,8 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+      - uses: ./.github/actions/resolve-job-id
+
       - name: Run synthetic monitoring tests
         id: run-e2e-tests
         if: ${{ steps.shoppy-prep.outputs.sample_app_branch_exists == 'true' }}
@@ -363,6 +369,19 @@ jobs:
     timeout-minutes: 45
     name: e2e-host-app-${{ matrix.test_suite }}-tests-${{ matrix.environment }}-bundle
     env:
+      # Host apps are the only suite here running through Metabase's Cypress config,
+      # whose `after:spec` hook reports failures and writes QUARANTINE_FAILURES_FILE.
+      # Sample-app suites load their own config (no-op), so ci-conductor is scoped to this job.
+      CI_CONDUCTOR_BASE_URL: ${{ secrets.CI_CONDUCTOR_BASE_URL }}
+      CI_CONDUCTOR_WEBHOOK_SECRET: ${{ secrets.CI_CONDUCTOR_WEBHOOK_SECRET }}
+      CI_CONDUCTOR_TEST_SUITE: embedding-sdk-host-app
+      REPO_ID: ${{ github.event.repository.id }}
+      COMMIT_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+      TARGET_BRANCH: ${{ github.event.pull_request.base.ref || github.ref_name }}
+      QUARANTINE_FAILURES_FILE: ${{ github.workspace }}/target/quarantine-failures.jsonl
+      # `Fail job if tests failed` is the arbiter until ci-conductor takes over.
+      # Exactly one of the two gates the job.
+      CI_CONDUCTOR_QUARANTINE_ACTIVE: ${{ vars.QUARANTINE_ENGINE == 'ci-conductor' }}
       CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
       HOST_APP_ENVIRONMENT: ${{ matrix.environment }}
     permissions:
@@ -399,6 +418,8 @@ jobs:
       - name: Run Metabase
         run: node e2e/runner/run_cypress_ci.js start
 
+      - uses: ./.github/actions/resolve-job-id
+
       - name: Generate database snapshots
         run: |
           node e2e/runner/run_cypress_ci.js snapshot \
@@ -416,14 +437,24 @@ jobs:
 
       - name: Upload Cypress Artifacts upon failure
         uses: actions/upload-artifact@v7
-        if: ${{ steps.run-e2e-tests.outcome != 'success' }}
+        if: ${{ !cancelled() && steps.run-e2e-tests.outcome == 'failure' }}
         with:
           name: cypress-recording-host-app-${{ matrix.test_suite }}-${{ matrix.environment }}-latest
           path: |
             ./cypress
           if-no-files-found: ignore
 
+      - name: Quarantine gate
+        if: ${{ !cancelled() && steps.run-e2e-tests.outcome == 'failure' }}
+        continue-on-error: ${{ env.CI_CONDUCTOR_QUARANTINE_ACTIVE != 'true' }}
+        timeout-minutes: 3
+        uses: ./.github/actions/quarantine-gate
+        with:
+          adapter: e2e
+          test-suite: ${{ env.CI_CONDUCTOR_TEST_SUITE }}
+          enforce-quarantine: ${{ env.CI_CONDUCTOR_QUARANTINE_ACTIVE }}
+
       - name: Fail job if tests failed
-        if: ${{ steps.run-e2e-tests.outcome != 'success' }}
+        if: ${{ !cancelled() && steps.run-e2e-tests.outcome == 'failure' && env.CI_CONDUCTOR_QUARANTINE_ACTIVE != 'true' }}
         run: |
           exit 1

