Fix import path in row-count.ts to use absolute path

Co-authored-by: iethree <30528226+iethree@users.noreply.github.com>

.claude/commands/ci-report.md

@@ -0,0 +1,12 @@
+Generate a CI failure report for PR $PR_NUM_OR_URL (or current branch if no argument given).
+
+Run `./bin/mage ci-report $PR_NUM_OR_URL` to generate the report, then:
+
+1. **Summarize the failures** - What tests failed and in which jobs?
+2. **Categorize** - Are these real failures, flaky tests, or infrastructure issues?
+3. **Recommend next steps**:
+   - If flaky: suggest rerunning with `gh run rerun <run-id> --failed -R metabase/metabase`
+   - If real: identify the root cause and suggest fixes
+   - If infrastructure: note the issue type (timeout, OOM, network)
+
+Focus on actionable insights. If all checks are passing, confirm that briefly.

.claude/commands/mutation-testing.md

@@ -0,0 +1 @@
+Run mutation testing for $ARGUMENTS

.claude/skills/_shared/clojure-style-guide.md

@@ -29,7 +29,7 @@ This guide covers Clojure and ClojureScript coding conventions for Metabase. See
 
 **Comments:**
 
-- `TODO` format: `;; TODO (Name M/D/YY) -- description`
+- `TODO` format: `;; TODO (Name YYYY-MM-DD) -- description`
 
 ## Code Organization
 

.claude/skills/_shared/typescript-commands.md

@@ -1,21 +1,21 @@
 ## Linting and Formatting
 
-- **Lint:** `yarn lint-eslint-pure`
+- **Lint:** `bun run lint-eslint-pure`
   - Run ESLint on the codebase
-- **Format:** `yarn prettier`
+- **Format:** `bun run prettier`
   - Format code using Prettier
-- **Type Check:** `yarn type-check-pure`
+- **Type Check:** `bun run type-check-pure`
   - Run TypeScript type checking
 
 ## Testing
 
 ### JavaScript/TypeScript Tests
 
-- **Test a specific file:** `yarn test-unit-keep-cljs path/to/file.unit.spec.js`
-- **Test by pattern:** `yarn test-unit-keep-cljs -t "pattern"`
+- **Test a specific file:** `bun run test-unit-keep-cljs path/to/file.unit.spec.js`
+- **Test by pattern:** `bun run test-unit-keep-cljs -t "pattern"`
   - Runs tests matching the given pattern
 
 ### ClojureScript Tests
 
-- **Test ClojureScript:** `yarn test-cljs`
+- **Test ClojureScript:** `bun run test-cljs`
   - Run ClojureScript tests

.claude/skills/analytics-events/SKILL.md

@@ -0,0 +1,504 @@
+---
+name: analytics-events
+description: Add product analytics events to track user interactions in the Metabase frontend
+allowed-tools: Read, Write, Edit, Grep, Glob
+---
+
+# Frontend Analytics Events Skill
+
+This skill helps you add product analytics (Snowplow) events to track user interactions in the Metabase frontend codebase.
+
+## Quick Reference
+
+Analytics events in Metabase use Snowplow with typed event schemas. All events must be defined in TypeScript types before use.
+
+**Key Files:**
+- `frontend/src/metabase-types/analytics/event.ts` - Event type definitions
+- `frontend/src/metabase-types/analytics/schema.ts` - Schema registry
+- `frontend/src/metabase/lib/analytics.ts` - Core tracking functions
+- Feature-specific `analytics.ts` files - Tracking function wrappers
+
+## Quick Checklist
+
+When adding a new analytics event:
+
+- [ ] Define event type in `frontend/src/metabase-types/analytics/event.ts`
+- [ ] Add event to appropriate union type (e.g., `DataStudioEvent`, `SimpleEvent`)
+- [ ] Create tracking function in feature's `analytics.ts` file
+- [ ] Import and call tracking function at the interaction point
+- [ ] Use `trackSimpleEvent()` for basic events (most common)
+
+## Event Schema Types
+
+### 1. Simple Events (Most Common)
+
+Use `SimpleEventSchema` for straightforward tracking. It supports these standard fields:
+
+```typescript
+type SimpleEventSchema = {
+  event: string;                    // Required: Event name (snake_case)
+  target_id?: number | null;        // Optional: ID of affected entity
+  triggered_from?: string | null;   // Optional: UI location/context
+  duration_ms?: number | null;      // Optional: Duration in milliseconds
+  result?: string | null;           // Optional: Outcome (e.g., "success", "failure")
+  event_detail?: string | null;     // Optional: Additional detail/variant
+};
+```
+
+**When to use:** 90% of events fit this schema. Use for clicks, opens, closes, creates, deletes, etc.
+
+### 2. Custom Schemas (legacy, no events are being added)
+
+Consider adding new event schema only in very special cases.
+
+**Examples:** `DashboardEventSchema`, `CleanupEventSchema`, `QuestionEventSchema`
+
+## Step-by-Step: Adding a Simple Event
+
+### Example: Track when a user applies filters in a table picker
+
+#### Step 1: Define Event Types
+
+Add event type definitions to `frontend/src/metabase-types/analytics/event.ts`:
+
+```typescript
+export type DataStudioTablePickerFiltersAppliedEvent = ValidateEvent<{
+  event: "data_studio_table_picker_filters_applied";
+}>;
+
+export type DataStudioTablePickerFiltersClearedEvent = ValidateEvent<{
+  event: "data_studio_table_picker_filters_cleared";
+}>;
+```
+
+#### Step 2: Add to Union Type
+
+Find or create the appropriate union type and add your events:
+
+```typescript
+export type DataStudioEvent =
+  | DataStudioLibraryCreatedEvent
+  | DataStudioTablePublishedEvent
+  | DataStudioGlossaryCreatedEvent
+  | DataStudioGlossaryEditedEvent
+  | DataStudioGlossaryDeletedEvent
+  | DataStudioTablePickerFiltersAppliedEvent  // <- Add here
+  | DataStudioTablePickerFiltersClearedEvent; // <- Add here
+```
+
+#### Step 3: Create Tracking Functions
+
+In your feature's `analytics.ts` file (e.g., `enterprise/frontend/src/metabase-enterprise/data-studio/analytics.ts`):
+
+```typescript
+import { trackSimpleEvent } from "metabase/lib/analytics";
+
+export const trackDataStudioTablePickerFiltersApplied = () => {
+  trackSimpleEvent({
+    event: "data_studio_table_picker_filters_applied",
+  });
+};
+
+export const trackDataStudioTablePickerFiltersCleared = () => {
+  trackSimpleEvent({
+    event: "data_studio_table_picker_filters_cleared",
+  });
+};
+```
+
+#### Step 4: Use in Components
+
+Import and call the tracking function at the interaction point:
+
+```typescript
+import {
+  trackDataStudioTablePickerFiltersApplied,
+  trackDataStudioTablePickerFiltersCleared,
+} from "metabase-enterprise/data-studio/analytics";
+
+function FilterPopover({ filters, onSubmit }) {
+  const handleReset = () => {
+    trackDataStudioTablePickerFiltersCleared(); // <- Track here
+    onSubmit(emptyFilters);
+  };
+
+  return (
+    <form
+      onSubmit={(event) => {
+        event.preventDefault();
+        trackDataStudioTablePickerFiltersApplied(); // <- Track here
+        onSubmit(form);
+      }}
+    >
+      {/* form content */}
+    </form>
+  );
+}
+```
+
+## Using SimpleEventSchema Fields
+
+### Example: Event with target_id
+
+```typescript
+// Type definition
+export type DataStudioLibraryCreatedEvent = ValidateEvent<{
+  event: "data_studio_library_created";
+  target_id: number | null;
+}>;
+
+// Tracking function
+export const trackDataStudioLibraryCreated = (id: CollectionId) => {
+  trackSimpleEvent({
+    event: "data_studio_library_created",
+    target_id: Number(id),
+  });
+};
+
+// Usage
+trackDataStudioLibraryCreated(newLibrary.id);
+```
+
+### Example: Event with triggered_from
+
+```typescript
+// Type definition
+export type NewButtonClickedEvent = ValidateEvent<{
+  event: "new_button_clicked";
+  triggered_from: "app-bar" | "empty-collection";
+}>;
+
+// Tracking function
+export const trackNewButtonClicked = (location: "app-bar" | "empty-collection") => {
+  trackSimpleEvent({
+    event: "new_button_clicked",
+    triggered_from: location,
+  });
+};
+
+// Usage
+<Button onClick={() => {
+  trackNewButtonClicked("app-bar");
+  handleCreate();
+}}>
+  New
+</Button>
+```
+
+### Example: Event with event_detail
+
+```typescript
+// Type definition
+export type MetadataEditEvent = ValidateEvent<{
+  event: "metadata_edited";
+  event_detail: "type_casting" | "semantic_type_change" | "visibility_change";
+  triggered_from: "admin" | "data_studio";
+}>;
+
+// Tracking function
+export const trackMetadataChange = (
+  detail: "type_casting" | "semantic_type_change" | "visibility_change",
+  location: "admin" | "data_studio"
+) => {
+  trackSimpleEvent({
+    event: "metadata_edited",
+    event_detail: detail,
+    triggered_from: location,
+  });
+};
+
+// Usage
+trackMetadataChange("semantic_type_change", "data_studio");
+```
+
+### Example: Event with result and duration
+
+```typescript
+// Type definition
+export type MoveToTrashEvent = ValidateEvent<{
+  event: "moved-to-trash";
+  target_id: number | null;
+  triggered_from: "collection" | "detail_page" | "cleanup_modal";
+  duration_ms: number | null;
+  result: "success" | "failure";
+  event_detail: "question" | "model" | "metric" | "dashboard";
+}>;
+
+// Tracking function
+export const trackMoveToTrash = (params: {
+  targetId: number | null;
+  triggeredFrom: "collection" | "detail_page" | "cleanup_modal";
+  durationMs: number | null;
+  result: "success" | "failure";
+  itemType: "question" | "model" | "metric" | "dashboard";
+}) => {
+  trackSimpleEvent({
+    event: "moved-to-trash",
+    target_id: params.targetId,
+    triggered_from: params.triggeredFrom,
+    duration_ms: params.durationMs,
+    result: params.result,
+    event_detail: params.itemType,
+  });
+};
+
+// Usage with timing
+const startTime = Date.now();
+try {
+  await moveToTrash(item);
+  trackMoveToTrash({
+    targetId: item.id,
+    triggeredFrom: "collection",
+    durationMs: Date.now() - startTime,
+    result: "success",
+    itemType: "question",
+  });
+} catch (error) {
+  trackMoveToTrash({
+    targetId: item.id,
+    triggeredFrom: "collection",
+    durationMs: Date.now() - startTime,
+    result: "failure",
+    itemType: "question",
+  });
+}
+```
+
+## Naming Conventions
+
+### Event Names (snake_case)
+
+```typescript
+// Good
+"data_studio_library_created"
+"table_picker_filters_applied"
+"metabot_chat_opened"
+
+// Bad
+"DataStudioLibraryCreated"  // Wrong case
+"tablePickerFiltersApplied" // Wrong case
+"filters-applied"            // Use underscore, not hyphen
+```
+
+### Event Type Names (PascalCase with "Event" suffix)
+
+```typescript
+// Good
+DataStudioLibraryCreatedEvent
+TablePickerFiltersAppliedEvent
+MetabotChatOpenedEvent
+
+// Bad
+dataStudioLibraryCreated      // Wrong case
+DataStudioLibraryCreated      // Missing "Event" suffix
+```
+
+### Tracking Function Names (camelCase with "track" prefix)
+
+```typescript
+// Good
+trackDataStudioLibraryCreated
+trackTablePickerFiltersApplied
+trackMetabotChatOpened
+
+// Bad
+DataStudioLibraryCreated      // Missing "track" prefix
+track_library_created         // Wrong case
+logLibraryCreated             // Use "track" prefix
+```
+
+## Common Patterns
+
+### Pattern 1: Feature-Specific Union Types
+
+Group related events together:
+
+```typescript
+export type DataStudioEvent =
+  | DataStudioLibraryCreatedEvent
+  | DataStudioTablePublishedEvent
+  | DataStudioGlossaryCreatedEvent;
+
+export type MetabotEvent =
+  | MetabotChatOpenedEvent
+  | MetabotRequestSentEvent
+  | MetabotFixQueryClickedEvent;
+
+// Then add to SimpleEvent union
+export type SimpleEvent =
+  | /* other events */
+  | DataStudioEvent
+  | MetabotEvent
+  | /* more events */;
+```
+
+### Pattern 2: Conditional Tracking
+
+Track different events based on user action:
+
+```typescript
+const handleSave = async () => {
+  if (isNewItem) {
+    await createItem(data);
+    trackItemCreated(newItem.id);
+  } else {
+    await updateItem(id, data);
+    trackItemUpdated(id);
+  }
+};
+```
+
+## Common Pitfalls
+
+### Don't: Add custom fields to SimpleEvent
+
+```typescript
+// WRONG - SimpleEvent doesn't support custom fields
+export const trackFiltersApplied = (filters: FilterState) => {
+  trackSimpleEvent({
+    event: "filters_applied",
+    data_layer: filters.dataLayer,      // ❌ Not in SimpleEventSchema
+    data_source: filters.dataSource,    // ❌ Not in SimpleEventSchema
+    with_owner: filters.hasOwner,       // ❌ Not in SimpleEventSchema
+  });
+};
+
+// RIGHT - Use only standard SimpleEventSchema fields
+export const trackFiltersApplied = () => {
+  trackSimpleEvent({
+    event: "filters_applied",
+  });
+};
+
+// Or use event_detail for a single variant
+export const trackFilterApplied = (filterType: string) => {
+  trackSimpleEvent({
+    event: "filter_applied",
+    event_detail: filterType,  // ✓ "data_layer", "data_source", etc.
+  });
+};
+```
+
+### Don't: Forget to add event to union type
+
+```typescript
+// Define the event
+export type NewFeatureClickedEvent = ValidateEvent<{
+  event: "new_feature_clicked";
+}>;
+
+// ❌ WRONG - Forgot to add to SimpleEvent union
+// Event won't be recognized by TypeScript
+
+// ✓ RIGHT - Add to appropriate union
+export type SimpleEvent =
+  | /* other events */
+  | NewFeatureClickedEvent;
+```
+
+### Don't: Mix up event name formats
+
+```typescript
+// WRONG
+event: "dataStudioLibraryCreated"  // camelCase
+event: "data-studio-library-created"  // kebab-case
+event: "Data_Studio_Library_Created"  // Mixed case
+
+// RIGHT
+event: "data_studio_library_created"  // snake_case
+```
+
+### Don't: Track PII or sensitive data
+
+```typescript
+// WRONG - Don't track user emails, names, or sensitive data
+trackSimpleEvent({
+  event: "user_logged_in",
+  event_detail: user.email,  // ❌ PII
+});
+
+// RIGHT - Track non-sensitive identifiers only
+trackSimpleEvent({
+  event: "user_logged_in",
+  target_id: user.id,  // ✓ Just the ID
+});
+```
+
+### Don't: Forget to track both success and failure
+
+```typescript
+// WRONG - Only tracking success
+try {
+  await saveData();
+  trackDataSaved();
+} catch (error) {
+  // ❌ No tracking for failure case
+}
+
+// RIGHT - Track both outcomes
+try {
+  await saveData();
+  trackDataSaved({ result: "success" });
+} catch (error) {
+  trackDataSaved({ result: "failure" });
+}
+```
+
+## Testing Analytics Events
+
+While developing, you can verify events are firing:
+
+1. **Check browser console** - When `SNOWPLOW_ENABLED=true` in dev, events are logged
+2. **Use shouldLogAnalytics** - Set in `metabase/env` to see all analytics in console
+3. **Check Snowplow debugger** - Browser extension for Snowplow events
+
+Example console output:
+
+```
+[SNOWPLOW EVENT | event sent:true], data_studio_table_picker_filters_applied
+```
+
+## File Organization
+
+### Where to put tracking functions:
+
+```
+Feature-specific analytics functions:
+frontend/src/metabase/{feature}/analytics.ts
+enterprise/frontend/src/metabase-enterprise/{feature}/analytics.ts
+
+Event type definitions (all in one place):
+frontend/src/metabase-types/analytics/event.ts
+
+Core tracking utilities:
+frontend/src/metabase/lib/analytics.ts
+```
+
+## Real-World Examples
+
+See these files for reference:
+
+- **Simple events**: `enterprise/frontend/src/metabase-enterprise/data-studio/analytics.ts`
+- **Events with variants**: `frontend/src/metabase/dashboard/analytics.ts`
+- **Complex events**: `frontend/src/metabase/query_builder/analytics.js`
+- **Event type examples**: `frontend/src/metabase-types/analytics/event.ts`
+
+## Workflow Summary
+
+1. **Identify the user interaction** to track
+2. **Decide on event name** (snake_case, descriptive)
+3. **Define event type** in `event.ts` using `ValidateEvent`
+4. **Add to union type** (create feature union if needed)
+5. **Create tracking function** in feature's `analytics.ts`
+6. **Import and call** at the interaction point
+7. **Test** that events fire correctly
+
+## Tips
+
+- **Be specific** - `filters_applied` is better than `action_performed`
+- **Use past tense** - `library_created` not `create_library`
+- **Group related events** - Create feature-specific event union types
+- **Track meaningful actions** - Not every click needs tracking
+- **Consider the data** - What would you want to analyze later?
+- **Stay consistent** - Follow existing naming patterns in the codebase
+- **Document context** - Use `triggered_from` to track where the action happened

.claude/skills/clojure-review/SKILL.md

@@ -54,7 +54,7 @@ Use this to scan through changes efficiently:
 - [ ] Public vars in `src` or `enterprise/backend/src` have useful docstrings
 - [ ] Docstrings use Markdown conventions
 - [ ] References use `[[other-var]]` not backticks
-- [ ] `TODO` comments include author and date: `;; TODO (Name 1/1/25) -- description`
+- [ ] `TODO` comments include author and date: `;; TODO (Name 2025-01-01) -- description`
 
 ### Code Organization
 
@@ -118,7 +118,7 @@ Quick scan for common issues:
 | `update-db`, `save-model`                    | Missing `!` for side effects: `update-db!`, `save-model!`   |
 | `snake_case_var`                             | Should use kebab-case                                       |
 | Public var without docstring                 | Add docstring explaining purpose                            |
-| `;; TODO fix this`                           | Missing author/date: `;; TODO (Name 1/1/25) -- description` |
+| `;; TODO fix this`                           | Missing author/date: `;; TODO (Name 2025-01-01) -- description` |
 | `(defn foo ...)` in namespace used elsewhere | Should be `(defn ^:private foo ...)`                        |
 | Function > 20 lines                          | Consider breaking up into smaller functions                 |
 | `/api/dashboards/:id`                        | Use singular: `/api/dashboard/:id`                          |

.claude/skills/docs-write/SKILL.md

@@ -40,7 +40,7 @@ allowed-tools: Read, Write, Grep, Bash, Glob
 
 **Format:**
 
-- Run prettier on the file after making edits: `yarn prettier --write <file-path>`
+- Run prettier on the file after making edits: `bun run prettier --write <file-path>`
 - This ensures consistent formatting across all documentation
 
 ### Common patterns

.claude/skills/mutation-testing/SKILL.md

@@ -0,0 +1,231 @@
+---
+name: mutation-testing
+description: Run mutation testing on a Clojure namespace, generate tests to kill surviving mutations, and open draft PRs with Linear issue tracking.
+---
+
+# Mutation Testing Skill
+
+This skill runs mutation testing on a target namespace, writes tests to kill surviving mutations, and creates draft PRs with Linear issues for each function.
+
+## Prerequisites
+
+- A running nREPL connected to the Metabase dev environment
+- `LINEAR_API_KEY` environment variable set with a valid Linear personal API key
+- `gh` CLI authenticated with GitHub
+
+## Reference Files
+
+- `dev/src/dev/coverage.clj` — mutation testing tool (generates reports, runs mutations)
+- `dev/src/dev/mutation_testing.clj` — Linear API client and PR template helpers
+- `mutation-testing-report.lib.card.md` — example report from the pilot
+
+## Invocation
+
+The argument is a Clojure namespace, e.g.:
+
+```
+/mutation-testing metabase.lib.order-by
+```
+
+## Workflow
+
+### Step 1: Parse the namespace
+
+From the argument (e.g., `metabase.lib.order-by`), derive:
+- **Test namespace**: append `-test` (e.g., `metabase.lib.order-by-test`)
+- **Short name**: the last segment (e.g., `order-by`)
+- **Source path**: `src/metabase/lib/order_by.cljc` (replace `-` with `_` in path segments)
+- **Test path**: `test/metabase/lib/order_by_test.cljc`
+
+### Step 2: Set up Linear and load tools
+
+```clojure
+(require '[dev.coverage :as cov] :reload)
+(require '[dev.mutation-testing :as mut-test] :reload)
+```
+
+If this is the first invocation (or the REPL was restarted), set up the Linear team:
+
+```clojure
+;; Find the team
+(mut-test/list-teams!)
+;; Set team ID from the output
+(mut-test/set-config! {:team-id "<team-id>"})
+```
+
+If config is already set from a previous invocation, skip this.
+
+### Step 3: Generate baseline report and create Linear project
+
+```clojure
+(cov/generate-report
+  '<target-ns>
+  ['<test-ns>]
+  "mutation-testing-report.lib.<short-name>.before.md")
+```
+
+Read the generated report file. It has three sections:
+- **Uncovered Functions** — never called by any test
+- **Partially Covered Functions** — called but with surviving mutations
+- **Fully Covered Functions** — all mutations killed
+
+Then create a Linear project for this namespace (uses report stats in the description):
+
+```clojure
+(mut-test/create-project-for-namespace!
+  "<target-ns>"
+  "mutation-testing-report.lib.<short-name>.before.md")
+;; => {:project-id "...", :name "Mutation Testing: metabase.lib.order-by"}
+;; Automatically sets :project-id in config for subsequent create-issue! calls
+```
+
+### Step 4: Plan the work
+
+Before creating branches, analyze the report to plan how to group the work:
+
+1. **Identify killable functions.** For each function with surviving mutations, assess whether any mutations are killable. Run `cov/test-mutations` to see the full mutation list. If ALL mutations for a function are unkillable (schema-only, semantically equivalent, etc.), skip that function — no branch or PR needed.
+
+2. **Group private functions by public entry point.** Private functions cannot be tested directly. Group them with the public function that exercises them. Create one branch/PR per group, not per private function.
+
+3. **Track mutations per group.** The `:mutations-before` and `:not-killed` fields in the PR should only reflect mutations for functions covered by that specific PR — never mutations from other functions.
+
+### Step 5: Process each group
+
+For each group of functions that has killable mutations:
+
+#### 5a. Create a branch
+
+```clojure
+(mut-test/create-branch! "<target-ns>" "<primary-fn-name>")
+;; => "mutation-testing-lib-order-by-orderable-columns"
+```
+
+Use the primary public function name for the branch. If the group covers private functions too, name the branch after the public entry point.
+
+#### 5b. Read context
+
+- Read the source function(s) from the source file
+- Read the full test file to understand existing test patterns, helpers, and metadata providers used
+- If the function is private, identify which public function(s) call it
+
+#### 5c. Write tests
+
+Generate the **simplest tests** that kill the surviving mutations while still making semantic sense. Guidelines:
+
+- **Never call private functions directly.** Always test through public API functions. Use the coverage data to identify which public functions exercise the private function.
+- **Keep tests simple.** Each test should verify one meaningful behavior. Don't over-engineer tests just to chase mutation kills.
+- **Follow existing patterns.** Match the style of the existing tests: same metadata providers, same helper functions, same assertion patterns.
+- **Insert tests near related existing tests** for the same function, not at the end of the file. This minimizes merge conflicts between branches. If there are no existing tests for the function, find the most logical location based on the order of functions in the source file.
+
+**IMPORTANT: Use `file_edit` (not `clojure_edit`) when editing test files.** The `clojure_edit` tool reformats the entire file, introducing unnecessary whitespace changes that pollute the diff. Use `file_edit` with exact string matching to make surgical insertions that only touch the lines you intend to change.
+
+#### 5d. Verify mutations are killed
+
+Use the REPL to check that the new tests kill the targeted mutations:
+
+```clojure
+;; Reload the test namespace to pick up new tests
+(require '<test-ns> :reload)
+
+;; Test mutations for the specific function
+(cov/test-mutations
+  '<target-ns>/<fn-name>
+  ;; Set of test names that cover this function
+  #{'<test-ns>/<test-name-1> '<test-ns>/<test-name-2>})
+```
+
+Check the `:survived` key in the result. If mutations still survive:
+- Try writing additional tests
+- If a mutation is truly unkillable (semantically equivalent), note it for the PR description
+- If a mutation reveals dead/unreachable code, consider suggesting removal as a code improvement
+
+#### 5e. Handle unkillable mutations and improvements
+
+**Do NOT edit the source namespace just for documentation.** Instead:
+
+- **Unkillable mutations**: Note them in the PR description with rationale
+- **Code improvements** (dead code removal, expression simplification) that directly relate to surviving mutants:
+  1. Make the change in the source file
+  2. Verify all tests still pass with the change
+  3. Note the file path, line range, and the improved code
+  4. **Reset the change**: `git checkout -- <source-file>` — do NOT commit it
+  5. After creating the PR, use `add-suggested-change!` to post the improvement as a GitHub suggested change (Step 5h)
+  6. The reviewer decides whether to accept it
+
+#### 5f. Commit and push
+
+```clojure
+;; Only commit the test file — never commit source changes for improvements
+(mut-test/commit-and-push! "<target-ns>" "<primary-fn-name>"
+  ["test/metabase/lib/<short_name>_test.cljc"])
+```
+
+#### 5g. Create Linear issue and draft PR
+
+```clojure
+;; Create a Linear issue (use the primary function name)
+(def issue (mut-test/create-issue-for-function! "<target-ns>" "<primary-fn-name>"))
+;; => {:identifier "QUE-1234", :url "https://linear.app/...", ...}
+
+;; Create draft PR linked to the Linear issue
+;; :fn-names lists ALL functions covered by this PR
+;; :mutations-before counts only mutations for functions in this PR
+;; :not-killed lists only unkillable mutations for functions in this PR
+(def pr-url
+  (mut-test/create-draft-pr!
+    {:target-ns         "<target-ns>"
+     :fn-name           "<primary-fn-name>"
+     :linear-identifier (:identifier issue)
+     :mutations-before  9       ;; surviving mutations for these functions only
+     :tests-added       2       ;; number of new test functions
+     :killed            ["Replace :segment-id with :segment-id__"
+                         "Replace cycle-path with nil"]
+     :not-killed        [{:description "Replace acc with nil"
+                          :rationale   "reduce always has single iteration"}]
+     :suggested-changes []}))
+;; => "https://github.com/metabase/metabase/pull/12345"
+```
+
+#### 5h. Add code improvement suggestions (if any)
+
+If you identified code improvements in step 5e (and reset them), post each as a GitHub suggested change:
+
+```clojure
+(mut-test/add-suggested-change!
+  {:pr-url     pr-url
+   :path       "src/metabase/lib/<short_name>.cljc"
+   :start-line 42    ;; first line of the code to replace
+   :end-line   45    ;; last line of the code to replace
+   :suggestion "(improved-code-here)"  ;; the replacement code
+   :comment    "**Suggested improvement:** <description of the change and why it's related to the surviving mutant>"})
+```
+
+### Step 6: Return to master and repeat
+
+```clojure
+(mut-test/return-to-master!)
+```
+
+Repeat Step 5 for the next group.
+
+### Step 7: Summary
+
+Print a summary of what was done:
+- Link to the Linear project for this namespace
+- Number of functions processed
+- Number of functions skipped (all mutations unkillable)
+- Number of draft PRs created
+- Number of mutations killed vs. unkillable
+- List of test PRs with links
+- List of mutation rule PRs with links (if any were created)
+
+## Suggesting New Mutation Rules
+
+If you notice patterns in surviving mutations that suggest the mutation testing tool should have additional rules (e.g., a common Clojure form that isn't being mutated), open a separate PR proposing additions to `dev.coverage/mutation-rules` with an explanation.
+
+## Configuration
+
+The `dev.mutation-testing` namespace reads `LINEAR_API_KEY` from the environment and stores team/project IDs in an atom.
+
+- **Team ID**: Set once per REPL session via `(mut-test/list-teams!)` and `(mut-test/set-config! {:team-id "..."})` (Step 2)
+- **Project ID**: Set automatically when `create-project-for-namespace!` is called (Step 3) — one project per namespace

.clj-kondo/config.edn

@@ -1,7 +1,7 @@
 ;; -*- comment-column: 100; -*-
 {:config-paths ["macros" "src" "config"]
  :linters
- { ;;
+ {;;
   ;; enabled optional linters (these are disabled by default)
   ;;
 
@@ -50,13 +50,15 @@
   ;; disabled linters
   ;;
 
-  :redundant-ignore {:level :off}    ; lots of false positives, see https://github.com/clj-kondo/clj-kondo/issues/2414
+  :redundant-ignore {:level :off} ; lots of false positives, see https://github.com/clj-kondo/clj-kondo/issues/2414
   :unexpected-recur {:level :off} ; TODO (cam): I think we just need to tell it how to handle MBQL match and we can enable this?
 
