Split api/analytics.ts into search telemetry and the export mutation

The file bundled two unrelated concerns. Search tracking now lives in
api/analytics/search.ts next to its only caller, and the export
mutation in api/analytics/export.ts. The analytics/ directory satisfies
the no-analytics-import-outside-analytics-files rule that pinned the
old filename.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.claude/skills/_shared/clojure-style-guide.md

@@ -27,9 +27,28 @@ This guide covers Clojure and ClojureScript coding conventions for Metabase. See
 - Format using Markdown conventions
 - Reference other vars with `[[other-var]]` not backticks
 
+A docstring states the *contract*: what it returns (including when it returns nil), what its
+params mean, what it throws versus swallows, and any precondition or invariant the caller must
+respect. A params block for non-obvious or optional args is good documentation — length is not
+the problem.
+
+These seven things are, and each is a reason to cut or relocate:
+
+| Anti-pattern | Why | Where it goes instead |
+| --- | --- | --- |
+| **Facts you don't own** — how a *callee*, another namespace, or another repo works internally | Drifts silently; nothing fails when it goes stale | Cut. Name the callee and let its own docstring say it |
+| **Said twice** — ns docstring restating its vars', a caller restating its callee's, sibling fns repeating boilerplate | Two copies means one is already wrong | Cut the copy. One fact, one owner |
+| **Design rationale** — why this approach, why it lives in this module, what the alternative was | The caller can't act on it | Commit message, or an inline comment on the specific line it constrains |
+| **Development history** — "matching master", "the X branch", "currently", "for now", "used to" | Stale by construction | Cut |
+| **Instructions to the reader** — "callers should trust this", "don't bother checking", "you should use X" | State the contract; the caller decides | Cut, keeping any actual guarantee as a plain statement |
+| **Invented precision** — score bands, thresholds, or tables no code enforces | Reads as spec, isn't | Cut, or make the code enforce it |
+| **A note on the wrong var** — describing how overrides behave, on the base/default impl | Nobody reading the override sees it | Move to the overrides it describes |
+
 **Comments:**
 
 - `TODO` format: `;; TODO (Name YYYY-MM-DD) -- description`
+- Prefer an inline comment over docstring prose for anything that explains *the body*. Put it on
+  the line it explains, not at the top of the function.
 
 ## Code Organization
 

.claude/skills/_shared/development-workflow.md

@@ -6,3 +6,4 @@
 - Run targeted tests, and lint continuously during development
 - Prioritize understanding existing patterns before implementing
 - Don't commit changes, leave it for the user to review and make commits
+- Minimize comments. Document only non-obvious intent, trade-offs, or constraints that the code itself cannot convey. Do not narrate what the code does — keep code self-descriptive through naming and structure.

.claude/skills/analytics-events/SKILL.md

@@ -10,23 +10,23 @@ This skill helps you add product analytics (Snowplow) events to track user inter
 
 ## Quick Reference
 
-Analytics events in Metabase use Snowplow with typed event schemas. All events must be defined in TypeScript types before use.
+Analytics events in Metabase use Snowplow with typed event schemas. Simple events are declared **where they are used** — `trackSimpleEvent` is generic and validates the payload at the call site.
 
 **Key Files:**
-- `frontend/src/metabase-types/analytics/event.ts` - Event type definitions
-- `frontend/src/metabase-types/analytics/schema.ts` - Schema registry
-- `frontend/src/metabase/analytics/` - Core tracking functions (import from `metabase/analytics`)
-- Feature-specific `analytics.ts` files - Tracking function wrappers
+- `frontend/src/metabase/analytics/event.ts` - Core tracking functions, `trackSimpleEvent` / `trackSchemaEvent` (import from `metabase/analytics`)
+- `frontend/src/metabase-types/analytics/event.ts` - The shared `SimpleEventSchema` only. **Do not add event types here** (see below)
+- `frontend/src/metabase-types/analytics/schema.ts` - Schema registry (custom/legacy schemas only)
+- Feature-specific `analytics.ts` files - Where your tracking functions and any local types live
 
 ## Quick Checklist
 
 When adding a new analytics event:
 
-- [ ] Define event type in `frontend/src/metabase-types/analytics/event.ts`
-- [ ] Add event to appropriate union type (e.g., `DataStudioEvent`, `SimpleEvent`)
-- [ ] Create tracking function in feature's `analytics.ts` file
-- [ ] Import and call tracking function at the interaction point
-- [ ] Use `trackSimpleEvent()` for basic events (most common)
+- [ ] Pick an event name (snake_case, past tense)
+- [ ] Add a tracking function to the feature's `analytics.ts` file, calling `trackSimpleEvent()`
+- [ ] Keep any field unions (e.g. `"success" | "failure"`) as local types in that same file
+- [ ] Import and call the tracking function at the interaction point
+- [ ] Do **not** add an event type to `metabase-types/analytics/event.ts` or to any union
 
 ## Event Schema Types
 
@@ -47,6 +47,25 @@ type SimpleEventSchema = {
 
 **When to use:** 90% of events fit this schema. Use for clicks, opens, closes, creates, deletes, etc.
 
+`trackSimpleEvent` is generic and enforces this schema on the object literal you pass it:
+
+```typescript
+// frontend/src/metabase/analytics/event.ts
+export function trackSimpleEvent<
+  T extends SimpleEventSchema &
+    Record<Exclude<keyof T, keyof SimpleEventSchema>, never>,
+>(event: T) {
+  trackSchemaEvent("simple_event", event);
+}
+```
+
+That means a missing `event` or any field outside `SimpleEventSchema` is a compile error at the call
+site. There is no separate event type to declare and no `satisfies` clause to add — the old
+`ValidateEvent<...>` helper is no longer exported and is not part of the workflow.
+
+`trackSchemaEvent` is generic too: it correlates the schema name with the payload type, so you can't
+send a dashboard event under the `simple_event` schema.
+
 ### 2. Custom Schemas (legacy, no events are being added)
 
 Consider adding new event schema only in very special cases.
@@ -57,36 +76,7 @@ Consider adding new event schema only in very special cases.
 
 ### Example: Track when a user applies filters in a table picker
 
-#### Step 1: Define Event Types
-
-Add event type definitions to `frontend/src/metabase-types/analytics/event.ts`:
-
-```typescript
-export type DataStudioTablePickerFiltersAppliedEvent = ValidateEvent<{
-  event: "data_studio_table_picker_filters_applied";
-}>;
-
-export type DataStudioTablePickerFiltersClearedEvent = ValidateEvent<{
-  event: "data_studio_table_picker_filters_cleared";
-}>;
-```
-
-#### Step 2: Add to Union Type
-
-Find or create the appropriate union type and add your events:
-
-```typescript
-export type DataStudioEvent =
-  | DataStudioLibraryCreatedEvent
-  | DataStudioTablePublishedEvent
-  | DataStudioGlossaryCreatedEvent
-  | DataStudioGlossaryEditedEvent
-  | DataStudioGlossaryDeletedEvent
-  | DataStudioTablePickerFiltersAppliedEvent  // <- Add here
-  | DataStudioTablePickerFiltersClearedEvent; // <- Add here
-```
-
-#### Step 3: Create Tracking Functions
+#### Step 1: Create Tracking Functions
 
 In your feature's `analytics.ts` file (e.g., `enterprise/frontend/src/metabase-enterprise/data-studio/analytics.ts`):
 
@@ -106,7 +96,7 @@ export const trackDataStudioTablePickerFiltersCleared = () => {
 };
 ```
 
-#### Step 4: Use in Components
+#### Step 2: Use in Components
 
 Import and call the tracking function at the interaction point:
 
@@ -138,16 +128,11 @@ function FilterPopover({ filters, onSubmit }) {
 
 ## Using SimpleEventSchema Fields
 
+All examples below live in the feature's own `analytics.ts` — nothing is registered centrally.
+
 ### Example: Event with target_id
 
 ```typescript
-// Type definition
-export type DataStudioLibraryCreatedEvent = ValidateEvent<{
-  event: "data_studio_library_created";
-  target_id: number | null;
-}>;
-
-// Tracking function
 export const trackDataStudioLibraryCreated = (id: CollectionId) => {
   trackSimpleEvent({
     event: "data_studio_library_created",
@@ -162,14 +147,10 @@ trackDataStudioLibraryCreated(newLibrary.id);
 ### Example: Event with triggered_from
 
 ```typescript
-// Type definition
-export type NewButtonClickedEvent = ValidateEvent<{
-  event: "new_button_clicked";
-  triggered_from: "app-bar" | "empty-collection";
-}>;
+// Local union, exported only if another feature needs to pass the same value
+export type NewButtonLocation = "app-bar" | "empty-collection";
 
-// Tracking function
-export const trackNewButtonClicked = (location: "app-bar" | "empty-collection") => {
+export const trackNewButtonClicked = (location: NewButtonLocation) => {
   trackSimpleEvent({
     event: "new_button_clicked",
     triggered_from: location,
@@ -187,44 +168,31 @@ export const trackNewButtonClicked = (location: "app-bar" | "empty-collection")
 
 ### Example: Event with event_detail
 
-```typescript
-// Type definition
-export type MetadataEditEvent = ValidateEvent<{
-  event: "metadata_edited";
-  event_detail: "type_casting" | "semantic_type_change" | "visibility_change";
-  triggered_from: "admin" | "data_studio";
-}>;
+Real example — `frontend/src/metabase/metadata/pages/shared/analytics.ts`:
 
-// Tracking function
-export const trackMetadataChange = (
-  detail: "type_casting" | "semantic_type_change" | "visibility_change",
-  location: "admin" | "data_studio"
-) => {
+```typescript
+export type MetadataEditEventDetail =
+  | "type_casting"
+  | "semantic_type_change"
+  | "visibility_change";
+
+export const trackMetadataChange = (detail: MetadataEditEventDetail) => {
   trackSimpleEvent({
     event: "metadata_edited",
     event_detail: detail,
-    triggered_from: location,
+    triggered_from: "admin",
   });
 };
 
 // Usage
-trackMetadataChange("semantic_type_change", "data_studio");
+trackMetadataChange("semantic_type_change");
 ```
 
 ### Example: Event with result and duration
 
-```typescript
-// Type definition
-export type MoveToTrashEvent = ValidateEvent<{
-  event: "moved-to-trash";
-  target_id: number | null;
-  triggered_from: "collection" | "detail_page" | "cleanup_modal";
-  duration_ms: number | null;
-  result: "success" | "failure";
-  event_detail: "question" | "model" | "metric" | "dashboard";
-}>;
+See `frontend/src/metabase/archive/analytics.ts` for the real version of this.
 
-// Tracking function
+```typescript
 export const trackMoveToTrash = (params: {
   targetId: number | null;
   triggeredFrom: "collection" | "detail_page" | "cleanup_modal";
@@ -280,17 +248,16 @@ try {
 "filters-applied"            // Use underscore, not hyphen
 ```
 
-### Event Type Names (PascalCase with "Event" suffix)
+### Local Field Types (PascalCase, named after the field)
+
+There is usually no `...Event` type to name anymore. When you do need a union for a field, name it
+after the field it feeds:
 
 ```typescript
 // Good
-DataStudioLibraryCreatedEvent
-TablePickerFiltersAppliedEvent
-MetabotChatOpenedEvent
-
-// Bad
-dataStudioLibraryCreated      // Wrong case
-DataStudioLibraryCreated      // Missing "Event" suffix
+type MetricDimensionResult = "success" | "failure";     // -> result
+export type MetadataEditEventDetail = "type_casting";   // -> event_detail
+type NewButtonLocation = "app-bar" | "empty-collection"; // -> triggered_from
 ```
 
 ### Tracking Function Names (camelCase with "track" prefix)
@@ -309,29 +276,28 @@ logLibraryCreated             // Use "track" prefix
 
 ## Common Patterns
 
-### Pattern 1: Feature-Specific Union Types
+### Pattern 1: Sharing Field Types Across Features
 
-Group related events together:
+When two features send the same event with a different `triggered_from`, export the field union from
+the owning feature's `analytics.ts` and import it — don't hoist anything into `metabase-types`:
 
 ```typescript
-export type DataStudioEvent =
-  | DataStudioLibraryCreatedEvent
-  | DataStudioTablePublishedEvent
-  | DataStudioGlossaryCreatedEvent;
+// frontend/src/metabase/data-studio/data-model/analytics.ts
+import { trackSimpleEvent } from "metabase/analytics";
+import type { MetadataEditEventDetail } from "metabase/metadata/pages/shared/analytics";
 
-export type MetabotEvent =
-  | MetabotChatOpenedEvent
-  | MetabotRequestSentEvent
-  | MetabotFixQueryClickedEvent;
-
-// Then add to SimpleEvent union
-export type SimpleEvent =
-  | /* other events */
-  | DataStudioEvent
-  | MetabotEvent
-  | /* more events */;
+export function trackMetadataChange(detail: MetadataEditEventDetail) {
+  trackSimpleEvent({
+    event: "metadata_edited",
+    event_detail: detail,
+    triggered_from: "data_studio",
+  });
+}
 ```
 
+This is the point of the extensible-events design: enterprise and feature-tier types stay in their
+own module instead of being imported down into a shared union.
+
 ### Pattern 2: Conditional Tracking
 
 Track different events based on user action:
@@ -350,10 +316,10 @@ const handleSave = async () => {
 
 ## Common Pitfalls
 
-### Don't: Add custom fields to SimpleEvent
+### Don't: Add custom fields to a simple event
 
 ```typescript
-// WRONG - SimpleEvent doesn't support custom fields
+// WRONG - SimpleEventSchema doesn't support custom fields (this is a compile error)
 export const trackFiltersApplied = (filters: FilterState) => {
   trackSimpleEvent({
     event: "filters_applied",
@@ -379,23 +345,43 @@ export const trackFilterApplied = (filterType: string) => {
 };
 ```
 
-### Don't: Forget to add event to union type
+### Don't: Add event types to `metabase-types/analytics/event.ts`
+
+The central `SimpleEvent` union was removed — it forced feature-tier types to be imported down into
+shared code, causing module-boundary violations. `trackSimpleEvent` is generic now, so the type adds
+nothing but duplication.
 