.github/workflows/embedding-sdk.yml

@@ -150,7 +150,7 @@ jobs:
         with:
           remove-previous-comment: true
           add-new-comment: true
-          message: "⚠️ Embedding SDK bundle size increased by ${{ steps.compare.outputs.size_change_percent }}% compared to the ${{ github.base_ref }} branch (threshold: ${{ env.BUNDLE_SIZE_THRESHOLD_PERCENT }}%). Please contact Embedding team."
+          message: "⚠️ Embedding SDK chunked bundle size (gzipped) increased by ${{ steps.compare.outputs.size_change_percent }}% compared to the ${{ github.base_ref }} branch (threshold: ${{ env.BUNDLE_SIZE_THRESHOLD_PERCENT }}%). Please contact Embedding team."
           include-log: false
 
       - name: Send notification to Slack via Zapier
@@ -165,7 +165,7 @@ jobs:
           PR_URL: ${{ github.event.pull_request.html_url }}
         run: |
           curl -s -X POST "$ZAPIER_WEBHOOK_URL" \
-            -d "⚠️ Embedding SDK bundle size increased by ${SIZE_CHANGE_PERCENT}% (threshold: ${BUNDLE_SIZE_THRESHOLD_PERCENT}%)
+            -d "⚠️ Embedding SDK chunked bundle size (gzipped) increased by ${SIZE_CHANGE_PERCENT}% (threshold: ${BUNDLE_SIZE_THRESHOLD_PERCENT}%)
 
           PR #${PR_NUMBER} ${PR_TITLE} (${PR_URL})"
 
@@ -175,7 +175,7 @@ jobs:
         with:
           remove-previous-comment: true
           add-new-comment: true
-          message: "🎉 Embedding SDK bundle size decreased by ${{ steps.compare.outputs.size_change_percent }}% compared to the ${{ github.base_ref }} branch. Nice work!"
+          message: "🎉 Embedding SDK chunked bundle size (gzipped) decreased by ${{ steps.compare.outputs.size_change_percent }}% compared to the ${{ github.base_ref }} branch. Nice work!"
           include-log: false
 
   embedding-sdk-tests-result:

.github/workflows/frontend.yml

@@ -31,6 +31,13 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}-frontend
   cancel-in-progress: true
 
+env:
+  # Consumed by the report-failures-to-ci-conductor step in fe-tests-unit. Absent
+  # (e.g. fork PRs without secret access) the reporter no-ops. Matches the other
+  # suite workflows (backend, drivers, e2e, app-db, semantic-search).
+  CI_CONDUCTOR_BASE_URL: ${{ secrets.CI_CONDUCTOR_BASE_URL }}
+  CI_CONDUCTOR_WEBHOOK_SECRET: ${{ secrets.CI_CONDUCTOR_WEBHOOK_SECRET }}
+
 jobs:
   fe-lint:
     if: ${{ !inputs.skip-lint }}
@@ -96,13 +103,32 @@ jobs:
         uses: ./.github/actions/prepare-frontend
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
+      - name: Resolve current job id
+        # Resolve JOB_ID before the long test step so the ci-conductor reporter
+        # below can link failures to this exact job. Best-effort.
+        uses: ./.github/actions/resolve-job-id
       - name: Run frontend unit tests
         id: fe-tests
         run: bun run test-unit --silent --shard=${{ matrix.shard }}/${{ env.SHARDS }}
-        # Trunk Quarantine controls the final state of the run in the CI!
-        # Even if this step fails we let it pass, and then `trunk-io/analytics-uploader` determines
-        # whether to fail or to pass the whole job, based on the quarantine list.
+        # Keep this step continue-on-error because the quarantine logic controls whether it ultimately fails.
         continue-on-error: true
+      - name: Report failed tests to ci-conductor
+        if: ${{ !cancelled() && steps.fe-tests.outcome == 'failure' }}
+        # This step should NEVER fail the job!
+        continue-on-error: true
+        uses: ./.github/actions/report-failures-to-ci-conductor
+        with:
+          test-suite: fe-tests-unit
+          adapter: frontend
+      - name: Quarantine gate
+        if: ${{ !cancelled() && steps.fe-tests.outcome == 'failure' }}
+        continue-on-error: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
+        timeout-minutes: 3
+        uses: ./.github/actions/quarantine-gate
+        with:
+          adapter: frontend
+          test-suite: fe-tests-unit
+          enforce-quarantine: ${{ vars.QUARANTINE_ENGINE == 'ci-conductor' }}
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
         if: always() && github.event_name != 'workflow_dispatch'
@@ -114,6 +140,7 @@ jobs:
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.fe-tests.outcome }}
+          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   fe-tests-timezones:
     if: ${{ !inputs.skip }}