   ;;
   ;; globally-enabled custom linters
   ;;
   :metabase/check-defmulti-arglists                          {:level :warning}
+  :metabase/check-def-check-not-uppercase-name               {:level :warning}
+  :metabase/check-def-no-underscores                         {:level :warning}
   :metabase/check-me-humanize                                {:level :warning}
   :metabase/defsetting-must-specify-export                   {:level :warning}
   :metabase/defsetting-namespace                             {:level :warning}
@@ -65,8 +67,8 @@
   :metabase/missing-test-expr-requires-in-cljs               {:level :warning}
   :metabase/modules                                          {:level :warning} ; more config in `.clj-kondo/config/modules/config.edn`
   :metabase/namespace-name                                   {:level :warning}
+  :metabase/no-jsqlparser-imports                            {:level :warning}
   :metabase/require-shape-checker                            {:level :warning}
-  :metabase/test-helpers-use-non-thread-safe-functions       {:level :warning} ; more config in `.clj-kondo/config/test-helpers/config.edn`
   :metabase/tests-must-live-in-known-modules                 {:level :warning}
   :metabase/validate-defendpoint-route-uses-kebab-case       {:level :warning}
   :metabase/validate-defendpoint-query-params-use-kebab-case {:level :warning}
@@ -178,6 +180,11 @@
      metabase.notification.models/create-notification!
      metabase.pulse.send/send-pulse!
      metabase-enterprise.transforms-python.python-runner-test/execute!
+     ;; Workspace isolation functions are safe in parallel tests because they operate on
+     ;; isolated, test-specific workspaces and databases that don't affect other tests
+     metabase-enterprise.workspaces.isolation/destroy-workspace-isolation!
+     metabase-enterprise.workspaces.isolation/ensure-database-isolation!
+     metabase-enterprise.workspaces.test-util/create-ready-ws!
      ;; Safe in tests, where we typically use a private, temporary index per thread.
      metabase.search.core/reindex!
      metabase.util/run-count!
@@ -191,7 +198,7 @@
   :metabase/disallow-hardcoded-driver-names-in-tests
   ;; don't include `:h2` since that will probably lead to a mountain of tests where we are specifically testing
   ;; middleware or compilation behavior with just H2 since it's the default.
-  {:drivers #{ ;; core drivers
+  {:drivers #{;; core drivers
               #_:h2
               :postgres
               :mysql
@@ -219,7 +226,8 @@
   ;; misc config for built-in linters
   ;;
 
-  :invalid-arity       {:skip-args [metabase.lib.util.match/match]}                    ; TODO (cam): can we fix these?
+  :invalid-arity       {:skip-args [metabase.lib.util.match/match
+                                    metabase.lib.util.match/match-lite]}                    ; TODO (cam): can we fix these?
   :refer-all           {:level :warning, :exclude [clojure.test]}
   :unused-referred-var {:exclude {compojure.core [GET DELETE POST PUT]}}
 
@@ -238,11 +246,11 @@
     (metabase.lib.util.match/match)
     (metabase.lib.util.match/match-one)
     (metabase.lib.util.match/match-lite)
-    (metabase.lib.util.match/match-lite-recursive)
     (metabase.lib.util.match/replace)
     (metabase.lib.util.match/replace-in)
     (metabase.driver-api.core/match)
     (metabase.driver-api.core/match-one)
+    (metabase.driver-api.core/match-lite)
     (metabase.driver-api.core/replace)
     (metabase.driver-api.core/replace-in)
     (metabase.query-processor.middleware.cache-backend.interface/with-cached-results)
@@ -299,7 +307,8 @@
    metabase-enterprise.transforms.interface/execute!  {:message "Use metabase-enterprise.transforms.execute/execute! instead of metabase-enterprise.transforms.interface/execute!"}
    next.jdbc/active-tx?                               {:message "Use metabase.app-db.core/in-transaction? to see if we are in a transaction"}
    toucan2.core/debug                                 {:message "Don't commit code using t2/debug"}
-   toucan2.tools.debug/debug                          {:message "Don't commit code using t2/debug"}}
+   toucan2.tools.debug/debug                          {:message "Don't commit code using t2/debug"}
+   }
 
   :discouraged-namespace
   {camel-snake-kebab.core {:message "CSK is not Turkish-safe, use the versions in metabase.util instead."}
@@ -418,11 +427,10 @@
   metabase-enterprise.content-translation.routes-test/with-new-secret-key!              clojure.core/fn
   metabase-enterprise.serialization.test-util/with-dbs                                  clojure.core/fn
   metabase-enterprise.serialization.test-util/with-random-dump-dir                      clojure.core/let
-  metabase-enterprise.transforms.api-test/with-transform-tags                           clojure.core/let
-  metabase-enterprise.transforms.api-test/with-worker-runs                              clojure.core/let
-  metabase-enterprise.transforms.test-util/with-transform-cleanup!                      clojure.core/let
-  metabase-enterprise.transforms.execute/with-transform-lifecycle                       clojure.core/let
+  metabase-enterprise.workspaces.test-util/with-resources!                              clojure.core/let
+  metabase-enterprise.workspaces.test-util/with-workspaces!                             clojure.core/let
   metabase.actions.test-util/with-actions                                               clojure.core/let
+  metabase.transforms.test-util/with-transform-cleanup!                                 clojure.core/let
   metabase.api.common/let-404                                                           clojure.core/let
   metabase.app-db.custom-migrations.util/with-temp-scheduler!                           clojure.core/fn
   metabase.app-db.custom-migrations/define-migration                                    clj-kondo.lint-as/def-catch-all
@@ -510,7 +518,16 @@
   {cljs.test/deftest                                                                                                         hooks.clojure.test/deftest
    cljs.test/is                                                                                                              hooks.clojure.test/is
    cljs.test/use-fixtures                                                                                                    hooks.clojure.test/use-fixtures
+   clojure.core/def                                                                                                          hooks.clojure.core.def/lint-def
+   clojure.core/definterface                                                                                                 hooks.clojure.core.def/lint-def
+   clojure.core/defmacro                                                                                                     hooks.clojure.core.defmacro/lint-defmacro
    clojure.core/defmulti                                                                                                     hooks.clojure.core.defmulti/lint-defmulti
+   clojure.core/defn                                                                                                         hooks.clojure.core.defn/lint-defn
+   clojure.core/defn-                                                                                                        hooks.clojure.core.defn/lint-defn
+   clojure.core/defonce                                                                                                      hooks.clojure.core.def/lint-def
+   clojure.core/defprotocol                                                                                                  hooks.clojure.core.def/lint-def
+   clojure.core/defrecord                                                                                                    hooks.clojure.core.def/lint-def
+   clojure.core/deftype                                                                                                      hooks.clojure.core.def/lint-def
    clojure.core/ns                                                                                                           hooks.clojure.core.ns/lint-ns
    clojure.core/require                                                                                                      hooks.clojure.core.require/lint-require
    clojure.core/requiring-resolve                                                                                            hooks.clojure.core.require/lint-requiring-resolve
@@ -522,8 +539,10 @@
    metabase-enterprise.advanced-permissions.models.permissions.application-permissions-test/with-new-group-and-current-graph hooks.common/with-two-top-level-bindings
    metabase-enterprise.audit-app.pages-test/with-temp-objects                                                                hooks.common/with-one-binding
    metabase-enterprise.cache.config-test/with-temp-persist-models                                                            hooks.common/with-seven-bindings
+   metabase-enterprise.dependencies.api-test/with-dependents-test!                                                           hooks.common/with-two-bindings
    metabase-enterprise.metabot-v3.tools.dependencies-test/with-dependent-transforms!                                         hooks.common/with-two-bindings
    metabase-enterprise.semantic-search.db.connection/with-migrate-tx                                                         hooks.common/let-one-with-optional-value
+   metabase-enterprise.serialization.api-test/with-serialization-test-data!                                                  hooks.common/with-three-bindings
    metabase-enterprise.serialization.test-util/with-temp-dpc                                                                 hooks.toucan2.tools.with-temp/with-temp
    metabase-enterprise.transforms-python.drivers-test/with-test-table                                                        hooks.common/with-two-bindings
    metabase.api.common.internal-test/with-jetty-server                                                                       hooks.common/with-one-binding
@@ -758,22 +777,17 @@
  :config-in-ns
  {test-namespaces
   {:linters
-   {:inline-def                              {:level :off}
-    :missing-docstring                       {:level :off}
-    :private-call                            {:level :off}
-    :metabase/defsetting-must-specify-export {:level :off}
-    :metabase/defsetting-namespace           {:level :off}
+   {:inline-def                                          {:level :off}
+    :missing-docstring                                   {:level :off}
+    :private-call                                        {:level :off}
+    :metabase/defsetting-must-specify-export             {:level :off}
+    :metabase/defsetting-namespace                       {:level :off}
+    :metabase/test-helpers-use-non-thread-safe-functions {:level :warning} ; more config in `.clj-kondo/config/test-helpers/config.edn
 
     :discouraged-var
     {metabase.driver/database-supports? {:level :off}
      metabase.lib.convert/->legacy-MBQL {:level :off}
-     metabase.lib.core/->legacy-MBQL    {:level :off}}}
-
-   :hooks
-   {:analyze-call
-    {clojure.core/defmacro hooks.clojure.core.defn/non-thread-safe-form-should-end-with-exclamation
-     clojure.core/defn     hooks.clojure.core.defn/non-thread-safe-form-should-end-with-exclamation
-     clojure.core/defn-    hooks.clojure.core.defn/non-thread-safe-form-should-end-with-exclamation}}}
+     metabase.lib.core/->legacy-MBQL    {:level :off}}}}
 
   source-namespaces
   {:linters

.clj-kondo/config/modules/config.edn

@@ -276,6 +276,7 @@
            events
            models
            premium-features
+           request
            settings
            util}}
 
@@ -383,7 +384,6 @@
    :uses #{api
            app-db
            collections
-           config
            eid-translation
            events
            lib-be
@@ -395,6 +395,7 @@
            request
            revisions
            settings
+           transforms
            upload
            util}}
 
@@ -409,7 +410,6 @@
            models
            request
            users
-           users-rest
            util}}
 
   ;; technically this 'uses' `enterprise/core` and `test` since it tries to load them to see if they exists so we know
@@ -501,6 +501,18 @@
            util
            xrays}}
 
+  data-studio
+  {:team "Gadget"
+   :api  #{metabase.data-studio.api}
+   :uses #{api
+           database-routing
+           driver
+           events
+           request
+           sync
+           util
+           warehouse-schema}}
+
   database-routing
   {:team "UX West"
    :api  #{metabase.database-routing.core}
@@ -530,7 +542,7 @@
            view-log}}
 
   driver
-  {:team "Drivers"
+  {:team "Querying"
    :api  #{metabase.driver
            metabase.driver.common
            metabase.driver.common.parameters
@@ -543,10 +555,16 @@
            metabase.driver.postgres
            metabase.driver.settings
            metabase.driver.sql
+           metabase.driver.sql-jdbc
            metabase.driver.sql-jdbc.connection
            metabase.driver.sql-jdbc.execute
            metabase.driver.sql-jdbc.execute.diagnostic
            metabase.driver.sql-jdbc.sync
+           ;; TODO (lbrdnk 2025/12/17): We should revisit addition of the following line. I've added it to make
+           ;; tests pass as we are using it directly with ee/workspaces module. I believe later, when workspaces
+           ;; are in better state quality wise, it should become part of the driver api and that should be used
+           ;; instead of calling directly into the normalize module.
+           metabase.driver.sql.normalize
            metabase.driver.sql.query-processor
            metabase.driver.sql.util
            metabase.driver.sync
@@ -564,13 +582,14 @@
            premium-features
            query-processor
            settings
+           sql-tools
            system
            util
            warehouse-schema
            warehouses}}
 
   driver-api
-  {:team "Drivers"
+  {:team "Querying"
    :api  #{metabase.driver-api.core}
    :uses #{actions
            api
@@ -614,7 +633,6 @@
            metabase.embedding.validation}
    :uses #{analytics
            api
-           config
            premium-features
            server
            settings
@@ -625,6 +643,7 @@
    :api  #{metabase.embedding-rest.api}
    :uses #{api
            dashboards
+           database-routing
            eid-translation
            embedding
            events
@@ -719,8 +738,6 @@
            metabase.lib.core
            metabase.lib.equality
            metabase.lib.field
-           metabase.lib.filter.desugar.jvm ; only so [[metabase.legacy-mbql.jvm-util]] can use defined regexes
-           metabase.lib.hierarchy
            metabase.lib.init
            metabase.lib.metadata
            metabase.lib.metadata.cached-provider
@@ -734,12 +751,9 @@
            metabase.lib.schema
            metabase.lib.schema.actions
            metabase.lib.schema.aggregation
-           metabase.lib.schema.binning
            metabase.lib.schema.common
-           metabase.lib.schema.constraints
            metabase.lib.schema.expression
            metabase.lib.schema.expression.temporal
-           metabase.lib.schema.expression.window
            metabase.lib.schema.id
            metabase.lib.schema.info
            metabase.lib.schema.join
@@ -748,12 +762,11 @@
            metabase.lib.schema.measure
            metabase.lib.schema.metadata
            metabase.lib.schema.metadata.fingerprint
-           metabase.lib.schema.middleware-options
            metabase.lib.schema.parameter
            metabase.lib.schema.ref
-           metabase.lib.schema.settings
            metabase.lib.schema.template-tag
            metabase.lib.schema.temporal-bucketing
+           metabase.lib.schema.test-spec
            metabase.lib.schema.util
            metabase.lib.schema.validate
            metabase.lib.temporal-bucket
@@ -766,7 +779,7 @@
            legacy-mbql
            types
            util}
-   :friends #{query-processor}}
+   :friends #{query-processor legacy-mbql}}
 
   lib-be
   {:team "Querying"
@@ -777,6 +790,24 @@
            settings
            util}}
 
+  llm
+  {:team "Metabot"
+   :api  #{metabase.llm.api
+           metabase.llm.init}
+   :uses #{analytics
+           api
+           driver
+           lib
+           lib-be
+           models
+           premium-features
+           request
+           settings
+           sql-tools
+           sync
+           util
+           warehouse-schema}}
+
   logger
   {:team "DevEx"
    :api  #{metabase.logger.api
@@ -810,6 +841,7 @@
            lib-be
            models
            permissions
+           remote-sync
            search
            util}}
 
@@ -847,10 +879,19 @@
    :uses #{api
            app-db
            classloader
+           collections
+           events
            legacy-mbql
            lib
+           lib-be
+           permissions
+           query-processor
+           remote-sync
+           search
            settings
-           util}}
+           transforms
+           util}
+   :friends #{transforms}}
 
   native-query-snippets
   {:team "Querying"
@@ -863,6 +904,7 @@
            models
            permissions
            premium-features
+           remote-sync
            util}}
 
   notification
@@ -880,6 +922,7 @@
            config
            dashboards
            driver
+           embedding
            events
            models
            parameters
@@ -904,6 +947,7 @@
            metabase.parameters.custom-values
            metabase.parameters.dashboard
            metabase.parameters.field
+           metabase.parameters.field-values
            metabase.parameters.init
            metabase.parameters.params
            metabase.parameters.schema
@@ -970,13 +1014,15 @@
    :api  #{metabase.premium-features.api
            metabase.premium-features.core
            metabase.premium-features.init}
-   :uses #{api
+   :uses #{analytics
+           api
            app-db
            classloader
            config
            events
            internal-stats
            settings
+           startup
            task
            util}}
 
@@ -1132,6 +1178,7 @@
            metabase.query-processor.init
            metabase.query-processor.interface
            metabase.query-processor.metadata
+           metabase.query-processor.middleware.add-remaps
            metabase.query-processor.middleware.annotate
            metabase.query-processor.middleware.cache-backend.db
            metabase.query-processor.middleware.constraints
@@ -1201,7 +1248,8 @@
    :api  #{metabase.request.core
            metabase.request.init
            metabase.request.schema}
-   :uses #{api
+   :uses #{analytics
+           api
            config
            embedding
            permissions ; FIXME
@@ -1265,11 +1313,11 @@
            settings
            startup
            task
-           util
-           warehouses}}
+           transforms
+           util}}
 
   secrets
-  {:team "Drivers"
+  {:team "Querying"
    :api  #{metabase.secrets.core}
    :uses #{api driver models premium-features util}}
 
@@ -1378,6 +1426,23 @@
            system
            util}}
 
+  sql-parsing
+  {:team "DevEx"
+   :api #{metabase.sql-parsing.core}
+   :uses #{analytics
+           util}}
+
+  sql-tools
+  {:team "DevEx"
+   :api #{metabase.sql-tools.core
+          metabase.sql-tools.init}
+   :uses #{analytics
+           driver
+           lib
+           settings
+           sql-parsing
+           util}}
+
   sso
   {:team "UX West"
    :api  #{metabase.sso.api
@@ -1457,6 +1522,7 @@
            models
            permissions
            premium-features
+           query-processor
            request
            task
            util}}
@@ -1476,6 +1542,8 @@
            api
            app-db
            config
+           lib
+           lib-be
            premium-features
            search
            util}}
@@ -1500,11 +1568,44 @@
    :uses #{analytics
            api
            collections
-           config
            events
            models
            util}}
 
+  transforms
+  {:team "Querying"
+   :api  #{metabase.transforms.api.transform
+           metabase.transforms.api.transform-job
+           metabase.transforms.api.transform-tag
+           metabase.transforms.core
+           metabase.transforms.feature-gating
+           metabase.transforms.init
+           metabase.transforms.schema
+           metabase.transforms.util}
+   :uses #{analytics
+           api
+           channel
+           database-routing
+           driver
+           events
+           lib
+           lib-be
+           models
+           premium-features
+           queries
+           query-processor
+           request
+           revisions
+           settings
+           sql-tools
+           sync
+           task
+           task-history
+           util}
+   :friends #{models
+              enterprise/transforms-python
+              enterprise/workspaces}}
+
   types
   {:team "Querying"
    :api  #{metabase.types.core
@@ -1515,6 +1616,7 @@
   {:team "Querying"
    :api  #{metabase.upload.api
            metabase.upload.core
+           metabase.upload.db
            metabase.upload.init}
    :uses #{analytics
            api
@@ -1542,41 +1644,42 @@
 
   users
   {:team "UX West"
-   :api  #{metabase.users.init
+   :api  #{metabase.users.core
+           metabase.users.init
            metabase.users.models.user
            metabase.users.models.user-parameter-value
            metabase.users.schema
            metabase.users.settings}
-   :uses #{api
-           batch-processing
-           channel
-           config
-           events
-           models
-           permissions
-           premium-features
-           settings
-           setup
-           system
-           tenants
-           util}}
-
-  users-rest
-  {:team "UX West"
-   :api  #{metabase.users-rest.api}
    :uses #{analytics
            api
-           appearance
-           auth-identity
-           collections
+           batch-processing
+           channel
            config
            events
            models
            notification
            permissions
            premium-features
-           request
            settings
+           setup
+           system
+           tenants
+           util
+           enterprise/advanced-permissions}}
+
+  users-rest
+  {:team "UX West"
+   :api  #{metabase.users-rest.api}
+   :uses #{api
+           appearance
+           auth-identity
+           collections
+           config
+           events
+           models
+           permissions
+           premium-features
+           request
            sso
            tenants
            users
@@ -1630,7 +1733,6 @@
            api
            app-db
            audit-app
-           config
            driver
            lib
            lib-be
@@ -1650,7 +1752,6 @@
    :uses #{analytics
            api
            app-db
-           config
            database-routing
            driver
            events
@@ -1778,6 +1879,7 @@
            metabase-enterprise.advanced-permissions.common
            metabase-enterprise.advanced-permissions.models.permissions.group-manager}
    :uses #{api
+           audit-app
            lib
            permissions
            premium-features
@@ -1788,6 +1890,17 @@
            warehouses
            enterprise/impersonation}}
 
+  enterprise/agent-api
+  {:team "Metabot"
+   :api  #{metabase-enterprise.agent-api.api}
+   :uses #{api
+           auth-identity
+           query-processor
+           request
+           server
+           util
+           enterprise/metabot-v3}}
+
   enterprise/ai-entity-analysis
   {:team "Metabot"
    :api  #{metabase-enterprise.ai-entity-analysis.api}
@@ -1857,7 +1970,7 @@
            setup
            startup
            sync
-           users-rest
+           users
            util
            enterprise/serialization}}
 
@@ -1899,6 +2012,14 @@
            util
            enterprise/harbormaster}}
 
+  enterprise/cloud-proxy
+  {:team "Cloud"
+   :api  #{metabase-enterprise.cloud-proxy.api}
+   :uses #{api
+           premium-features
+           util
+           enterprise/harbormaster}}
+
   enterprise/content-translation
   {:team "UX West"
    :api  #{metabase-enterprise.content-translation.routes}
@@ -1928,20 +2049,15 @@
    :uses #{premium-features}}
 
   enterprise/data-studio
-  {:team "Gadget"
+  {:team "UX West"
    :api  #{metabase-enterprise.data-studio.api}
    :uses #{api
            collections
-           database-routing
-           driver
            events
            models
            permissions
            premium-features
-           request
-           sync
-           util
-           warehouse-schema}}
+           util}}
 
   enterprise/database-replication
   {:team "Cloud"
@@ -1969,7 +2085,7 @@
            settings
            util
            warehouse-schema
-           warehouses-rest}}
+           warehouses}}
 
   enterprise/dependencies
   {:team "Querying"
@@ -1997,8 +2113,8 @@
            revisions
            settings
            task
-           util
-           enterprise/transforms}}
+           transforms
+           util}}
 
   enterprise/email
   {:team "UX West"
@@ -2040,7 +2156,7 @@
            util}}
 
   enterprise/impersonation
-  {:team "Drivers"
+  {:team "Querying"
    :api  #{metabase-enterprise.impersonation.api}
    :uses #{api
            audit-app
@@ -2080,44 +2196,46 @@
            util}}
 
   enterprise/metabot-v3
-  {:team "Metabot"
-   :api  #{metabase-enterprise.metabot-v3.api
-           metabase-enterprise.metabot-v3.client
-           metabase-enterprise.metabot-v3.core
-           metabase-enterprise.metabot-v3.init
-           metabase-enterprise.metabot-v3.tools.api}
-   :uses #{activity-feed
-           api
-           app-db
-           audit-app
-           collections
-           config
-           documents
-           driver
-           legacy-mbql
-           lib
-           lib-be
-           models
-           native-query-snippets
-           permissions
-           premium-features
-           pulse
-           query-processor
-           request
-           search
-           server
-           settings
-           store-api
-           sync
-           system
-           task
-           users-rest
-           util
-           warehouse-schema
-           warehouses-rest
-           enterprise/dependencies
-           enterprise/transforms
-           enterprise/transforms-python}}
+  {:team    "Metabot"
+   :api     #{metabase-enterprise.metabot-v3.api
+              metabase-enterprise.metabot-v3.client
+              metabase-enterprise.metabot-v3.core
+              metabase-enterprise.metabot-v3.init
+              metabase-enterprise.metabot-v3.tools.api}
+   :friends #{enterprise/agent-api}
+   :uses    #{activity-feed
+              api
+              app-db
+              audit-app
+              collections
+              config
+              documents
+              driver
+              legacy-mbql
+              lib
+              lib-be
+              models
+              native-query-snippets
+              parameters
+              permissions
+              premium-features
+              pulse
+              query-processor
+              request
+              search
+              server
+              settings
+              sql-tools
+              store-api
+              sync
+              system
+              task
+              transforms
+              users
+              util
+              warehouses
+              enterprise/dependencies
+              enterprise/transforms-python}}
 
   enterprise/permission-debug
   {:team "UX West"
@@ -2151,7 +2269,8 @@
            task
            task-history
            util
-           enterprise/serialization}}
+           enterprise/serialization
+           enterprise/transforms-python}}
 
   enterprise/sandbox
   {:team "UX West"
@@ -2248,6 +2367,7 @@
            native-query-snippets
            permissions
            premium-features
+           remote-sync
            util}}
 
   enterprise/sso
@@ -2275,7 +2395,6 @@
    :uses #{analytics
            api
            collections
-           collections-rest
            embedding
            premium-features
            queries
@@ -2313,50 +2432,29 @@
 
   enterprise/transforms
   {:team "Querying"
-   :api  #{metabase-enterprise.transforms.api
-           metabase-enterprise.transforms.core
-           metabase-enterprise.transforms.init
-           metabase-enterprise.transforms.instrumentation
-           metabase-enterprise.transforms.interface
-           metabase-enterprise.transforms.schema
-           metabase-enterprise.transforms.util}
-   :uses #{analytics
-           api
-           app-db
-           channel
-           collections
-           driver
-           events
-           lib
-           lib-be
-           models
-           premium-features
-           queries
-           query-processor
-           request
-           revisions
-           search
-           settings
-           sync
-           task
-           task-history
-           util}}
+   :api  #{}
+   :uses #{}}
 
   enterprise/transforms-python
   {:team "Querying"
    :api  #{metabase-enterprise.transforms-python.api
-           metabase-enterprise.transforms-python.init}
+           metabase-enterprise.transforms-python.core
+           metabase-enterprise.transforms-python.init
+           metabase-enterprise.transforms-python.python-runner}
    :uses #{analytics
            api
            app-db
            config
            driver
+           events
            lib
            lib-be
+           models
+           permissions
            query-processor
            settings
-           util
-           enterprise/transforms}}
+           transforms
+           util}}
 
   enterprise/upload-management
   {:team "UX West"
@@ -2365,7 +2463,32 @@
            models
            premium-features
            upload
-           util}}}
+           util}}
+
+  enterprise/workspaces
+  {:team "Metabot"
+   :api  #{metabase-enterprise.workspaces.api
+           metabase-enterprise.workspaces.init}
+   :uses #{api
+           api-keys
+           app-db
+           config
+           database-routing
+           driver
+           events
+           lib
+           lib-be
+           models
+           queries
+           ;; NOTE: we will remove this once we get "pure transforms" module.
+           query-processor
+           request
+           settings
+           sql-tools
+           system
+           transforms
+           util
+           enterprise/transforms-python}}}
 
  ;; namespaces matching these patterns (with `re-find`) are excluded from the module linter. Since regex literals
  ;; aren't allowed in EDN just used the `(str <regex>)` version i.e. two slashes instead of one.

.clj-kondo/macros/metabase/server/statistics_handler_test.clj

@@ -1,6 +0,0 @@
-(ns macros.metabase.server.statistics-handler-test)
-
-(defmacro with-server
-  [[_hold-chan _hit-chan] & body]
-  `(let []
-     ~@body))

.clj-kondo/src/hooks/clojure/core.clj

@@ -0,0 +1,38 @@
+(ns hooks.clojure.core
+  (:require
+   [clj-kondo.hooks-api :as hooks]
+   [clojure.string :as str]))
+
+(defn- all-uppercase? [symb]
+  (let [s (str symb)]
+    (= s #_{:clj-kondo/ignore [:discouraged-var]} (str/upper-case s))))
+
+(defn- has-underscores? [symb]
+  (str/includes? (str symb) "_"))
+
+(defn-  check-symbol-is-kebab-case [symbol-node]
+  (let [symb (hooks/sexpr symbol-node)]
+    (when (or (all-uppercase? symb)
+              (has-underscores? symb))
+      (hooks/reg-finding! (assoc (meta symbol-node)
+                                 :message "Use kebab-case for function and variable names; don't use special notation for constants."
+                                 :type    :metabase/check-def-kebab-case)))))
+
+(defn lint-def* [{:keys [node]}]
+  (let [[_def & args] (:children node)
+        name-symbol   (some (fn [arg]
+                              (when (and (hooks/token-node? arg)
+                                         (symbol? (hooks/sexpr arg)))
+                                arg))
+                            args)]
+    (check-symbol-is-kebab-case name-symbol)))
+
+(defn lint-def [x]
+  (lint-def* x)
+  x)
+
+(comment
+  (defn x []
+    (let [node (-> "(def ^:private TYPE->MODEL {\"document\" :model/Document})"
+                   hooks/parse-string)]
+      (lint-def {:node node}))))

.clj-kondo/src/hooks/clojure/core/def.clj

@@ -0,0 +1,52 @@
+(ns hooks.clojure.core.def
+  (:require
+   [clj-kondo.hooks-api :as hooks]
+   [clojure.string :as str]))
+
+(defn- uppercase-name?
+  "Whether the symbol is clearly an uppercase name like `TYPE-CONSTANTS` or `SOME_CONSTANT` or `TYPE->MODEL`."
+  [s]
+  (and (re-find #"[A-Z0-9]+(?:[-_]>?[A-Z0-9]+)+" s)
+       ;; ignore stuff like `->SCREAMING_SNAKE_CASE`... this is ok
+       (not (str/includes? s "SCREAMING_SNAKE_CASE"))))
+
+(defn- has-underscores? [s]
+  (and (str/includes? s "_")
+       ;; ignore stuff like `->snake_case` and `->SCREAMING_SNAKE_CASE`
+       (not (str/includes? s "snake_case"))
+       (not (str/includes? s "SCREAMING_SNAKE_CASE"))))
+
+(defn-  check-symbol-is-kebab-case [symbol-node]
+  (let [symb (hooks/sexpr symbol-node)
+        s    (str symb)]
+    (cond
+      (uppercase-name? s)
+      (hooks/reg-finding!
+       (assoc (meta symbol-node)
+              :message "Use lower-case names for functions and variables; don't use special notation for constants. [:metabase/check-def-check-not-all-uppercase]"
+              :type    :metabase/check-def-check-not-uppercase-name))
+
+      (has-underscores? s)
+      (hooks/reg-finding!
+       (assoc (meta symbol-node)
+              :message "Use kebab-case names for functions and variables. [:metabase/check-def-no-underscores]"
+              :type    :metabase/check-def-no-underscores)))))
+
+(defn lint-def* [{:keys [node]}]
+  (let [[_def & args] (:children node)
+        name-symbol   (some (fn [arg]
+                              (when (and (hooks/token-node? arg)
+                                         (symbol? (hooks/sexpr arg)))
+                                arg))
+                            args)]
+    (check-symbol-is-kebab-case name-symbol)))
+
+(defn lint-def [x]
+  (lint-def* x)
+  x)
+
+(comment
+  (defn x []
+    (let [node (-> "(def ^:private TYPE->MODEL {\"document\" :model/Document})"
+                   hooks/parse-string)]
+      (lint-def {:node node}))))

.clj-kondo/src/hooks/clojure/core/defmacro.clj

@@ -0,0 +1,7 @@
+(ns hooks.clojure.core.defmacro
+  (:require
+   [hooks.clojure.core.def]))
+
+(defn lint-defmacro [x]
+  (hooks.clojure.core.def/lint-def* x)
+  x)

.clj-kondo/src/hooks/clojure/core/defmulti.clj

@@ -2,6 +2,7 @@
   (:require
    [clj-kondo.hooks-api :as hooks]
    [clojure.string :as str]
+   [hooks.clojure.core.def]
    [hooks.common]))
 
 (defn- check-arglists [report-node arglists]
@@ -49,4 +50,5 @@
 
 (defn lint-defmulti [x]
   (defmulti-check-for-arglists-metadata (:node x))
+  (hooks.clojure.core.def/lint-def* x)
   x)

.clj-kondo/src/hooks/clojure/core/defn.clj

@@ -2,6 +2,7 @@
   (:require
    [clj-kondo.hooks-api :as hooks]
    [clojure.string :as str]
+   [hooks.clojure.core.def]
    [hooks.common]))
 
 (defn- end-with-exclamation?
@@ -50,6 +51,11 @@
     (non-thread-safe-form-should-end-with-exclamation* node config))
   {:node node})
 
+(defn lint-defn [x]
+  (non-thread-safe-form-should-end-with-exclamation x)
+  (hooks.clojure.core.def/lint-def* x)
+  x)
+
 (comment
   (require '[clj-kondo.core :as clj-kondo])
   (def form (str '(defmacro a

.clj-kondo/src/hooks/clojure/core/ns.clj

@@ -99,12 +99,48 @@
                                      :message "Metabase namespaces should have the form metabase[-enterprise].<module>.* [:metabase/namespace-name]"
                                      :type    :metabase/namespace-name)))))))
 
+(defn- ns-form-node->import-node [ns-form-node]
+  (some (fn [node]
+          (when (and (hooks/list-node? node)
+                     (let [first-child (first (:children node))]
+                       (and (hooks/keyword-node? first-child)
+                            (= (hooks/sexpr first-child) :import))))
+            node))
+        (:children ns-form-node)))
+
+(defn- jsqlparser-import?
+  "Check if a symbol or string represents a jsqlparser import."
+  [s]
+  (str/starts-with? (str s) "net.sf.jsqlparser"))
+
+(defn- lint-jsqlparser-imports [ns-form-node]
+  (when-let [import-node (ns-form-node->import-node ns-form-node)]
+    (doseq [node (rest (:children import-node))
+            :when (not (contains? (hooks.common/ignored-linters node) :metabase/no-jsqlparser-imports))]
+      (cond
+        ;; Handle (net.sf.jsqlparser.foo Bar Baz) form
+        (hooks/list-node? node)
+        (let [package-node (first (:children node))
+              package-name (when package-node (str (hooks/sexpr package-node)))]
+          (when (jsqlparser-import? package-name)
+            (hooks/reg-finding! (assoc (meta node)
+                                       :message "Don't import net.sf.jsqlparser classes directly. This code should be agnostic to the parsing library. [:metabase/no-jsqlparser-imports]"
+                                       :type    :metabase/no-jsqlparser-imports))))
+
+        ;; Handle net.sf.jsqlparser.foo.Bar form (single class import)
+        (hooks/token-node? node)
+        (when (jsqlparser-import? (hooks/sexpr node))
+          (hooks/reg-finding! (assoc (meta node)
+                                     :message "Don't import net.sf.jsqlparser classes directly. This code should be agnostic to the parsing library. [:metabase/no-jsqlparser-imports]"
+                                     :type    :metabase/no-jsqlparser-imports)))))))
+
 (defn lint-ns [x]
   (doto (:node x)
     lint-require-shapes
     lint-requires-on-new-lines
     (lint-modules (modules/config x))
-    lint-namespace-name)
+    lint-namespace-name
+    lint-jsqlparser-imports)
   x)
 