 ```typescript
-// Define the event
+// ❌ WRONG - central declaration + re-import for a `satisfies` clause
+// frontend/src/metabase-types/analytics/event.ts
 export type NewFeatureClickedEvent = ValidateEvent<{
   event: "new_feature_clicked";
+  target_id: number;
 }>;
 
-// ❌ WRONG - Forgot to add to SimpleEvent union
-// Event won't be recognized by TypeScript
+// frontend/src/metabase/my-feature/analytics.ts
+import type { NewFeatureClickedEvent } from "metabase-types/analytics";
 
-// ✓ RIGHT - Add to appropriate union
-export type SimpleEvent =
-  | /* other events */
-  | NewFeatureClickedEvent;
+export const trackNewFeatureClicked = (id: number) => {
+  trackSimpleEvent({
+    event: "new_feature_clicked",
+    target_id: id,
+  } satisfies NewFeatureClickedEvent);
+};
+
+// ✓ RIGHT - the object literal is already checked by the generic
+// frontend/src/metabase/my-feature/analytics.ts
+export const trackNewFeatureClicked = (id: number) => {
+  trackSimpleEvent({
+    event: "new_feature_clicked",
+    target_id: id,
+  });
+};
 ```
 
+A few `...Event` types still sit in `metabase-types/analytics/event.ts`. They are leftovers from PRs
+that landed around the refactor — don't copy them, and don't add to them.
+
 ### Don't: Mix up event name formats
 
 ```typescript
@@ -463,41 +449,44 @@ Example console output:
 ### Where to put tracking functions:
 
 ```
-Feature-specific analytics functions:
+Tracking functions AND their local field types (this is where new events live):
 frontend/src/metabase/{feature}/analytics.ts
 enterprise/frontend/src/metabase-enterprise/{feature}/analytics.ts
 
-Event type definitions (all in one place):
-frontend/src/metabase-types/analytics/event.ts
-
 Core tracking utilities:
 frontend/src/metabase/analytics/ (import from `metabase/analytics`)
+
+Shared SimpleEventSchema only — nothing new goes here:
+frontend/src/metabase-types/analytics/event.ts
 ```
 
+In embedding SDK code, use `trackSdkSimpleEvent`
+(`frontend/src/embedding-sdk-bundle/analytics/snowplow.ts`) instead — the main-app `"sp"` tracker
+isn't initialized in the customer's page, so `trackSimpleEvent`'s Snowplow leg is a no-op there.
+
 ## Real-World Examples
 
 See these files for reference:
 
-- **Simple events**: `enterprise/frontend/src/metabase-enterprise/data-studio/analytics.ts`
-- **Events with variants**: `frontend/src/metabase/dashboard/analytics.ts`
-- **Complex events**: `frontend/src/metabase/query_builder/analytics.js`
-- **Event type examples**: `frontend/src/metabase-types/analytics/event.ts`
+- **Simple events + local field union**: `frontend/src/metabase/metadata/pages/shared/analytics.ts`
+- **Reusing another feature's field type**: `frontend/src/metabase/data-studio/data-model/analytics.ts`
+- **Result + duration timing**: `frontend/src/metabase/archive/analytics.ts`
+- **Enterprise feature events**: `enterprise/frontend/src/metabase-enterprise/google_drive/analytics.ts`
 
 ## Workflow Summary
 
 1. **Identify the user interaction** to track
 2. **Decide on event name** (snake_case, descriptive)
-3. **Define event type** in `event.ts` using `ValidateEvent`
-4. **Add to union type** (create feature union if needed)
-5. **Create tracking function** in feature's `analytics.ts`
-6. **Import and call** at the interaction point
-7. **Test** that events fire correctly
+3. **Create tracking function** in feature's `analytics.ts`, calling `trackSimpleEvent()`
+4. **Add local field unions** in that same file if a field has a fixed set of values
+5. **Import and call** at the interaction point
+6. **Test** that events fire correctly
 
 ## Tips
 
 - **Be specific** - `filters_applied` is better than `action_performed`
 - **Use past tense** - `library_created` not `create_library`
-- **Group related events** - Create feature-specific event union types
+- **Group related events** - Keep a feature's tracking functions together in its `analytics.ts`
 - **Track meaningful actions** - Not every click needs tracking
 - **Consider the data** - What would you want to analyze later?
 - **Stay consistent** - Follow existing naming patterns in the codebase

.claude/skills/clojure-review/SKILL.md

@@ -56,6 +56,11 @@ Use this to scan through changes efficiently:
 - [ ] References use `[[other-var]]` not backticks
 - [ ] `TODO` comments include author and date: `;; TODO (Name 2025-01-01) -- description`
 
+Docstring content — check every new or rewritten docstring against the anti-pattern table in the
+style guide above. Read the diff's docstrings on their own, separately from the code: prose is
+where review attention slides off, and a long docstring reads as diligence rather than as the
+liability it usually is.
+
 ### Code Organization
 
 - [ ] Everything `^:private` unless used elsewhere
@@ -135,6 +140,17 @@ Quick scan for common issues:
 
 > This public var needs a docstring explaining its purpose, inputs, and outputs.
 
+**For docstrings documenting code they don't own:**
+
+> This describes how `lib` decides binning strategies internally. Nothing here fails when that
+> changes, so it will go stale silently — drop it and let `available-binning-strategies` answer
+> for its own behavior.
+
+**For docstring content that belongs in the body:**
+
+> This paragraph explains why the branches are ordered this way, which is what someone editing
+> the `cond` needs — but a caller can't act on it. Move it to an inline comment above the `cond`.
+
 **For organization issues:**
 
 > This function is only used in this namespace, so it should be marked `^:private`.

.claude/skills/clojure-write/SKILL.md

@@ -82,10 +82,29 @@ either a bug, or it means callers must handle each case themselves — and
 in *that* case it is the *absence* of the property that must be
 documented. Document deviations from expectation, not conformance to it.
 
-Heuristic: if a sentence would still be true after a full rewrite of the
-body, it may belong in the docstring. If it describes *how the current
-body works*, it belongs in the body — as an inline comment, if it is
-non-obvious.
+Heuristic — a sentence earns its place in the docstring only if it
+passes both tests:
+
+1. Rewrite test (necessary, not sufficient): if rewriting the body to a
+   different implementation with an identical contract could make the
+   sentence false, it describes the implementation, not the contract.
+   Relocate it to an inline comment at the point in the body where it
+   applies.
+
+2. Ownership test: if the sentence states a fact about code this
+   function does not own — a callee's behavior, a library's guarantee —
+   it survives any rewrite trivially, which is exactly why the rewrite
+   test alone is not enough. If this body *relies* on that fact, it is
+   implementation context: relocate it to the call site. If nothing here
+   relies on it, it is blather about someone else's code: delete it, and
+   let the callee's own docstring answer for it.
+
+Say each fact once. Duplicated prose is a stale comment in advance: when
+the fact changes, one copy gets updated and the rest quietly rot. This
+holds even within code you own — a namespace docstring that
+re-summarizes its own multimethods, three sibling functions carrying the
+same paragraph about retry behavior. Give the fact one home, and have
+the other places name it rather than restate it.
 
 Multi-line docstrings are not banned — a genuinely non-obvious constraint
 the code had to deal with can be worth explaining. But be prudent; the
@@ -102,3 +121,7 @@ breakage keeps happening, *that* is the signal a comment was warranted.
 - End all files with a newline
 - When editing tabular code, where the columns line up, try to keep them aligned
 - Spaces on a line with nothing after it is not allowed
+- After changing module boundaries (adding/removing/renaming a `src` namespace, a cross-module `require`
+  or `:model/X` reference, or a new module), run `./bin/mage fix-modules-config` to regenerate
+  `.clj-kondo/config/modules/config.edn` and keep `metabase.core.modules-test` green. No-op when nothing
+  drifted; see "Module Boundaries" in the project `CLAUDE.md`.

.claude/skills/emotion-migrate/SKILL.md

@@ -257,7 +257,7 @@ Remove the old styled file entirely. Remove all imports of it from other files.
 
 - Text: `"text-primary"`, `"text-secondary"`, `"text-disabled"`
 - Background: `"background_page-primary"`, `"background_page-secondary"`, `"background_surface-hover"`
-- Brand: `"core-brand"`, `"error"`, `"success"`, `"warning"`
+- Brand: `"core-brand"`, `"feedback-negative"`, `"feedback-positive"`, `"feedback-warning"`
 
 **Typography** (`fz`, `fw`, `lh`, `ta`, `ff`):
 
@@ -283,7 +283,7 @@ Remove the old styled file entirely. Remove all imports of it from other files.
 - `--mb-color-background_page-primary`, `--mb-color-background_page-secondary`, `--mb-color-background_surface-hover`
 - `--mb-color-border`, `--mb-color-border-strong`, `--mb-color-border-subtle`
 - `--mb-color-core-brand`, `--mb-color-core-brand-hover`
-- `--mb-color-error`, `--mb-color-success`, `--mb-color-warning`
+- `--mb-color-feedback-negative`, `--mb-color-feedback-positive`, `--mb-color-feedback-warning`
 - `--mb-color-shadow`, `--mb-color-focus`
 - `--mb-color-accent0` through `--mb-color-accent7`
 

.claude/skills/typescript-review/SKILL.md

@@ -13,7 +13,7 @@ allowed-tools: Read, Grep, Bash, Glob, Skill
 
 **Primary standard: the [`typescript-write`](../typescript-write/SKILL.md) skill.** Load it first — it defines the authoring rules this review enforces, alongside `frontend/CLAUDE.md` and `docs/developers-guide/frontend.md`.
 
-Adherence to `typescript-write` is the **highest-priority** review dimension: rank any violation of its provisions above all other findings. Treat its **no-`any` hard rule** (no explicit *or* implicit `any` in new code) as **blocking**, and verify it with the LSP rather than by eye.
+Adherence to `typescript-write` is the **highest-priority** review dimension: rank any violation of its provisions above all other findings. Treat its **no-`any` hard rule** (no explicit *or* implicit `any` in new code) as **blocking**. Use TypeScript LSP tools to inspect inferred types when available; otherwise rely on type-checking and linting.
 
 Review in this priority order:
 

.claude/skills/typescript-write/SKILL.md

@@ -13,7 +13,7 @@ description: Write TypeScript and JavaScript code following Metabase coding stan
 
 - **New code must not introduce `any`, explicit or implicit.** No `any` annotations, no `as any` / `as unknown as`, no untyped parameters or returns that infer `any`, no implicitly-`any` destructures or array/object literals.
 - **Untyped third-party / boundary values** must be typed at the boundary (a declared type, `unknown` + type guard, or a small typed wrapper) — never let `any` propagate inward.
-- **Mandatory LSP verification.** After writing or editing any TS/TSX, inspect the changed symbols with the TypeScript Language Server (hover to read inferred types; `goToDefinition` to confirm sources) and run the project type-check.
+- **Mandatory type verification.** Before finishing a TS/TSX change, run `bun run type-check-pure`. If TypeScript LSP tools are available, also inspect changed symbols with hover and go-to-definition; otherwise skip LSP check.
 
 ## Type tightening
 
@@ -26,6 +26,7 @@ description: Write TypeScript and JavaScript code following Metabase coding stan
 - **Avoid non-null assertions (`!`)**. Prefer a guard, early return, or `?.`. Use `!` only when non-nullness is provably true and localized, with a comment.
 - **No redundant runtime coercion** — don't wrap already-typed values in `Number()` / `String()` / `Boolean()`.
 - **Type guards belong in `frontend/src/metabase-types/guards/`**. Do not redefine them locally.
+- **A cast you can't avoid needs a real justification comment.** The `metabase/no-unjustified-type-casts` rule accepts any preceding comment — state the actual reason the cast is safe. NEVER write the legacy `// Unjustified type cast. FIXME` placeholder; it exists only on casts that predated the rule, and copying it sneaks an unjustified cast past the linter. If you can't articulate why the cast is correct, the cast is wrong — fix the types.
 
 ## Type modeling
 

.clj-kondo/config.edn

@@ -7,7 +7,6 @@
 
   :aliased-namespace-symbol     {:level :warning}
   :case-symbol-test             {:level :warning}
-  :condition-always-true        {:level :warning}
   :def-fn                       {:level :warning}
   :dynamic-var-not-earmuffed    {:level :warning}
   :equals-expected-position     {:level :warning, :only-in-test-assertion true}
@@ -50,9 +49,11 @@
   ;; disabled linters
   ;;
 
+  :constant-condition {:level :off} ; TODO (sashko): too confused by defenterprises, some hook/config is needed
   :redundant-ignore {:level :off} ; lots of false positives, see https://github.com/clj-kondo/clj-kondo/issues/2414
   :unexpected-recur {:level :off} ; TODO (cam): I think we just need to tell it how to handle MBQL match and we can enable this?
   :redundant-primitive-coercion {:level :off} ; there are many defensive boolean coercions, kondo looks too much into it
+  :type-mismatch {:level :off} ; Still quite raw, can sometimes give useful insights, but sometimes is just confused
 
   ;;
   ;; globally-enabled custom linters
@@ -179,6 +180,9 @@
      clojure.core.async/take!
      clojure.core.async/to-chan!
      clojure.core.async/to-chan!!
+     ;; only writes .clj-kondo/ratchets.edn, from a :once fixture that finishes before the parallel tests
+     dev.kondo-ratchet/fix!
+     metabase.ai-tracing.core/record!
      metabase.api.macros.defendpoint.tools-manifest/assert-optional-fields-nullable!
      metabase.channel.core/send!
      metabase.channel.render.pdf/draw-too-large!
@@ -187,10 +191,17 @@
      metabase.channel.render.pdf.font/load-fonts!
      metabase.warehouses.models.database/assert-not-h2!
      metabase.driver.sql-jdbc.execute/execute-prepared-statement!
+     metabase.mcp.usage/record-mcp-session!
+     metabase.mcp.usage/record-mcp-session-end!
+     metabase.mcp.usage/record-mcp-tool-call!
      metabase.notification.models/create-notification!
      metabase.oauth-server.core/reset-provider!
      metabase.pulse.send/send-pulse!
      metabase-enterprise.transforms-python.python-runner-test/execute!
+     ;; MCP usage tests isolate their rows by unique keys (session id / tool name / duration /
+     ;; client version) and clean up only those, so these deletes are safe in parallel.
+     metabase-enterprise.mcp.usage-test/cleanup!
+     metabase-enterprise.mcp.usage-test/cleanup-calls!
      ;; Workspace isolation functions are safe in parallel tests because they operate on
      ;; isolated, test-specific workspaces and databases that don't affect other tests
      metabase-enterprise.workspaces.isolation/destroy-workspace-isolation!
@@ -252,9 +263,6 @@
   ;; misc config for built-in linters
   ;;
 
-  :invalid-arity       {:skip-args [metabase.util.match/match-one
-                                    metabase.util.match/match-many
-                                    metabase.util.match/replace]}                    ; TODO (cam): can we fix these?
   :refer-all           {:level :warning, :exclude [clojure.test]}
   :unused-referred-var {:exclude {compojure.core [GET DELETE POST PUT]}}
 
@@ -293,7 +301,10 @@
     metabase.query-processor.util/normalize-token                {:namespaces ["metabase.*"]}}}
 
