Run the tests please

move snowplow transform metrics to OSS, as transforms are now available on OSS

.claude/commands/ci-report.md

@@ -0,0 +1,12 @@
+Generate a CI failure report for PR $PR_NUM_OR_URL (or current branch if no argument given).
+
+Run `./bin/mage ci-report $PR_NUM_OR_URL` to generate the report, then:
+
+1. **Summarize the failures** - What tests failed and in which jobs?
+2. **Categorize** - Are these real failures, flaky tests, or infrastructure issues?
+3. **Recommend next steps**:
+   - If flaky: suggest rerunning with `gh run rerun <run-id> --failed -R metabase/metabase`
+   - If real: identify the root cause and suggest fixes
+   - If infrastructure: note the issue type (timeout, OOM, network)
+
+Focus on actionable insights. If all checks are passing, confirm that briefly.

.claude/commands/mutation-testing.md

@@ -0,0 +1 @@
+Run mutation testing for $ARGUMENTS

.claude/skills/_shared/clojure-commands.md

@@ -12,14 +12,7 @@
 
 ## Testing
 
-- **Run a test:** `./bin/mage run-tests namespace/test-name`
-- **Run all tests in a namespace:** `./bin/mage run-tests namespace`
-- **Run all tests for a module:** `./bin/mage run-tests test/metabase/notification` Because the module lives in that directory.
-
-Note: the `./bin/mage run-tests` command accepts multiple args, so you can pass
-`./bin/mage run-tests namespace/test-name namespace/other-test namespace/third-test`
-to run 3 tests, or
-`./bin/mage run-tests test/metabase/module1 test/metabase/module2` to run 2 modules.
+Use `./bin/test-agent` to run backend tests. See the top-level CLAUDE.md for usage.
 
 ## Code Readability
 

.claude/skills/_shared/clojure-style-guide.md

@@ -29,7 +29,7 @@ This guide covers Clojure and ClojureScript coding conventions for Metabase. See
 
 **Comments:**
 
-- `TODO` format: `;; TODO (Name M/D/YY) -- description`
+- `TODO` format: `;; TODO (Name YYYY-MM-DD) -- description`
 
 ## Code Organization
 
@@ -42,7 +42,7 @@ This guide covers Clojure and ClojureScript coding conventions for Metabase. See
 
 - Break up functions > 20 lines
 - Lines ≤ 120 characters
-- No blank lines within definition forms (except pairwise `let`/`cond`)
+- No blank non-comment lines within definition forms (except pairwise `let`/`cond`)
 
 ## Style Conventions
 

.claude/skills/_shared/typescript-commands.md

@@ -1,21 +1,21 @@
 ## Linting and Formatting
 
-- **Lint:** `yarn lint-eslint-pure`
+- **Lint:** `bun run lint-eslint-pure`
   - Run ESLint on the codebase
-- **Format:** `yarn prettier`
+- **Format:** `bun run prettier`
   - Format code using Prettier
-- **Type Check:** `yarn type-check-pure`
+- **Type Check:** `bun run type-check-pure`
   - Run TypeScript type checking
 
 ## Testing
 
 ### JavaScript/TypeScript Tests
 
-- **Test a specific file:** `yarn test-unit-keep-cljs path/to/file.unit.spec.js`
-- **Test by pattern:** `yarn test-unit-keep-cljs -t "pattern"`
+- **Test a specific file:** `bun run test-unit-keep-cljs path/to/file.unit.spec.js`
+- **Test by pattern:** `bun run test-unit-keep-cljs -t "pattern"`
   - Runs tests matching the given pattern
 
 ### ClojureScript Tests
 
-- **Test ClojureScript:** `yarn test-cljs`
+- **Test ClojureScript:** `bun run test-cljs`
   - Run ClojureScript tests

.claude/skills/add-tracing/SKILL.md

@@ -0,0 +1,357 @@
+--b-
+name: add-tracing
+description: Add OpenTelemetry tracing spans to Clojure code following Metabase tracing conventions. Use when instrumenting backend code with trace coverage.
+---
+
+# Add Tracing Spans to Clojure Code
+
+This skill helps you add OpenTelemetry (OTel) tracing spans to the Metabase backend codebase using the custom `tracing/with-span` macro.
+
+## Reference Files
+
+- `src/metabase/tracing/core.clj` - `with-span` macro, group registry, SDK lifecycle, `best-effort-sanitize-sql`, Pyroscope integration
+- `src/metabase/task/impl.clj` - `defjob` macro that wraps Quartz jobs with root spans
+- `.clj-kondo/config/modules/config.edn` - Module boundary configuration
+
+## Module Architecture
+
+The tracing module has a deliberately minimal API surface. **Only 2 namespaces are public** (listed in `:api` in the module config):
+
+| Namespace | Role | Status |
+|---|---|---|
+| `tracing.core` | Primary API: `with-span`, groups, SDK lifecycle, Pyroscope, MDC, `best-effort-sanitize-sql` | **Public API** |
+| `tracing.init` | Side-effect loader for `quartz` and `settings` | **Public API** (init convention) |
+| `tracing.attributes` | `best-effort-sanitize-sql` implementation (re-exported via `tracing.core`) | Internal |
+| `tracing.settings` | Setting definitions (`MB_TRACING_*` env vars) | Internal |
+| `tracing.quartz` | Quartz JDBC proxy + JobListener | Internal |
+
+**Rules:**
+- Only require `[metabase.tracing.core :as tracing]` from outside the module. `tracing/best-effort-sanitize-sql` and all other public functions are available from this single namespace.
+- Do not add new API namespaces. Add new public functions to `tracing.core` instead.
+- Do not require internal namespaces (`tracing.attributes`, `tracing.settings`, `tracing.quartz`) from outside the module.
+- `:uses :any` on the `core` module does NOT bypass the target module's `:api` check — internal namespaces are still enforced.
+
+### Cyclic Dependency Avoidance
+
+`tracing/core.clj` is required by many modules across the codebase. It **must NOT** compile-time require `tracing.settings`, as this creates transitive cyclic load dependencies (e.g., `settings/core -> tracing/settings -> tracing/core -> events/impl -> events/core`).
+
+Instead, `tracing/core.clj` uses `requiring-resolve` for settings access:
+
+```clojure
+;; CORRECT — lazy runtime resolution, no compile-time dependency
+((requiring-resolve 'metabase.tracing.settings/tracing-enabled))
+
+;; WRONG — creates cyclic load dependency
+(require '[metabase.tracing.settings :as settings])
+(settings/tracing-enabled)
+```
+
+External library namespaces (clj-otel API, SDK, exporters) are safe to require normally — they don't participate in Metabase namespace cycles.
+
+**Important:** `requiring-resolve` must use **literal quoted symbols**. Kondo hooks validate that `required-namespaces` are all simple symbols, so dynamic construction fails:
+
+```clojure
+;; CORRECT — literal quoted symbol
+(requiring-resolve 'metabase.tracing.settings/tracing-endpoint)
+
+;; WRONG — kondo hook rejects this: "Assert failed: (every? simple-symbol? required-namespaces)"
+(requiring-resolve (symbol "metabase.tracing.settings" "tracing-endpoint"))
+```
+
+## Quick Checklist
+
+When adding tracing spans:
+
+- [ ] Module has `tracing` in its `:uses` set in `.clj-kondo/config/modules/config.edn`
+- [ ] Added `[metabase.tracing.core :as tracing]` to ns requires (alphabetically sorted)
+- [ ] Span wraps a meaningful I/O boundary (not pure computation)
+- [ ] Group matches the domain (check `src/metabase/tracing/core.clj` for registered groups; add a new one if none fit)
+- [ ] Span name follows dot-notation convention (`"domain.subsystem.operation"`)
+- [ ] Attributes use namespaced keywords (`:search/query-length`, `:db/id`)
+- [ ] No sensitive data in attributes (use `best-effort-sanitize-sql` for HoneySQL, never raw SQL)
+- [ ] No new tracing namespaces created (add to `tracing.core` instead)
+- [ ] No `DO_NOT_ADD_NEW_FILES_HERE.txt` violations in the target directory
+- [ ] Run `clj-kondo --lint <files>` to verify 0 errors, 0 warnings
+- [ ] Add or update tests in the corresponding `test/` path (see Testing section below)
+- [ ] Run tests: `clojure -X:dev:test :only <test-ns>`
+
+## The `with-span` Macro
+
+```clojure
+(tracing/with-span group span-name attrs & body)
+```
+
+- **group** - A keyword selecting which trace group this span belongs to (e.g., `:tasks`, `:sync`)
+- **span-name** - A string identifying the span in traces (e.g., `"search.execute"`)
+- **attrs** - A map of span attributes (e.g., `{:db/id 42}`)
+- **body** - The code to execute inside the span
+
+**When disabled:** zero overhead -- single atom deref + boolean check, body runs directly.
+**When enabled:** creates OTel span AND injects `trace_id`/`span_id` into Log4j2 MDC for log-to-trace correlation.
+
+## Trace Groups
+
+Groups are registered in `src/metabase/tracing/core.clj`. Check that file for the current list. The general rule: **match the group to the domain, not the call site.** If code runs inside a Quartz job but is logically search work, use `:search`, not `:tasks`.
+
+To add a new group:
+
+```clojure
+;; In src/metabase/tracing/core.clj
+(register-group! :my-domain "Description of what this covers")
+```
+
+Users enable groups via `MB_TRACING_GROUPS=tasks,search,sync` (comma-separated, or `"all"`).
+
+## Naming Conventions
+
+### Span Names
+
+Use dot-separated hierarchical names: `"domain.subsystem.operation"`. The domain prefix should match the group name:
+
+```
+search.execute              -- `:search` group
+sync.fingerprint.table      -- `:sync` group
+task.session-cleanup.delete -- `:tasks` group
+db-app.collection-items     -- `:db-app` group
+```
+
+### Attributes
+
+Use namespaced keywords. The namespace groups related attributes:
+
+```clojure
+:db/id              -- Database ID (integer)
+:db/engine          -- Database engine name (string)
+:db/statement       -- Sanitized SQL (string, via best-effort-sanitize-sql)
+:search/engine      -- Search engine name (string)
+:search/query-length -- Query string length (integer)
+:sync/table         -- Table name (string)
+:sync/step          -- Sync step name (string)
+:task/name          -- Task name (string)
+:http/method        -- HTTP method (string)
+:http/url           -- Request URL (string)
+```
+
+Invent new namespaced attributes as needed (e.g., `:pulse/id`, `:transform/count`). Keep values as primitives (strings, numbers, booleans) -- no maps or collections.
+
+## Step-by-Step: Adding a Span
+
+### 1. Check module boundaries
+
+Look up the module for your namespace in `.clj-kondo/config/modules/config.edn`. If `tracing` is not in the module's `:uses` set, add it (keep alphabetically sorted):
+
+```edn
+my-module
+{:team "MyTeam"
+ :uses #{analytics config tracing util}}
+```
+
+### 2. Add the require
+
+```clojure
+(ns metabase.my-module.thing
+  (:require
+   [metabase.tracing.core :as tracing]
+   [metabase.util :as u]))
+```
+
+`best-effort-sanitize-sql` is available from `tracing.core` — no additional require needed.
+
+### 3. Identify the I/O boundary
+
+Only wrap code at **meaningful I/O boundaries**:
+
+**DO trace:**
+- External API calls (embedding APIs, metabot, webhooks)
+- Database queries (both app DB and user DB)
+- Network requests (HTTP calls to external services)
+- Heavy batch processing (batch indexing, batch embedding)
+- Top-level orchestration functions that coordinate multiple sub-operations
+
+**DO NOT trace:**
+- Pure computation (sorting, filtering, mapping)
+- Simple single-row lookups (`t2/select-one :model/Setting :key k`)
+- Every function in a call chain (only boundaries matter)
+- Trivial operations (string formatting, hash calculations)
+
+### 4. Wrap with `with-span`
+
+```clojure
+;; Simple span (no attributes needed)
+(tracing/with-span :search "search.init-index" {}
+  (do-expensive-thing))
+
+;; Span with static attributes
+(tracing/with-span :sync "sync.fingerprint.table"
+                   {:db/id (:db_id table)
+                    :sync/table (:name table)}
+  (fingerprint-fields! table fields))
+
+;; Span with computed attributes
+(tracing/with-span :search "search.execute"
+                   {:search/engine       (name (:search-engine ctx))
+                    :search/query-length (count (:search-string ctx))}
+  (search.engine/results ctx))
+
+;; Span with sanitized SQL (for dynamic HoneySQL queries)
+(let [hsql {:delete-from [(t2/table-name :model/Session)]
+            :where [:< :created_at oldest-allowed]}]
+  (tracing/with-span :tasks "task.session-cleanup.delete"
+                     {:db/statement (tracing/best-effort-sanitize-sql hsql)}
+    (t2/query-one hsql)))
+
+;; Sub-spans breaking a function into I/O phases
+(let [embedding (tracing/with-span :search "search.semantic.embedding"
+                                   {:search.semantic/provider (:provider model)}
+                  (get-embedding model search-string))
+      results   (tracing/with-span :search "search.semantic.db-query" {}
+                  (into [] xform reducible))]
+  (process results))
+
+;; Per-item iteration spans
+(doseq [e (search.engine/active-engines)]
+  (tracing/with-span :search "search.ingestion.update" {:search/engine (name e)}
+    (search.engine/update! e batch)))
+```
+
+### 5. Add tests
+
+Create or update tests in the corresponding `test/` path. Follow the patterns in existing tracing tests:
+
+- **Reference tests:** `test/metabase/tracing/quartz_test.clj`, `test/metabase/server/middleware/trace_test.clj`
+- Use `tracing/init-enabled-groups!` / `tracing/shutdown-groups!` with `try`/`finally` to manage group lifecycle
+- Test both enabled and disabled paths (verify zero overhead when group is off)
+- Use `reify` mocks for Java interfaces (Connection, PreparedStatement, JobListener, etc.)
+- Add `(set! *warn-on-reflection* true)` and type-hint proxy/reify calls to avoid reflection warnings
+
+```clojure
+(deftest my-span-enabled-test
+  (testing "when group is enabled, span is created"
+    (try
+      (tracing/init-enabled-groups! "my-group" "INFO")
+      ;; ... test that span behavior occurs ...
+      (finally
+        (tracing/shutdown-groups!)))))
+
+(deftest my-span-disabled-test
+  (testing "when group is disabled, code runs without tracing"
+    (tracing/shutdown-groups!)
+    ;; ... test that code still works, no wrapping applied ...
+    ))
+```
+
+### 6. Lint and run tests
+
+```bash
+# Lint modified source and test files — expect 0 errors, 0 warnings
+clj-kondo --lint path/to/modified/file.clj path/to/test/file.clj
+
+# Run tests (requires Java 21+)
+  clojure -X:dev:test :only my-ns.test-ns
+```
+
+Expect: all tests pass, 0 failures, 0 errors, no reflection warnings from your files.
+
+## Sanitizing SQL for Attributes
+
+When including SQL in span attributes, **always** use `tracing/best-effort-sanitize-sql`. This converts HoneySQL maps to parameterized SQL strings where values become `?` placeholders -- no data leaks.
+
+```clojure
+(let [hsql {:delete-from [:core_session]
+            :where [:< :created_at some-timestamp]}]
+  (tracing/with-span :tasks "task.cleanup.delete"
+                     {:db/statement (tracing/best-effort-sanitize-sql hsql)}
+    (t2/query-one hsql)))
+;; Trace attribute: db/statement = "DELETE FROM core_session WHERE created_at < ?"
+```
+
+**Rules:**
+- Never put raw SQL strings or user-provided values in attributes
+- Use `best-effort-sanitize-sql` only for app DB (HoneySQL) queries
+- For external/user DB queries, trace only timing and counts, not SQL content
+
+## Defjob and Root Spans
+
+The `defjob` macro in `metabase.task.impl` automatically wraps every Quartz job with a `:tasks` root span:
+
+```clojure
+(task/defjob ^{DisallowConcurrentExecution true} SessionCleanup [_]
+  (cleanup-sessions!))
+;; Automatically creates span: "task.SessionCleanup" {:task/name "SessionCleanup"}
+```
+
+You do NOT need a root span inside `defjob` bodies. Add **child spans** for I/O inside the job.
+
+For code on plain `Thread`s (not Quartz), add the root span manually:
+
+```clojure
+(defn init! []
+  (tracing/with-span :search "search.task.init" {}
+    (search/init-index!)))
+```
+
+## What NOT to Do
+
+### Span Usage Mistakes
+
+```clojure
+;; WRONG - pure computation, no I/O
+(tracing/with-span :search "search.format-results" {}
+  (map format-result results))
+
+;; WRONG - trivial single-row lookup
+(tracing/with-span :db-app "db-app.get-setting" {}
+  (t2/select-one :model/Setting :key "my-setting"))
+
+;; WRONG - raw SQL in attributes (data leak)
+(tracing/with-span :tasks "task.cleanup" {:db/statement raw-sql-string}
+  (execute! raw-sql-string))
+
+;; WRONG - wrong group (search work should use :search, not :tasks)
+(tracing/with-span :tasks "search.execute" {} ...)
+
+;; WRONG - redundant nesting (do-search already has a span)
+(tracing/with-span :search "search.process" {}
+  (let [results (do-search ctx)]
+    (tracing/with-span :search "search.format" {}
+      (format-results results))))
+```
+
+### Architecture Mistakes
+
+```clojure
+;; WRONG - creating a new tracing namespace
+(ns metabase.tracing.my-feature ...)
+
+;; WRONG - requiring internal tracing namespaces from outside the module
+(ns metabase.my-module.thing
+  (:require [metabase.tracing.attributes :as trace-attrs]      ;; internal!
+            [metabase.tracing.settings :as tracing.settings]   ;; internal!
+            [metabase.tracing.quartz :as tracing.quartz]))     ;; internal!
+
+;; WRONG - adding compile-time requires to tracing/core.clj for settings or SDK
+;; This creates cyclic load dependencies because tracing/core is widely required
+(ns metabase.tracing.core
+  (:require [metabase.tracing.settings :as settings]))  ;; causes cycle!
+
+;; WRONG - dynamic symbol construction with requiring-resolve (kondo rejects it)
+(requiring-resolve (symbol "metabase.tracing.settings" "tracing-enabled"))
+```
+
+## Configuration
+
+All settings are env-var-only (defined in `src/metabase/tracing/settings.clj`):
+
+```bash
+# Core
+MB_TRACING_ENABLED=true              # Enable tracing (default: false)
+MB_TRACING_ENDPOINT=host:4317        # OTLP collector endpoint (default: http://localhost:4317)
+MB_TRACING_GROUPS=tasks,search,sync  # Comma-separated groups or "all" (default: all)
+MB_TRACING_SERVICE_NAME=metabase     # Service name in traces (default: hostname)
+MB_TRACING_LOG_LEVEL=DEBUG           # Log threshold for traced threads: TRACE/DEBUG/INFO (default: INFO)
+
+# Batch span processor tuning
+MB_TRACING_MAX_QUEUE_SIZE=2048       # Max spans queued for export; drops when full (default: 2048)
+MB_TRACING_EXPORT_TIMEOUT_MS=10000   # Max wait for batch export to complete (default: 10000)
+MB_TRACING_SCHEDULE_DELAY_MS=5000    # Delay between consecutive batch exports (default: 5000)
+```

.claude/skills/analytics-events/SKILL.md

@@ -0,0 +1,504 @@
+---
+name: analytics-events
+description: Add product analytics events to track user interactions in the Metabase frontend
+allowed-tools: Read, Write, Edit, Grep, Glob
+---
+
+# Frontend Analytics Events Skill
+
+This skill helps you add product analytics (Snowplow) events to track user interactions in the Metabase frontend codebase.
+
+## Quick Reference
+
+Analytics events in Metabase use Snowplow with typed event schemas. All events must be defined in TypeScript types before use.
+
+**Key Files:**
+- `frontend/src/metabase-types/analytics/event.ts` - Event type definitions
+- `frontend/src/metabase-types/analytics/schema.ts` - Schema registry
+- `frontend/src/metabase/lib/analytics.ts` - Core tracking functions
+- Feature-specific `analytics.ts` files - Tracking function wrappers
+
+## Quick Checklist
+
+When adding a new analytics event:
+
+- [ ] Define event type in `frontend/src/metabase-types/analytics/event.ts`
+- [ ] Add event to appropriate union type (e.g., `DataStudioEvent`, `SimpleEvent`)
+- [ ] Create tracking function in feature's `analytics.ts` file
+- [ ] Import and call tracking function at the interaction point
+- [ ] Use `trackSimpleEvent()` for basic events (most common)
+
+## Event Schema Types
+
+### 1. Simple Events (Most Common)
+
+Use `SimpleEventSchema` for straightforward tracking. It supports these standard fields:
+
+```typescript
+type SimpleEventSchema = {
+  event: string;                    // Required: Event name (snake_case)
+  target_id?: number | null;        // Optional: ID of affected entity
+  triggered_from?: string | null;   // Optional: UI location/context
+  duration_ms?: number | null;      // Optional: Duration in milliseconds
+  result?: string | null;           // Optional: Outcome (e.g., "success", "failure")
+  event_detail?: string | null;     // Optional: Additional detail/variant
+};
+```
+
+**When to use:** 90% of events fit this schema. Use for clicks, opens, closes, creates, deletes, etc.
+
+### 2. Custom Schemas (legacy, no events are being added)
+
+Consider adding new event schema only in very special cases.
+
+**Examples:** `DashboardEventSchema`, `CleanupEventSchema`, `QuestionEventSchema`
+
+## Step-by-Step: Adding a Simple Event
+
+### Example: Track when a user applies filters in a table picker
+
+#### Step 1: Define Event Types
+
+Add event type definitions to `frontend/src/metabase-types/analytics/event.ts`:
+
+```typescript
+export type DataStudioTablePickerFiltersAppliedEvent = ValidateEvent<{
+  event: "data_studio_table_picker_filters_applied";
+}>;
+
+export type DataStudioTablePickerFiltersClearedEvent = ValidateEvent<{
+  event: "data_studio_table_picker_filters_cleared";
+}>;
+```
+
+#### Step 2: Add to Union Type
+
+Find or create the appropriate union type and add your events:
+
+```typescript
+export type DataStudioEvent =
+  | DataStudioLibraryCreatedEvent
+  | DataStudioTablePublishedEvent
+  | DataStudioGlossaryCreatedEvent
+  | DataStudioGlossaryEditedEvent
+  | DataStudioGlossaryDeletedEvent
+  | DataStudioTablePickerFiltersAppliedEvent  // <- Add here
+  | DataStudioTablePickerFiltersClearedEvent; // <- Add here
+```
+
+#### Step 3: Create Tracking Functions
+
+In your feature's `analytics.ts` file (e.g., `enterprise/frontend/src/metabase-enterprise/data-studio/analytics.ts`):
+
+```typescript
+import { trackSimpleEvent } from "metabase/lib/analytics";
+
+export const trackDataStudioTablePickerFiltersApplied = () => {
+  trackSimpleEvent({
+    event: "data_studio_table_picker_filters_applied",
+  });
+};
+
+export const trackDataStudioTablePickerFiltersCleared = () => {
+  trackSimpleEvent({
+    event: "data_studio_table_picker_filters_cleared",
+  });
+};
+```
+
+#### Step 4: Use in Components
+
+Import and call the tracking function at the interaction point:
+
+```typescript
+import {
+  trackDataStudioTablePickerFiltersApplied,
+  trackDataStudioTablePickerFiltersCleared,
+} from "metabase-enterprise/data-studio/analytics";
+
+function FilterPopover({ filters, onSubmit }) {
+  const handleReset = () => {
+    trackDataStudioTablePickerFiltersCleared(); // <- Track here
+    onSubmit(emptyFilters);
+  };
+
+  return (
+    <form
+      onSubmit={(event) => {
+        event.preventDefault();
+        trackDataStudioTablePickerFiltersApplied(); // <- Track here
+        onSubmit(form);
+      }}
+    >
+      {/* form content */}
+    </form>
+  );
+}
+```
+
+## Using SimpleEventSchema Fields
+
+### Example: Event with target_id
+
+```typescript
+// Type definition
+export type DataStudioLibraryCreatedEvent = ValidateEvent<{
+  event: "data_studio_library_created";
+  target_id: number | null;
+}>;
+
+// Tracking function
+export const trackDataStudioLibraryCreated = (id: CollectionId) => {
+  trackSimpleEvent({
+    event: "data_studio_library_created",
+    target_id: Number(id),
+  });
+};
+
+// Usage
+trackDataStudioLibraryCreated(newLibrary.id);
+```
+
+### Example: Event with triggered_from
+
+```typescript
+// Type definition
+export type NewButtonClickedEvent = ValidateEvent<{
+  event: "new_button_clicked";
+  triggered_from: "app-bar" | "empty-collection";
+}>;
+
+// Tracking function
+export const trackNewButtonClicked = (location: "app-bar" | "empty-collection") => {
+  trackSimpleEvent({
+    event: "new_button_clicked",
+    triggered_from: location,
+  });
+};
+
+// Usage
+<Button onClick={() => {
+  trackNewButtonClicked("app-bar");
+  handleCreate();
+}}>
+  New
+</Button>
+```
+
+### Example: Event with event_detail
+
+```typescript
+// Type definition
+export type MetadataEditEvent = ValidateEvent<{
+  event: "metadata_edited";
+  event_detail: "type_casting" | "semantic_type_change" | "visibility_change";
+  triggered_from: "admin" | "data_studio";
+}>;
+
+// Tracking function
+export const trackMetadataChange = (
+  detail: "type_casting" | "semantic_type_change" | "visibility_change",
+  location: "admin" | "data_studio"
+) => {
+  trackSimpleEvent({
+    event: "metadata_edited",
+    event_detail: detail,
+    triggered_from: location,
+  });
+};
+
+// Usage
+trackMetadataChange("semantic_type_change", "data_studio");
+```
+
+### Example: Event with result and duration
+
+```typescript
+// Type definition
+export type MoveToTrashEvent = ValidateEvent<{
+  event: "moved-to-trash";
+  target_id: number | null;
+  triggered_from: "collection" | "detail_page" | "cleanup_modal";
+  duration_ms: number | null;
+  result: "success" | "failure";
+  event_detail: "question" | "model" | "metric" | "dashboard";
+}>;
+
+// Tracking function
+export const trackMoveToTrash = (params: {
+  targetId: number | null;
+  triggeredFrom: "collection" | "detail_page" | "cleanup_modal";
+  durationMs: number | null;
+  result: "success" | "failure";
+  itemType: "question" | "model" | "metric" | "dashboard";
+}) => {
+  trackSimpleEvent({
+    event: "moved-to-trash",
+    target_id: params.targetId,
+    triggered_from: params.triggeredFrom,
+    duration_ms: params.durationMs,
+    result: params.result,
+    event_detail: params.itemType,
+  });
+};
+
+// Usage with timing
+const startTime = Date.now();
+try {
+  await moveToTrash(item);
+  trackMoveToTrash({
+    targetId: item.id,
+    triggeredFrom: "collection",
+    durationMs: Date.now() - startTime,
+    result: "success",
+    itemType: "question",
+  });
+} catch (error) {
+  trackMoveToTrash({
+    targetId: item.id,
+    triggeredFrom: "collection",
+    durationMs: Date.now() - startTime,
+    result: "failure",
+    itemType: "question",
+  });
+}
+```
+
+## Naming Conventions
+
+### Event Names (snake_case)
+
+```typescript
+// Good
+"data_studio_library_created"
+"table_picker_filters_applied"
+"metabot_chat_opened"
+
+// Bad
+"DataStudioLibraryCreated"  // Wrong case
+"tablePickerFiltersApplied" // Wrong case
+"filters-applied"            // Use underscore, not hyphen
+```
+
+### Event Type Names (PascalCase with "Event" suffix)
+
+```typescript
+// Good
+DataStudioLibraryCreatedEvent
+TablePickerFiltersAppliedEvent
+MetabotChatOpenedEvent
+
+// Bad
+dataStudioLibraryCreated      // Wrong case
+DataStudioLibraryCreated      // Missing "Event" suffix
+```
+
+### Tracking Function Names (camelCase with "track" prefix)
+
+```typescript
+// Good
+trackDataStudioLibraryCreated
+trackTablePickerFiltersApplied
+trackMetabotChatOpened
+
+// Bad
+DataStudioLibraryCreated      // Missing "track" prefix
+track_library_created         // Wrong case
+logLibraryCreated             // Use "track" prefix
+```
+
+## Common Patterns
+
+### Pattern 1: Feature-Specific Union Types
+
+Group related events together:
+
+```typescript
+export type DataStudioEvent =
+  | DataStudioLibraryCreatedEvent
+  | DataStudioTablePublishedEvent
+  | DataStudioGlossaryCreatedEvent;
+
+export type MetabotEvent =
+  | MetabotChatOpenedEvent
+  | MetabotRequestSentEvent
+  | MetabotFixQueryClickedEvent;
+
+// Then add to SimpleEvent union
+export type SimpleEvent =
+  | /* other events */
+  | DataStudioEvent
+  | MetabotEvent
+  | /* more events */;
+```
+
+### Pattern 2: Conditional Tracking
+
+Track different events based on user action:
+
+```typescript
+const handleSave = async () => {
+  if (isNewItem) {
+    await createItem(data);
+    trackItemCreated(newItem.id);
+  } else {
+    await updateItem(id, data);
+    trackItemUpdated(id);
+  }
+};
+```
+
+## Common Pitfalls
+
+### Don't: Add custom fields to SimpleEvent
+
+```typescript
+// WRONG - SimpleEvent doesn't support custom fields
+export const trackFiltersApplied = (filters: FilterState) => {
+  trackSimpleEvent({
+    event: "filters_applied",
+    data_layer: filters.dataLayer,      // ❌ Not in SimpleEventSchema
+    data_source: filters.dataSource,    // ❌ Not in SimpleEventSchema
+    with_owner: filters.hasOwner,       // ❌ Not in SimpleEventSchema
+  });
+};
+
+// RIGHT - Use only standard SimpleEventSchema fields
+export const trackFiltersApplied = () => {
+  trackSimpleEvent({
+    event: "filters_applied",
+  });
+};
+
+// Or use event_detail for a single variant
+export const trackFilterApplied = (filterType: string) => {
+  trackSimpleEvent({
+    event: "filter_applied",
+    event_detail: filterType,  // ✓ "data_layer", "data_source", etc.
+  });
+};
+```
+
+### Don't: Forget to add event to union type
+
+```typescript
+// Define the event
+export type NewFeatureClickedEvent = ValidateEvent<{
+  event: "new_feature_clicked";
+}>;
+
+// ❌ WRONG - Forgot to add to SimpleEvent union
+// Event won't be recognized by TypeScript
+
+// ✓ RIGHT - Add to appropriate union
+export type SimpleEvent =
+  | /* other events */
+  | NewFeatureClickedEvent;
+```
+
+### Don't: Mix up event name formats
+
+```typescript
+// WRONG
+event: "dataStudioLibraryCreated"  // camelCase
+event: "data-studio-library-created"  // kebab-case
+event: "Data_Studio_Library_Created"  // Mixed case
+
+// RIGHT
+event: "data_studio_library_created"  // snake_case
+```
+
+### Don't: Track PII or sensitive data
+
+```typescript
+// WRONG - Don't track user emails, names, or sensitive data
+trackSimpleEvent({
+  event: "user_logged_in",
+  event_detail: user.email,  // ❌ PII
+});
+
+// RIGHT - Track non-sensitive identifiers only
+trackSimpleEvent({
+  event: "user_logged_in",
+  target_id: user.id,  // ✓ Just the ID
+});
+```
+
+### Don't: Forget to track both success and failure
+
+```typescript
+// WRONG - Only tracking success
+try {
+  await saveData();
+  trackDataSaved();
+} catch (error) {
+  // ❌ No tracking for failure case
+}
+
+// RIGHT - Track both outcomes
+try {
+  await saveData();
+  trackDataSaved({ result: "success" });
+} catch (error) {
+  trackDataSaved({ result: "failure" });
+}
+```
+
+## Testing Analytics Events
+
+While developing, you can verify events are firing:
+
+1. **Check browser console** - When `SNOWPLOW_ENABLED=true` in dev, events are logged
+2. **Use shouldLogAnalytics** - Set in `metabase/env` to see all analytics in console
+3. **Check Snowplow debugger** - Browser extension for Snowplow events
+
+Example console output:
+
+```
+[SNOWPLOW EVENT | event sent:true], data_studio_table_picker_filters_applied
+```
+
+## File Organization
+
+### Where to put tracking functions:
+
+```
+Feature-specific analytics functions:
+frontend/src/metabase/{feature}/analytics.ts
+enterprise/frontend/src/metabase-enterprise/{feature}/analytics.ts
+
+Event type definitions (all in one place):
+frontend/src/metabase-types/analytics/event.ts
+
+Core tracking utilities:
+frontend/src/metabase/lib/analytics.ts
+```
+
+## Real-World Examples
+
+See these files for reference:
+
+- **Simple events**: `enterprise/frontend/src/metabase-enterprise/data-studio/analytics.ts`
+- **Events with variants**: `frontend/src/metabase/dashboard/analytics.ts`
+- **Complex events**: `frontend/src/metabase/query_builder/analytics.js`
+- **Event type examples**: `frontend/src/metabase-types/analytics/event.ts`
+
+## Workflow Summary
+
+1. **Identify the user interaction** to track
+2. **Decide on event name** (snake_case, descriptive)
+3. **Define event type** in `event.ts` using `ValidateEvent`
+4. **Add to union type** (create feature union if needed)
+5. **Create tracking function** in feature's `analytics.ts`
+6. **Import and call** at the interaction point
+7. **Test** that events fire correctly
+
+## Tips
+
+- **Be specific** - `filters_applied` is better than `action_performed`
+- **Use past tense** - `library_created` not `create_library`
+- **Group related events** - Create feature-specific event union types
+- **Track meaningful actions** - Not every click needs tracking
+- **Consider the data** - What would you want to analyze later?
+- **Stay consistent** - Follow existing naming patterns in the codebase
+- **Document context** - Use `triggered_from` to track where the action happened