.github/workflows/module-boundaries-stats.yml

@@ -13,6 +13,8 @@ jobs:
     steps:
       - uses: actions/checkout@v6
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version-file: 'package.json'
       - name: Install dependencies
         run: bun install --frozen-lockfile
       - name: get module boundary stats

.github/workflows/pre-release.yml

@@ -122,7 +122,7 @@ jobs:
     strategy:
       matrix:
         edition: [oss, ee]
-        java-version: [21]
+        java-version: [25]
     steps:
       - name: Prepare JRE (Java Run-time Environment)
         uses: actions/setup-java@v5.2.0

.github/workflows/release-milestone-check.yml

@@ -33,7 +33,7 @@ jobs:
       - name: Install bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
-          bun-version: "1.3.14"
+          bun-version-file: 'package.json'
           token: ${{ secrets.GITHUB_TOKEN }}
       - name: Prepare build scripts
         run: bun install --cwd release --frozen-lockfile && bun run --cwd release build

.github/workflows/release-tests.yml

@@ -39,7 +39,7 @@ jobs:
       - name: Install bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
-          bun-version: "1.3.14"
+          bun-version-file: 'package.json'
           token: ${{ secrets.GITHUB_TOKEN }}
       - name: prepare dependencies in release directory
         run: bun install --cwd release --frozen-lockfile
@@ -58,13 +58,34 @@ jobs:
       - name: Install bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
-          bun-version: "1.3.14"
+          bun-version-file: 'package.json'
           token: ${{ secrets.GITHUB_TOKEN }}
       - name: prepare dependencies in release directory
         run: bun install --cwd release --frozen-lockfile
       - name: Run release unit tests
         run: bun run --cwd release test:unit
 
+  ci-conductor-tests:
+    needs: files-changed
+    if: needs.files-changed.outputs.release_source == 'true'
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          sparse-checkout: "release/ci-conductor"
+      - name: Install bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version-file: 'package.json'
+          token: ${{ secrets.GITHUB_TOKEN }}
+      - name: Install ci-conductor dependencies
+        run: bun install --cwd release/ci-conductor --frozen-lockfile
+      - name: Type-check ci-conductor
+        run: bun run --cwd release/ci-conductor type-check
+      - name: Run ci-conductor unit tests
+        run: bun run --cwd release/ci-conductor test
+
   release-test-build:
     needs: files-changed
     if: needs.files-changed.outputs.release_source == 'true'
@@ -77,7 +98,7 @@ jobs:
       - name: Install bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
-          bun-version: "1.3.14"
+          bun-version-file: 'package.json'
           token: ${{ secrets.GITHUB_TOKEN }}
       - name: prepare dependencies in release directory
         run: bun install --cwd release --frozen-lockfile