   :discouraged-var
-  {clojure.core/print                                 {:message "Use metabase.util.log instead of clojure.core/print"}
+  {metabase-enterprise.entity-retrieval.core/search-unfiltered {:message "Permission bypass risk: library-index hits are unfiltered — resolve each entity and drop what the current user can't read"}
+   metabase.entity-retrieval.core/search-unfiltered            {:message "Permission bypass risk: library-index hits are unfiltered — resolve each entity and drop what the current user can't read"}
+   metabase.entity-retrieval.mirror/search-unfiltered          {:message "Permission bypass risk: library-index hits are unfiltered — resolve each entity and drop what the current user can't read"}
+   clojure.core/print                                 {:message "Use metabase.util.log instead of clojure.core/print"}
    clojure.core/println                               {:message "Use metabase.util.log instead of clojure.core/println"}
    clojure.core/printf                                {:message "Use metabase.util.log instead of clojure.core/printf"}
    clojure.core/prn                                   {:message "Use metabase.util.log instead of clojure.core/prn"}
@@ -449,6 +460,9 @@
   metabase-enterprise.action-v2.test-util/with-test-tables!                             clojure.core/let
   metabase-enterprise.content-translation.routes-test/with-new-secret-key!              clojure.core/fn
   metabase-enterprise.entity-retrieval.reconcile-test/with-isolated-index                 clojure.core/fn
+  metabase-enterprise.mfa.enrollment-flow-test/with-fresh-user-session!                  clojure.core/fn
+  metabase-enterprise.mfa.login-flow-test/with-enrolled-rasta!                           clojure.core/fn
+  metabase-enterprise.mfa.recovery-codes-test/with-confirmed-enrollment!                 clojure.core/fn
   metabase-enterprise.serialization.metadata-file-import.wire-format-test/with-tiny-fixture! clojure.core/fn
   metabase-enterprise.serialization.test-util/with-dbs                                  clojure.core/fn
   metabase-enterprise.serialization.test-util/with-random-dump-dir                      clojure.core/let
@@ -457,6 +471,8 @@
   metabase.actions.test-util/with-actions                                               clojure.core/let
   metabase.transforms.test-util/with-transform-cleanup!                                 clojure.core/let
   metabase.api.common/let-404                                                           clojure.core/let
+  metabase.app-db.connection/with-unshared-connection                                   clojure.core/fn
+  metabase.app-db.core/with-unshared-connection                                         clojure.core/fn
   metabase.app-db.custom-migrations.util/with-temp-scheduler!                           clojure.core/fn
   metabase.app-db.custom-migrations/define-migration                                    clj-kondo.lint-as/def-catch-all
   metabase.app-db.custom-migrations/define-reversible-migration                         clj-kondo.lint-as/def-catch-all
@@ -488,7 +504,9 @@
   metabase.query-processor.pipeline-queries-test/mbql5-query                            clojure.core/->
   metabase.query-processor.pipeline-queries-test/run-mbql5-query                        clojure.core/->
   metabase.query-processor.error-type/deferror                                          clojure.core/def
+  metabase.query-processor.core/with-reducible-deserialized-results                     clojure.core/let
   metabase.query-processor.middleware.cache.impl/with-reducible-deserialized-results    clojure.core/let
+  metabase.query-processor.result-serialization/with-reducible-deserialized-results     clojure.core/let
   metabase.query-processor.middleware.process-userland-query-test/with-query-execution! clojure.core/let
   metabase.query-processor.setup/with-qp-setup                                          clojure.core/let
   metabase.search.api-test/do-test-users                                                clojure.core/let
@@ -505,7 +523,6 @@
   metabase.test.data.interface/defdataset                                               clojure.core/def
   metabase.test.data.interface/defdataset-edn                                           clojure.core/def
   metabase.test.embedded-postgres.core/with-system                                      clojure.core/let
-  metabase.test.gentest/defgentest                                                      clojure.test/deftest
   metabase.test/defdataset                                                              clojure.core/def
   metabase.test/let-url                                                                 clojure.core/let
   metabase.test/with-actions                                                            clojure.core/let
@@ -516,6 +533,7 @@
   metabase.test/with-temp-empty-app-db                                                  clojure.core/let
   metabase.test/with-temp-file                                                          clojure.core/let
   metabase.test/with-user-in-groups                                                     clojure.core/let
+  metabase.transforms-rest.api.transform-runs-test/with-runs-fixture!                   clojure.core/fn
   metabase.upload.impl-test/with-upload-table!                                          clojure.core/let
   metabase.util/for-map                                                                 clojure.core/for
   metabase.util.files/with-open-path-to-resource                                        clojure.core/let
@@ -581,7 +599,7 @@
    metabase.api.common.internal-test/with-jetty-server                                                                       hooks.common/with-one-binding
    metabase.api.macros/defendpoint                                                                                           hooks.metabase.api.macros/defendpoint
    metabase.app-db.schema-migrations-test.impl/test-migrations                                                               hooks.metabase.app-db.schema-migrations-test.impl/test-migrations
-   metabase.channel.render.js.svg/with-static-viz-context                                                                    hooks.common/with-one-top-level-binding
+   metabase.channel.render.js.pool/with-static-viz-context                                                                   hooks.common/with-one-top-level-binding
    metabase.channel.template.handlebars-helper/defhelper                                                                     hooks.metabase.channel.template.handlebars-helper/defhelper
    metabase.channel.template.handlebars-test/with-temp-template!                                                             hooks.common/with-vec-first-binding
    metabase.classloader.core/require                                                                                         hooks.clojure.core.require/lint-require
@@ -614,9 +632,13 @@
    metabase.lib.test-util.macros/mbql-query                                                                                  hooks.metabase.test.data/mbql-query
    metabase.lib.test-util.macros/mbql-5-query                                                                                hooks.metabase.test.data/mbql-query
    metabase.lib.test-util.macros/with-testing-against-standard-queries                                                       hooks.metabase.lib.test-util.macros/with-testing-against-standard-queries
+   metabase.metrics.api-dimension-test/with-seeded-metric                                                                    hooks.common/with-one-binding
    metabase.model-persistence.api-test/with-persistence-setup!                                                               hooks.common/with-one-top-level-binding
    metabase.model-persistence.api-test/with-setup!                                                                           hooks.common/with-one-top-level-binding
    metabase.model-persistence.test-util/with-persistence-enabled!                                                            hooks.metabase.model-persistence.test-util/with-persistence-enabled!
+   metabase.mq.core/with-queue                                                                                               hooks.common/let-second
+   metabase.mq.test-util/with-test-mq                                                                                        hooks.common/with-one-binding
+   metabase.mq.core/def-listener!                                                                                            hooks.metabase.mq.impl/def-listener
    metabase.models.interface/define-batched-hydration-method                                                                 hooks.metabase.models.interface/define-hydration-method
    metabase.models.interface/define-simple-hydration-method                                                                  hooks.metabase.models.interface/define-hydration-method
    metabase.permissions.core/allow-changing-all-users-group-members                                                          hooks.common/do*
@@ -659,7 +681,6 @@
    metabase.test.data/dataset                                                                                                hooks.metabase.test.data/dataset
    metabase.test.data/mbql-query                                                                                             hooks.metabase.test.data/mbql-query
    metabase.test.data/run-mbql-query                                                                                         hooks.metabase.test.data/mbql-query
-   metabase.test.gentest/iterate                                                                                             hooks.metabase.test.gentest/iterate*
    metabase.test.util.async/with-open-channels                                                                               hooks.common/let-with-optional-value-for-last-binding
    metabase.test.util.generators.jvm/with-random-cards                                                                       hooks.metabase.test.util.generators.jvm/with-random-cards
    metabase.test.util.log/with-log-level                                                                                     hooks.common/with-ignored-first-arg
@@ -708,6 +729,10 @@
    metabase.util.log/warn                                                                                                    hooks.metabase.util.log/info
    metabase.util.log/warnf                                                                                                   hooks.metabase.util.log/infof
    metabase.util.malli.registry/def                                                                                          hooks.metabase.util.malli.registry/def
+   metabase.util.match/match-one                                                                                             hooks.metabase.util.match/match-one
+   metabase.util.match/match-many                                                                                            hooks.metabase.util.match/match-many
+   metabase.util.match/replace                                                                                               hooks.metabase.util.match/replace
+   metabase.util.match/replace-in                                                                                            hooks.metabase.util.match/replace-in
    metabase.util/case-enum                                                                                                   hooks.metabase.util/case-enum
    metabase.util/format-color                                                                                                hooks.metabase.util/format-color
    metabase.xrays.api.automagic-dashboards-test/with-indexed-model!                                                          hooks.metabase.xrays.api.automagic-dashboards-test/with-indexed-model!
@@ -721,6 +746,7 @@
    clojurewerkz.quartzite.schedule.simple/schedule                                              macros.quartz/simple-schedule
    clojurewerkz.quartzite.triggers/build                                                        macros.quartz/build-trigger
    metabase-enterprise.database-routing.e2e-test/with-temp-dbs!                                 macros.metabase-enterprise.database-routing.e2e-test/with-temp-dbs!
+   metabase-enterprise.database-routing.e2e-test/with-routing-setup!                            macros.metabase-enterprise.database-routing.e2e-test/with-routing-setup!
    metabase-enterprise.impersonation.util-test/with-impersonations!                             macros.metabase-enterprise.impersonation.util-test/with-impersonations!
    metabase-enterprise.query-reference-validation.api-test/with-test-setup!                     macros.metabase-enterprise.query-reference-validation.api-test/with-test-setup!
    metabase-enterprise.sandbox.test-util/with-gtaps!                                            macros.metabase-enterprise.sandbox.test-util/with-gtaps!
@@ -751,6 +777,7 @@
    metabase.test/with-temporary-raw-setting-values                                              macros.metabase.test.util/with-temporary-raw-setting-values
    metabase.users.models.user-test/with-groups!                                                 macros.metabase.users.models.user-test/with-groups!
    metabase.util.namespaces/import-fn                                                           macros.metabase.util.namespaces/import-fn
+   metabase.util.namespaces/import-macro                                                        macros.metabase.util.namespaces/import-macro
    metabase.xrays.related-test/with-world                                                       macros.metabase.xrays.related-test/with-world}}
 
  :config-in-comment
@@ -833,6 +860,11 @@
   metabase.util.time-test
   {:linters {:metabase/prefer-with-dynamic-fn-redefs {:level :off}}}
 
+  ;; classloader sits below `util` in the module graph, so it can't use `metabase.util.log` without creating
+  ;; a cycle; it gets to use tools.logging directly.
+  metabase.classloader.impl
+  {:linters {:discouraged-namespace {clojure.tools.logging {:level :off}}}}
+
   source-namespaces
   {:linters
    {:metabase/discourage-millis-duration               {:level :warning}

.clj-kondo/config/test-helpers/config.edn

@@ -36,6 +36,9 @@
      ;; Definitely thread safe
      metabase.test.util.dynamic-redefs/patch-vars!
 
+     ;; test-only cleanup of in-memory throttle state (atom resets)
+     metabase.session.api/reset-throttlers-for-testing!
+
      ;; TODO: most of these symbols shouldn't be here, we should go through them and
      ;; find the functions/macros that use them and make sure their names end with !
      ;; best way to do this is try remove each of these and rely on kondo output to find places where it's used

.clj-kondo/macros/metabase/util/namespaces.clj

@@ -6,3 +6,8 @@
    `(def ~(-> sym name symbol) "docstring" ~sym))
   ([sym name]
    `(def ~name "docstring" ~sym)))
+
+(defmacro import-macro
+  "Kondo macro replacement for [[metabase.util.namespaces/import-macro]]."
+  [sym]
+  `(def ~(-> sym name symbol) "docstring" ~sym))

.clj-kondo/macros/metabase_enterprise/database_routing/e2e_test.clj

@@ -3,3 +3,8 @@
 (defmacro with-temp-dbs! [bindings & body]
   `(let [~@(interleave bindings (repeat nil))]
      ~@body))
+
+(defmacro with-routing-setup! [[router-binding destinations] & body]
+  `(let [~router-binding nil
+         ~@(interleave (map first destinations) (repeat nil))]
+     ~@body))

.clj-kondo/ratchets.edn

@@ -0,0 +1,48 @@
+;; Per-linter budgets for inline `:clj-kondo/ignore` forms.
+;; metabase.core.kondo-ratchet-test fails when the budgets drift from the actual counts.
+;; `./bin/mage fix-kondo-ratchets` lowers budgets to match the tree; local test runs do it
+;; automatically. Raising a budget, or adding one for a new linter (`--seed`), is a hand edit
+;; to defend in your PR.
+;; :all is the vector-less ignore form, which suppresses every linter on the next form.
+{:ignore-counts {:aliased-namespace-symbol                                            3
+                 :all                                                                 49
+                 :case-symbol-test                                                    1
+                 :clojure-lsp/unused-public-var                                       9
+                 :def-fn                                                              1
+                 :deprecated-namespace                                                95
+                 :deprecated-var                                                      79
+                 :discouraged-java-method                                             3
+                 :discouraged-namespace                                               79
+                 :discouraged-var                                                     107
+                 :equals-true                                                         1
+                 :main-without-gen-class                                              1
+                 :metabase/defsetting-namespace                                       2
+                 :metabase/disallow-hardcoded-driver-names-in-tests                   34
+                 :metabase/discourage-millis-duration                                 1
+                 :metabase/i-like-making-cams-eyes-bleed-with-horrifically-long-tests 13
+                 :metabase/modules                                                    7
+                 :metabase/namespace-name                                             4
+                 :metabase/prefer-with-dynamic-fn-redefs                              28
+                 :metabase/test-helpers-use-non-thread-safe-functions                 17
+                 :metabase/validate-defendpoint-has-response-schema                   441
+                 :metabase/validate-defendpoint-query-params-use-kebab-case           47
+                 :metabase/validate-defendpoint-route-uses-kebab-case                 44
+                 :metabase/validate-deftest                                           9
+                 :missing-docstring                                                   10
+                 :missing-protocol-method                                             3
+                 :non-arg-vec-return-type-hint                                        1
+                 :reduce-without-init                                                 3
+                 :redundant-fn-wrapper                                                1
+                 :syntax                                                              2
+                 :uninitialized-var                                                   1
+                 :unquote-not-syntax-quoted                                           1
+                 :unresolved-namespace                                                3
+                 :unresolved-require                                                  1
+                 :unresolved-symbol                                                   4
+                 :unsorted-required-namespaces                                        1
+                 :unused-alias                                                        1
+                 :unused-binding                                                      9
+                 :unused-excluded-var                                                 2
+                 :unused-namespace                                                    1
+                 :unused-private-var                                                  8
+                 :unused-value                                                        1}}

.clj-kondo/src/hooks/clojure/test.clj

@@ -153,6 +153,7 @@
          "build."
          "i18n." ; bin/i18n
          "lint-migrations-file-test"
+         "mage."
          "main-test" ; bin/release-list
          "metabase.deps-edn-test"
          "metabase.driver."

.clj-kondo/src/hooks/metabase/mq/impl.clj

@@ -0,0 +1,18 @@
+(ns hooks.metabase.mq.impl
+  (:require
+   [clj-kondo.hooks-api :as hooks]))
+
+(defn def-listener
+  "Kondo hook for `mq/def-listener`. Rewrites to a `fn` form so kondo can analyze bindings.
+
+   Form:
+     (mq/def-listener! :queue/bar [msgs] body...)"
+  [{:keys [node]}]
+  (let [[_ _channel-name bindings & body] (:children node)
+        ;; rewrite as: (fn [bindings...] body...)
+        new-node (hooks/list-node
+                  (list*
+                   (hooks/token-node 'fn)
+                   bindings
+                   body))]
+    {:node new-node}))

.clj-kondo/src/hooks/metabase/test/gentest.clj

@@ -1,14 +0,0 @@
-(ns hooks.metabase.test.gentest
-  (:require
-   [clj-kondo.hooks-api :as hooks]))
-
-(defn iterate*
-  "(iterate {:as limit-spec} [s1 val1 & more] body-form body-form...)"
-  [{{:keys [children] :as node} :node :as orig}]
-  (let [[token limit-spec bindings & body-nodes] children
-        node* (-> (hooks/list-node
-                   (list token limit-spec
-                         (hooks/list-node (list* (hooks/token-node 'let) bindings
-                                                 body-nodes))))
-                  (with-meta (meta node)))]
-    (assoc orig :node node*)))

.clj-kondo/src/hooks/metabase/util/match.clj

@@ -0,0 +1,132 @@
+(ns hooks.metabase.util.match
+  (:require [clj-kondo.hooks-api :as api]))
+
+(defn- token-node? [node token-name]
+  (and (api/token-node? node)
+       (= (str (:value node)) token-name)))
+
+(defn- keyword-node? [node k]
+  (and (api/keyword-node? node)
+       (= (:k node) k)))
+
+(defn- binding-symbol?
+  "True when the token is a plain symbol that should be treated as a binding
+  (not a keyword, not a boolean literal, not nil, not a number, not `_`)."
+  [node]
+  (and (api/token-node? node)
+       (let [v (:value node)]
+         (and (symbol? v)
+              (not (contains? '#{_ nil true false} v))))))
+
+;; To establish fake let bindings, we need to bind them to something. This "something" has to be vague enough to trick
+;; kondo into not looking too much into it. E.g., if we bind everything to `nil`, Kondo linters will get fired up.
+(def opaque-node (api/list-node (list (api/token-node 'rand-nth) (api/list-node []))))
+
+(defn collect-bindings
+  "Return a list of token nodes (symbols) introduced as bindings by `pattern`."
+  [pattern]
+  (cond
+    (binding-symbol? pattern)
+    [[pattern opaque-node]]
+
+    ;; Lists: (:or ...), (:and ...), (sym :guard pred ...), or a quoted symbol.
+    (api/list-node? pattern)
+    (let [[head & rst] (:children pattern)]
+      (cond (or (keyword-node? head :or)
+                (keyword-node? head :and))
+            (mapcat collect-bindings rst)
+
+            (api/token-node? head)
+            (cond-> []
+              (binding-symbol? head) (conj [head opaque-node])
+              (keyword-node? (first rst) :guard) (conj [(api/token-node '_) (second rst)]))
+
+            ;; anything else (e.g. a function call used as predicate) — no bindings
+            :else []))
+
+    (api/vector-node? pattern)
+    (mapcat (fn [node]
+              (when-not (token-node? node "&")
+                (collect-bindings node)))
+            (:children pattern))
+
+    ;; Maps: keys are literal selectors, values are sub-patterns.
+    ;; Special value-symbols &truthy and _ are NOT user bindings.
+    (api/map-node? pattern)
+    (let [children (:children pattern)
+          pairs    (partition 2 children)]
+      (mapcat (fn [[_k v]]
+                (when-not (or (token-node? v "&truthy")
+                              (token-node? v "_"))
+                  (collect-bindings v)))
+              pairs))
+
+    ;; For sets, make sure to use them because they may reference some of the outer local bindings, so if we don't
+    ;; include them, Kondo will complain about those bindings being unused.
+    (api/set-node? pattern)
+    [[(api/token-node '_) pattern]]
+
+    ;; Anything else — no bindings.
+    :else []))
+
+(defn- dedupe-bindings
+  "Prevent Kondo complaining that we have multiple fake bindings."
+  [pairs]
+  (loop [[[sym v] & r] pairs, seen #{}, result []]
+    (cond (nil? sym) result
+          (and (seen sym) (not (token-node? sym "_"))) (recur r seen result)
+          :else (recur r (conj seen sym) (conj result sym v)))))
+
+(defn match-one
+  "clj-kondo :analyze-call hook for match-one.
+
+  Rewrites
+
+    (match-one value
+      pat1 ret1
+      pat2 ret2
+      ...)
+
+  into a `let` form that declares all binding symbols introduced by the patterns, so clj-kondo knows they are
+  legitimate and won't warn about unresolved/unused symbols:
+
+    (let [<all-bindings> (rand-nth []) ...]
+      (or ret1 ret2 ...))"
+  [{:keys [node]}]
+  (let [[_ value & clauses] (:children node)]
+    (when (odd? (count clauses))
+      (api/reg-finding!
+       {:message  "match-one/match-many/replace requires an even number of pattern/result pairs"
+        :type     :metabase/match-odd-clauses
+        :row      (:row node)
+        :col      (:col node)
+        :filename (-> node meta :filename)}))
+    (let [pairs (partition 2 clauses)
+          all-bindings (->> pairs
+                            (mapcat (fn [[pat _ret]] (collect-bindings pat)))
+                            dedupe-bindings)
+          special-bindings [(api/token-node '_)        value
+                            (api/token-node '&match)   opaque-node
+                            (api/token-node '&parents) opaque-node
+                            (api/token-node '&recur)   opaque-node
+                            ;; Pretend to use &match, &parents, and &recur so that Kondo doesn't complain about them
+                            ;; if they are not used by the user code.
+                            (api/token-node '_) (api/token-node '&match)
+                            (api/token-node '_) (api/token-node '&parents)
+                            (api/token-node '_) (api/token-node '&recur)]
+          binding-nodes (into special-bindings all-bindings)
+          result-exprs (map second pairs)
+          new-node (api/list-node
+                    (list
+                     (api/token-node 'let)
+                     (api/vector-node binding-nodes)
+                     (api/list-node
+                      (concat [(api/token-node 'clojure.core/or)] result-exprs [opaque-node]))))]
+      {:node new-node})))
+
+(def match-many match-one)
+(def replace match-one)
+
+(defn replace-in [context]
+  ;; Everything is the same as in match-one, just drop the middle argument.
+  (match-one (update-in context [:node :children] (fn [[sym value path & clauses]] (list* sym value clauses)))))