 (comment

.clj-kondo/src/hooks/common/modules.clj

@@ -75,6 +75,15 @@
         (contains? module-api-namespaces ns-symb)
         (contains? module-friends current-module))))
 
+(defn- rest-module? [module]
+  (str/ends-with? module "-rest"))
+
+(defn- routes-module? [module]
+  (str/ends-with? module "-routes"))
+
+(defn- core-module? [module]
+  (str/ends-with? module "core"))
+
 (defn usage-error
   "Find usage errors when a `required-namespace` is required in the `current-module`. Returns a string describing the
   error type if there is one, otherwise `nil` if there are no errors."
@@ -93,4 +102,15 @@
         (format "Namespace %s is not an allowed external API namespace for the %s module. [:metabase/modules %s :api]"
                 required-namespace
                 required-module
-                required-module)))))
+                required-module)
+
+        ;; (for now) rest modules are allowed to use one another; `routes` is ok because it collects routes together
+        ;; and `core` is ok because [[metabase.core.init]] might need to init some of the `-routes` modules'
+        ;; namespaces
+        (and (not ((some-fn rest-module? routes-module? core-module?) current-module))
+             (rest-module? required-module))
+        (format "Do not use -rest modules (%s) in non-rest modules (%s) -- move things from %s to %s if needed"
+                required-module
+                current-module
+                required-module
+                (symbol (str/replace required-module #"-rest$" "")))))))

.cljfmt.edn

@@ -90,6 +90,7 @@
   metabase-enterprise.test/with-gtaps!                                                        [[:inner 0]]
   metabase-enterprise.test/with-gtaps-for-user!                                               [[:inner 0]]
   metabase-enterprise.test/with-user-attributes                                               [[:block 2]]
+  metabase-enterprise.workspaces.models.workspace-log/track!                                  [[:block 2]]
   metabase.actions.actions-test/with-actions-test-data-and-actions-permissively-enabled       [[:block 0]]
   metabase.actions.test-util/with-actions                                                     [[:block 1]]
   metabase.actions.test-util/with-actions-disabled                                            [[:block 0]]
@@ -119,6 +120,7 @@
   metabase.dashboards.models.dashboard-test/with-dash-in-collection                           [[:inner 0]]
   metabase.driver-api.core/match                                                              [[:inner 0]]
   metabase.driver-api.core/match-one                                                          [[:inner 0]]
+  metabase.driver-api.core/match-lite                                                         [[:inner 0]]
   metabase.driver-api.core/replace                                                            [[:inner 0]]
   metabase.driver-api.core/replace-in                                                         [[:inner 0]]
   metabase.driver.bigquery-cloud-sdk.query-processor/with-temporal-type                       [[:default]]
@@ -133,6 +135,7 @@
   metabase.driver.sql-jdbc.execute.diagnostic/capturing-diagnostic-info                       [[:block 1]]
   metabase.driver.sql.query-processor/apply-top-level-clause                                  [[:default]]
   metabase.driver/with-driver                                                                 [[:block 1]]
+  metabase.driver/with-swapped-connection-details                                             [[:block 2]]
   metabase.embedding-rest.api.embed-test/do-response-formats                                  [[:block 1]]
   metabase.embedding-rest.api.embed-test/with-embedding-enabled-and-new-secret-key            [[:block 0]]
   metabase.embedding-rest.api.embed-test/with-embedding-enabled-and-temp-card-referencing     [[:block 3]]
@@ -154,7 +157,6 @@
   metabase.lib.util.match/match                                                               [[:inner 0]]
   metabase.lib.util.match/match-one                                                           [[:inner 0]]
   metabase.lib.util.match/match-lite                                                          [[:inner 0]]
-  metabase.lib.util.match/match-lite-recursive                                                [[:inner 0]]
   metabase.lib.util.match/replace                                                             [[:inner 0]]
   metabase.lib.util.match/replace-in                                                          [[:inner 0]]
   metabase.models.interface/define-batched-hydration-method                                   [[:inner 0]]

.devcontainer/Dockerfile

@@ -1,10 +1,11 @@
 FROM mcr.microsoft.com/vscode/devcontainers/java:21
 
-# Set up nodesource, install node, yarn, fontconfig for static viz, rlwrap for dev ergonomics
+# Set up nodesource, install node, bun, fontconfig for static viz, rlwrap for dev ergonomics
 
 RUN ( curl -fsSL https://deb.nodesource.com/setup_22.x | bash ) \
   && export DEBIAN_FRONTEND=noninteractive \
-  && apt-get update && apt-get -y install --no-install-recommends nodejs yarn rlwrap fontconfig
+  && apt-get update && apt-get -y install --no-install-recommends nodejs rlwrap fontconfig \
+  && npm install -g bun
 
 # install Clojure
 RUN curl https://download.clojure.org/install/linux-install-1.12.0.1488.sh | bash

.dir-locals.el

@@ -61,6 +61,7 @@
   (eval . (put-clojure-indent 'u/prog1                         1))
   (eval . (put-clojure-indent 'u/select-keys-when              '(:form)))
   (eval . (put-clojure-indent 'with-meta                       '(:form)))
+  (eval . (put-clojure-indent 'ws.log/track!                   2))
   ;; these ones have to be done with `define-clojure-indent' for now because of upstream bug
   ;; https://github.com/clojure-emacs/clojure-mode/issues/600 once that's resolved we should use `put-clojure-indent'
   ;; instead. Please don't add new entries unless they don't work with `put-clojure-indent'

.env.example

@@ -100,7 +100,7 @@ METASTORE_DEV_SERVER_URL="https://token-check.staging.metabase.com"
 #
 # The whole environment is already orchestrated via deps.edn using :e2e alias.
 # Treat it as a source of truth for JVM flags and ENVs whether you decide to run
-# backend on your own, or using `yarn test-cypress` (local test runner).
+# backend on your own, or using `bun run test-cypress` (local test runner).
 #
 # You don't _have to_ export any of these vars (except for the tokens below).
 # Things will still work.
@@ -118,6 +118,9 @@ MB_EDITION="ee"
 # MB_JETTY_HOST="localhost"
 # MB_JETTY_PORT=4000
 
+# Frontend dev server port (for hot reload). Must match the port used by `yarn build-hot`.
+# MB_FRONTEND_DEV_PORT=8080
+
 # 3.2 E2E Local Runner Setup
 # ------------------------------------------------------------------------------
 

.eslintignore

@@ -1,6 +0,0 @@
-frontend/src/cljs
-frontend/src/cljs_release
-e2e/support/cypress_sample_database.js
-e2e/support/cypress_sample_instance_data.js
-frontend/src/metabase-types/openapi/types.gen.ts
-e2e/embedding-sdk-host-apps

.eslintrc.js

@@ -1,356 +0,0 @@
-/* eslint-disable import/no-commonjs */
-/* eslint-disable no-undef */
-
-const path = require("path");
-
-// `postcss-modules` lints css modules class names, but it currently crashes
-// eslint on vscode. If you use webstorm or want to run the lint for the cli, you
-// can use this flag to enable it. This is set to true in CI
-const shouldLintCssModules =
-  process.env.LINT_CSS_MODULES === "true" || process.env.CI;
-const plugins = ["react", "no-only-tests", "ttag", "i18next"];
-if (shouldLintCssModules) {
-  plugins.push("postcss-modules");
-}
-
-module.exports = {
-  ignorePatterns: ["!.storybook"],
-  rules: {
-    strict: [2, "never"],
-    "no-undef": 2,
-    "no-var": 1,
-    "no-unused-vars": [
-      "error",
-      {
-        vars: "all",
-        args: "none",
-        varsIgnorePattern: "^_.+$",
-        ignoreRestSiblings: true,
-      },
-    ],
-    "no-empty": [1, { allowEmptyCatch: true }],
-    // Note: adding this rule to a eslint config file in a subfolder will remove
-    // *not* carry over the restricted imports from parent folders, you will
-    // need to copy them over
-    "no-restricted-imports": [
-      "error",
-      {
-        paths: [
-          {
-            name: "moment",
-            message: "Moment is deprecated, please use dayjs",
-          },
-          {
-            name: "moment-timezone",
-            message: "Moment is deprecated, please use dayjs",
-          },
-        ],
-      },
-    ],
-    curly: [1, "all"],
-    eqeqeq: [1, "smart"],
-    "import/no-duplicates": ["warn", { considerQueryString: true }],
-    "import/no-default-export": 2,
-    "import/no-named-as-default": 0,
-    "import/no-commonjs": 1,
-    "import/order": [
-      "error",
-      {
-        "newlines-between": "always",
-        alphabetize: {
-          order: "asc",
-          orderImportKind: "asc",
-          caseInsensitive: false,
-        },
-        groups: [
-          "builtin",
-          "external",
-          "internal",
-          "parent",
-          "sibling",
-          "index",
-        ],
-        warnOnUnassignedImports: false,
-      },
-    ],
-    "sort-imports": [
-      "error",
-      {
-        // allows this rule to work with import/order
-        ignoreDeclarationSort: true,
-      },
-    ],
-    "no-console": [2, { allow: ["warn", "error", "errorBuffer"] }],
-    "react/no-is-mounted": 2,
-    "react/prefer-es6-class": 2,
-    "react/display-name": 1,
-    "react/prop-types": 2,
-    "react/no-did-mount-set-state": 0,
-    "react/no-did-update-set-state": 0,
-    "react/no-find-dom-node": 0,
-    "react/no-children-prop": 2,
-    "react/no-string-refs": 2,
-    "react/no-unescaped-entities": 2,
-    "react/jsx-no-target-blank": 2,
-    "react/jsx-key": 2,
-    "react/forbid-component-props": [2, { forbid: ["sx"] }],
-    "react-hooks/exhaustive-deps": ["warn"],
-    "prefer-const": [1, { destructuring: "all" }],
-    "no-restricted-globals": ["error", "close"],
-    "no-useless-escape": 0,
-    "no-only-tests/no-only-tests": [
-      "error",
-      {
-        block: [
-          "describe",
-          "it",
-          "context",
-          "test",
-          "tape",
-          "fixture",
-          "serial",
-          "Feature",
-          "Scenario",
-          "Given",
-          "And",
-          "When",
-          "Then",
-        ],
-      },
-    ],
-    complexity: ["error", { max: 55 }],
-    ...(shouldLintCssModules
-      ? {
-          "postcss-modules/no-undef-class": "error",
-        }
-      : {}),
-  },
-  globals: {
-    before: true,
-    cy: true,
-    Cypress: true,
-  },
-  env: {
-    browser: true,
-    es2020: true,
-    commonjs: true,
-    jest: true,
-    "jest/globals": true,
-  },
-  parser: "babel-eslint",
-  plugins,
-  extends: [
-    "eslint:recommended",
-    "plugin:react/recommended",
-    "plugin:react/jsx-runtime",
-    "plugin:react-hooks/recommended",
-    "plugin:import/errors",
-    "plugin:import/warnings",
-    "plugin:import/typescript",
-    "plugin:depend/recommended",
-    "plugin:storybook/recommended",
-    "plugin:i18next/recommended",
-  ],
-  settings: {
-    "import/internal-regex": "^metabase/|^metabase-lib/",
-    "import/resolver": {
-      webpack: {
-        config: path.resolve(__dirname, "./rspack.main.config.js"),
-        typescript: true,
-      },
-    },
-    "import/ignore": ["\\.css$"],
-    react: {
-      version: "detect",
-    },
-    "postcss-modules": {
-      baseDir: "./frontend/src",
-    },
-  },
-  parserOptions: {
-    ecmaFeatures: {
-      legacyDecorators: true,
-    },
-  },
-  overrides: [
-    {
-      files: ["*.js", "*.jsx", "*.ts", "*.tsx"],
-      rules: {
-        "jtag-missing-key": "error",
-        "no-unconditional-metabase-links-render": "error",
-        "no-color-literals": "error",
-        "no-literal-metabase-strings": "error",
-        "no-oss-reinitialize-import": "error",
-        "depend/ban-dependencies": [
-          "error",
-          {
-            allowed: [
-              "underscore",
-              "moment",
-              "lodash.orderby",
-              "lodash.debounce",
-            ],
-          },
-        ],
-      },
-    },
-    {
-      files: [
-        "*.unit.spec.*",
-        "frontend/src/metabase/admin/**/*",
-        "frontend/src/metabase/setup/**/*",
-        "enterprise/frontend/src/metabase-enterprise/whitelabel/**/*",
-        "enterprise/frontend/src/metabase-enterprise/embedding/**/*",
-        "frontend/lint/**/*",
-        "*.stories.*",
-        "**/.storybook/*",
-        "stories-data.*",
-        "e2e/**/*",
-        "**/tests/*",
-        "release/**/*",
-        "rspack.config.js",
-        "rspack.main.config.js",
-        "rspack.embedding-sdk-package.config.js",
-        "rspack.embedding-sdk-bundle.config.js",
-      ],
-      rules: {
-        "no-color-literals": "off",
-        "no-unconditional-metabase-links-render": "off",
-        "no-literal-metabase-strings": "off",
-      },
-    },
-    {
-      files: [
-        "*.unit.spec.*",
-        "frontend/lint/**/*",
-        "*.stories.*",
-        "stories-data.*",
-        "e2e/**/*",
-        "**/tests/*",
-        "release/**/*",
-        "rspack.main.config.js",
-      ],
-      rules: {
-        "i18next/no-literal-string": "off",
-      },
-    },
-    {
-      extends: ["plugin:@typescript-eslint/recommended"],
-      files: ["*.ts", "*.tsx"],
-      parser: "@typescript-eslint/parser",
-      plugins: ["@typescript-eslint"],
-      rules: {
-        "prefer-rest-params": "off",
-        "react/prop-types": "off", // TypeScript handles prop validation
-        "@typescript-eslint/explicit-module-boundary-types": "off",
-        "@typescript-eslint/no-inferrable-types": "off",
-        "@typescript-eslint/no-explicit-any": "off",
-        "@typescript-eslint/no-this-alias": "off",
-        "@typescript-eslint/consistent-type-imports": [
-          "error",
-          {
-            fixStyle: "inline-type-imports",
-          },
-        ],
-        "@typescript-eslint/no-import-type-side-effects": "error",
-        "@typescript-eslint/no-unused-vars": [
-          "error",
-          {
-            argsIgnorePattern: "^_.+$",
-            varsIgnorePattern: "^_.+$",
-            ignoreRestSiblings: true,
-            destructuredArrayIgnorePattern: "^_.+$",
-          },
-        ],
-        // This was introduced in 6.0.0
-        "@typescript-eslint/no-unsafe-declaration-merging": "off",
-      },
-    },
-    {
-      extends: [
-        "plugin:jest/recommended",
-        "plugin:jest-dom/recommended",
-        "plugin:testing-library/react",
-        "plugin:jest-formatting/recommended",
-      ],
-      plugins: ["jest", "jest-dom", "testing-library", "jest-formatting"],
-      files: [
-        "*.unit.spec.ts",
-        "*.unit.spec.tsx",
-        "*.unit.spec.js",
-        "*.unit.spec.jsx",
-      ],
-      rules: {
-        "jest/valid-title": ["error", { ignoreTypeOfDescribeName: true }],
-        "jest/expect-expect": [
-          "error",
-          {
-            assertFunctionNames: ["expect*", "assert*"],
-            additionalTestBlockFunctions: [],
-          },
-        ],
-      },
-    },
-    {
-      // Enable jest formatting for cypress tests too, the plugin logic just works
-      extends: ["plugin:jest-formatting/recommended"],
-      files: ["*.cy.spec.ts", "*.cy.spec.js"],
-    },
-    {
-      files: ["frontend/src/**/*"],
-      rules: {
-        "no-restricted-syntax": [
-          "error",
-          {
-            selector: "Literal[value=/mb-base-color-/]",
-            message:
-              "You may not use base colors in the application, use semantic colors instead. (see colors.module.css)",
-          },
-        ],
-      },
-    },
-    {
-      files: ["frontend/src/metabase/**/*"],
-      rules: {
-        "no-restricted-syntax": [
-          "error",
-          {
-            selector: "Literal[value=/mb-base-color-/]",
-            message:
-              "You may not use base colors in the application, use semantic colors instead. (see colors.module.css)",
-          },
-        ],
-      },
-    },
-    {
-      files: ["frontend/src/metabase/query_builder/**/*"],
-      rules: {
-        "import/no-cycle": "error",
-      },
-    },
-    {
-      files: ["docs/**/snippets/**/*.{ts,tsx,js,jsx}"],
-      rules: {
-        "@typescript-eslint/no-unused-vars": "off",
-        "@typescript-eslint/no-var-requires": "off",
-        "import/no-commonjs": "off",
-        "import/no-default-export": "off",
-        "import/order": "off",
-        "import/no-unresolved": "off",
-        "no-color-literals": "off",
-      },
-    },
-    {
-      files: ["frontend/build/**/*.js"],
-      rules: {
-        "import/no-commonjs": "off",
-      },
-    },
-    {
-      files: ["**/*.stories.tsx", "**/preview.tsx"],
-      rules: {
-        "import/no-default-export": "off",
-      },
-    },
-  ],
-};

.gitconfig

@@ -1,7 +1,5 @@
 # execute this in your shell to enable custom merge driver:
 # echo '\n[include]\npath=../.gitconfig' >> .git/config
-#
-# TODO (Bryan 12/12/25) -- reenable this when we can completely verify correctness
-# [merge "yaml-migrations"]
-#     name = YAML migration changeset-aware merge
-#     driver = mage -merge-yaml-migrations %O %A %B %L %P
+[merge "yaml-migrations"]
+    name = YAML migration changeset-aware merge
+    driver = bin/mage -merge-yaml-migrations %O %A %B %L %P

.github/PULL_REQUEST_TEMPLATE/cypress_repro.md

@@ -5,7 +5,7 @@ PENDING CI / PENDING REVIEW / READY _(choose one and update accordingly)_
 - Reproduces #XXXXX
 
 ### How to test this manually?
-- `yarn test-cypress`
+- `bun run test-cypress`
 - `relative/path/to/the/file`
 > _(For still unfixed bug)_
 - Replace `it.skip()` with `it.only()` to run the test in isolation

.github/actions/fetch-artifact/action.yml

@@ -2,9 +2,16 @@ name: Fetch artifact
 description: Fetches a specific artifact and downloads it to the current directory
 
 inputs:
-  name:
-    description: The name of the artifact to fetch
+  commit:
+    description: Commit SHA for the artifact
     required: true
+  edition:
+    description: Metabase edition (ee or oss)
+    required: true
+  release:
+    description: Whether this is a release artifact (uses metabase-release- prefix)
+    required: false
+    default: "false"
   output-name:
     description: Optional custom name for the output jar file (defaults to metabase.jar)
     required: false
@@ -25,15 +32,20 @@ runs:
         script: | # js
           const fs = require('fs');
 
+          const isRelease = "${{ inputs.release }}" === "true";
+          const prefix = isRelease ? "metabase-release" : "metabase";
+          const artifactName = `${prefix}-${{ inputs.edition }}-${{ inputs.commit }}-uberjar`;
+          console.log(`Looking for artifact: ${artifactName}`);
+
           const artifacts = await github.rest.actions.listArtifactsForRepo({
             owner: context.repo.owner,
             repo: context.repo.repo,
-            name: "${{ inputs.name }}",
+            name: artifactName,
             per_page: 1,
           });
 
           if (!artifacts.data?.artifacts?.[0]?.id) {
-            throw new Error(`No artifacts found for ${{ inputs.name }}`);
+            throw new Error(`No artifacts found for ${artifactName}`);
           }
 
           const artifact_id = artifacts.data.artifacts[0].id;

.github/actions/prepare-backend/action.yml

@@ -29,6 +29,9 @@ runs:
       uses: ./.github/actions/get-cache-keys
       id: get-cache-keys
 
+    - name: Install uv (for Python package installation)
+      uses: astral-sh/setup-uv@v7
+
     - name: Restore M2 cache
       uses: actions/cache/restore@v4
       with:

.github/actions/prepare-cypress/action.yml

@@ -3,7 +3,7 @@ description: Cypress preparation steps
 
 inputs:
   working-directory:
-    description: "Optional working directory for yarn commands"
+    description: "Optional working directory for bun commands"
     required: false
     default: "."
 
@@ -16,7 +16,7 @@ runs:
   using: "composite"
   steps:
     - name: Install Chrome v111
-      uses: browser-actions/setup-chrome@v1
+      uses: browser-actions/setup-chrome@v2
       with:
         # https://chromium.cypress.io/linux/stable/111.0.5563.146
         chrome-version: 1097615
@@ -34,9 +34,9 @@ runs:
 
     - name: Ensure that Cypress executable is ready
       run: |
-        yarn cypress install
-        yarn cypress cache path
-        yarn cypress cache list
-        yarn cypress verify
+        bun run cypress install
+        bun run cypress cache path
+        bun run cypress cache list
+        bun run cypress verify
       shell: bash
       working-directory: ${{ inputs.working-directory }}

.github/actions/prepare-frontend/action.yml

@@ -1,4 +1,5 @@
 name: Prepare front-end environment
+description: "Prepare the front-end environment for the CI build"
 inputs:
   node-version:
     description: "The version of Node.js to use, overriding .nvmrc"
@@ -16,6 +17,12 @@ runs:
         node-version: ${{ inputs.node-version }} # this overrides, if present
         node-version-file: ".nvmrc"
 
+    - name: Install bun
+      uses: oven-sh/setup-bun@v2
+      with:
+        bun-version: "1.3.7"
+        token: ${{ github.token }}
+
     - name: Get cache keys
       uses: ./.github/actions/get-cache-keys
       id: get-cache-keys
@@ -28,12 +35,12 @@ runs:
           ~/.gitlibs
         key: ${{ steps.get-cache-keys.outputs.m2-cache-key }}
 
-    - name: Get yarn cache directory
-      id: yarn-cache-dir
+    - name: Get bun cache directory
+      id: bun-cache
       run: |
-        YARN_CACHE_DIR=$(yarn cache dir)
-        echo "Yarn cache directory: $YARN_CACHE_DIR"
-        echo "dir=$YARN_CACHE_DIR" >> $GITHUB_OUTPUT
+        BUN_CACHE_DIR=$(bun pm cache)
+        echo "Bun cache directory: $BUN_CACHE_DIR"
+        echo "dir=$BUN_CACHE_DIR" >> $GITHUB_OUTPUT
       shell: bash
 
     - name: Restore node_modules cache
@@ -41,7 +48,7 @@ runs:
       id: node-modules-cache
       with:
         path: |
-          ${{ steps.yarn-cache-dir.outputs.dir }}
+          ${{ steps.bun-cache.outputs.dir }}
           node_modules
         key: ${{ steps.get-cache-keys.outputs.node-cache-key }}
 
@@ -49,9 +56,9 @@ runs:
     # If a job wants to patch packages, it does so explicitly in the CI. This setting is opt-out.
     # For example, we never want to cache node_modules with patches already applied so cache-generator.yml skips that step.
     - name: Clean install
-      run: yarn install --frozen-lockfile --prefer-offline
+      run: bun install --frozen-lockfile
       shell: bash
     - name: Patch frontend dependencies
       if: inputs.apply-patches == 'true'
-      run: yarn patch-package
+      run: bun run patch-package
       shell: bash

.github/actions/prepare-release-scripts/action.yml

@@ -0,0 +1,14 @@
+name: Prepare Release Scripts
+description: Set up bun and build release scripts
+
+runs:
+  using: composite
+  steps:
+    - uses: oven-sh/setup-bun@v2
+      with:
+        bun-version: "1.3.7"
+        token: ${{ github.token }}
+
+    - name: Build release scripts
+      shell: bash
+      run: cd ${{ github.workspace }}/release && bun install --frozen-lockfile && bun run build

.github/actions/prepare-shoppy-e2e/action.yml

@@ -0,0 +1,132 @@
+name: Prepare Shoppy E2E environment
+description: Shared setup steps for Shoppy E2E tests (regular and synthetic)
+
+inputs:
+  commit:
+    description: "Commit SHA for artifact retrieval"
+    required: true
+  sample-app-branch-name:
+    description: "Branch name for the sample app"
+    required: true
+  sample-app-environment:
+    description: "Environment (production/development)"
+    required: true
+  staging-mb-all-features-token:
+    description: "Staging MB all features token"
+    required: true
+  shoppy-iam-role:
+    description: "Shoppy IAM role for AWS credentials"
+    required: true
+  shoppy-metabase-app-db-s3-bucket:
+    description: "S3 bucket for Shoppy app DB dump"
+    required: true
+  shoppy-metabase-app-db-s3-key:
+    description: "S3 key for Shoppy app DB dump"
+    required: true
+  shoppy-metabase-app-db-user:
+    description: "Shoppy Metabase app DB user"
+    required: true
+  shoppy-metabase-app-db-database:
+    description: "Shoppy Metabase app DB database"
+    required: true
+  metastore-dev-server-url:
+    description: "Metastore dev server URL"
+    required: true
+  shoppy-datadog-application-id:
+    description: "Shoppy Datadog application ID"
+    required: true
+  shoppy-datadog-client-token:
+    description: "Shoppy Datadog client token"
+    required: true
+
+outputs:
+  chrome-path:
+    description: "Path to Chrome executable"
+    value: ${{ steps.cypress-prep.outputs.chrome-path }}
+  sample_app_branch_exists:
+    description: "Whether the sample app branch exists"
+    value: ${{ steps.check-sample-app-branch.outputs.sample_app_branch_exists }}
+
+runs:
+  using: "composite"
+  steps:
+    - uses: ./.github/actions/maximize-disk-space
+
+    # We have to use the latest version that does not have this issue https://github.com/docker/compose/pull/12752
+    - name: Set up Docker Compose
+      uses: docker/setup-compose-action@v1
+      with:
+        version: latest
+
+    - name: Retrieve uberjar artifact for ee
+      uses: ./.github/actions/fetch-artifact
+      with:
+        commit: ${{ inputs.commit }}
+        edition: ee
+        extract-path: "target/uberjar"
+        output-name: "metabase.jar"
+
+    - name: Retrieve Embedding SDK dist artifact
+      uses: actions/download-artifact@v4
+      with:
+        name: embedding-sdk-${{ inputs.commit }}
+        path: ${{ github.workspace }}/resources/embedding-sdk
+
+    - name: Prepare front-end environment
+      uses: ./.github/actions/prepare-frontend
+
+    - name: Prepare Cypress environment
+      id: cypress-prep
+      uses: ./.github/actions/prepare-cypress
+
+    - name: Check if sample app branch exists
+      id: check-sample-app-branch
+      shell: bash
+      env:
+        SAMPLE_APP_BRANCH_NAME: ${{ inputs.sample-app-branch-name }}
+      run: |
+        REPO_URL="https://github.com/metabase/shoppy.git"
+        echo "Checking if branch '${SAMPLE_APP_BRANCH_NAME}' exists in ${REPO_URL}..."
+        if git ls-remote --exit-code --heads "$REPO_URL" "${SAMPLE_APP_BRANCH_NAME}"; then
+          echo "sample_app_branch_exists=true" >> $GITHUB_OUTPUT
+        else
+          echo "sample_app_branch_exists=false" >> $GITHUB_OUTPUT
+        fi
+
+    - name: Configure AWS credentials
+      if: ${{ steps.check-sample-app-branch.outputs.sample_app_branch_exists == 'true' }}
+      uses: aws-actions/configure-aws-credentials@v4
+      with:
+        role-to-assume: ${{ inputs.shoppy-iam-role }}
+        role-session-name: GitHub_to_AWS_via_FederatedOIDC
+        aws-region: us-east-1
+
+    - name: Download Shoppy's App DB PostgreSQL dump from S3
+      if: ${{ steps.check-sample-app-branch.outputs.sample_app_branch_exists == 'true' }}
+      shell: bash
+      run: |
+        aws s3 cp s3://${{ inputs.shoppy-metabase-app-db-s3-bucket }}/${{ inputs.shoppy-metabase-app-db-s3-key }} ./e2e/tmp/db_dumps/shoppy_metabase_app_db_dump.sql
+
+    - name: Prepare and launch Shoppy containers
+      if: ${{ steps.check-sample-app-branch.outputs.sample_app_branch_exists == 'true' }}
+      shell: bash
+      env:
+        SAMPLE_APP_BRANCH_NAME: ${{ inputs.sample-app-branch-name }}
+        SAMPLE_APP_ENVIRONMENT: ${{ inputs.sample-app-environment }}
+        CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ inputs.staging-mb-all-features-token }}
+        METASTORE_DEV_SERVER_URL: ${{ inputs.metastore-dev-server-url }}
+        METABASE_APP_DB_USER: ${{ inputs.shoppy-metabase-app-db-user }}
+        METABASE_APP_DB: ${{ inputs.shoppy-metabase-app-db-database }}
+        SHOPPY_DATADOG_APPLICATION_ID: ${{ inputs.shoppy-datadog-application-id }}
+        SHOPPY_DATADOG_CLIENT_TOKEN: ${{ inputs.shoppy-datadog-client-token }}
+        SHOPPY_DATADOG_SITE: "us5.datadoghq.com"
+        SHOPPY_DATADOG_ENV: "staging"
+      run: npx tsx ./e2e/runner/embedding-sdk/sample-apps/start-ci.ts shoppy-e2e
+
+    - name: Prune build cache
+      shell: bash
+      run: docker builder prune -af
+
+    - name: Log free disk space
+      shell: bash
+      run: df -h /

.github/actions/prepare-uberjar-artifact/action.yml

@@ -2,9 +2,10 @@ name: Prepare Uberjar Artifact
 description: Prepare and upload Metabase JAR as a GitHub artifact.
 
 inputs:
-  name:
-    required: true
-    description: Artifact name
+  edition:
+    required: false
+    default: "ee"
+    description: Metabase edition (ee or oss)
 
 runs:
   using: "composite"
@@ -18,7 +19,7 @@ runs:
     - name: Upload JARs as artifact
       uses: actions/upload-artifact@v4
       with:
-        name: ${{ inputs.name }}
+        name: metabase-${{ inputs.edition }}-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
         path: |
           ./target/uberjar/metabase.jar
           ./COMMIT-ID

.github/actions/test-driver/action.yml

@@ -12,6 +12,15 @@ inputs:
   logs-artifact-suffix:
     required: false
     description: Suffix to append to the test logs artifact name to avoid conflicts in matrix jobs
+  edition:
+    required: false
+    default: 'ee'
+    description: Edition to test (oss or ee)
+
+outputs:
+  test-outcome:
+    description: "The outcome of the test run (success, failure, cancelled, skipped)"
+    value: ${{ steps.run-test.outcome }}
 
 runs:
   using: "composite"
@@ -23,12 +32,12 @@ runs:
       uses: ./.github/actions/prepare-frontend
     - name: Build static viz frontend
       if: ${{ inputs.build-static-viz == 'true' }}
-      run: yarn build-static-viz
+      run: bun run build-static-viz
       shell: bash
       env:
         MB_EDITION: ee
     - name: Test database driver
-      run: clojure -X:dev:ci:ee:ee-dev:drivers:drivers-dev:test ${{ inputs.test-args }}
+      run: clojure -X:dev:ci:${{ inputs.edition }}:${{ inputs.edition }}-dev:drivers:drivers-dev:test ${{ inputs.test-args }}
       shell: bash
       id: run-test
       # Trunk Quarantine controls the final state of the run in the CI!
@@ -52,7 +61,7 @@ runs:
       if: always() && steps.run-test.outcome != 'success'
       uses: actions/upload-artifact@v4
       with:
-        name: ${{ format('test-logs-{0}{1}', github.job, (inputs.logs-artifact-suffix == '' || inputs.logs-artifact-suffix == null) && '' || format('-{0}', inputs.logs-artifact-suffix)) }}
+        name: ${{ format('test-logs-{0}{1}', github.job, inputs.logs-artifact-suffix && format('-{0}', inputs.logs-artifact-suffix) || '') }}
         path: logs/test-log.json
         retention-days: 1
       # Failing to upload the artifact should never affect the outcome of the whole test run.