.github/workflows/run-tests.yml

@@ -44,7 +44,6 @@ jobs:
       e2e_specs_to_run: ${{ steps.compute.outputs.e2e_specs_to_run }}
     steps:
       - uses: actions/checkout@v6
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
       - name: Test which files changed
         uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
         id: changes
@@ -55,23 +54,21 @@ jobs:
           filters: .github/file-paths.yaml
       - name: Create test plan
         id: compute
-        if: ${{ github.event_name == 'pull_request' }}
-        env:
-          CHANGED_FILES: ${{ steps.changes.outputs.all_changed_files }}
-          UNIT_INFRA_TOUCHED: ${{ steps.changes.outputs.frontend_unit_infra }}
-          LOKI_INFRA_TOUCHED: ${{ steps.changes.outputs.frontend_loki_infra }}
-        run: |
-          OUTPUT=$(bun .github/scripts/create-test-plan.ts)
-          echo "$OUTPUT" | jq '.stats'
-          echo "stats=$(echo "$OUTPUT" | jq -c '.stats')" >> $GITHUB_OUTPUT
-          echo "fe_unit_specs_to_run=$(echo "$OUTPUT" | jq -c '.fe_unit_specs_to_run')" >> $GITHUB_OUTPUT
-          echo "loki_stories_to_run=$(echo "$OUTPUT" | jq -c '.loki_stories_to_run')" >> $GITHUB_OUTPUT
-          echo "e2e_specs_to_run=$(echo "$OUTPUT" | jq -c '.e2e_specs_to_run')" >> $GITHUB_OUTPUT
+        if: ${{ github.event_name == 'pull_request' || (github.event_name == 'push' && github.ref == 'refs/heads/master') }}
+        uses: ./.github/actions/create-test-plan
+        with:
+          changed-files: ${{ steps.changes.outputs.all_changed_files }}
+          fe-changed-files: ${{ steps.changes.outputs.frontend_sources_files }}
+          be-changed-files: ${{ steps.changes.outputs.backend_sources_files }}
+          unit-infra-touched: ${{ steps.changes.outputs.frontend_unit_infra }}
+          loki-infra-touched: ${{ steps.changes.outputs.frontend_loki_infra }}
+          e2e-infra-touched: ${{ steps.changes.outputs.e2e_infra }}
+          shared-sources-touched: ${{ steps.changes.outputs.shared_sources }}
 
   upload-affected-tests-stats:
     needs: create-test-plan
     # Only land rows for the upstream repo so forks don't pollute the table.
-    if: ${{ !cancelled() && needs.create-test-plan.result == 'success' && github.event.pull_request.head.repo.full_name == 'metabase/metabase' }}
+    if: ${{ !cancelled() && needs.create-test-plan.result == 'success' && (github.event.pull_request.head.repo.full_name == 'metabase/metabase' || (github.event_name == 'push' && github.repository == 'metabase/metabase')) }}
     # Stats upload is best-effort — a failure here shouldn't fail the PR run.
     continue-on-error: true
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
@@ -79,11 +76,14 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Upload affected tests stats
+        # On push (merge to master) there is no PR context, so fall back to the
+        # commit SHAs and a 0 PR number.
         env:
           STATS_JSON: ${{ needs.create-test-plan.outputs.stats }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          TRIGGERED_BY: ${{ github.event_name == 'pull_request' && 'pr_update' || 'merge_to_master' }}
+          PR_NUMBER: ${{ github.event_name == 'pull_request' && github.event.pull_request.number || 0 }}
+          HEAD_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
+          BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }}
           API_KEY: ${{ secrets.STATS_API_KEY }}
         run: node .github/scripts/upload-affected-tests-stats.js
 
@@ -154,8 +154,11 @@ jobs:
       # here we pass the list of changed files
       # e.g. e2e/test/scenarios/onboarding/command-palette.cy.spec.js,e2e/test/scenarios/question/document-title.cy.spec.js
       # e2e_all_files includes all changes which trigger all e2e tests, if the list of changes files is included in the
-      # list of changed specs files, then only specs are changed and we can run only those specs
-      specs: ${{ needs.create-test-plan.outputs.e2e_all_files == needs.create-test-plan.outputs.e2e_specs_files && needs.create-test-plan.outputs.e2e_specs_files || '' }}
+      # list of changed specs files, then only specs are changed and we can run only those specs.
+      # Only narrow to changed specs on pull requests. On push to master/release branches (and the
+      # merge queue) the paths-filter still computes these file lists, so without this guard a push
+      # that touched only specs would silently run a narrowed suite — we always want the full suite there.
+      specs: ${{ github.event_name == 'pull_request' && needs.create-test-plan.outputs.e2e_all_files == needs.create-test-plan.outputs.e2e_specs_files && needs.create-test-plan.outputs.e2e_specs_files || '' }}
 