.clj-kondo/test/hooks/metabase/util/match_test.clj

@@ -0,0 +1,59 @@
+(ns hooks.metabase.util.match-test
+  (:require
+   [clj-kondo.hooks-api :as hooks]
+   [clj-kondo.impl.utils]
+   [clojure.test :refer :all]
+   [hooks.metabase.util.match :as sut]))
+
+(defn- expand [src]
+  (-> (sut/match-one {:node (hooks/parse-string (pr-str src))})
+      :node
+      hooks/sexpr))
+
+(defn- lint [src]
+  (binding [clj-kondo.impl.utils/*ctx* {:config     {:linters {:metabase/match-odd-clauses {:level :warning}}}
+                                        :ignores    (atom nil)
+                                        :findings   (atom [])
+                                        :namespaces (atom {})}]
+    (expand src)
+    @(:findings clj-kondo.impl.utils/*ctx*)))
+
+(deftest odd-clauses-triggers-warning-test
+  (is (=? [{:type :metabase/match-odd-clauses}]
+          (lint '(metabase.util.match/match-one [] [a b c])))))
+
+(deftest expansion-test
+  (testing "simple expansion example"
+    (is (= '(let [_ []
+                  &match (rand-nth ())
+                  &parents (rand-nth ())
+                  &recur (rand-nth ())
+                  _ &match
+                  _ &parents
+                  _ &recur
+                  a (rand-nth ())
+                  b (rand-nth ())
+                  c (rand-nth ())]
+              (clojure.core/or (+ a b) (rand-nth ())))
+           (expand '(match-one [] [a b c] (+ a b))))))
+  (testing "complicated expansion example that uses most match-one macro features, and also binding deduplication by the rewriter"
+    (is (= '(let [_ []
+                  &match (rand-nth ())
+                  &parents (rand-nth ())
+                  &recur (rand-nth ())
+                  _ &match
+                  _ &parents
+                  _ &recur
+                  val1 (rand-nth ())
+                  a (rand-nth ())
+                  _ #{maybe important}
+                  rst (rand-nth ())
+                  x (rand-nth ())
+                  _ (= x 3)
+                  b (rand-nth ())]
+              (clojure.core/or (+ a val1) (rand-nth ())))
+           (expand '(match-one []
+                               (:or [{:key1 val1, :key2 &truthy, :key3 _} _ a #{maybe important} & rst]
+                                    (:and (x :guard (= x 3))
+                                          [a b]))
+                               (+ a val1)))))))

.coderabbit.yaml

@@ -0,0 +1,28 @@
+# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
+reviews:
+  high_level_summary: false
+  review_status: false
+
+  auto_review:
+    enabled: false
+    drafts: true
+    labels:
+      - "coderabbit"
+
+  path_filters:
+    - "!**/*.snap"
+    - "!**/*.po"
+    - "!**/bun.lock"
+    - "!**/package-lock.json"
+
+  tools:
+    eslint:
+      enabled: false
+
+knowledge_base:
+  code_guidelines:
+    filePatterns:
+      - ".claude/skills/clojure-review/SKILL.md"
+      - ".claude/skills/typescript-review/SKILL.md"
+      - ".claude/skills/e2e-test-review/SKILL.md"
+      - ".claude/skills/docs-review/SKILL.md"

.devcontainer/Dockerfile

@@ -1,4 +1,4 @@
-FROM mcr.microsoft.com/vscode/devcontainers/java:21
+FROM mcr.microsoft.com/vscode/devcontainers/java:25
 
 # Set up nodesource, install node, bun, fontconfig for static viz, rlwrap for dev ergonomics
 

.dockerignore

@@ -1,5 +1,6 @@
+.git
 .babel_cache
-target/*
+target
 .circleci
 .cpcache
 .devcontainer
@@ -15,6 +16,7 @@ test_config/*
 test_modules/*
 test_resources/*
 node_modules
+**/node_modules
 **metabase.jar
 
 *.db

.github/CODEOWNERS

@@ -10,6 +10,7 @@ src/metabase/query_processor @metabase/core-backend-querying-platform
 src/metabase/graph @metabase/graphy
 enterprise/backend/src/metabase_enterprise/dependencies @metabase/graphy
 enterprise/frontend/src/metabase-enterprise/dependencies @metabase/graphy
+enterprise/frontend/src/metabase-enterprise/monitor/dependency-diagnostics @metabase/graphy
 
 # @metabase/embedding
 
@@ -49,5 +50,5 @@ docs/installation-and-operation/commands.md # auto-generated
 src/metabase/analytics/prometheus.clj @metabase/cloud-ops
 
 # @metabase/metabot-frontend
-enterprise/frontend/src/metabase-enterprise/metabot @metabase/metabot-frontend 
+enterprise/frontend/src/metabase-enterprise/metabot @metabase/metabot-frontend
 frontend/src/metabase/metabot @metabase/metabot-frontend

.github/actionlint.yaml

@@ -0,0 +1,13 @@
+self-hosted-runner:
+  # Custom runner labels that actionlint cannot know about. Everything else is
+  # selected through `vars.DEFAULT_RUNNER_KEY` and is not checked.
+  labels:
+    - arm-ubuntu-24-2core
+
+paths:
+  # GitHub added parallel steps (`parallel`, `background`, `wait`, `wait-all`,
+  # `cancel`) in June 2026, and actionlint 1.7.12 does not know the schema yet:
+  # https://github.blog/changelog/2026-06-25-actions-steps-can-now-be-run-in-parallel/
+  .github/workflows/lint.yml:
+    ignore:
+      - 'step must run script with "run" section or run action with "uses" section'

.github/actions/bundle-size-check/action.yml

@@ -0,0 +1,114 @@
+name: Bundle Size Check
+description: |
+  Measures app + embedding SDK bundle sizes from the current and base-ref
+  uberjars (reusing the builds that already ran) plus their bundle-stats
+  artifacts, and flags gzipped size changes beyond the threshold for the main
+  app's initial bundle and the chunked SDK's reachable total. Skips when the
+  base-ref artifacts aren't available rather than rebuilding from source (which
+  would compare across pipelines).
+
+inputs:
+  edition:
+    description: 'Metabase edition (ee or oss)'
+    required: true
+  base-ref-commit:
+    description: 'Commit SHA of the base ref.'
+    required: true
+  threshold-percent:
+    description: 'Percent threshold for bundle size change'
+    required: true
+
+outputs:
+  app_status:
+    description: "App initial bundle status: increased, decreased, or stable"
+    value: ${{ steps.compare.outputs.app_initial_status }}
+  app_size_change_percent:
+    description: "App initial bundle size change percent (positive = increase, negative = decrease)"
+    value: ${{ steps.compare.outputs.app_initial_size_change_percent }}
+  sdk_status:
+    description: "Chunked SDK bundle status: increased, decreased, or stable"
+    value: ${{ steps.compare.outputs.embedding_sdk_chunked_total_status }}
+  sdk_size_change_percent:
+    description: "Chunked SDK bundle size change percent (positive = increase, negative = decrease)"
+    value: ${{ steps.compare.outputs.embedding_sdk_chunked_total_size_change_percent }}
+
+runs:
+  using: "composite"
+  steps:
+    - name: Download current uberjar
+      uses: ./.github/actions/fetch-artifact
+      with:
+        commit: ${{ github.event.pull_request.head.sha || github.sha }}
+        edition: ${{ inputs.edition }}
+        extract-path: temp/current-uberjar
+    - name: Download base-ref uberjar
+      id: base-jar
+      continue-on-error: true
+      uses: ./.github/actions/fetch-artifact
+      with:
+        commit: ${{ inputs.base-ref-commit }}
+        edition: ${{ inputs.edition }}
+        extract-path: temp/base-uberjar
+    - name: Measure and compare bundle sizes
+      id: compare
+      shell: bash
+      env:
+        GH_TOKEN: ${{ github.token }}
+        EDITION: ${{ inputs.edition }}
+        HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+        BASE_SHA: ${{ inputs.base-ref-commit }}
+        THRESHOLD: ${{ inputs.threshold-percent }}
+        MEASURE_BUNDLES: app,embedding-sdk-legacy,embedding-sdk-chunked
+        # The gated bundles, as "<bundle>/<kind>". Each one's step outputs are
+        # named after its key (see outputPrefix in compare.js), which is what the
+        # action outputs above read.
+        GATES: app/initial,embedding-sdk-chunked/total
+      run: |
+        set -uo pipefail
+
+        skip() {
+          echo "::notice::Bundle-size check skipped: $1"
+          for gate in ${GATES//,/ }; do
+            prefix=$(printf '%s' "$gate" | tr -c 'a-zA-Z0-9' '_')
+            echo "${prefix}_status=stable" >> "$GITHUB_OUTPUT"
+            echo "${prefix}_size_change_percent=0" >> "$GITHUB_OUTPUT"
+          done
+          exit 0
+        }
+
+        # The base ref needs an already-built uberjar. Rebuilding it from source
+        # would compare across two build pipelines (the bug this check used to
+        # have), so skip instead when it — or its stats — isn't available.
+        [ -f temp/base-uberjar/metabase.jar ] || skip "base-ref uberjar not found for ${BASE_SHA}"
+
+        extract_js() { # $1=jar  $2=dest-root
+          mkdir -p "$2/resources"
+          unzip -o "$1" \
+            "frontend_client/app/dist/*" \
+            "frontend_client/app/embed.js" \
+            "frontend_client/app/embedding-sdk/*" \
+            -d "$2/resources" >/dev/null || true
+        }
+
+        fetch_stats() { # $1=sha  $2=dest-dir
+          local name="metabase-bundle-stats-${EDITION}-$1"
+          local id
+          id=$(gh api "/repos/${GITHUB_REPOSITORY}/actions/artifacts?name=${name}" --jq '.artifacts[0].id // empty' 2>/dev/null)
+          [ -n "${id}" ] || return 1
+          mkdir -p "$2"
+          gh api "/repos/${GITHUB_REPOSITORY}/actions/artifacts/${id}/zip" > "$2.zip" 2>/dev/null || return 1
+          unzip -o "$2.zip" -d "$2" >/dev/null || return 1
+        }
+
+        extract_js temp/current-uberjar/metabase.jar temp/current
+        extract_js temp/base-uberjar/metabase.jar temp/base
+
+        fetch_stats "${HEAD_SHA}" temp/current/artifacts || skip "bundle stats not found for current ${HEAD_SHA}"
+        fetch_stats "${BASE_SHA}" temp/base/artifacts || skip "bundle stats not found for base ${BASE_SHA}"
+
+        MEASURE_ROOT=temp/current node ./.github/scripts/measure-bundle-sizes.js > temp/current-sizes.json \
+          || { echo "::error::Failed to measure current bundle sizes"; exit 1; }
+        MEASURE_ROOT=temp/base node ./.github/scripts/measure-bundle-sizes.js > temp/base-sizes.json \
+          || { echo "::error::Failed to measure base bundle sizes"; exit 1; }
+
+        node ./.github/actions/bundle-size-check/compare.js temp/current-sizes.json temp/base-sizes.json