.claude/skills/clojure-review/SKILL.md

@@ -54,14 +54,14 @@ Use this to scan through changes efficiently:
 - [ ] Public vars in `src` or `enterprise/backend/src` have useful docstrings
 - [ ] Docstrings use Markdown conventions
 - [ ] References use `[[other-var]]` not backticks
-- [ ] `TODO` comments include author and date: `;; TODO (Name 1/1/25) -- description`
+- [ ] `TODO` comments include author and date: `;; TODO (Name 2025-01-01) -- description`
 
 ### Code Organization
 
 - [ ] Everything `^:private` unless used elsewhere
 - [ ] No `declare` when avoidable (public functions near end)
 - [ ] Functions under 20 lines when possible
-- [ ] No blank lines within definition forms (except pairwise constructs in `let`/`cond`)
+- [ ] No blank, non-comment lines within definition forms (except pairwise constructs in `let`/`cond`)
 - [ ] Lines ≤ 120 characters
 
 ### Tests
@@ -118,7 +118,7 @@ Quick scan for common issues:
 | `update-db`, `save-model`                    | Missing `!` for side effects: `update-db!`, `save-model!`   |
 | `snake_case_var`                             | Should use kebab-case                                       |
 | Public var without docstring                 | Add docstring explaining purpose                            |
-| `;; TODO fix this`                           | Missing author/date: `;; TODO (Name 1/1/25) -- description` |
+| `;; TODO fix this`                           | Missing author/date: `;; TODO (Name 2025-01-01) -- description` |
 | `(defn foo ...)` in namespace used elsewhere | Should be `(defn ^:private foo ...)`                        |
 | Function > 20 lines                          | Consider breaking up into smaller functions                 |
 | `/api/dashboards/:id`                        | Use singular: `/api/dashboard/:id`                          |

.claude/skills/docs-write/SKILL.md

@@ -40,7 +40,7 @@ allowed-tools: Read, Write, Grep, Bash, Glob
 
 **Format:**
 
-- Run prettier on the file after making edits: `yarn prettier --write <file-path>`
+- Run prettier on the file after making edits: `bun run prettier --write <file-path>`
 - This ensures consistent formatting across all documentation
 
 ### Common patterns

.claude/skills/e2e-test-create/SKILL.md

@@ -0,0 +1,260 @@
+---
+name: e2e-test-create
+description: >
+  Analyze React component source code to understand UI structure,
+  then generate idiomatic Cypress E2E tests following Metabase conventions.
+  Falls back to Playwright MCP browser exploration only when code reading
+  and screenshot debugging are insufficient.
+disable-model-invocation: true
+allowed-tools:
+  - Bash
+  - Read
+  - Write
+  - Grep
+  - Glob
+  - Skill
+  - "mcp__playwright__*"
+---
+
+# Code-Reading-First → Generate Cypress Tests (Metabase)
+
+You are writing Cypress E2E tests for the **Metabase** codebase.
+Before generating ANY test code, you MUST analyze React component source code
+to understand DOM structure, selectors, and user flows.
+
+## Phase 0 — Research
+
+1. Read existing helpers before writing anything:
+   - `e2e/support/helpers/` — all shared helpers (restore, signInAs, openOrdersTable, etc.)
+   - `e2e/support/cypress_sample_database.ts` — table/field schema constants (ORDERS, PRODUCTS, etc.)
+   - `e2e/support/cypress_sample_instance_data.ts` — instance-specific IDs (ORDERS_DASHBOARD_ID, NORMAL_USER_ID, etc.)
+2. Glob `e2e/test/scenarios/` to find the closest existing spec to the area under test.
+   Study its patterns — match them exactly.
+3. Glob `frontend/src/metabase/` to find React components for the feature area.
+
+## Phase 1 — Code Analysis
+
+Read React component source to understand DOM structure. No browser needed — source code has everything.
+
+1. **Find relevant components**: Glob and grep `frontend/src/metabase/` for the feature area.
+2. **Extract selectors**: Grep for `data-testid` in relevant components.
+3. **Note visible text**: Read component JSX for button labels, headings, placeholders.
+4. **Note aria attributes**: Grep for `aria-label` in relevant components.
+5. **Understand user flows**: Read event handlers (onClick, onSubmit, onChange) to understand interactions.
+6. **Find API calls**: Grep for `Api.use`, `fetch`, `useQuery`, endpoint definitions to identify API calls to intercept.
+7. **Cross-reference with existing specs**: Find specs in the same area and reuse their proven selectors and `cy.intercept` patterns.
+
+## Phase 2 — Start Backend
+
+Use `MB_EDITION=oss` by default. Only use `MB_EDITION=ee` when the user explicitly asks to write an enterprise test.
+
+Start the backend using `run_in_background: true` (NOT `&`).
+`bin/e2e-backend` automatically detects if a backend is already running and reuses it.
+```bash
+MB_EDITION=oss bin/e2e-backend
+```
+
+Do NOT manually generate snapshots by running unrelated test specs.
+The `bun test-cypress` runner has `GENERATE_SNAPSHOTS: true` by default and automatically
+generates snapshots before running any spec. When running tests in Phase 4 via the `/e2e-test` skill,
+snapshots will be generated on the first run if they don't already exist.
+
+Restore clean test data:
+```bash
+curl -sf -X POST http://localhost:4000/api/testing/restore/default
+```
+
+## Phase 3 — Generate Cypress Spec
+
+### File location & naming
+
+Place specs in `e2e/test/scenarios/<area>/` mirroring the URL structure.
+Name: `<feature>.cy.spec.js` (NOT `.cy.spec.ts`).
+
+### Metabase conventions (mandatory)
+
+- **Helpers via `cy.H`**: All helpers are accessed via `const { H } = cy;` — NOT via direct imports from `e2e/support/helpers`.
+
+```js
+const { H } = cy;
+
+describe("feature name", () => {
+  beforeEach(() => {
+    H.restore();
+    cy.signInAsAdmin();
+  });
+});
+```
+
+- **Sample Database schema** (table/field definitions): Import from `cypress_sample_database`.
+
+```js
+import { ORDERS, ORDERS_ID, PRODUCTS } from "e2e/support/cypress_sample_database";
+```
+
+- **Instance data** (dashboard IDs, user IDs, etc.): Import from `cypress_sample_instance_data`.
+
+```js
+import { ORDERS_DASHBOARD_ID } from "e2e/support/cypress_sample_instance_data";
+```
+
+- **Selectors** (priority order):
+  1. `cy.findByText()` / `cy.findByLabelText()` / `cy.findByRole()` — from `@testing-library/cypress`
+  2. `cy.findByTestId()` — for `data-testid` attributes
+  3. `cy.get("[data-testid='...']")` — fallback
+  4. NEVER use positional selectors, CSS class names, or XPaths.
+
+- **Navigation helpers**: Use existing helpers like `H.openOrdersTable()`, `H.openNativeEditor()`,
+  `H.visitDashboard(id)`, `H.visitQuestion(id)` instead of raw `cy.visit()` chains.
+  Grep `e2e/support/helpers/` to discover what's available for your area.
+
+- **API setup over UI setup**: Use `cy.request()` or existing API helpers to set up state.
+  Only use the UI for the flow you're actually testing.
+
+- **Assertions**: Assert on visible text, URL, aria state — not DOM structure.
+
+- **Waits**: Never use `cy.wait(ms)`. Use `cy.intercept()` + `cy.wait("@alias")` for API calls,
+  or `cy.findByText().should("be.visible")` for DOM readiness.
+
+- **Isolation**: Each `it()` block must be independently runnable.
+  Don't depend on state from a previous `it()`.
+
+### Spec structure template
+
+```js
+const { H } = cy;
+import { ORDERS_DASHBOARD_ID } from "e2e/support/cypress_sample_instance_data";
+import { ORDERS, ORDERS_ID } from "e2e/support/cypress_sample_database";
+
+describe("area > sub-area > feature (#issue-number)", () => {
+  beforeEach(() => {
+    H.restore();
+    cy.signInAsAdmin();
+  });
+
+  it("should do the primary happy-path thing", () => {
+    // test
+  });
+
+  it("should handle the edge case", () => {
+    // test
+  });
+});
+```
+
+### Intercepts
+
+When you identified API calls during code analysis, stub or wait on them:
+
+```js
+cy.intercept("POST", "/api/dataset").as("dataset");
+// ... trigger action ...
+cy.wait("@dataset");
+```
+
+## Phase 4 — Validate
+
+After generating specs:
+1. Check that all imported helpers exist (Grep `e2e/support/helpers/`).
+2. **You MUST use the `/e2e-test` skill** to run tests — do NOT run `bun test-cypress` directly.
+   The `/e2e-test` skill handles edition selection, snapshot management, and correct env vars.
+   `/e2e-test GREP="should do the thing" --spec e2e/test/scenarios/<path>`
+   If you created multiple `it()` blocks, run each one individually to isolate failures.
+
+## Phase 5 — Fix Failures (up to 2 attempts)
+
+When a test fails, **try to fix it from Cypress output first**:
+1. Read the failure screenshot (path printed under `(Screenshots)`).
+2. Read the error message and code frame from the console output.
+3. Fix the test and re-run (back to Phase 4, step 2).
+
+If you cannot diagnose the issue after 2 attempts, proceed to Phase 6.
+
+## Phase 6 — Playwright Fallback
+
+Only reach this phase after 2 failed fix attempts from Phase 5. The backend is already running.
+
+Restore clean test data:
+```bash
+curl -sf -X POST http://localhost:4000/api/testing/restore/default
+```
+
+**Bypass CSP** headers before navigating (Metabase serves strict CSP that blocks dev server scripts).
+Use `browser_run_code` to set this up:
+
+```js
+async (page) => {
+  // Strip CSP headers so the page loads (mirrors Cypress chromeWebSecurity: false)
+  await page.context().route('**/*', async (route) => {
+    const response = await route.fetch();
+    const headers = { ...response.headers() };
+    delete headers['content-security-policy'];
+    delete headers['content-security-policy-report-only'];
+    await route.fulfill({ response, headers });
+  });
+
+  // Sign in via API
+  const response = await page.request.post('http://localhost:4000/api/session', {
+    data: { username: 'admin@metabase.test', password: '12341234' }
+  });
+  const session = await response.json();
+  await page.context().addCookies([{
+    name: 'metabase.DEVICE',
+    value: session.id,
+    domain: 'localhost',
+    path: '/'
+  }]);
+
+  await page.goto('http://localhost:4000');
+  await page.waitForLoadState('networkidle');
+  return 'signed in';
+}
+```
+
+**Maintain an observation log incrementally.** After EVERY significant Playwright interaction,
+IMMEDIATELY append what you observed to the scratch file BEFORE performing the next interaction:
+
+```bash
+cat >> /tmp/e2e-observations.md << 'OBSERVATION'
+## [Page/Flow name]
+- URL: /question/notebook#...
+- Clicked: "Box plot" button → visible text "Box plot", role: radio
+- Selectors: data-testid="viz-type-button", findByText("Box plot")
+- API call: POST /api/dataset (triggered on viz change)
+- Key state: after selecting viz type, summary sidebar shows metric picker
+OBSERVATION
+```
+
+For each page/flow:
+- Take an accessibility snapshot (`browser_snapshot`).
+- Click through interactive elements, fill forms, trigger modals.
+- **Append to the observation log immediately after each step**: URLs, visible text, aria labels, `data-testid` attrs, API calls.
+- Screenshot key states.
+
+After exploration:
+1. Read back your observation log: `cat /tmp/e2e-observations.md`
+2. Fix the test using observed selectors and behavior.
+3. Re-run the test (back to Phase 4).
+4. Clean up: `rm -f /tmp/e2e-observations.md`
+
+## Phase 7 — Cleanup
+
+After all tests pass (or after giving up on fixing failures), **always kill the backend on port 4000**:
+```bash
+lsof -ti:4000 | xargs kill 2>/dev/null || true
+```
+
+Do NOT use broad `pkill` patterns — there may be other Metabase instances on different ports.
+The backend process started in Phase 2 will NOT be killed automatically when the Claude session ends.
+Leaving it running wastes resources and can interfere with future sessions. Always clean up.
+
+## What NOT to do
+
+- Do NOT use Playwright as the first step — always analyze source code first.
+- Do NOT kill the backend between phases — it stays running throughout.
+- Do NOT invent selectors you didn't find in source code or observe in the browser.
+- Do NOT hardcode database IDs — import from `cypress_sample_database` or `cypress_sample_instance_data`.
+- Do NOT use `cy.wait(1000)` or any numeric wait.
+- Do NOT create setup flows through the UI when an API helper exists.
+- Do NOT put tests in `cypress/e2e/` — Metabase uses `e2e/test/scenarios/`.
+- Do NOT import helpers directly from `e2e/support/helpers` — use `const { H } = cy;`.

.claude/skills/e2e-test/SKILL.md

@@ -0,0 +1,78 @@
+---
+name: e2e-test
+description: Run Cypress E2E tests, analyze failures including screenshots, and stress test for flakiness
+disable-model-invocation: false
+---
+
+Run Cypress E2E test: $ARGUMENTS
+
+## Edition selection
+
+**Default: `MB_EDITION=oss`** — runs without enterprise tokens, simpler and faster.
+
+Only use `MB_EDITION=ee` when the user explicitly asks to write or run an enterprise test.
+
+**For `MB_EDITION=ee`:**
+These tokens must be exported in the shell before starting Claude Code:
+- `CYPRESS_MB_ALL_FEATURES_TOKEN` — all features (most EE tests need this)
+- `CYPRESS_MB_PRO_SELF_HOSTED_TOKEN` — pro self-hosted (permissions, SSO, sandboxing)
+- `CYPRESS_MB_STARTER_CLOUD_TOKEN` — starter plan (rarely needed)
+- `CYPRESS_MB_PRO_CLOUD_TOKEN` — pro cloud (rarely needed)
+
+**NEVER echo, print, or log token values. Only check if they are set:**
+```bash
+echo "ALL_FEATURES: ${CYPRESS_MB_ALL_FEATURES_TOKEN:+set}" && echo "PRO_SELF_HOSTED: ${CYPRESS_MB_PRO_SELF_HOSTED_TOKEN:+set}" && echo "STARTER: ${CYPRESS_MB_STARTER_CLOUD_TOKEN:+set}" && echo "PRO_CLOUD: ${CYPRESS_MB_PRO_CLOUD_TOKEN:+set}"
+```
+
+If tokens are missing, tell the user: "EE tokens are not set. Either export them and restart Claude Code, or add `MB_EDITION=oss` to run OSS-only tests."
+
+## Running
+
+First check if snapshots exist:
+```bash
+ls e2e/snapshots/default.sql 2>/dev/null && echo "snapshots exist" || echo "snapshots missing"
+```
+
+If snapshots exist, skip regeneration for speed:
+```bash
+MB_EDITION=oss CYPRESS_VIDEO=false CYPRESS_RETRIES=0 CYPRESS_GUI=false GENERATE_SNAPSHOTS=false bun test-cypress $ARGUMENTS
+```
+
+If snapshots are missing (first run), let the runner generate them:
+```bash
+MB_EDITION=oss CYPRESS_VIDEO=false CYPRESS_RETRIES=0 CYPRESS_GUI=false bun test-cypress $ARGUMENTS
+```
+
+When running enterprise tests, replace `MB_EDITION=oss` with `MB_EDITION=ee` in the commands above.
+
+If `$ARGUMENTS` is empty, ask the user which spec to run.
+
+If the user provides a test name or fuzzy name instead of a spec path, find the spec file:
+```bash
+find e2e/test/scenarios -name "*FUZZY_NAME*.cy.spec.*" -type f
+```
+Then run with `--spec "path/to/matched.cy.spec.js"`.
+
+To filter by test name, use the `GREP` env var (not `--env grep=`, which breaks on commas):
+```bash
+GREP="test name here" MB_EDITION=oss bun test-cypress --spec path/to/spec.js
+```
+
+## Stress test (flaky detection)
+
+When the user asks to verify a test is not flaky:
+
+```bash
+MB_EDITION=oss bin/e2e-stress-test $ARGUMENTS
+```
+
+Set `E2E_STRESS_RUNS=N` for more iterations (default: 5). Stops on first failure and prints screenshot paths. Read those screenshots to analyze the failure.
+
+## Analyzing failures
+
+When tests fail:
+
+1. Read the **screenshot** for each failure — paths are printed in Cypress output under `(Screenshots)`, typically at `cypress/screenshots/<spec-name>/<test-name> (failed).png`
+2. Read the error message and code frame from the console output
+3. Identify the root cause: is it a test bug, a product bug, or a timing issue?
+4. Suggest a fix with specific code changes

.claude/skills/mutation-testing/SKILL.md

@@ -0,0 +1,114 @@
+---
+name: mutation-testing
+description: Run mutation testing on a Clojure namespace, generate tests to kill surviving mutations, and open draft PRs with Linear issue tracking.
+---
+
+# Mutation Testing Skill
+
+This skill runs mutation testing end-to-end: generates a coverage report, groups functions, shells out to `claude -p` to write tests, verifies mutations are killed, and creates draft PRs with Linear issues.
+
+## Prerequisites
+
+- A running nREPL connected to the Metabase dev environment
+- `LINEAR_API_KEY` environment variable set with a valid Linear personal API key
+- `gh` CLI authenticated with GitHub
+- `claude` CLI available on PATH
+
+## Reference Files
+
+- `dev/src/dev/coverage.clj` — mutation testing engine (generates reports, runs mutations)
+- `dev/src/dev/mutation_testing.clj` — orchestration, Linear API, PR helpers
+
+## Invocation
+
+The argument is a Clojure namespace, optionally followed by a base branch:
+
+```
+/mutation-testing metabase.lib.order-by
+/mutation-testing metabase.lib.order-by --base-branch release-x.52.x
+/mutation-testing metabase.lib.order-by --project-id abc-123
+/mutation-testing metabase.lib.order-by --base-branch release-x.52.x --project-id abc-123
+```
+
+- `--base-branch`: defaults to the value in config (set via `set-config!`), or `"master"` if not configured.
+- `--project-id`: if provided, issues are added to this existing Linear project instead of creating a new one.
+
+## Steps
+
+### 1. Parse arguments
+
+Parse `$ARGUMENTS` to extract:
+- **namespace** (required) — the first positional argument
+- **`--base-branch`** (optional) — if present, the next argument is the base branch name
+- **`--project-id`** (optional) — if present, the next argument is an existing Linear project ID
+
+### 2. Load and configure
+
+```clojure
+(require '[dev.mutation-testing :as mut-test] :reload)
+(require '[dev.coverage :as cov] :reload)
+```
+
+If this is the first invocation (or the REPL was restarted), set up the Linear team:
+
+```clojure
+(mut-test/list-teams!)
+(mut-test/set-config! {:team-id "<id>"})
+```
+
+### 3. Run
+
+```clojure
+(mut-test/run! '<target-ns>)
+;; Or with options:
+(mut-test/run! '<target-ns> {:base-branch "release-x.52.x"})
+(mut-test/run! '<target-ns> {:project-id "abc-123"})
+(mut-test/run! '<target-ns> {:base-branch "release-x.52.x" :project-id "abc-123"})
+```
+
+Pass the opts map with `:base-branch` and/or `:project-id` if those flags were provided in the arguments.
+
+This will:
+1. Generate a baseline mutation testing report
+2. Create a Linear project for the namespace
+3. Group functions by coverage relationships
+4. For each group: create branch → invoke Claude to write tests → verify → retry if needed → commit & push → create Linear issue → create draft PR
+5. Print a summary with PR links
+
+### 4. Handle failures
+
+If a group fails mid-processing, `run!` catches the error and continues to the next group. To retry a single group manually:
+
+```clojure
+;; Get the parsed namespace info
+(def parsed (mut-test/parse-namespace '<target-ns>))
+
+;; Run coverage to get the data
+(def coverage-results (cov/test-namespace (:target-ns parsed) [(:test-ns parsed)]))
+
+;; Group and find the one you want
+(def groups (mut-test/group-functions coverage-results))
+
+;; Process just that group
+(mut-test/process-group! parsed (nth groups <index>))
+```
+
+### 5. Verify the prompt (dry run)
+
+To inspect what Claude will see without invoking it:
+
+```clojure
+(def parsed (mut-test/parse-namespace '<target-ns>))
+(def coverage-results (cov/test-namespace (:target-ns parsed) [(:test-ns parsed)]))
+(def groups (mut-test/group-functions coverage-results))
+(println (mut-test/build-test-prompt
+           (merge (select-keys parsed [:target-ns :test-ns :source-path :test-path])
+                  (select-keys (first groups) [:fn-names :mutations]))))
+```
+
+## Configuration
+
+- **Team ID**: Set once per REPL session via `(mut-test/list-teams!)` and `(mut-test/set-config! {:team-id "..."})`
+- **Project ID**: Set automatically when `run!` calls `create-project-for-namespace!`
+- **Base Branch**: Defaults to `"master"`. Override via `(mut-test/set-config! {:base-branch "release-x.52.x"})` or pass `{:base-branch "..."}` as the second arg to `run!`
+- **Project ID**: If set (via `set-config!` or `run!` opts), `run!` reuses the existing Linear project instead of creating a new one

.claude/skills/typescript-review/SKILL.md

@@ -12,8 +12,9 @@ allowed-tools: Read, Grep, Bash, Glob
 
 Review pull requests with a focus on:
 
+- Readability and maintainability
+- Appropriate test coverage
 - Compliance with project coding standards and conventions
 - Code quality and best practices
-- Clear and correct JSDoc comments
 - Type safety and proper TypeScript usage
-- React best practices (when applicable)
+- React best practices (when applicable)

.clj-kondo/config.edn

@@ -1,7 +1,7 @@
 ;; -*- comment-column: 100; -*-
 {:config-paths ["macros" "src" "config"]
  :linters
- { ;;
+ {;;
   ;; enabled optional linters (these are disabled by default)
   ;;
 
@@ -50,13 +50,15 @@
   ;; disabled linters
   ;;
 
-  :redundant-ignore {:level :off}    ; lots of false positives, see https://github.com/clj-kondo/clj-kondo/issues/2414
+  :redundant-ignore {:level :off} ; lots of false positives, see https://github.com/clj-kondo/clj-kondo/issues/2414
   :unexpected-recur {:level :off} ; TODO (cam): I think we just need to tell it how to handle MBQL match and we can enable this?
 
   ;;
   ;; globally-enabled custom linters
   ;;
   :metabase/check-defmulti-arglists                          {:level :warning}
+  :metabase/check-def-check-not-uppercase-name               {:level :warning}
+  :metabase/check-def-no-underscores                         {:level :warning}
   :metabase/check-me-humanize                                {:level :warning}
   :metabase/defsetting-must-specify-export                   {:level :warning}
   :metabase/defsetting-namespace                             {:level :warning}
@@ -65,8 +67,8 @@
   :metabase/missing-test-expr-requires-in-cljs               {:level :warning}
   :metabase/modules                                          {:level :warning} ; more config in `.clj-kondo/config/modules/config.edn`
   :metabase/namespace-name                                   {:level :warning}
+  :metabase/no-jsqlparser-imports                            {:level :warning}
   :metabase/require-shape-checker                            {:level :warning}
-  :metabase/test-helpers-use-non-thread-safe-functions       {:level :warning} ; more config in `.clj-kondo/config/test-helpers/config.edn`
   :metabase/tests-must-live-in-known-modules                 {:level :warning}
   :metabase/validate-defendpoint-route-uses-kebab-case       {:level :warning}
   :metabase/validate-defendpoint-query-params-use-kebab-case {:level :warning}
@@ -178,6 +180,11 @@
      metabase.notification.models/create-notification!
      metabase.pulse.send/send-pulse!
      metabase-enterprise.transforms-python.python-runner-test/execute!
+     ;; Workspace isolation functions are safe in parallel tests because they operate on
+     ;; isolated, test-specific workspaces and databases that don't affect other tests
+     metabase-enterprise.workspaces.isolation/destroy-workspace-isolation!
+     metabase-enterprise.workspaces.isolation/ensure-database-isolation!
+     metabase-enterprise.workspaces.test-util/create-ready-ws!
      ;; Safe in tests, where we typically use a private, temporary index per thread.
      metabase.search.core/reindex!
      metabase.util/run-count!
@@ -191,7 +198,7 @@
   :metabase/disallow-hardcoded-driver-names-in-tests
   ;; don't include `:h2` since that will probably lead to a mountain of tests where we are specifically testing
   ;; middleware or compilation behavior with just H2 since it's the default.
-  {:drivers #{ ;; core drivers
+  {:drivers #{;; core drivers
               #_:h2
               :postgres
               :mysql
@@ -219,7 +226,10 @@
   ;; misc config for built-in linters
   ;;
 
-  :invalid-arity       {:skip-args [metabase.lib.util.match/match]}                    ; TODO (cam): can we fix these?
+  :invalid-arity       {:skip-args [metabase.lib.util.match/match
+                                    metabase.lib.util.match/match-lite
+                                    metabase.lib.util.match/match-many
+                                    metabase.lib.util.match/replace-lite]}                    ; TODO (cam): can we fix these?
   :refer-all           {:level :warning, :exclude [clojure.test]}
   :unused-referred-var {:exclude {compojure.core [GET DELETE POST PUT]}}
 
@@ -238,13 +248,17 @@
     (metabase.lib.util.match/match)
     (metabase.lib.util.match/match-one)
     (metabase.lib.util.match/match-lite)
-    (metabase.lib.util.match/match-lite-recursive)
+    (metabase.lib.util.match/match-many)
     (metabase.lib.util.match/replace)
     (metabase.lib.util.match/replace-in)
+    (metabase.lib.util.match/replace-lite)
     (metabase.driver-api.core/match)
     (metabase.driver-api.core/match-one)
+    (metabase.driver-api.core/match-lite)
+    (metabase.driver-api.core/match-many)
     (metabase.driver-api.core/replace)
     (metabase.driver-api.core/replace-in)
+    (metabase.driver-api.core/replace-lite)
     (metabase.query-processor.middleware.cache-backend.interface/with-cached-results)
     (metabase.util.regex/rx [opt])
     (metabase.util/prog1 [<>])
@@ -296,10 +310,14 @@
    metabase.lib.convert/->legacy-MBQL                 {:message "Conversion to legacy MBQL is discouraged, please use Lib to manipulate MBQL queries"}
    metabase.lib.core/->legacy-MBQL                    {:message "Conversion to legacy MBQL is discouraged, please use Lib to manipulate MBQL queries"}
    metabase.lib.equality/find-column-indexes-for-refs {:message "Use lib.equality/closest-matches-in-metadata or lib.equality/find-closest-matches-for-refs instead of lib.equality/find-column-indexes-for-refs"}
+   metabase.lib.util.match/match                      {:message "Use lib.util.match/match-many instead of lib.util.match/match."}
+   metabase.lib.util.match/match-one                  {:message "Use lib.util.match/match-lite instead of lib.util.match/match-one."}
+   metabase.lib.util.match/replace                    {:message "Use lib.util.match/replace-lite instead of lib.util.match/replace."}
    metabase-enterprise.transforms.interface/execute!  {:message "Use metabase-enterprise.transforms.execute/execute! instead of metabase-enterprise.transforms.interface/execute!"}
    next.jdbc/active-tx?                               {:message "Use metabase.app-db.core/in-transaction? to see if we are in a transaction"}
    toucan2.core/debug                                 {:message "Don't commit code using t2/debug"}
-   toucan2.tools.debug/debug                          {:message "Don't commit code using t2/debug"}}
+   toucan2.tools.debug/debug                          {:message "Don't commit code using t2/debug"}
+   }
 
   :discouraged-namespace
   {camel-snake-kebab.core {:message "CSK is not Turkish-safe, use the versions in metabase.util instead."}
@@ -404,6 +422,8 @@
     ring.util.codec                           codec
     ring.util.response                        response
     saml20-clj.core                           saml
+    metabase.transforms-base.util              transforms-base.u
+    metabase.transforms.util                   transforms.u
     toucan2.core                              t2}}}
 
  :lint-as
@@ -418,11 +438,10 @@
   metabase-enterprise.content-translation.routes-test/with-new-secret-key!              clojure.core/fn
   metabase-enterprise.serialization.test-util/with-dbs                                  clojure.core/fn
   metabase-enterprise.serialization.test-util/with-random-dump-dir                      clojure.core/let
-  metabase-enterprise.transforms.api-test/with-transform-tags                           clojure.core/let
-  metabase-enterprise.transforms.api-test/with-worker-runs                              clojure.core/let
-  metabase-enterprise.transforms.test-util/with-transform-cleanup!                      clojure.core/let
-  metabase-enterprise.transforms.execute/with-transform-lifecycle                       clojure.core/let
+  metabase-enterprise.workspaces.test-util/with-resources!                              clojure.core/let
+  metabase-enterprise.workspaces.test-util/with-workspaces!                             clojure.core/let
   metabase.actions.test-util/with-actions                                               clojure.core/let
+  metabase.transforms.test-util/with-transform-cleanup!                                 clojure.core/let
   metabase.api.common/let-404                                                           clojure.core/let
   metabase.app-db.custom-migrations.util/with-temp-scheduler!                           clojure.core/fn
   metabase.app-db.custom-migrations/define-migration                                    clj-kondo.lint-as/def-catch-all
@@ -510,7 +529,16 @@
   {cljs.test/deftest                                                                                                         hooks.clojure.test/deftest
    cljs.test/is                                                                                                              hooks.clojure.test/is
    cljs.test/use-fixtures                                                                                                    hooks.clojure.test/use-fixtures
+   clojure.core/def                                                                                                          hooks.clojure.core.def/lint-def
+   clojure.core/definterface                                                                                                 hooks.clojure.core.def/lint-def
+   clojure.core/defmacro                                                                                                     hooks.clojure.core.defmacro/lint-defmacro
    clojure.core/defmulti                                                                                                     hooks.clojure.core.defmulti/lint-defmulti
+   clojure.core/defn                                                                                                         hooks.clojure.core.defn/lint-defn
+   clojure.core/defn-                                                                                                        hooks.clojure.core.defn/lint-defn
+   clojure.core/defonce                                                                                                      hooks.clojure.core.def/lint-def
+   clojure.core/defprotocol                                                                                                  hooks.clojure.core.def/lint-def
+   clojure.core/defrecord                                                                                                    hooks.clojure.core.def/lint-def
+   clojure.core/deftype                                                                                                      hooks.clojure.core.def/lint-def
    clojure.core/ns                                                                                                           hooks.clojure.core.ns/lint-ns
    clojure.core/require                                                                                                      hooks.clojure.core.require/lint-require
    clojure.core/requiring-resolve                                                                                            hooks.clojure.core.require/lint-requiring-resolve
@@ -522,8 +550,10 @@
    metabase-enterprise.advanced-permissions.models.permissions.application-permissions-test/with-new-group-and-current-graph hooks.common/with-two-top-level-bindings
    metabase-enterprise.audit-app.pages-test/with-temp-objects                                                                hooks.common/with-one-binding
    metabase-enterprise.cache.config-test/with-temp-persist-models                                                            hooks.common/with-seven-bindings
+   metabase-enterprise.dependencies.api-test/with-dependents-test!                                                           hooks.common/with-two-bindings
    metabase-enterprise.metabot-v3.tools.dependencies-test/with-dependent-transforms!                                         hooks.common/with-two-bindings
    metabase-enterprise.semantic-search.db.connection/with-migrate-tx                                                         hooks.common/let-one-with-optional-value
+   metabase-enterprise.serialization.api-test/with-serialization-test-data!                                                  hooks.common/with-three-bindings
    metabase-enterprise.serialization.test-util/with-temp-dpc                                                                 hooks.toucan2.tools.with-temp/with-temp
    metabase-enterprise.transforms-python.drivers-test/with-test-table                                                        hooks.common/with-two-bindings
    metabase.api.common.internal-test/with-jetty-server                                                                       hooks.common/with-one-binding
@@ -758,22 +788,17 @@
  :config-in-ns
  {test-namespaces
   {:linters
-   {:inline-def                              {:level :off}
-    :missing-docstring                       {:level :off}
-    :private-call                            {:level :off}
-    :metabase/defsetting-must-specify-export {:level :off}
-    :metabase/defsetting-namespace           {:level :off}
+   {:inline-def                                          {:level :off}
+    :missing-docstring                                   {:level :off}
+    :private-call                                        {:level :off}
+    :metabase/defsetting-must-specify-export             {:level :off}
+    :metabase/defsetting-namespace                       {:level :off}
+    :metabase/test-helpers-use-non-thread-safe-functions {:level :warning} ; more config in `.clj-kondo/config/test-helpers/config.edn
 
     :discouraged-var
     {metabase.driver/database-supports? {:level :off}
      metabase.lib.convert/->legacy-MBQL {:level :off}
-     metabase.lib.core/->legacy-MBQL    {:level :off}}}
-
-   :hooks
-   {:analyze-call
-    {clojure.core/defmacro hooks.clojure.core.defn/non-thread-safe-form-should-end-with-exclamation
-     clojure.core/defn     hooks.clojure.core.defn/non-thread-safe-form-should-end-with-exclamation
-     clojure.core/defn-    hooks.clojure.core.defn/non-thread-safe-form-should-end-with-exclamation}}}
+     metabase.lib.core/->legacy-MBQL    {:level :off}}}}
 
   source-namespaces
   {:linters

.clj-kondo/config/test-helpers/config.edn

@@ -3,7 +3,7 @@
   ;; TODO -- seems silly to maintain different blacklists and whitelists here than we use for the deftest `^:parallel`
   ;; checker...
   {:explicitly-safe
-   #{ ;; these toucan methods might actually set global values if it's used outside of a transaction,
+   #{;; these toucan methods might actually set global values if it's used outside of a transaction,
      ;; but since mt/with-temp runs in a transaction, so we'll ignore them in this case.
      toucan2.core/delete!
      toucan2.core/update!