   embedding-sdk-package:
     needs: [create-test-plan]
@@ -219,16 +222,16 @@ jobs:
       analytics_dev_mode: true
 
   pr-env-stats-dump:
-      needs: [uberjar]
-      if: |
-        !cancelled() &&
-        contains(github.event.pull_request.labels.*.name, 'PR-Env-Stats-Dump')
-      uses: ./.github/workflows/pr-env.yml
-      secrets: inherit
-      with:
-        self_hosting: false
-        analytics_dev_mode: false
-        stats_dump: true
+    needs: [uberjar]
+    if: |
+      !cancelled() &&
+      contains(github.event.pull_request.labels.*.name, 'PR-Env-Stats-Dump')
+    uses: ./.github/workflows/pr-env.yml
+    secrets: inherit
+    with:
+      self_hosting: false
+      analytics_dev_mode: false
+      stats_dump: true
 
   containerize:
     needs: [uberjar]

.github/workflows/semantic-search.yml

@@ -11,6 +11,13 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}-semantic-search
   cancel-in-progress: true
 
+# Exposed to every job so the test-driver action can report failures to
+# ci-conductor (secrets: inherit is already set on the semantic-search call in
+# run-tests.yml). See DEV-2224.
+env:
+  CI_CONDUCTOR_BASE_URL: ${{ secrets.CI_CONDUCTOR_BASE_URL }}
+  CI_CONDUCTOR_WEBHOOK_SECRET: ${{ secrets.CI_CONDUCTOR_WEBHOOK_SECRET }}
+
 jobs:
   semantic-search-tests-h2:
     if: ${{ !inputs.skip }}
@@ -27,7 +34,7 @@ jobs:
           - name: Semantic Search Tests
             build-static-viz: false
             test-args: >-
-              :only '["enterprise/backend/test/metabase_enterprise/semantic_search" "enterprise/backend/test/metabase_enterprise/curated_search" "enterprise/backend/test/metabase_enterprise/metabot_v3/tools/semantic_search_test.clj"]'
+              :only '["enterprise/backend/test/metabase_enterprise/semantic_search" "enterprise/backend/test/metabase_enterprise/entity_retrieval" "enterprise/backend/test/metabase_enterprise/metabot/tools/semantic_search_test.clj"]'
             exclude-tag: ':mb/driver-tests'
 
     services:
@@ -54,6 +61,7 @@ jobs:
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[${{ matrix.job.exclude-tag }}]'
+          quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
         if: always()
@@ -65,6 +73,7 @@ jobs:
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   semantic-search-tests-mariadb:
     if: ${{ !inputs.skip }}
@@ -86,7 +95,7 @@ jobs:
           - name: Semantic Search Tests
             build-static-viz: false
             test-args: >-
-              :only '["enterprise/backend/test/metabase_enterprise/semantic_search" "enterprise/backend/test/metabase_enterprise/curated_search" "enterprise/backend/test/metabase_enterprise/metabot_v3/tools/semantic_search_test.clj"]'
+              :only '["enterprise/backend/test/metabase_enterprise/semantic_search" "enterprise/backend/test/metabase_enterprise/entity_retrieval" "enterprise/backend/test/metabase_enterprise/metabot/tools/semantic_search_test.clj"]'
             exclude-tag: ':mb/driver-tests'
 