.github/actions/bundle-size-check/compare.js

@@ -0,0 +1,133 @@
+/* eslint-disable import/no-commonjs */
+// Diffs the bundle sizes produced by measure-bundle-sizes.js for the current
+// build and the base ref. Every (bundle, kind) is compared strictly against the
+// same (bundle, kind) — never one bundle type against another — using gzipped
+// (served) bytes.
+//
+// The report covers every measured bundle; the gates are the subset that drives
+// PR comments, named as "<bundle>/<kind>" (e.g. "app/initial",
+// "embedding-sdk-chunked/total").
+//
+// compareBundles is pure (data in, data out) so it can be unit-tested; main()
+// is the thin I/O wrapper that reads the size files, prints the report and sets
+// the step outputs / exit code.
+const fs = require("fs");
+
+const pick = (rows, bundle, kind) => rows.find(row => row.bundle === bundle && row.kind === kind);
+const keyOf = row => `${row.bundle}/${row.kind}`;
+const mb = bytes => (bytes / 1024 / 1024).toFixed(2);
+const percentOf = (currentBytes, baseBytes) =>
+  baseBytes ? Math.trunc(((currentBytes - baseBytes) * 100) / baseBytes) : 0;
+
+// Output names are derived from the gate key, so the workflow reads
+// `app_initial_status`, `embedding_sdk_chunked_total_status`, and so on.
+const outputPrefix = gateKey => gateKey.replace(/[^a-zA-Z0-9]+/g, "_");
+
+/**
+ * Evaluate one gate. Returns the key plus exactly one of:
+ *  - `status` / `percent`: the bundle moved by `percent`.
+ *  - `skip`  reason: the gate is non-actionable (reported stable, no comment).
+ *  - `error` reason: the gate inputs are missing (hard failure).
+ */
+function evaluateGate({ current, base, threshold, gateKey }) {
+  const [bundle, kind] = gateKey.split("/");
+  const gateCurrent = pick(current, bundle, kind);
+  const gateBase = pick(base, bundle, kind);
+  if (!gateCurrent || !gateBase || !gateBase.gzipBytes) {
+    return { gateKey, error: `Could not find ${bundle} ${kind} (gzip) in both builds` };
+  }
+
+  // Both sides must measure the bundle the same way. A base ref built before the
+  // reachableAssets enrichment collapses its total to the initial set, so
+  // comparing it against the current reachable total reports a phantom jump
+  // (~30%). Skip until the base ref also carries reachable stats.
+  if (Boolean(gateCurrent.reachable) !== Boolean(gateBase.reachable)) {
+    return {
+      gateKey,
+      skip:
+        `"${gateKey}" measured differently on each side ` +
+        `(current reachable=${Boolean(gateCurrent.reachable)}, base reachable=${Boolean(gateBase.reachable)}); ` +
+        `the base ref predates the reachable-chunk stats. Resolves once this change is on the base ref.`,
+    };
+  }
+
+  const percent = percentOf(gateCurrent.gzipBytes, gateBase.gzipBytes);
+  const status = percent > threshold ? "increased" : percent < -threshold ? "decreased" : "stable";
+  return { gateKey, status, percent };
+}
+
+/**
+ * Compare two measurement sets and evaluate every gate. Returns a
+ * human-readable `report` over all measured bundles plus one entry per gate.
+ */
+function compareBundles({ current, base, threshold, gateKeys }) {
+  const report = ["=== Bundle sizes (gzipped, current vs base) ==="];
+  const keys = [...new Set([...current, ...base].map(keyOf))].sort();
+  for (const key of keys) {
+    const [bundle, kind] = key.split("/");
+    const currentRow = pick(current, bundle, kind);
+    const baseRow = pick(base, bundle, kind);
+    if (!currentRow || !baseRow) {
+      report.push(`${key}: present only in ${currentRow ? "current" : "base"} build`);
+      continue;
+    }
+    const diff = currentRow.gzipBytes - baseRow.gzipBytes;
+    const percent = percentOf(currentRow.gzipBytes, baseRow.gzipBytes);
+    report.push(`${key}: ${mb(currentRow.gzipBytes)}MB vs ${mb(baseRow.gzipBytes)}MB (${percent}%, ${diff} bytes)`);
+  }
+
+  return { report, gates: gateKeys.map(gateKey => evaluateGate({ current, base, threshold, gateKey })) };
+}
+
+module.exports = { compareBundles, outputPrefix };
+
+const setOutput = (name, value) => {
+  if (process.env.GITHUB_OUTPUT) {
+    fs.appendFileSync(process.env.GITHUB_OUTPUT, `${name}=${value}\n`);
+  }
+};
+
+function main() {
+  const [, , currentPath, basePath] = process.argv;
+  const threshold = Number(process.env.THRESHOLD ?? 2);
+  const gateKeys = (process.env.GATES ?? "embedding-sdk-chunked/total").split(",").map(key => key.trim());
+
+  const current = JSON.parse(fs.readFileSync(currentPath, "utf8"));
+  const base = JSON.parse(fs.readFileSync(basePath, "utf8"));
+
+  const { report, gates } = compareBundles({ current, base, threshold, gateKeys });
+  console.log(report.join("\n"));
+  console.log("");
+
+  for (const gate of gates) {
+    const prefix = outputPrefix(gate.gateKey);
+
+    if (gate.error) {
+      // One broken gate must not hide the others, so report them all and fail
+      // the step at the end.
+      console.error(`::error::${gate.error}`);
+      continue;
+    }
+
+    if (gate.skip) {
+      // Treat the gate as non-actionable: report stable so no regression comment
+      // is posted, mirroring the shell skip() for missing artifacts.
+      console.log(`::notice::Bundle-size gate skipped: ${gate.skip}`);
+      setOutput(`${prefix}_status`, "stable");
+      setOutput(`${prefix}_size_change_percent`, "0");
+      continue;
+    }
+
+    console.log(`Gate: ${gate.gateKey} ${gate.percent}% (threshold ${threshold}%) → ${gate.status}`);
+    setOutput(`${prefix}_status`, gate.status);
+    setOutput(`${prefix}_size_change_percent`, gate.percent);
+  }
+
+  if (gates.some(gate => gate.error)) {
+    process.exit(1);
+  }
+}
+
+if (require.main === module) {
+  main();
+}

.github/actions/bundle-size-check/compare.unit.spec.js

@@ -0,0 +1,84 @@
+const { compareBundles, outputPrefix } = require("./compare");
+
+const SDK_GATE = "embedding-sdk-chunked/total";
+const APP_GATE = "app/initial";
+
+const total = (gzipBytes, over = {}) => ({
+  bundle: "embedding-sdk-chunked",
+  kind: "total",
+  gzipBytes,
+  reachable: true,
+  ...over,
+});
+
+const appInitial = gzipBytes => ({ bundle: "app", kind: "initial", gzipBytes });
+
+const compare = ({ current, base, threshold = 2, gateKeys = [SDK_GATE] }) =>
+  compareBundles({ current, base, threshold, gateKeys });
+
+describe("outputPrefix", () => {
+  it("turns a gate key into a step-output prefix", () => {
+    expect(outputPrefix(APP_GATE)).toBe("app_initial");
+    expect(outputPrefix(SDK_GATE)).toBe("embedding_sdk_chunked_total");
+  });
+});
+
+describe("compareBundles", () => {
+  it("gates on the chunked SDK total and flags an increase past the threshold", () => {
+    const { gates, report } = compare({ current: [total(110)], base: [total(100)] });
+
+    expect(gates).toEqual([{ gateKey: SDK_GATE, status: "increased", percent: 10 }]);
+    expect(report[0]).toContain("current vs base");
+  });
+
+  it("flags a decrease and stays stable within the threshold", () => {
+    expect(compare({ current: [total(90)], base: [total(100)] }).gates[0]).toMatchObject({
+      status: "decreased",
+      percent: -10,
+    });
+    expect(compare({ current: [total(101)], base: [total(100)] }).gates[0]).toMatchObject({
+      status: "stable",
+      percent: 1,
+    });
+  });
+
+  it("evaluates each gate against its own bundle", () => {
+    const { gates } = compare({
+      current: [total(100), appInitial(110)],
+      base: [total(100), appInitial(100)],
+      gateKeys: [APP_GATE, SDK_GATE],
+    });
+
+    expect(gates).toEqual([
+      { gateKey: APP_GATE, status: "increased", percent: 10 },
+      { gateKey: SDK_GATE, status: "stable", percent: 0 },
+    ]);
+  });
+
+  it("skips when the two sides measured a gate differently (reachable mismatch)", () => {
+    const { gates } = compare({
+      current: [total(130, { reachable: true })],
+      base: [total(100, { reachable: false })],
+    });
+
+    expect(gates[0].status).toBeUndefined();
+    expect(gates[0].skip).toContain("predates the reachable-chunk stats");
+  });
+
+  it("errors when a gate bundle is missing on either side, without hiding the others", () => {
+    const { gates } = compare({
+      current: [appInitial(100)],
+      base: [appInitial(100)],
+      gateKeys: [APP_GATE, SDK_GATE],
+    });
+
+    expect(gates[0]).toEqual({ gateKey: APP_GATE, status: "stable", percent: 0 });
+    expect(gates[1].error).toContain("embedding-sdk-chunked total");
+  });
+
+  it("reports a bundle/kind present on only one side without erroring", () => {
+    const { report } = compare({ current: [total(100), appInitial(50)], base: [total(100)] });
+
+    expect(report.some(line => line.includes("present only in current build"))).toBe(true);
+  });
+});

.github/actions/create-backport/action.yml

@@ -1,4 +1,5 @@
 name: Create Backport PR
+description: Cherry-picks a commit onto a release branch and opens the backport pull request.
 
 inputs:
   target-version: # major version number like 34 or 86
@@ -42,7 +43,7 @@ runs:
           git cherry-pick --abort
 
           echo "Could not cherry pick because of a conflict"
-          echo "has-conflicts=true" >> $GITHUB_OUTPUT
+          echo "has-conflicts=true" >> "$GITHUB_OUTPUT"
 
           # Add a shell script for resolving conflicts
           echo "git reset HEAD~1" > ./backport.sh
@@ -57,27 +58,30 @@ runs:
           #${ORIGINAL_PULL_REQUEST_NUMBER}
           > [!IMPORTANT]
           > Manual conflict resolution is required.
-          > Checkout the branch and run \`./backport.sh\` script. Force push your changes after cherry-picking. Check the box below when done.
+          > Checkout the branch and run \`./backport.sh\` script. Force push your changes after cherry-picking. Mark the PR as ready for review once conflicts have been addressed.
 
           Conflicts:
           \`\`\`shell
           ${CONFLICT_LIST}
           \`\`\`
-
-          - [ ] Conflicts resolved
         END
           )
         else
-          echo "has-conflicts=false" >> $GITHUB_OUTPUT
+          echo "has-conflicts=false" >> "$GITHUB_OUTPUT"
           PR_BODY="#${ORIGINAL_PULL_REQUEST_NUMBER}"
         fi
 
         git push -u origin ${BACKPORT_BRANCH}
 
-        BACKPORT_PR_URL=$(gh pr create --base "${TARGET_BRANCH}" --head "${BACKPORT_BRANCH}" --label "was-backported" --assignee "${{ github.event.pull_request.user.login }}" --title "🤖 backported \"${ORIGINAL_TITLE}\"" --body "${PR_BODY}")
+        PR_ARGS=(--base "${TARGET_BRANCH}" --head "${BACKPORT_BRANCH}" --label "was-backported" --assignee "${{ github.event.pull_request.user.login }}" --title "🤖 backported \"${ORIGINAL_TITLE}\"" --body "${PR_BODY}")
+        if [ "$CONFLICTS" -gt 0 ]; then
+          PR_ARGS+=(--draft)
+        fi
+
+        BACKPORT_PR_URL=$(gh pr create "${PR_ARGS[@]}")
         BACKPORT_PR_NUMBER=${BACKPORT_PR_URL##*/}
 
-        echo "backport_pr_number=$BACKPORT_PR_NUMBER" >> $GITHUB_OUTPUT
+        echo "backport_pr_number=$BACKPORT_PR_NUMBER" >> "$GITHUB_OUTPUT"
         echo "New PR has been created: #${BACKPORT_PR_NUMBER}"
 
         git checkout ${{ github.sha }}

.github/actions/create-test-plan/action.yml

@@ -17,6 +17,9 @@ inputs:
   loki-infra-touched:
     description: Whether Loki infra changed.
     required: true
+  e2e-infra-touched:
+    description: Whether e2e harness/support code changed.
+    required: true
   shared-sources-touched:
     description: Whether cljc/cljs/package.json changed.
     required: true
@@ -40,6 +43,34 @@ runs:
   steps:
     - name: Prepare Node + Bun
       uses: ./.github/actions/prepare-node-bun
+    - name: Resolve closest-ancestor e2e coverage manifest
+      id: manifest
+      uses: actions/github-script@v9
+      with:
+        script: | # js
+          const { pathToFileURL } = require("url");
+          const { resolveCoverageManifest } = await import(
+            pathToFileURL(
+              `${process.env.GITHUB_WORKSPACE}/.github/scripts/resolve-coverage-manifest.mjs`,
+            ).href,
+          );
+          const result = await resolveCoverageManifest({
+            github,
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+            headSha: context.payload.pull_request?.head?.sha ?? context.sha,
+          });
+          core.setOutput("path", result?.path ?? "");
+    - name: Build dependency graph
+      shell: bash
+      run: |
+        # Quiet on success; surface output only if install fails.
+        bun install --frozen-lockfile > /tmp/bun-install.log 2>&1 \
+          || { echo "bun install issues (continuing):"; tail -20 /tmp/bun-install.log; }
+        bunx depcruise frontend/src enterprise/frontend/src \
+          --config .dependency-cruiser.cjs \
+          --output-type json > dependency-graph.json || true
+
     - name: Create test plan
       id: compute
       shell: bash
@@ -49,18 +80,52 @@ runs:
         BE_CHANGED_FILES: ${{ inputs.be-changed-files }}
         UNIT_INFRA_TOUCHED: ${{ inputs.unit-infra-touched }}
         LOKI_INFRA_TOUCHED: ${{ inputs.loki-infra-touched }}
+        E2E_INFRA_TOUCHED: ${{ inputs.e2e-infra-touched }}
         SHARED_SOURCES_TOUCHED: ${{ inputs.shared-sources-touched }}
         DEP_GRAPH_JSON: dependency-graph.json
+        E2E_SPEC_MANIFEST: ${{ steps.manifest.outputs.path }}
       run: |
-        # on failure create-test-plan falls back to the rules graph.
-        bun install --frozen-lockfile || true
-        bunx depcruise frontend/src enterprise/frontend/src \
-          --config .dependency-cruiser.cjs \
-          --output-type json > dependency-graph.json || true
+        # stdout is the plan JSON; the planner's own info logs go to stderr.
+        bun .github/scripts/create-test-plan.ts > test-plan.json
+        echo "stats=$(jq -c '.stats' test-plan.json)" >> "$GITHUB_OUTPUT"
+        echo "fe_unit_specs_to_run=$(jq -c '.fe_unit_specs_to_run' test-plan.json)" >> "$GITHUB_OUTPUT"
+        echo "loki_stories_to_run=$(jq -c '.loki_stories_to_run' test-plan.json)" >> "$GITHUB_OUTPUT"
+        echo "e2e_specs_to_run=$(jq -c '.e2e_specs_to_run' test-plan.json)" >> "$GITHUB_OUTPUT"
 
-        OUTPUT=$(bun .github/scripts/create-test-plan.ts)
-        echo "$OUTPUT" | jq '.stats'
-        echo "stats=$(echo "$OUTPUT" | jq -c '.stats')" >> "$GITHUB_OUTPUT"
-        echo "fe_unit_specs_to_run=$(echo "$OUTPUT" | jq -c '.fe_unit_specs_to_run')" >> "$GITHUB_OUTPUT"
-        echo "loki_stories_to_run=$(echo "$OUTPUT" | jq -c '.loki_stories_to_run')" >> "$GITHUB_OUTPUT"
-        echo "e2e_specs_to_run=$(echo "$OUTPUT" | jq -c '.e2e_specs_to_run')" >> "$GITHUB_OUTPUT"
+    - name: Report test plan
+      shell: bash
+      run: |
+        plan=test-plan.json
+        row() { # name, selected, total
+          if [ "$2" -eq "$3" ]; then echo "| $1 | all ($3) | $3 |"; else echo "| $1 | $2 | $3 |"; fi
+        }
+        {
+          echo "## Affected test plan"
+          echo
+          echo "| Suite | Selected | Total |"
+          echo "|---|---:|---:|"
+          row "Unit" "$(jq '.stats.unit_specs_to_run_usage' "$plan")" "$(jq '.stats.unit_specs_all' "$plan")"
+          row "Loki" "$(jq '.stats.loki_stories_to_run_usage' "$plan")" "$(jq '.stats.loki_stories_all' "$plan")"
+          row "E2E"  "$(jq '.stats.e2e_specs_to_run_usage' "$plan")"  "$(jq '.stats.e2e_specs_all' "$plan")"
+          echo
+          echo "Changed: $(jq '.stats.fe_files_changed' "$plan") FE / $(jq '.stats.be_files_changed' "$plan") BE file(s) · $(jq '.stats.fe_modules_affected_usage' "$plan") FE module(s) affected"
+          echo
+          e2e_run=$(jq '.stats.e2e_specs_to_run_usage' "$plan")
+          e2e_all=$(jq '.stats.e2e_specs_all' "$plan")
+          if [ "$e2e_run" -eq "$e2e_all" ]; then
+            echo "**E2E: full run** — no manifest, or a change the coverage manifest can't scope (backend, e2e infra, cljc/cljs)."
+          else
+            echo "<details><summary><b>E2E specs to run ($e2e_run)</b></summary>"
+            echo
+            jq -r '.e2e_specs_to_run[]' "$plan" | sed 's/^/- /'
+            echo
+            echo "</details>"
+          fi
+          echo
+          echo "<details><summary>Full stats (rules vs usage graph)</summary>"
+          echo
+          echo '```json'
+          jq '.stats' "$plan"
+          echo '```'
+          echo "</details>"
+        } | tee -a "${GITHUB_STEP_SUMMARY:-/dev/null}"

.github/actions/cross-branch-migration-test/action.yml

@@ -1,4 +1,7 @@
 name: Cross-branch migration test
+description: >-
+  Boot Metabase on the base branch to migrate the app db, then boot the PR branch against the
+  same db, verifying the PR's migrations apply cleanly on top of the base branch's schema.
 
 inputs:
   base-ref: ## Base branch PR came from

.github/actions/fetch-artifact/action.yml

@@ -113,9 +113,9 @@ runs:
 
         # Set the JAR_PATH environment variable
         if [ "$EXTRACT_PATH" == "." ]; then
-          echo "JAR_PATH=$OUTPUT_NAME" >> $GITHUB_ENV
+          echo "JAR_PATH=$OUTPUT_NAME" >> "$GITHUB_ENV"
         else
-          echo "JAR_PATH=$EXTRACT_PATH/$OUTPUT_NAME" >> $GITHUB_ENV
+          echo "JAR_PATH=$EXTRACT_PATH/$OUTPUT_NAME" >> "$GITHUB_ENV"
         fi
 