.clj-kondo/macros/metabase/server/statistics_handler_test.clj

@@ -1,9 +0,0 @@
-(ns macros.metabase.server.statistics-handler-test)
-
-(defmacro with-server
-  [_ _ [connector chan-start-handle chan-finish-handle chan-done-request] & body]
-  `(let [~connector          nil
-         ~chan-start-handle  nil
-         ~chan-finish-handle nil
-         ~chan-done-request  nil]
-     ~@body))

.clj-kondo/src/hooks/clojure/core.clj

@@ -0,0 +1,38 @@
+(ns hooks.clojure.core
+  (:require
+   [clj-kondo.hooks-api :as hooks]
+   [clojure.string :as str]))
+
+(defn- all-uppercase? [symb]
+  (let [s (str symb)]
+    (= s #_{:clj-kondo/ignore [:discouraged-var]} (str/upper-case s))))
+
+(defn- has-underscores? [symb]
+  (str/includes? (str symb) "_"))
+
+(defn-  check-symbol-is-kebab-case [symbol-node]
+  (let [symb (hooks/sexpr symbol-node)]
+    (when (or (all-uppercase? symb)
+              (has-underscores? symb))
+      (hooks/reg-finding! (assoc (meta symbol-node)
+                                 :message "Use kebab-case for function and variable names; don't use special notation for constants."
+                                 :type    :metabase/check-def-kebab-case)))))
+
+(defn lint-def* [{:keys [node]}]
+  (let [[_def & args] (:children node)
+        name-symbol   (some (fn [arg]
+                              (when (and (hooks/token-node? arg)
+                                         (symbol? (hooks/sexpr arg)))
+                                arg))
+                            args)]
+    (check-symbol-is-kebab-case name-symbol)))
+
+(defn lint-def [x]
+  (lint-def* x)
+  x)
+
+(comment
+  (defn x []
+    (let [node (-> "(def ^:private TYPE->MODEL {\"document\" :model/Document})"
+                   hooks/parse-string)]
+      (lint-def {:node node}))))

.clj-kondo/src/hooks/clojure/core/def.clj

@@ -0,0 +1,52 @@
+(ns hooks.clojure.core.def
+  (:require
+   [clj-kondo.hooks-api :as hooks]
+   [clojure.string :as str]))
+
+(defn- uppercase-name?
+  "Whether the symbol is clearly an uppercase name like `TYPE-CONSTANTS` or `SOME_CONSTANT` or `TYPE->MODEL`."
+  [s]
+  (and (re-find #"[A-Z0-9]+(?:[-_]>?[A-Z0-9]+)+" s)
+       ;; ignore stuff like `->SCREAMING_SNAKE_CASE`... this is ok
+       (not (str/includes? s "SCREAMING_SNAKE_CASE"))))
+
+(defn- has-underscores? [s]
+  (and (str/includes? s "_")
+       ;; ignore stuff like `->snake_case` and `->SCREAMING_SNAKE_CASE`
+       (not (str/includes? s "snake_case"))
+       (not (str/includes? s "SCREAMING_SNAKE_CASE"))))
+
+(defn-  check-symbol-is-kebab-case [symbol-node]
+  (let [symb (hooks/sexpr symbol-node)
+        s    (str symb)]
+    (cond
+      (uppercase-name? s)
+      (hooks/reg-finding!
+       (assoc (meta symbol-node)
+              :message "Use lower-case names for functions and variables; don't use special notation for constants. [:metabase/check-def-check-not-all-uppercase]"
+              :type    :metabase/check-def-check-not-uppercase-name))
+
+      (has-underscores? s)
+      (hooks/reg-finding!
+       (assoc (meta symbol-node)
+              :message "Use kebab-case names for functions and variables. [:metabase/check-def-no-underscores]"
+              :type    :metabase/check-def-no-underscores)))))
+
+(defn lint-def* [{:keys [node]}]
+  (let [[_def & args] (:children node)
+        name-symbol   (some (fn [arg]
+                              (when (and (hooks/token-node? arg)
+                                         (symbol? (hooks/sexpr arg)))
+                                arg))
+                            args)]
+    (check-symbol-is-kebab-case name-symbol)))
+
+(defn lint-def [x]
+  (lint-def* x)
+  x)
+
+(comment
+  (defn x []
+    (let [node (-> "(def ^:private TYPE->MODEL {\"document\" :model/Document})"
+                   hooks/parse-string)]
+      (lint-def {:node node}))))

.clj-kondo/src/hooks/clojure/core/defmacro.clj

@@ -0,0 +1,7 @@
+(ns hooks.clojure.core.defmacro
+  (:require
+   [hooks.clojure.core.def]))
+
+(defn lint-defmacro [x]
+  (hooks.clojure.core.def/lint-def* x)
+  x)

.clj-kondo/src/hooks/clojure/core/defmulti.clj

@@ -2,6 +2,7 @@
   (:require
    [clj-kondo.hooks-api :as hooks]
    [clojure.string :as str]
+   [hooks.clojure.core.def]
    [hooks.common]))
 
 (defn- check-arglists [report-node arglists]
@@ -49,4 +50,5 @@
 
 (defn lint-defmulti [x]
   (defmulti-check-for-arglists-metadata (:node x))
+  (hooks.clojure.core.def/lint-def* x)
   x)

.clj-kondo/src/hooks/clojure/core/defn.clj

@@ -2,6 +2,7 @@
   (:require
    [clj-kondo.hooks-api :as hooks]
    [clojure.string :as str]
+   [hooks.clojure.core.def]
    [hooks.common]))
 
 (defn- end-with-exclamation?
@@ -50,6 +51,11 @@
     (non-thread-safe-form-should-end-with-exclamation* node config))
   {:node node})
 
+(defn lint-defn [x]
+  (non-thread-safe-form-should-end-with-exclamation x)
+  (hooks.clojure.core.def/lint-def* x)
+  x)
+
 (comment
   (require '[clj-kondo.core :as clj-kondo])
   (def form (str '(defmacro a

.clj-kondo/src/hooks/clojure/core/ns.clj

@@ -99,12 +99,48 @@
                                      :message "Metabase namespaces should have the form metabase[-enterprise].<module>.* [:metabase/namespace-name]"
                                      :type    :metabase/namespace-name)))))))
 
+(defn- ns-form-node->import-node [ns-form-node]
+  (some (fn [node]
+          (when (and (hooks/list-node? node)
+                     (let [first-child (first (:children node))]
+                       (and (hooks/keyword-node? first-child)
+                            (= (hooks/sexpr first-child) :import))))
+            node))
+        (:children ns-form-node)))
+
+(defn- jsqlparser-import?
+  "Check if a symbol or string represents a jsqlparser import."
+  [s]
+  (str/starts-with? (str s) "net.sf.jsqlparser"))
+
+(defn- lint-jsqlparser-imports [ns-form-node]
+  (when-let [import-node (ns-form-node->import-node ns-form-node)]
+    (doseq [node (rest (:children import-node))
+            :when (not (contains? (hooks.common/ignored-linters node) :metabase/no-jsqlparser-imports))]
+      (cond
+        ;; Handle (net.sf.jsqlparser.foo Bar Baz) form
+        (hooks/list-node? node)
+        (let [package-node (first (:children node))
+              package-name (when package-node (str (hooks/sexpr package-node)))]
+          (when (jsqlparser-import? package-name)
+            (hooks/reg-finding! (assoc (meta node)
+                                       :message "Don't import net.sf.jsqlparser classes directly. This code should be agnostic to the parsing library. [:metabase/no-jsqlparser-imports]"
+                                       :type    :metabase/no-jsqlparser-imports))))
+
+        ;; Handle net.sf.jsqlparser.foo.Bar form (single class import)
+        (hooks/token-node? node)
+        (when (jsqlparser-import? (hooks/sexpr node))
+          (hooks/reg-finding! (assoc (meta node)
+                                     :message "Don't import net.sf.jsqlparser classes directly. This code should be agnostic to the parsing library. [:metabase/no-jsqlparser-imports]"
+                                     :type    :metabase/no-jsqlparser-imports)))))))
+
 (defn lint-ns [x]
   (doto (:node x)
     lint-require-shapes
     lint-requires-on-new-lines
     (lint-modules (modules/config x))
-    lint-namespace-name)
+    lint-namespace-name
+    lint-jsqlparser-imports)
   x)
 
 (comment

.clj-kondo/src/hooks/common/modules.clj

@@ -31,7 +31,7 @@
                 second
                 symbol))))
 
-(defn module-api-namespaces
+(defn- module-api-namespaces
   "Set of API namespace symbols for a given module. `:any` means you can use anything, there are no API namespaces for
   this module (yet). If unspecified, the default is just the `<module>.core` namespace."
   [config module]
@@ -51,6 +51,12 @@
           (symbol (str ns-prefix ".core"))
           (symbol (str ns-prefix ".init"))}))))
 
+(defn- module-friends
+  [config module]
+  "Set of modules that are `:friends` of `module`, i.e. allowed to use *any* namespace from the module, not just the
+  designated [[module-api-namespaces]]."
+  (set (get-in config [:metabase/modules module :friends])))
+
 (defn allowed-modules
   "Set of namespace symbols that `module` is allowed to use. `:any` means it's allowed to use anything."
   [config module]
@@ -61,11 +67,22 @@
     (or (= allowed-modules :any)
         (contains? (set allowed-modules) required-module))))
 
-(defn allowed-module-namespace? [config ns-symb]
+(defn- allowed-module-namespace? [config current-module ns-symb]
   (let [module                (module ns-symb)
-        module-api-namespaces (module-api-namespaces config module)]
+        module-api-namespaces (module-api-namespaces config module)
+        module-friends        (module-friends config module)]
     (or (empty? module-api-namespaces)
-        (contains? module-api-namespaces ns-symb))))
+        (contains? module-api-namespaces ns-symb)
+        (contains? module-friends current-module))))
+
+(defn- rest-module? [module]
+  (str/ends-with? module "-rest"))
+
+(defn- routes-module? [module]
+  (str/ends-with? module "-routes"))
+
+(defn- core-module? [module]
+  (str/ends-with? module "core"))
 
 (defn usage-error
   "Find usage errors when a `required-namespace` is required in the `current-module`. Returns a string describing the
@@ -81,8 +98,19 @@
                 current-module
                 current-module)
 
-        (not (allowed-module-namespace? config required-namespace))
+        (not (allowed-module-namespace? config current-module required-namespace))
         (format "Namespace %s is not an allowed external API namespace for the %s module. [:metabase/modules %s :api]"
                 required-namespace
                 required-module
-                required-module)))))
+                required-module)
+
+        ;; (for now) rest modules are allowed to use one another; `routes` is ok because it collects routes together
+        ;; and `core` is ok because [[metabase.core.init]] might need to init some of the `-routes` modules'
+        ;; namespaces
+        (and (not ((some-fn rest-module? routes-module? core-module?) current-module))
+             (rest-module? required-module))
+        (format "Do not use -rest modules (%s) in non-rest modules (%s) -- move things from %s to %s if needed"
+                required-module
+                current-module
+                required-module
+                (symbol (str/replace required-module #"-rest$" "")))))))

.clj-kondo/src/hooks/metabase/settings/models/setting.clj

@@ -55,7 +55,6 @@
      help-link-custom-destination
      instance-creation
      is-hosted?
-     is-metabot-enabled
      jdbc-data-warehouse-max-connection-pool-size
      jdbc-data-warehouse-unreturned-connection-timeout-seconds
      jwt-attribute-email

.clj-kondo/test/hooks/clojure/core/ns_test.clj

@@ -43,6 +43,17 @@
            '{:metabase/modules {api    {:uses #{search}}
                                 search {:api  #{metabase.search.core}}}}))))
 
+(deftest ^:parallel module-checker-friends-test
+  (is (= []
+         (lint-modules
+          '(ns metabase.search-rest.api
+             (:require
+              [metabase.search.config :as search.config]
+              [metabase.search.core :as search]))
+          '{:metabase/modules {search      {:api     #{metabase.search.core}
+                                            :friends #{search-rest}}
+                               search-rest {:uses #{search}}}}))))
+
 (deftest ^:parallel module-checker-api-namespaces-ignore-test
   (is (empty? (lint-modules
                '(ns metabase.api.search

.cljfmt.edn

@@ -90,6 +90,7 @@
   metabase-enterprise.test/with-gtaps!                                                        [[:inner 0]]
   metabase-enterprise.test/with-gtaps-for-user!                                               [[:inner 0]]
   metabase-enterprise.test/with-user-attributes                                               [[:block 2]]
+  metabase-enterprise.workspaces.models.workspace-log/track!                                  [[:block 2]]
   metabase.actions.actions-test/with-actions-test-data-and-actions-permissively-enabled       [[:block 0]]
   metabase.actions.test-util/with-actions                                                     [[:block 1]]
   metabase.actions.test-util/with-actions-disabled                                            [[:block 0]]
@@ -119,7 +120,10 @@
   metabase.dashboards.models.dashboard-test/with-dash-in-collection                           [[:inner 0]]
   metabase.driver-api.core/match                                                              [[:inner 0]]
   metabase.driver-api.core/match-one                                                          [[:inner 0]]
+  metabase.driver-api.core/match-lite                                                         [[:inner 0]]
+  metabase.driver-api.core/match-many                                                         [[:inner 0]]
   metabase.driver-api.core/replace                                                            [[:inner 0]]
+  metabase.driver-api.core/replace-lite                                                       [[:inner 0]]
   metabase.driver-api.core/replace-in                                                         [[:inner 0]]
   metabase.driver.bigquery-cloud-sdk.query-processor/with-temporal-type                       [[:default]]
   metabase.driver.druid.client/DELETE                                                         [[:default]]
@@ -133,6 +137,7 @@
   metabase.driver.sql-jdbc.execute.diagnostic/capturing-diagnostic-info                       [[:block 1]]
   metabase.driver.sql.query-processor/apply-top-level-clause                                  [[:default]]
   metabase.driver/with-driver                                                                 [[:block 1]]
+  metabase.driver/with-swapped-connection-details                                             [[:block 2]]
   metabase.embedding-rest.api.embed-test/do-response-formats                                  [[:block 1]]
   metabase.embedding-rest.api.embed-test/with-embedding-enabled-and-new-secret-key            [[:block 0]]
   metabase.embedding-rest.api.embed-test/with-embedding-enabled-and-temp-card-referencing     [[:block 3]]
@@ -154,8 +159,9 @@
   metabase.lib.util.match/match                                                               [[:inner 0]]
   metabase.lib.util.match/match-one                                                           [[:inner 0]]
   metabase.lib.util.match/match-lite                                                          [[:inner 0]]
-  metabase.lib.util.match/match-lite-recursive                                                [[:inner 0]]
+  metabase.lib.util.match/match-many                                                          [[:inner 0]]
   metabase.lib.util.match/replace                                                             [[:inner 0]]
+  metabase.lib.util.match/replace-lite                                                        [[:inner 0]]
   metabase.lib.util.match/replace-in                                                          [[:inner 0]]
   metabase.models.interface/define-batched-hydration-method                                   [[:inner 0]]
   metabase.models.interface/define-simple-hydration-method                                    [[:inner 0]]

.codespellignore

@@ -1,23 +1,35 @@
-Brite
 afterAll
 ags
 altho
+Brite
 cancelation
 cancelations
+caracteres
+copyin
 datas
 edn
 eduction
+hasTable
 hasTables
 horizontalX
 horizontalY
 juxt
 methodd
+nd
 notIn
+optionA
+ot
 pass-thru
+requestor
+re-use
+re-used
 ser
 serieses
 sortings
+titel
 trs
 trsn
 tru
 trun
+unparseable
+withs

.codespellrc

@@ -1,3 +1,24 @@
 [codespell]
-skip = *.csv,*.edn,*.geojson,*.json,*.tsv,*.xml,docs/developers-guide/drivers/driver-tests.md,docs/developers-guide/e2e-tests.md,docs/questions/query-builder/expressions-list.md,docs/questions/visualizations/country-codes.md,e2e/test/scenarios/admin/i18n/content-translation/constants.ts,frontend/src/cljs,frontend/src/metabase/querying/expressions/tokenizer/lezer.js,frontend/src/metabase/static-viz/constants/char-sizes.ts,frontend/src/metabase/visualizations/lib/mapping_codes.ts,modules/drivers/mongo/src/metabase/driver/mongo/operators.clj
+skip =
+    *.csv,
+    *.edn,
+    *.geojson,
+    *.json,
+    *.tsv,
+    *.unit.spec.*,
+    *.xml,
+    docs/developers-guide/drivers/driver-tests.md,
+    docs/developers-guide/e2e-tests.md,
+    docs/questions/query-builder/expressions-list.md,
+    docs/questions/visualizations/country-codes.md,
+    e2e/test/scenarios/admin/i18n/content-translation/constants.ts,
+    frontend/src/cljs,
+    frontend/src/metabase/querying/expressions/tokenizer/lezer.js,
+    frontend/src/metabase/query_builder/components/NativeQueryEditor/CodeMirrorEditor/language.ts,
+    frontend/src/metabase/static-viz/constants/char-sizes.ts,
+    frontend/src/metabase/visualizations/lib/mapping_codes.ts,
+    frontend/*/mocks/*,
+    modules/drivers/mongo/src/metabase/driver/mongo/operators.clj,
+    src/metabase/analyze/classifiers/name.clj,
+    src/metabase/util/currency.cljc,
 ignore-words = .codespellignore

.devcontainer/Dockerfile

@@ -1,10 +1,11 @@
 FROM mcr.microsoft.com/vscode/devcontainers/java:21
 
-# Set up nodesource, install node, yarn, fontconfig for static viz, rlwrap for dev ergonomics
+# Set up nodesource, install node, bun, fontconfig for static viz, rlwrap for dev ergonomics
 
 RUN ( curl -fsSL https://deb.nodesource.com/setup_22.x | bash ) \
   && export DEBIAN_FRONTEND=noninteractive \
-  && apt-get update && apt-get -y install --no-install-recommends nodejs yarn rlwrap fontconfig
+  && apt-get update && apt-get -y install --no-install-recommends nodejs rlwrap fontconfig \
+  && npm install -g bun
 
 # install Clojure
 RUN curl https://download.clojure.org/install/linux-install-1.12.0.1488.sh | bash

.dir-locals.el

@@ -61,6 +61,7 @@
   (eval . (put-clojure-indent 'u/prog1                         1))
   (eval . (put-clojure-indent 'u/select-keys-when              '(:form)))
   (eval . (put-clojure-indent 'with-meta                       '(:form)))
+  (eval . (put-clojure-indent 'ws.log/track!                   2))
   ;; these ones have to be done with `define-clojure-indent' for now because of upstream bug
   ;; https://github.com/clojure-emacs/clojure-mode/issues/600 once that's resolved we should use `put-clojure-indent'
   ;; instead. Please don't add new entries unless they don't work with `put-clojure-indent'

.env.example

@@ -100,7 +100,7 @@ METASTORE_DEV_SERVER_URL="https://token-check.staging.metabase.com"
 #
 # The whole environment is already orchestrated via deps.edn using :e2e alias.
 # Treat it as a source of truth for JVM flags and ENVs whether you decide to run
-# backend on your own, or using `yarn test-cypress` (local test runner).
+# backend on your own, or using `bun run test-cypress` (local test runner).
 #
 # You don't _have to_ export any of these vars (except for the tokens below).
 # Things will still work.
@@ -118,6 +118,9 @@ MB_EDITION="ee"
 # MB_JETTY_HOST="localhost"
 # MB_JETTY_PORT=4000
 
+# Frontend dev server port (for hot reload). Must match the port used by `yarn build-hot`.
+# MB_FRONTEND_DEV_PORT=8080
+
 # 3.2 E2E Local Runner Setup
 # ------------------------------------------------------------------------------
 

.eslintignore

@@ -1,6 +0,0 @@
-frontend/src/cljs
-frontend/src/cljs_release
-e2e/support/cypress_sample_database.js
-e2e/support/cypress_sample_instance_data.js
-frontend/src/metabase-types/openapi/types.gen.ts
-e2e/embedding-sdk-host-apps

.eslintrc.js

@@ -1,356 +0,0 @@
-/* eslint-disable import/no-commonjs */
-/* eslint-disable no-undef */
-
-const path = require("path");
-
-// `postcss-modules` lints css modules class names, but it currently crashes
-// eslint on vscode. If you use webstorm or want to run the lint for the cli, you
-// can use this flag to enable it. This is set to true in CI
-const shouldLintCssModules =
-  process.env.LINT_CSS_MODULES === "true" || process.env.CI;
-const plugins = ["react", "no-only-tests", "ttag", "i18next"];
-if (shouldLintCssModules) {
-  plugins.push("postcss-modules");
-}
-
-module.exports = {
-  ignorePatterns: ["!.storybook"],
-  rules: {
-    strict: [2, "never"],
-    "no-undef": 2,
-    "no-var": 1,
-    "no-unused-vars": [
-      "error",
-      {
-        vars: "all",
-        args: "none",
-        varsIgnorePattern: "^_.+$",
-        ignoreRestSiblings: true,
-      },
-    ],
-    "no-empty": [1, { allowEmptyCatch: true }],
-    // Note: adding this rule to a eslint config file in a subfolder will remove
-    // *not* carry over the restricted imports from parent folders, you will
-    // need to copy them over
-    "no-restricted-imports": [
-      "error",
-      {
-        paths: [
-          {
-            name: "moment",
-            message: "Moment is deprecated, please use dayjs",
-          },
-          {
-            name: "moment-timezone",
-            message: "Moment is deprecated, please use dayjs",
-          },
-        ],
-      },
-    ],
-    curly: [1, "all"],
-    eqeqeq: [1, "smart"],
-    "import/no-duplicates": ["warn", { considerQueryString: true }],
-    "import/no-default-export": 2,
-    "import/no-named-as-default": 0,
-    "import/no-commonjs": 1,
-    "import/order": [
-      "error",
-      {
-        "newlines-between": "always",
-        alphabetize: {
-          order: "asc",
-          orderImportKind: "asc",
-          caseInsensitive: false,
-        },
-        groups: [
-          "builtin",
-          "external",
-          "internal",
-          "parent",
-          "sibling",
-          "index",
-        ],
-        warnOnUnassignedImports: false,
-      },
-    ],
-    "sort-imports": [
-      "error",
-      {
-        // allows this rule to work with import/order
-        ignoreDeclarationSort: true,
-      },
-    ],
-    "no-console": [2, { allow: ["warn", "error", "errorBuffer"] }],
-    "react/no-is-mounted": 2,
-    "react/prefer-es6-class": 2,
-    "react/display-name": 1,
-    "react/prop-types": 2,
-    "react/no-did-mount-set-state": 0,
-    "react/no-did-update-set-state": 0,
-    "react/no-find-dom-node": 0,
-    "react/no-children-prop": 2,
-    "react/no-string-refs": 2,
-    "react/no-unescaped-entities": 2,
-    "react/jsx-no-target-blank": 2,
-    "react/jsx-key": 2,
-    "react/forbid-component-props": [2, { forbid: ["sx"] }],
-    "react-hooks/exhaustive-deps": ["warn"],
-    "prefer-const": [1, { destructuring: "all" }],
-    "no-restricted-globals": ["error", "close"],
-    "no-useless-escape": 0,
-    "no-only-tests/no-only-tests": [
-      "error",
-      {
-        block: [
-          "describe",
-          "it",
-          "context",
-          "test",
-          "tape",
-          "fixture",
-          "serial",
-          "Feature",
-          "Scenario",
-          "Given",
-          "And",
-          "When",
-          "Then",
-        ],
-      },
-    ],
-    complexity: ["error", { max: 55 }],
-    ...(shouldLintCssModules
-      ? {
-          "postcss-modules/no-undef-class": "error",
-        }
-      : {}),
-  },
-  globals: {
-    before: true,
-    cy: true,
-    Cypress: true,
-  },
-  env: {
-    browser: true,
-    es2020: true,
-    commonjs: true,
-    jest: true,
-    "jest/globals": true,
-  },
-  parser: "babel-eslint",
-  plugins,
-  extends: [
-    "eslint:recommended",
-    "plugin:react/recommended",
-    "plugin:react/jsx-runtime",
-    "plugin:react-hooks/recommended",
-    "plugin:import/errors",
-    "plugin:import/warnings",
-    "plugin:import/typescript",
-    "plugin:depend/recommended",
-    "plugin:storybook/recommended",
-    "plugin:i18next/recommended",
-  ],
-  settings: {
-    "import/internal-regex": "^metabase/|^metabase-lib/",
-    "import/resolver": {
-      webpack: {
-        config: path.resolve(__dirname, "./rspack.main.config.js"),
-        typescript: true,
-      },
-    },
-    "import/ignore": ["\\.css$"],
-    react: {
-      version: "detect",
-    },
-    "postcss-modules": {
-      baseDir: "./frontend/src",
-    },
-  },
-  parserOptions: {
-    ecmaFeatures: {
-      legacyDecorators: true,
-    },
-  },
-  overrides: [
-    {
-      files: ["*.js", "*.jsx", "*.ts", "*.tsx"],
-      rules: {
-        "jtag-missing-key": "error",
-        "no-unconditional-metabase-links-render": "error",
-        "no-color-literals": "error",
-        "no-literal-metabase-strings": "error",
-        "no-oss-reinitialize-import": "error",
-        "depend/ban-dependencies": [
-          "error",
-          {
-            allowed: [
-              "underscore",
-              "moment",
-              "lodash.orderby",
-              "lodash.debounce",
-            ],
-          },
-        ],
-      },
-    },
-    {
-      files: [
-        "*.unit.spec.*",
-        "frontend/src/metabase/admin/**/*",
-        "frontend/src/metabase/setup/**/*",
-        "enterprise/frontend/src/metabase-enterprise/whitelabel/**/*",
-        "enterprise/frontend/src/metabase-enterprise/embedding/**/*",
-        "frontend/lint/**/*",
-        "*.stories.*",
-        "**/.storybook/*",
-        "stories-data.*",
-        "e2e/**/*",
-        "**/tests/*",
-        "release/**/*",
-        "rspack.config.js",
-        "rspack.main.config.js",
-        "rspack.embedding-sdk-package.config.js",
-        "rspack.embedding-sdk-bundle.config.js",
-      ],
-      rules: {
-        "no-color-literals": "off",
-        "no-unconditional-metabase-links-render": "off",
-        "no-literal-metabase-strings": "off",
-      },
-    },
-    {
-      files: [
-        "*.unit.spec.*",
-        "frontend/lint/**/*",
-        "*.stories.*",
-        "stories-data.*",
-        "e2e/**/*",
-        "**/tests/*",
-        "release/**/*",
-        "rspack.main.config.js",
-      ],
-      rules: {
-        "i18next/no-literal-string": "off",
-      },
-    },
-    {
-      extends: ["plugin:@typescript-eslint/recommended"],
-      files: ["*.ts", "*.tsx"],
-      parser: "@typescript-eslint/parser",
-      plugins: ["@typescript-eslint"],
-      rules: {
-        "prefer-rest-params": "off",
-        "react/prop-types": "off", // TypeScript handles prop validation
-        "@typescript-eslint/explicit-module-boundary-types": "off",
-        "@typescript-eslint/no-inferrable-types": "off",
-        "@typescript-eslint/no-explicit-any": "off",
-        "@typescript-eslint/no-this-alias": "off",
-        "@typescript-eslint/consistent-type-imports": [
-          "error",
-          {
-            fixStyle: "inline-type-imports",
-          },
-        ],
-        "@typescript-eslint/no-import-type-side-effects": "error",
-        "@typescript-eslint/no-unused-vars": [
-          "error",
-          {
-            argsIgnorePattern: "^_.+$",
-            varsIgnorePattern: "^_.+$",
-            ignoreRestSiblings: true,
-            destructuredArrayIgnorePattern: "^_.+$",
-          },
-        ],
-        // This was introduced in 6.0.0
-        "@typescript-eslint/no-unsafe-declaration-merging": "off",
-      },
-    },
-    {
-      extends: [
-        "plugin:jest/recommended",
-        "plugin:jest-dom/recommended",
-        "plugin:testing-library/react",
-        "plugin:jest-formatting/recommended",
-      ],
-      plugins: ["jest", "jest-dom", "testing-library", "jest-formatting"],
-      files: [
-        "*.unit.spec.ts",
-        "*.unit.spec.tsx",
-        "*.unit.spec.js",
-        "*.unit.spec.jsx",
-      ],
-      rules: {
-        "jest/valid-title": ["error", { ignoreTypeOfDescribeName: true }],
-        "jest/expect-expect": [
-          "error",
-          {
-            assertFunctionNames: ["expect*", "assert*"],
-            additionalTestBlockFunctions: [],
-          },
-        ],
-      },
-    },
-    {
-      // Enable jest formatting for cypress tests too, the plugin logic just works
-      extends: ["plugin:jest-formatting/recommended"],
-      files: ["*.cy.spec.ts", "*.cy.spec.js"],
-    },
-    {
-      files: ["frontend/src/**/*"],
-      rules: {
-        "no-restricted-syntax": [
-          "error",
-          {
-            selector: "Literal[value=/mb-base-color-/]",
-            message:
-              "You may not use base colors in the application, use semantic colors instead. (see colors.module.css)",
-          },
-        ],
-      },
-    },
-    {
-      files: ["frontend/src/metabase/**/*"],
-      rules: {
-        "no-restricted-syntax": [
-          "error",
-          {
-            selector: "Literal[value=/mb-base-color-/]",
-            message:
-              "You may not use base colors in the application, use semantic colors instead. (see colors.module.css)",
-          },
-        ],
-      },
-    },
-    {
-      files: ["frontend/src/metabase/query_builder/**/*"],
-      rules: {
-        "import/no-cycle": "error",
-      },
-    },
-    {
-      files: ["docs/**/snippets/**/*.{ts,tsx,js,jsx}"],
-      rules: {
-        "@typescript-eslint/no-unused-vars": "off",
-        "@typescript-eslint/no-var-requires": "off",
-        "import/no-commonjs": "off",
-        "import/no-default-export": "off",
-        "import/order": "off",
-        "import/no-unresolved": "off",
-        "no-color-literals": "off",
-      },
-    },
-    {
-      files: ["frontend/build/**/*.js"],
-      rules: {
-        "import/no-commonjs": "off",
-      },
-    },
-    {
-      files: ["**/*.stories.tsx", "**/preview.tsx"],
-      rules: {
-        "import/no-default-export": "off",
-      },
-    },
-  ],
-};