     services:
@@ -127,6 +136,7 @@ jobs:
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[${{ matrix.job.exclude-tag }}]'
+          quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
         if: always()
@@ -138,6 +148,7 @@ jobs:
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   semantic-search-tests-mysql:
     if: ${{ !inputs.skip }}
@@ -159,7 +170,7 @@ jobs:
           - name: Semantic Search Tests
             build-static-viz: false
             test-args: >-
-              :only '["enterprise/backend/test/metabase_enterprise/semantic_search" "enterprise/backend/test/metabase_enterprise/curated_search" "enterprise/backend/test/metabase_enterprise/metabot_v3/tools/semantic_search_test.clj"]'
+              :only '["enterprise/backend/test/metabase_enterprise/semantic_search" "enterprise/backend/test/metabase_enterprise/entity_retrieval" "enterprise/backend/test/metabase_enterprise/metabot/tools/semantic_search_test.clj"]'
             exclude-tag: ':mb/driver-tests'
 
     services:
@@ -200,6 +211,7 @@ jobs:
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[${{ matrix.job.exclude-tag }}]'
+          quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
         if: always()
@@ -211,6 +223,7 @@ jobs:
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   semantic-search-tests-postgres:
     if: ${{ !inputs.skip }}
@@ -232,7 +245,7 @@ jobs:
           - name: Semantic Search Tests
             build-static-viz: false
             test-args: >-
-              :only '["enterprise/backend/test/metabase_enterprise/semantic_search" "enterprise/backend/test/metabase_enterprise/curated_search" "enterprise/backend/test/metabase_enterprise/metabot_v3/tools/semantic_search_test.clj"]'
+              :only '["enterprise/backend/test/metabase_enterprise/semantic_search" "enterprise/backend/test/metabase_enterprise/entity_retrieval" "enterprise/backend/test/metabase_enterprise/metabot/tools/semantic_search_test.clj"]'
             exclude-tag: ':mb/driver-tests'
 
     services:
@@ -274,6 +287,7 @@ jobs:
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[${{ matrix.job.exclude-tag }}]'
+          quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
         if: always()
@@ -285,6 +299,73 @@ jobs:
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
           previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
+
+  # pgvector-on-the-app-db mode: the app db itself is a pgvector-capable Postgres and
+  # MB_PGVECTOR_DB_URL is deliberately unset. The dedicated-harness tests gate themselves off; the
+  # appdb-pgvector-mode round trip (and the URL-independent unit tests) run for real.
+  semantic-search-tests-appdb-mode:
+    if: ${{ !inputs.skip }}
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 40
+    strategy:
+      fail-fast: false
+      matrix:
+        version:
+          - name: pgvector pg17 as app db, no dedicated pgvector
+            junit-name: semantic-search-tests-appdb-mode-pg17
+            appdb-image: pgvector/pgvector:pg17
+        job:
+          - name: Semantic Search Tests
+            build-static-viz: false
+            test-args: >-
+              :only '["enterprise/backend/test/metabase_enterprise/semantic_search" "enterprise/backend/test/metabase_enterprise/entity_retrieval" "enterprise/backend/test/metabase_enterprise/metabot/tools/semantic_search_test.clj"]'
+            exclude-tag: ':mb/driver-tests'
+
+    services:
+      postgres:
+        image: ${{ matrix.version.appdb-image }}
+        ports:
+          - "5432:5432"
+        env:
+          POSTGRES_USER: mb_test
+          POSTGRES_DB: mb_test
+          POSTGRES_HOST_AUTH_METHOD: trust
+    env:
+      CI: 'true'
+      MB_DB_TYPE: postgres
+      MB_DB_PORT: 5432
+      MB_DB_HOST: localhost
+      MB_DB_DBNAME: mb_test
+      MB_DB_USER: mb_test
+      # opts this job into the destructive appdb-pgvector-mode round trip, which then FAILS (rather
+      # than silently skipping) if the app db can't actually host pgvector
+      MB_APPDB_PGVECTOR_MODE_TEST: 'true'
+    name: "${{ matrix.version.name }} ${{ matrix.job.name }}"
+    steps:
+      - uses: actions/checkout@v6
+      - name: Test ${{ matrix.version.name }}
+        id: test-driver
+        uses: ./.github/actions/test-driver
+        with:
+          build-static-viz: ${{ matrix.job.build-static-viz }}
+          junit-name: ${{ matrix.version.junit-name }}
+          test-args: >-
+            ${{ matrix.job.test-args }}
+            :exclude-tags '[${{ matrix.job.exclude-tag }}]'
+          quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
+      - name: Upload Test Results
+        uses: ./.github/actions/upload-test-results
+        if: always()
+        with:
+          input-path: ./target/junit/
+          output-name: ${{ github.job }}
+          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
+          aws-region: ${{ vars.AWS_REGION }}
+          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+          run-trunk: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
 