     - name: Verify that this is a valid JAR file

.github/actions/find-squashed-commit/action.yml

@@ -22,7 +22,7 @@ runs:
         COMMIT=$(env -i git log $BASE_REF --grep="(#$PULL_REQUEST_NUMBER)" --format="%H")
         echo "commit SHA $COMMIT"
 
-        echo "commit=$COMMIT" >> $GITHUB_OUTPUT
+        echo "commit=$COMMIT" >> "$GITHUB_OUTPUT"
       id: find-squashed-commit
       shell: bash
       env:

.github/actions/get-cache-keys/action.yml

@@ -36,10 +36,10 @@ runs:
         WEEK_OF_YEAR=$(/bin/date "+%G-%V")
         CACHE_SUFFIX="${{ runner.os }}-$WEEK_OF_YEAR"
 
-        echo "m2-cache-key=$M2_CACHE_PREFIX-$CACHE_SUFFIX" >> $GITHUB_OUTPUT
-        echo "m2-restore-key=$M2_CACHE_PREFIX-" >> $GITHUB_OUTPUT
-        echo "node-cache-key=$NODE_CACHE_PREFIX-$CACHE_SUFFIX" >> $GITHUB_OUTPUT
-        echo "node-restore-key=$NODE_CACHE_PREFIX-" >> $GITHUB_OUTPUT
-        echo "eslint-cache-key=$ESLINT_CACHE_PREFIX-$CACHE_SUFFIX" >> $GITHUB_OUTPUT
-        echo "cypress-cache-key=$CYPRESS_CACHE_PREFIX-$CACHE_SUFFIX" >> $GITHUB_OUTPUT
+        echo "m2-cache-key=$M2_CACHE_PREFIX-$CACHE_SUFFIX" >> "$GITHUB_OUTPUT"
+        echo "m2-restore-key=$M2_CACHE_PREFIX-" >> "$GITHUB_OUTPUT"
+        echo "node-cache-key=$NODE_CACHE_PREFIX-$CACHE_SUFFIX" >> "$GITHUB_OUTPUT"
+        echo "node-restore-key=$NODE_CACHE_PREFIX-" >> "$GITHUB_OUTPUT"
+        echo "eslint-cache-key=$ESLINT_CACHE_PREFIX-$CACHE_SUFFIX" >> "$GITHUB_OUTPUT"
+        echo "cypress-cache-key=$CYPRESS_CACHE_PREFIX-$CACHE_SUFFIX" >> "$GITHUB_OUTPUT"
       shell: bash

.github/actions/notify-pull-request/action.yml

@@ -1,12 +1,11 @@
 name: Notify Pull Request
+description: Post a comment on the pull request, optionally replacing the previous one with the same message.
 inputs:
   remove-previous-comment:
     required: false
-    type: boolean
     default: false
   add-new-comment:
     required: false
-    type: boolean
     default: true
   message:
     required: true

.github/actions/prepare-backend/action.yml

@@ -4,7 +4,7 @@ description: |
 inputs:
   java-version:
     required: true
-    default: "21"
+    default: "25"
   clojure-version:
     required: true
     default: "1.12.0.1488"

.github/actions/prepare-ci-conductor/action.yml

@@ -0,0 +1,52 @@
+name: Prepare CI Conductor
+description: >-
+  Make the ci-conductor sources runnable in the workspace.
+  Unless the checkout is headed for master, they are overlaid from master, so every
+  branch runs the latest scripts while its workflow wiring stays branch-historical.
+
+runs:
+  using: composite
+  steps:
+    - name: Detect bun
+      id: bun
+      shell: bash
+      run: |
+        if command -v bun >/dev/null; then
+          echo "present=true" >> "$GITHUB_OUTPUT"
+        else
+          echo "present=false" >> "$GITHUB_OUTPUT"
+        fi
+
+    - name: Install bun
+      if: steps.bun.outputs.present != 'true'
+      uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+      with:
+        bun-version-file: "package.json"
+        token: ${{ github.token }}
+
+    # Anything headed for master runs master's own sources, so a PR can test its own changes.
+    - name: Fetch ci-conductor sources from master
+      if: ${{ github.base_ref != 'master' && github.ref_name != 'master' }}
+      uses: actions/checkout@v6
+      with:
+        repository: metabase/metabase
+        ref: master
+        path: .ci-conductor-master
+        persist-credentials: false
+        sparse-checkout-cone-mode: false
+        sparse-checkout: |
+          release/ci-conductor
+          e2e/support/ci_conductor.ts
+
+    # e2e/support/config.js and e2e/support/ci_conductor.ts resolve these by relative
+    # path at bundle time, so the sources have to land where the branch expects them.
+    - name: Overlay ci-conductor sources from master
+      if: ${{ github.base_ref != 'master' && github.ref_name != 'master' }}
+      shell: bash
+      run: |
+        set -euo pipefail
+        rm -rf release/ci-conductor
+        mv .ci-conductor-master/release/ci-conductor release/ci-conductor
+        mv .ci-conductor-master/e2e/support/ci_conductor.ts e2e/support/ci_conductor.ts
+        rm -rf .ci-conductor-master
+        echo "Overlaid ci-conductor sources from master."

.github/actions/prepare-cypress/action.yml

@@ -15,6 +15,10 @@ outputs:
 runs:
   using: "composite"
   steps:
+    # e2e/support/config.js imports the reporter, so it has to be in place before Cypress bundles.
+    - name: Prepare CI Conductor
+      uses: ./.github/actions/prepare-ci-conductor
+
     - name: Install Chrome v144
       uses: browser-actions/setup-chrome@2e1d749697dd1612b833dba4a722266286fbefcd # v2.1.2
       with:

.github/actions/prepare-frontend/action.yml

@@ -35,7 +35,7 @@ runs:
       run: |
         BUN_CACHE_DIR=$(bun pm cache)
         echo "Bun cache directory: $BUN_CACHE_DIR"
-        echo "dir=$BUN_CACHE_DIR" >> $GITHUB_OUTPUT
+        echo "dir=$BUN_CACHE_DIR" >> "$GITHUB_OUTPUT"
       shell: bash
 
     - name: Restore node_modules cache
@@ -53,7 +53,13 @@ runs:
     # If a job wants to patch packages, it does so explicitly in the CI. This setting is opt-out.
     # For example, we never want to cache node_modules with patches already applied so cache-generator.yml skips that step.
     - name: Clean install
-      run: bun install --frozen-lockfile
+      # Remove the restored node_modules before installing. The os-week cache can
+      # carry a stale tree (for example a different React major), and
+      # `--frozen-lockfile` alone does not prune it. Rebuilding from the cached bun
+      # store gives an exact, lockfile-correct node_modules with no extra download.
+      run: |
+        rm -rf node_modules
+        bun install --frozen-lockfile
       shell: bash
     - name: Patch frontend dependencies
       if: inputs.apply-patches == 'true'

.github/actions/prepare-node-bun/action.yml

@@ -16,5 +16,5 @@ runs:
     - name: Install bun
       uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
       with:
-        bun-version: "1.3.14"
+        bun-version-file: 'package.json'
         token: ${{ github.token }}

.github/actions/prepare-release-scripts/action.yml

@@ -6,7 +6,7 @@ runs:
   steps:
     - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
       with:
-        bun-version: "1.3.14"
+        bun-version-file: 'package.json'
         token: ${{ github.token }}
 
     - name: Build release scripts

.github/actions/prepare-shoppy-e2e/action.yml

@@ -88,9 +88,9 @@ runs:
         REPO_URL="https://github.com/metabase/shoppy.git"
         echo "Checking if branch '${SAMPLE_APP_BRANCH_NAME}' exists in ${REPO_URL}..."
         if git ls-remote --exit-code --heads "$REPO_URL" "${SAMPLE_APP_BRANCH_NAME}"; then
-          echo "sample_app_branch_exists=true" >> $GITHUB_OUTPUT
+          echo "sample_app_branch_exists=true" >> "$GITHUB_OUTPUT"
         else
-          echo "sample_app_branch_exists=false" >> $GITHUB_OUTPUT
+          echo "sample_app_branch_exists=false" >> "$GITHUB_OUTPUT"
         fi
 
     - name: Configure AWS credentials

.github/actions/prepare-uberjar-artifact/action.yml

@@ -1,26 +0,0 @@
-name: Prepare Uberjar Artifact
-description: Prepare and upload Metabase JAR as a GitHub artifact.
-
-inputs:
-  edition:
-    required: false
-    default: "ee"
-    description: Metabase edition (ee or oss)
-
-runs:
-  using: "composite"
-  steps:
-    - name: Mark with the commit hash
-      run: git rev-parse --short HEAD > COMMIT-ID
-      shell: bash
-    - name: Calculate SHA256 checksum
-      run: sha256sum ./target/uberjar/metabase.jar > SHA256.sum
-      shell: bash
-    - name: Upload JARs as artifact
-      uses: actions/upload-artifact@v7
-      with:
-        name: metabase-${{ inputs.edition }}-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
-        path: |
-          ./target/uberjar/metabase.jar
-          ./COMMIT-ID
-          ./SHA256.sum

.github/actions/quarantine-gate/action.yml

@@ -0,0 +1,38 @@
+name: CI Conductor quarantine gate
+description: >-
+  Check this job's test failures against ci-conductor's quarantine list.
+  Either enforces the quarantine or only prints a verdict (dry run).
+  Fails closed when enforcing but the `CI_CONDUCTOR_BASE_URL` is missing or unreachable.
+
+inputs:
+  adapter:
+    description: Which gate to run — one of `backend`, `frontend`, `e2e`.
+    required: true
+  test-suite:
+    description: >-
+      Suite label to gate (CI_CONDUCTOR_TEST_SUITE). MUST match the label this
+      job reports under, or the gate checks the wrong quarantine list.
+    required: true
+  enforce-quarantine:
+    description: >-
+      Whether the gate actually gates the job. When "false", it only prints a verdict.
+    required: false
+    default: "false"
+
+runs:
+  using: composite
+  steps:
+    - name: Prepare CI Conductor
+      uses: ./.github/actions/prepare-ci-conductor
+    - name: Check failures against the quarantine list
+      shell: bash
+      env:
+        CI_CONDUCTOR_TEST_SUITE: ${{ inputs.test-suite }}
+        ADAPTER: ${{ inputs.adapter }}
+        QUARANTINE_DRY_RUN: ${{ inputs.enforce-quarantine != 'true' }}
+      run: |
+        case "$ADAPTER" in
+          backend|frontend|e2e) ;;
+          *) echo "::error::quarantine-gate: unknown adapter '$ADAPTER' (expected backend|frontend|e2e)"; exit 1 ;;
+        esac
+        bun "release/ci-conductor/src/check-${ADAPTER}-quarantine.ts"

.github/actions/report-failures-to-ci-conductor/action.yml

@@ -15,21 +15,8 @@ inputs:
 runs:
   using: composite
   steps:
-    - name: Detect bun
-      id: bun
-      shell: bash
-      run: |
-        if command -v bun >/dev/null; then
-          echo "present=true" >> "$GITHUB_OUTPUT"
-        else
-          echo "present=false" >> "$GITHUB_OUTPUT"
-        fi
-    - name: Install bun
-      if: steps.bun.outputs.present != 'true'
-      uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
-      with:
-        bun-version: "1.3.14"
-        token: ${{ github.token }}
+    - name: Prepare CI Conductor
+      uses: ./.github/actions/prepare-ci-conductor
     - name: Report failed tests to ci-conductor
       shell: bash
       env:

.github/actions/sdk-bundle-size-check/action.yml

@@ -1,76 +0,0 @@
-name: Embedding SDK Bundle Size Check
-description: |
-  Downloads the current branch's uberjar and builds the base ref's
-  embedding-sdk.js from source, compares their sizes,
-  and sets output if the size change exceeds the threshold.
-
-inputs:
-  edition:
-    description: 'Metabase edition (ee or oss)'
-    required: true
-  base-ref-commit:
-    description: 'Commit SHA of the base ref (e.g. merge base).'
-    required: true
-  threshold-percent:
-    description: 'Percent threshold for bundle size change'
-    required: true
-
-outputs:
-  status:
-    description: "Bundle size status: increased, decreased, or stable"
-    value: ${{ steps.compare.outputs.status }}
-  size_change_percent:
-    description: "size change percent (positive = increase, negative = decrease)"
-    value: ${{ steps.compare.outputs.size_change_percent }}
-
-runs:
-  using: "composite"
-  steps:
-    - name: Prepare backend
-      uses: ./.github/actions/prepare-backend
-    - name: Prepare frontend
-      uses: ./.github/actions/prepare-frontend
-    - name: Download current uberjar
-      uses: ./.github/actions/fetch-artifact
-      with:
-        commit: ${{ github.event.pull_request.head.sha || github.sha }}
-        edition: ${{ inputs.edition }}
-        extract-path: temp/current-uberjar
-    - name: Extract embedding-sdk bundles from current uberjar
-      shell: bash
-      run: |
-        # Extract preserving the jar's internal paths under resources/ so the
-        # shared measure script sees the same layout as a source build. Both the
-        # new (embedding-sdk/legacy + chunks) and old (embedding-sdk.js) layouts
-        # are pulled; whichever exists is what gets measured.
-        mkdir -p temp/current/resources
-        unzip -o temp/current-uberjar/metabase.jar \
-          "frontend_client/app/embedding-sdk/*" \
-          -d temp/current/resources 2>/dev/null || true
-        unzip -o temp/current-uberjar/metabase.jar \
-          "frontend_client/app/embedding-sdk.js" \
-          -d temp/current/resources 2>/dev/null || true
-    - name: Checkout base ref
-      uses: actions/checkout@v6
-      with:
-        ref: ${{ inputs.base-ref-commit }}
-        path: temp/base-ref-src
-    - name: Build base-ref embedding-sdk.js
-      shell: bash
-      run: |
-        cd temp/base-ref-src
-        bun install
-        MB_EDITION=${{ inputs.edition }} bun run build-release
-    - name: Measure current and base bundle sizes
-      shell: bash
-      env:
-        MEASURE_BUNDLES: embedding-sdk-legacy,embedding-sdk-chunked
-      run: |
-        MEASURE_ROOT=temp/current node ./.github/scripts/measure-bundle-sizes.js > temp/current-sizes.json
-        MEASURE_ROOT=temp/base-ref-src node ./.github/scripts/measure-bundle-sizes.js > temp/base-sizes.json
-    - name: Compare sizes and set output
-      id: compare
-      shell: bash
-      env:
-        THRESHOLD: ${{ inputs.threshold-percent }}
-      run: node ./.github/actions/sdk-bundle-size-check/compare.js temp/current-sizes.json temp/base-sizes.json

.github/actions/sdk-bundle-size-check/compare.js

@@ -1,54 +0,0 @@
-/* eslint-disable import/no-commonjs */
-// Diffs the embedding SDK bundle sizes produced by measure-bundle-sizes.js for
-// the current build and the base ref. The gate is driven by the legacy
-// (monolithic) bundle's raw bytes; the chunked delivery is reported for context.
-const fs = require("fs");
-
-const [, , currentPath, basePath] = process.argv;
-const threshold = Number(process.env.THRESHOLD ?? 2);
-
-const current = JSON.parse(fs.readFileSync(currentPath, "utf8"));
-const base = JSON.parse(fs.readFileSync(basePath, "utf8"));
-
-const pick = (rows, bundle, kind) => rows.find(row => row.bundle === bundle && row.kind === kind);
-
-const setOutput = (name, value) => {
-  if (process.env.GITHUB_OUTPUT) {
-    fs.appendFileSync(process.env.GITHUB_OUTPUT, `${name}=${value}\n`);
-  }
-};
-
-const mb = bytes => (bytes / 1024 / 1024).toFixed(2);
-
-const legacyCurrent = pick(current, "embedding-sdk-legacy", "total");
-const legacyBase = pick(base, "embedding-sdk-legacy", "total");
-
-if (!legacyCurrent || !legacyBase || !legacyBase.rawBytes) {
-  console.error("::error::Could not find embedding-sdk-legacy size in both builds");
-  process.exit(1);
-}
-
-const diff = legacyCurrent.rawBytes - legacyBase.rawBytes;
-const percent = Math.trunc((diff * 100) / legacyBase.rawBytes);
-
-const status = percent > threshold ? "increased" : percent < -threshold ? "decreased" : "stable";
-
-console.log("=== Embedding SDK legacy (monolithic) bundle ===");
-console.log(`Current:  ${legacyCurrent.rawBytes} bytes raw / ${mb(legacyCurrent.gzipBytes)}MB gzip`);
-console.log(`Base ref: ${legacyBase.rawBytes} bytes raw / ${mb(legacyBase.gzipBytes)}MB gzip`);
-console.log(`Difference: ${diff} bytes (${percent}%), threshold ${threshold}%`);
-console.log(`Status: ${status}`);
-
-const chunkedCurrent = pick(current, "embedding-sdk-chunked", "total");
-const chunkedBase = pick(base, "embedding-sdk-chunked", "total");
-if (chunkedCurrent && chunkedBase) {
-  const chunkedDiff = chunkedCurrent.rawBytes - chunkedBase.rawBytes;
-  console.log("");
-  console.log("=== Embedding SDK chunked (informational) ===");
-  console.log(`Current:  ${chunkedCurrent.rawBytes} bytes raw / ${mb(chunkedCurrent.gzipBytes)}MB gzip`);
-  console.log(`Base ref: ${chunkedBase.rawBytes} bytes raw / ${mb(chunkedBase.gzipBytes)}MB gzip`);
-  console.log(`Difference: ${chunkedDiff} bytes`);
-}
-
-setOutput("status", status);
-setOutput("size_change_percent", percent);