.github/actions/upload-test-results/action.yml

@@ -21,6 +21,8 @@ inputs:
   variant:
     required: false
     default: ""
+  previous-step-outcome:
+    required: true
 
 runs:
   using: "composite"
@@ -57,3 +59,4 @@ runs:
         dry-run: ${{ github.event_name == 'pull_request' && github.event.pull_request.draft == true }} # quarantine, but do not upload results
         token: ${{ inputs.trunk-api-token }}
         use-cache: true
+        previous-step-outcome: ${{ inputs.previous-step-outcome }}

.github/file-paths.yaml

@@ -26,7 +26,7 @@ frontend_ci: &frontend_ci
   - ".github/workflows/frontend.yml"
 
 frontend_configs: &frontend_configs
-  - "yarn.lock"
+  - "bun.lock"
   - "**/tsconfig*.json"
   - "package.json"
   - "babel.config.json"
@@ -85,7 +85,9 @@ backend_ci: &backend_ci
 
 backend_presto_kerberos:
   - "**/presto_jdbc/**"
+  - "**/presto-jdbc/**" # the driver module has a hyphen. underscores are classpaths
   - "**/presto_jdbc.clj"
+  - "**/presto_jdbc_test.clj"
   - ".github/workflows/presto-kerberos-integration-test.yml"
 
 backend_sources: &backend_sources

.github/scripts/csv-to-mb.js

@@ -0,0 +1,41 @@
+/**
+ * jsonData must be in the format:
+ * [
+ *   { column1: value1, column2: value2, ... },
+ *   { column1: value3, column2: value4, ... },
+ *   ...
+ * ]
+ */
+function jsonToCsvFormData(jsonData) {
+  const formData = new FormData();
+  const csvHeader = Object.keys(jsonData[0]).join(',') + '\n';
+  const csvContent = jsonData.map(row =>
+    Object.values(row).map(value => `"${String(value).replace(/"/g, '""')}"`).join(',')
+  ).join('\n');
+
+  const blob = new Blob([csvHeader + csvContent], { type: 'text/csv' });
+  formData.append('file', blob, 'data.csv');
+
+  return formData;
+}
+
+function uploadCsvToMb({ baseUrl, tableId, jsonData, mode = 'append' }) {
+  const formData = jsonToCsvFormData(jsonData);
+  const operation = mode === 'replace' ? 'replace-csv' : 'append-csv';
+
+  return fetch(`${baseUrl}/api/table/${tableId}/${operation}`, {
+    method: 'POST',
+    headers: {
+      "x-api-key": process.env.API_KEY
+    },
+    body: formData
+  })
+  .then(response => {
+    if (!response.ok) {
+      throw new Error(`Upload failed`);
+    }
+    return { success: true };
+  });
+}
+
+module.exports = { uploadCsvToMb };

.github/scripts/find-linear-issue.js

@@ -0,0 +1,40 @@
+async function findLinearIssue({ githubIssueUrl, linearApiKey }) {
+  const response = await fetch("https://api.linear.app/graphql", {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: linearApiKey,
+    },
+    body: JSON.stringify({
+      query: `
+        query {
+          attachmentsForURL(url: "${githubIssueUrl}") {
+            nodes {
+              issue { identifier }
+            }
+          }
+        }
+      `,
+    }),
+  });
+
+  const data = await response.json();
+
+  if (!response.ok) {
+    return { success: false, message: `Linear API error: ${response.status}` };
+  }
+
+  if (!data.data?.attachmentsForURL?.nodes?.length) {
+    return {
+      success: false,
+      message: `No Linear issue linked to ${githubIssueUrl}`,
+    };
+  }
+
+  return {
+    success: true,
+    issue: data.data.attachmentsForURL.nodes[0].issue.identifier,
+  };
+}
+
+module.exports = { findLinearIssue };

.github/scripts/generate-llms-txt.js

@@ -1,317 +0,0 @@
-const fs = require("fs");
-const path = require("path");
-
-const REPO = "metabase/metabase";
-const OUTPUT_FILE = "llms.txt";
-
-// Sections to generate llms-<name>-full.txt for.
-// Each section can define a preamble (introductory content before the main docs).
-const LLMS_FULL_TO_GENERATE = [
-  {
-    section: "embedding",
-    getPreamble: (branch) =>
-      aboveVersion(branch, 57) ? getModularEmbeddingGotchaNotes() : "",
-  },
-];
-
-/**
- * List directory recursively to get markdown files
- *
- * @param {string} docsPath - full path to docs directory
- * @returns {Array} list of markdown file objects with fullPath and relativePath
- */
-function getMarkdownFilesList(docsPath) {
-  if (!fs.existsSync(docsPath)) {
-    console.error(`Error: Docs directory '${docsPath}' does not exist`);
-    process.exit(1);
-  }
-
-  const entries = fs.readdirSync(docsPath, {
-    recursive: true,
-    withFileTypes: true,
-  });
-
-  return entries
-    .filter((entry) => {
-      return (
-        entry.isFile() &&
-        // Only markdown files
-        entry.name.endsWith(".md") &&
-        // Ignore README.md
-        entry.name !== "README.md" &&
-        // Ignore node_modules and hidden directories
-        !entry.parentPath
-          .split(path.sep)
-          .some((dir) => dir === "node_modules" || dir.startsWith("."))
-      );
-    })
-    .map((entry) => {
-      const fullPath = path
-        .join(entry.parentPath, entry.name)
-        .replace(/\\/g, "/");
-
-      const relativePath = path
-        .relative(docsPath, fullPath)
-        .replace(/\\/g, "/");
-
-      return { fullPath, relativePath };
-    });
-}
-
-/**
- * Generate llms.txt file with links to all markdown files in docs/
- *
- * @param {string} branch - branch name (e.g. 'master' or 'release-x.58.x')
- * @param {Array} files - list of all markdown file objects
- * @param {Array<Object>} sectionsConfig - list of section config objects to generate complete references for
- */
-function generateLlmsTxt(branch, files, sectionsConfig) {
-  const baseUrl = `https://raw.githubusercontent.com/${REPO}/refs/heads/${branch}`;
-
-  const filesToExtract = files
-    // Files in embedding/sdk/api/snippets does not exist in the repo.
-    .filter(
-      (file) => !file.relativePath.startsWith("embedding/sdk/api/snippets"),
-    );
-
-  const entries = filesToExtract.map((file) => {
-    const content = fs.readFileSync(file.fullPath, "utf8");
-    const title = extractTitle(content, file.relativePath);
-    const url = `${baseUrl}/docs/${file.relativePath}`;
-
-    return { title, url, path: file.relativePath };
-  });
-
-  // Generate table of contents entries
-  const tableOfContents = entries.map(
-    (entry) => `- [${entry.title}](${entry.url})`,
-  );
-
-  // Generate complete references entries
-  const completeReferences = sectionsConfig
-    .filter((config) =>
-      files.some((file) => file.relativePath.startsWith(`${config.section}/`)),
-    )
-    .map((config) => {
-      const capitalized =
-        config.section.charAt(0).toUpperCase() + config.section.slice(1);
-      return `- [${capitalized} - Complete Reference](${baseUrl}/llms-${config.section}-full.txt)`;
-    });
-
-  // Generate llms.txt content using template literal
-  const content = `# Metabase Documentation
-Metabase - The simplest, fastest way to get business intelligence and analytics to everyone in your company.
-
-## Table of Contents
-
-${tableOfContents.join("\n")}
-
-## Complete References
-
-These files are very large and are around 90,000 tokens. Do not use by default unless the context window is huge or RAG is supported in your editor.
-
-${completeReferences.join("\n")}
-`;
-
-  fs.writeFileSync(OUTPUT_FILE, content, "utf8");
-
-  console.log(
-    `✅ Generated ${OUTPUT_FILE} with ${entries.length} markdown files`,
-  );
-  console.log(`   Branch: ${branch}`);
-  console.log(`   Base URL: ${baseUrl}`);
-}
-
-/**
- * Generate llms-full.txt files for specified sections
- *
- * @param {string} branch - branch name (e.g., 'master', 'release-x.58.x')
- * @param {Array} files - list of all markdown file objects
- * @param {Array<Object>} sectionsConfig - list of section config objects to generate full files for
- */
-function generateLlmsFullFiles(branch, files, sectionsConfig) {
-  const baseUrl = `https://raw.githubusercontent.com/${REPO}/refs/heads/${branch}`;
-
-  sectionsConfig.forEach((config) => {
-    generateLlmsFullTxt(branch, config, files, baseUrl);
-  });
-}
-
-/**
- * LLMs are likely to pay attention to the very first lines.
- *
- * We add the most important context for LLMs to avoid
- * confusion and pitfalls like out-of-date APIs in trained data.
- *
- * @returns {string} Markdown formatted gotcha notes
- */
-function getModularEmbeddingGotchaNotes() {
-  return `> **Important Version Notes**
->
-> Watch out for these deprecated props and gotchas for Metabase 57 onwards, for modular embedding:
->
-> 1. \`config\` prop on MetabaseProvider no longer exist - it is replaced by \`authConfig\`.
-> 2. \`authProviderUri\` field no longer exist.
-> 3. \`jwtProviderUri\` optional field only exists in v58+. This is used to make JWT auth faster by skipping the \`GET /auth/sso\` discovery request. Not needed for initial implementation.
-> 4. \`fetchRequestToken\` is not needed by default. This is only used to customize how the SDK fetches the request token.
-> 5. Numeric IDs must be integers not strings, e.g. \`dashboardId={1}\`. When the ID is retrieved from the URL and it is numeric, convert it to an integer via \`parseInt\` before passing it to the SDK. IDs can also be strings for entity ids, so you should not parse all IDs as numbers if entity ids are also to be expected.
-`;
-}
-
-/**
- * Generate llms-full.txt file for a specific section
- * @param {string} branch - The branch name
- * @param {Object} config - Section config object with section name and optional getPreamble function
- * @param {Array} files - Array of all markdown file objects
- * @param {string} baseUrl - Base URL for raw GitHub links
- */
-function generateLlmsFullTxt(branch, config, files, baseUrl) {
-  const { section, getPreamble } = config;
-
-  // Filter docs for this section
-  const sectionFiles = files.filter((file) =>
-    file.relativePath.startsWith(`${section}/`),
-  );
-
-  if (sectionFiles.length === 0) {
-    console.log(`   Skipping llms-full.txt for ${section} (no files found)`);
-    return;
-  }
-
-  // Build content
-  const sectionCapitalized = section.charAt(0).toUpperCase() + section.slice(1);
-  const header = `# Metabase ${sectionCapitalized} - Complete Reference for AI agents
-
-> Table of contents: ${baseUrl}/${OUTPUT_FILE}
-
-`;
-
-  // Add preamble if provided (e.g., version-specific notes, warnings)
-  const preamble = getPreamble ? getPreamble(branch) : "";
-
-  // Concatenate all documents
-  const docs = sectionFiles
-    .map((file) => readAndCleanMarkdown(file.fullPath))
-    .join("\n");
-
-  // Write llms-full.txt file at repo root
-  const content = header + preamble + "\n" + docs;
-  const llmsFullPath = `llms-${section}-full.txt`;
-  fs.writeFileSync(llmsFullPath, content, "utf8");
-
-  console.log(
-    `✅ Generated ${llmsFullPath} with ${sectionFiles.length} documents`,
-  );
-}
-
-/**
- * Extract title from markdown file frontmatter or filename.
- *
- * We try to extract the title in this order: 1) YAML frontmatter
- * 2) first H1 heading, and 3) the Markdown file name.
- *
- * Example Markdown and frontmatter format:
- * ```markdown
- * ---
- * title: "Getting Started"
- * description: "A guide"
- * ---
- * # Getting Started
- * ```
- *
- * @param {string} content - file content
- * @param {string} filePath - relative file path
- * @returns {string} title of content
- */
-function extractTitle(content, filePath) {
-  // Try to extract title from YAML frontmatter
-  // First, match against the YAML frontmatter delimiter `---`
-  const frontmatterMatch = content.match(/^---\s*\n([\s\S]*?)\n---\s*\n/);
-
-  if (frontmatterMatch) {
-    // Then, match against the title property
-    // Example: `title: "My Page"`
-    const frontmatter = frontmatterMatch[1];
-    const titleMatch = frontmatter.match(/^title:\s*(.+)$/m);
-
-    // Remove quotes if present
-    if (titleMatch) {
-      return titleMatch[1].trim().replace(/^["']|["']$/g, "");
-    }
-  }
-
-  // Try to extract title from first H1 heading
-  // Example: `# My Page`
-  const h1Match = content.match(/^#\s+(.+)$/m);
-
-  if (h1Match) {
-    return h1Match[1].trim();
-  }
-
-  // Fallback to filename, e.g. `my-page.md`
-  const filename = path.basename(filePath, ".md");
-
-  // Convert kebab-case or snake_case to Title Case
-  // `my-page.md` would become "My Page"
-  return filename
-    .split(/[-_]/)
-    .map((word) => word.charAt(0).toUpperCase() + word.slice(1))
-    .join(" ");
-}
-
-/**
- * Read and clean markdown file content
- *
- * @param {string} filePath - full path to the markdown file
- * @returns {string} cleaned markdown content with separator
- */
-function readAndCleanMarkdown(filePath) {
-  let content = fs.readFileSync(filePath, "utf8");
-
-  // Strip YAML frontmatter
-  content = content.replace(/^---\s*\n[\s\S]*?\n---\s*\n/, "");
-
-  // Strip Jekyll/Liquid template syntax
-  content = content.replace(/\{%.*?%\}/g, "");
-  content = content.replace(/\{\{.*?\}\}/g, "");
-
-  return `${content.trim()}\n\n---\n`;
-}
-
-/**
- * Check if branch version is above target version
- * @param {string} branch - Branch name (e.g., 'master', 'release-x.58.x')
- * @param {number} targetVersion - Target version number
- * @returns {boolean}
- */
-function aboveVersion(branch, targetVersion) {
-  if (branch === "master") {
-    return true;
-  }
-
-  // Parse version from release branch like "release-x.58.x" -> 58
-  const match = branch.match(/release-x\.(\d+)\.x/);
-  if (!match) {
-    return false;
-  }
-
-  const version = parseInt(match[1], 10);
-
-  return version >= targetVersion;
-}
-
-// Main execution
-if (require.main === module) {
-  const args = process.argv.slice(2);
-  const docsPath = args[0] || "docs";
-  const branch = args[1] || "master";
-
-  const resolvedDocsPath = path.resolve(docsPath);
-  const markdownFiles = getMarkdownFilesList(resolvedDocsPath);
-
-  // Sort all files upfront for consistent ordering across all generated files
-  markdownFiles.sort((a, b) => a.relativePath.localeCompare(b.relativePath));
-
-  generateLlmsTxt(branch, markdownFiles, LLMS_FULL_TO_GENERATE);
-  generateLlmsFullFiles(branch, markdownFiles, LLMS_FULL_TO_GENERATE);
-}

.github/team.json

@@ -10,14 +10,7 @@
         "metamben",
         "wzimrin",
         "ericnormand",
-        "galdre"
-      ]
-    },
-    {
-      "name": "Drivers",
-      "label": ".Team/Drivers",
-      "members": [
-        "snoe",
+        "galdre",
         "rileythomp"
       ]
     },
@@ -62,7 +55,8 @@
         "tsplude",
         "lbrdnk",
         "piranha",
-        "crisptrutski"
+        "crisptrutski",
+        "undrfined"
       ]
     },
     {
@@ -86,16 +80,12 @@
         "eliotmetabase",
         "npfitz",
         "johnswanson",
-        "iethree",
         "nvoxland",
         "edpaget",
         "deniskaber",
         "alxnddr",
-        "bpander",
         "andsalves",
-        "gantoreno",
-        "kevinkelleher12",
-        "undrfined"
+        "kevinkelleher12"
       ]
     },
     {
@@ -112,6 +102,16 @@
         "uladzimirdev",
         "egorgrushin"
       ]
+    },
+    {
+      "name": "Growth Eng",
+      "label": ".Team/GrowthEng",
+      "members": [
+        "iethree",
+        "bpander",
+        "gantoreno",
+        "losrebellos"
+      ]
     }
   ]
 }

.github/workflows/app-db.yml

@@ -15,7 +15,7 @@ jobs:
   be-tests-mariadb:
     if: ${{ !inputs.skip }}
     runs-on: ubuntu-22.04
-    timeout-minutes: 60
+    timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
@@ -105,6 +105,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Test ${{ matrix.version.name }}
+        id: test-driver
         uses: ./.github/actions/test-driver
         with:
           build-static-viz: ${{ matrix.job.build-static-viz }}
@@ -123,11 +124,12 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   be-tests-mysql:
     if: ${{ !inputs.skip }}
     runs-on: ubuntu-22.04
-    timeout-minutes: 60
+    timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
@@ -227,6 +229,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Test ${{ matrix.version.name }}
+        id: test-driver
         uses: ./.github/actions/test-driver
         with:
           build-static-viz: ${{ matrix.job.build-static-viz }}
@@ -245,11 +248,12 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   be-tests-postgres:
     if: ${{ !inputs.skip }}
     runs-on: ubuntu-22.04
-    timeout-minutes: 60
+    timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
@@ -336,6 +340,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Test ${{ matrix.version.name }} (${{ matrix.job.name }})
+        id: test-driver
         uses: ./.github/actions/test-driver
         with:
           build-static-viz: ${{ matrix.job.build-static-viz }}
@@ -354,6 +359,7 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   app-db-tests-result:
     needs:

.github/workflows/backend-cloverage.yml

@@ -1,12 +1,33 @@
 name: Backend-Cloverage
 
+# Module lists are generated dynamically by listing source directories.
+# The setup-oss and setup-ee jobs list folders in src/metabase/ and
+# enterprise/backend/src/metabase_enterprise/ respectively, convert
+# underscores to dashes (for Clojure namespace convention), and output
+# as JSON arrays for the matrix jobs to consume.
+#
+# jq flags: -R (raw string input), -s (slurp all lines into one string),
+# -c (compact single-line output for GitHub Actions).
+
 on:
   workflow_dispatch:
   schedule:
     - cron: '0 10 * * 1-5' # every weekday at 5am US eastern time
 
 jobs:
+  setup-oss:
+    runs-on: ubuntu-22.04
+    outputs:
+      modules: ${{ steps.get-modules.outputs.modules }}
+    steps:
+      - uses: actions/checkout@v4
+      - id: get-modules
+        run: |
+          modules=$(ls -1d src/metabase/*/ | xargs -n1 basename | tr '_' '-' | jq -R -s -c 'split("\n") | map(select(length > 0))')
+          echo "modules=$modules" >> $GITHUB_OUTPUT
+
   be-linter-cloverage:
+    needs: setup-oss
     # don't run this workflow on a cron for forks
     if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
     runs-on: ubuntu-22.04
@@ -14,96 +35,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        modules:
-          - actions
-          - activity-feed
-          - analytics
-          - analyze
-          - api
-          - api-keys
-          - api-routes
-          - app-db
-          - appearance
-          - audit-app
-          - auth-provider
-          - batch-processing
-          - bookmarks
-          - bug-reporting
-          - cache
-          - channel
-          - classloader
-          - cloud-migration
-          - cmd
-          - collections
-          - config
-          - connection-pool
-          - content-translation
-          - content-verification
-          - core
-          - dashboards
-          - database-routing
-          - driver
-          - driver-api
-          - eid-translation
-          - embedding
-          - events
-          - formatter
-          - geojson
-          - glossary
-          - graph
-          - indexed-entities
-          - internal-stats
-          - legacy-mbql
-          - lib
-          - lib-be
-          - logger
-          - login-history
-          - model-persistence
-          - models
-          - native-query-snippets
-          - notification
-          - parameters
-          - permissions
-          - pivot
-          - plugins
-          - premium-features
-          - product-feedback
-          - public-sharing
-          - pulse
-          - queries
-          - query-permissions
-          - query-processor
-          - remote-sync
-          - request
-          - revisions
-          - sample-data
-          - search
-          - secrets
-          - segments
-          - server
-          - session
-          - settings
-          - setup
-          - sso
-          - startup
-          - store-api
-          - sync
-          - system
-          - task
-          - task-history
-          - testing-api
-          - tiles
-          - timeline
-          - types
-          - upload
-          - user-key-value
-          - users
-          - util
-          - version
-          - view-log
-          - warehouse-schema
-          - warehouses
-          - xrays
+        modules: ${{ fromJson(needs.setup-oss.outputs.modules) }}
     steps:
       - uses: actions/checkout@v4
       - name: Prepare front-end environment
@@ -112,7 +44,7 @@ jobs:
         uses: ./.github/actions/prepare-backend
 
       - name: Build static viz frontend
-        run: yarn build-static-viz
+        run: bun run build-static-viz
         env:
           MB_EDITION: ee
       - name: Collect the test coverage
@@ -130,7 +62,19 @@ jobs:
           files: ./target/coverage/codecov.json
           flags: back-end
 
+  setup-ee:
+    runs-on: ubuntu-22.04
+    outputs:
+      modules: ${{ steps.get-modules.outputs.modules }}
+    steps:
+      - uses: actions/checkout@v4
+      - id: get-modules
+        run: |
+          modules=$(ls -1d enterprise/backend/src/metabase_enterprise/*/ | xargs -n1 basename | tr '_' '-' | jq -R -s -c 'split("\n") | map(select(length > 0))')
+          echo "modules=$modules" >> $GITHUB_OUTPUT
+
   be-linter-cloverage-enterprise:
+    needs: setup-ee
     # don't run this workflow on a cron for forks
     if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
     runs-on: ubuntu-22.04
@@ -138,53 +82,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        modules:
-          - action-v2
-          - advanced-config
-          - advanced-permissions
-          - ai-entity-analysis
-          - ai-sql-fixer
-          - ai-sql-generation
-          - analytics
-          - api
-          - audit-app
-          - auth-provider
-          - billing
-          - bookmarks
-          - cache
-          - cloud-add-ons
-          - comments
-          - content-translation
-          - content-verification
-          - core
-          - dashboard-subscription-filters
-          - database-replication
-          - database-routing
-          - dependencies
-          - documents
-          - email
-          - embedding-hub
-          - gsheets
-          - harbormaster
-          - impersonation
-          - internal-stats
-          - llm
-          - metabot-v3
-          - permission-debug
-          - premium-features
-          - public-sharing
-          - remote-sync
-          - sandbox
-          - scim
-          - search
-          - semantic-search
-          - serialization
-          - snippet-collections
-          - sso
-          - stale
-          - transforms
-          - transforms-python
-          - upload-management
+        modules: ${{ fromJson(needs.setup-ee.outputs.modules) }}
     steps:
       - uses: actions/checkout@v4
       - name: Prepare front-end environment
@@ -193,7 +91,7 @@ jobs:
         uses: ./.github/actions/prepare-backend
 
       - name: Build static viz frontend
-        run: yarn build-static-viz
+        run: bun run build-static-viz
         env:
           MB_EDITION: ee
       - name: Collect the test coverage

.github/workflows/backend.yml

@@ -39,7 +39,7 @@ jobs:
   be-tests:
     if: ${{ !inputs.skip }}
     runs-on: ubuntu-22.04
-    timeout-minutes: 60
+    timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
@@ -104,7 +104,7 @@ jobs:
         with:
           java-version: "${{ matrix.java-version }}"
       - name: Build static-viz frontend
-        run: yarn build-static-viz
+        run: bun run build-static-viz
         env:
           MB_EDITION: ${{ matrix.job.edition }}
 
@@ -130,6 +130,7 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.run-java-tests.outcome }}
 
       - name: Publish Test Report (JUnit)
         uses: dorny/test-reporter@v1

.github/workflows/build-for-release.yml

@@ -19,9 +19,11 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          sparse-checkout: release
-      - name: Prepare build scripts
-        run: cd ${{ github.workspace }}/release && yarn && yarn build
+          sparse-checkout: |
+            release
+            .github
+      - name: Prepare release scripts
+        uses: ./.github/actions/prepare-release-scripts
       - name: Send build start message
         uses: actions/github-script@v7
         env:
@@ -79,9 +81,11 @@ jobs:
         exit 1
     - uses: actions/checkout@v4
       with:
-        sparse-checkout: release
-    - name: Prepare build scripts
-      run: cd ${{ github.workspace }}/release && yarn && yarn build
+        sparse-checkout: |
+          release
+          .github
+    - name: Prepare release scripts
+      uses: ./.github/actions/prepare-release-scripts
     - name: Get Release Version
       uses: actions/github-script@v7
       id: canonical_version
@@ -121,9 +125,11 @@ jobs:
       uses: actions/checkout@v4
       with:
         fetch-depth: 0  # IMPORTANT! to get all the branches
-        sparse-checkout: release
-    - name: Prepare build scripts
-      run: cd ${{ github.workspace }}/release && yarn && yarn build
+        sparse-checkout: |
+          release
+          .github
+    - name: Prepare release scripts
+      uses: ./.github/actions/prepare-release-scripts
     - name: Get Release Branch
       uses: actions/github-script@v7
       id: release_branch
@@ -135,12 +141,13 @@ jobs:
           const releaseBranch = getReleaseBranch(version);
           return releaseBranch;
     - name: Ensure that the specified commit exists in the ${{ steps.release_branch.outputs.result }} release branch
-      run: |
+      run: | # bash
         RELEASE_BRANCH=${{ steps.release_branch.outputs.result }}
         git checkout $RELEASE_BRANCH
         git branch --contains ${{ inputs.commit }} | grep -q $RELEASE_BRANCH \
           && echo "Commit found in correct release branch" \
           || (echo "Commit not found in correct release branch" && exit 1)
+        git checkout -
 
   get-build-requirements:
     runs-on: ubuntu-22.04
@@ -152,9 +159,11 @@ jobs:
     steps:
     - uses: actions/checkout@v4
       with:
-        sparse-checkout: release
-    - name: Prepare build scripts
-      run: cd ${{ github.workspace }}/release && yarn && yarn build
+        sparse-checkout: |
+          release
+          .github
+    - name: Prepare release scripts
+      uses: ./.github/actions/prepare-release-scripts
     - name: Get build dependencies
       uses: actions/github-script@v7
       id: dependencies

.github/workflows/cache-generator.yml

@@ -82,7 +82,7 @@ jobs:
 
       # Frontend preparation and caches
       # `prepare-frontend` action (1) prepares Node.js and (2) fetches the node_modules cache if it exists.
-      # It then (3) runs `yarn install --frozen-lockfile --prefer-offline` which ensures the local cache is fully populated.
+      # It then (3) runs `bun install --frozen-lockfile` which ensures the local cache is fully populated.
       # IMPORTANT: Caching node_modules after patches are already applied will break any PR that attempts to either:
       #   - upgrade a patched library
       #   - change a patch
@@ -92,31 +92,31 @@ jobs:
         with:
           apply-patches: "false"
 
-      - name: Get yarn cache directory
-        id: yarn-cache-dir
+      - name: Get bun cache directory
+        id: bun-cache
         run: |
-          YARN_CACHE_DIR=$(yarn cache dir)
-          echo "Yarn cache directory: $YARN_CACHE_DIR"
-          echo "dir=$YARN_CACHE_DIR" >> $GITHUB_OUTPUT
+          BUN_CACHE_DIR=$(bun pm cache)
+          echo "Bun cache directory: $BUN_CACHE_DIR"
+          echo "dir=$BUN_CACHE_DIR" >> $GITHUB_OUTPUT
 
       - name: Ensure that Cypress executable is ready
         run: |
-          yarn cypress install
-          yarn cypress cache path
-          yarn cypress cache list
-          yarn cypress verify
+          bun run cypress install
+          bun run cypress cache path
+          bun run cypress cache list
+          bun run cypress verify
         shell: bash
 
       # Run Prettier to populate its cache (stored in node_modules/.cache/prettier)
       # so it gets saved as part of the node_modules cache below
       - name: Run Prettier to populate cache
-        run: yarn lint-prettier-pure
+        run: bun run lint-prettier-pure
 
       - name: Update node_modules cache
         uses: ./.github/actions/update-cache
         with:
           path: |
-            ${{ steps.yarn-cache-dir.outputs.dir }}
+            ${{ steps.bun-cache.outputs.dir }}
             node_modules
           key: ${{ env.NODE_CACHE_KEY }}
 
@@ -128,10 +128,10 @@ jobs:
 
       # ESLint cache (requires both backend and frontend)
       - name: Compile CLJS
-        run: yarn build-pure:cljs
+        run: bun run build-pure:cljs
 
       - name: Run ESLint to populate cache
-        run: yarn lint-eslint-pure
+        run: bun run lint-eslint-pure
 
       - name: Update eslint cache
         uses: ./.github/actions/update-cache

.github/workflows/check-milestone.yml

@@ -26,11 +26,13 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          sparse-checkout: release
+          sparse-checkout: |
+            release
+            .github
           fetch-depth: ${{ env.isNewReleaseBranch == 'false' && 3 || 0 }} # we need the full history to get all the commit messages
           ref: master # we want the logic from master, even though we're triggering on a release branch
-      - name: Prepare build scripts
-        run: cd ${{ github.workspace }}/release && yarn && yarn build
+      - name: Prepare release scripts
+        uses: ./.github/actions/prepare-release-scripts
       - uses: actions/github-script@v7
         if: ${{ env.isNewReleaseBranch == 'false' }}
         name: Set milestone for single commit

.github/workflows/chromatic.yml

@@ -41,7 +41,7 @@ jobs:
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
       - name: Compile CLJS
-        run: NODE_ENV=development yarn build-pure:cljs
+        run: NODE_ENV=development bun run build-pure:cljs
       - name: Publish to Chromatic
         uses: chromaui/action@v10.2.0
         env:

.github/workflows/claude-code-bug-fix.yml

@@ -70,6 +70,31 @@ jobs:
               core.setFailed(error.message);
             }
 
+      - name: Find linked Linear issue
+        id: find_linear
+        continue-on-error: true
+        uses: actions/github-script@v7
+        env:
+          LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}
+          ISSUE_NUMBER: ${{ steps.get_issue.outputs.issue_number }}
+        with:
+          script: |
+            const { findLinearIssue } = require('${{ github.workspace }}/.github/scripts/find-linear-issue.js');
+
+            const githubIssueUrl = `https://github.com/${context.repo.owner}/${context.repo.repo}/issues/${process.env.ISSUE_NUMBER}`;
+
+            const result = await findLinearIssue({
+              githubIssueUrl,
+              linearApiKey: process.env.LINEAR_API_KEY
+            });
+
+            if (result.success) {
+              console.log(`Found Linear issue: ${result.issue}`);
+              core.setOutput('linear_issue', result.issue);
+            } else {
+              console.log(`Could not find Linear issue: ${result.message}`);
+            }
+
       - name: Set up git configuration
         run: |
           git config --global user.name "Claude Code[bot]"
@@ -205,6 +230,12 @@ jobs:
           mkdir -p .claude-scratchpad
           echo "Scratchpad directory created for Claude's temporary verification files"
 
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+
       - name: Generate GitHub App Token for Claude
         uses: actions/create-github-app-token@v1
         id: claude-app-token
@@ -219,7 +250,7 @@ jobs:
           github_token: ${{ steps.claude-app-token.outputs.token }}
           prompt: ${{ env.BUG_FIX_PROMPT }}
           claude_args: |
-            --allowedTools "Bash(yarn test-unit*),Bash(yarn lint-eslint-pure),Bash(./bin/mage*),Bash(clojure*),Bash(find*),Bash(ls*),Bash(grep*),Write,Read,Glob,Grep,Edit,MultiEdit"
+            --allowedTools "Bash(bun run test-unit*),Bash(bun run lint-eslint-pure),Bash(./bin/mage*),Bash(clojure*),Bash(find*),Bash(ls*),Bash(grep*),Write,Read,Glob,Grep,Edit,MultiEdit"
             --disallowedTools "Bash(git commit*),Bash(git push*),Bash(gh*)"
 
       - name: Clean up scratchpad directory
@@ -259,6 +290,7 @@ jobs:
             core.setOutput('reviewers', issueCreator);
 
       - name: Create Pull Request
+        id: create_pr
         if: steps.check_changes.outputs.has_changes == 'true'
         uses: peter-evans/create-pull-request@v6
         with:
@@ -279,6 +311,8 @@ jobs:
           body: |
             This PR automatically fixes the bug reported in #${{ env.ISSUE_NUMBER }}.
 