.gitattributes

@@ -1,7 +1,9 @@
-# Custom merge driver for YAML migration files
-# Treats each changeset as an atomic unit to avoid conflicts within changesets
+# Custom merge driver for per-release YAML migration files.
+# Treats each changeset as an atomic unit to avoid conflicts within changesets.
+# Only applies to per-release *_update_migrations.yaml files — directory-based
+# migrations (e.g. 060/*.yaml) have one file per migration and don't need this.
 # Execute this in your shell to enable custom merge driver:
 # echo '\n[include]\npath=../.gitconfig' >> .git/config
 #
 # TODO (Bryan 12/12/25) -- reenable this when we can completely verify correctness
-# resources/migrations/*.yaml merge=yaml-migrations
+# resources/migrations/*_update_migrations.yaml merge=yaml-migrations

.gitconfig

@@ -1,7 +1,5 @@
 # execute this in your shell to enable custom merge driver:
 # echo '\n[include]\npath=../.gitconfig' >> .git/config
-#
-# TODO (Bryan 12/12/25) -- reenable this when we can completely verify correctness
-# [merge "yaml-migrations"]
-#     name = YAML migration changeset-aware merge
-#     driver = mage -merge-yaml-migrations %O %A %B %L %P
+[merge "yaml-migrations"]
+    name = Per-release YAML migration changeset-aware merge
+    driver = bin/mage -merge-yaml-migrations %O %A %B %L %P

.github/CODEOWNERS

@@ -1,266 +1,30 @@
 # Before changing this file, make sure you have read how we use it:
 # https://www.notion.so/metabase/Pull-Request-Code-Review-Guide-374f05df889748b69d67af753f9bc9b8?pvs=4#36550c04ceab40b5a8b8bee6264b090c
 
+# @metabase/core-backend-querying-platform
+src/metabase/lib @metabase/core-backend-querying-platform
+src/metabase/lib_be @metabase/core-backend-querying-platform
+src/metabase/query_processor @metabase/core-backend-querying-platform
+
+# @metabase/graphy
+src/metabase/graph @metabase/graphy
+enterprise/backend/src/metabase_enterprise/dependencies @metabase/graphy
+enterprise/frontend/src/metabase-enterprise/dependencies @metabase/graphy
+
+# @metabase/embedding
 enterprise/frontend/src/embedding-sdk-package @metabase/embedding
 enterprise/frontend/src/embedding-sdk-bundle @metabase/embedding
 enterprise/frontend/src/embedding-sdk-shared @metabase/embedding
 frontend/src/metabase/embedding-sdk @metabase/embedding
 frontend/src/metabase/public/containers/PublicOrEmbeddedQuestion @metabase/embedding
 frontend/src/metabase/public/containers/PublicOrEmbeddedDashboard @metabase/embedding
-frontend/src/metabase/ui @metabase/core-frontend-ux-west
-# snowplow/* @metabase/data
-src/metabase/analytics/prometheus.clj @metabase/cloud-ops
-.github @metabase/devexp
-.clj-kondo @metabase/devexp
-deps.edn @metabase/backend-developers
 
+# @metabase/tech-writers
 docs @metabase/tech-writers
 docs/developers-guide # exclude from tech-writer ownership
 
-#
-# Backend modules <=> teams that own them
-#
+# @metabase/devexp
+.github @metabase/devexp
 
-# modules/drivers @metabase/drivers
-src/metabase/driver/sql_jdbc/actions.clj       @metabase/core-ux-east
-test/metabase/driver/sql_jdbc/actions_test.clj @metabase/core-ux-east
-
-# enterprise/backend/src/metabase_enterprise/advanced_config @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/advanced_config @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/advanced_permissions @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/advanced_permissions @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/airgap @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/airgap @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/api @metabase/devexp
-# enterprise/backend/test/metabase_enterprise/api @metabase/devexp
-
-# enterprise/backend/src/metabase_enterprise/audit_app @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/audit_app @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/auth_provider @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/auth_provider @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/billing @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/billing @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/cache @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/cache @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/content_verification @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/content_verification @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/core @metabase/devexp
-# enterprise/backend/test/metabase_enterprise/core @metabase/devexp
-
-# enterprise/backend/src/metabase_enterprise/dashboard_subscription_filters @metabase/core-ux-east
-# enterprise/backend/test/metabase_enterprise/dashboard_subscription_filters @metabase/core-ux-east
-
-# enterprise/backend/src/metabase_enterprise/enhancements @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/enhancements @metabase/core-backend-admin-webapp
-
-# # enterprise/backend/src/metabase_enterprise/llm
-# # enterprise/backend/test/metabase_enterprise/llm
-
-# enterprise/backend/src/metabase_enterprise/query_reference_validation @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/query_reference_validation @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/sandbox @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/sandbox @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/scim @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/scim @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/search ...
-# enterprise/backend/test/metabase_enterprise/search ...
-
-# enterprise/backend/src/metabase_enterprise/serialization @metabase/core-ux-east
-# enterprise/backend/test/metabase_enterprise/serialization @metabase/core-ux-east
-
-# enterprise/backend/src/metabase_enterprise/snippet_collections @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/snippet_collections @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/sso @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/sso @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/stale @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/stale @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/stats @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/stats @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/task @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/task @metabase/core-backend-admin-webapp
-
-# enterprise/backend/src/metabase_enterprise/upload_management @metabase/core-backend-admin-webapp
-# enterprise/backend/test/metabase_enterprise/upload_management @metabase/core-backend-admin-webapp
-
-src/metabase/actions @metabase/core-ux-east
-test/metabase/actions @metabase/core-ux-east
-
-# src/metabase/activity_feed @metabase/core-backend-admin-webapp
-# test/metabase/activity_feed @metabase/core-backend-admin-webapp
-
-# src/metabase/analytics @metabase/core-backend-admin-webapp
-# test/metabase/analytics @metabase/core-backend-admin-webapp
-
-# src/metabase/analyze @metabase/drivers
-# test/metabase/analyze @metabase/drivers
-
-# src/metabase/api @metabase/devexp
-# test/metabase/api @metabase/devexp
-
-# src/metabase/audit @metabase/core-backend-admin-webapp
-# test/metabase/audit @metabase/core-backend-admin-webapp
-
-# src/metabase/auth_provider @metabase/core-backend-admin-webapp
-# test/metabase/auth_provider @metabase/core-backend-admin-webapp
-
-# src/metabase/bookmarks @metabase/core-backend-admin-webapp
-# test/metabase/bookmarks @metabase/core-backend-admin-webapp
-
-# src/metabase/cmd @metabase/devexp
-# test/metabase/cmd @metabase/devexp
-
-# src/metabase/channel @metabase/core-ux-east
-# test/metabase/channel @metabase/core-ux-east
-
-# src/metabase/cloud_migration ...
-# test/metabase/cloud_migration ...
-
-# src/metabase/cmd @metabase/devexp
-# test/metabase/cmd @metabase/devexp
-
-# src/metabase/config @metabase/devexp
-# test/metabase/config @metabase/devexp
-
-# src/metabase/core @metabase/devexp
-# test/metabase/core @metabase/devexp
-
-# src/metabase/db @metabase/core-backend-admin-webapp
-# test/metabase/db @metabase/core-backend-admin-webapp
-
-# src/metabase/driver @metabase/drivers
-# test/metabase/driver @metabase/drivers
-
-# src/metabase/eid_translation @metabase/core-backend-admin-webapp
-# test/metabase/eid_translation @metabase/core-backend-admin-webapp
-
-# src/metabase/embed @metabase/embedding
-# test/metabase/embed @metabase/embedding
-
-# src/metabase/events @metabase/devexp
-# test/metabase/events @metabase/devexp
-
-# src/metabase/formatter @metabase/core-backend-querying
-# test/metabase/formatter @metabase/core-backend-querying
-
-# src/metabase/indexed_entities @metabase/core-backend-querying
-# test/metabase/indexed_entities @metabase/core-backend-querying
-
-# src/metabase/integrations ...
-# test/metabase/integrations ...
-
-# src/metabase/legacy_mbql @metabase/core-backend-querying
-# test/metabase/legacy_mbql @metabase/core-backend-querying
-
-# src/metabase/lib @metabase/core-backend-querying
-# test/metabase/lib @metabase/core-backend-querying
-
-# src/metabase/logger @metabase/devexp
-# test/metabase/logger @metabase/devexp
-
-# src/metabase/login_history @metabase/core-backend-admin-webapp
-# test/metabase/login_history @metabase/core-backend-admin-webapp
-
-# src/metabase/model_persistence @metabase/core-backend-querying
-# test/metabase/model_persistence @metabase/core-backend-querying
-
-# src/metabase/models @metabase/devexp
-# test/metabase/models @metabase/devexp
-
-# src/metabase/moderation @metabase/core-backend-admin-webapp
-# test/metabase/moderation @metabase/core-backend-admin-webapp
-
-# src/metabase/notification @metabase/core-ux-east
-# test/metabase/notification @metabase/core-ux-east
-
-# src/metabase/permissions @metabase/core-backend-admin-webapp
-# test/metabase/permissions @metabase/core-backend-admin-webapp
-
-# src/metabase/plugins @metabase/devexp
-# test/metabase/plugins @metabase/devexp
-
-# src/metabase/premium_features @metabase/core-backend-admin-webapp
-# test/metabase/premium_features @metabase/core-backend-admin-webapp
-
-# src/metabase/public_settings @metabase/core-backend-admin-webapp
-# test/metabase/public_settings @metabase/core-backend-admin-webapp
-
-# src/metabase/public_sharing @metabase/core-backend-admin-webapp
-# test/metabase/public_sharing @metabase/core-backend-admin-webapp
-
-# src/metabase/pulse @metabase/core-ux-east
-# test/metabase/pulse @metabase/core-ux-east
-
-# src/metabase/query_analysis @metabase/core-backend-querying
-# test/metabase/query_analysis @metabase/core-backend-querying
-
-# src/metabase/query_processor @metabase/core-backend-querying
-# test/metabase/query_processor @metabase/core-backend-querying
-
-# src/metabase/request @metabase/devexp
-# test/metabase/request @metabase/devexp
-
-# src/metabase/revisions @metabase/core-backend-admin-webapp
-# test/metabase/revisions @metabase/core-backend-admin-webapp
-
-# src/metabase/sample_data @metabase/core-backend-admin-webapp
-# test/metabase/sample_data @metabase/core-backend-admin-webapp
-
-# src/metabase/search ...
-# test/metabase/search ...
-
-# src/metabase/segments @metabase/core-backend-querying
-# test/metabase/segments @metabase/core-backend-querying
-
-# src/metabase/server @metabase/devexp
-# test/metabase/server @metabase/devexp
-
-# src/metabase/session @metabase/core-backend-admin-webapp
-# test/metabase/session @metabase/core-backend-admin-webapp
-
-# src/metabase/setup @metabase/core-backend-admin-webapp
-# test/metabase/setup @metabase/core-backend-admin-webapp
-
-# src/metabase/sso @metabase/core-backend-admin-webapp
-# test/metabase/sso @metabase/core-backend-admin-webapp
-
-# src/metabase/sync @metabase/drivers
-# test/metabase/sync @metabase/drivers
-
-# src/metabase/task @metabase/devexp
-# test/metabase/task @metabase/devexp
-
-# src/metabase/tiles @metabase/core-backend-dashviz
-# test/metabase/tiles @metabase/core-backend-dashviz
-
-# src/metabase/timeline @metabase/core-backend-dashviz
-# test/metabase/timeline @metabase/core-backend-dashviz
-
-# src/metabase/types @metabase/core-backend-querying
-# test/metabase/types @metabase/core-backend-querying
-
-# src/metabase/upload @metabase/core-backend-admin-webapp
-# test/metabase/upload @metabase/core-backend-admin-webapp
-
-# src/metabase/user_key_value @metabase/core-backend-admin-webapp
-# test/metabase/user_key_value @metabase/core-backend-admin-webapp
-
-# src/metabase/util @metabase/devexp
-# test/metabase/util @metabase/devexp
-
-# src/metabase/xrays @metabase/core-backend-querying
-# test/metabase/xrays @metabase/core-backend-querying
+# @metabase/cloud-ops
+src/metabase/analytics/prometheus.clj @metabase/cloud-ops

.github/ISSUE_TEMPLATE/epic.md

@@ -1,23 +0,0 @@
----
-name: Epic (Internal Use)
-about: This issue is used to track a feature/project that may span several days
-  to weeks to implement. This is used by the core Metabase team to project plan
-  and manage work.
-title: "[Epic] Title"
-labels: ".Epic"
----
-
-### Links
-
-- [product doc](LINK_TO_PRODUCT_DOC)
-- [technical design doc](LINK_TO_TECHNICAL_DESIGN_DOC)
-- [testing plan](LINK_TO_TESTING_PLAN)
-- feature branch: `BRANCH_NAME`
-- issue links: _related issues, if any_
-
-### Implementation Plan
-
-```[tasklist]
-#### Milestone 1
-- [ ] _Add tasks here_
-```

.github/ISSUE_TEMPLATE/feature_request.md

@@ -7,16 +7,13 @@ assignees: ''
 
 ---
 
-**Is your feature request related to a problem? Please describe.**
-A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+**What problem will this feature request solve?**
 
-**Describe the solution you'd like**
+**Describe the solution you'd like.**
 A clear and concise description of what you want to happen.
 
-**Describe alternatives you've considered**
-A clear and concise description of any alternative solutions or features you've considered.
+**How does this feature request impact you?**
+For example, is it a minor inconvenience, or does it block important work?
 
-**How important is this feature to you?**
-
-**Additional context**
+**Additional information**
 Add any other context or screenshots about the feature request here.

.github/ISSUE_TEMPLATE/task.md

@@ -1,14 +0,0 @@
----
-name: Task (Internal Use)
-about: This issue is used to track a smaller feature/task that does not require
-  being broken down to milestones. This is used by the core Metabase team to
-  project plan and manage work.
-labels: ".Task"
-
----
-
-**Context**
-
-
-- issue links: _related issues if any_
-

.github/PULL_REQUEST_TEMPLATE.md

@@ -25,3 +25,4 @@ _Upload a demo video or before/after screenshots if sensible or remove the secti
 ### Checklist
 
 - [ ] Tests have been added/updated to cover changes in this PR
+- [ ] If adding new Loki tests: they pass [stress testing](https://github.com/metabase/metabase/actions/workflows/loki-stress-test-flake-fix.yml)

.github/PULL_REQUEST_TEMPLATE/cypress_repro.md

@@ -5,7 +5,7 @@ PENDING CI / PENDING REVIEW / READY _(choose one and update accordingly)_
 - Reproduces #XXXXX
 
 ### How to test this manually?
-- `yarn test-cypress`
+- `bun run test-cypress`
 - `relative/path/to/the/file`
 > _(For still unfixed bug)_
 - Replace `it.skip()` with `it.only()` to run the test in isolation

.github/actions/fetch-artifact/action.yml

@@ -2,9 +2,16 @@ name: Fetch artifact
 description: Fetches a specific artifact and downloads it to the current directory
 
 inputs:
-  name:
-    description: The name of the artifact to fetch
+  commit:
+    description: Commit SHA for the artifact
     required: true
+  edition:
+    description: Metabase edition (ee or oss)
+    required: true
+  release:
+    description: Whether this is a release artifact (uses metabase-release- prefix)
+    required: false
+    default: "false"
   output-name:
     description: Optional custom name for the output jar file (defaults to metabase.jar)
     required: false
@@ -25,25 +32,44 @@ runs:
         script: | # js
           const fs = require('fs');
 
+          const isRelease = "${{ inputs.release }}" === "true";
+          const prefix = isRelease ? "metabase-release" : "metabase";
+          const artifactName = `${prefix}-${{ inputs.edition }}-${{ inputs.commit }}-uberjar`;
+          console.log(`Looking for artifact: ${artifactName}`);
+
           const artifacts = await github.rest.actions.listArtifactsForRepo({
             owner: context.repo.owner,
             repo: context.repo.repo,
-            name: "${{ inputs.name }}",
+            name: artifactName,
             per_page: 1,
           });
 
           if (!artifacts.data?.artifacts?.[0]?.id) {
-            throw new Error(`No artifacts found for ${{ inputs.name }}`);
+            core.setFailed(`No artifacts found for ${artifactName}`);
+            return;
           }
 
           const artifact_id = artifacts.data.artifacts[0].id;
 
-          const download = await github.rest.actions.downloadArtifact({
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-            artifact_id: artifact_id,
-            archive_format: 'zip',
-          });
+          let download;
+          const maxAttempts = 3;
+          for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+            try {
+              download = await github.rest.actions.downloadArtifact({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                artifact_id: artifact_id,
+                archive_format: 'zip',
+              });
+              break;
+            } catch (err) {
+              console.log(`Attempt ${attempt}/${maxAttempts} failed: ${err.message}`);
+              if (attempt === maxAttempts) throw err;
+              const delay = attempt * 15000; // 15s, 30s
+              console.log(`Retrying in ${delay / 1000}s...`);
+              await new Promise(r => setTimeout(r, delay));
+            }
+          }
 
           fs.writeFileSync(`${process.env.GITHUB_WORKSPACE}/mb.zip`, Buffer.from(download.data));
 

.github/actions/get-cache-keys/action.yml

@@ -7,9 +7,15 @@ outputs:
   m2-cache-key:
     description: "The cache key for the Maven cache."
     value: ${{ steps.keys-factory.outputs.m2-cache-key }}
+  m2-restore-key:
+    description: "The fallback restore key prefix for the Maven cache."
+    value: ${{ steps.keys-factory.outputs.m2-restore-key }}
   node-cache-key:
     description: "The cache key for the Node.js cache."
     value: ${{ steps.keys-factory.outputs.node-cache-key }}
+  node-restore-key:
+    description: "The fallback restore key prefix for the Node.js cache."
+    value: ${{ steps.keys-factory.outputs.node-restore-key }}
   eslint-cache-key:
     description: "The cache key for Eslint cache"
     value: ${{ steps.keys-factory.outputs.eslint-cache-key }}
@@ -31,7 +37,9 @@ runs:
         CACHE_SUFFIX="${{ runner.os }}-$WEEK_OF_YEAR"
 
         echo "m2-cache-key=$M2_CACHE_PREFIX-$CACHE_SUFFIX" >> $GITHUB_OUTPUT
+        echo "m2-restore-key=$M2_CACHE_PREFIX-" >> $GITHUB_OUTPUT
         echo "node-cache-key=$NODE_CACHE_PREFIX-$CACHE_SUFFIX" >> $GITHUB_OUTPUT
+        echo "node-restore-key=$NODE_CACHE_PREFIX-" >> $GITHUB_OUTPUT
         echo "eslint-cache-key=$ESLINT_CACHE_PREFIX-$CACHE_SUFFIX" >> $GITHUB_OUTPUT
         echo "cypress-cache-key=$CYPRESS_CACHE_PREFIX-$CACHE_SUFFIX" >> $GITHUB_OUTPUT
       shell: bash

.github/actions/maximize-disk-space/action.yml

@@ -0,0 +1,19 @@
+name: Maximize disk space
+description: Removes unused stuff from GH runner
+
+runs:
+  using: "composite"
+  steps:
+    - name: Maximize build space
+      shell: bash
+      run: |
+        echo "-- Dotnet"
+        sudo rm -rf /usr/share/dotnet
+        echo "-- Android"
+        sudo rm -rf /usr/local/lib/android
+        echo "-- Haskell"
+        sudo rm -rf /opt/ghc
+        echo "-- CodeQL"
+        sudo rm -rf /opt/hostedtoolcache/CodeQL
+
+        df -h

.github/actions/prepare-backend/action.yml

@@ -1,14 +1,13 @@
 name: Prepare back-end environment
 description: |
   Prepare the backend. Installs jdk, Clojure, and fetches the cache for m2.
-  The CI config fetches `ci-test-config.json` from master and lets us ignore tests at the var level if they are flaking.
 inputs:
   java-version:
     required: true
-    default: '21'
+    default: "21"
   clojure-version:
     required: true
-    default: '1.12.0.1488'
+    default: "1.12.0.1488"
 
 runs:
   using: "composite"
@@ -17,18 +16,33 @@ runs:
       uses: actions/setup-java@v4
       with:
         java-version: ${{ inputs.java-version }}
-        distribution: 'temurin'
+        distribution: "temurin"
     - name: Install Clojure CLI
       shell: bash
-      continue-on-error: true
       run: |
-        curl -O https://download.clojure.org/install/linux-install-${{ inputs.clojure-version }}.sh &&
-        sudo bash ./linux-install-${{ inputs.clojure-version }}.sh
+        for attempt in 1 2 3; do
+          curl --retry 3 --retry-delay 5 --fail -O https://download.clojure.org/install/linux-install-${{ inputs.clojure-version }}.sh \
+            && sudo bash ./linux-install-${{ inputs.clojure-version }}.sh \
+            && break
+          echo "::warning::Clojure install attempt $attempt failed, retrying in 10s..."
+          sleep 10
+        done
+        if ! clojure --version; then
+          echo "::error::Clojure CLI installation failed after 3 attempts"
+          exit 1
+        fi
 
     - name: Get M2 cache key
       uses: ./.github/actions/get-cache-keys
       id: get-cache-keys
 
+    - name: Install uv (for Python package installation)
+      uses: astral-sh/setup-uv@v7
+      with:
+        enable-cache: false
+        version: "0.10.2" # keep in sync with mise.toml
+        github-token: ${{ github.token }}
+
     - name: Restore M2 cache
       uses: actions/cache/restore@v4
       with:
@@ -36,3 +50,5 @@ runs:
           ~/.m2
           ~/.gitlibs
         key: ${{ steps.get-cache-keys.outputs.m2-cache-key }}
+        restore-keys: |
+          ${{ steps.get-cache-keys.outputs.m2-restore-key }}

.github/actions/prepare-cypress/action.yml

@@ -3,7 +3,7 @@ description: Cypress preparation steps
 
 inputs:
   working-directory:
-    description: "Optional working directory for yarn commands"
+    description: "Optional working directory for bun commands"
     required: false
     default: "."
 
@@ -15,11 +15,10 @@ outputs:
 runs:
   using: "composite"
   steps:
-    - name: Install Chrome v111
-      uses: browser-actions/setup-chrome@v1
+    - name: Install Chrome v144
+      uses: browser-actions/setup-chrome@v2
       with:
-        # https://chromium.cypress.io/linux/stable/111.0.5563.146
-        chrome-version: 1097615
+        chrome-version: 144
       id: setup-chrome
 
     - name: Get cache keys
@@ -34,9 +33,9 @@ runs:
 
     - name: Ensure that Cypress executable is ready
       run: |
-        yarn cypress install
-        yarn cypress cache path
-        yarn cypress cache list
-        yarn cypress verify
+        bun run cypress install
+        bun run cypress cache path
+        bun run cypress cache list
+        bun run cypress verify
       shell: bash
       working-directory: ${{ inputs.working-directory }}

.github/actions/prepare-frontend/action.yml

@@ -1,4 +1,5 @@
 name: Prepare front-end environment
+description: "Prepare the front-end environment for the CI build"
 inputs:
   node-version:
     description: "The version of Node.js to use, overriding .nvmrc"
@@ -10,11 +11,10 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - name: Prepare Node.js
-      uses: actions/setup-node@v4
+    - name: Prepare Node + Bun environment
+      uses: ./.github/actions/prepare-node-bun
       with:
-        node-version: ${{ inputs.node-version }} # this overrides, if present
-        node-version-file: ".nvmrc"
+        node-version: ${{ inputs.node-version }}
 
     - name: Get cache keys
       uses: ./.github/actions/get-cache-keys
@@ -27,13 +27,15 @@ runs:
           ~/.m2
           ~/.gitlibs
         key: ${{ steps.get-cache-keys.outputs.m2-cache-key }}
+        restore-keys: |
+          ${{ steps.get-cache-keys.outputs.m2-restore-key }}
 
-    - name: Get yarn cache directory
-      id: yarn-cache-dir
+    - name: Get bun cache directory
+      id: bun-cache
       run: |
-        YARN_CACHE_DIR=$(yarn cache dir)
-        echo "Yarn cache directory: $YARN_CACHE_DIR"
-        echo "dir=$YARN_CACHE_DIR" >> $GITHUB_OUTPUT
+        BUN_CACHE_DIR=$(bun pm cache)
+        echo "Bun cache directory: $BUN_CACHE_DIR"
+        echo "dir=$BUN_CACHE_DIR" >> $GITHUB_OUTPUT
       shell: bash
 
     - name: Restore node_modules cache
@@ -41,17 +43,19 @@ runs:
       id: node-modules-cache
       with:
         path: |
-          ${{ steps.yarn-cache-dir.outputs.dir }}
+          ${{ steps.bun-cache.outputs.dir }}
           node_modules
         key: ${{ steps.get-cache-keys.outputs.node-cache-key }}
+        restore-keys: |
+          ${{ steps.get-cache-keys.outputs.node-restore-key }}
 
     # postinstall lifecycle hook can be dangerous in CI so we only run it locally (see package.json)
     # If a job wants to patch packages, it does so explicitly in the CI. This setting is opt-out.
     # For example, we never want to cache node_modules with patches already applied so cache-generator.yml skips that step.
     - name: Clean install
-      run: yarn install --frozen-lockfile --prefer-offline
+      run: bun install --frozen-lockfile
       shell: bash
     - name: Patch frontend dependencies
       if: inputs.apply-patches == 'true'
-      run: yarn patch-package
+      run: bun run patch-package
       shell: bash

.github/actions/prepare-node-bun/action.yml

@@ -0,0 +1,20 @@
+name: Prepare Node + Bun environment
+description: "Set up Node.js and Bun for CI jobs"
+inputs:
+  node-version:
+    description: "The version of Node.js to use, overriding .nvmrc"
+    required: false
+runs:
+  using: "composite"
+  steps:
+    - name: Prepare Node.js
+      uses: actions/setup-node@v4
+      with:
+        node-version: ${{ inputs.node-version }}
+        node-version-file: ".nvmrc"
+
+    - name: Install bun
+      uses: oven-sh/setup-bun@v2
+      with:
+        bun-version: "1.3.7"
+        token: ${{ github.token }}

.github/actions/prepare-release-scripts/action.yml

@@ -0,0 +1,14 @@
+name: Prepare Release Scripts
+description: Set up bun and build release scripts
+
+runs:
+  using: composite
+  steps:
+    - uses: oven-sh/setup-bun@v2
+      with:
+        bun-version: "1.3.7"
+        token: ${{ github.token }}
+
+    - name: Build release scripts
+      shell: bash
+      run: cd ${{ github.workspace }}/release && bun install --frozen-lockfile && bun run build

.github/actions/prepare-shoppy-e2e/action.yml

@@ -0,0 +1,132 @@
+name: Prepare Shoppy E2E environment
+description: Shared setup steps for Shoppy E2E tests (regular and synthetic)
+
+inputs:
+  commit:
+    description: "Commit SHA for artifact retrieval"
+    required: true
+  sample-app-branch-name:
+    description: "Branch name for the sample app"
+    required: true
+  sample-app-environment:
+    description: "Environment (production/development)"
+    required: true
+  staging-mb-all-features-token:
+    description: "Staging MB all features token"
+    required: true
+  shoppy-iam-role:
+    description: "Shoppy IAM role for AWS credentials"
+    required: true
+  shoppy-metabase-app-db-s3-bucket:
+    description: "S3 bucket for Shoppy app DB dump"
+    required: true
+  shoppy-metabase-app-db-s3-key:
+    description: "S3 key for Shoppy app DB dump"
+    required: true
+  shoppy-metabase-app-db-user:
+    description: "Shoppy Metabase app DB user"
+    required: true
+  shoppy-metabase-app-db-database:
+    description: "Shoppy Metabase app DB database"
+    required: true
+  metastore-dev-server-url:
+    description: "Metastore dev server URL"
+    required: true
+  shoppy-datadog-application-id:
+    description: "Shoppy Datadog application ID"
+    required: true
+  shoppy-datadog-client-token:
+    description: "Shoppy Datadog client token"
+    required: true
+
+outputs:
+  chrome-path:
+    description: "Path to Chrome executable"
+    value: ${{ steps.cypress-prep.outputs.chrome-path }}
+  sample_app_branch_exists:
+    description: "Whether the sample app branch exists"
+    value: ${{ steps.check-sample-app-branch.outputs.sample_app_branch_exists }}
+
+runs:
+  using: "composite"
+  steps:
+    - uses: ./.github/actions/maximize-disk-space
+
+    # We have to use the latest version that does not have this issue https://github.com/docker/compose/pull/12752
+    - name: Set up Docker Compose
+      uses: docker/setup-compose-action@v1
+      with:
+        version: latest
+
+    - name: Retrieve uberjar artifact for ee
+      uses: ./.github/actions/fetch-artifact
+      with:
+        commit: ${{ inputs.commit }}
+        edition: ee
+        extract-path: "target/uberjar"
+        output-name: "metabase.jar"
+
+    - name: Retrieve Embedding SDK dist artifact
+      uses: actions/download-artifact@v4
+      with:
+        name: embedding-sdk-${{ inputs.commit }}
+        path: ${{ github.workspace }}/resources/embedding-sdk
+
+    - name: Prepare front-end environment
+      uses: ./.github/actions/prepare-frontend
+
+    - name: Prepare Cypress environment
+      id: cypress-prep
+      uses: ./.github/actions/prepare-cypress
+
+    - name: Check if sample app branch exists
+      id: check-sample-app-branch
+      shell: bash
+      env:
+        SAMPLE_APP_BRANCH_NAME: ${{ inputs.sample-app-branch-name }}
+      run: |
+        REPO_URL="https://github.com/metabase/shoppy.git"
+        echo "Checking if branch '${SAMPLE_APP_BRANCH_NAME}' exists in ${REPO_URL}..."
+        if git ls-remote --exit-code --heads "$REPO_URL" "${SAMPLE_APP_BRANCH_NAME}"; then
+          echo "sample_app_branch_exists=true" >> $GITHUB_OUTPUT
+        else
+          echo "sample_app_branch_exists=false" >> $GITHUB_OUTPUT
+        fi
+
+    - name: Configure AWS credentials
+      if: ${{ steps.check-sample-app-branch.outputs.sample_app_branch_exists == 'true' }}
+      uses: aws-actions/configure-aws-credentials@v4
+      with:
+        role-to-assume: ${{ inputs.shoppy-iam-role }}
+        role-session-name: GitHub_to_AWS_via_FederatedOIDC
+        aws-region: us-east-1
+
+    - name: Download Shoppy's App DB PostgreSQL dump from S3
+      if: ${{ steps.check-sample-app-branch.outputs.sample_app_branch_exists == 'true' }}
+      shell: bash
+      run: |
+        aws s3 cp s3://${{ inputs.shoppy-metabase-app-db-s3-bucket }}/${{ inputs.shoppy-metabase-app-db-s3-key }} ./e2e/tmp/db_dumps/shoppy_metabase_app_db_dump.sql
+
+    - name: Prepare and launch Shoppy containers
+      if: ${{ steps.check-sample-app-branch.outputs.sample_app_branch_exists == 'true' }}
+      shell: bash
+      env:
+        SAMPLE_APP_BRANCH_NAME: ${{ inputs.sample-app-branch-name }}
+        SAMPLE_APP_ENVIRONMENT: ${{ inputs.sample-app-environment }}
+        CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ inputs.staging-mb-all-features-token }}
+        METASTORE_DEV_SERVER_URL: ${{ inputs.metastore-dev-server-url }}
+        METABASE_APP_DB_USER: ${{ inputs.shoppy-metabase-app-db-user }}
+        METABASE_APP_DB: ${{ inputs.shoppy-metabase-app-db-database }}
+        SHOPPY_DATADOG_APPLICATION_ID: ${{ inputs.shoppy-datadog-application-id }}
+        SHOPPY_DATADOG_CLIENT_TOKEN: ${{ inputs.shoppy-datadog-client-token }}
+        SHOPPY_DATADOG_SITE: "us5.datadoghq.com"
+        SHOPPY_DATADOG_ENV: "staging"
+      run: npx tsx ./e2e/runner/embedding-sdk/sample-apps/start-ci.ts shoppy-e2e
+
+    - name: Prune build cache
+      shell: bash
+      run: docker builder prune -af
+
+    - name: Log free disk space
+      shell: bash
+      run: df -h /