.github/actions/test-driver/action.yml

@@ -9,13 +9,26 @@ inputs:
   build-static-viz:
     required: true
     default: false
-  logs-artifact-suffix:
+  artifact-suffix:
     required: false
-    description: Suffix to append to the test logs artifact name to avoid conflicts in matrix jobs
+    description: >-
+      Discriminator appended to this job's artifact names (test logs, granular-rerun failed
+      tests). A job whose matrix runs several concurrent legs MUST set a per-leg-unique value,
+      or the legs collide on one artifact — for the rerun artifact that means a leg restores
+      another leg's failed set. Must be stable across attempts of the same job.
   edition:
     required: false
-    default: 'ee'
+    default: "ee"
     description: Edition to test (oss or ee)
+  quarantine-engine:
+    required: false
+  granular-rerun:
+    required: false
+    default: "true"
+    description: >-
+      When "true" (default), a re-run of a failed job runs only the tests that failed on the
+      previous attempt (hawk `:only`). Stress workflows set this to "false": they intentionally
+      run a fixed test set `:times N`, and narrowing to failures would drop that repetition.
 
 outputs:
   test-outcome:
@@ -39,28 +52,100 @@ runs:
       run: bun run build-static-viz
       shell: bash
       env:
-        MB_EDITION: ee
+        MB_EDITION: ${{ inputs.edition }}
+
+    # Granular rerun: on a re-run of a failed job, restore the list
+    # of tests that failed on the previous attempt (uploaded below) so the test
+    # step can target only those instead of the whole suite. Best-effort: a
+    # missing/empty artifact leaves no file and the run falls back to the full
+    # suite. First attempts skip this entirely.
+    #
+    # Scoped to the IMMEDIATELY preceding attempt: an attempt that passed, or
+    # that failed with nothing attributable to a var, uploads no artifact, and a
+    # narrow set must not outlive it. Reading `attempt - 1` means "only what the
+    # last attempt actually recorded" — anything else falls back to the full suite.
+    # Workflow expressions have no arithmetic, so the shell computes it.
+    #
+    # run-tests.yml calls app-db.yml, backend.yml, drivers.yml and semantic-search.yml
+    # as part of ONE run, so all four share an artifact namespace. `junit-name` alone is not
+    # unique there — app-db.yml and drivers.yml both derive `be-tests-postgres-ee` — so
+    # `artifact-suffix` carries the rest of the discriminator.
+    - name: Resolve rerun artifact names
+      if: ${{ inputs.granular-rerun == 'true' }}
+      shell: bash
+      env:
+        RERUN_ARTIFACT_BASE: ${{ format('failed-tests-{0}{1}', inputs.junit-name, inputs.artifact-suffix && format('-{0}', inputs.artifact-suffix) || '') }}
+      run: |
+        echo "RERUN_ARTIFACT=$RERUN_ARTIFACT_BASE-attempt-$GITHUB_RUN_ATTEMPT" >> "$GITHUB_ENV"
+        echo "RERUN_PREV_ARTIFACT=$RERUN_ARTIFACT_BASE-attempt-$((GITHUB_RUN_ATTEMPT - 1))" >> "$GITHUB_ENV"
+
+    # `pattern` (not `name`) because the artifact is legitimately absent whenever the
+    # previous attempt recorded nothing: `name` treats that as an error, `pattern`
+    # downloads nothing and moves on. The value is a literal — no glob metacharacters —
+    # so it matches exactly one artifact, which lands at `target/failed-tests`. A pattern
+    # that ever matched two would nest them under their artifact names instead, leaving
+    # the file absent and falling back to the full suite.
+    - name: Restore previously-failed tests
+      if: ${{ inputs.granular-rerun == 'true' && github.run_attempt != '1' }}
+      continue-on-error: true
+      uses: actions/download-artifact@v8
+      with:
+        pattern: ${{ env.RERUN_PREV_ARTIFACT }}
+        path: target
+
     - name: Test database driver
-      run: clojure -X:dev:ci:${{ inputs.edition }}:${{ inputs.edition }}-dev:drivers:drivers-dev:test ${{ inputs.test-args }}
+      # On a rerun with a non-empty failed-tests file, target only those vars via
+      # hawk `:only` (a var-level selector bypasses `:only-tags`, which is fine —
+      # every listed var already passed that filter on the first attempt).
+      # Otherwise run exactly as before. Quote the file so the whole `[ns/var ...]`
+      # vector reaches clojure -X as a single argument.
+      run: |
+        BASE="clojure -X:dev:ci:${{ inputs.edition }}:${{ inputs.edition }}-dev:drivers:drivers-dev:test"
+        if [ "${{ inputs.granular-rerun }}" = "true" ] && [ "${{ github.run_attempt }}" != "1" ] && [ -s target/failed-tests ]; then
+          echo "Granular rerun of previously-failed tests: $(cat target/failed-tests)"
+          $BASE :only "$(cat target/failed-tests)"
+        else
+          $BASE ${{ inputs.test-args }}
+        fi
       shell: bash
       id: run-test
-      # Trunk Quarantine controls the final state of the run in the CI!
-      # Even if this step fails we let it pass, and then `trunk-io/analytics-uploader` determines
-      # whether to fail or to pass the whole job, based on the quarantine list.
+      # Keep this step continue-on-error because the quarantine gate below controls whether it
+      # ultimately fails.
       continue-on-error: true
+
     - name: Report failed tests to ci-conductor
-      # Positioned right after the test run (before the report/upload steps) so it
-      # reads pristine JUnit. Gated to non-clean runs + continue-on-error so it can
-      # never change the job outcome — Trunk Quarantine remains the sole arbiter.
-      # junit-name is the per-job identity label (e.g. be-tests-postgres-ee); only
-      # workflows that also set CI_CONDUCTOR_BASE_URL actually POST. See DEV-2224 /
-      # DEV-2235.
-      if: ${{ always() && steps.run-test.outcome != 'success' }}
+      if: ${{ !cancelled() && steps.run-test.outcome == 'failure' }}
+      # This step should NEVER fail the job!
       continue-on-error: true
       uses: ./.github/actions/report-failures-to-ci-conductor
       with:
         test-suite: ${{ inputs.junit-name }}
         adapter: backend
+
+    # Granular rerun: record which tests failed so a re-run of this
+    # job targets only those (restored above). Reuses the backend JUnit adapter
+    # from the ci-conductor sources the report step just prepared. Best-effort:
+    # writes nothing unless every failure is attributable to a var, so an
+    # unattributable failure falls back to a full rerun.
+    - name: Collect failed tests for rerun
+      if: ${{ inputs.granular-rerun == 'true' && !cancelled() && steps.run-test.outcome == 'failure' }}
+      continue-on-error: true
+      shell: bash
+      # Clear the restored set first, so a collector that dies before deciding
+      # can't leave the previous attempt's file to be uploaded as this one's.
+      run: |
+        rm -f target/failed-tests
+        bun release/ci-conductor/src/collect-failed-backend.ts
+
+    - name: Upload failed tests for rerun
+      if: ${{ inputs.granular-rerun == 'true' && !cancelled() && steps.run-test.outcome == 'failure' }}
+      continue-on-error: true
+      uses: actions/upload-artifact@v7
+      with:
+        name: ${{ env.RERUN_ARTIFACT }}
+        path: target/failed-tests
+        if-no-files-found: ignore
+
     - name: Publish Test Report (JUnit)
       uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
       # As per the documentation: https://docs.github.com/en/actions/reference/workflows-and-actions/contexts#steps-context
@@ -74,12 +159,23 @@ runs:
         list-suites: failed
         list-tests: failed
         fail-on-error: false
+
     - name: Upload Logs on Failure
       if: always() && steps.run-test.outcome != 'success'
       uses: actions/upload-artifact@v7
       with:
-        name: ${{ format('test-logs-{0}{1}', github.job, inputs.logs-artifact-suffix && format('-{0}', inputs.logs-artifact-suffix) || '') }}
+        name: ${{ format('test-logs-{0}{1}', github.job, inputs.artifact-suffix && format('-{0}', inputs.artifact-suffix) || '') }}
         path: logs/test-log.json
         retention-days: 1
       # Failing to upload the artifact should never affect the outcome of the whole test run.
       continue-on-error: true
+
+    # Last, because this is the only step allowed to fail the job: everything above it reports the
+    # failure (JUnit report, logs, ci-conductor) and must run regardless of the verdict below.
+    - name: Quarantine gate
+      if: ${{ !cancelled() && steps.run-test.outcome == 'failure' }}
+      uses: ./.github/actions/quarantine-gate
+      with:
+        adapter: backend
+        test-suite: ${{ inputs.junit-name }}
+        enforce-quarantine: ${{ inputs.quarantine-engine == 'ci-conductor' }}

.github/actions/upgrade-backend-deps/action.yml

@@ -1,4 +1,5 @@
 name: Create Backend Dep Bump PRs
+description: Opens a pull request for each backend dependency that has a newer version available.
 
 inputs:
   github-token:

.github/actions/upload-test-results/action.yml

@@ -1,183 +0,0 @@
-name: Upload Test Results to s3
-description: Uploads test results files to s3
-
-inputs:
-  input-path:
-    required: true
-  output-name:
-    required: true
-    default: test
-  role-to-assume:
-    required: true
-  aws-region:
-    required: true
-    default: us-east-1
-  bucket:
-    required: true
-  trunk-api-token:
-    required: true
-  variant:
-    required: false
-    default: ""
-  previous-step-outcome:
-    required: true
-  driver-status:
-    required: false
-    default: ""
-    description: >-
-      Configured status for this driver ("info", "skip", "required", or empty). When
-      "info", the job is reported as passing regardless of the real test outcome, and
-      that outcome is surfaced via a job summary and (on PRs) a comment instead.
-  report-variant:
-    required: false
-    default: ""
-    description: >-
-      Optional label disambiguating matrix legs of the same job, so the info-driver
-      job summary and PR comment stay distinct per leg.
-
-runs:
-  using: "composite"
-  steps:
-    - name: Configure AWS credentials
-      uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885
-      with:
-        role-to-assume: ${{ inputs.role-to-assume }}
-        aws-region: ${{ inputs.aws-region }}
-    - name: zip test results
-      env:
-        INPUT_DIR: ${{ inputs.input-path }}
-        OUTPUT_FILE: ${{ inputs.output-name }}
-      shell: bash
-      run: | # sh
-        zip ${OUTPUT_FILE}.zip $INPUT_DIR/*.xml
-    - name: Upload test results to S3
-      env:
-        BUCKET: ${{ inputs.bucket }}
-        OUTPUT_FILE: ${{ inputs.output-name }}
-      shell: bash
-      run: | # sh
-        DATE=$(date '+%Y-%m-%d')
-        aws s3 cp ${OUTPUT_FILE}.zip s3://$BUCKET/$DATE/$GITHUB_RUN_ID/$GITHUB_RUN_ATTEMPT/
-
-    - name: Upload results to Trunk
-      # Important!
-      # 1. This step must always run because it controls job's exit code.
-      # 2. There's no point in running this outside the organization
-      # 3. For "info" drivers off master/release branches, our own status takes precedence: we let this
-      #    step pass so the job is reported as passing regardless of the real outcome (still uploaded).
-      #    On master and release branches, info status is ignored and the real outcome gates the job.
-      if: always() && github.repository_owner == 'metabase'
-      continue-on-error: ${{ inputs.driver-status == 'info' && !(github.ref_name == 'master' || startsWith(github.ref_name, 'release-x')) }}
-      uses: trunk-io/analytics-uploader@1198efcc0976501147b10a7e343c3fa069527526 # v2.0.9
-      env:
-        TRUNK_REPO_URL: git@github.com:metabase/metabase.git
-      with:
-        junit-paths: ${{ inputs.input-path }}
-        variant: ${{ inputs.variant || inputs.output-name }}
-        org-slug: metabase
-        dry-run: ${{ (github.event_name == 'pull_request' && github.event.pull_request.draft == true) || github.repository != 'metabase/metabase' }} # quarantine, but do not upload results
-        token: ${{ inputs.trunk-api-token }}
-        use-cache: true
-        previous-step-outcome: ${{ inputs.previous-step-outcome }}
-
-    # For "info" drivers the job is forced green above, so surface the real outcome here —
-    # but only when it did NOT pass, to avoid spamming summaries/comments for healthy runs.
-    # Never include logs or stack traces — only the real status and a link to the run.
-    - name: Report info-level driver result (job summary)
-      if: ${{ always() && inputs.driver-status == 'info' && inputs.previous-step-outcome == 'failure' }}
-      shell: bash
-      env:
-        OUTCOME: ${{ inputs.previous-step-outcome }}
-        LABEL: ${{ inputs.output-name }}
-        VARIANT: ${{ inputs.report-variant }}
-      run: | # sh
-        if [ "$OUTCOME" = "success" ]; then EMOJI="✅"; else EMOJI="❌"; fi
-        TITLE="$LABEL"
-        [ -n "$VARIANT" ] && TITLE="$LABEL ($VARIANT)"
-        RUN_URL="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID"
-        {
-          echo "### ℹ️ Info-level driver: $TITLE"
-          echo ""
-          echo "Reported as passing (non-blocking). Real result: $EMOJI \`$OUTCOME\`"
-          echo ""
-          echo "[View run]($RUN_URL)"
-        } >> "$GITHUB_STEP_SUMMARY"
-
-    # Maintain ONE PR comment per commit for all info drivers. Each leg upserts its own line
-    # (keyed by a hidden tag); a passing leg removes its line, and the comment is deleted once
-    # no failing legs remain. Comments from older commits are cleaned up. Runs on pass and fail
-    # so recoveries self-heal. Never includes logs or stack traces — only status and a run link.
-    - name: Sync info-level driver result into the PR comment
-      if: ${{ always() && inputs.driver-status == 'info' && github.event_name == 'pull_request' }}
-      uses: actions/github-script@v9
-      continue-on-error: true
-      env:
-        OUTCOME: ${{ inputs.previous-step-outcome }}
-        LABEL: ${{ inputs.output-name }}
-        VARIANT: ${{ inputs.report-variant }}
-      with:
-        script: | # js
-          const { OUTCOME, LABEL, VARIANT, GITHUB_SERVER_URL, GITHUB_REPOSITORY, GITHUB_RUN_ID } = process.env;
-          const pr = context.payload.pull_request;
-          if (!pr) return;
-          const { owner, repo } = context.repo;
-          const sha = pr.head.sha;
-          // PREFIX matches the current per-commit marker AND the older per-leg one, so legacy
-          // comments from a previous version get cleaned up on the next sync.
-          const PREFIX = "<!-- info-driver-result";
-          const marker = `<!-- info-driver-results:${sha} -->`;
-          const header = `${marker}\nℹ️ **Info-level drivers** failed (non-blocking) on \`${sha.slice(0, 7)}\` — these do not gate:`;
-          const lineKey = `${LABEL}:${VARIANT}`;
-          const title = VARIANT ? `${LABEL} (${VARIANT})` : LABEL;
-          const runUrl = `${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}`;
-          // Only real failures are reported; cancelled/skipped/success remove this leg's line.
-          // List-item line with the hidden key tag at the END so markdown (links) renders.
-          const ourLine = OUTCOME === "failure"
-            ? `- **${title}** — ❌ \`${OUTCOME}\` ([Logs](${runUrl})) <!--l:${lineKey}-->`
-            : null;
-          const linesOf = (body) => body.split("\n").filter((l) => l.includes("<!--l:"));
-
-          const sync = async () => {
-            const { data: comments } = await github.rest.issues.listComments({
-              owner, repo, issue_number: pr.number, per_page: 100,
-            });
-            const tagged = comments.filter((c) => c.body.includes(PREFIX));
-            // Drop comments left over from older commits.
-            for (const c of tagged.filter((c) => !c.body.includes(marker))) {
-              await github.rest.issues.deleteComment({ owner, repo, comment_id: c.id }).catch(() => {});
-            }
-            const mine = tagged
-              .filter((c) => c.body.includes(marker))
-              .sort((a, b) => new Date(a.created_at) - new Date(b.created_at));
-            // Merge any duplicates raced into existence; latest write of each line wins.
-            const byKey = new Map();
-            for (const c of mine) {
-              for (const l of linesOf(c.body)) {
-                const m = l.match(/<!--l:(.*?)-->/);
-                if (m) byKey.set(m[1], l);
-              }
-            }
-            if (ourLine) byKey.set(lineKey, ourLine);
-            else byKey.delete(lineKey);
-            const lines = [...byKey.values()].sort();
-            const target = mine[0];
-            for (const c of mine.slice(1)) {
-              await github.rest.issues.deleteComment({ owner, repo, comment_id: c.id }).catch(() => {});
-            }
-            if (lines.length === 0) {
-              if (target) await github.rest.issues.deleteComment({ owner, repo, comment_id: target.id }).catch(() => {});
-              return;
-            }
-            const body = [header, "", ...lines].join("\n");
-            if (target) {
-              await github.rest.issues.updateComment({ owner, repo, comment_id: target.id, body });
-            } else {
-              await github.rest.issues.createComment({ owner, repo, issue_number: pr.number, body });
-            }
-          };
-
-          // Retry to shrink the window where parallel legs clobber each other's update.
-          for (let i = 0; i < 4; i++) {
-            try { await sync(); break; }
-            catch (e) { if (i === 3) throw e; await new Promise((r) => setTimeout(r, 400 * (i + 1))); }
-          }