+            ${{ steps.find_linear.outputs.linear_issue && format('Closes {0}', steps.find_linear.outputs.linear_issue) || '' }}
+
             ## Bug Report
             **Original Issue:** #${{ env.ISSUE_NUMBER }}
             **Reporter:** @${{ env.ISSUE_AUTHOR }}
@@ -299,7 +333,6 @@ jobs:
             - If issues are found, either fix them or close this PR
 
             ---
-            Closes #${{ env.ISSUE_NUMBER }}
 
             🤖 Generated with [Claude Code](https://claude.ai/code)
 
@@ -309,6 +342,7 @@ jobs:
             automated-fix
             ci skip
           reviewers: ${{ steps.prepare_reviewers.outputs.reviewers }}
+          assignees: ${{ github.actor }}
 
       - name: Log existing branch update
         if: steps.check_changes.outputs.has_changes == 'true' && env.BRANCH_EXISTS == 'true'

.github/workflows/claude-code-review.yaml

@@ -1,98 +0,0 @@
-name: "Claude Code Review"
-
-on:
-  pull_request:
-    types:
-      - closed
-      - synchronize
-      - labeled
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}-claude-code-review
-  cancel-in-progress: true
-
-jobs:
-  review:
-    if: |
-      (
-        github.event.action == 'closed' &&
-        github.event.pull_request.merged == true
-      ) ||
-      contains(github.event.pull_request.labels.*.name, 'Claude Code Review')
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: write
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 1
-          # Make sure the value of GITHUB_TOKEN will not be persisted in repo's config
-          persist-credentials: false
-
-      # Apparently comments on specific lines and top-level comments about the PR as a whole are TWO TOTALLY DIFFERENT
-      # TYPES OF THINGS. So we have to fetch and delete separately.
-      - name: Delete old Claude PR review comments
-        env:
-          GH_TOKEN: ${{ github.token }}
-          REPO: ${{ github.repository }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-        shell: bash
-        run: |
-          # Get old comment IDs from the bot
-          old_line_comment_ids=$(gh api "/repos/$REPO/pulls/$PR_NUMBER/comments" --jq '.[] | select(.user.login=="metabase-bot[bot]") | .id')
-          echo "Deleting line comments: $old_line_comment_ids"
-          # Delete each comment
-          for id in $old_line_comment_ids; do
-            gh api -X DELETE "/repos/$REPO/pulls/comments/$id"
-            echo "Deleted line comment $id"
-          done
-          # Get old top-level comment IDs (technically "issue" comments on the PR?)
-          old_top_level_comment_ids=$(gh api "/repos/$REPO/issues/$PR_NUMBER/comments" --jq '.[] | select(.user.login=="metabase-bot[bot]") | .id')
-          echo "Deleting top-level comments: $old_top_level_comment_ids"
-          # Delete each comment
-          for id in $old_top_level_comment_ids; do
-            gh api -X DELETE "/repos/$REPO/issues/comments/$id"
-            echo "Deleted top-level comment $id"
-          done
-
-      - name: Generate GitHub App Token for Claude
-        uses: actions/create-github-app-token@v1
-        id: claude-app-token
-        with:
-          app-id: ${{ secrets.METABASE_BOT_APP_ID }}
-          private-key: ${{ secrets.METABASE_BOT_APP_PRIVATE_KEY }}
-          permission-contents: read       # Required for reading repository files and PR diffs
-          permission-pull-requests: write # Required for creating inline comments and PR comments
-
-      - name: Fetch Community Clojure Style Guide
-        run: >-
-          curl https://raw.githubusercontent.com/bbatsov/clojure-style-guide/refs/heads/master/README.adoc -o CLOJURE_STYLE_GUIDE.adoc
-
-      - uses: anthropics/claude-code-action@v1
-        timeout-minutes: 10
-        with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-          github_token: ${{ steps.claude-app-token.outputs.token }}
-          prompt: |
-            REPO: ${{ github.repository }}
-            PR NUMBER: ${{ github.event.pull_request.number }}
-
-            Review this pull request for compliance with project coding standards and conventions.
-
-            **Use the appropriate review skill based on the file types changed:**
-            - Use clojure-review for Clojure/ClojureScript files
-            - Use typescript-review for TypeScript/JavaScript files
-            - Follow the review guidelines and checklists in each skill
-
-            DO NOT post any comments confirming that something is correct - only post comments for style violations or concerns.
-
-            Note: The PR branch is already checked out in the current working directory.
-
-            Use `gh pr comment` for top-level feedback.
-            Use `mcp__github_inline_comment__create_inline_comment` to highlight specific code issues.
-            Only post GitHub comments - don't submit review text as messages.
-
-          claude_args: |
-            --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),ReadFile(CLOJURE_STYLE_GUIDE.adoc)"

.github/workflows/claude-docs-review.yml

@@ -1,103 +0,0 @@
-name: "Claude Docs Review"
-
-on:
-  pull_request:
-    types:
-      - opened
-      - synchronize
-      - reopened
-    paths:
-      - 'docs/**/*.md'
-      - 'docs/**/*.mdx'
-  workflow_dispatch:
-    inputs:
-      pr_number:
-        description: 'PR number to review'
-        required: true
-        type: number
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}-claude-docs-review
-  cancel-in-progress: true
-
-jobs:
-  review:
-    runs-on: ubuntu-latest
-    if: github.event.pull_request.draft == false
-    permissions:
-      contents: read
-      pull-requests: write
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 1
-          # Make sure the value of GITHUB_TOKEN will not be persisted in repo's config
-          persist-credentials: false
-
-      - name: Generate GitHub App Token for Claude
-        uses: actions/create-github-app-token@v1
-        id: claude-app-token
-        with:
-          app-id: ${{ secrets.METABASE_BOT_APP_ID }}
-          private-key: ${{ secrets.METABASE_BOT_APP_PRIVATE_KEY }}
-          permission-contents: read       # Required for reading repository files and PR diffs
-          permission-pull-requests: write # Required for creating inline comments and PR comments
-
-      - name: Delete old Claude docs review comments
-        env:
-          GH_TOKEN: ${{ steps.claude-app-token.outputs.token }}
-          REPO: ${{ github.repository }}
-          PR_NUMBER: ${{ github.event.pull_request.number || github.event.inputs.pr_number }}
-        shell: bash
-        run: |
-          # Delete pending reviews first (these can be deleted entirely)
-          pending_review_ids=$(gh api "/repos/$REPO/pulls/$PR_NUMBER/reviews" --jq '.[] | select(.user.login=="metabase-bot[bot]" and .state=="PENDING") | .id')
-          if [ -n "$pending_review_ids" ]; then
-            echo "Deleting pending reviews: $pending_review_ids"
-            for id in $pending_review_ids; do
-              gh api -X DELETE "/repos/$REPO/pulls/$PR_NUMBER/reviews/$id"
-              echo "Deleted pending review $id"
-            done
-          fi
-
-          # Delete individual inline comments from submitted reviews (can't delete the review itself)
-          old_line_comment_ids=$(gh api "/repos/$REPO/pulls/$PR_NUMBER/comments" --jq '.[] | select(.user.login=="metabase-bot[bot]") | .id')
-          if [ -n "$old_line_comment_ids" ]; then
-            echo "Deleting line comments: $old_line_comment_ids"
-            for id in $old_line_comment_ids; do
-              gh api -X DELETE "/repos/$REPO/pulls/comments/$id"
-              echo "Deleted line comment $id"
-            done
-          fi
-
-          # Delete top-level review comments
-          old_top_level_comment_ids=$(gh api "/repos/$REPO/issues/$PR_NUMBER/comments" --jq '.[] | select(.user.login=="metabase-bot[bot]") | .id')
-          if [ -n "$old_top_level_comment_ids" ]; then
-            echo "Deleting top-level comments: $old_top_level_comment_ids"
-            for id in $old_top_level_comment_ids; do
-              gh api -X DELETE "/repos/$REPO/issues/comments/$id"
-              echo "Deleted top-level comment $id"
-            done
-          fi
-
-      - uses: anthropics/claude-code-action@v1
-        timeout-minutes: 10
-        with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-          github_token: ${{ steps.claude-app-token.outputs.token }}
-          show_full_output: true
-          prompt: |
-            REPO: ${{ github.repository }}
-            PR NUMBER: ${{ github.event.pull_request.number || github.event.inputs.pr_number }}
-
-            Review the documentation changes in this pull request.
-
-            Use the docs-review skill to review all changed documentation files for compliance with the Metabase writing style guide.
-
-            IMPORTANT: Only review markdown files (.md and .mdx). Skip any .txt files or other non-markdown files.
-
-            DO NOT post any comments confirming that something is correct - only post comments for style violations or concerns.
-
-          claude_args: |
-            --allowedTools "Skill,mcp__github__get_pull_request,mcp__github__get_pull_request_files,mcp__github__create_pending_pull_request_review,mcp__github__get_pull_request_diff,mcp__github__add_comment_to_pending_review,mcp__github__add_pull_request_review_comment_to_pending_review,mcp__github__delete_pending_pull_request_review,mcp__github__submit_pending_pull_request_review"

.github/workflows/clean-cache.yml

@@ -1,33 +0,0 @@
-name: Cleanup caches by a branch
-on:
-  pull_request:
-    types:
-      - closed
-
-jobs:
-  cleanup:
-    runs-on: ubuntu-22.04
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v4
-
-      - name: Cleanup
-        run: |
-          gh extension install actions/gh-actions-cache
-
-          REPO=${{ github.repository }}
-          BRANCH="refs/pull/${{ github.event.pull_request.number }}/merge"
-
-          echo "Fetching list of cache key"
-          cacheKeysForPR=$(gh actions-cache list -R $REPO -B $BRANCH | cut -f 1 )
-
-          ## Setting this to not fail the workflow while deleting cache keys.
-          set +e
-          echo "Deleting caches..."
-          for cacheKey in $cacheKeysForPR
-          do
-              gh actions-cache delete $cacheKey -R $REPO -B $BRANCH --confirm
-          done
-          echo "Done"
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/cljs.yml

@@ -39,4 +39,4 @@ jobs:
     - name: Prepare back-end environment
       uses: ./.github/actions/prepare-backend
     - name: Run Cljs tests
-      run: yarn run test-cljs
+      run: bun run test-cljs

.github/workflows/codespell.yml

@@ -1,23 +1,110 @@
 name: Codespell
 
 on:
-  push:
-    branches:
-      - "master"
-      - "release-**"
-  pull_request:
+  schedule:
+    # Run nightly at 4:00 AM UTC
+    - cron: "0 4 * * *"
+  workflow_dispatch:
 
 jobs:
   codespell:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
       - uses: actions/checkout@v4
-      - uses: codespell-project/actions-codespell@v2
+
+      - name: Install codespell
+        run: pip install codespell
+
+      - name: Set up git configuration
+        run: |
+          git config --global user.name "Claude Code[bot]"
+          git config --global user.email "noreply@anthropic.com"
+
+      - name: Get current date
+        id: date
+        run: echo "date=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT
+
+      - name: Run codespell check
+        id: codespell_check
+        continue-on-error: true
+        run: |
+          set -o pipefail
+          ./bin/mage codespell 2>&1 | tee codespell_output.txt
+
+      - name: Generate GitHub App Token for Claude
+        if: steps.codespell_check.outcome == 'failure'
+        uses: actions/create-github-app-token@v1
+        id: claude-app-token
         with:
-          # keep this list in sync with the list in `mage/src/mage/codespell.clj`
-          path: >-
-            docs
-            enterprise
-            frontend
-            modules/drivers
-            src
+          app-id: ${{ secrets.METABASE_BOT_APP_ID }}
+          private-key: ${{ secrets.METABASE_BOT_APP_PRIVATE_KEY }}
+
+      - name: Fix spelling errors with Claude Code
+        if: steps.codespell_check.outcome == 'failure'
+        uses: anthropics/claude-code-action@v1
+        with:
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          github_token: ${{ steps.claude-app-token.outputs.token }}
+          prompt: |
+            You are tasked with fixing spelling errors detected by codespell in this repository.
+
+            ## Codespell Output
+            The following spelling errors were detected:
+            ```
+            $(cat codespell_output.txt)
+            ```
+
+            ## Instructions
+            1. **Review the codespell output and identify reported spelling errors** - The usual format codespell uses is `typo ==> correction`
+            2. **Fix every spelling error** - Use the Edit tool to fix each misspelling with the suggested correction
+               - If codespell suggests multiple corrections, choose the most appropriate one based on context
+
+            Human reviewers will verify the changes before merging, so fix all errors reported by codespell.
+          claude_args: |
+            --allowedTools "Write,Read,Glob,Grep,Edit,MultiEdit,Bash(cat*),Bash(ls*)"
+            --disallowedTools "Bash(git commit*),Bash(git push*),Bash(gh*)"
+
+      - name: Clean up temporary files
+        if: steps.codespell_check.outcome == 'failure'
+        run: rm -f codespell_output.txt
+
+      - name: Create Pull Request
+        if: steps.codespell_check.outcome == 'failure'
+        uses: peter-evans/create-pull-request@v6
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          branch: claude-fix/codespell-${{ steps.date.outputs.date }}
+          base: master
+          delete-branch: true
+          commit-message: |
+            Fix spelling errors detected by codespell (${{ steps.date.outputs.date }})
+
+            🤖 Generated with [Claude Code](https://claude.ai/code)
+
+            Co-Authored-By: Claude <noreply@anthropic.com>
+          committer: "Claude Code[bot] <noreply@anthropic.com>"
+          author: "Claude Code[bot] <noreply@anthropic.com>"
+          title: "Fix spelling errors detected by codespell (${{ steps.date.outputs.date }})"
+          body: |
+            This PR automatically fixes spelling errors detected by the scheduled codespell check.
+
+            ## Automated Fix
+            🤖 This fix was generated automatically by Claude Code based on codespell output.
+
+            **Please review carefully:**
+            - [ ] The spelling fixes are correct
+            - [ ] No code functionality was changed
+            - [ ] Technical terms were preserved correctly
+
+            ---
+
+            🤖 Generated with [Claude Code](https://claude.ai/code)
+
+            Co-Authored-By: Claude <noreply@anthropic.com>
+          labels: |
+            automated-fix
+            backport

.github/workflows/containerize-jar.yml

@@ -4,8 +4,10 @@ run-name: Containerize ${{ inputs.tag }} Uberjar
 on:
   workflow_call:
     inputs:
-      artifact-name:
+      edition:
+        description: Metabase edition (ee or oss)
         type: string
+        required: true
       repo:
         description: owner and repo like "metabase/metabase"
         type: string
@@ -15,14 +17,18 @@ on:
         type: string
       release:
         type: string
-        default: 'true'
+        default: 'false'
       build-args:
         type: string
   workflow_dispatch:
     inputs:
-      artifact-name:
-        description: usually something like "metabase-release-{{ edition }}-{{ hash }}-uberjar"
-        type: string
+      edition:
+        description: Metabase edition (ee or oss)
+        type: choice
+        options:
+          - ee
+          - oss
+        required: true
       repo:
         description: docker owner and repo like "metabase/metabase"
         type: string
@@ -32,6 +38,13 @@ on:
       commit:
         description: the full commit hash
         type: string
+      release:
+        description: Whether this is a release artifact (uses metabase-release- prefix)
+        type: choice
+        options:
+          - "false"
+          - "true"
+        default: "false"
 
 jobs:
   containerize:
@@ -45,12 +58,14 @@ jobs:
         fetch-depth: 0
       # we want the dockerfile from the commit we're building
     - run: git checkout ${{ inputs.commit }} -- bin/docker
-    - name: Retrieve test build uberjar artifact
+    - name: Retrieve uberjar artifact
       uses: ./.github/actions/fetch-artifact
       with:
-        name: ${{ inputs.artifact-name }}
-    - name: Prepare build scripts
-      run: cd ${{ github.workspace }}/release && yarn && yarn build
+        commit: ${{ inputs.commit }}
+        edition: ${{ inputs.edition }}
+        release: ${{ inputs.release }}
+    - name: Prepare release scripts
+      uses: ./.github/actions/prepare-release-scripts
     - name: Get platforms
       id: platforms
       uses: actions/github-script@v7

.github/workflows/containerize-uberjar.yml

@@ -55,13 +55,13 @@ jobs:
     uses: ./.github/workflows/containerize-jar.yml
     secrets: inherit
     with:
-      artifact-name: metabase-${{ matrix.edition }}-${{ github.event.inputs.commit || github.event.pull_request.head.sha || github.sha }}-uberjar
-      commit: ${{ github.event.inputs.commit || github.sha }}
+      edition: ${{ matrix.edition }}
+      commit: ${{ github.event.inputs.commit || github.event.pull_request.head.sha || github.sha }}
       repo: ${{ fromJson(needs.get-container-info.outputs[matrix.edition]).repo }}
       tag: ${{ fromJson(needs.get-container-info.outputs[matrix.edition]).tag }}
       release: "false"
       build-args: |
-        GIT_COMMIT_SHA=${{ github.event.inputs.commit || github.sha }}
+        GIT_COMMIT_SHA=${{ github.event.inputs.commit || github.event.pull_request.head.sha || github.sha }}
 
   run-trivy:
     needs: [get-container-info, containerize]
@@ -74,7 +74,7 @@ jobs:
       - name: Check out the code
         uses: actions/checkout@v4
         with:
-          ref: ${{ github.event.inputs.commit || github.sha }}
+          ref: ${{ github.event.inputs.commit || github.event.pull_request.head.sha || github.sha }}
       - name: Run Trivy vulnerability scanner
         uses: aquasecurity/trivy-action@0.29.0
         env:

.github/workflows/coverage.yml

@@ -17,7 +17,7 @@ jobs:
         uses: ./.github/actions/prepare-backend
       - name: Run frontend unit tests
         run: |
-          yarn run test-unit \
+          bun run test-unit \
             --silent \
             --coverage \
             --testTimeout=60000

.github/workflows/drivers.yml

@@ -72,7 +72,7 @@ jobs:
           # All decision logic is in mage - it analyzes module dependencies,
           # branch context, labels, and file changes to decide what runs.
           MAGE_ARGS=(
-            --git-ref="${{ github.event.pull_request.base.ref || 'master' }}"
+            --git-ref="${{ github.event.pull_request.base.ref || github.ref_name }}"
             --is-master-or-release="${{ github.ref_name == 'master' || startsWith(github.ref_name, 'release-') }}"
             --pr-labels="${{ join(github.event.pull_request.labels.*.name, ',') }}"
             --skip="${{ inputs.skip }}"
@@ -87,7 +87,7 @@ jobs:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.athena-should-run == 'true' || needs.determine-driver-skips.outputs.athena-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
-    timeout-minutes: 60
+    timeout-minutes: 40
     env:
       CI: 'true'
       DRIVERS: athena
@@ -132,6 +132,7 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   be-tests-bigquery-cloud-sdk-ee:
     needs: determine-driver-skips
@@ -146,6 +147,7 @@ jobs:
             test-args: >-
               :only-tags [:mb/driver-tests]
               :exclude-tags [:mb/transforms-python-test]
+              :fail-fast? true
 # DS 2025-09-26 temporarily disabled while we diagnose flakes
 #          - name: Transforms Python Tests
 #            test-args: >-
@@ -197,6 +199,7 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -208,7 +211,7 @@ jobs:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.clickhouse-should-run == 'true' || needs.determine-driver-skips.outputs.clickhouse-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
-    timeout-minutes: 60
+    timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
@@ -279,6 +282,7 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -290,7 +294,7 @@ jobs:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.druid-should-run == 'true' || needs.determine-driver-skips.outputs.druid-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
-    timeout-minutes: 60
+    timeout-minutes: 40
     env:
       CI: 'true'
       DRIVERS: druid
@@ -333,12 +337,13 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   be-tests-druid-jdbc-ee:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.druid-jdbc-should-run == 'true' || needs.determine-driver-skips.outputs.druid-jdbc-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
-    timeout-minutes: 60
+    timeout-minutes: 40
     env:
       CI: 'true'
       DRIVERS: druid-jdbc
@@ -381,12 +386,13 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   be-tests-databricks-ee:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.databricks-should-run == 'true' || needs.determine-driver-skips.outputs.databricks-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
-    timeout-minutes: 60
+    timeout-minutes: 40
     env:
       CI: 'true'
       DRIVERS: databricks
@@ -429,12 +435,13 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   be-tests-databricks-multi-catalog-ee:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.databricks-should-run == 'true' || needs.determine-driver-skips.outputs.databricks-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
-    timeout-minutes: 60
+    timeout-minutes: 40
     env:
       CI: 'true'
       DRIVERS: databricks
@@ -478,12 +485,13 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   be-tests-h2:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.h2-should-run == 'true' }}
     runs-on: ubuntu-latest
-    timeout-minutes: 60
+    timeout-minutes: 40
     env:
       CI: 'true'
     name: H2
@@ -508,12 +516,45 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+
+  be-tests-h2-oss:
+    needs: determine-driver-skips
+    if: ${{ needs.determine-driver-skips.outputs.h2-should-run == 'true' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 40
+    env:
+      CI: 'true'
+    name: H2 (OSS)
+    steps:
+    - uses: actions/checkout@v4
+    - name: Test H2 driver (OSS)
+      id: test-driver
+      uses: ./.github/actions/test-driver
+      with:
+        junit-name: 'be-tests-h2-oss'
+        edition: 'oss'
+        test-args: >-
+          :only-tags [:mb/driver-tests]
+          :exclude-tags [:mb/transforms-python-test]
+    - name: Upload Test Results
+      uses: ./.github/actions/upload-test-results
+      if: always()
+      with:
+        input-path: ./target/junit/
+        output-name: ${{ github.job }}
+        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        aws-region: ${{ vars.AWS_REGION }}
+        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   be-tests-mysql-mariadb:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.mysql-mariadb-should-run == 'true' }}
     runs-on: ubuntu-latest
-    timeout-minutes: 60
+    timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
@@ -638,6 +679,7 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
       - name: Cleanup python-runner
         if: always()
         uses: ./.github/actions/cleanup-python-runner
@@ -649,7 +691,7 @@ jobs:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.mongo-should-run == 'true' || needs.determine-driver-skips.outputs.mongo-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
-    timeout-minutes: 60
+    timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
@@ -718,6 +760,7 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -729,7 +772,7 @@ jobs:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.mongo-ssl-should-run == 'true' || needs.determine-driver-skips.outputs.mongo-ssl-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
-    timeout-minutes: 60
+    timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
@@ -800,12 +843,13 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   be-tests-mongo-sharded-cluster-ee:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.mongo-sharded-cluster-should-run == 'true' || needs.determine-driver-skips.outputs.mongo-sharded-cluster-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
-    timeout-minutes: 60
+    timeout-minutes: 40
     env:
       CI: 'true'
       DRIVERS: mongo
@@ -845,12 +889,13 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   be-tests-oracle:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.oracle-should-run == 'true' || needs.determine-driver-skips.outputs.oracle-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
-    timeout-minutes: 60
+    timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
@@ -930,12 +975,13 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   be-tests-postgres:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.postgres-should-run == 'true' }}
     runs-on: ubuntu-latest
-    timeout-minutes: 60
+    timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
@@ -1019,6 +1065,7 @@ jobs:
         uses: ./.github/actions/test-driver
         with:
           junit-name: 'be-tests-${{ matrix.version.junit-name }}'
+          logs-artifact-suffix: ${{ matrix.version.name }}-${{ matrix.job.name }}
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[ ${{ matrix.job.exclude-tag }} ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
@@ -1033,6 +1080,7 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
       - name: Cleanup python-runner
         if: always()
         uses: ./.github/actions/cleanup-python-runner
@@ -1044,7 +1092,7 @@ jobs:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.presto-jdbc-should-run == 'true' || needs.determine-driver-skips.outputs.presto-jdbc-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
-    timeout-minutes: 60
+    timeout-minutes: 40
     env:
       CI: 'true'
       DRIVERS: presto-jdbc
@@ -1120,12 +1168,13 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   be-tests-redshift-ee:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.redshift-should-run == 'true' || needs.determine-driver-skips.outputs.redshift-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
-    timeout-minutes: 60
+    timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
@@ -1204,6 +1253,7 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -1224,6 +1274,7 @@ jobs:
             test-args: >-
               :only-tags [:mb/driver-tests]
               :exclude-tags [:mb/transforms-python-test]
+              :fail-fast? true
 
 # DS 2025-09-26 temporarily disabled while we diagnose flakes
 #          - name: Transforms Python Tests
@@ -1285,6 +1336,7 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -1296,7 +1348,7 @@ jobs:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.sparksql-should-run == 'true' || needs.determine-driver-skips.outputs.sparksql-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
-    timeout-minutes: 60
+    timeout-minutes: 40
     env:
       CI: 'true'
       DRIVERS: sparksql
@@ -1337,12 +1389,13 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   be-tests-sqlite-ee:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.sqlite-should-run == 'true' || needs.determine-driver-skips.outputs.sqlite-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
-    timeout-minutes: 60
+    timeout-minutes: 40
     env:
       CI: 'true'
       DRIVERS: sqlite
@@ -1378,6 +1431,7 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   be-tests-sqlserver:
     needs: determine-driver-skips
@@ -1454,6 +1508,7 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -1466,7 +1521,7 @@ jobs:
   #   needs: determine-driver-skips
   #   if: ${{ !inputs.skip && !(needs.determine-driver-skips.outputs.skip == 'true') }}
   #   runs-on: ubuntu-latest
-  #   timeout-minutes: 60
+  #   timeout-minutes: 40
   #   env:
   #     CI: 'true'
   #     DRIVERS: starburst
@@ -1534,7 +1589,7 @@ jobs:
     needs: [determine-driver-skips, login-to-ecr]
     if: ${{ needs.determine-driver-skips.outputs.vertica-should-run == 'true' || needs.determine-driver-skips.outputs.vertica-quarantine-conflict == 'true' }}
     runs-on: ubuntu-latest
-    timeout-minutes: 60
+    timeout-minutes: 40
     env:
       CI: 'true'
       DRIVERS: vertica
@@ -1580,6 +1635,7 @@ jobs:
         aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   drivers-tests-result:
     needs:

.github/workflows/e2e-stress-test-flake-fix.yml

@@ -115,11 +115,15 @@ jobs:
 
       - name: Build Embedding SDK package
         if: ${{ needs.determine-test-type.outputs.type == 'component' }}
-        run: yarn build-embedding-sdk-package
+        run: bun run build-embedding-sdk-package
 
       - name: Prepare Cypress environment
         id: cypress-prep
         uses: ./.github/actions/prepare-cypress
+
+      - name: Compile CLJS
+        run: bun run build-pure:cljs
+
       - name: Run Metabase
         run: node e2e/runner/run_cypress_ci.js start
 

.github/workflows/e2e-test.yml

@@ -41,7 +41,7 @@ env:
 jobs:
   e2e-tests:
     runs-on: ${{ inputs.runner }}
-    timeout-minutes: 45
+    timeout-minutes: 40
     name: e2e-tests-${{ inputs.name }}-${{ inputs.edition }}
     env:
       MB_EDITION: ${{ inputs.edition }}
@@ -79,7 +79,8 @@ jobs:
       - name: Retrieve uberjar artifact for ${{ inputs.edition }}
         uses: ./.github/actions/fetch-artifact
         with:
-          name: metabase-${{ inputs.edition }}-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+          commit: ${{ github.event.pull_request.head.sha || github.sha }}
+          edition: ${{ inputs.edition }}
           extract-path: "target/uberjar"
           output-name: "metabase.jar"
 
@@ -104,6 +105,9 @@ jobs:
         if: github.run_attempt != '1'
         run: echo "specs=$(cat failed-specs)" >> $GITHUB_ENV
 
+      - name: Compile CLJS
+        run: bun run build-pure:cljs
+
       - name: Run Metabase
         run: node e2e/runner/run_cypress_ci.js start
 
@@ -167,6 +171,7 @@ jobs:
           # Related to Trunk uploader
           variant: e2e-tests
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ inputs.specs && steps.tagged-e2e.outcome || steps.split-e2e.outcome }}
 
       - name: Upload Cypress Artifacts upon failure
         uses: actions/upload-artifact@v4

.github/workflows/embedding-sdk-component-tests.yml

@@ -45,7 +45,8 @@ jobs:
       - name: Retrieve uberjar artifact for ee
         uses: ./.github/actions/fetch-artifact
         with:
-          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+          commit: ${{ github.event.pull_request.head.sha || github.sha }}
+          edition: ee
           extract-path: "target/uberjar"
           output-name: "metabase.jar"
 
@@ -80,6 +81,7 @@ jobs:
         run: ./bin/embedding-sdk/change-react-version.bash ${{ matrix.react-version }}
 
       - name: Run component tests for Embedding SDK
+        id: run-tests
         env:
           CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
         run: node e2e/runner/run_cypress_ci.js component
@@ -95,6 +97,7 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.run-tests.outcome }}
 
       - name: "SDK component tests > Upload Cypress Artifacts upon failure"
         uses: actions/upload-artifact@v4
@@ -194,7 +197,8 @@ jobs:
         id: download-uberjar
         uses: ./.github/actions/fetch-artifact
         with:
-          name: metabase-ee-${{ steps.get-commit-sha.outputs.sha }}-uberjar
+          commit: ${{ steps.get-commit-sha.outputs.sha }}
+          edition: ee
           extract-path: "target/uberjar"
           output-name: "metabase.jar"
         continue-on-error: true # do not break the whole job if this step doesn't succeed
@@ -228,6 +232,7 @@ jobs:
             --spec "e2e/snapshot-creators/default.cy.snap.js"
 
       - name: Run component tests for Embedding SDK
+        id: run-tests
         env:
           CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
         run: |
@@ -245,6 +250,7 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.run-tests.outcome }}
 
       - name: Upload Cypress Artifacts upon failure
         uses: actions/upload-artifact@v4

.github/workflows/embedding-sdk-host-sample-apps-tests.yml

@@ -9,7 +9,6 @@ env:
   TZ: US/Pacific # to make Node match the instance tz
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   HASH: ${{ github.event.pull_request.head.sha || github.sha }}-${{ github.run_attempt }}
-  PR_NUMBER: ${{ github.event.pull_request.number || '' }}
   MB_EDITION: ee
 jobs:
   get-sample-apps-data:
@@ -21,12 +20,7 @@ jobs:
       TEST_SUITES: |
         [
           "metabase-nodejs-react-sdk-embedding-sample-e2e",
-          "metabase-nextjs-sdk-embedding-sample-e2e",
-          "shoppy-e2e"
-        ]
-      TEST_SUITES_TO_RUN_IN_MASTER_ONLY: |
-        [
-          "shoppy-e2e"
+          "metabase-nextjs-sdk-embedding-sample-e2e"
         ]
       SAMPLE_APP_MAIN_BRANCH_NAME: "main"
       SAMPLE_APP_STABLE_RELEASE_BRANCH_NAME_SUFFIX: "stable"
@@ -36,8 +30,8 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Prepare build scripts
-        run: cd ${{ github.workspace }}/release && yarn && yarn build
+      - name: Prepare release scripts
+        uses: ./.github/actions/prepare-release-scripts
 