.github/actions/prepare-uberjar-artifact/action.yml

@@ -2,9 +2,10 @@ name: Prepare Uberjar Artifact
 description: Prepare and upload Metabase JAR as a GitHub artifact.
 
 inputs:
-  name:
-    required: true
-    description: Artifact name
+  edition:
+    required: false
+    default: "ee"
+    description: Metabase edition (ee or oss)
 
 runs:
   using: "composite"
@@ -18,7 +19,7 @@ runs:
     - name: Upload JARs as artifact
       uses: actions/upload-artifact@v4
       with:
-        name: ${{ inputs.name }}
+        name: metabase-${{ inputs.edition }}-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
         path: |
           ./target/uberjar/metabase.jar
           ./COMMIT-ID

.github/actions/sdk-bundle-size-check/action.yml

@@ -0,0 +1,110 @@
+name: Embedding SDK Bundle Size Check
+description: |
+  Downloads the current branch's uberjar and builds the base ref's
+  embedding-sdk.js from source, compares their sizes,
+  and sets output if the size change exceeds the threshold.
+
+inputs:
+  edition:
+    description: 'Metabase edition (ee or oss)'
+    required: true
+  base-ref-commit:
+    description: 'Commit SHA of the base ref (e.g. merge base).'
+    required: true
+  threshold-percent:
+    description: 'Percent threshold for bundle size change'
+    required: true
+
+outputs:
+  status:
+    description: "Bundle size status: increased, decreased, or stable"
+    value: ${{ steps.compare.outputs.status }}
+  size_change_percent:
+    description: "size change percent (positive = increase, negative = decrease)"
+    value: ${{ steps.compare.outputs.size_change_percent }}
+
+runs:
+  using: "composite"
+  steps:
+    - name: Prepare backend
+      uses: ./.github/actions/prepare-backend
+    - name: Prepare frontend
+      uses: ./.github/actions/prepare-frontend
+    - name: Download current uberjar
+      uses: actions/download-artifact@v4
+      with:
+        name: metabase-${{ inputs.edition }}-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+        path: temp/current-uberjar
+    - name: Extract embedding-sdk bundles from current uberjar
+      shell: bash
+      run: |
+        # Try new layout first (app/embedding-sdk/legacy/), fall back to old layout (app/embedding-sdk.js)
+        unzip -j temp/current-uberjar/target/uberjar/metabase.jar \
+          "frontend_client/app/embedding-sdk/legacy/embedding-sdk.js" \
+          -d temp/current-bundle 2>/dev/null || \
+        unzip -j temp/current-uberjar/target/uberjar/metabase.jar \
+          "frontend_client/app/embedding-sdk.js" \
+          -d temp/current-bundle
+
+        # Extract chunks directory if it exists (new layout only)
+        mkdir -p temp/current-chunks
+        unzip -j temp/current-uberjar/target/uberjar/metabase.jar \
+          "frontend_client/app/embedding-sdk/chunks/*" \
+          -d temp/current-chunks 2>/dev/null || true
+    - name: Checkout base ref
+      uses: actions/checkout@v4
+      with:
+        ref: ${{ inputs.base-ref-commit }}
+        path: temp/base-ref-src
+    - name: Build base-ref embedding-sdk.js
+      shell: bash
+      run: |
+        cd temp/base-ref-src
+        bun install
+        MB_EDITION=${{ inputs.edition }} bun run build-release
+    - name: Compare sizes and set output
+      id: compare
+      shell: bash
+      run: |
+        # --- Legacy (monolithic) bundle comparison ---
+        current_size=$(wc -c < temp/current-bundle/embedding-sdk.js) || { echo "::error::Failed to read current bundle"; exit 1; }
+
+        # Base ref: try new layout first, fall back to old
+        if [ -f "temp/base-ref-src/resources/frontend_client/app/embedding-sdk/legacy/embedding-sdk.js" ]; then
+          base_ref_size=$(wc -c < "temp/base-ref-src/resources/frontend_client/app/embedding-sdk/legacy/embedding-sdk.js")
+        else
+          base_ref_size=$(wc -c < "temp/base-ref-src/resources/frontend_client/app/embedding-sdk.js")
+        fi
+        [ "$current_size" -gt 0 ] && [ "$base_ref_size" -gt 0 ] || { echo "::error::Bundle file is empty"; exit 1; }
+
+        diff=$((current_size - base_ref_size))
+        percent=$(( diff * 100 / base_ref_size ))
+
+        echo "=== Legacy (monolithic) bundle ==="
+        echo "Current size: $current_size bytes"
+        echo "Base ref size: $base_ref_size bytes"
+        echo "Difference: $diff bytes ($percent%)"
+
+        threshold="${{ inputs.threshold-percent }}"
+        if [ "$percent" -gt "$threshold" ]; then
+          status="increased"
+        elif [ "$percent" -lt "$(( -threshold ))" ]; then
+          status="decreased"
+        else
+          status="stable"
+        fi
+
+        echo "status=$status" >> $GITHUB_OUTPUT
+        echo "size_change_percent=$percent" >> $GITHUB_OUTPUT
+
+        # --- Chunked bundle (informational) ---
+        if ls temp/current-chunks/*.js 1>/dev/null 2>&1; then
+          chunks_size=$(cat temp/current-chunks/*.js | wc -c)
+          echo ""
+          echo "=== Chunked bundle (bootstrap + chunks) ==="
+          echo "Total chunked size: $chunks_size bytes"
+          echo "chunks_size=$chunks_size" >> $GITHUB_OUTPUT
+        else
+          echo ""
+          echo "No chunked bundle found (expected on master)"
+        fi

.github/actions/test-driver/action.yml

@@ -12,56 +12,32 @@ inputs:
   logs-artifact-suffix:
     required: false
     description: Suffix to append to the test logs artifact name to avoid conflicts in matrix jobs
+  edition:
+    required: false
+    default: 'ee'
+    description: Edition to test (oss or ee)
 
 outputs:
-  quarantine-skipped:
-    description: Whether the driver test was skipped due to quarantine
-    value: ${{ steps.check-driver.outputs.skip }}
+  test-outcome:
+    description: "The outcome of the test run (success, failure, cancelled, skipped)"
+    value: ${{ steps.run-test.outcome }}
 
 runs:
   using: "composite"
   steps:
-    - name: Check if driver is ignored
-      id: check-driver
-      shell: bash
-      run: |
-        # If DRIVERS env var is not set, proceed with tests
-        if [ -z "$DRIVERS" ]; then
-          echo "No DRIVERS env var set. Proceeding with tests."
-          echo "skip=false" >> $GITHUB_OUTPUT
-          exit 0
-        fi
-
-        # Fetch CI config and check if driver should be skipped
-        curl -sSf -o ci-test-config.json https://raw.githubusercontent.com/metabase/ci-test-config/refs/heads/master/ci-test-config.json || true
-
-        # Check if the driver is in the ignored list (gracefully handle missing/invalid config)
-        IS_IGNORED=$(jq --arg driver "$DRIVERS" '.ignored.drivers // [] | contains([$driver])' ci-test-config.json 2>/dev/null || echo "false")
-
-        if [ "$IS_IGNORED" = "true" ]; then
-          echo "⚠️  Driver '$DRIVERS' is in the ignored list. Skipping tests."
-          echo "View the ignored list here: https://github.com/metabase/ci-test-config/blob/master/ci-test-config.json"
-          echo "skip=true" >> $GITHUB_OUTPUT
-        else
-          echo "Driver '$DRIVERS' is not ignored. Proceeding with tests."
-          echo "skip=false" >> $GITHUB_OUTPUT
-        fi
-
     - name: Prepare back-end environment
-      if: steps.check-driver.outputs.skip != 'true'
       uses: ./.github/actions/prepare-backend
     - name: Prepare front-end environment
-      if: ${{ steps.check-driver.outputs.skip != 'true' && inputs.build-static-viz == 'true' }}
+      if: ${{ inputs.build-static-viz == 'true' }}
       uses: ./.github/actions/prepare-frontend
     - name: Build static viz frontend
-      if: ${{ steps.check-driver.outputs.skip != 'true' && inputs.build-static-viz == 'true' }}
-      run: yarn build-static-viz
+      if: ${{ inputs.build-static-viz == 'true' }}
+      run: bun run build-static-viz
       shell: bash
       env:
         MB_EDITION: ee
     - name: Test database driver
-      if: steps.check-driver.outputs.skip != 'true'
-      run: clojure -X:dev:ci:ee:ee-dev:drivers:drivers-dev:test ${{ inputs.test-args }}
+      run: clojure -X:dev:ci:${{ inputs.edition }}:${{ inputs.edition }}-dev:drivers:drivers-dev:test ${{ inputs.test-args }}
       shell: bash
       id: run-test
       # Trunk Quarantine controls the final state of the run in the CI!
@@ -73,7 +49,7 @@ runs:
       # As per the documentation: https://docs.github.com/en/actions/reference/workflows-and-actions/contexts#steps-context
       # test.outcome gives us access to the result before `continue-on-error` overrides it and sets it to 'success'.
       # We want test reports even if the test step gets cancelled (e.g. times out), hence we match anything that is not a 'success'.
-      if: ${{ steps.run-test.outcome != 'success' && steps.check-driver.outputs.skip != 'true' }}
+      if: ${{ steps.run-test.outcome != 'success' }}
       with:
         path: "target/junit/**/*_test.xml"
         name: JUnit Test Report ${{ inputs.junit-name }}
@@ -82,10 +58,10 @@ runs:
         list-tests: failed
         fail-on-error: false
     - name: Upload Logs on Failure
-      if: always() && steps.run-test.outcome != 'success' && steps.check-driver.outputs.skip != 'true'
+      if: always() && steps.run-test.outcome != 'success'
       uses: actions/upload-artifact@v4
       with:
-        name: ${{ format('test-logs-{0}{1}', github.job, (inputs.logs-artifact-suffix == '' || inputs.logs-artifact-suffix == null) && '' || format('-{0}', inputs.logs-artifact-suffix)) }}
+        name: ${{ format('test-logs-{0}{1}', github.job, inputs.logs-artifact-suffix && format('-{0}', inputs.logs-artifact-suffix) || '') }}
         path: logs/test-log.json
         retention-days: 1
       # Failing to upload the artifact should never affect the outcome of the whole test run.

.github/actions/upload-test-results/action.yml

@@ -21,6 +21,8 @@ inputs:
   variant:
     required: false
     default: ""
+  previous-step-outcome:
+    required: true
 
 runs:
   using: "composite"
@@ -57,3 +59,4 @@ runs:
         dry-run: ${{ github.event_name == 'pull_request' && github.event.pull_request.draft == true }} # quarantine, but do not upload results
         token: ${{ inputs.trunk-api-token }}
         use-cache: true
+        previous-step-outcome: ${{ inputs.previous-step-outcome }}

.github/copilot-instructions.md

@@ -1,52 +1,55 @@
 # Metabase Developer Assistant Instructions
 
-## Frontend Development
+For detailed coding standards and conventions, see `CLAUDE.md` and the skills in `.claude/skills/`.
 
-### Repository Structure
+## Code Review Standards
 
-```
-frontend/src/
-├── metabase/           # Main application components and pages
-├── metabase-lib/       # Query building and data modeling utilities
-├── metabase-types/     # TypeScript type definitions
-└── metabase/ui/        # Design system components
+Review focus areas: Security → Performance → Testing → Documentation (in priority order)
 
-e2e/                    # Cypress end-to-end tests
-frontend/test/          # Jest unit tests
-```
+When reviewing code, use these emoji prefixes to categorize feedback:
+- 🔒 Security concerns
+- ⚡ Performance opportunities
+- 🧹 Cleanup needs
+- 📚 Documentation gaps
+- 🚨 Blocking issues
+- 💭 Clarification questions
 
-### Technology Stack
+### Security Critical Issues
 
-- **Framework**: React 18 with TypeScript
-- **State**: Redux Toolkit
-- **Styling**: CSS Modules (preferred) > Emotion styled-components
-- **UI**: `metabase/ui` components built with Mantine v8
-- **Build**: Rspack (primary), Webpack (legacy)
-- **Testing**: Jest + React Testing Library, Cypress
+- Check for hardcoded secrets, API keys, or credentials
+- Look for SQL injection and XSS vulnerabilities
+- Verify proper input validation and sanitization
+- Review authentication and authorization logic
+- Ensure enterprise features use the plugin system (no enterprise code in OSS)
 
-### Coding Standards
+### Performance Red Flags
 
-#### Component Preferences
+- Identify N+1 database query problems
+- Spot inefficient loops and algorithmic issues
+- Check for memory leaks and resource cleanup
+- Review caching opportunities for expensive operations
 
-- Prefer `metabase/ui`components over `metabase/common/components`
-- Use `.tsx` for components, `.ts` for utilities
+### Code Quality Essentials
 
-#### Styling
+- Functions should be focused and appropriately sized
+- Use clear, descriptive naming conventions
+- Ensure proper error handling throughout
+- Remove dead code and unused imports
 
-ALWAYS prefer Mantine style props,then CSS modules. DO NOT suggest styled components, they are deprecated.
+### Review Style
 
-#### TypeScript Migration
+- Only flag actual issues worth mentioning
+- Do not post "looks good" comments or congratulate following conventions
+- Be specific and actionable in feedback
+- Explain the "why" behind recommendations
+- Ask clarifying questions when code intent is unclear
 
-When heavily editing `.js`/`.jsx` files, create a separate PR to convert to TypeScript first, then implement changes.
+### Review Format
 
-#### Enterprise Features
+- Condense feedback into as few comments as possible
+- Prefer a single summary comment over dozens of inline comments
+- Only use inline comments for critical issues that require immediate attention
+- For non-critical issues, link to the specific line from the summary instead
+- Delete all stale comments and summaries on each new push or CI run
 
-Enterprise functionality MUST use the plugin system. It is very important to not expose enterprise code in the OSS version.
-
-#### Testing Requirements
-
-All PRs should include tests. Prefer Unit tests over E2E tests.
-
-#### Localization
-
-All user-facing strings MUST be localized using the ttag library. Localized strings should be complete phrases, do not concatenate a few separately localized strings. You should add context to strings where the meaning of the string might not be obvious in isolation: e.g. "Home" might have different words in some languages depending on whether you're talking about a dwelling or the landing page for a website.
+Language-specific rules are in `.github/instructions/*.instructions.md`.

.github/file-paths.yaml

@@ -26,11 +26,11 @@ frontend_ci: &frontend_ci
   - ".github/workflows/frontend.yml"
 
 frontend_configs: &frontend_configs
-  - "yarn.lock"
+  - "bun.lock"
   - "**/tsconfig*.json"
   - "package.json"
   - "babel.config.json"
-  - ".eslintrc.js"
+  - "eslint.config.mjs"
   - "postcss.config.js"
   - "rspack.config.js"
   - "rspack.main.config.js"
@@ -85,7 +85,9 @@ backend_ci: &backend_ci
 
 backend_presto_kerberos:
   - "**/presto_jdbc/**"
+  - "**/presto-jdbc/**" # the driver module has a hyphen. underscores are classpaths
   - "**/presto_jdbc.clj"
+  - "**/presto_jdbc_test.clj"
   - ".github/workflows/presto-kerberos-integration-test.yml"
 
 backend_sources: &backend_sources
@@ -197,3 +199,15 @@ cljs:
   - *shared_specs
   - ".github/workflows/cljs.yml"
   - "shadow-cljs.edn"
+
+openapi:
+  - ".github/workflows/openapi.yml"
+  - "src/metabase/api/**"
+  - "src/metabase/api_routes/**"
+  - "src/metabase/*_rest/api.clj"
+  - "src/metabase/*/api.clj"
+  - "src/metabase/*/api/*.clj"
+  - "enterprise/backend/src/metabase_enterprise/**/api.clj"
+  - "enterprise/backend/src/metabase_enterprise/**/api/*.clj"
+  - "resources/openapi/**"
+  - "package.json"

.github/instructions/clojure.instructions.md

@@ -0,0 +1,9 @@
+---
+applyTo: "**/*.{clj,cljs,cljc}"
+---
+
+# Clojure/ClojureScript Code Review
+
+When reviewing Clojure or ClojureScript code, apply the guidelines in these files:
+- `.claude/skills/_shared/clojure-style-guide.md`
+- `.claude/skills/clojure-review/SKILL.md`

.github/instructions/docs.instructions.md

@@ -0,0 +1,9 @@
+---
+applyTo: "docs/**/*.md"
+---
+
+# Documentation Review
+
+When reviewing documentation, apply the guidelines in these files:
+- `.claude/skills/_shared/metabase-style-guide.md`
+- `.claude/skills/docs-review/SKILL.md`

.github/instructions/typescript.instructions.md

@@ -0,0 +1,11 @@
+---
+applyTo: "**/*.{ts,tsx,js,jsx}"
+---
+
+# TypeScript/JavaScript Code Review
+
+When reviewing TypeScript or JavaScript code, apply the guidelines in these files:
+
+- `.claude/skills/typescript-review/SKILL.md`
+- `docs/developers-guide/frontend.md`
+- `frontend/CLAUDE.md`

.github/scripts/build-cross-version-matrix.js

@@ -0,0 +1,52 @@
+// This script is used in .github/workflows/cross-version.yml
+// to generate a matrix for cross-version migration testing
+
+/**
+ * Generate a CI matrix for cross-version migration testing (EE only).
+ *
+ * Creates pairs of [source, target] for testing HEAD against the last N
+ * minor versions in both upgrade and downgrade directions.
+ *
+ * @param {number} currentVersion - The current major version number (e.g., 59)
+ * @param {number} count - Number of previous minor versions to test against (default: 3)
+ * @returns {{ config: Array<{ source: string, target: string }> }}
+ *
+ * @example
+ * buildMatrix(59)
+ * // Returns:
+ * // {
+ * //   config: [
+ * //     { source: "HEAD", target: "v1.59.x" },
+ * //     { source: "v1.59.x", target: "HEAD" },
+ * //     { source: "HEAD", target: "v1.58.x" },
+ * //     { source: "v1.58.x", target: "HEAD" },
+ * //     { source: "HEAD", target: "v1.57.x" },
+ * //     { source: "v1.57.x", target: "HEAD" },
+ * //   ]
+ * // }
+ */
+function buildCrossVersionMatrix(currentVersion, count = 3) {
+  if (!Number.isInteger(currentVersion) || currentVersion < 1) {
+    throw new Error(
+      `Invalid currentVersion: ${currentVersion}. Must be a positive integer.`,
+    );
+  }
+
+  if (!Number.isInteger(count) || count < 1) {
+    throw new Error(`Invalid count: ${count}. Must be a positive integer.`);
+  }
+
+  const config = Array.from({ length: count }, (_, i) => currentVersion - i)
+    .filter((majorVersion) => majorVersion >= 1)
+    .flatMap((majorVersion) => {
+      const version = `v1.${majorVersion}.x`;
+      return [
+        { source: "HEAD", target: version },
+        { source: version, target: "HEAD" },
+      ];
+    });
+
+  return { config };
+}
+
+module.exports = { buildCrossVersionMatrix };

.github/scripts/build-cross-version-matrix.unit.spec.js

@@ -0,0 +1,242 @@
+const { buildCrossVersionMatrix } = require("./build-cross-version-matrix");
+
+describe("buildCrossVersionMatrix", () => {
+  describe("default behavior", () => {
+    it("should generate matrix with 3 versions by default", () => {
+      const result = buildCrossVersionMatrix(59);
+      expect(result).toEqual({
+        config: [
+          { source: "HEAD", target: "v1.59.x" },
+          { source: "v1.59.x", target: "HEAD" },
+          { source: "HEAD", target: "v1.58.x" },
+          { source: "v1.58.x", target: "HEAD" },
+          { source: "HEAD", target: "v1.57.x" },
+          { source: "v1.57.x", target: "HEAD" },
+        ],
+      });
+    });
+
+    it("should use EE prefix (v1)", () => {
+      const result = buildCrossVersionMatrix(50);
+      expect(result.config[0].target).toBe("v1.50.x");
+      expect(result.config[1].source).toBe("v1.50.x");
+    });
+
+    it("should create pairs in both directions (upgrade and downgrade)", () => {
+      const result = buildCrossVersionMatrix(59);
+      const entries = result.config;
+
+      // Check HEAD -> version (upgrade test)
+      expect(entries.filter((e) => e.source === "HEAD")).toHaveLength(3);
+      // Check version -> HEAD (downgrade test)
+      expect(entries.filter((e) => e.target === "HEAD")).toHaveLength(3);
+    });
+  });
+
+  describe("custom count", () => {
+    it("should generate matrix with custom count", () => {
+      const result = buildCrossVersionMatrix(59, 5);
+      expect(result.config).toHaveLength(10); // 5 versions × 2 directions
+      expect(result.config).toEqual([
+        { source: "HEAD", target: "v1.59.x" },
+        { source: "v1.59.x", target: "HEAD" },
+        { source: "HEAD", target: "v1.58.x" },
+        { source: "v1.58.x", target: "HEAD" },
+        { source: "HEAD", target: "v1.57.x" },
+        { source: "v1.57.x", target: "HEAD" },
+        { source: "HEAD", target: "v1.56.x" },
+        { source: "v1.56.x", target: "HEAD" },
+        { source: "HEAD", target: "v1.55.x" },
+        { source: "v1.55.x", target: "HEAD" },
+      ]);
+    });
+
+    it("should generate matrix with count=1", () => {
+      const result = buildCrossVersionMatrix(59, 1);
+      expect(result.config).toHaveLength(2);
+      expect(result.config).toEqual([
+        { source: "HEAD", target: "v1.59.x" },
+        { source: "v1.59.x", target: "HEAD" },
+      ]);
+    });
+
+    it("should generate matrix with large count", () => {
+      const result = buildCrossVersionMatrix(59, 10);
+      expect(result.config).toHaveLength(20);
+
+      // Check first and last entries
+      expect(result.config[0]).toEqual({
+        source: "HEAD",
+        target: "v1.59.x",
+      });
+      expect(result.config[18]).toEqual({
+        source: "HEAD",
+        target: "v1.50.x",
+      });
+      expect(result.config[19]).toEqual({
+        source: "v1.50.x",
+        target: "HEAD",
+      });
+    });
+  });
+
+  describe("edge cases", () => {
+    it("should handle version 1", () => {
+      const result = buildCrossVersionMatrix(1);
+      expect(result).toEqual({
+        config: [
+          { source: "HEAD", target: "v1.1.x" },
+          { source: "v1.1.x", target: "HEAD" },
+        ],
+      });
+    });
+
+    it("should stop when version would go below 1", () => {
+      const result = buildCrossVersionMatrix(2, 5);
+      // Can only generate v1.2.x and v1.1.x (2 versions, not 5)
+      expect(result.config).toHaveLength(4);
+      expect(result).toEqual({
+        config: [
+          { source: "HEAD", target: "v1.2.x" },
+          { source: "v1.2.x", target: "HEAD" },
+          { source: "HEAD", target: "v1.1.x" },
+          { source: "v1.1.x", target: "HEAD" },
+        ],
+      });
+    });
+
+    it("should handle high version numbers", () => {
+      const result = buildCrossVersionMatrix(100, 2);
+      expect(result).toEqual({
+        config: [
+          { source: "HEAD", target: "v1.100.x" },
+          { source: "v1.100.x", target: "HEAD" },
+          { source: "HEAD", target: "v1.99.x" },
+          { source: "v1.99.x", target: "HEAD" },
+        ],
+      });
+    });
+  });
+
+  describe("error handling", () => {
+    it("should throw for undefined currentVersion", () => {
+      expect(() => buildCrossVersionMatrix()).toThrow(
+        "Invalid currentVersion: undefined. Must be a positive integer.",
+      );
+    });
+
+    it("should throw for non-integer currentVersion", () => {
+      expect(() => buildCrossVersionMatrix(59.5)).toThrow(
+        "Invalid currentVersion: 59.5. Must be a positive integer.",
+      );
+    });
+
+    it("should throw for zero currentVersion", () => {
+      expect(() => buildCrossVersionMatrix(0)).toThrow(
+        "Invalid currentVersion: 0. Must be a positive integer.",
+      );
+    });
+
+    it("should throw for negative currentVersion", () => {
+      expect(() => buildCrossVersionMatrix(-1)).toThrow(
+        "Invalid currentVersion: -1. Must be a positive integer.",
+      );
+    });
+
+    it("should throw for NaN currentVersion", () => {
+      expect(() => buildCrossVersionMatrix(NaN)).toThrow(
+        "Invalid currentVersion: NaN. Must be a positive integer.",
+      );
+    });
+
+    it("should throw for non-integer count", () => {
+      expect(() => buildCrossVersionMatrix(59, 2.5)).toThrow(
+        "Invalid count: 2.5. Must be a positive integer.",
+      );
+    });
+
+    it("should throw for zero count", () => {
+      expect(() => buildCrossVersionMatrix(59, 0)).toThrow(
+        "Invalid count: 0. Must be a positive integer.",
+      );
+    });
+
+    it("should throw for negative count", () => {
+      expect(() => buildCrossVersionMatrix(59, -1)).toThrow(
+        "Invalid count: -1. Must be a positive integer.",
+      );
+    });
+  });
+
+  describe("matrix structure for GitHub Actions", () => {
+    it("should return object with config array", () => {
+      const result = buildCrossVersionMatrix(59);
+      expect(result).toHaveProperty("config");
+      expect(Array.isArray(result.config)).toBe(true);
+    });
+
+    it("should produce valid JSON for GitHub Actions", () => {
+      const result = buildCrossVersionMatrix(59);
+      const json = JSON.stringify(result);
+      expect(() => JSON.parse(json)).not.toThrow();
+
+      const parsed = JSON.parse(json);
+      expect(parsed.config).toHaveLength(6);
+      expect(parsed.config[0]).toEqual({
+        source: "HEAD",
+        target: "v1.59.x",
+      });
+    });
+
+    it("should have consistent entry structure", () => {
+      const result = buildCrossVersionMatrix(59, 5);
+
+      result.config.forEach((entry) => {
+        expect(entry).toHaveProperty("source");
+        expect(entry).toHaveProperty("target");
+        expect(typeof entry.source).toBe("string");
+        expect(typeof entry.target).toBe("string");
+        // Either source or target should be HEAD
+        expect(entry.source === "HEAD" || entry.target === "HEAD").toBeTruthy();
+      });
+    });
+  });
+
+  describe("version ordering", () => {
+    it("should generate versions in descending order", () => {
+      const result = buildCrossVersionMatrix(59, 5);
+      const versions = result.config
+        .filter((e) => e.source === "HEAD")
+        .map((e) => e.target);
+
+      expect(versions).toEqual([
+        "v1.59.x",
+        "v1.58.x",
+        "v1.57.x",
+        "v1.56.x",
+        "v1.55.x",
+      ]);
+    });
+
+    it("should interleave upgrade and downgrade tests", () => {
+      const result = buildCrossVersionMatrix(59, 2);
+
+      expect(result.config[0]).toEqual({
+        source: "HEAD",
+        target: "v1.59.x",
+      });
+      expect(result.config[1]).toEqual({
+        source: "v1.59.x",
+        target: "HEAD",
+      });
+      expect(result.config[2]).toEqual({
+        source: "HEAD",
+        target: "v1.58.x",
+      });
+      expect(result.config[3]).toEqual({
+        source: "v1.58.x",
+        target: "HEAD",
+      });
+    });
+  });
+});

.github/scripts/csv-to-mb.js

@@ -0,0 +1,41 @@
+/**
+ * jsonData must be in the format:
+ * [
+ *   { column1: value1, column2: value2, ... },
+ *   { column1: value3, column2: value4, ... },
+ *   ...
+ * ]
+ */
+function jsonToCsvFormData(jsonData) {
+  const formData = new FormData();
+  const csvHeader = Object.keys(jsonData[0]).join(',') + '\n';
+  const csvContent = jsonData.map(row =>
+    Object.values(row).map(value => `"${String(value).replace(/"/g, '""')}"`).join(',')
+  ).join('\n');
+
+  const blob = new Blob([csvHeader + csvContent], { type: 'text/csv' });
+  formData.append('file', blob, 'data.csv');
+
+  return formData;
+}
+
+function uploadCsvToMb({ baseUrl, tableId, jsonData, mode = 'append' }) {
+  const formData = jsonToCsvFormData(jsonData);
+  const operation = mode === 'replace' ? 'replace-csv' : 'append-csv';
+
+  return fetch(`${baseUrl}/api/table/${tableId}/${operation}`, {
+    method: 'POST',
+    headers: {
+      "x-api-key": process.env.API_KEY
+    },
+    body: formData
+  })
+  .then(response => {
+    if (!response.ok) {
+      throw new Error(`Upload failed`);
+    }
+    return { success: true };
+  });
+}
+
+module.exports = { uploadCsvToMb };

.github/scripts/find-linear-issue.js

@@ -0,0 +1,40 @@
+async function findLinearIssue({ githubIssueUrl, linearApiKey }) {
+  const response = await fetch("https://api.linear.app/graphql", {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: linearApiKey,
+    },
+    body: JSON.stringify({
+      query: `
+        query {
+          attachmentsForURL(url: "${githubIssueUrl}") {
+            nodes {
+              issue { identifier }
+            }
+          }
+        }
+      `,
+    }),
+  });
+
+  const data = await response.json();
+
+  if (!response.ok) {
+    return { success: false, message: `Linear API error: ${response.status}` };
+  }
+
+  if (!data.data?.attachmentsForURL?.nodes?.length) {
+    return {
+      success: false,
+      message: `No Linear issue linked to ${githubIssueUrl}`,
+    };
+  }
+
+  return {
+    success: true,
+    issue: data.data.attachmentsForURL.nodes[0].issue.identifier,
+  };
+}
+
+module.exports = { findLinearIssue };

.github/scripts/setup-python-runner.sh

@@ -19,7 +19,7 @@ while [[ $# -gt 0 ]]; do
 done
 
 echo "Cloning python-runner repository..."
-git clone --depth 1 https://${METABASE_AUTOMATION_USER_TOKEN}@github.com/metabase/python-runner-container.git python-runner
+git clone --depth 1 -b extensible-resource-schema https://${METABASE_AUTOMATION_USER_TOKEN}@github.com/metabase/python-runner-container.git python-runner
 
 if [ "$SKIP_START" = false ]; then
   echo "Starting python-runner..."