   semantic-search-tests-result:
     needs:
@@ -292,6 +373,7 @@ jobs:
       - semantic-search-tests-mariadb
       - semantic-search-tests-mysql
       - semantic-search-tests-postgres
+      - semantic-search-tests-appdb-mode
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
     name: semantic-search-tests-result

.github/workflows/snowplow.yml

@@ -32,7 +32,7 @@ jobs:
         uses: actions/setup-java@v5.2.0
         with:
           distribution: temurin
-          java-version: 21
+          java-version: 25
       - name: Set up Babashka
         uses: turtlequeue/setup-babashka@d78ec6570aea3b614bc695cafcceb82eb45c2af9 # v1.8.0
         with:

.github/workflows/snyk.yml

@@ -53,7 +53,7 @@ jobs:
       - uses: actions/checkout@v6
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
-          bun-version: "1.3.14"
+          bun-version-file: 'package.json'
           token: ${{ secrets.GITHUB_TOKEN }}
         # Snyk doesn't support bun.lock yet, so we generate yarn.lock and scan that.
         # Bun has a bug where it normalizes "< 3.0.0" to "< 3" in alias entries

.github/workflows/tag-for-release.yml

@@ -201,7 +201,7 @@ jobs:
       uses: actions/setup-java@v5.2.0
       with:
         distribution: 'temurin'
-        java-version: 21
+        java-version: 25
 
     - name: Retrieve test build uberjar artifact for ${{ matrix.edition }}
       uses: ./.github/actions/fetch-artifact

.github/workflows/team-issues-slack-notification.yml

@@ -1,3 +1,15 @@
+# .github/workflows/team-issues-slack-notification.yml
+#
+# Posts newly team-labeled bugs to the team's Slack channel (e.g.
+# #team-graphy-bugs), now including a link to the synced Linear issue.
+#
+# Changes from the current version:
+# - Checks out .github/scripts so we can reuse find-linear-issue.js
+# - The message-building step now queries Linear (via attachmentsForURL)
+#   with a short retry, and appends "Linear: <link|ID>" when found
+# - Degrades gracefully: if no Linear issue is attached (or the API is
+#   down), the message posts without the Linear issue link
+
 name: Team Issues Slack Notification
 