       - name: Build sample app compatibility data
         uses: actions/github-script@v7
@@ -50,7 +44,6 @@ jobs:
             } = require('${{ github.workspace }}/release/dist/index.cjs');
 
             const testSuites = JSON.parse(process.env.TEST_SUITES);
-            const testSuitesToRunInMasterOnly = JSON.parse(process.env.TEST_SUITES_TO_RUN_IN_MASTER_ONLY);
 
             const ref = '${{ github.base_ref || github.ref }}';
             const branchName = ref.replace(/^refs\/heads\//, '');
@@ -74,19 +67,16 @@ jobs:
               const sampleAppBranchName = `${currentBranchVersion}-${{ env.SAMPLE_APP_STABLE_RELEASE_BRANCH_NAME_SUFFIX }}`
 
               const shouldRunTestsForVersion = (currentReleaseVersion - currentBranchVersion) <= (supportedReleasesCount - 1);
-              const releaseBranchTestSuites = testSuites.filter(testSuite => !testSuitesToRunInMasterOnly.includes(testSuite));
 
               return {
                 branch_name: sampleAppBranchName,
-                matrix: shouldRunTestsForVersion
-                  ? releaseBranchTestSuites
-                  : []
+                matrix: shouldRunTestsForVersion ? testSuites : [],
               };
             }
 
             return {
               branch_name: '',
-              matrix: []
+              matrix: [],
             };
 
   # In order to check compatibility between Sample Apps and Embedding SDK, the job for each sample app:
@@ -137,7 +127,8 @@ jobs:
       - name: Retrieve uberjar artifact for ee
         uses: ./.github/actions/fetch-artifact
         with:
-          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+          commit: ${{ github.event.pull_request.head.sha || github.sha }}
+          edition: ee
           extract-path: "target/uberjar"
           output-name: "metabase.jar"
 
@@ -167,28 +158,8 @@ jobs:
             echo "sample_app_branch_exists=false" >> $GITHUB_OUTPUT
           fi
 
-      - name: Configure AWS credentials
-        if: ${{ matrix.test_suite == 'shoppy-e2e' }}
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          role-to-assume: ${{ secrets.SHOPPY_IAM_ROLE }}
-          role-session-name: GitHub_to_AWS_via_FederatedOIDC
-          aws-region: us-east-1
-
-      - name: Download Shoppy's App DB PostgreSQL dump from S3
-        if: ${{ matrix.test_suite == 'shoppy-e2e' }}
-        run: |
-          aws s3 cp s3://${{ secrets.SHOPPY_METABASE_APP_DB_S3_BUCKET }}/${{ secrets.SHOPPY_METABASE_APP_DB_S3_KEY }} ./e2e/tmp/db_dumps/shoppy_metabase_app_db_dump.sql
-
-      - name: Prepare and launch Sample Apps for shoppy-e2e test suite
-        if: ${{ steps.check-sample-app-branch.outputs.sample_app_branch_exists == 'true' && matrix.test_suite == 'shoppy-e2e' }}
-        env:
-          METABASE_APP_DB_USER: ${{ secrets.SHOPPY_METABASE_APP_DB_USER }}
-          METABASE_APP_DB: ${{ secrets.SHOPPY_METABASE_APP_DB_DATABASE }}
-        run: npx tsx ./e2e/runner/embedding-sdk/sample-apps/start-ci.ts shoppy-e2e
-
-      - name: Prepare and launch Sample Apps for other test suites
-        if: ${{ steps.check-sample-app-branch.outputs.sample_app_branch_exists == 'true' && matrix.test_suite != 'shoppy-e2e' }}
+      - name: Prepare and launch Sample Apps
+        if: ${{ steps.check-sample-app-branch.outputs.sample_app_branch_exists == 'true' }}
         run: npx tsx ./e2e/runner/embedding-sdk/sample-apps/start-ci.ts ${{ matrix.test_suite }}
 
       - name: Prune build cache
@@ -209,7 +180,7 @@ jobs:
         uses: actions/upload-artifact@v4
         if: ${{ steps.check-sample-app-branch.outputs.sample_app_branch_exists == 'true' && steps.run-e2e-tests.outcome != 'success' }}
         with:
-          name: cypress-recording-sample-app-${{ matrix.test_suite }}-latest
+          name: cypress-recording-sample-app-${{ matrix.test_suite }}-${{ matrix.environment }}-latest
           path: |
             ./e2e/tmp/${{ steps.get-sample-app-name.outputs.sample_app_name }}/cypress
           if-no-files-found: ignore
@@ -219,6 +190,149 @@ jobs:
         run: |
           exit 1
 
+  # Shoppy e2e tests run separately using the shared composite action for setup.
+  e2e-shoppy-tests:
+    needs: [get-sample-apps-data]
+    strategy:
+      matrix:
+        environment: ["production", "development"]
+    if: |
+      !cancelled() && needs.get-sample-apps-data.result == 'success' &&
+      (github.ref == 'refs/heads/master' || github.base_ref == 'master')
+    runs-on: ubuntu-22.04
+    timeout-minutes: 45
+    name: e2e-sample-app-shoppy-e2e-tests-${{ matrix.environment }}-bundle
+    env:
+      MB_EDITION: ee
+      MB_RUN_MODE: e2e
+      METASTORE_DEV_SERVER_URL: ${{ secrets.METASTORE_DEV_SERVER_URL }}
+      CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
+      SAMPLE_APP_BRANCH_NAME: ${{ needs.get-sample-apps-data.outputs.branch_name }}
+      SAMPLE_APP_ENVIRONMENT: ${{ matrix.environment }}
+    permissions:
+      id-token: write
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Prepare Shoppy E2E environment
+        uses: ./.github/actions/prepare-shoppy-e2e
+        id: shoppy-prep
+        with:
+          commit: ${{ github.event.pull_request.head.sha || github.sha }}
+          sample-app-branch-name: ${{ needs.get-sample-apps-data.outputs.branch_name }}
+          sample-app-environment: ${{ matrix.environment }}
+          staging-mb-all-features-token: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
+          shoppy-iam-role: ${{ secrets.SHOPPY_IAM_ROLE }}
+          shoppy-metabase-app-db-s3-bucket: ${{ secrets.SHOPPY_METABASE_APP_DB_S3_BUCKET }}
+          shoppy-metabase-app-db-s3-key: ${{ secrets.SHOPPY_METABASE_APP_DB_S3_KEY }}
+          shoppy-metabase-app-db-user: ${{ secrets.SHOPPY_METABASE_APP_DB_USER }}
+          shoppy-metabase-app-db-database: ${{ secrets.SHOPPY_METABASE_APP_DB_DATABASE }}
+          metastore-dev-server-url: ${{ secrets.METASTORE_DEV_SERVER_URL }}
+          shoppy-datadog-application-id: ${{ secrets.SHOPPY_METABASE_APP_DATADOG_APPLICATION_ID }}
+          shoppy-datadog-client-token: ${{ secrets.SHOPPY_METABASE_APP_DATADOG_CLIENT_TOKEN }}
+
+      - name: Run e2e tests for Shoppy
+        id: run-e2e-tests
+        if: ${{ steps.shoppy-prep.outputs.sample_app_branch_exists == 'true' }}
+        continue-on-error: true
+        env:
+          CYPRESS_BROWSER: ${{ steps.shoppy-prep.outputs.chrome-path }}
+        run: node e2e/runner/run_cypress_ci.js shoppy-e2e
+
+      - name: Upload Cypress Artifacts upon failure
+        uses: actions/upload-artifact@v4
+        if: ${{ steps.shoppy-prep.outputs.sample_app_branch_exists == 'true' && steps.run-e2e-tests.outcome != 'success' }}
+        with:
+          name: cypress-recording-sample-app-shoppy-e2e-${{ matrix.environment }}-latest
+          path: |
+            ./e2e/tmp/shoppy/cypress
+          if-no-files-found: ignore
+
+      - name: Fail job if tests failed
+        if: ${{ steps.shoppy-prep.outputs.sample_app_branch_exists == 'true' && steps.run-e2e-tests.outcome != 'success' }}
+        run: |
+          exit 1
+
+  # Synthetic monitoring tests run only on master merges, in parallel with the regular e2e tests.
+  # They use the shoppy production environment and include performance measurement tests.
+  e2e-shoppy-synthetic-tests:
+    needs: [get-sample-apps-data]
+    if: |
+      !cancelled() && needs.get-sample-apps-data.result == 'success' &&
+      github.event_name == 'push' &&
+      github.ref == 'refs/heads/master'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 45
+    name: e2e-shoppy-synthetic-monitoring-tests
+    env:
+      MB_EDITION: ee
+      MB_RUN_MODE: e2e
+      METASTORE_DEV_SERVER_URL: ${{ secrets.METASTORE_DEV_SERVER_URL }}
+      CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
+      SAMPLE_APP_BRANCH_NAME: ${{ needs.get-sample-apps-data.outputs.branch_name }}
+      SAMPLE_APP_ENVIRONMENT: production
+    permissions:
+      id-token: write
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Prepare Shoppy E2E environment
+        uses: ./.github/actions/prepare-shoppy-e2e
+        id: shoppy-prep
+        with:
+          commit: ${{ github.event.pull_request.head.sha || github.sha }}
+          sample-app-branch-name: ${{ needs.get-sample-apps-data.outputs.branch_name }}
+          sample-app-environment: production
+          staging-mb-all-features-token: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
+          shoppy-iam-role: ${{ secrets.SHOPPY_IAM_ROLE }}
+          shoppy-metabase-app-db-s3-bucket: ${{ secrets.SHOPPY_METABASE_APP_DB_S3_BUCKET }}
+          shoppy-metabase-app-db-s3-key: ${{ secrets.SHOPPY_METABASE_APP_DB_S3_KEY }}
+          shoppy-metabase-app-db-user: ${{ secrets.SHOPPY_METABASE_APP_DB_USER }}
+          shoppy-metabase-app-db-database: ${{ secrets.SHOPPY_METABASE_APP_DB_DATABASE }}
+          metastore-dev-server-url: ${{ secrets.METASTORE_DEV_SERVER_URL }}
+          shoppy-datadog-application-id: ${{ secrets.SHOPPY_METABASE_APP_DATADOG_APPLICATION_ID }}
+          shoppy-datadog-client-token: ${{ secrets.SHOPPY_METABASE_APP_DATADOG_CLIENT_TOKEN }}
+
+      - name: Get merged PR number
+        if: ${{ steps.shoppy-prep.outputs.sample_app_branch_exists == 'true' }}
+        id: get-merged-pr-number
+        run: |
+          PR=$(gh api repos/${{ github.repository }}/commits/${{ github.sha }}/pulls --jq '.[0].number' 2>/dev/null || echo "")
+          if [ -z "$PR" ] || [ "$PR" = "null" ]; then
+            echo "number=" >> "$GITHUB_OUTPUT"
+          else
+            echo "number=$PR" >> "$GITHUB_OUTPUT"
+          fi
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Run synthetic monitoring tests
+        id: run-e2e-tests
+        if: ${{ steps.shoppy-prep.outputs.sample_app_branch_exists == 'true' }}
+        continue-on-error: true
+        env:
+          CYPRESS_BROWSER: ${{ steps.shoppy-prep.outputs.chrome-path }}
+          PR_NUMBER: ${{ steps.get-merged-pr-number.outputs.number }}
+          INCLUDE_SYNTHETIC_MONITORING_TESTS: "true"
+        run: node e2e/runner/run_cypress_ci.js shoppy-e2e
+
+      - name: Upload Cypress Artifacts upon failure
+        uses: actions/upload-artifact@v4
+        if: ${{ steps.shoppy-prep.outputs.sample_app_branch_exists == 'true' && steps.run-e2e-tests.outcome != 'success' }}
+        with:
+          name: cypress-recording-shoppy-synthetic-tests-latest
+          path: |
+            ./e2e/tmp/shoppy/cypress
+          if-no-files-found: ignore
+
+      - name: Fail job if tests failed
+        if: ${{ steps.shoppy-prep.outputs.sample_app_branch_exists == 'true' && steps.run-e2e-tests.outcome != 'success' }}
+        run: |
+          exit 1
+
   # The job checks integration of the Embedding SDK with consumer's apps that use different frameworks/bundlers,
   # or when we want to test some tricky integration cases like conflicting types.
   # The job
@@ -252,7 +366,8 @@ jobs:
       - name: Retrieve uberjar artifact for ee
         uses: ./.github/actions/fetch-artifact
         with:
-          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+          commit: ${{ github.event.pull_request.head.sha || github.sha }}
+          edition: ee
           extract-path: "target/uberjar"
           output-name: "metabase.jar"
 

.github/workflows/embedding-sdk-package-build.yml

@@ -23,7 +23,7 @@ jobs:
           # Remove the matchers to not report false positives on every PR
           # unrelated to embedding (EMB-765)
           echo "::remove-matcher owner=tsc::"
-          yarn build-embedding-sdk-package
+          bun run build-embedding-sdk-package
       - name: Prepare Embedding SDK artifact
         uses: actions/upload-artifact@v4
         with:

.github/workflows/embedding-sdk.yml

@@ -47,7 +47,7 @@ jobs:
           name: embedding-sdk-${{ github.event.pull_request.head.sha || github.sha }}
           path: ${{ github.workspace }}/resources/embedding-sdk
       - name: Run frontend embedding SDK snippets type check
-        run: yarn run embedding-sdk:cli-snippets:type-check
+        run: bun run embedding-sdk:cli-snippets:type-check
 
   embedding-sdk-docs-snippets-type-check:
     if: inputs.docs-snippets-type-check && !inputs.skip
@@ -63,7 +63,7 @@ jobs:
           name: embedding-sdk-${{ github.event.pull_request.head.sha || github.sha }}
           path: ${{ github.workspace }}/resources/embedding-sdk
       - name: Run frontend embedding SDK snippets type check
-        run: yarn run embedding-sdk:docs-snippets:type-check
+        run: bun run embedding-sdk:docs-snippets:type-check
 
   embedding-sdk-api-documentation-generation-validation:
     if: inputs.documentation-validation && !inputs.skip
@@ -86,7 +86,7 @@ jobs:
         shell: bash
         run: |
           set -o pipefail
-          yarn embedding-sdk:docs:generate:pure --emit none 2>&1 \
+          bun run embedding-sdk:docs:generate:pure --emit none 2>&1 \
           | tee /dev/stdout \
           | tee >( tail -n 10 \
           | sed '1s/^/output<<EOF\n/' \
@@ -98,14 +98,14 @@ jobs:
         with:
           remove-previous-comment: true
           add-new-comment: ${{ steps.docs-generation.outcome == 'failure' && contains(steps.docs-generation.outputs.output, 'not included in the documentation') }}
-          message: "📝 Some exported types from `@metabase/embedding-sdk-react` reference other types that are not exported, i.e. internal types.<br><br>The internal type reference breaks API documentation generation for the SDK and also may unexpectedly increase the output size of the type declaration file.<br><br>Please check the CI logs to find the name of such type.<br><br>- If a type should be publicly available in the SDK, add a description to it or a TypeDoc annotation and export it from SDK.<br>- If a type is internal and should _not_ be publicly exposed, refactor types to prevent referencing other types that are not exported from SDK.<br><br>You can run `yarn embedding-sdk:docs:generate` locally to  verify that the issue has been resolved."
+          message: "📝 Some exported types from `@metabase/embedding-sdk-react` reference other types that are not exported, i.e. internal types.<br><br>The internal type reference breaks API documentation generation for the SDK and also may unexpectedly increase the output size of the type declaration file.<br><br>Please check the CI logs to find the name of such type.<br><br>- If a type should be publicly available in the SDK, add a description to it or a TypeDoc annotation and export it from SDK.<br>- If a type is internal and should _not_ be publicly exposed, refactor types to prevent referencing other types that are not exported from SDK.<br><br>You can run `bun run embedding-sdk:docs:generate` locally to  verify that the issue has been resolved."
           include-log: true
       - name: Comment on PR if 'Failed to resolve link' error happens
         uses: ./.github/actions/notify-pull-request
         with:
           remove-previous-comment: true
           add-new-comment: ${{ steps.docs-generation.outcome == 'failure' && contains(steps.docs-generation.outputs.output, 'Failed to resolve link') }}
-          message: "📝 A typedoc `{@link <TYPE_NAME>}` annotation is found that can't be resolved.<br><br>Most likely it happens when the referenced type is not exported. Please check the CI logs to find the name of such type.<br><br>- If a referenced in `{@link}` type should be publicly available in the SDK, add a description to it or a TypeDoc annotation and export it from SDK.<br>- If a type is internal and should _not_ be publicly exposed, change types to prevent unexported type reference in `{@link}` annotation.<br><br>You can run `yarn embedding-sdk:docs:generate` locally to verify that the issue has been resolved."
+          message: "📝 A typedoc `{@link <TYPE_NAME>}` annotation is found that can't be resolved.<br><br>Most likely it happens when the referenced type is not exported. Please check the CI logs to find the name of such type.<br><br>- If a referenced in `{@link}` type should be publicly available in the SDK, add a description to it or a TypeDoc annotation and export it from SDK.<br>- If a type is internal and should _not_ be publicly exposed, change types to prevent unexported type reference in `{@link}` annotation.<br><br>You can run `bun run embedding-sdk:docs:generate` locally to verify that the issue has been resolved."
           include-log: true
       - name: Fail Job
         if: ${{ steps.docs-generation.outcome == 'failure' }}

.github/workflows/frontend-unit-test-stress-test-flake-fix.yml

@@ -44,12 +44,12 @@ jobs:
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
       - name: Build cljs
-        run: yarn build:cljs
+        run: bun run build:cljs
       - name: Stress-test ${{ github.event.inputs.spec }} ${{ github.event.inputs.burn_in }} times
         run: |
           for i in {1..${{ github.event.inputs.burn_in }}}; do
-            yarn jest --runInBand --ci --silent --no-cache \
-              --testPathPattern '${{ github.event.inputs.spec }}' \
+            bun run jest --runInBand --ci --silent --no-cache \
+              --testPathPatterns '${{ github.event.inputs.spec }}' \
               --testNamePattern '${{ github.event.inputs.grep }}'
             if [[ "$?" != 0 ]]; then
               echo "Failed after $i attempts" && break;

.github/workflows/frontend.yml

@@ -46,15 +46,15 @@ jobs:
           key: ${{ steps.get-cache-keys.outputs.eslint-cache-key }}
 
       - name: Compile CLJS
-        run: yarn build-pure:cljs
+        run: bun run build-pure:cljs
       - name: Find CSS variables that are used but never defined
-        run: yarn find-never-defined-css-variables
+        run: bun run find-never-defined-css-variables
       - name: Run Prettier formatting linter
-        run: yarn run lint-prettier-pure
+        run: bun run lint-prettier-pure
       - name: Run ESLint linter
-        run: yarn run lint-eslint-pure
+        run: bun run lint-eslint-pure
       - name: Run CSS linter
-        run: yarn run lint-css
+        run: bun run lint-css
 
   fe-type-check:
     if: ${{ !inputs.skip }}
@@ -66,9 +66,9 @@ jobs:
         uses: ./.github/actions/prepare-frontend
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
-      - run: yarn build-pure:cljs
+      - run: bun run build-pure:cljs
         name: Compile CLJS
-      - run: yarn type-check-pure
+      - run: bun run type-check-pure
         name: Check types
 
   fe-tests-unit:
@@ -90,7 +90,8 @@ jobs:
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
       - name: Run frontend unit tests
-        run: yarn run test-unit --silent --shard=${{ matrix.shard }}/${{ env.SHARDS }}
+        id: fe-tests
+        run: bun run test-unit --silent --shard=${{ matrix.shard }}/${{ env.SHARDS }}
         # Trunk Quarantine controls the final state of the run in the CI!
         # Even if this step fails we let it pass, and then `trunk-io/analytics-uploader` determines
         # whether to fail or to pass the whole job, based on the quarantine list.
@@ -106,6 +107,7 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.fe-tests.outcome }}
 
   fe-tests-timezones:
     if: ${{ !inputs.skip }}
@@ -118,7 +120,7 @@ jobs:
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
       - name: Run frontend timezones tests
-        run: yarn run test-timezones
+        run: bun run test-timezones
 
   fe-tests-result:
     needs:

.github/workflows/fuzzing.yml

@@ -1,56 +0,0 @@
-name: Fuzzing
-
-on:
-  workflow_dispatch:
-  push:
-    branches:
-      - "master"
-      - "release-**"
-    paths:
-      - "frontend/src/metabase/querying/expressions/**"
-  pull_request:
-    paths:
-      - "frontend/src/metabase/querying/expressions/**"
-
-jobs:
-  fe-fuzz-lexifier:
-    runs-on: ubuntu-22.04
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@v4
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-      - name: Prepare back-end environment
-        uses: ./.github/actions/prepare-backend
-      - run: yarn test-unit frontend/src/metabase/querying/expressions/pratt/fuzz.lexifier.unit.spec.ts
-        env:
-          MB_FUZZ: 1
-        name: Run fuzz testing on the lexifier
-
-  fe-fuzz-compiler:
-    runs-on: ubuntu-22.04
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@v4
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-      - name: Prepare back-end environment
-        uses: ./.github/actions/prepare-backend
-      - run: yarn test-unit frontend/src/metabase/querying/expressions/fuzz.compiler.unit.spec.ts
-        env:
-          MB_FUZZ: 1
-        name: Run fuzz testing on the custom expression compiler
-
-  fe-fuzz-string-quoting:
-    runs-on: ubuntu-22.04
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@v4
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-      - name: Prepare back-end environment
-        uses: ./.github/actions/prepare-backend
-      - run: yarn test-unit frontend/src/metabase/querying/expressions/fuzz.string.unit.spec.ts
-        env:
-          MB_FUZZ: 1
-        name: Run fuzz testing on the custom expression string quoter

.github/workflows/js-stats-update.yml

@@ -0,0 +1,51 @@
+name: JS Stats Update
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: 40 1 * * 4 # every Thursday at 1:40
+
+jobs:
+  js-stats:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+      - name: get JS file count
+        id: get-js-file-count
+        run: |
+          oss=$(find ./frontend/src/metabase -type f -name "*.js" -o -name "*.jsx" | wc -l)
+          ee=$(find ./enterprise/frontend/src/metabase-enterprise -type f -name "*.js" -o -name "*.jsx" | wc -l)
+
+          echo $(($oss+$ee)) javascript files
+
+          echo "JS_FILES=$(($oss+$ee))" >> $GITHUB_OUTPUT
+      - name: Upload count to Stats
+        uses: actions/github-script@v7
+        env:
+          JS_FILES: ${{ steps.get-js-file-count.outputs.JS_FILES }}
+          API_KEY: ${{ secrets.STATS_API_KEY }}
+        with:
+          script: | # js
+            const { uploadCsvToMb } = require('${{ github.workspace }}/.github/scripts/csv-to-mb.js');
+
+            console.log("JS_FILES", Number(process.env.JS_FILES));
+
+            const data = [
+              {
+                'Date': new Date().toISOString().slice(0, 10), // YYYY-MM-DD
+                'Js files': Number(process.env.JS_FILES),
+              }
+            ];
+
+            uploadCsvToMb({
+              baseUrl: 'https://stats.metabase.com',
+              tableId: 73270,
+              jsonData: data,
+              mode: 'append',
+            }).then(() => {
+              console.log('Data uploaded successfully');
+            }).catch((error) => {
+              console.error('Error uploading data:', error);
+              process.exit(1);
+            });

.github/workflows/llms-txt-generate.yml

@@ -1,198 +0,0 @@
-name: Generate llms.txt file
-
-on:
-  workflow_call:
-    inputs:
-      version:
-        description: 'Metabase version (e.g. v0.57.0)'
-        type: string
-        required: true
-      branch:
-        description: 'Target branch (e.g. release-x.57.x)'
-        type: string
-        required: true
-  workflow_dispatch:
-    inputs:
-      version:
-        description: 'Metabase version (e.g. v0.57.0)'
-        type: string
-        required: true
-      branch:
-        description: 'Target branch (e.g. release-x.57.x)'
-        type: string
-        required: true
-
-permissions:
-  contents: write
-  pull-requests: write
-
-jobs:
-  check-version:
-    name: Check if minor or major release
-    runs-on: ubuntu-22.04
-    timeout-minutes: 5
-    outputs:
-      should_generate: ${{ steps.check.outputs.should_generate }}
-      target_branch: ${{ steps.check.outputs.target_branch }}
-      version: ${{ steps.check.outputs.version }}
-    steps:
-      - name: Check version
-        id: check
-        run: |
-          VERSION="${{ inputs.version }}"
-          BRANCH="${{ inputs.branch }}"
-
-          # Extract version number (e.g., v0.57.0 -> 0.57.0)
-          VERSION_NUM="${VERSION#v}"
-
-          # Count dots to determine version type
-          # Metabase format: v0.MAJOR.MINOR (3 segments) or v0.MAJOR.MINOR.PATCH (4 segments)
-          DOT_COUNT=$(echo "$VERSION_NUM" | tr -cd '.' | wc -c | tr -d ' ')
-
-          # Only proceed if this is a minor or major release (3 segments)
-          # Examples of minor/major releases: v0.57.8, v0.59.0
-          # Skip for patch releases (4 segments): v0.57.8.1
-          # Note: This is a safety check even though the workflow should only be called
-          # for minor/major releases, just in case the workflow is dispatched manually.
-          if [ "$DOT_COUNT" -eq 3 ]; then
-            echo "⏭️  This is a patch release ($VERSION). Skipping llms.txt generation."
-            echo "should_generate=false" >> $GITHUB_OUTPUT
-          else
-            echo "✅ This is a minor or major release ($VERSION). Proceeding with llms.txt generation for branch: $BRANCH"
-            echo "should_generate=true" >> $GITHUB_OUTPUT
-          fi
-
-          echo "target_branch=$BRANCH" >> $GITHUB_OUTPUT
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
-
-  generate-llms-txt:
-    name: Generate llms.txt
-    needs: check-version
-    if: needs.check-version.outputs.should_generate == 'true'
-    runs-on: ubuntu-22.04
-    timeout-minutes: 15
-    steps:
-
-      - name: Get the generate-llms-txt.js node script via sparse checkout
-        uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
-          ref: ${{ github.ref }}
-          sparse-checkout: |
-            .github/scripts
-          path: workflow-scripts
-
-      - name: Checkout target branch for docs
-        uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
-          ref: ${{ needs.check-version.outputs.target_branch }}
-          path: metabase
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: 22
-
-      - name: Generate llms.txt
-        id: generate
-        run: |
-          node workflow-scripts/.github/scripts/generate-llms-txt.js metabase/docs ${{ needs.check-version.outputs.target_branch }}
-
-      - name: Sanity check generated files
-        run: |
-          if [ ! -f "llms.txt" ]; then
-            echo "❌ Error: llms.txt was not generated"
-            exit 1
-          fi
-
-          if [ ! -f "llms-embedding-full.txt" ]; then
-            echo "❌ Error: llms-embedding-full.txt was not generated"
-            exit 1
-          fi
-
-          # Check that llms.txt contains URLs with the expected GitHub raw URL prefix
-          URL_COUNT=$(grep -o "https://raw.githubusercontent.com/metabase/metabase/refs/heads/${{ needs.check-version.outputs.target_branch }}/docs" llms.txt | wc -l)
-          if [ "$URL_COUNT" -lt 10 ]; then
-            echo "❌ Error: llms.txt appears to be malformed. Found only $URL_COUNT URLs (expected at least 10)"
-            exit 1
-          fi
-
-          echo "✅ Both llms.txt and llms-embedding-full.txt were generated successfully"
-          echo "✅ llms.txt contains $URL_COUNT documentation URLs"
-
-      - name: Set up git configuration
-        working-directory: metabase
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          BRANCH_NAME="llms-txt/auto-update-${{ needs.check-version.outputs.target_branch }}-$(date +%Y%m%d-%H%M%S)"
-          echo "BRANCH_NAME=$BRANCH_NAME" >> $GITHUB_ENV
-          echo "Branch name will be: $BRANCH_NAME"
-
-      - name: Copy generated files to metabase repo
-        run: |
-          cp llms.txt metabase/
-          cp llms-embedding-full.txt metabase/
-
-      - name: Create Pull Request
-        id: create_pr
-        uses: peter-evans/create-pull-request@v6
-        with:
-          token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
-          path: metabase
-          branch: ${{ env.BRANCH_NAME }}
-          base: ${{ needs.check-version.outputs.target_branch }}
-          commit-message: |
-            Update llms.txt and llms-full.txt (${{ needs.check-version.outputs.target_branch }})
-
-            Regenerated llms.txt to include all markdown files from the docs/ directory.
-            Also generated llms-full.txt files for the embedding section.
-
-            🤖 Generated automatically by llms-txt-generate workflow
-
-            Co-Authored-By: GitHub Actions <actions@github.com>
-          committer: "github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>"
-          author: "github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>"
-          title: "[chore] Update llms.txt for ${{ needs.check-version.outputs.target_branch }}"
-          body: |
-            ## Summary
-            This PR contains automatically generated updates to `llms.txt` and `llms-embedding-full.txt` files, triggered by a minor or major release.
-
-            ## Changes
-            - The `llms.txt` file has been regenerated to include all markdown files from the `docs/` directory.
-            - The `llms-embedding-full.txt` file has been generated for the embedding section (concatenated documentation for RAG).
-
-            ## Generation
-            These files were generated using:
-            - Script: `.github/scripts/generate-llms-txt.js`
-            - Branch: `${{ needs.check-version.outputs.target_branch }}`
-            - Base URL: `https://raw.githubusercontent.com/metabase/metabase/refs/heads/${{ needs.check-version.outputs.target_branch }}`
-
-            Please review the changes and merge if they look correct.
-
-            🤖 Generated automatically by the `llms-txt-generate` workflow.
-
-            Co-Authored-By: GitHub Actions <actions@github.com>
-          labels: |
-            Type:Documentation
-            no-backport
-          add-paths: |
-            llms.txt
-            llms-embedding-full.txt
-
-      - name: Auto approve PR
-        if: steps.create_pr.outputs.pull-request-number != ''
-        working-directory: metabase
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          gh pr review "${{ steps.create_pr.outputs.pull-request-number }}" --approve --body "Auto-approved by llms-txt-generate workflow"
-
-      - name: Auto merge PR
-        if: steps.create_pr.outputs.pull-request-number != ''
-        working-directory: metabase
-        env:
-          GH_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
-        run: |
-          gh pr merge "${{ steps.create_pr.outputs.pull-request-number }}" --auto --squash