.github/team.json

@@ -4,21 +4,23 @@
       "name": "Querying",
       "label": ".Team/Querying",
       "members": [
-        "ranquild",
-        "romeovs",
         "bshepherdson",
         "metamben",
-        "wzimrin",
-        "ericnormand",
-        "galdre"
+        "rileythomp",
+        "camsual"
       ]
     },
     {
-      "name": "Drivers",
-      "label": ".Team/Drivers",
+      "name": "Graphy",
+      "label": ".Team/Graphy",
       "members": [
-        "snoe",
-        "rileythomp"
+        "ranquild",
+        "romeovs",
+        "ericnormand",
+        "galdre",
+        "dpsutton",
+        "escherize",
+        "bgrabow"
       ]
     },
     {
@@ -43,9 +45,6 @@
       "name": "DevEx",
       "label": ".Team/DevEx",
       "members": [
-        "camsaul",
-        "dpsutton",
-        "escherize",
         "fraserdrops",
         "nemanjaglumac"
       ]
@@ -62,7 +61,8 @@
         "tsplude",
         "lbrdnk",
         "piranha",
-        "crisptrutski"
+        "crisptrutski",
+        "undrfined"
       ]
     },
     {
@@ -86,14 +86,12 @@
         "eliotmetabase",
         "npfitz",
         "johnswanson",
-        "iethree",
         "nvoxland",
         "edpaget",
         "deniskaber",
         "alxnddr",
-        "bpander",
         "andsalves",
-        "gantoreno"
+        "kevinkelleher12"
       ]
     },
     {
@@ -110,6 +108,16 @@
         "uladzimirdev",
         "egorgrushin"
       ]
+    },
+    {
+      "name": "Growth Eng",
+      "label": ".Team/GrowthEng",
+      "members": [
+        "iethree",
+        "bpander",
+        "gantoreno",
+        "losrebellos"
+      ]
     }
   ]
 }

.github/workflows/app-db.yml

@@ -15,14 +15,14 @@ jobs:
   be-tests-mariadb:
     if: ${{ !inputs.skip }}
     runs-on: ubuntu-22.04
-    timeout-minutes: 60
+    timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
         version:
-          - name: MariaDB 10.2
-            junit-name: be-tests-mariadb-10-2-ee
-            image: circleci/mariadb:10.2.23
+          - name: MariaDB 10.6
+            junit-name: be-tests-mariadb-10-6-ee
+            image: circleci/mariadb:10.6
             env:
               enable-ssl-tests: 'false'
           - name: MariaDB Latest
@@ -100,11 +100,12 @@ jobs:
       MB_MYSQL_SSL_TEST_USER: metabase
       MB_MYSQL_SSL_TEST_PASSWORD: ${{ secrets.MYSQL_RDS_SSL_INSTANCE_PASSWORD }}
     # for historic reasons (I don't want to mess around with required jobs) the job name should be something like
-    # "be-tests-mariadb-10-2-ee (0)"
+    # "be-tests-mariadb-10-6-ee (0)"
     name: "${{ matrix.version.name }} ${{ matrix.job.name }}"
     steps:
       - uses: actions/checkout@v4
       - name: Test ${{ matrix.version.name }}
+        id: test-driver
         uses: ./.github/actions/test-driver
         with:
           build-static-viz: ${{ matrix.job.build-static-viz }}
@@ -123,18 +124,19 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   be-tests-mysql:
     if: ${{ !inputs.skip }}
     runs-on: ubuntu-22.04
-    timeout-minutes: 60
+    timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
         version:
-          - name: MySQL 8.0
-            junit-name: be-tests-mysql-8-0-ee
-            image: cimg/mysql:8.0
+          - name: MySQL 8.4
+            junit-name: be-tests-mysql-8-4-ee
+            image: cimg/mysql:8.4
             env:
               enable-ssl-tests: 'false'
               enable-aws-iam-tests: 'false'
@@ -222,11 +224,12 @@ jobs:
       AWS_ACCESS_KEY_ID: ${{ secrets.AWS_AURORA_IAM_ACCESS_KEY_ID }}
       AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_AURORA_IAM_SECRET_ACCESS_KEY }}
     # for historic reasons (I don't want to mess around with required jobs) the job name should be something like
-    # "be-tests-mariadb-10-2-ee (0)"
+    # "be-tests-mariadb-10-6-ee (0)"
     name: "${{ matrix.version.name }} ${{ matrix.job.name }}"
     steps:
       - uses: actions/checkout@v4
       - name: Test ${{ matrix.version.name }}
+        id: test-driver
         uses: ./.github/actions/test-driver
         with:
           build-static-viz: ${{ matrix.job.build-static-viz }}
@@ -245,18 +248,19 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   be-tests-postgres:
     if: ${{ !inputs.skip }}
     runs-on: ubuntu-22.04
-    timeout-minutes: 60
+    timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
         version:
-          - name: Postgres 12.x
+          - name: Postgres 14.x
             junit-name: postgres-ee
-            docker-image: postgres:12-alpine
+            docker-image: postgres:14-alpine
             env:
               enable-ssl-tests: 'false'
               enable-aws-iam-tests: 'false'
@@ -336,6 +340,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Test ${{ matrix.version.name }} (${{ matrix.job.name }})
+        id: test-driver
         uses: ./.github/actions/test-driver
         with:
           build-static-viz: ${{ matrix.job.build-static-viz }}
@@ -354,6 +359,7 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
 
   app-db-tests-result:
     needs:

.github/workflows/backend-cloverage.yml

@@ -1,12 +1,34 @@
 name: Backend-Cloverage
 
+# Module lists are generated dynamically by listing source directories.
+# The setup-oss and setup-ee jobs list folders in src/metabase/ and
+# enterprise/backend/src/metabase_enterprise/ respectively, convert
+# underscores to dashes (for Clojure namespace convention), and output
+# as JSON arrays for the matrix jobs to consume.
+#
+# jq flags: -R (raw string input), -s (slurp all lines into one string),
+# -c (compact single-line output for GitHub Actions).
+
 on:
   workflow_dispatch:
-  schedule:
-    - cron: '0 10 * * 1-5' # every weekday at 5am US eastern time
+  # re-enable once we figure out the correctness of the reports in DEV-1104
+  # schedule:
+  #   - cron: '0 10 * * 1-5' # every weekday at 5am US eastern time
 
 jobs:
+  setup-oss:
+    runs-on: ubuntu-22.04
+    outputs:
+      modules: ${{ steps.get-modules.outputs.modules }}
+    steps:
+      - uses: actions/checkout@v4
+      - id: get-modules
+        run: |
+          modules=$(ls -1d src/metabase/*/ | xargs -n1 basename | tr '_' '-' | jq -R -s -c 'split("\n") | map(select(length > 0))')
+          echo "modules=$modules" >> $GITHUB_OUTPUT
+
   be-linter-cloverage:
+    needs: setup-oss
     # don't run this workflow on a cron for forks
     if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
     runs-on: ubuntu-22.04
@@ -14,96 +36,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        modules:
-          - actions
-          - activity-feed
-          - analytics
-          - analyze
-          - api
-          - api-keys
-          - api-routes
-          - app-db
-          - appearance
-          - audit-app
-          - auth-provider
-          - batch-processing
-          - bookmarks
-          - bug-reporting
-          - cache
-          - channel
-          - classloader
-          - cloud-migration
-          - cmd
-          - collections
-          - config
-          - connection-pool
-          - content-translation
-          - content-verification
-          - core
-          - dashboards
-          - database-routing
-          - driver
-          - driver-api
-          - eid-translation
-          - embedding
-          - events
-          - formatter
-          - geojson
-          - glossary
-          - graph
-          - indexed-entities
-          - internal-stats
-          - legacy-mbql
-          - lib
-          - lib-be
-          - logger
-          - login-history
-          - model-persistence
-          - models
-          - native-query-snippets
-          - notification
-          - parameters
-          - permissions
-          - pivot
-          - plugins
-          - premium-features
-          - product-feedback
-          - public-sharing
-          - pulse
-          - queries
-          - query-permissions
-          - query-processor
-          - remote-sync
-          - request
-          - revisions
-          - sample-data
-          - search
-          - secrets
-          - segments
-          - server
-          - session
-          - settings
-          - setup
-          - sso
-          - startup
-          - store-api
-          - sync
-          - system
-          - task
-          - task-history
-          - testing-api
-          - tiles
-          - timeline
-          - types
-          - upload
-          - user-key-value
-          - users
-          - util
-          - version
-          - view-log
-          - warehouse-schema
-          - warehouses
-          - xrays
+        modules: ${{ fromJson(needs.setup-oss.outputs.modules) }}
     steps:
       - uses: actions/checkout@v4
       - name: Prepare front-end environment
@@ -112,7 +45,7 @@ jobs:
         uses: ./.github/actions/prepare-backend
 
       - name: Build static viz frontend
-        run: yarn build-static-viz
+        run: bun run build-static-viz
         env:
           MB_EDITION: ee
       - name: Collect the test coverage
@@ -130,7 +63,19 @@ jobs:
           files: ./target/coverage/codecov.json
           flags: back-end
 
+  setup-ee:
+    runs-on: ubuntu-22.04
+    outputs:
+      modules: ${{ steps.get-modules.outputs.modules }}
+    steps:
+      - uses: actions/checkout@v4
+      - id: get-modules
+        run: |
+          modules=$(ls -1d enterprise/backend/src/metabase_enterprise/*/ | xargs -n1 basename | tr '_' '-' | jq -R -s -c 'split("\n") | map(select(length > 0))')
+          echo "modules=$modules" >> $GITHUB_OUTPUT
+
   be-linter-cloverage-enterprise:
+    needs: setup-ee
     # don't run this workflow on a cron for forks
     if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
     runs-on: ubuntu-22.04
@@ -138,53 +83,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        modules:
-          - action-v2
-          - advanced-config
-          - advanced-permissions
-          - ai-entity-analysis
-          - ai-sql-fixer
-          - ai-sql-generation
-          - analytics
-          - api
-          - audit-app
-          - auth-provider
-          - billing
-          - bookmarks
-          - cache
-          - cloud-add-ons
-          - comments
-          - content-translation
-          - content-verification
-          - core
-          - dashboard-subscription-filters
-          - database-replication
-          - database-routing
-          - dependencies
-          - documents
-          - email
-          - embedding-hub
-          - gsheets
-          - harbormaster
-          - impersonation
-          - internal-stats
-          - llm
-          - metabot-v3
-          - permission-debug
-          - premium-features
-          - public-sharing
-          - remote-sync
-          - sandbox
-          - scim
-          - search
-          - semantic-search
-          - serialization
-          - snippet-collections
-          - sso
-          - stale
-          - transforms
-          - transforms-python
-          - upload-management
+        modules: ${{ fromJson(needs.setup-ee.outputs.modules) }}
     steps:
       - uses: actions/checkout@v4
       - name: Prepare front-end environment
@@ -193,7 +92,7 @@ jobs:
         uses: ./.github/actions/prepare-backend
 
       - name: Build static viz frontend
-        run: yarn build-static-viz
+        run: bun run build-static-viz
         env:
           MB_EDITION: ee
       - name: Collect the test coverage

.github/workflows/backend.yml

@@ -36,10 +36,22 @@ jobs:
       - run: clojure -X:dev:ee:ee-dev:drivers:drivers-dev:test:eastwood
         name: Run Eastwood linter
 
+  be-linter-eastwood-test:
+    if: ${{ !inputs.skip }}
+    runs-on: ubuntu-22.04
+    timeout-minutes: 30
+    name: Eastwood (test)
+    steps:
+      - uses: actions/checkout@v4
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+      - run: clojure -X:dev:ee:ee-dev:drivers:drivers-dev:test:eastwood/test
+        name: Run Eastwood linter on tests
+
   be-tests:
     if: ${{ !inputs.skip }}
     runs-on: ubuntu-22.04
-    timeout-minutes: 60
+    timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
@@ -104,7 +116,7 @@ jobs:
         with:
           java-version: "${{ matrix.java-version }}"
       - name: Build static-viz frontend
-        run: yarn build-static-viz
+        run: bun run build-static-viz
         env:
           MB_EDITION: ${{ matrix.job.edition }}
 
@@ -130,6 +142,7 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.run-java-tests.outcome }}
 
       - name: Publish Test Report (JUnit)
         uses: dorny/test-reporter@v1
@@ -183,6 +196,7 @@ jobs:
   be-tests-result:
     needs:
       - be-linter-eastwood
+      - be-linter-eastwood-test
       - be-linter-clj-kondo
       - be-cljfmt
       - be-check

.github/workflows/build-for-release.yml

@@ -19,9 +19,11 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          sparse-checkout: release
-      - name: Prepare build scripts
-        run: cd ${{ github.workspace }}/release && yarn && yarn build
+          sparse-checkout: |
+            release
+            .github
+      - name: Prepare release scripts
+        uses: ./.github/actions/prepare-release-scripts
       - name: Send build start message
         uses: actions/github-script@v7
         env:
@@ -79,9 +81,11 @@ jobs:
         exit 1
     - uses: actions/checkout@v4
       with:
-        sparse-checkout: release
-    - name: Prepare build scripts
-      run: cd ${{ github.workspace }}/release && yarn && yarn build
+        sparse-checkout: |
+          release
+          .github
+    - name: Prepare release scripts
+      uses: ./.github/actions/prepare-release-scripts
     - name: Get Release Version
       uses: actions/github-script@v7
       id: canonical_version
@@ -121,9 +125,11 @@ jobs:
       uses: actions/checkout@v4
       with:
         fetch-depth: 0  # IMPORTANT! to get all the branches
-        sparse-checkout: release
-    - name: Prepare build scripts
-      run: cd ${{ github.workspace }}/release && yarn && yarn build
+        sparse-checkout: |
+          release
+          .github
+    - name: Prepare release scripts
+      uses: ./.github/actions/prepare-release-scripts
     - name: Get Release Branch
       uses: actions/github-script@v7
       id: release_branch
@@ -135,12 +141,13 @@ jobs:
           const releaseBranch = getReleaseBranch(version);
           return releaseBranch;
     - name: Ensure that the specified commit exists in the ${{ steps.release_branch.outputs.result }} release branch
-      run: |
+      run: | # bash
         RELEASE_BRANCH=${{ steps.release_branch.outputs.result }}
         git checkout $RELEASE_BRANCH
         git branch --contains ${{ inputs.commit }} | grep -q $RELEASE_BRANCH \
           && echo "Commit found in correct release branch" \
           || (echo "Commit not found in correct release branch" && exit 1)
+        git checkout -
 
   get-build-requirements:
     runs-on: ubuntu-22.04
@@ -152,9 +159,11 @@ jobs:
     steps:
     - uses: actions/checkout@v4
       with:
-        sparse-checkout: release
-    - name: Prepare build scripts
-      run: cd ${{ github.workspace }}/release && yarn && yarn build
+        sparse-checkout: |
+          release
+          .github
+    - name: Prepare release scripts
+      uses: ./.github/actions/prepare-release-scripts
     - name: Get build dependencies
       uses: actions/github-script@v7
       id: dependencies

.github/workflows/cache-generator.yml

@@ -82,7 +82,7 @@ jobs:
 
       # Frontend preparation and caches
       # `prepare-frontend` action (1) prepares Node.js and (2) fetches the node_modules cache if it exists.
-      # It then (3) runs `yarn install --frozen-lockfile --prefer-offline` which ensures the local cache is fully populated.
+      # It then (3) runs `bun install --frozen-lockfile` which ensures the local cache is fully populated.
       # IMPORTANT: Caching node_modules after patches are already applied will break any PR that attempts to either:
       #   - upgrade a patched library
       #   - change a patch
@@ -92,31 +92,31 @@ jobs:
         with:
           apply-patches: "false"
 
-      - name: Get yarn cache directory
-        id: yarn-cache-dir
+      - name: Get bun cache directory
+        id: bun-cache
         run: |
-          YARN_CACHE_DIR=$(yarn cache dir)
-          echo "Yarn cache directory: $YARN_CACHE_DIR"
-          echo "dir=$YARN_CACHE_DIR" >> $GITHUB_OUTPUT
+          BUN_CACHE_DIR=$(bun pm cache)
+          echo "Bun cache directory: $BUN_CACHE_DIR"
+          echo "dir=$BUN_CACHE_DIR" >> $GITHUB_OUTPUT
 
       - name: Ensure that Cypress executable is ready
         run: |
-          yarn cypress install
-          yarn cypress cache path
-          yarn cypress cache list
-          yarn cypress verify
+          bun run cypress install
+          bun run cypress cache path
+          bun run cypress cache list
+          bun run cypress verify
         shell: bash
 
       # Run Prettier to populate its cache (stored in node_modules/.cache/prettier)
       # so it gets saved as part of the node_modules cache below
       - name: Run Prettier to populate cache
-        run: yarn lint-prettier-pure
+        run: bun run lint-prettier-pure
 
       - name: Update node_modules cache
         uses: ./.github/actions/update-cache
         with:
           path: |
-            ${{ steps.yarn-cache-dir.outputs.dir }}
+            ${{ steps.bun-cache.outputs.dir }}
             node_modules
           key: ${{ env.NODE_CACHE_KEY }}
 
@@ -128,10 +128,10 @@ jobs:
 
       # ESLint cache (requires both backend and frontend)
       - name: Compile CLJS
-        run: yarn build-pure:cljs
+        run: bun run build-pure:cljs
 
       - name: Run ESLint to populate cache
-        run: yarn lint-eslint-pure
+        run: bun run lint-eslint-pure
 
       - name: Update eslint cache
         uses: ./.github/actions/update-cache

.github/workflows/check-milestone.yml

@@ -26,11 +26,13 @@ jobs:
     steps:
       - uses: actions/checkout@v4
         with:
-          sparse-checkout: release
+          sparse-checkout: |
+            release
+            .github
           fetch-depth: ${{ env.isNewReleaseBranch == 'false' && 3 || 0 }} # we need the full history to get all the commit messages
           ref: master # we want the logic from master, even though we're triggering on a release branch
-      - name: Prepare build scripts
-        run: cd ${{ github.workspace }}/release && yarn && yarn build
+      - name: Prepare release scripts
+        uses: ./.github/actions/prepare-release-scripts
       - uses: actions/github-script@v7
         if: ${{ env.isNewReleaseBranch == 'false' }}
         name: Set milestone for single commit

.github/workflows/chromatic.yml

@@ -41,7 +41,7 @@ jobs:
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
       - name: Compile CLJS
-        run: NODE_ENV=development yarn build-pure:cljs
+        run: NODE_ENV=development bun run build-pure:cljs
       - name: Publish to Chromatic
         uses: chromaui/action@v10.2.0
         env:

.github/workflows/claude-code-bug-fix.yml

@@ -70,6 +70,31 @@ jobs:
               core.setFailed(error.message);
             }
 
+      - name: Find linked Linear issue
+        id: find_linear
+        continue-on-error: true
+        uses: actions/github-script@v7
+        env:
+          LINEAR_API_KEY: ${{ secrets.LINEAR_API_KEY }}
+          ISSUE_NUMBER: ${{ steps.get_issue.outputs.issue_number }}
+        with:
+          script: |
+            const { findLinearIssue } = require('${{ github.workspace }}/.github/scripts/find-linear-issue.js');
+
+            const githubIssueUrl = `https://github.com/${context.repo.owner}/${context.repo.repo}/issues/${process.env.ISSUE_NUMBER}`;
+
+            const result = await findLinearIssue({
+              githubIssueUrl,
+              linearApiKey: process.env.LINEAR_API_KEY
+            });
+
+            if (result.success) {
+              console.log(`Found Linear issue: ${result.issue}`);
+              core.setOutput('linear_issue', result.issue);
+            } else {
+              console.log(`Could not find Linear issue: ${result.message}`);
+            }
+
       - name: Set up git configuration
         run: |
           git config --global user.name "Claude Code[bot]"
@@ -205,6 +230,12 @@ jobs:
           mkdir -p .claude-scratchpad
           echo "Scratchpad directory created for Claude's temporary verification files"
 
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+
       - name: Generate GitHub App Token for Claude
         uses: actions/create-github-app-token@v1
         id: claude-app-token
@@ -219,7 +250,7 @@ jobs:
           github_token: ${{ steps.claude-app-token.outputs.token }}
           prompt: ${{ env.BUG_FIX_PROMPT }}
           claude_args: |
-            --allowedTools "Bash(yarn test-unit*),Bash(yarn lint-eslint-pure),Bash(./bin/mage*),Bash(clojure*),Bash(find*),Bash(ls*),Bash(grep*),Write,Read,Glob,Grep,Edit,MultiEdit"
+            --allowedTools "Bash(bun run test-unit*),Bash(bun run lint-eslint-pure),Bash(./bin/mage*),Bash(clojure*),Bash(find*),Bash(ls*),Bash(grep*),Write,Read,Glob,Grep,Edit,MultiEdit"
             --disallowedTools "Bash(git commit*),Bash(git push*),Bash(gh*)"
 
       - name: Clean up scratchpad directory
@@ -259,6 +290,7 @@ jobs:
             core.setOutput('reviewers', issueCreator);
 
       - name: Create Pull Request
+        id: create_pr
         if: steps.check_changes.outputs.has_changes == 'true'
         uses: peter-evans/create-pull-request@v6
         with:
@@ -279,6 +311,8 @@ jobs:
           body: |
             This PR automatically fixes the bug reported in #${{ env.ISSUE_NUMBER }}.
 
+            ${{ steps.find_linear.outputs.linear_issue && format('Closes {0}', steps.find_linear.outputs.linear_issue) || '' }}
+
             ## Bug Report
             **Original Issue:** #${{ env.ISSUE_NUMBER }}
             **Reporter:** @${{ env.ISSUE_AUTHOR }}
@@ -299,7 +333,6 @@ jobs:
             - If issues are found, either fix them or close this PR
 
             ---
-            Closes #${{ env.ISSUE_NUMBER }}
 
             🤖 Generated with [Claude Code](https://claude.ai/code)
 
@@ -309,6 +342,7 @@ jobs:
             automated-fix
             ci skip
           reviewers: ${{ steps.prepare_reviewers.outputs.reviewers }}
+          assignees: ${{ github.actor }}
 
       - name: Log existing branch update
         if: steps.check_changes.outputs.has_changes == 'true' && env.BRANCH_EXISTS == 'true'

.github/workflows/claude-code-review.yaml

@@ -1,98 +0,0 @@
-name: "Claude Code Review"
-
-on:
-  pull_request:
-    types:
-      - closed
-      - synchronize
-      - labeled
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}-claude-code-review
-  cancel-in-progress: true
-
-jobs:
-  review:
-    if: |
-      (
-        github.event.action == 'closed' &&
-        github.event.pull_request.merged == true
-      ) ||
-      contains(github.event.pull_request.labels.*.name, 'Claude Code Review')
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: write
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 1
-          # Make sure the value of GITHUB_TOKEN will not be persisted in repo's config
-          persist-credentials: false
-
-      # Apparently comments on specific lines and top-level comments about the PR as a whole are TWO TOTALLY DIFFERENT
-      # TYPES OF THINGS. So we have to fetch and delete separately.
-      - name: Delete old Claude PR review comments
-        env:
-          GH_TOKEN: ${{ github.token }}
-          REPO: ${{ github.repository }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-        shell: bash
-        run: |
-          # Get old comment IDs from the bot
-          old_line_comment_ids=$(gh api "/repos/$REPO/pulls/$PR_NUMBER/comments" --jq '.[] | select(.user.login=="metabase-bot[bot]") | .id')
-          echo "Deleting line comments: $old_line_comment_ids"
-          # Delete each comment
-          for id in $old_line_comment_ids; do
-            gh api -X DELETE "/repos/$REPO/pulls/comments/$id"
-            echo "Deleted line comment $id"
-          done
-          # Get old top-level comment IDs (technically "issue" comments on the PR?)
-          old_top_level_comment_ids=$(gh api "/repos/$REPO/issues/$PR_NUMBER/comments" --jq '.[] | select(.user.login=="metabase-bot[bot]") | .id')
-          echo "Deleting top-level comments: $old_top_level_comment_ids"
-          # Delete each comment
-          for id in $old_top_level_comment_ids; do
-            gh api -X DELETE "/repos/$REPO/issues/comments/$id"
-            echo "Deleted top-level comment $id"
-          done
-
-      - name: Generate GitHub App Token for Claude
-        uses: actions/create-github-app-token@v1
-        id: claude-app-token
-        with:
-          app-id: ${{ secrets.METABASE_BOT_APP_ID }}
-          private-key: ${{ secrets.METABASE_BOT_APP_PRIVATE_KEY }}
-          permission-contents: read       # Required for reading repository files and PR diffs
-          permission-pull-requests: write # Required for creating inline comments and PR comments
-
-      - name: Fetch Community Clojure Style Guide
-        run: >-
-          curl https://raw.githubusercontent.com/bbatsov/clojure-style-guide/refs/heads/master/README.adoc -o CLOJURE_STYLE_GUIDE.adoc
-
-      - uses: anthropics/claude-code-action@v1
-        timeout-minutes: 10
-        with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-          github_token: ${{ steps.claude-app-token.outputs.token }}
-          prompt: |
-            REPO: ${{ github.repository }}
-            PR NUMBER: ${{ github.event.pull_request.number }}
-
-            Review this pull request for compliance with project coding standards and conventions.
-
-            **Use the appropriate review skill based on the file types changed:**
-            - Use clojure-review for Clojure/ClojureScript files
-            - Use typescript-review for TypeScript/JavaScript files
-            - Follow the review guidelines and checklists in each skill
-
-            DO NOT post any comments confirming that something is correct - only post comments for style violations or concerns.
-
-            Note: The PR branch is already checked out in the current working directory.
-
-            Use `gh pr comment` for top-level feedback.
-            Use `mcp__github_inline_comment__create_inline_comment` to highlight specific code issues.
-            Only post GitHub comments - don't submit review text as messages.
-
-          claude_args: |
-            --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),ReadFile(CLOJURE_STYLE_GUIDE.adoc)"

.github/workflows/claude-docs-review.yml

@@ -1,101 +0,0 @@
-name: "Claude Docs Review"
-
-on:
-  pull_request:
-    types:
-      - opened
-      - synchronize
-      - reopened
-    paths:
-      - 'docs/**/*.md'
-      - 'docs/**/*.mdx'
-  workflow_dispatch:
-    inputs:
-      pr_number:
-        description: 'PR number to review'
-        required: true
-        type: number
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}-claude-docs-review
-  cancel-in-progress: true
-
-jobs:
-  review:
-    runs-on: ubuntu-latest
-    if: github.event.pull_request.draft == false
-    permissions:
-      contents: read
-      pull-requests: write
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 1
-          # Make sure the value of GITHUB_TOKEN will not be persisted in repo's config
-          persist-credentials: false
-
-      - name: Generate GitHub App Token for Claude
-        uses: actions/create-github-app-token@v1
-        id: claude-app-token
-        with:
-          app-id: ${{ secrets.METABASE_BOT_APP_ID }}
-          private-key: ${{ secrets.METABASE_BOT_APP_PRIVATE_KEY }}
-          permission-contents: read       # Required for reading repository files and PR diffs
-          permission-pull-requests: write # Required for creating inline comments and PR comments
-
-      - name: Delete old Claude docs review comments
-        env:
-          GH_TOKEN: ${{ steps.claude-app-token.outputs.token }}
-          REPO: ${{ github.repository }}
-          PR_NUMBER: ${{ github.event.pull_request.number || github.event.inputs.pr_number }}
-        shell: bash
-        run: |
-          # Delete pending reviews first (these can be deleted entirely)
-          pending_review_ids=$(gh api "/repos/$REPO/pulls/$PR_NUMBER/reviews" --jq '.[] | select(.user.login=="metabase-bot[bot]" and .state=="PENDING") | .id')
-          if [ -n "$pending_review_ids" ]; then
-            echo "Deleting pending reviews: $pending_review_ids"
-            for id in $pending_review_ids; do
-              gh api -X DELETE "/repos/$REPO/pulls/$PR_NUMBER/reviews/$id"
-              echo "Deleted pending review $id"
-            done
-          fi
-
-          # Delete individual inline comments from submitted reviews (can't delete the review itself)
-          old_line_comment_ids=$(gh api "/repos/$REPO/pulls/$PR_NUMBER/comments" --jq '.[] | select(.user.login=="metabase-bot[bot]") | .id')
-          if [ -n "$old_line_comment_ids" ]; then
-            echo "Deleting line comments: $old_line_comment_ids"
-            for id in $old_line_comment_ids; do
-              gh api -X DELETE "/repos/$REPO/pulls/comments/$id"
-              echo "Deleted line comment $id"
-            done
-          fi
-
-          # Delete top-level review comments
-          old_top_level_comment_ids=$(gh api "/repos/$REPO/issues/$PR_NUMBER/comments" --jq '.[] | select(.user.login=="metabase-bot[bot]") | .id')
-          if [ -n "$old_top_level_comment_ids" ]; then
-            echo "Deleting top-level comments: $old_top_level_comment_ids"
-            for id in $old_top_level_comment_ids; do
-              gh api -X DELETE "/repos/$REPO/issues/comments/$id"
-              echo "Deleted top-level comment $id"
-            done
-          fi
-
-      - uses: anthropics/claude-code-action@v1
-        timeout-minutes: 10
-        with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-          github_token: ${{ steps.claude-app-token.outputs.token }}
-          show_full_output: true
-          prompt: |
-            REPO: ${{ github.repository }}
-            PR NUMBER: ${{ github.event.pull_request.number || github.event.inputs.pr_number }}
-
-            Review the documentation changes in this pull request.
-
-            Use the docs-review skill to review all changed documentation files for compliance with the Metabase writing style guide.
-
-            DO NOT post any comments confirming that something is correct - only post comments for style violations or concerns.
-
-          claude_args: |
-            --allowedTools "Skill,mcp__github__get_pull_request,mcp__github__get_pull_request_files,mcp__github__create_pending_pull_request_review,mcp__github__get_pull_request_diff,mcp__github__add_comment_to_pending_review,mcp__github__add_pull_request_review_comment_to_pending_review,mcp__github__delete_pending_pull_request_review,mcp__github__submit_pending_pull_request_review"

.github/workflows/clean-cache.yml

@@ -1,33 +0,0 @@
-name: Cleanup caches by a branch
-on:
-  pull_request:
-    types:
-      - closed
-
-jobs:
-  cleanup:
-    runs-on: ubuntu-22.04
-    steps:
-      - name: Check out code
-        uses: actions/checkout@v4
-
-      - name: Cleanup
-        run: |
-          gh extension install actions/gh-actions-cache
-
-          REPO=${{ github.repository }}
-          BRANCH="refs/pull/${{ github.event.pull_request.number }}/merge"
-
-          echo "Fetching list of cache key"
-          cacheKeysForPR=$(gh actions-cache list -R $REPO -B $BRANCH | cut -f 1 )
-
-          ## Setting this to not fail the workflow while deleting cache keys.
-          set +e
-          echo "Deleting caches..."
-          for cacheKey in $cacheKeysForPR
-          do
-              gh actions-cache delete $cacheKey -R $REPO -B $BRANCH --confirm
-          done
-          echo "Done"
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/cljs.yml

@@ -39,4 +39,4 @@ jobs:
     - name: Prepare back-end environment
       uses: ./.github/actions/prepare-backend
     - name: Run Cljs tests
-      run: yarn run test-cljs
+      run: bun run test-cljs