 on:
@@ -14,18 +26,58 @@ jobs:
        ( contains(github.event.issue.labels.*.name, 'Type:Bug') ||
          contains(github.event.issue.labels.*.name, 'flaky-test-fix') )
     steps:
-      - name: Setting title
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: .github/scripts
+
+      - name: Build Slack message (with Linear link if available)
         uses: actions/github-script@v9
         id: vars
+        env:
+          LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}
         with:
           script: |
-            core.setOutput('issue_title', JSON.stringify(${{ toJson(github.event.issue.title) }} + '\n' + ${{ toJson(github.event.issue.html_url) }}));
+            const { findLinearIssue } = require('./.github/scripts/find-linear-issue.js');
+
+            const title = context.payload.issue.title;
+            const issueUrl = context.payload.issue.html_url;
+
+            let text = title + '\n' + issueUrl;
+
+            // The Linear issue is usually already synced by the time the
+            // team label lands at triage, but retry briefly just in case.
+            try {
+              const delaysSeconds = [0, 15, 30];
+              let result = null;
+
+              for (const delay of delaysSeconds) {
+                if (delay) await new Promise((r) => setTimeout(r, delay * 1000));
+                result = await findLinearIssue({
+                  githubIssueUrl: issueUrl,
+                  linearApiKey: process.env.LINEAR_API_KEY,
+                });
+                if (result.success) break;
+              }
+
+              if (result && result.success) {
+                const id = result.issue; // e.g. "GIT-1234"
+                text += `\nLinear: <https://linear.app/metabase/issue/${id}|${id}>`;
+              } else {
+                core.info(`No Linear issue found for ${issueUrl}; posting without link.`);
+              }
+            } catch (e) {
+              // Never block the notification on a Linear lookup failure
+              core.warning(`Linear lookup failed: ${e.message}`);
+            }
+
+            core.setOutput('message', JSON.stringify(text));
+
       - name: Extracting team name
         id: team_name
         env:
           LABEL_NAME: ${{ github.event.label.name }}
         run: |
-          team_label=$(sed 's/&/\$/g' <<< "$LABEL_NAME")
+          team_label="${LABEL_NAME//&/$}"
           echo "$team_label"
           team_name=${team_label#*.Team/}
           echo "$team_name"
@@ -55,7 +107,7 @@ jobs:
                   "type": "section",
                   "text": {
                     "type": "mrkdwn",
-                    "text": ${{ steps.vars.outputs.issue_title }}
+                    "text": ${{ steps.vars.outputs.message }}
                   }
                 }
               ]

.github/workflows/uberjar.yml

@@ -128,8 +128,9 @@ jobs:
       MB_EDITION: ${{ matrix.edition }}
       INTERACTIVE: false
       SKIP_LICENSES: ${{ github.event_name == 'pull_request' }}  # faster builds for dev
-      # Emit bundle stats on trunk/release builds so they can be tracked over time
-      EMIT_BUNDLE_STATS: ${{ (github.ref_name == 'master' || startsWith(github.ref_name, 'release-')) && 'true' || 'false' }}
+      # Emit bundle stats on trunk/release builds (tracked over time) and on PRs
+      # (the bundle-size check reads them for both the PR head and its base ref).
+      EMIT_BUNDLE_STATS: ${{ (github.ref_name == 'master' || startsWith(github.ref_name, 'release-') || github.event_name == 'pull_request') && 'true' || 'false' }}
     steps:
       - name: Check out the code
         uses: actions/checkout@v6
@@ -142,7 +143,7 @@ jobs:
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
         with:
-          java-version: "${{ needs.get-build-requirements.outputs.java_version || 21 }}"
+          java-version: "${{ needs.get-build-requirements.outputs.java_version || 25 }}"
       - name: Build
         run: ./bin/build.sh
       - name: Upload bundle stats
@@ -173,7 +174,7 @@ jobs:
     strategy:
       matrix:
         edition: ["ee", "oss"]
-        java-version: [21]
+        java-version: [25]
     steps:
       - name: Check out the code
         uses: actions/checkout@v6

.gitignore

@@ -57,6 +57,16 @@ cypress.env.json
 /e2e/tmp/db_dumps/*
 !/e2e/tmp/db_dumps/.gitkeep
 /e2e/support/assets/example_custom_viz_plugin*.tgz
+# Coverage artifacts
+/e2e/coverage-manifest-raw
+/e2e/coverage-manifest
+/e2e/coverage/analysis
+/e2e/coverage/spec-file-manifest.json
+/e2e/support/.nyc_output
+/e2e/support/coverage
+/e2e/support/e2e
+/.nyc_output
+
 /lein-plugins/*/target
 /local
 /locales/metabase-*.pot
@@ -191,3 +201,7 @@ __pycache__/
 .claude/scheduled_tasks.lock
 .playwright-mcp
 .ci_reports/
+
+# dependency-cruiser output
+dependency-graph.json
+.playwright-cli/