.github/workflows/loki-stress-test-flake-fix.yml

@@ -1,10 +1,15 @@
 name: Loki Visual Stress Test Flake Fix
 
 on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+    paths:
+      - 'frontend/**/*.stories.tsx'
+      - 'enterprise/frontend/**/*.stories.tsx'
   workflow_dispatch:
     inputs:
-      stories_filter:
-        description: "Regex pattern to filter stories (e.g. 'DataGrid' or 'static-viz|viz')"
+      story_files:
+        description: "Comma-separated story file paths relative to repo root"
         type: string
         required: true
       burn_in:
@@ -14,22 +19,96 @@ on:
         default: "50"
 
 jobs:
+  detect-changed-stories:
+    name: Detect changed stories
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    outputs:
+      story_files: ${{ steps.detect.outputs.story_files }}
+      should_run: ${{ steps.detect.outputs.should_run }}
+    steps:
+      - name: Detect changed story files
+        id: detect
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          validate_paths() {
+            local files="$1"
+            for file in $(echo "$files" | tr ',' '\n'); do
+              file=$(echo "$file" | xargs)  # trim whitespace
+              if [[ -z "$file" ]]; then
+                continue
+              fi
+              if [[ ! "$file" =~ ^(frontend/|enterprise/frontend/).+\.stories\. ]]; then
+                echo "::error::Invalid story path: $file"
+                echo "Paths must start with 'frontend/' or 'enterprise/frontend/' and contain '.stories.'"
+                return 1
+              fi
+            done
+            return 0
+          }
+
+          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
+            FILES=$(echo "${{ inputs.story_files }}" | tr ',' '\n' | xargs -n1 | paste -sd',')
+            if ! validate_paths "$FILES"; then
+              exit 1
+            fi
+            echo "story_files=$FILES" >> $GITHUB_OUTPUT
+            echo "should_run=true" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+
+          FILES=$( \
+            gh pr view ${{ github.event.pull_request.number }} --repo ${{ github.repository }} --json files --jq '.files[].path' \
+            | grep '\.stories\.tsx$' \
+            | xargs -n1 \
+            | sort -u \
+            | paste -sd',' \
+          )
+
+          if [[ -z "$FILES" ]]; then
+            echo "No changed story files found"
+            echo "should_run=false" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+
+          if ! validate_paths "$FILES"; then
+            exit 1
+          fi
+
+          echo "Changed story files: $FILES"
+          echo "story_files=$FILES" >> $GITHUB_OUTPUT
+          echo "should_run=true" >> $GITHUB_OUTPUT
+
   workflow-summary:
-    name: Stress test inputs
+    name: Summary
+    needs: detect-changed-stories
+    if: needs.detect-changed-stories.outputs.should_run == 'true'
     runs-on: ubuntu-22.04
     timeout-minutes: 5
     steps:
       - name: Generate workflow summary
         run: |
-          echo '**Inputs:**' >> $GITHUB_STEP_SUMMARY
+          echo '## Loki Stress Test' >> $GITHUB_STEP_SUMMARY
           echo '' >> $GITHUB_STEP_SUMMARY
-          echo '- `branch`: ${{ github.ref_name }}' >> $GITHUB_STEP_SUMMARY
-          echo '- `stories_filter`: ${{ inputs.stories_filter }}' >> $GITHUB_STEP_SUMMARY
-          echo '- `burn_in`: ${{ inputs.burn_in }}' >> $GITHUB_STEP_SUMMARY
+          echo '**Branch:** `${{ github.head_ref || github.ref_name }}`' >> $GITHUB_STEP_SUMMARY
           echo '' >> $GITHUB_STEP_SUMMARY
-          echo 'triggered by: @${{ github.event.sender.login }}' >> $GITHUB_STEP_SUMMARY
+          echo '**Story files:**' >> $GITHUB_STEP_SUMMARY
+          echo '${{ needs.detect-changed-stories.outputs.story_files }}' | tr ',' '\n' | while read -r file; do
+            echo "- \`$file\`" >> $GITHUB_STEP_SUMMARY
+          done
+          echo '' >> $GITHUB_STEP_SUMMARY
+          echo '**Burn-in:** ${{ inputs.burn_in || 50 }} runs' >> $GITHUB_STEP_SUMMARY
+          echo '' >> $GITHUB_STEP_SUMMARY
+          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+            echo 'Triggered by PR #${{ github.event.pull_request.number }} from @${{ github.event.pull_request.user.login }}' >> $GITHUB_STEP_SUMMARY
+          else
+            echo 'Triggered manually by @${{ github.actor }}' >> $GITHUB_STEP_SUMMARY
+          fi
 
   stress-test-loki:
+    needs: detect-changed-stories
+    if: needs.detect-changed-stories.outputs.should_run == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 60
     name: Stress test Loki visual tests
@@ -56,17 +135,20 @@ jobs:
         uses: ./.github/actions/prepare-backend
 
       - name: Compile CLJS
-        run: NODE_ENV=development yarn build-pure:cljs
+        run: NODE_ENV=development bun run build-pure:cljs
 
-      - name: Build Storybook (once)
-        run: yarn build-storybook
+      - name: Build Storybook
+        run: bun run build-storybook
+        env:
+          STORYBOOK_STORIES_FILTER: ${{ needs.detect-changed-stories.outputs.story_files }}
 
-      - name: Stress-test Loki "${{ inputs.stories_filter }}" ${{ inputs.burn_in }} times
+      - name: Stress-test Loki
         run: |
-          BURN_IN=${{ inputs.burn_in }}
-          STORIES_FILTER='${{ inputs.stories_filter }}'
+          BURN_IN=${{ inputs.burn_in || '50' }}
+          STORY_FILES='${{ needs.detect-changed-stories.outputs.story_files }}'
 
-          echo "Running Loki visual tests $BURN_IN times for stories matching: $STORIES_FILTER"
+          echo "Story files: $STORY_FILES"
+          echo "Running Loki $BURN_IN times"
           echo ""
 
           FAILED=0
@@ -75,10 +157,9 @@ jobs:
             echo "Run $i of $BURN_IN"
             echo "=========================================="
 
-            if yarn test-visual:loki \
+            if bun run test-visual:loki \
               --reactUri file:./storybook-static \
-              --verboseRenderer \
-              --storiesFilter "$STORIES_FILTER"; then
+              --verboseRenderer; then
               echo "✅ Run $i passed"
             else
               echo "❌ Run $i FAILED"
@@ -101,10 +182,9 @@ jobs:
 
       - name: Generate Visual Report on Failure
         if: failure()
-        run: yarn test-visual:loki-report
+        run: bun run test-visual:loki-report
 
       - name: Upload Artifact
-        id: artifact-upload-step
         if: failure()
         uses: actions/upload-artifact@v4
         with:

.github/workflows/loki-update.yml

@@ -22,10 +22,10 @@ jobs:
         uses: ./.github/actions/prepare-backend
 
       - name: Compile CLJS
-        run: yarn build-pure:cljs
+        run: bun run build-pure:cljs
 
       - name: Update Loki Snapshots
-        run: yarn test-visual:loki:ci || yarn test-visual:loki-approve-diff && yarn test-visual:loki-prune
+        run: bun run test-visual:loki:ci || bun run test-visual:loki-approve-diff && bun run test-visual:loki-prune
 
       - name: Check for changes
         id: check-changes

.github/workflows/loki.yml

@@ -49,14 +49,14 @@ jobs:
         uses: ./.github/actions/prepare-backend
 
       - name: Compile CLJS
-        run: NODE_ENV=development yarn build-pure:cljs
+        run: NODE_ENV=development bun run build-pure:cljs
 
       - name: Run Loki Visual Tests
-        run: yarn test-visual:loki:ci
+        run: bun run test-visual:loki:ci
 
       - name: Generate Visual Report on Failure
         if: failure()
-        run: yarn test-visual:loki-report
+        run: bun run test-visual:loki-report
 
       - name: Upload Artifact
         id: artifact-upload-step

.github/workflows/minimal-tests.yml

@@ -30,9 +30,9 @@ jobs:
     needs: check-label
     if: needs.check-label.outputs.should-run == 'true'
     runs-on: ubuntu-22.04
-    timeout-minutes: 60
+    timeout-minutes: 40
     env:
-      CI: 'true'
+      CI: "true"
       DRIVERS: postgres
       MB_DB_TYPE: postgres
       MB_DB_PORT: 5432
@@ -53,10 +53,11 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Test Postgres App DB
+        id: test-driver
         uses: ./.github/actions/test-driver
         with:
           build-static-viz: true
-          junit-name: 'minimal-be-tests-postgres-ee'
+          junit-name: "minimal-be-tests-postgres-ee"
           test-args: >-
             :only '["test" "enterprise/backend/test"]'
             :exclude-tags '[:mb/driver-tests :mb/transforms-python-test]'
@@ -73,15 +74,16 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   # Postgres driver tests
   postgres-driver-test:
     needs: check-label
     if: needs.check-label.outputs.should-run == 'true'
     runs-on: ubuntu-latest
-    timeout-minutes: 60
+    timeout-minutes: 40
     env:
-      CI: 'true'
+      CI: "true"
       DRIVERS: postgres
       MB_DB_TYPE: postgres
       MB_DB_PORT: 5432
@@ -102,9 +104,10 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Test Postgres Driver
+        id: test-driver
         uses: ./.github/actions/test-driver
         with:
-          junit-name: 'minimal-be-tests-postgres-driver-ee'
+          junit-name: "minimal-be-tests-postgres-driver-ee"
           test-args: >-
             :only-tags [:mb/driver-tests]
             :exclude-tags [:mb/transforms-python-test]
@@ -119,6 +122,7 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   # Frontend unit tests
   frontend-unit-tests:
@@ -137,7 +141,8 @@ jobs:
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
       - name: Run frontend unit tests
-        run: yarn run test-unit --silent
+        id: run-tests
+        run: bun run test-unit --silent
         continue-on-error: true
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
@@ -150,6 +155,7 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.run-tests.outcome }}
 
   # Summary job
   minimal-tests-result:

.github/workflows/openapi-check.yml

@@ -0,0 +1,44 @@
+name: OpenAPI Check
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, labeled, unlabeled]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  check-openapi-specs:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    if: contains(github.event.pull_request.labels.*.name, 'openapi-self-healing')
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # we're intentionally using METABASE_AUTOMATION_USER_TOKEN to trigger the whole CI pipeline again
+          #  after the self-healing commit is created
+          #  if we used GITHUB_TOKEN, the self-healing commit would not trigger the CI pipeline again
+          token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+          # fetch full git history to allow fetching the latest base branch commit and comparing changes
+          fetch-depth: 0
+      - name: Setup Node.js 22
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22.x
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+      - name: Generate version.properties
+        run: ./bin/build.sh :steps [:version]
+      - name: Get latest base branch commit
+        run: |
+          git fetch origin ${{ github.event.pull_request.base.ref }}
+          echo "LATEST_BASE_SHA=$(git rev-parse origin/${{ github.event.pull_request.base.ref }})" >> $GITHUB_ENV
+      - name: Check OpenAPI specs are up to date
+        env:
+          AUTO_COMMIT: "true"
+          PR_BRANCH: ${{ github.event.pull_request.head.ref }}
+          BASE_SHA: ${{ env.LATEST_BASE_SHA }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          GITHUB_SHA: ${{ github.sha }}
+        run: ./bin/openapi-check.sh

.github/workflows/perf-test.yml

@@ -29,7 +29,8 @@ jobs:
       - name: Retrieve uberjar artifact for ee
         uses: ./.github/actions/fetch-artifact
         with:
-          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+          commit: ${{ github.event.pull_request.head.sha || github.sha }}
+          edition: ee
           extract-path: "target/uberjar"
           output-name: "metabase.jar"
       - name: Move uberjar to bin/docker

.github/workflows/pr-env.yml

@@ -40,7 +40,8 @@ jobs:
       - name: Retrieve uberjar artifact for ee
         uses: ./.github/actions/fetch-artifact
         with:
-          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+          commit: ${{ github.event.pull_request.head.sha || github.sha }}
+          edition: ee
           extract-path: "target/uberjar"
           output-name: "metabase.jar"
       - name: Move uberjar to bin/docker

.github/workflows/pre-release.yml

@@ -30,12 +30,15 @@ jobs:
     outputs:
       run_mode: ${{ fromJson(steps.config.outputs.result).runMode }}
       dev_server: ${{ fromJson(steps.config.outputs.result).metastoreDevServer }}
+      package_manager: ${{ fromJson(steps.config.outputs.result).packageManager }}
     steps:
       - uses: actions/checkout@v4
         with:
-          sparse-checkout: release
-      - name: Prepare build scripts
-        run: cd ${{ github.workspace }}/release && yarn && yarn build
+          sparse-checkout: |
+            release
+            .github
+      - name: Prepare release scripts
+        uses: ./.github/actions/prepare-release-scripts
       # note: this block can be removed after we stop needing to be able to test versions before v55
       - name: Get test mode config
         id: config
@@ -48,13 +51,17 @@ jobs:
             // with v55 and later we use enterprise tokens that mirror actual Metabase plans
             const MULTIPLE_TEST_TOKEN_THRESHOLD = 55;
 
+            // Versions before v59 used yarn, v59 and later use bun
+            const BUN_PACKAGE_MANAGER_THRESHOLD = 59;
+
             const version = '${{ inputs.version }}';
             const majorVersion = Number(getMajorVersion(version));
             const oldTestToken = majorVersion < MULTIPLE_TEST_TOKEN_THRESHOLD;
 
             return ({
               runMode: oldTestToken ? 'prod' : 'e2e',
-              metastoreDevServer: oldTestToken ? '' : '${{ vars.METASTORE_DEV_SERVER_URL }}'
+              metastoreDevServer: oldTestToken ? '' : '${{ vars.METASTORE_DEV_SERVER_URL }}',
+              packageManager: majorVersion < BUN_PACKAGE_MANAGER_THRESHOLD ? 'yarn' : 'bun',
             });
 
   release-artifact:
@@ -71,10 +78,12 @@ jobs:
       - uses: actions/checkout@v4
         with:
           sparse-checkout: .github
-      - name: Retrieve test build uberjar artifact for ${{ matrix.edition }}
+      - name: Retrieve release uberjar artifact for ${{ matrix.edition }}
         uses: ./.github/actions/fetch-artifact
         with:
-          name: metabase-release-${{ matrix.edition }}-${{ inputs.commit }}-uberjar
+          commit: ${{ inputs.commit }}
+          edition: ${{ matrix.edition }}
+          release: "true"
 
       - name: Extract version number from  version.properties
         id: version-properties
@@ -168,6 +177,8 @@ jobs:
         uses: ./.github/actions/prepare-frontend
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
+      - name: Compile CLJS
+        run: ${{ needs.test-mode-config.outputs.package_manager }} run build-pure:cljs
       - name: Prepare Cypress environment
         id: cypress-prep
         uses: ./.github/actions/prepare-cypress
@@ -228,32 +239,42 @@ jobs:
     uses: ./.github/workflows/containerize-jar.yml
     secrets: inherit
     with:
-      artifact-name: metabase-release-oss-${{ inputs.commit }}-uberjar
+      edition: oss
       commit: ${{ inputs.commit }}
       repo: ${{ vars.DOCKERHUB_OWNER }}/${{ vars.DOCKERHUB_STAGING_REPO }}
       tag: ${{ needs.release-artifact.outputs.oss_version }}-${{ inputs.commit }}
+      release: "true"
 
   containerize-ee:
     needs: release-artifact
     uses: ./.github/workflows/containerize-jar.yml
     secrets: inherit
     with:
-      artifact-name: metabase-release-ee-${{ inputs.commit }}-uberjar
+      edition: ee
       commit: ${{ inputs.commit }}
       repo: ${{ vars.DOCKERHUB_OWNER }}/${{ vars.DOCKERHUB_STAGING_REPO }}
       tag: ${{ needs.release-artifact.outputs.ee_version }}-${{ inputs.commit }}
+      release: "true"
 
   tests-complete-message:
     if: always()
     runs-on: ubuntu-22.04
-    needs: [run-sanity-check, check-uberjar-health, containerize-ee, containerize-oss]
+    needs:
+      [
+        run-sanity-check,
+        check-uberjar-health,
+        containerize-ee,
+        containerize-oss,
+      ]
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@v4
         with:
-          sparse-checkout: release
-      - name: Prepare build scripts
-        run: cd ${{ github.workspace }}/release && yarn && yarn build
+          sparse-checkout: |
+            release
+            .github
+      - name: Prepare release scripts
+        uses: ./.github/actions/prepare-release-scripts
       - name: Send tests complete message
         uses: actions/github-script@v7
         env:

.github/workflows/release-embedding-sdk.yml

@@ -44,10 +44,12 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          sparse-checkout: release
+          sparse-checkout: |
+            release
+            .github
 
-      - name: Prepare build scripts
-        run: cd ${{ github.workspace }}/release && yarn && yarn build
+      - name: Prepare release scripts
+        uses: ./.github/actions/prepare-release-scripts
 
       - name: Cache build scripts
         uses: actions/upload-artifact@v4
@@ -178,8 +180,8 @@ jobs:
         with:
           ref: ${{ inputs.branch }}
 
-      - name: Prepare build scripts
-        run: yarn --cwd release --frozen-lockfile && yarn --cwd release build
+      - name: Prepare release scripts
+        uses: ./.github/actions/prepare-release-scripts
 
       - name: Get current SDK version
         id: current-sdk-version
@@ -256,7 +258,7 @@ jobs:
         uses: ./.github/actions/prepare-backend
 
       - name: Run unit tests
-        run: yarn embedding-sdk:test-unit
+        run: bun run embedding-sdk:test-unit
 
   build-sdk:
     needs: [test, determine-sdk-version]
@@ -282,10 +284,10 @@ jobs:
           ./bin/embedding-sdk/release_utils.bash update_package_json_template ${{ needs.determine-sdk-version.outputs.sdk_version }}
 
       - name: Build SDK package
-        run: yarn run build-embedding-sdk-package
+        run: bun run build-embedding-sdk-package
 
       - name: Generate SDK package.json in the build directory
-        run: yarn run embedding-sdk:generate-package
+        run: bun run embedding-sdk:generate-package
 
       - name: Upload built SDK package as artifact
         uses: actions/upload-artifact@v4

.github/workflows/release-log.yml

@@ -38,10 +38,10 @@ jobs:
         with:
           ref: master # this only works on master
           fetch-depth: 0 # we want all branches and tags
-      - name: Install Dependencies
-        run: yarn --cwd release --frozen-lockfile && npm i -g tsx
-      - name: Build release scripts
-        run: yarn --cwd release build
+      - name: Prepare release scripts
+        uses: ./.github/actions/prepare-release-scripts
+      - name: Install tsx
+        run: npm i -g tsx
       - name: Get version number
         uses: actions/github-script@v7
         with:

.github/workflows/release-milestone-check.yml

@@ -21,8 +21,13 @@ jobs:
       - uses: actions/checkout@v4
         with:
           sparse-checkout: release
+      - name: Install bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: "1.3.7"
+          token: ${{ secrets.GITHUB_TOKEN }}
       - name: Prepare build scripts
-        run: yarn --cwd release --frozen-lockfile && yarn --cwd release build
+        run: bun install --cwd release --frozen-lockfile && bun run --cwd release build
       - uses: actions/github-script@v7
         env:
           GITHUB_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}

.github/workflows/release-notes-preview.yml

@@ -23,9 +23,11 @@ jobs:
         exit 1
     - uses: actions/checkout@v4
       with:
-        sparse-checkout: release
-    - name: Prepare build scripts
-      run: cd ${{ github.workspace }}/release && yarn && yarn build
+        sparse-checkout: |
+          release
+          .github
+    - name: Prepare release scripts
+      uses: ./.github/actions/prepare-release-scripts
     - name: Get Release Version
       uses: actions/github-script@v7
       env:

.github/workflows/release-patch.yml

@@ -13,8 +13,8 @@ on:
         type: string
         required: false
         default: ''
-  schedule:
-    - cron: '0 21 * * 1-5' # every weekday at 4 pm EST/5 pm EDT
+  # schedule:
+  #   - cron: '0 21 * * 1-5' # every weekday at 4 pm EST/5 pm EDT
 
 jobs:
   auto-patch-trigger:
@@ -26,8 +26,13 @@ jobs:
       - uses: actions/checkout@v4
         with:
           sparse-checkout: release
+      - name: Install bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: "1.3.7"
+          token: ${{ secrets.GITHUB_TOKEN }}
       - name: Prepare build scripts
-        run: yarn --cwd release --frozen-lockfile && yarn --cwd release build
+        run: bun install --cwd release --frozen-lockfile && bun run --cwd release build
       - name: Trigger auto-patch
         uses: actions/github-script@v7
         with:

.github/workflows/release-status.yml

@@ -14,9 +14,11 @@ jobs:
     steps:
     - uses: actions/checkout@v4
       with:
-        sparse-checkout: release
-    - name: Prepare build scripts
-      run: cd ${{ github.workspace }}/release && yarn --frozen-lockfile && yarn build
+        sparse-checkout: |
+          release
+          .github
+    - name: Prepare release scripts
+      uses: ./.github/actions/prepare-release-scripts
     - name: Check release status and post to Slack
       uses: actions/github-script@v7
       env:
@@ -47,9 +49,11 @@ jobs:
     steps:
     - uses: actions/checkout@v4
       with:
-        sparse-checkout: release
-    - name: Prepare build scripts
-      run: cd ${{ github.workspace }}/release && yarn --frozen-lockfile && yarn build
+        sparse-checkout: |
+          release
+          .github
+    - name: Prepare release scripts
+      uses: ./.github/actions/prepare-release-scripts
     - name: Check backport status and post to Slack
       uses: actions/github-script@v7
       env:

.github/workflows/release-tag.yml

@@ -79,9 +79,11 @@ jobs:
         exit 1
     - uses: actions/checkout@v4
       with:
-        sparse-checkout: release
-    - name: Prepare build scripts
-      run: cd ${{ github.workspace }}/release && yarn && yarn build
+        sparse-checkout: |
+          release
+          .github
+    - name: Prepare release scripts
+      uses: ./.github/actions/prepare-release-scripts
     - name: Get Release Version
       uses: actions/github-script@v7
       id: canonical_version
@@ -304,9 +306,11 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
     - uses: actions/checkout@v4
       with:
-        sparse-checkout: release
-    - name: Prepare build scripts
-      run: cd ${{ github.workspace }}/release && yarn && yarn build
+        sparse-checkout: |
+          release
+          .github
+    - name: Prepare release scripts
+      uses: ./.github/actions/prepare-release-scripts
     - name: Generate new version info
       uses: actions/github-script@v7
       id: new_version_info

.github/workflows/release-tests.yml

@@ -36,10 +36,15 @@ jobs:
       - uses: actions/checkout@v4
         with:
           sparse-checkout: "release"
+      - name: Install bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: "1.3.7"
+          token: ${{ secrets.GITHUB_TOKEN }}
       - name: prepare dependencies in release directory
-        run: yarn --cwd release --frozen-lockfile
+        run: bun install --cwd release --frozen-lockfile
       - name: Run frontend type-check
-        run: yarn --cwd release type-check
+        run: bun run --cwd release type-check
 
   release-tests-unit:
     needs: files-changed
@@ -50,10 +55,15 @@ jobs:
       - uses: actions/checkout@v4
         with:
           sparse-checkout: "release"
+      - name: Install bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: "1.3.7"
+          token: ${{ secrets.GITHUB_TOKEN }}
       - name: prepare dependencies in release directory
-        run: yarn --cwd release --frozen-lockfile
+        run: bun install --cwd release --frozen-lockfile
       - name: Run release unit tests
-        run: yarn --cwd release test:unit
+        run: bun run --cwd release test:unit
 
   release-test-build:
     needs: files-changed
@@ -64,9 +74,14 @@ jobs:
       - uses: actions/checkout@v4
         with:
           sparse-checkout: "release"
+      - name: Install bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: "1.3.7"
+          token: ${{ secrets.GITHUB_TOKEN }}
       - name: prepare dependencies in release directory
-        run: yarn --cwd release --frozen-lockfile
+        run: bun install --cwd release --frozen-lockfile
       - name: Build release bundle
-        run: yarn --cwd release build
+        run: bun run --cwd release build
       - name: Smoke test release bundle
         run: node release/dist/index.cjs

.github/workflows/release.yml

@@ -63,9 +63,11 @@ jobs:
         exit 1
     - uses: actions/checkout@v4
       with:
-        sparse-checkout: release
-    - name: Prepare build scripts
-      run: cd ${{ github.workspace }}/release && yarn && yarn build
+        sparse-checkout: |
+          release
+          .github
+    - name: Prepare release scripts
+      uses: ./.github/actions/prepare-release-scripts
     - name: Get Release Version
       uses: actions/github-script@v7
       id: canonical_version
@@ -108,9 +110,11 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          sparse-checkout: release
-      - name: Prepare build scripts
-        run: cd ${{ github.workspace }}/release && yarn && yarn build
+          sparse-checkout: |
+            release
+            .github
+      - name: Prepare release scripts
+        uses: ./.github/actions/prepare-release-scripts
       - name: Send publish start message
         uses: actions/github-script@v7
         env:
@@ -140,10 +144,12 @@ jobs:
     - uses: actions/checkout@v4
       with:
         sparse-checkout: .github
-    - name: Retrieve test build uberjar artifact for ${{ matrix.edition }}
+    - name: Retrieve release uberjar artifact for ${{ matrix.edition }}
       uses: ./.github/actions/fetch-artifact
       with:
-        name: metabase-release-${{ matrix.edition }}-${{ inputs.commit }}-uberjar
+        commit: ${{ inputs.commit }}
+        edition: ${{ matrix.edition }}
+        release: "true"
     - name: Check JAR version properties
       run: |
         # ensure actual jar checksum matches checksum file
@@ -187,9 +193,11 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
     - uses: actions/checkout@v4
       with:
-        sparse-checkout: release
-    - name: prepare release scripts
-      run: cd release && yarn && yarn build
+        sparse-checkout: |
+          release
+          .github
+    - name: Prepare release scripts
+      uses: ./.github/actions/prepare-release-scripts
     - uses: actions/download-artifact@v4
       name: Retrieve uberjar artifact
       with:
@@ -259,20 +267,22 @@ jobs:
     uses: ./.github/workflows/containerize-jar.yml
     secrets: inherit
     with:
-      artifact-name: metabase-release-oss-${{ inputs.commit }}-uberjar
+      edition: oss
       commit: ${{ inputs.commit }}
       repo: ${{ vars.DOCKERHUB_OWNER }}/${{ vars.DOCKERHUB_REPO }}
       tag: ${{ needs.check-version.outputs.oss }}
+      release: "true"
 
   containerize-ee:
     needs: check-version
     uses: ./.github/workflows/containerize-jar.yml
     secrets: inherit
     with:
-      artifact-name: metabase-release-ee-${{ inputs.commit }}-uberjar
+      edition: ee
       commit: ${{ inputs.commit }}
       repo: ${{ vars.DOCKERHUB_OWNER }}/${{ vars.DOCKERHUB_REPO }}-enterprise
       tag: ${{ needs.check-version.outputs.ee }}
+      release: "true"
 
   push-tags:
     permissions: write-all
@@ -282,9 +292,11 @@ jobs:
     steps:
     - uses: actions/checkout@v4
       with:
-        sparse-checkout: release
-    - name: prepare release scripts
-      run: cd release && yarn && yarn build
+        sparse-checkout: |
+          release
+          .github
+    - name: Prepare release scripts
+      uses: ./.github/actions/prepare-release-scripts
     - name: Tag Release
       uses: actions/github-script@v7
       with:
@@ -314,9 +326,11 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          sparse-checkout: release
-      - name: prepare release scripts
-        run: cd release && yarn && yarn build
+          sparse-checkout: |
+            release
+            .github
+      - name: Prepare release scripts
+        uses: ./.github/actions/prepare-release-scripts
       - name: Get extra tags
         id: taglist
         uses: actions/github-script@v7
@@ -326,10 +340,11 @@ jobs:
             const { getExtraTagsForVersion } = require('${{ github.workspace }}/release/dist/index.cjs');
 
             const version = '${{ inputs.version }}';
+            const latestMajorVersion = '${{ vars.LATEST_MAJOR_VERSION }}';
 
-            const extra_tags = getExtraTagsForVersion({ version });
+            const extra_tags = getExtraTagsForVersion({ version, latestMajorVersion });
 
-            console.log({ extra_tags });
+            console.log({ extra_tags, latestMajorVersion });
             core.setOutput('extra_tags', JSON.stringify(extra_tags));
 
   add-extra-tags:
@@ -347,9 +362,11 @@ jobs:
     with:
       version: ${{ inputs.version }}
       tag_name: ${{ matrix.tag }}
-      tag_ee: ${{ contains(matrix.tag, 'v1') }}
-      tag_oss: ${{ contains(matrix.tag, 'v0') }}
-      dot-x-tag: true
+      # For version tags (v0.x, v1.x), apply to matching edition only
+      # For non-version tags like "latest", apply to both editions
+      tag_ee: ${{ contains(matrix.tag, 'v1') || !startsWith(matrix.tag, 'v') }}
+      tag_oss: ${{ contains(matrix.tag, 'v0') || !startsWith(matrix.tag, 'v') }}
+      dot-x-tag: ${{ startsWith(matrix.tag, 'v') }}
 
   trigger-cloud-issues:
     if: ${{ !inputs.auto }}
@@ -359,9 +376,11 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          sparse-checkout: release
-      - name: Prepare build scripts
-        run: cd ${{ github.workspace }}/release && yarn && yarn build
+          sparse-checkout: |
+            release
+            .github
+      - name: Prepare release scripts
+        uses: ./.github/actions/prepare-release-scripts
       - name: Find milestone
         id: find-milestone
         uses: actions/github-script@v7
@@ -424,19 +443,6 @@ jobs:
               }
             });
 
-  # updates the llms.txt asynchronously.
-  # release does not need to wait for this PR to be merged,
-  # because the llms.txt is in the main git repo.
-  trigger-update-llms-txt:
-    # do not trigger llms.txt update on automatic patch releases
-    if: ${{ !inputs.auto }}
-    needs: add-extra-tags
-    uses: ./.github/workflows/llms-txt-generate.yml
-    secrets: inherit
-    with:
-      version: ${{ inputs.version }}
-      branch: ${{ github.ref_name }}
-
   draft-release-notes:
     if: ${{ !inputs.auto }}
     needs: add-extra-tags
@@ -450,9 +456,11 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          sparse-checkout: release
-      - name: prepare release scripts
-        run: cd release && yarn && yarn build
+          sparse-checkout: |
+            release
+            .github
+      - name: Prepare release scripts
+        uses: ./.github/actions/prepare-release-scripts
       - name: Publish draft release notes to github
         uses: actions/github-script@v7
         with:
@@ -529,9 +537,11 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
     - uses: actions/checkout@v4
       with:
-        sparse-checkout: release
-    - name: Prepare build scripts
-      run: cd ${{ github.workspace }}/release && yarn && yarn build
+        sparse-checkout: |
+          release
+          .github
+    - name: Prepare release scripts
+      uses: ./.github/actions/prepare-release-scripts
     - name: Publish version info
       uses: actions/github-script@v7
       id: new_version_info
@@ -586,9 +596,11 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          sparse-checkout: release
-      - name: Prepare build scripts
-        run: cd ${{ github.workspace }}/release && yarn && yarn build
+          sparse-checkout: |
+            release
+            .github
+      - name: Prepare release scripts
+        uses: ./.github/actions/prepare-release-scripts
       - name: Send publish complete message
         uses: actions/github-script@v7
         env:
@@ -617,9 +629,11 @@ jobs:
     steps:
     - uses: actions/checkout@v4
       with:
-        sparse-checkout: release
-    - name: Prepare build scripts
-      run: cd ${{ github.workspace }}/release && yarn && yarn build
+        sparse-checkout: |
+          release
+          .github
+    - name: Prepare release scripts
+      uses: ./.github/actions/prepare-release-scripts
     - name: Update milestones
       uses: actions/github-script@v7
       with:

.github/workflows/semantic-search.yml

@@ -15,7 +15,7 @@ jobs:
   semantic-search-tests-h2:
     if: ${{ !inputs.skip }}
     runs-on: ubuntu-22.04
-    timeout-minutes: 60
+    timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
@@ -46,6 +46,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Test ${{ matrix.version.name }}
+        id: test-driver
         uses: ./.github/actions/test-driver
         with:
           build-static-viz: ${{ matrix.job.build-static-viz }}
@@ -64,11 +65,12 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   semantic-search-tests-mariadb:
     if: ${{ !inputs.skip }}
     runs-on: ubuntu-22.04
-    timeout-minutes: 60
+    timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
@@ -118,6 +120,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Test ${{ matrix.version.name }}
+        id: test-driver
         uses: ./.github/actions/test-driver
         with:
           build-static-viz: ${{ matrix.job.build-static-viz }}
@@ -136,11 +139,12 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   semantic-search-tests-mysql:
     if: ${{ !inputs.skip }}
     runs-on: ubuntu-22.04
-    timeout-minutes: 60
+    timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
@@ -190,6 +194,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Test ${{ matrix.version.name }}
+        id: test-driver
         uses: ./.github/actions/test-driver
         with:
           build-static-viz: ${{ matrix.job.build-static-viz }}
@@ -208,11 +213,12 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   semantic-search-tests-postgres:
     if: ${{ !inputs.skip }}
     runs-on: ubuntu-22.04
-    timeout-minutes: 60
+    timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
@@ -263,6 +269,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Test ${{ matrix.version.name }}
+        id: test-driver
         uses: ./.github/actions/test-driver
         with:
           build-static-viz: ${{ matrix.job.build-static-viz }}
@@ -281,6 +288,7 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   semantic-search-tests-result:
     needs:

.github/workflows/snyk.yml

@@ -41,16 +41,36 @@ jobs:
     strategy:
       matrix:
         project:
-          - name: Main Frontend (yarn)
+          - name: Main Frontend (bun w/ yarn.lock)
             file: yarn.lock
             package-manager: yarn
-            category: main-frontend-yarn
+            category: main-frontend-bun
           - name: Release Helper
             file: release/yarn.lock
             package-manager: yarn
             category: release-helper
     steps:
       - uses: actions/checkout@v4
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: "1.3.7"
+          token: ${{ secrets.GITHUB_TOKEN }}
+        # Snyk doesn't support bun.lock yet, so we generate yarn.lock and scan that.
+        # Bun has a bug where it normalizes "< 3.0.0" to "< 3" in alias entries
+        # but not in dependency specs, causing Snyk to fail matching dependencies.
+        # The sed commands fix this inconsistency. They continue on error to let
+        # Snyk report parsing issues directly rather than failing on the workaround.
+      - name: Generate yarn.lock
+        if: matrix.project.file == 'yarn.lock'
+        run: |
+          bun install --yarn
+          sed -i -E 's/< ([0-9]+)\.0\.0"/< \1"/g; s/< ([0-9]+)\.0"/< \1"/g' yarn.lock || true
+      - name: Generate release/yarn.lock
+        if: matrix.project.file == 'release/yarn.lock'
+        run: |
+          bun install --yarn
+          sed -i -E 's/< ([0-9]+)\.0\.0"/< \1"/g; s/< ([0-9]+)\.0"/< \1"/g' yarn.lock || true
+        working-directory: release
       - uses: snyk/actions/setup@0.4.0
       - name: Run snyk test
         env:

.github/workflows/tag-for-release.yml

@@ -23,9 +23,11 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          sparse-checkout: release
-      - name: Prepare build scripts
-        run: cd ${{ github.workspace }}/release && yarn && yarn build
+          sparse-checkout: |
+            release
+            .github
+      - name: Prepare release scripts
+        uses: ./.github/actions/prepare-release-scripts
       - name: Send build start message
         uses: actions/github-script@v7
         env:
@@ -62,9 +64,11 @@ jobs:
         exit 1
     - uses: actions/checkout@v4
       with:
-        sparse-checkout: release
-    - name: Prepare build scripts
-      run: cd ${{ github.workspace }}/release && yarn && yarn build
+        sparse-checkout: |
+          release
+          .github
+    - name: Prepare release scripts
+      uses: ./.github/actions/prepare-release-scripts
     - name: Get Release Version
       uses: actions/github-script@v7
       id: canonical_version
@@ -104,9 +108,11 @@ jobs:
       uses: actions/checkout@v4
       with:
         fetch-depth: 0  # IMPORTANT! to get all the branches
-        sparse-checkout: release
-    - name: Prepare build scripts
-      run: cd ${{ github.workspace }}/release && yarn && yarn build
+        sparse-checkout: |
+          release
+          .github
+    - name: Prepare release scripts
+      uses: ./.github/actions/prepare-release-scripts
     - name: Get Release Branch
       uses: actions/github-script@v7
       id: release_branch
@@ -124,6 +130,7 @@ jobs:
         git branch --contains ${{ inputs.commit }} | grep -q $RELEASE_BRANCH \
           && echo "Commit found in correct release branch" \
           || (echo "Commit not found in correct release branch" && exit 1)
+        git checkout -
 
   tag-uberjar-for-release:
     needs: [check-version, check-commit]
@@ -156,7 +163,8 @@ jobs:
     - name: Retrieve test build uberjar artifact for ${{ matrix.edition }}
       uses: ./.github/actions/fetch-artifact
       with:
-        name: metabase-${{ matrix.edition }}-${{ inputs.commit }}-uberjar
+        commit: ${{ inputs.commit }}
+        edition: ${{ matrix.edition }}
 
     - name: Update version.properties in jar
       run: | # sh

.github/workflows/transforms-python-stress-test.yml

@@ -0,0 +1,495 @@
+name: Transforms Python Stress Test
+
+on:
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: 'Branch name or commit SHA to checkout'
+        type: string
+        required: false
+        default: ''
+      driver:
+        description: 'Which driver(s) to test'
+        required: true
+        default: 'all'
+        type: choice
+        options:
+          - all
+          - bigquery
+          - clickhouse
+          - mongo
+          - mysql
+          - postgres
+          - redshift
+          - snowflake
+          - sqlserver
+
+jobs:
+
+  be-tests-bigquery-transforms:
+    # inputs.driver is empty on push triggers, so treat '' as 'all'
+    if: ${{ inputs.driver == 'all' || inputs.driver == '' || inputs.driver == 'bigquery' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    env:
+      CI: 'true'
+      DRIVERS: bigquery-cloud-sdk
+      MB_BIGQUERY_TEST_PROJECT_ID: ${{ secrets.BIGQUERY_TEST_PROJECT_ID }}
+      MB_BIGQUERY_TEST_CLIENT_ID: ${{ secrets.MB_BIGQUERY_TEST_CLIENT_ID }}
+      MB_BIGQUERY_TEST_CLIENT_SECRET: ${{ secrets.MB_BIGQUERY_TEST_CLIENT_SECRET }}
+      MB_BIGQUERY_TEST_ACCESS_TOKEN: ${{ secrets.MB_BIGQUERY_TEST_ACCESS_TOKEN }}
+      MB_BIGQUERY_TEST_REFRESH_TOKEN: ${{ secrets.MB_BIGQUERY_TEST_REFRESH_TOKEN }}
+      MB_BIGQUERY_CLOUD_SDK_TEST_SERVICE_ACCOUNT_JSON: ${{ secrets.MB_BIGQUERY_CLOUD_SDK_TEST_SERVICE_ACCOUNT_JSON }}
+      MB_BIGQUERY_CLOUD_SDK_TEST_SERVICE_ACCOUNT_JSON_ROUTING: ${{ secrets.MB_BIGQUERY_CLOUD_SDK_TEST_SERVICE_ACCOUNT_JSON_ROUTING }}
+    name: BigQuery Transforms
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        ref: ${{ inputs.ref || github.ref }}
+    - name: Setup python-runner
+      uses: ./.github/actions/setup-python-runner
+      with:
+        metabase-automation-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+    - name: Test BigQuery transforms
+      id: test-driver
+      uses: ./.github/actions/test-driver
+      with:
+        junit-name: 'be-tests-bigquery-transforms'
+        test-args: >-
+          :only-tags [:mb/transforms-python-test]
+    - name: Upload Test Results
+      uses: ./.github/actions/upload-test-results
+      if: always()
+      with:
+        input-path: ./target/junit/
+        output-name: ${{ github.job }}
+        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        aws-region: ${{ vars.AWS_REGION }}
+        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+    - name: Cleanup python-runner
+      if: always()
+      uses: ./.github/actions/cleanup-python-runner
+      with:
+        upload-logs: ${{ steps.test-driver.outcome == 'failure' }}
+        logs-artifact-suffix: BigQuery Transforms
+
+  be-tests-clickhouse-transforms:
+    if: ${{ inputs.driver == 'all' || inputs.driver == '' || inputs.driver == 'clickhouse' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    env:
+      CI: 'true'
+      DRIVERS: clickhouse
+      MB_CLICKHOUSE_TEST_HOST: localhost
+      MB_CLICKHOUSE_TEST_PORT: 8123
+      MB_CLICKHOUSE_TEST_OLD_PORT: 8124
+      MB_CLICKHOUSE_TEST_NGINX_PORT: 8127
+    name: ClickHouse Transforms
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        ref: ${{ inputs.ref || github.ref }}
+    - name: Setup python-runner
+      uses: ./.github/actions/setup-python-runner
+      with:
+        metabase-automation-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+    - name: Add ClickHouse TLS instance to /etc/hosts
+      run: |
+        sudo echo "127.0.0.1 server.clickhouseconnect.test" | sudo tee -a /etc/hosts
+    - name: Start ClickHouse in Docker
+      uses: hoverkraft-tech/compose-action@v2.0.0
+      with:
+        compose-file: "modules/drivers/clickhouse/docker-compose.yml"
+        down-flags: "--volumes"
+        services: |
+          clickhouse
+          clickhouse_tls
+          clickhouse_older_version
+          clickhouse_cluster_node1
+          clickhouse_cluster_node2
+          nginx
+    - name: Test ClickHouse transforms
+      id: test-driver
+      uses: ./.github/actions/test-driver
+      with:
+        junit-name: 'be-tests-clickhouse-transforms'
+        test-args: >-
+          :only-tags [:mb/transforms-python-test]
+    - name: Upload Test Results
+      uses: ./.github/actions/upload-test-results
+      if: always()
+      with:
+        input-path: ./target/junit/
+        output-name: ${{ github.job }}
+        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        aws-region: ${{ vars.AWS_REGION }}
+        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+    - name: Cleanup python-runner
+      if: always()
+      uses: ./.github/actions/cleanup-python-runner
+      with:
+        upload-logs: ${{ steps.test-driver.outcome == 'failure' }}
+        logs-artifact-suffix: ClickHouse Transforms
+
+  be-tests-mongo-transforms:
+    if: ${{ inputs.driver == 'all' || inputs.driver == '' || inputs.driver == 'mongo' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    env:
+      CI: 'true'
+      DRIVERS: mongo
+      MB_MONGO_TEST_USER: metabase
+      MB_MONGO_TEST_PASSWORD: metasample123
+    services:
+      mongodb:
+        image: mongo:latest
+        ports:
+          - "27017:27017"
+        env:
+          MONGO_INITDB_ROOT_USERNAME: metabase
+          MONGO_INITDB_ROOT_PASSWORD: metasample123
+    name: MongoDB Transforms
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        ref: ${{ inputs.ref || github.ref }}
+    - name: Setup python-runner
+      uses: ./.github/actions/setup-python-runner
+      with:
+        metabase-automation-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+    - name: Test MongoDB transforms
+      id: test-driver
+      uses: ./.github/actions/test-driver
+      with:
+        junit-name: 'be-tests-mongo-transforms'
+        test-args: >-
+          :only-tags [:mb/transforms-python-test]
+    - name: Upload Test Results
+      uses: ./.github/actions/upload-test-results
+      if: always()
+      with:
+        input-path: ./target/junit/
+        output-name: ${{ github.job }}
+        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        aws-region: ${{ vars.AWS_REGION }}
+        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+    - name: Cleanup python-runner
+      if: always()
+      uses: ./.github/actions/cleanup-python-runner
+      with:
+        upload-logs: ${{ steps.test-driver.outcome == 'failure' }}
+        logs-artifact-suffix: MongoDB Transforms
+
+  be-tests-mysql-transforms:
+    if: ${{ inputs.driver == 'all' || inputs.driver == '' || inputs.driver == 'mysql' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    services:
+      mysql:
+        image: mysql:latest
+        ports:
+          - "3306:3306"
+        env:
+          MYSQL_ALLOW_EMPTY_PASSWORD: true
+          MYSQL_DATABASE: circle_test
+    env:
+      CI: 'true'
+      DRIVERS: mysql
+      MB_DB_TYPE: mysql
+      MB_DB_HOST: localhost
+      MB_DB_PORT: 3306
+      MB_DB_DBNAME: circle_test
+      MB_DB_USER: root
+      MB_MYSQL_TEST_USER: root
+    name: MySQL Transforms
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        ref: ${{ inputs.ref || github.ref }}
+    - name: Setup python-runner
+      uses: ./.github/actions/setup-python-runner
+      with:
+        metabase-automation-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+    - name: Test MySQL transforms
+      id: test-driver
+      uses: ./.github/actions/test-driver
+      with:
+        junit-name: 'be-tests-mysql-transforms'
+        test-args: >-
+          :only-tags [:mb/transforms-python-test]
+    - name: Upload Test Results
+      uses: ./.github/actions/upload-test-results
+      if: always()
+      with:
+        input-path: ./target/junit/
+        output-name: ${{ github.job }}
+        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        aws-region: ${{ vars.AWS_REGION }}
+        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+    - name: Cleanup python-runner
+      if: always()
+      uses: ./.github/actions/cleanup-python-runner
+      with:
+        upload-logs: ${{ steps.test-driver.outcome == 'failure' }}
+        logs-artifact-suffix: MySQL Transforms
+
+  be-tests-postgres-transforms:
+    if: ${{ inputs.driver == 'all' || inputs.driver == '' || inputs.driver == 'postgres' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    env:
+      CI: 'true'
+      DRIVERS: postgres
+      MB_DB_TYPE: postgres
+      MB_DB_PORT: 5432
+      MB_DB_HOST: localhost
+      MB_DB_DBNAME: mb_test
+      MB_DB_USER: mb_test
+      MB_POSTGRESQL_TEST_USER: mb_test
+    services:
+      postgres:
+        image: postgres:latest
+        ports:
+          - "5432:5432"
+        env:
+          POSTGRES_USER: mb_test
+          POSTGRES_DB: mb_test
+          POSTGRES_HOST_AUTH_METHOD: trust
+    name: Postgres Transforms
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        ref: ${{ inputs.ref || github.ref }}
+    - name: Setup python-runner
+      uses: ./.github/actions/setup-python-runner
+      with:
+        metabase-automation-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+    - name: Test Postgres transforms
+      id: test-driver
+      uses: ./.github/actions/test-driver
+      with:
+        junit-name: 'be-tests-postgres-transforms'
+        test-args: >-
+          :only-tags [:mb/transforms-python-test]
+    - name: Upload Test Results
+      uses: ./.github/actions/upload-test-results
+      if: always()
+      with:
+        input-path: ./target/junit/
+        output-name: ${{ github.job }}
+        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        aws-region: ${{ vars.AWS_REGION }}
+        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+    - name: Cleanup python-runner
+      if: always()
+      uses: ./.github/actions/cleanup-python-runner
+      with:
+        upload-logs: ${{ steps.test-driver.outcome == 'failure' }}
+        logs-artifact-suffix: Postgres Transforms
+
+  be-tests-redshift-transforms:
+    if: ${{ inputs.driver == 'all' || inputs.driver == '' || inputs.driver == 'redshift' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    env:
+      CI: 'true'
+      DRIVERS: redshift
+      MB_REDSHIFT_TEST_USER: metabase_ci
+      MB_REDSHIFT_TEST_DB: testdb
+      MB_REDSHIFT_TEST_DB_ROUTING: dev
+      MB_REDSHIFT_TEST_HOST: ${{ secrets.MB_REDSHIFT_TEST_HOST }}
+      MB_REDSHIFT_TEST_PASSWORD: ${{ secrets.MB_REDSHIFT_TEST_PASSWORD }}
+    name: Redshift Transforms
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        ref: ${{ inputs.ref || github.ref }}
+    - name: Setup python-runner
+      uses: ./.github/actions/setup-python-runner
+      with:
+        metabase-automation-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+    - name: Test Redshift transforms
+      id: test-driver
+      uses: ./.github/actions/test-driver
+      with:
+        junit-name: 'be-tests-redshift-transforms'
+        test-args: >-
+          :only-tags [:mb/transforms-python-test]
+    - name: Upload Test Results
+      uses: ./.github/actions/upload-test-results
+      if: always()
+      with:
+        input-path: ./target/junit/
+        output-name: ${{ github.job }}
+        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        aws-region: ${{ vars.AWS_REGION }}
+        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+    - name: Cleanup python-runner
+      if: always()
+      uses: ./.github/actions/cleanup-python-runner
+      with:
+        upload-logs: ${{ steps.test-driver.outcome == 'failure' }}
+        logs-artifact-suffix: Redshift Transforms
+
+  be-tests-snowflake-transforms:
+    if: ${{ inputs.driver == 'all' || inputs.driver == '' || inputs.driver == 'snowflake' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    env:
+      CI: 'true'
+      DRIVERS: snowflake
+      MB_SNOWFLAKE_TEST_USER: METABASE CI
+      MB_SNOWFLAKE_TEST_ACCOUNT: ${{ secrets.MB_SNOWFLAKE_TEST_ACCOUNT }}
+      MB_SNOWFLAKE_TEST_PASSWORD: ${{ secrets.MB_SNOWFLAKE_TEST_PASSWORD }}
+      MB_SNOWFLAKE_TEST_PRIVATE_KEY: ${{ secrets.MB_SNOWFLAKE_TEST_PRIVATE_KEY }}
+      MB_SNOWFLAKE_TEST_WAREHOUSE: ${{ secrets.MB_SNOWFLAKE_TEST_WAREHOUSE }}
+      MB_SNOWFLAKE_TEST_PK_USER: METABASE PK
+      MB_SNOWFLAKE_TEST_PK_PRIVATE_KEY: ${{ secrets.MB_SNOWFLAKE_TEST_PK_PRIVATE_KEY }}
+      MB_SNOWFLAKE_TEST_PK_PRIVATE_KEY_2: ${{ secrets.MB_SNOWFLAKE_TEST_PK_PRIVATE_KEY_2 }}
+      MB_SNOWFLAKE_TEST_PK_PUBLIC_KEY: ${{ secrets.MB_SNOWFLAKE_TEST_PK_PUBLIC_KEY }}
+      MB_SNOWFLAKE_TEST_PK_PUBLIC_KEY_2: ${{ secrets.MB_SNOWFLAKE_TEST_PK_PUBLIC_KEY_2 }}
+      MB_SNOWFLAKE_TEST_RSA_ROLE_TEST_DEFAULT_USER: RSA_ROLE_TEST_DEFAULT_USER
+      MB_SNOWFLAKE_TEST_RSA_ROLE_TEST_CUSTOM_USER: RSA_ROLE_TEST_CUSTOM_USER
+      MB_SNOWFLAKE_TEST_RSA_ROLE_TEST_ROLE: RSA_ROLE_TEST_ROLE
+      MB_SNOWFLAKE_TEST_RSA_ROLE_TEST_DB: RSA_ROLE_TEST_DB
+    name: Snowflake Transforms
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        ref: ${{ inputs.ref || github.ref }}
+    - name: Setup python-runner
+      uses: ./.github/actions/setup-python-runner
+      with:
+        metabase-automation-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+    - name: Test Snowflake transforms
+      id: test-driver
+      uses: ./.github/actions/test-driver
+      with:
+        junit-name: 'be-tests-snowflake-transforms'
+        test-args: >-
+          :only-tags [:mb/transforms-python-test]
+    - name: Upload Test Results
+      uses: ./.github/actions/upload-test-results
+      if: always()
+      with:
+        input-path: ./target/junit/
+        output-name: ${{ github.job }}
+        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        aws-region: ${{ vars.AWS_REGION }}
+        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+    - name: Cleanup python-runner
+      if: always()
+      uses: ./.github/actions/cleanup-python-runner
+      with:
+        upload-logs: ${{ steps.test-driver.outcome == 'failure' }}
+        logs-artifact-suffix: Snowflake Transforms
+
+  be-tests-sqlserver-transforms:
+    if: ${{ inputs.driver == 'all' || inputs.driver == '' || inputs.driver == 'sqlserver' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    env:
+      CI: 'true'
+      DRIVERS: sqlserver
+      MB_SQLSERVER_TEST_HOST: localhost
+      MB_SQLSERVER_TEST_PASSWORD: 'P@ssw0rd'
+      MB_SQLSERVER_TEST_USER: SA
+    services:
+      sqlserver:
+        image: mcr.microsoft.com/mssql/server:2022-latest
+        ports:
+          - "1433:1433"
+        env:
+          ACCEPT_EULA: Y
+          SA_PASSWORD: 'P@ssw0rd'
+          MSSQL_MEMORY_LIMIT_MB: 1024
+    name: SQL Server Transforms
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        ref: ${{ inputs.ref || github.ref }}
+    - name: Setup python-runner
+      uses: ./.github/actions/setup-python-runner
+      with:
+        metabase-automation-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+    - name: Test SQL Server transforms
+      id: test-driver
+      uses: ./.github/actions/test-driver
+      with:
+        junit-name: 'be-tests-sqlserver-transforms'
+        test-args: >-
+          :only-tags [:mb/transforms-python-test]
+    - name: Upload Test Results
+      uses: ./.github/actions/upload-test-results
+      if: always()
+      with:
+        input-path: ./target/junit/
+        output-name: ${{ github.job }}
+        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        aws-region: ${{ vars.AWS_REGION }}
+        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+    - name: Cleanup python-runner
+      if: always()
+      uses: ./.github/actions/cleanup-python-runner
+      with:
+        upload-logs: ${{ steps.test-driver.outcome == 'failure' }}
+        logs-artifact-suffix: SQL Server Transforms
+
+  transforms-stress-test-result:
+    needs:
+      - be-tests-bigquery-transforms
+      - be-tests-clickhouse-transforms
+      - be-tests-mongo-transforms
+      - be-tests-mysql-transforms
+      - be-tests-postgres-transforms
+      - be-tests-redshift-transforms
+      - be-tests-snowflake-transforms
+      - be-tests-sqlserver-transforms
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    name: transforms-stress-test-result
+    if: always() && !cancelled()
+    steps:
+      - name: Check job status
+        uses: actions/github-script@v7
+        env:
+          needs: ${{ toJson(needs) }}
+        with:
+          script: |
+            const needs = JSON.parse(process.env.needs);
+
+            const jobs = Object.entries(needs).map(
+              ([jobName, jobValues]) => ({
+                name: jobName,
+                result: jobValues.result
+              }));
+
+            if (jobs.every(job => (job.result === 'skipped' || job.result === 'success'))) {
+              console.log("All transforms tests have passed (or been skipped).");
+              process.exit(0);
+            }
+
+            console.log("Some transforms tests have failed:");
+            jobs.forEach((job) => {
+              if (job.result !== 'success' && job.result !== 'skipped') {
+                console.log(`  ${job.name} - ${job.result}`);
+              }
+            });
+
+            process.exit(1);

.github/workflows/tusk-sanity-check.yml

@@ -1,70 +0,0 @@
-# This allows Tusk to manually run workflows to check lint/build/tests before creating a PR.
-# If you have any questions, please reach out to support@usetusk.ai.
-
-name: Tusk Sanity Check
-
-on:
-  workflow_dispatch:
-    inputs:
-      taskId:
-        description: "Tusk Task ID"
-        required: true
-      runType:
-        description: "Tusk Run Type"
-        required: true
-      runId:
-        description: "Tusk Run ID"
-        required: true
-
-jobs:
-  sanity_check:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Log inputs
-        run: |
-          echo "Tusk Task ID: ${{ github.event.inputs.taskId }}"
-          echo "Tusk Run Type: ${{ github.event.inputs.runType }}"
-          echo "Tusk Run ID: ${{ github.event.inputs.runId }}"
-          echo "Current Branch: ${{ github.ref }}"
-          echo "Repository default branch: ${{ github.event.repository.default_branch }}"
-
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ github.ref }}
-          fetch-depth: 0
-
-      - name: Check which files changed
-        uses: dorny/paths-filter@v3.0.0
-        id: changes
-        with:
-          token: ${{ github.token }}
-          filters: .github/file-paths.yaml
-
-      # Similar to .github/workflows/frontend.yml
-      - name: Prepare front-end environment
-        if: steps.changes.outputs.frontend_all == 'true'
-        uses: ./.github/actions/prepare-frontend
-      - name: Prepare back-end environment
-        uses: ./.github/actions/prepare-backend
-      - run: yarn build-pure:cljs
-        name: Compile CLJS
-
-      - name: Run lint-staged
-        if: steps.changes.outputs.frontend_all == 'true'
-        run: |
-          BASE_COMMIT=$(git merge-base origin/${{ github.event.repository.default_branch }} HEAD)
-          npx lint-staged --shell --no-stash --diff="$BASE_COMMIT...HEAD"
-
-      # You must include this step after running all auto-fixing steps
-      - uses: stefanzweifel/git-auto-commit-action@v5
-        with:
-          commit_message: "fix(${{ github.run_id }}): auto linting" # The commit message MUST start with "fix(${{ github.run_id }}):"
-          commit_options: "--no-verify" # No verify because we already ran it above
-          skip_fetch: true
-          skip_checkout: true
-          status_options: "--untracked-files=no"
-          add_options: "--update"
-
-      - name: Check types
-        if: steps.changes.outputs.frontend_all == 'true'
-        run: yarn type-check-pure

.github/workflows/uberjar.yml

@@ -44,7 +44,8 @@ jobs:
         continue-on-error: true
         uses: ./.github/actions/fetch-artifact
         with:
-          name: metabase-ee-${{ github.event.inputs.commit || github.event.pull_request.head.sha || github.sha }}-uberjar
+          commit: ${{ github.event.inputs.commit || github.event.pull_request.head.sha || github.sha }}
+          edition: ee
           output-name: metabase-ee.jar
 
       - name: Try to fetch existing OSS artifact
@@ -52,7 +53,8 @@ jobs:
         continue-on-error: true
         uses: ./.github/actions/fetch-artifact
         with:
-          name: metabase-oss-${{ github.event.inputs.commit || github.event.pull_request.head.sha || github.sha }}-uberjar
+          commit: ${{ github.event.inputs.commit || github.event.pull_request.head.sha || github.sha }}
+          edition: oss
           output-name: metabase-oss.jar
 
       - name: Decide if build is needed
@@ -89,9 +91,11 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          sparse-checkout: release
-      - name: Prepare build scripts
-        run: cd ${{ github.workspace }}/release && yarn && yarn build
+          sparse-checkout: |
+            release
+            .github
+      - name: Prepare release scripts
+        uses: ./.github/actions/prepare-release-scripts
       - name: Get build dependencies
         uses: actions/github-script@v7
         id: dependencies
@@ -140,7 +144,7 @@ jobs:
       - name: Prepare uberjar artifact
         uses: ./.github/actions/prepare-uberjar-artifact
         with:
-          name: metabase-${{ matrix.edition }}-${{ github.event.inputs.commit || github.event.pull_request.head.sha || github.sha }}-uberjar
+          edition: ${{ matrix.edition }}
 
   check-jar-health:
     runs-on: ubuntu-22.04
@@ -171,7 +175,14 @@ jobs:
       - name: Retrieve uberjar artifact
         uses: ./.github/actions/fetch-artifact
         with:
-          name: metabase-${{ matrix.edition }}-${{ github.event.inputs.commit || github.event.pull_request.head.sha || github.sha }}-uberjar
+          commit: ${{ github.event.inputs.commit || github.event.pull_request.head.sha || github.sha }}
+          edition: ${{ matrix.edition }}
+      - name: Verify license files are present in uberjar
+        run: |
+          echo "Checking for license files in uberjar..."
+          unzip -l ./metabase.jar | grep -q "license-backend-third-party.txt" || (echo "ERROR: license-backend-third-party.txt not found in uberjar" && exit 1)
+          unzip -l ./metabase.jar | grep -q "license-frontend-third-party.txt" || (echo "ERROR: license-frontend-third-party.txt not found in uberjar" && exit 1)
+          echo "Both license files found in uberjar"
       - name: Launch uberjar
         run: >-
           java --add-opens java.base/java.nio=ALL-UNNAMED -jar ./metabase.jar &

.github/workflows/update-e2e-timings.yml

@@ -23,9 +23,16 @@ jobs:
     env:
       DAYS_BACK: ${{ inputs.days_back || 7 }}
     steps:
+      - name: Generate GitHub App Token
+        uses: actions/create-github-app-token@v1
+        id: app-token
+        with:
+          app-id: ${{ secrets.METABASE_BOT_APP_ID }}
+          private-key: ${{ secrets.METABASE_BOT_APP_PRIVATE_KEY }}
+
       - uses: actions/checkout@v4
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ steps.app-token.outputs.token }}
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
@@ -41,7 +48,7 @@ jobs:
             const result = await collectAndAverageTimings({
               github,
               context,
-              token: '${{ secrets.GITHUB_TOKEN }}',
+              token: '${{ steps.app-token.outputs.token }}',
               daysBack: ${{ env.DAYS_BACK }},
               existingTimingsPath: 'e2e/support/timings.json'
             });
@@ -59,7 +66,7 @@ jobs:
       - name: Create Pull Request
         uses: peter-evans/create-pull-request@v6
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ steps.app-token.outputs.token }}
           branch: ${{ env.BRANCH_NAME }}
           base: master
           commit-message: |
@@ -89,4 +96,7 @@ jobs:
             Co-Authored-By: GitHub Actions <actions@github.com>
           labels: |
             .CI & Tests
+            no-backport
           add-paths: e2e/support/timings.json
+          team-reviewers: |
+            devexp

.github/workflows/yaml.yml

@@ -31,4 +31,4 @@ jobs:
     - uses: actions/checkout@v4
     - name: Prepare front-end environment
       uses: ./.github/actions/prepare-frontend
-    - run: yarn run lint-yaml
+    - run: bun run lint-yaml

.gitignore

@@ -39,7 +39,7 @@
 /cypress
 cypress.env.json
 /deploy/artifacts/*
-/docs/**/node_modules
+**/node_modules/
 /docs/**/package.json
 /docs/**/yarn.lock
 /docs/embedding/sdk/api/
@@ -55,7 +55,6 @@ cypress.env.json
 /logs
 /modules/drivers/*/resources/namespaces.edn
 /modules/drivers/*/target
-/node_modules/
 /plugins
 /process.yml
 /reset-password-artifacts
@@ -86,7 +85,6 @@ cypress.env.json
 /temp
 **/cli-snippets-tmp/**
 \#*\#
-bin/node_modules/
 bin/release/aws-eb/metabase-aws-eb.zip
 coverage-summary.json
 junit.xml
@@ -106,7 +104,6 @@ dev/serialization_deltas/
 /trace-output/
 /temp-types/
 /frontend/src/metabase-types/openapi
-/resources/openapi/openapi.json
 
 **/cypress_sample_database.json
 **/cypress_sample_instance_data.json
@@ -168,3 +165,9 @@ CLAUDE.local.md
 /logs
 /.clojure-mcp
 
+# Python dependencies (pip-installed, not committed)
+/resources/python-sources/sqlglot/
+/resources/python-sources/sqlglot-*.dist-info/
+/resources/python-sources/.lock
+__pycache__/
+

.husky/pre-commit

@@ -1,4 +1,4 @@
-yarn precommit
+bun run precommit
 
 # Run the formatter
 # Note that this is stubbed in for now until we can gobally resolve some formatting issues such as what is described