.github/workflows/codespell.yml

@@ -1,19 +1,118 @@
 name: Codespell
 
 on:
-  push:
-    branches:
-      - 'master'
-      - 'release-**'
-  pull_request:
+  schedule:
+    # Run nightly at 4:00 AM UTC
+    - cron: "0 4 * * *"
+  workflow_dispatch:
 
 jobs:
   codespell:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
-      - uses: actions/checkout@v3
-      - uses: codespell-project/actions-codespell@v1
+      - uses: actions/checkout@v4
+
+      - name: Install codespell
+        run: pip install codespell
+
+      - name: Set up git configuration
+        run: |
+          git config --global user.name "Claude Code[bot]"
+          git config --global user.email "noreply@anthropic.com"
+
+      - name: Get current date
+        id: date
+        run: echo "date=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT
+
+      - name: Run codespell check
+        id: codespell_check
+        continue-on-error: true
+        run: |
+          set -o pipefail
+          ./bin/mage codespell 2>&1 | tee codespell_output.txt
+
+      - name: Generate GitHub App Token for Claude
+        if: steps.codespell_check.outcome == 'failure'
+        uses: actions/create-github-app-token@v1
+        id: claude-app-token
         with:
-          # keep this list in sync with the list in `mage/src/mage/codespell.yml`
-          path: >-
-            docs
+          app-id: ${{ secrets.METABASE_BOT_APP_ID }}
+          private-key: ${{ secrets.METABASE_BOT_APP_PRIVATE_KEY }}
+
+      - name: Build Claude prompt
+        if: steps.codespell_check.outcome == 'failure'
+        run: |
+          cat > /tmp/claude_prompt.txt << 'PROMPT_HEADER'
+          You are tasked with fixing spelling errors detected by codespell in this repository.
+
+          ## Codespell Output
+          The following spelling errors were detected:
+          ```
+          PROMPT_HEADER
+          cat codespell_output.txt >> /tmp/claude_prompt.txt
+          cat >> /tmp/claude_prompt.txt << 'PROMPT_FOOTER'
+          ```
+
+          ## Instructions
+          1. **Review the codespell output and identify reported spelling errors** - The usual format codespell uses is `typo ==> correction`
+          2. **Fix every spelling error** - Use the Edit tool to fix each misspelling with the suggested correction
+             - If codespell suggests multiple corrections, choose the most appropriate one based on context
+
+          Human reviewers will verify the changes before merging, so fix all errors reported by codespell.
+          PROMPT_FOOTER
+
+      - name: Fix spelling errors with Claude Code
+        if: steps.codespell_check.outcome == 'failure'
+        uses: anthropics/claude-code-action@v1
+        with:
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          github_token: ${{ steps.claude-app-token.outputs.token }}
+          prompt_file: /tmp/claude_prompt.txt
+          claude_args: |
+            --allowedTools "Write,Read,Glob,Grep,Edit,MultiEdit,Bash(cat*),Bash(ls*)"
+            --disallowedTools "Bash(git commit*),Bash(git push*),Bash(gh*)"
+
+      - name: Clean up temporary files
+        if: steps.codespell_check.outcome == 'failure'
+        run: rm -f codespell_output.txt
+
+      - name: Create Pull Request
+        if: steps.codespell_check.outcome == 'failure'
+        uses: peter-evans/create-pull-request@v6
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          branch: claude-fix/codespell-${{ steps.date.outputs.date }}
+          base: master
+          delete-branch: true
+          commit-message: |
+            Fix spelling errors detected by codespell (${{ steps.date.outputs.date }})
+
+            🤖 Generated with [Claude Code](https://claude.ai/code)
+
+            Co-Authored-By: Claude <noreply@anthropic.com>
+          committer: "Claude Code[bot] <noreply@anthropic.com>"
+          author: "Claude Code[bot] <noreply@anthropic.com>"
+          title: "Fix spelling errors detected by codespell (${{ steps.date.outputs.date }})"
+          body: |
+            This PR automatically fixes spelling errors detected by the scheduled codespell check.
+
+            ## Automated Fix
+            🤖 This fix was generated automatically by Claude Code based on codespell output.
+
+            **Please review carefully:**
+            - [ ] The spelling fixes are correct
+            - [ ] No code functionality was changed
+            - [ ] Technical terms were preserved correctly
+
+            ---
+
+            🤖 Generated with [Claude Code](https://claude.ai/code)
+
+            Co-Authored-By: Claude <noreply@anthropic.com>
+          labels: |
+            automated-fix
+            backport

.github/workflows/containerize-jar.yml

@@ -4,8 +4,10 @@ run-name: Containerize ${{ inputs.tag }} Uberjar
 on:
   workflow_call:
     inputs:
-      artifact-name:
+      edition:
+        description: Metabase edition (ee or oss)
         type: string
+        required: true
       repo:
         description: owner and repo like "metabase/metabase"
         type: string
@@ -15,14 +17,18 @@ on:
         type: string
       release:
         type: string
-        default: 'true'
+        default: 'false'
       build-args:
         type: string
   workflow_dispatch:
     inputs:
-      artifact-name:
-        description: usually something like "metabase-release-{{ edition }}-{{ hash }}-uberjar"
-        type: string
+      edition:
+        description: Metabase edition (ee or oss)
+        type: choice
+        options:
+          - ee
+          - oss
+        required: true
       repo:
         description: docker owner and repo like "metabase/metabase"
         type: string
@@ -32,6 +38,13 @@ on:
       commit:
         description: the full commit hash
         type: string
+      release:
+        description: Whether this is a release artifact (uses metabase-release- prefix)
+        type: choice
+        options:
+          - "false"
+          - "true"
+        default: "false"
 
 jobs:
   containerize:
@@ -45,12 +58,14 @@ jobs:
         fetch-depth: 0
       # we want the dockerfile from the commit we're building
     - run: git checkout ${{ inputs.commit }} -- bin/docker
-    - name: Retrieve test build uberjar artifact
+    - name: Retrieve uberjar artifact
       uses: ./.github/actions/fetch-artifact
       with:
-        name: ${{ inputs.artifact-name }}
-    - name: Prepare build scripts
-      run: cd ${{ github.workspace }}/release && yarn && yarn build
+        commit: ${{ inputs.commit }}
+        edition: ${{ inputs.edition }}
+        release: ${{ inputs.release }}
+    - name: Prepare release scripts
+      uses: ./.github/actions/prepare-release-scripts
     - name: Get platforms
       id: platforms
       uses: actions/github-script@v7

.github/workflows/containerize-uberjar.yml

@@ -55,13 +55,13 @@ jobs:
     uses: ./.github/workflows/containerize-jar.yml
     secrets: inherit
     with:
-      artifact-name: metabase-${{ matrix.edition }}-${{ github.event.inputs.commit || github.event.pull_request.head.sha || github.sha }}-uberjar
-      commit: ${{ github.event.inputs.commit || github.sha }}
+      edition: ${{ matrix.edition }}
+      commit: ${{ github.event.inputs.commit || github.event.pull_request.head.sha || github.sha }}
       repo: ${{ fromJson(needs.get-container-info.outputs[matrix.edition]).repo }}
       tag: ${{ fromJson(needs.get-container-info.outputs[matrix.edition]).tag }}
       release: "false"
       build-args: |
-        GIT_COMMIT_SHA=${{ github.event.inputs.commit || github.sha }}
+        GIT_COMMIT_SHA=${{ github.event.inputs.commit || github.event.pull_request.head.sha || github.sha }}
 
   run-trivy:
     needs: [get-container-info, containerize]
@@ -74,7 +74,7 @@ jobs:
       - name: Check out the code
         uses: actions/checkout@v4
         with:
-          ref: ${{ github.event.inputs.commit || github.sha }}
+          ref: ${{ github.event.inputs.commit || github.event.pull_request.head.sha || github.sha }}
       - name: Run Trivy vulnerability scanner
         uses: aquasecurity/trivy-action@0.29.0
         env:

.github/workflows/coverage.yml

@@ -17,7 +17,7 @@ jobs:
         uses: ./.github/actions/prepare-backend
       - name: Run frontend unit tests
         run: |
-          yarn run test-unit \
+          bun run test-unit \
             --silent \
             --coverage \
             --testTimeout=60000

.github/workflows/cross-branch-migrations.yml

@@ -38,7 +38,7 @@ jobs:
           base-ref: ${{ env.BASE_REF }}
           head-ref: ${{ env.HEAD_REF }}
 
-  migrations-postgres-12-ee:
+  migrations-postgres-14-ee:
     runs-on: ubuntu-22.04
     timeout-minutes: 10
     env:
@@ -50,7 +50,7 @@ jobs:
       MB_DB_USER: circle_test
     services:
       postgres:
-        image: postgres:12-alpine
+        image: postgres:14-alpine
         ports:
           - "5432:5432"
         env:
@@ -90,7 +90,7 @@ jobs:
           base-ref: ${{ env.BASE_REF }}
           head-ref: ${{ env.HEAD_REF }}
 
-  migrations-mysql-8-0-ee:
+  migrations-mysql-8-4-ee:
     runs-on: ubuntu-22.04
     timeout-minutes: 10
     env:
@@ -102,7 +102,7 @@ jobs:
       MB_DB_USER: root
     services:
       mysql:
-        image: cimg/mysql:8.0
+        image: cimg/mysql:8.4
         ports:
           - "3306:3306"
     steps:
@@ -138,7 +138,7 @@ jobs:
           base-ref: ${{ env.BASE_REF }}
           head-ref: ${{ env.HEAD_REF }}
 
-  migrations-mariadb-10-2-ee:
+  migrations-mariadb-10-6-ee:
     runs-on: ubuntu-22.04
     timeout-minutes: 10
     env:
@@ -150,7 +150,7 @@ jobs:
       MB_DB_USER: root
     services:
       mariadb:
-        image: circleci/mariadb:10.2.23
+        image: circleci/mariadb:10.6
         ports:
           - "3306:3306"
     steps:

.github/workflows/cross-version.yml

@@ -0,0 +1,102 @@
+name: Cross-Version Migration Tests
+
+on:
+  workflow_dispatch:
+    inputs:
+      source_version:
+        description: "Source version (e.g., v1.58.6 or HEAD)"
+        required: true
+        type: string
+      target_version:
+        description: "Target version (e.g., v1.58.7 or HEAD)"
+        required: true
+        type: string
+
+  pull_request:
+    paths:
+      - "cross-version/**"
+      - ".github/workflows/cross-version.yml"
+      - ".github/scripts/build-cross-version-matrix.js"
+
+  schedule:
+    # Run nightly at 3 AM UTC
+    - cron: "0 3 * * *"
+
+jobs:
+  # Generate matrix for scheduled/PR runs
+  generate-matrix:
+    if: github.event_name != 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.set-matrix.outputs.matrix }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: .github
+
+      - name: Generate version matrix
+        id: set-matrix
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const { buildCrossVersionMatrix } = require('${{ github.workspace }}/.github/scripts/build-cross-version-matrix');
+            const { config } = buildCrossVersionMatrix(${{ vars.CURRENT_VERSION }});
+            const matrix = JSON.stringify({ include: config });
+            core.setOutput("matrix", matrix);
+            console.log("matrix:", matrix);
+
+  # Matrix-based tests for scheduled/PR runs
+  test-matrix:
+    if: github.event_name != 'workflow_dispatch'
+    needs: generate-matrix
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    strategy:
+      matrix: ${{ fromJson(needs.generate-matrix.outputs.matrix) }}
+      fail-fast: false
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Prepare release scripts
+        uses: ./.github/actions/prepare-release-scripts
+
+      - name: Run cross-version test
+        env:
+          CURRENT_VERSION: ${{ vars.CURRENT_VERSION }}
+        run: |
+          cd cross-version
+          ./test.sh --source "${{ matrix.source }}" --target "${{ matrix.target }}"
+
+      - name: Show logs on failure
+        if: failure()
+        run: |
+          cd cross-version
+          docker compose logs metabase || true
+          docker compose logs postgres || true
+
+  # Manual test for workflow_dispatch
+  test-manual:
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Prepare release scripts
+        uses: ./.github/actions/prepare-release-scripts
+
+      - name: Run cross-version test
+        env:
+          CURRENT_VERSION: ${{ vars.CURRENT_VERSION }}
+        run: |
+          cd cross-version
+          ./test.sh --source "${{ inputs.source_version }}" --target "${{ inputs.target_version }}"
+
+      - name: Show logs on failure
+        if: failure()
+        run: |
+          cd cross-version
+          docker compose logs metabase || true
+          docker compose logs postgres || true

.github/workflows/disabled-drivers-slack-notification.yml

@@ -0,0 +1,79 @@
+name: Disabled Drivers Slack Notification
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "0 9 * * 1" # every Monday at 9:00 UTC
+
+jobs:
+  notify-disabled-drivers:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/setup-node@v4
+        with:
+          node-version: lts/Jod
+
+      - name: Install Slack SDK
+        run: npm install @slack/web-api
+
+      - name: Check disabled drivers and notify Slack
+        uses: actions/github-script@v7
+        env:
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+        with:
+          script: |
+            const { WebClient } = require('@slack/web-api');
+
+            // Fetch the config
+            const response = await fetch('https://raw.githubusercontent.com/metabase/ci-test-config/refs/heads/master/ci-test-config.json');
+            const config = await response.json();
+
+            const drivers = config.ignored?.drivers || [];
+            const lastUpdated = config.metadata?.last_updated || 'unknown';
+            const reason = config.metadata?.reason || 'No reason provided';
+
+            if (drivers.length === 0) {
+              console.log('No drivers are currently disabled. Skipping Slack notification.');
+              return;
+            }
+
+            if (!process.env.SLACK_BOT_TOKEN) {
+              throw new Error('SLACK_BOT_TOKEN is required');
+            }
+
+            const slack = new WebClient(process.env.SLACK_BOT_TOKEN);
+
+            await slack.chat.postMessage({
+              channel: 'engineering-ci',
+              text: 'CI Disabled Drivers Report',
+              blocks: [
+                {
+                  type: 'section',
+                  text: {
+                    type: 'mrkdwn',
+                    text: `:no_entry: *CI Disabled Drivers*\n${drivers.map(d => `\`${d}\``).join('  ')}`
+                  },
+                  accessory: {
+                    type: 'button',
+                    text: {
+                      type: 'plain_text',
+                      text: 'View Config',
+                      emoji: true
+                    },
+                    url: 'https://github.com/metabase/ci-test-config/blob/master/ci-test-config.json'
+                  }
+                },
+                {
+                  type: 'context',
+                  elements: [
+                    {
+                      type: 'mrkdwn',
+                      text: `${reason} · :clock1: *${lastUpdated}*`
+                    }
+                  ]
+                }
+              ]
+            });
+
+            console.log('Slack notification sent successfully');

.github/workflows/docs-release-generate.yml

@@ -8,7 +8,7 @@ on:
       target_branch:
         description: "Target branch for documentation update"
         required: false
-        default: "release-x.57.x"
+        default: "release-x.59.x"
         type: string
 
 jobs:
@@ -16,6 +16,6 @@ jobs:
     name: Call documentation update for release branch
     uses: ./.github/workflows/docs-generate-base.yml
     with:
-      target_branch: ${{ inputs.target_branch || 'release-x.57.x' }}
+      target_branch: ${{ inputs.target_branch || 'release-x.59.x' }}
     secrets:
       automation_token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}

.github/workflows/drivers-stress-test.yml

@@ -109,7 +109,7 @@ jobs:
         junit-name: 'be-tests-druid-ee'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
-  be-tests-mariadb-10-2-ee:
+  be-tests-mariadb-10-6-ee:
     if: inputs.driver == 'Maria DB'
     runs-on: ubuntu-22.04
     timeout-minutes: 90
@@ -124,15 +124,15 @@ jobs:
       MB_MYSQL_TEST_USER: root
     services:
       mariadb:
-        image: circleci/mariadb:10.2.23
+        image: circleci/mariadb:10.6
         ports:
           - "3306:3306"
     steps:
     - uses: actions/checkout@v4
-    - name: Test MariaDB driver (10.2)
+    - name: Test MariaDB driver (10.6)
       uses: ./.github/actions/test-driver
       with:
-        junit-name: 'be-tests-mariadb-10-2-ee'
+        junit-name: 'be-tests-mariadb-10-6-ee'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-mariadb-latest-ee:
@@ -298,7 +298,7 @@ jobs:
         junit-name: 'be-tests-mongo-latest-ee'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
-  be-tests-mysql-8-0-ee:
+  be-tests-mysql-8-4-ee:
     if: inputs.driver == 'MySQL'
     runs-on: ubuntu-22.04
     timeout-minutes: 90
@@ -313,15 +313,15 @@ jobs:
       MB_MYSQL_TEST_USER: root
     services:
       mysql:
-        image: cimg/mysql:8.0
+        image: cimg/mysql:8.4
         ports:
           - "3306:3306"
     steps:
     - uses: actions/checkout@v4
-    - name: Test MySQL driver (8.0)
+    - name: Test MySQL driver (8.4)
       uses: ./.github/actions/test-driver
       with:
-        junit-name: 'be-tests-mysql-8-0-ee'
+        junit-name: 'be-tests-mysql-8-4-ee'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-mysql-latest-ee:
@@ -438,7 +438,7 @@ jobs:
       MB_POSTGRESQL_TEST_USER: mb_test
     services:
       postgres:
-        image: postgres:12-alpine
+        image: postgres:14-alpine
         ports:
           - "5432:5432"
         env:
@@ -447,7 +447,7 @@ jobs:
           POSTGRES_HOST_AUTH_METHOD: trust
     steps:
     - uses: actions/checkout@v4
-    - name: Test Postgres driver (12)
+    - name: Test Postgres driver (14)
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-postgres-ee'

.github/workflows/e2e-stress-test-flake-fix.yml

@@ -76,19 +76,15 @@ jobs:
     timeout-minutes: 60
     name: Stress test E2E flake fix
     env:
-      DISPLAY: ""
-      MB_RUN_MODE: e2e
-      METASTORE_DEV_SERVER_URL: ${{ secrets.METASTORE_DEV_SERVER_URL }}
+      DISPLAY: "" # https://github.com/cypress-io/cypress/issues/4034
+      TERM: xterm
+      TZ: US/Pacific # to make Node match the instance tz
       CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
       CYPRESS_MB_STARTER_CLOUD_TOKEN: ${{ secrets.STAGING_MB_STARTER_CLOUD_TOKEN }}
       CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.STAGING_MB_PRO_CLOUD_TOKEN }}
       CYPRESS_MB_PRO_SELF_HOSTED_TOKEN: ${{ secrets.STAGING_MB_PRO_SELF_HOSTED_TOKEN }}
-      MB_SNOWPLOW_AVAILABLE: true
-      MB_SNOWPLOW_URL: "http://localhost:9090" # Snowplow micro
       MB_EDITION: ${{ inputs.mb_edition }}
       CYPRESS_ENABLE_NETWORK_THROTTLING: ${{ inputs.enable_network_throttling }}
-      TERM: xterm
-      TZ: US/Pacific # to make node match the instance tz
     steps:
       - uses: actions/checkout@v4
         with:
@@ -114,17 +110,20 @@ jobs:
 
       - name: Prepare front-end environment
         uses: ./.github/actions/prepare-frontend
-
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
 
       - name: Build Embedding SDK package
         if: ${{ needs.determine-test-type.outputs.type == 'component' }}
-        run: yarn build-embedding-sdk-package
+        run: bun run build-embedding-sdk-package
 
       - name: Prepare Cypress environment
         id: cypress-prep
         uses: ./.github/actions/prepare-cypress
+
+      - name: Compile CLJS
+        run: bun run build-pure:cljs
+
       - name: Run Metabase
         run: node e2e/runner/run_cypress_ci.js start
 

.github/workflows/e2e-test.yml

@@ -29,28 +29,29 @@ on:
         required: false
         type: number
 
+env:
+  DISPLAY: "" # https://github.com/cypress-io/cypress/issues/4034
+  TERM: xterm
+  TZ: US/Pacific # to make Node match the instance tz
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  HASH: ${{ github.event.pull_request.head.sha || github.sha }}-${{ github.run_attempt }}
+  PR_NUMBER: ${{ github.event.pull_request.number || '' }}
+  JOB_NAME: ${{ inputs.name }}
+
 jobs:
   e2e-tests:
     runs-on: ${{ inputs.runner }}
-    timeout-minutes: 45
+    timeout-minutes: 40
     name: e2e-tests-${{ inputs.name }}-${{ inputs.edition }}
     env:
       MB_EDITION: ${{ inputs.edition }}
-      DISPLAY: ""
-      PR_NUMBER: ${{ github.event.pull_request.number || '' }}
-      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      HASH: ${{ github.event.pull_request.head.sha || github.sha }}-${{ github.run_attempt }}
-      JOB_NAME: ${{ inputs.name }}
-      # Any env starting with `CYPRESS_` will be available to all Cypress tests via `Cypress.env()`
-      # Example: you can get `CYPRESS_FOO` with `Cypress.env("FOO")`
+      # Sensitive env vars (tokens, secrets) starting with `CYPRESS_` are accessed via async `cy.env()`
+      # Example: `cy.env(["FOO"]).then(({ FOO }) => ...)`
+      # For non-sensitive config, use `Cypress.expose()` in cypress config instead (synchronous)
       CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
       CYPRESS_MB_STARTER_CLOUD_TOKEN: ${{ secrets.STAGING_MB_STARTER_CLOUD_TOKEN }}
       CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.STAGING_MB_PRO_CLOUD_TOKEN }}
       CYPRESS_MB_PRO_SELF_HOSTED_TOKEN: ${{ secrets.STAGING_MB_PRO_SELF_HOSTED_TOKEN }}
-      CYPRESS_PULL_REQUEST_ID: ${{ github.event.pull_request.number || '' }}
-      COMMIT_INFO_MESSAGE: ${{ github.event.pull_request.title || github.event.head_commit.message || github.event.head.sha }}
-      TZ: US/Pacific # to make node match the instance tz
-      CYPRESS_CI: true
     steps:
       - uses: actions/checkout@v4
         with:
@@ -79,7 +80,8 @@ jobs:
       - name: Retrieve uberjar artifact for ${{ inputs.edition }}
         uses: ./.github/actions/fetch-artifact
         with:
-          name: metabase-${{ inputs.edition }}-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+          commit: ${{ github.event.pull_request.head.sha || github.sha }}
+          edition: ${{ inputs.edition }}
           extract-path: "target/uberjar"
           output-name: "metabase.jar"
 
@@ -104,6 +106,9 @@ jobs:
         if: github.run_attempt != '1'
         run: echo "specs=$(cat failed-specs)" >> $GITHUB_ENV
 
+      - name: Compile CLJS
+        run: bun run build-pure:cljs
+
       - name: Run Metabase
         run: node e2e/runner/run_cypress_ci.js start
 
@@ -113,6 +118,7 @@ jobs:
         run: node e2e/runner/run_cypress_ci.js snapshot
 
       - name: Run auto-split Cypress tests on ${{ inputs.name }}
+        id: split-e2e
         if: ${{ !inputs.specs }}
         env:
           SPLIT: ${{ inputs.total_chunks }}
@@ -136,6 +142,7 @@ jobs:
         continue-on-error: true
 
       - name: Run Tagged EE Cypress tests on ${{ inputs.name }}
+        id: tagged-e2e
         if: ${{ inputs.specs }}
         shell: bash
         env:
@@ -165,10 +172,12 @@ jobs:
           # Related to Trunk uploader
           variant: e2e-tests
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ inputs.specs && steps.tagged-e2e.outcome || steps.split-e2e.outcome }}
 
       - name: Upload Cypress Artifacts upon failure
         uses: actions/upload-artifact@v4
-        if: failure()
+        if: |
+          !cancelled() && (steps.split-e2e.outcome == 'failure' || steps.tagged-e2e.outcome == 'failure')
         with:
           name: cypress-recording-${{ inputs.name }}-${{ inputs.edition }}
           path: |
@@ -178,10 +187,12 @@ jobs:
 
       - name: Upload Failed Tests
         uses: actions/upload-artifact@v4
-        if: failure()
+        if: |
+          !cancelled() && (steps.split-e2e.outcome == 'failure' || steps.tagged-e2e.outcome == 'failure')
         with:
           name: failed-tests-${{ inputs.name }}-${{ inputs.edition }}
           path: ./cypress/test-results
+          if-no-files-found: ignore
 
       - name: Extract chunk-specific changed timings
         id: extract-timings

.github/workflows/embedding-sdk-component-tests.yml

@@ -3,6 +3,12 @@ name: Embedding SDK Component Tests
 on:
   workflow_call:
 
+env:
+  DISPLAY: "" # https://github.com/cypress-io/cypress/issues/4034
+  TERM: xterm
+  TZ: US/Pacific # to make Node match the instance tz
+  MB_EDITION: "ee"
+
 jobs:
   sdk-component-tests:
     name: "SDK component tests (React ${{ matrix.react-version }})"
@@ -13,17 +19,13 @@ jobs:
         react-version: [18, 19]
       fail-fast: false
     env:
-      MB_EDITION: ee
-      DISPLAY: ""
-      # Any env starting with `CYPRESS_` will be available to all Cypress tests via `Cypress.env()`
-      # Example: you can get `CYPRESS_FOO` with `Cypress.env("FOO")`
+      # Sensitive env vars (tokens, secrets) starting with `CYPRESS_` are accessed via async `cy.env()`
+      # Example: `cy.env(["FOO"]).then(({ FOO }) => ...)`
+      # For non-sensitive config, use `Cypress.expose()` in cypress config instead (synchronous)
       CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
       CYPRESS_MB_STARTER_CLOUD_TOKEN: ${{ secrets.STAGING_MB_STARTER_CLOUD_TOKEN }}
       CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.STAGING_MB_PRO_CLOUD_TOKEN }}
       CYPRESS_MB_PRO_SELF_HOSTED_TOKEN: ${{ secrets.STAGING_MB_PRO_SELF_HOSTED_TOKEN }}
-      COMMIT_INFO_MESSAGE: ${{ github.event.pull_request.title || github.event.head_commit.message || github.event.head.sha }}
-      TZ: US/Pacific # to make node match the instance tz
-      CYPRESS_CI: true
 
     steps:
       - uses: actions/checkout@v4
@@ -44,7 +46,8 @@ jobs:
       - name: Retrieve uberjar artifact for ee
         uses: ./.github/actions/fetch-artifact
         with:
-          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+          commit: ${{ github.event.pull_request.head.sha || github.sha }}
+          edition: ee
           extract-path: "target/uberjar"
           output-name: "metabase.jar"
 
@@ -79,6 +82,7 @@ jobs:
         run: ./bin/embedding-sdk/change-react-version.bash ${{ matrix.react-version }}
 
       - name: Run component tests for Embedding SDK
+        id: run-tests
         env:
           CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
         run: node e2e/runner/run_cypress_ci.js component
@@ -94,6 +98,7 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.run-tests.outcome }}
 
       - name: "SDK component tests > Upload Cypress Artifacts upon failure"
         uses: actions/upload-artifact@v4
@@ -149,19 +154,15 @@ jobs:
     runs-on: ubuntu-22.04
     timeout-minutes: 45
     env:
-      MB_EDITION: ee
-      DISPLAY: ""
       MB_RUN_MODE: "e2e"
       METASTORE_DEV_SERVER_URL: ${{ secrets.METASTORE_DEV_SERVER_URL }}
-      # Any env starting with `CYPRESS_` will be available to all Cypress tests via `Cypress.env()`
-      # Example: you can get `CYPRESS_FOO` with `Cypress.env("FOO")`
+      # Sensitive env vars (tokens, secrets) starting with `CYPRESS_` are accessed via async `cy.env()`
+      # Example: `cy.env(["FOO"]).then(({ FOO }) => ...)`
+      # For non-sensitive config, use `Cypress.expose()` in cypress config instead (synchronous)
       CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
       CYPRESS_MB_STARTER_CLOUD_TOKEN: ${{ secrets.STAGING_MB_STARTER_CLOUD_TOKEN }}
       CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.STAGING_MB_PRO_CLOUD_TOKEN }}
       CYPRESS_MB_PRO_SELF_HOSTED_TOKEN: ${{ secrets.STAGING_MB_PRO_SELF_HOSTED_TOKEN }}
-      COMMIT_INFO_MESSAGE: ${{ github.event.pull_request.title || github.event.head_commit.message || github.event.head.sha }}
-      TZ: US/Pacific # to make node match the instance tz
-      CYPRESS_CI: true
 
     steps:
       - name: Check out the code from the previous commit
@@ -198,7 +199,8 @@ jobs:
         id: download-uberjar
         uses: ./.github/actions/fetch-artifact
         with:
-          name: metabase-ee-${{ steps.get-commit-sha.outputs.sha }}-uberjar
+          commit: ${{ steps.get-commit-sha.outputs.sha }}
+          edition: ee
           extract-path: "target/uberjar"
           output-name: "metabase.jar"
         continue-on-error: true # do not break the whole job if this step doesn't succeed
@@ -232,6 +234,7 @@ jobs:
             --spec "e2e/snapshot-creators/default.cy.snap.js"
 
       - name: Run component tests for Embedding SDK
+        id: run-tests
         env:
           CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
         run: |
@@ -249,6 +252,7 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.run-tests.outcome }}
 
       - name: Upload Cypress Artifacts upon failure
         uses: actions/upload-artifact@v4

.github/workflows/embedding-sdk-host-sample-apps-tests.yml

@@ -3,6 +3,13 @@ name: "[NOT REQUIRED] SDK Compatibility tests"
 on:
   workflow_call:
 
+env:
+  DISPLAY: "" # https://github.com/cypress-io/cypress/issues/4034
+  TERM: xterm
+  TZ: US/Pacific # to make Node match the instance tz
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  HASH: ${{ github.event.pull_request.head.sha || github.sha }}-${{ github.run_attempt }}
+  MB_EDITION: ee
 jobs:
   get-sample-apps-data:
     runs-on: ubuntu-22.04
@@ -13,12 +20,7 @@ jobs:
       TEST_SUITES: |
         [
           "metabase-nodejs-react-sdk-embedding-sample-e2e",
-          "metabase-nextjs-sdk-embedding-sample-e2e",
-          "shoppy-e2e"
-        ]
-      TEST_SUITES_TO_RUN_IN_MASTER_ONLY: |
-        [
-          "shoppy-e2e"
+          "metabase-nextjs-sdk-embedding-sample-e2e"
         ]
       SAMPLE_APP_MAIN_BRANCH_NAME: "main"
       SAMPLE_APP_STABLE_RELEASE_BRANCH_NAME_SUFFIX: "stable"
@@ -28,8 +30,8 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Prepare build scripts
-        run: cd ${{ github.workspace }}/release && yarn && yarn build
+      - name: Prepare release scripts
+        uses: ./.github/actions/prepare-release-scripts
 
       - name: Build sample app compatibility data
         uses: actions/github-script@v7
@@ -42,7 +44,6 @@ jobs:
             } = require('${{ github.workspace }}/release/dist/index.cjs');
 
             const testSuites = JSON.parse(process.env.TEST_SUITES);
-            const testSuitesToRunInMasterOnly = JSON.parse(process.env.TEST_SUITES_TO_RUN_IN_MASTER_ONLY);
 
             const ref = '${{ github.base_ref || github.ref }}';
             const branchName = ref.replace(/^refs\/heads\//, '');
@@ -66,19 +67,16 @@ jobs:
               const sampleAppBranchName = `${currentBranchVersion}-${{ env.SAMPLE_APP_STABLE_RELEASE_BRANCH_NAME_SUFFIX }}`
 
               const shouldRunTestsForVersion = (currentReleaseVersion - currentBranchVersion) <= (supportedReleasesCount - 1);
-              const releaseBranchTestSuites = testSuites.filter(testSuite => !testSuitesToRunInMasterOnly.includes(testSuite));
 
               return {
                 branch_name: sampleAppBranchName,
-                matrix: shouldRunTestsForVersion
-                  ? releaseBranchTestSuites
-                  : []
+                matrix: shouldRunTestsForVersion ? testSuites : [],
               };
             }
 
             return {
               branch_name: '',
-              matrix: []
+              matrix: [],
             };
 
   # In order to check compatibility between Sample Apps and Embedding SDK, the job for each sample app:
@@ -90,6 +88,7 @@ jobs:
   e2e-sample-apps-tests:
     needs: [get-sample-apps-data]
     strategy:
+      fail-fast: false
       matrix:
         test_suite: ${{ fromJSON(needs.get-sample-apps-data.outputs.matrix) }}
         environment: ["production", "development"]
@@ -100,15 +99,9 @@ jobs:
     name: e2e-sample-app-${{ matrix.test_suite }}-tests-${{ matrix.environment }}-bundle
     env:
       MB_EDITION: ee
-      DISPLAY: ""
-      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      PR_NUMBER: ${{ github.event.pull_request.number || '' }}
-      HASH: ${{ github.event.pull_request.head.sha || github.sha }}-${{ github.run_attempt }}
       MB_RUN_MODE: e2e
       METASTORE_DEV_SERVER_URL: ${{ secrets.METASTORE_DEV_SERVER_URL }}
       CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
-      TZ: US/Pacific # to make node match the instance tz
-      CYPRESS_CI: true
       SAMPLE_APP_BRANCH_NAME: ${{ needs.get-sample-apps-data.outputs.branch_name }}
       SAMPLE_APP_ENVIRONMENT: ${{ matrix.environment }}
     permissions:
@@ -117,6 +110,8 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      - uses: ./.github/actions/maximize-disk-space
+
       # We have to use the latest version that does not have this issue https://github.com/docker/compose/pull/12752
       - name: Set up Docker Compose
         uses: docker/setup-compose-action@v1
@@ -133,7 +128,8 @@ jobs:
       - name: Retrieve uberjar artifact for ee
         uses: ./.github/actions/fetch-artifact
         with:
-          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+          commit: ${{ github.event.pull_request.head.sha || github.sha }}
+          edition: ee
           extract-path: "target/uberjar"
           output-name: "metabase.jar"
 
@@ -163,28 +159,8 @@ jobs:
             echo "sample_app_branch_exists=false" >> $GITHUB_OUTPUT
           fi
 
-      - name: Configure AWS credentials
-        if: ${{ matrix.test_suite == 'shoppy-e2e' }}
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          role-to-assume: ${{ secrets.SHOPPY_IAM_ROLE }}
-          role-session-name: GitHub_to_AWS_via_FederatedOIDC
-          aws-region: us-east-1
-
-      - name: Download Shoppy's App DB PostgreSQL dump from S3
-        if: ${{ matrix.test_suite == 'shoppy-e2e' }}
-        run: |
-          aws s3 cp s3://${{ secrets.SHOPPY_METABASE_APP_DB_S3_BUCKET }}/${{ secrets.SHOPPY_METABASE_APP_DB_S3_KEY }} ./e2e/tmp/db_dumps/shoppy_metabase_app_db_dump.sql
-
-      - name: Prepare and launch Sample Apps for shoppy-e2e test suite
-        if: ${{ steps.check-sample-app-branch.outputs.sample_app_branch_exists == 'true' && matrix.test_suite == 'shoppy-e2e' }}
-        env:
-          METABASE_APP_DB_USER: ${{ secrets.SHOPPY_METABASE_APP_DB_USER }}
-          METABASE_APP_DB: ${{ secrets.SHOPPY_METABASE_APP_DB_DATABASE }}
-        run: npx tsx ./e2e/runner/embedding-sdk/sample-apps/start-ci.ts shoppy-e2e
-
-      - name: Prepare and launch Sample Apps for other test suites
-        if: ${{ steps.check-sample-app-branch.outputs.sample_app_branch_exists == 'true' && matrix.test_suite != 'shoppy-e2e' }}
+      - name: Prepare and launch Sample Apps
+        if: ${{ steps.check-sample-app-branch.outputs.sample_app_branch_exists == 'true' }}
         run: npx tsx ./e2e/runner/embedding-sdk/sample-apps/start-ci.ts ${{ matrix.test_suite }}
 
       - name: Prune build cache
@@ -205,7 +181,7 @@ jobs:
         uses: actions/upload-artifact@v4
         if: ${{ steps.check-sample-app-branch.outputs.sample_app_branch_exists == 'true' && steps.run-e2e-tests.outcome != 'success' }}
         with:
-          name: cypress-recording-sample-app-${{ matrix.test_suite }}-latest
+          name: cypress-recording-sample-app-${{ matrix.test_suite }}-${{ matrix.environment }}-latest
           path: |
             ./e2e/tmp/${{ steps.get-sample-app-name.outputs.sample_app_name }}/cypress
           if-no-files-found: ignore
@@ -215,6 +191,150 @@ jobs:
         run: |
           exit 1
 
+  # Shoppy e2e tests run separately using the shared composite action for setup.
+  e2e-shoppy-tests:
+    needs: [get-sample-apps-data]
+    strategy:
+      fail-fast: false
+      matrix:
+        environment: ["production", "development"]
+    if: |
+      !cancelled() && needs.get-sample-apps-data.result == 'success' &&
+      (github.ref == 'refs/heads/master' || github.base_ref == 'master')
+    runs-on: ubuntu-22.04
+    timeout-minutes: 45
+    name: e2e-sample-app-shoppy-e2e-tests-${{ matrix.environment }}-bundle
+    env:
+      MB_EDITION: ee
+      MB_RUN_MODE: e2e
+      METASTORE_DEV_SERVER_URL: ${{ secrets.METASTORE_DEV_SERVER_URL }}
+      CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
+      SAMPLE_APP_BRANCH_NAME: ${{ needs.get-sample-apps-data.outputs.branch_name }}
+      SAMPLE_APP_ENVIRONMENT: ${{ matrix.environment }}
+    permissions:
+      id-token: write
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Prepare Shoppy E2E environment
+        uses: ./.github/actions/prepare-shoppy-e2e
+        id: shoppy-prep
+        with:
+          commit: ${{ github.event.pull_request.head.sha || github.sha }}
+          sample-app-branch-name: ${{ needs.get-sample-apps-data.outputs.branch_name }}
+          sample-app-environment: ${{ matrix.environment }}
+          staging-mb-all-features-token: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
+          shoppy-iam-role: ${{ secrets.SHOPPY_IAM_ROLE }}
+          shoppy-metabase-app-db-s3-bucket: ${{ secrets.SHOPPY_METABASE_APP_DB_S3_BUCKET }}
+          shoppy-metabase-app-db-s3-key: ${{ secrets.SHOPPY_METABASE_APP_DB_S3_KEY }}
+          shoppy-metabase-app-db-user: ${{ secrets.SHOPPY_METABASE_APP_DB_USER }}
+          shoppy-metabase-app-db-database: ${{ secrets.SHOPPY_METABASE_APP_DB_DATABASE }}
+          metastore-dev-server-url: ${{ secrets.METASTORE_DEV_SERVER_URL }}
+          shoppy-datadog-application-id: ${{ secrets.SHOPPY_METABASE_APP_DATADOG_APPLICATION_ID }}
+          shoppy-datadog-client-token: ${{ secrets.SHOPPY_METABASE_APP_DATADOG_CLIENT_TOKEN }}
+
+      - name: Run e2e tests for Shoppy
+        id: run-e2e-tests
+        if: ${{ steps.shoppy-prep.outputs.sample_app_branch_exists == 'true' }}
+        continue-on-error: true
+        env:
+          CYPRESS_BROWSER: ${{ steps.shoppy-prep.outputs.chrome-path }}
+        run: node e2e/runner/run_cypress_ci.js shoppy-e2e
+
+      - name: Upload Cypress Artifacts upon failure
+        uses: actions/upload-artifact@v4
+        if: ${{ steps.shoppy-prep.outputs.sample_app_branch_exists == 'true' && steps.run-e2e-tests.outcome != 'success' }}
+        with:
+          name: cypress-recording-sample-app-shoppy-e2e-${{ matrix.environment }}-latest
+          path: |
+            ./e2e/tmp/shoppy/cypress
+          if-no-files-found: ignore
+
+      - name: Fail job if tests failed
+        if: ${{ steps.shoppy-prep.outputs.sample_app_branch_exists == 'true' && steps.run-e2e-tests.outcome != 'success' }}
+        run: |
+          exit 1
+
+  # Synthetic monitoring tests run only on master merges, in parallel with the regular e2e tests.
+  # They use the shoppy production environment and include performance measurement tests.
+  e2e-shoppy-synthetic-tests:
+    needs: [get-sample-apps-data]
+    if: |
+      !cancelled() && needs.get-sample-apps-data.result == 'success' &&
+      github.event_name == 'push' &&
+      github.ref == 'refs/heads/master'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 45
+    name: e2e-shoppy-synthetic-monitoring-tests
+    env:
+      MB_EDITION: ee
+      MB_RUN_MODE: e2e
+      METASTORE_DEV_SERVER_URL: ${{ secrets.METASTORE_DEV_SERVER_URL }}
+      CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
+      SAMPLE_APP_BRANCH_NAME: ${{ needs.get-sample-apps-data.outputs.branch_name }}
+      SAMPLE_APP_ENVIRONMENT: production
+    permissions:
+      id-token: write
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Prepare Shoppy E2E environment
+        uses: ./.github/actions/prepare-shoppy-e2e
+        id: shoppy-prep
+        with:
+          commit: ${{ github.event.pull_request.head.sha || github.sha }}
+          sample-app-branch-name: ${{ needs.get-sample-apps-data.outputs.branch_name }}
+          sample-app-environment: production
+          staging-mb-all-features-token: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
+          shoppy-iam-role: ${{ secrets.SHOPPY_IAM_ROLE }}
+          shoppy-metabase-app-db-s3-bucket: ${{ secrets.SHOPPY_METABASE_APP_DB_S3_BUCKET }}
+          shoppy-metabase-app-db-s3-key: ${{ secrets.SHOPPY_METABASE_APP_DB_S3_KEY }}
+          shoppy-metabase-app-db-user: ${{ secrets.SHOPPY_METABASE_APP_DB_USER }}
+          shoppy-metabase-app-db-database: ${{ secrets.SHOPPY_METABASE_APP_DB_DATABASE }}
+          metastore-dev-server-url: ${{ secrets.METASTORE_DEV_SERVER_URL }}
+          shoppy-datadog-application-id: ${{ secrets.SHOPPY_METABASE_APP_DATADOG_APPLICATION_ID }}
+          shoppy-datadog-client-token: ${{ secrets.SHOPPY_METABASE_APP_DATADOG_CLIENT_TOKEN }}
+
+      - name: Get merged PR number
+        if: ${{ steps.shoppy-prep.outputs.sample_app_branch_exists == 'true' }}
+        id: get-merged-pr-number
+        run: |
+          PR=$(gh api repos/${{ github.repository }}/commits/${{ github.sha }}/pulls --jq '.[0].number' 2>/dev/null || echo "")
+          if [ -z "$PR" ] || [ "$PR" = "null" ]; then
+            echo "number=" >> "$GITHUB_OUTPUT"
+          else
+            echo "number=$PR" >> "$GITHUB_OUTPUT"
+          fi
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Run synthetic monitoring tests
+        id: run-e2e-tests
+        if: ${{ steps.shoppy-prep.outputs.sample_app_branch_exists == 'true' }}
+        continue-on-error: true
+        env:
+          CYPRESS_BROWSER: ${{ steps.shoppy-prep.outputs.chrome-path }}
+          PR_NUMBER: ${{ steps.get-merged-pr-number.outputs.number }}
+          INCLUDE_SYNTHETIC_MONITORING_TESTS: "true"
+        run: node e2e/runner/run_cypress_ci.js shoppy-e2e
+
+      - name: Upload Cypress Artifacts upon failure
+        uses: actions/upload-artifact@v4
+        if: ${{ steps.shoppy-prep.outputs.sample_app_branch_exists == 'true' && steps.run-e2e-tests.outcome != 'success' }}
+        with:
+          name: cypress-recording-shoppy-synthetic-tests-latest
+          path: |
+            ./e2e/tmp/shoppy/cypress
+          if-no-files-found: ignore
+
+      - name: Fail job if tests failed
+        if: ${{ steps.shoppy-prep.outputs.sample_app_branch_exists == 'true' && steps.run-e2e-tests.outcome != 'success' }}
+        run: |
+          exit 1
+
   # The job checks integration of the Embedding SDK with consumer's apps that use different frameworks/bundlers,
   # or when we want to test some tricky integration cases like conflicting types.
   # The job
@@ -224,6 +344,7 @@ jobs:
   # For more details see `Embedding SDK integration tests with Host Apps` in `enterprise/frontend/src/embedding-sdk-package/dev.md`
   e2e-host-apps-tests:
     strategy:
+      fail-fast: false
       matrix:
         test_suite:
           [
@@ -237,14 +358,7 @@ jobs:
     timeout-minutes: 45
     name: e2e-host-app-${{ matrix.test_suite }}-tests-${{ matrix.environment }}-bundle
     env:
-      MB_EDITION: ee
-      DISPLAY: ""
-      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      PR_NUMBER: ${{ github.event.pull_request.number || '' }}
-      HASH: ${{ github.event.pull_request.head.sha || github.sha }}-${{ github.run_attempt }}
       CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
-      TZ: US/Pacific # to make node match the instance tz
-      CYPRESS_CI: true
       HOST_APP_ENVIRONMENT: ${{ matrix.environment }}
     permissions:
       id-token: write
@@ -255,7 +369,8 @@ jobs:
       - name: Retrieve uberjar artifact for ee
         uses: ./.github/actions/fetch-artifact
         with:
-          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+          commit: ${{ github.event.pull_request.head.sha || github.sha }}
+          edition: ee
           extract-path: "target/uberjar"
           output-name: "metabase.jar"
 

.github/workflows/embedding-sdk-package-build.yml

@@ -23,7 +23,7 @@ jobs:
           # Remove the matchers to not report false positives on every PR
           # unrelated to embedding (EMB-765)
           echo "::remove-matcher owner=tsc::"
-          yarn build-embedding-sdk-package
+          bun run build-embedding-sdk-package
       - name: Prepare Embedding SDK artifact
         uses: actions/upload-artifact@v4
         with:

.github/workflows/embedding-sdk.yml

@@ -23,6 +23,10 @@ on:
         description: "Whether to run host and sample apps compatibility tests."
         required: true
         type: boolean
+      bundle-size-check:
+        description: "Whether to run bundle size check."
+        required: true
+        type: boolean
       skip:
         description: Whether to skip running tests due to one of the artifacts failing to build.
         required: true
@@ -47,7 +51,7 @@ jobs:
           name: embedding-sdk-${{ github.event.pull_request.head.sha || github.sha }}
           path: ${{ github.workspace }}/resources/embedding-sdk
       - name: Run frontend embedding SDK snippets type check
-        run: yarn run embedding-sdk:cli-snippets:type-check
+        run: bun run embedding-sdk:cli-snippets:type-check
 
   embedding-sdk-docs-snippets-type-check:
     if: inputs.docs-snippets-type-check && !inputs.skip
@@ -63,7 +67,7 @@ jobs:
           name: embedding-sdk-${{ github.event.pull_request.head.sha || github.sha }}
           path: ${{ github.workspace }}/resources/embedding-sdk
       - name: Run frontend embedding SDK snippets type check
-        run: yarn run embedding-sdk:docs-snippets:type-check
+        run: bun run embedding-sdk:docs-snippets:type-check
 
   embedding-sdk-api-documentation-generation-validation:
     if: inputs.documentation-validation && !inputs.skip
@@ -86,7 +90,7 @@ jobs:
         shell: bash
         run: |
           set -o pipefail
-          yarn embedding-sdk:docs:generate:pure --emit none 2>&1 \
+          bun run embedding-sdk:docs:generate:pure --emit none 2>&1 \
           | tee /dev/stdout \
           | tee >( tail -n 10 \
           | sed '1s/^/output<<EOF\n/' \
@@ -98,14 +102,14 @@ jobs:
         with:
           remove-previous-comment: true
           add-new-comment: ${{ steps.docs-generation.outcome == 'failure' && contains(steps.docs-generation.outputs.output, 'not included in the documentation') }}
-          message: "📝 Some exported types from `@metabase/embedding-sdk-react` reference other types that are not exported, i.e. internal types.<br><br>The internal type reference breaks API documentation generation for the SDK and also may unexpectedly increase the output size of the type declaration file.<br><br>Please check the CI logs to find the name of such type.<br><br>- If a type should be publicly available in the SDK, add a description to it or a TypeDoc annotation and export it from SDK.<br>- If a type is internal and should _not_ be publicly exposed, refactor types to prevent referencing other types that are not exported from SDK.<br><br>You can run `yarn embedding-sdk:docs:generate` locally to  verify that the issue has been resolved."
+          message: "📝 Some exported types from `@metabase/embedding-sdk-react` reference other types that are not exported, i.e. internal types.<br><br>The internal type reference breaks API documentation generation for the SDK and also may unexpectedly increase the output size of the type declaration file.<br><br>Please check the CI logs to find the name of such type.<br><br>- If a type should be publicly available in the SDK, add a description to it or a TypeDoc annotation and export it from SDK.<br>- If a type is internal and should _not_ be publicly exposed, refactor types to prevent referencing other types that are not exported from SDK.<br><br>You can run `bun run embedding-sdk:docs:generate` locally to  verify that the issue has been resolved."
           include-log: true
       - name: Comment on PR if 'Failed to resolve link' error happens
         uses: ./.github/actions/notify-pull-request
         with:
           remove-previous-comment: true
           add-new-comment: ${{ steps.docs-generation.outcome == 'failure' && contains(steps.docs-generation.outputs.output, 'Failed to resolve link') }}
-          message: "📝 A typedoc `{@link <TYPE_NAME>}` annotation is found that can't be resolved.<br><br>Most likely it happens when the referenced type is not exported. Please check the CI logs to find the name of such type.<br><br>- If a referenced in `{@link}` type should be publicly available in the SDK, add a description to it or a TypeDoc annotation and export it from SDK.<br>- If a type is internal and should _not_ be publicly exposed, change types to prevent unexported type reference in `{@link}` annotation.<br><br>You can run `yarn embedding-sdk:docs:generate` locally to verify that the issue has been resolved."
+          message: "📝 A typedoc `{@link <TYPE_NAME>}` annotation is found that can't be resolved.<br><br>Most likely it happens when the referenced type is not exported. Please check the CI logs to find the name of such type.<br><br>- If a referenced in `{@link}` type should be publicly available in the SDK, add a description to it or a TypeDoc annotation and export it from SDK.<br>- If a type is internal and should _not_ be publicly exposed, change types to prevent unexported type reference in `{@link}` annotation.<br><br>You can run `bun run embedding-sdk:docs:generate` locally to verify that the issue has been resolved."
           include-log: true
       - name: Fail Job
         if: ${{ steps.docs-generation.outcome == 'failure' }}
@@ -124,8 +128,59 @@ jobs:
     uses: ./.github/workflows/embedding-sdk-host-sample-apps-tests.yml
     secrets: inherit
 
+  embedding-sdk-bundle-size-check:
+    if: inputs.bundle-size-check
+    continue-on-error: true
+    runs-on: ubuntu-22.04
+    timeout-minutes: 20
+    env:
+      BUNDLE_SIZE_THRESHOLD_PERCENT: 2
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/sdk-bundle-size-check
+        id: compare
+        with:
+          edition: ee
+          base-ref-commit: ${{ github.event.pull_request.base.sha }}
+          threshold-percent: ${{ env.BUNDLE_SIZE_THRESHOLD_PERCENT }}
+
+      - name: Comment on PR if bundle size has increased
+        uses: ./.github/actions/notify-pull-request
+        if: success() && steps.compare.outputs.status == 'increased'
+        with:
+          remove-previous-comment: true
+          add-new-comment: true
+          message: "⚠️ Embedding SDK bundle size increased by ${{ steps.compare.outputs.size_change_percent }}% compared to the ${{ github.base_ref }} branch (threshold: ${{ env.BUNDLE_SIZE_THRESHOLD_PERCENT }}%). Please contact Embedding team."
+          include-log: false
+
+      - name: Send notification to Slack via Zapier
+        if: success() && steps.compare.outputs.status == 'increased'
+        shell: bash
+        env:
+          ZAPIER_WEBHOOK_URL: ${{ secrets.EMBEDDING_ZAPIER_WEBHOOK_URL }}
+          SIZE_CHANGE_PERCENT: ${{ steps.compare.outputs.size_change_percent }}
+          BUNDLE_SIZE_THRESHOLD_PERCENT: ${{ env.BUNDLE_SIZE_THRESHOLD_PERCENT }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+        run: |
+          curl -s -X POST "$ZAPIER_WEBHOOK_URL" \
+            -d "⚠️ Embedding SDK bundle size increased by ${SIZE_CHANGE_PERCENT}% (threshold: ${BUNDLE_SIZE_THRESHOLD_PERCENT}%)
+
+          PR #${PR_NUMBER} ${PR_TITLE} (${PR_URL})"
+
+      - name: Comment on PR if bundle size has decreased
+        uses: ./.github/actions/notify-pull-request
+        if: success() && steps.compare.outputs.status == 'decreased'
+        with:
+          remove-previous-comment: true
+          add-new-comment: true
+          message: "🎉 Embedding SDK bundle size decreased by ${{ steps.compare.outputs.size_change_percent }}% compared to the ${{ github.base_ref }} branch. Nice work!"
+          include-log: false
+
   embedding-sdk-tests-result:
     needs:
+      - embedding-sdk-bundle-size-check
       - embedding-sdk-cli-snippets-type-check
       - embedding-sdk-docs-snippets-type-check
       - embedding-sdk-api-documentation-generation-validation

.github/workflows/frontend-unit-test-stress-test-flake-fix.yml

@@ -44,12 +44,12 @@ jobs:
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
       - name: Build cljs
-        run: yarn build:cljs
+        run: bun run build:cljs
       - name: Stress-test ${{ github.event.inputs.spec }} ${{ github.event.inputs.burn_in }} times
         run: |
           for i in {1..${{ github.event.inputs.burn_in }}}; do
-            yarn jest --runInBand --ci --silent --no-cache \
-              --testPathPattern '${{ github.event.inputs.spec }}' \
+            bun run jest --runInBand --ci --silent --no-cache \
+              --testPathPatterns '${{ github.event.inputs.spec }}' \
               --testNamePattern '${{ github.event.inputs.grep }}'
             if [[ "$?" != 0 ]]; then
               echo "Failed after $i attempts" && break;

.github/workflows/frontend.yml

@@ -46,15 +46,15 @@ jobs:
           key: ${{ steps.get-cache-keys.outputs.eslint-cache-key }}
 
       - name: Compile CLJS
-        run: yarn build-pure:cljs
+        run: bun run build-pure:cljs
       - name: Find CSS variables that are used but never defined
-        run: yarn find-never-defined-css-variables
+        run: bun run find-never-defined-css-variables
       - name: Run Prettier formatting linter
-        run: yarn run lint-prettier-pure
+        run: bun run lint-prettier-pure
       - name: Run ESLint linter
-        run: yarn run lint-eslint-pure
+        run: bun run lint-eslint-pure
       - name: Run CSS linter
-        run: yarn run lint-css
+        run: bun run lint-css
 
   fe-type-check:
     if: ${{ !inputs.skip }}
@@ -66,9 +66,9 @@ jobs:
         uses: ./.github/actions/prepare-frontend
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
-      - run: yarn build-pure:cljs
+      - run: bun run build-pure:cljs
         name: Compile CLJS
-      - run: yarn type-check-pure
+      - run: bun run type-check-pure
         name: Check types
 
   fe-tests-unit:
@@ -90,7 +90,8 @@ jobs:
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
       - name: Run frontend unit tests
-        run: yarn run test-unit --silent --shard=${{ matrix.shard }}/${{ env.SHARDS }}
+        id: fe-tests
+        run: bun run test-unit --silent --shard=${{ matrix.shard }}/${{ env.SHARDS }}
         # Trunk Quarantine controls the final state of the run in the CI!
         # Even if this step fails we let it pass, and then `trunk-io/analytics-uploader` determines
         # whether to fail or to pass the whole job, based on the quarantine list.
@@ -106,6 +107,7 @@ jobs:
           aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
           aws-region: ${{ vars.AWS_REGION }}
           trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+          previous-step-outcome: ${{ steps.fe-tests.outcome }}
 
   fe-tests-timezones:
     if: ${{ !inputs.skip }}
@@ -118,7 +120,7 @@ jobs:
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
       - name: Run frontend timezones tests
-        run: yarn run test-timezones
+        run: bun run test-timezones
 
   fe-tests-result:
     needs:

.github/workflows/fuzzing.yml

@@ -1,56 +0,0 @@
-name: Fuzzing
-
-on:
-  workflow_dispatch:
-  push:
-    branches:
-      - "master"
-      - "release-**"
-    paths:
-      - "frontend/src/metabase/querying/expressions/**"
-  pull_request:
-    paths:
-      - "frontend/src/metabase/querying/expressions/**"
-
-jobs:
-  fe-fuzz-lexifier:
-    runs-on: ubuntu-22.04
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@v4
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-      - name: Prepare back-end environment
-        uses: ./.github/actions/prepare-backend
-      - run: yarn test-unit frontend/src/metabase/querying/expressions/pratt/fuzz.lexifier.unit.spec.ts
-        env:
-          MB_FUZZ: 1
-        name: Run fuzz testing on the lexifier
-
-  fe-fuzz-compiler:
-    runs-on: ubuntu-22.04
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@v4
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-      - name: Prepare back-end environment
-        uses: ./.github/actions/prepare-backend
-      - run: yarn test-unit frontend/src/metabase/querying/expressions/fuzz.compiler.unit.spec.ts
-        env:
-          MB_FUZZ: 1
-        name: Run fuzz testing on the custom expression compiler
-
-  fe-fuzz-string-quoting:
-    runs-on: ubuntu-22.04
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@v4
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-      - name: Prepare back-end environment
-        uses: ./.github/actions/prepare-backend
-      - run: yarn test-unit frontend/src/metabase/querying/expressions/fuzz.string.unit.spec.ts
-        env:
-          MB_FUZZ: 1
-        name: Run fuzz testing on the custom expression string quoter

.github/workflows/js-stats-update.yml

@@ -0,0 +1,51 @@
+name: JS Stats Update
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: 40 1 * * 4 # every Thursday at 1:40
+
+jobs:
+  js-stats:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+      - name: get JS file count
+        id: get-js-file-count
+        run: |
+          oss=$(find ./frontend/src/metabase -type f -name "*.js" -o -name "*.jsx" | wc -l)
+          ee=$(find ./enterprise/frontend/src/metabase-enterprise -type f -name "*.js" -o -name "*.jsx" | wc -l)
+
+          echo $(($oss+$ee)) javascript files
+
+          echo "JS_FILES=$(($oss+$ee))" >> $GITHUB_OUTPUT
+      - name: Upload count to Stats
+        uses: actions/github-script@v7
+        env:
+          JS_FILES: ${{ steps.get-js-file-count.outputs.JS_FILES }}
+          API_KEY: ${{ secrets.STATS_API_KEY }}
+        with:
+          script: | # js
+            const { uploadCsvToMb } = require('${{ github.workspace }}/.github/scripts/csv-to-mb.js');
+
+            console.log("JS_FILES", Number(process.env.JS_FILES));
+
+            const data = [
+              {
+                'Date': new Date().toISOString().slice(0, 10), // YYYY-MM-DD
+                'Js files': Number(process.env.JS_FILES),
+              }
+            ];
+
+            uploadCsvToMb({
+              baseUrl: 'https://stats.metabase.com',
+              tableId: 73270,
+              jsonData: data,
+              mode: 'append',
+            }).then(() => {
+              console.log('Data uploaded successfully');
+            }).catch((error) => {
+              console.error('Error uploading data:', error);
+              process.exit(1);
+            });

.github/workflows/loki-stress-test-flake-fix.yml

@@ -0,0 +1,194 @@
+name: Loki Visual Stress Test Flake Fix
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+    paths:
+      - 'frontend/**/*.stories.tsx'
+      - 'enterprise/frontend/**/*.stories.tsx'
+  workflow_dispatch:
+    inputs:
+      story_files:
+        description: "Comma-separated story file paths relative to repo root"
+        type: string
+        required: true
+      burn_in:
+        description: "Number of times to run the test (e.g. 50)"
+        type: string
+        required: true
+        default: "50"
+
+jobs:
+  detect-changed-stories:
+    name: Detect changed stories
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    outputs:
+      story_files: ${{ steps.detect.outputs.story_files }}
+      should_run: ${{ steps.detect.outputs.should_run }}
+    steps:
+      - name: Detect changed story files
+        id: detect
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          validate_paths() {
+            local files="$1"
+            for file in $(echo "$files" | tr ',' '\n'); do
+              file=$(echo "$file" | xargs)  # trim whitespace
+              if [[ -z "$file" ]]; then
+                continue
+              fi
+              if [[ ! "$file" =~ ^(frontend/|enterprise/frontend/).+\.stories\. ]]; then
+                echo "::error::Invalid story path: $file"
+                echo "Paths must start with 'frontend/' or 'enterprise/frontend/' and contain '.stories.'"
+                return 1
+              fi
+            done
+            return 0
+          }
+
+          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
+            FILES=$(echo "${{ inputs.story_files }}" | tr ',' '\n' | xargs -n1 | paste -sd',')
+            if ! validate_paths "$FILES"; then
+              exit 1
+            fi
+            echo "story_files=$FILES" >> $GITHUB_OUTPUT
+            echo "should_run=true" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+
+          FILES=$( \
+            gh pr view ${{ github.event.pull_request.number }} --repo ${{ github.repository }} --json files --jq '.files[].path' \
+            | grep '\.stories\.tsx$' \
+            | xargs -n1 \
+            | sort -u \
+            | paste -sd',' \
+          )
+
+          if [[ -z "$FILES" ]]; then
+            echo "No changed story files found"
+            echo "should_run=false" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+
+          if ! validate_paths "$FILES"; then
+            exit 1
+          fi
+
+          echo "Changed story files: $FILES"
+          echo "story_files=$FILES" >> $GITHUB_OUTPUT
+          echo "should_run=true" >> $GITHUB_OUTPUT
+
+  workflow-summary:
+    name: Summary
+    needs: detect-changed-stories
+    if: needs.detect-changed-stories.outputs.should_run == 'true'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    steps:
+      - name: Generate workflow summary
+        run: |
+          echo '## Loki Stress Test' >> $GITHUB_STEP_SUMMARY
+          echo '' >> $GITHUB_STEP_SUMMARY
+          echo '**Branch:** `${{ github.head_ref || github.ref_name }}`' >> $GITHUB_STEP_SUMMARY
+          echo '' >> $GITHUB_STEP_SUMMARY
+          echo '**Story files:**' >> $GITHUB_STEP_SUMMARY
+          echo '${{ needs.detect-changed-stories.outputs.story_files }}' | tr ',' '\n' | while read -r file; do
+            echo "- \`$file\`" >> $GITHUB_STEP_SUMMARY
+          done
+          echo '' >> $GITHUB_STEP_SUMMARY
+          echo '**Burn-in:** ${{ inputs.burn_in || 50 }} runs' >> $GITHUB_STEP_SUMMARY
+          echo '' >> $GITHUB_STEP_SUMMARY
+          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+            echo 'Triggered by PR #${{ github.event.pull_request.number }} from @${{ github.event.pull_request.user.login }}' >> $GITHUB_STEP_SUMMARY
+          else
+            echo 'Triggered manually by @${{ github.actor }}' >> $GITHUB_STEP_SUMMARY
+          fi
+
+  stress-test-loki:
+    needs: detect-changed-stories
+    if: needs.detect-changed-stories.outputs.should_run == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    name: Stress test Loki visual tests
+    services:
+      docker:
+        image: docker:19.03.12
+        options: --privileged
+        ports:
+          - 2376:2376
+        env:
+          DOCKER_TLS_CERTDIR: /certs
+        volumes:
+          - /var/run/docker.sock:/var/run/docker.sock
+          - /tmp/docker-certs:/certs/client
+
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v4
+
+      - name: Prepare frontend environment
+        uses: ./.github/actions/prepare-frontend
+
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+
+      - name: Compile CLJS
+        run: NODE_ENV=development bun run build-pure:cljs
+
+      - name: Build Storybook
+        run: bun run build-storybook
+        env:
+          STORYBOOK_STORIES_FILTER: ${{ needs.detect-changed-stories.outputs.story_files }}
+
+      - name: Stress-test Loki
+        run: |
+          BURN_IN=${{ inputs.burn_in || '50' }}
+          STORY_FILES='${{ needs.detect-changed-stories.outputs.story_files }}'
+
+          echo "Story files: $STORY_FILES"
+          echo "Running Loki $BURN_IN times"
+          echo ""
+
+          FAILED=0
+          for i in $(seq 1 $BURN_IN); do
+            echo "=========================================="
+            echo "Run $i of $BURN_IN"
+            echo "=========================================="
+
+            if bun run test-visual:loki \
+              --reactUri file:./storybook-static \
+              --verboseRenderer; then
+              echo "✅ Run $i passed"
+            else
+              echo "❌ Run $i FAILED"
+              FAILED=$((FAILED + 1))
+
+              mkdir -p .loki/failures/run-$i
+              cp -r .loki/difference/* .loki/failures/run-$i/ 2>/dev/null || true
+            fi
+            echo ""
+          done
+
+          echo "=========================================="
+          echo "Summary: $((BURN_IN - FAILED))/$BURN_IN passed, $FAILED failed"
+          echo "=========================================="
+
+          if [ $FAILED -gt 0 ]; then
+            echo "::error::$FAILED out of $BURN_IN runs failed"
+            exit 1
+          fi
+
+      - name: Generate Visual Report on Failure
+        if: failure()
+        run: bun run test-visual:loki-report
+
+      - name: Upload Artifact
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: loki-stress-test-report
+          include-hidden-files: true
+          path: .loki/
+          if-no-files-found: ignore

.github/workflows/loki-update.yml

@@ -22,10 +22,10 @@ jobs:
         uses: ./.github/actions/prepare-backend
 
       - name: Compile CLJS
-        run: yarn build-pure:cljs
+        run: bun run build-pure:cljs
 
       - name: Update Loki Snapshots
-        run: yarn test-visual:loki:ci || yarn test-visual:loki-approve-diff && yarn test-visual:loki-prune
+        run: bun run test-visual:loki:ci || bun run test-visual:loki-approve-diff && bun run test-visual:loki-prune
 
       - name: Check for changes
         id: check-changes