.github/actions/verify-membership/action.yml

@@ -1,22 +0,0 @@
-name: 'Verify Organization Membership'
-description: 'Check if a user is a member of a GitHub organization'
-inputs:
-  github_token:
-    description: 'Token with access to the organization'
-    required: true
-  organization_name:
-    description: 'Organization name'
-    required: true
-  username:
-    description: 'Username'
-    required: true
-outputs:
-  is_member:
-    value: ${{ steps.verify-membership.outputs.is_member }}
-    description: "Is the user a member of the organization"
-runs:
-  using: "composite"
-  steps:
-    - run: bash ${{ github.action_path }}/verify_membership.sh ${{ inputs.github_token }} ${{ inputs.organization_name }} ${{ inputs.username }}
-      id: verify-membership
-      shell: bash

.github/actions/verify-membership/verify_membership.sh

@@ -1,25 +0,0 @@
-#!/bin/bash
-
-TOKEN=$1
-ORG_NAME=$2
-USERNAME=$3
-
-response=$(curl -L -o /dev/null -w "%{http_code}" \
-  -H "Accept: application/vnd.github+json" \
-  -H "Authorization: Bearer $TOKEN" \
-  -H "X-GitHub-Api-Version: 2022-11-28" \
-  "https://api.github.com/orgs/$ORG_NAME/members/$USERNAME")
-
-# Github returns an empty response with 204 status if user is a member and 404 status otherwise
-# See: https://docs.github.com/en/rest/orgs/members?apiVersion=2022-11-28#check-organization-membership-for-a-user
-if [ "$response" == "204" ]; then
-    echo "The user $USERNAME is a member of $ORG_NAME"
-    echo "is_member=true" >> $GITHUB_OUTPUT
-elif [ "$response" == "404" ]; then
-    echo "The user $USERNAME is not a member of $ORG_NAME"
-    echo "is_member=false" >> $GITHUB_OUTPUT
-else
-    echo "Failed to determine the membership status for $USERNAME in $ORG_NAME"
-    echo "is_member=false" >> $GITHUB_OUTPUT
-    exit 1
-fi

.github/file-paths.yaml

@@ -7,6 +7,10 @@ default: &default
   - "locales/**"
   - "bin/**/!(*.md)"
 
+actionlint:
+  - added|modified: ".github/workflows/*.yml"
+  - added|modified: ".github/workflows/*.yaml"
+
 shared_sources: &shared_sources
   - "src/**/*.cljc"
   - "src/**/*.cljs"
@@ -50,11 +54,6 @@ frontend_sources: &frontend_sources
   - "enterprise/frontend/!(test)**/**/{!(*.spec),}.{js,jsx,ts,tsx,css}"
   - "frontend/!(test)**/**/{!(*.spec),}.{js,jsx,ts,tsx,css}"
 
-# Used only in .github/workflows/conventional-commit-pr-title-reminder.yml
-frontend_embedding_sources:
-  - "enterprise/frontend/src/{embedding,embedding-*}/**/{!(*.spec),}.{js,jsx,ts,tsx,css}"
-  - "enterprise/frontend/src/metabase-enterprise/{embedding,embedding-*}**/{!(*.spec),}.{js,jsx,ts,tsx,css}"
-
 # Used only in .github/workflows/embedding-sdk-labels-reminder.yml
 frontend_embedding_sdk_package_sources:
   - "enterprise/frontend/src/embedding-sdk-package/**/!(*.spec).{js,jsx,ts,tsx,css}"
@@ -95,19 +94,18 @@ frontend_loki_infra: &frontend_loki_infra
   - *shared_ci
   - *frontend_loki_ci
 
+# e2e harness/support code (commands, support file, runner). Not in the
+# instrumented bundle, so it maps to no covered module — a change here forces a
+# full e2e run (see create-test-plan / e2eInfraTouched).
+e2e_infra: &e2e_infra
+  - *shared_e2e
+
 backend_ci: &backend_ci
   - *shared_ci
   - ".github/actions/test-driver/**"
   - ".github/workflows/backend.yml"
   - ".github/workflows/drivers.yml"
 
-backend_presto_kerberos:
-  - "**/presto_jdbc/**"
-  - "**/presto-jdbc/**" # the driver module has a hyphen. underscores are classpaths
-  - "**/presto_jdbc.clj"
-  - "**/presto_jdbc_test.clj"
-  - ".github/workflows/presto-kerberos-integration-test.yml"
-
 backend_sources: &backend_sources
   - *shared_sources
   - "**deps.edn"
@@ -145,7 +143,7 @@ custom_viz_all:
 
 e2e_ci: &e2e_ci
   - *shared_ci
-  - ".github/actions/prepare-uberjar-artifact/**"
+  - ".github/workflows/uberjar.yml"
   - ".github/actions/fetch-artifact/action.yml"
   - ".github/actions/e2e-prepare-containers/**"
   - ".github/actions/prepare-cypress/**"
@@ -156,7 +154,7 @@ e2e_specs: &e2e_specs
 
 embedding_sdk_ci: &embedding_sdk_ci
   - *shared_ci
-  - ".github/actions/prepare-uberjar-artifact/**"
+  - ".github/workflows/uberjar.yml"
   - ".github/actions/fetch-artifact/action.yml"
   - ".github/actions/prepare-cypress/**"
   - ".github/workflows/embedding-sdk*.yml"
@@ -178,7 +176,7 @@ embedding_sdk_host_sample_apps:
   - "e2e/test-host-app/**/*.cy.*.{js,ts}"
 
 snowplow: &snowplow
-  - ".github/workflows/snowplow.yml"
+  - ".github/workflows/lint.yml"
   - "snowplow/**"
   - "bin/lint-snowplow-schemas.bb"
   - "bin/lint-snowplow-schemas-test.bb"
@@ -207,7 +205,7 @@ yaml:
   - "**/*.yaml"
 
 codeql:
-  - ".github/workflows/codeql.yml"
+  - ".github/workflows/lint.yml"
   - "frontend/src/**"
   - "enterprise/frontend/src/**"
 
@@ -215,14 +213,9 @@ i18n:
   - *default
   - ".github/actions/prepare-frontend/**"
   - ".github/actions/prepare-backend/**"
-  - ".github/workflows/i18n.yml"
+  - ".github/workflows/lint.yml"
   - *sources
 
-visualizations:
-  - "frontend/src/metabase/visualizations/**"
-  - "frontend/src/metabase/static-viz/**"
-  - "src/metabase/pulse/**"
-
 cljs:
   - *shared_sources
   - *shared_specs
@@ -234,7 +227,7 @@ serialization_baseline:
   - "test_resources/serialization_baseline/**"
 
 openapi:
-  - ".github/workflows/openapi.yml"
+  - ".github/workflows/lint.yml"
   - "src/metabase/api/**"
   - "src/metabase/api_routes/**"
   - "src/metabase/*_rest/api.clj"

.github/scripts/affected-modules.ts

@@ -1,25 +1,23 @@
+import micromatch from "micromatch";
+
 export type ModuleDef = { type: string; pattern: string };
-export type Rule = { from: string[]; allow: string[] };
+
+export type Rule = {
+  from: string[];
+  allow?: string[];
+  disallow?: string[];
+};
 
 export type ModuleNode = { type: string; regex: RegExp };
 
 export type FileDependency = { source: string; dependencies: string[] };
 
-/**
- * Compiles a glob pattern to an anchored RegExp.
- */
-function globToRegex(glob: string): RegExp {
-  const escapeSegment = (seg: string) =>
-    seg.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, "[^/]*");
-  const body = glob.split("**").map(escapeSegment).join(".*");
-  return new RegExp(`^${body}$`);
-}
-
 /** First match wins, so element order matters for nested patterns. */
 export function buildNodes(elements: ModuleDef[]): ModuleNode[] {
   return elements.map((el) => ({
     type: el.type,
-    regex: globToRegex(el.pattern),
+    // dot:true so files in dot-directories (e.g. .storybook) still match.
+    regex: micromatch.makeRe(el.pattern, { dot: true }),
   }));
 }
 
@@ -210,8 +208,11 @@ export function buildModuleGraph(
     allTypes.map((type) => [type, new Set()]),
   );
   for (const rule of rules) {
+    // Grandfathered imports that break the disallow rules still exist in the code,
+    // and selection must cover every import that actually exists.
+    // So disallow rules are ignored, at the cost of a looser graph.
     const fromTypes = rule.from.flatMap(expandPattern);
-    const allowTypes = rule.allow.flatMap(expandPattern);
+    const allowTypes = (rule.allow ?? []).flatMap(expandPattern);
     for (const target of allowTypes) {
       for (const importer of fromTypes) {
         if (importer !== target) {

.github/scripts/affected-tests.ts

@@ -1,5 +1,7 @@
 // Builds the affected-tests plan from raw inputs: computes the rules and usage
 // affected-module sets and selects, per suite, which specs to run under each.
+import { getFeatureModules } from "../../frontend/lint/module-boundaries.mjs";
+
 import {
   type FileDependency,
   type ModuleDef,
@@ -14,7 +16,13 @@ import {
 
 export type TestPlanStats = {
   fe_files_changed: number;
+  fe_files_total: number;
   be_files_changed: number;
+  be_files_total: number;
+  unit_infra_touched: boolean;
+  loki_infra_touched: boolean;
+  shared_sources_touched: boolean;
+  fe_modules_total: number;
   fe_modules_changed: number;
   fe_modules_affected_rules: number;
   fe_modules_affected_usage: number;
@@ -43,11 +51,15 @@ export type CreateTestPlanInput = {
   // Parsed dependency-cruiser edges, or null to fall back to the rules graph.
   fileDependencies: FileDependency[] | null;
   testFilesBySuite: { unit: string[]; loki: string[]; e2e: string[] };
+  e2eSpecFiles: Record<string, string[]> | null;
   unitInfraTouched: boolean;
   lokiInfraTouched: boolean;
+  e2eInfraTouched: boolean;
   sharedSourcesTouched: boolean;
   feFilesChanged: number;
   beFilesChanged: number;
+  feFilesTotal: number;
+  beFilesTotal: number;
 };
 
 // Tests whose owning module is affected.
@@ -62,17 +74,73 @@ export function filterAffectedTests(
   });
 }
 
+// Collapse each spec's covered files to the *feature* modules it exercises,
+// once, for reuse across the rules/usage selects. Non-feature tiers
+// (shared/lib/...) are intentionally dropped: the manifest is a stale nightly
+// artifact, so its coupling to the module graph stays minimal ("does this spec
+// touch feature X?"). Accuracy comes from the fresh `affected` set, which
+// already expands a shared/infra change into the feature modules that depend on
+// it.
+export function specFeatureModules(
+  nodes: ModuleNode[],
+  featureModules: Set<string>,
+  specFiles: Record<string, string[]>,
+): Map<string, Set<string>> {
+  const moduleCache = new Map<string, string | null>();
+  const moduleOf = (file: string): string | null => {
+    let module = moduleCache.get(file);
+    if (module === undefined) {
+      module = mapFileToModule(nodes, file);
+      moduleCache.set(file, module);
+    }
+    return module;
+  };
+
+  const result = new Map<string, Set<string>>();
+  for (const [spec, files] of Object.entries(specFiles)) {
+    const features = new Set<string>();
+    for (const file of files) {
+      const module = moduleOf(file);
+      if (module !== null && featureModules.has(module)) {
+        features.add(module);
+      }
+    }
+    result.set(spec, features);
+  }
+  return result;
+}
+
+// A spec runs if any feature module it covers is affected.
+// A spec doesn't map to any feature module always runs because its scope is unknown
+export function filterAffectedE2eSpecs(
+  specFeatures: Map<string, Set<string>>,
+  affected: Set<string>,
+  e2eSpecs: string[],
+): string[] {
+  return e2eSpecs.filter((spec) => {
+    const features = specFeatures.get(spec);
+    if (!features || features.size === 0) {
+      return true;
+    }
+    return [...features].some((module) => affected.has(module));
+  });
+}
+
 export function createTestPlan({
   elements,
   rules,
   changedFiles,
   fileDependencies,
   testFilesBySuite,
+  e2eSpecFiles,
   unitInfraTouched,
   lokiInfraTouched,
+  e2eInfraTouched,
   sharedSourcesTouched,
   feFilesChanged,
   beFilesChanged,
+  feFilesTotal,
+  beFilesTotal,
 }: CreateTestPlanInput): TestPlan {
   const rulesGraph = buildModuleGraph(elements, rules);
   const usageGraph = fileDependencies
@@ -80,14 +148,29 @@ export function createTestPlan({
     : rulesGraph;
 
   const nodes = rulesGraph.nodes;
+  // Distinct module types (an element type can span several patterns).
+  const totalModules = new Set(elements.map((el) => el.type)).size;
   const changedModules = getChangedModules(nodes, changedFiles);
   const rulesAffected = getAffectedModules(rulesGraph, changedFiles);
   const usageAffected = getAffectedModules(usageGraph, changedFiles);
 
+  // The coarse "feature" tier is the only set the e2e manifest is ever
+  // collapsed to (see filterAffectedE2eSpecs).
+  const featureModules = new Set(getFeatureModules(elements));
+
   // cljc/cljs compile into the FE bundle, so they force a full run that module
   // selection can't narrow — same effect as a suite's own infra changing.
   const unitForceAll = unitInfraTouched || sharedSourcesTouched;
   const lokiForceAll = lokiInfraTouched || sharedSourcesTouched;
+  // e2e is integration-level, so anything the FE-coverage manifest can't see
+  // forces a full run: cljc/cljs in the bundle (sharedSourcesTouched), a backend
+  // change that can break the UI (beFilesChanged), an e2e harness/support change
+  // (e2eInfraTouched), or no manifest at all.
+  const e2eForceAll =
+    sharedSourcesTouched ||
+    e2eInfraTouched ||
+    beFilesChanged > 0 ||
+    e2eSpecFiles === null;
 
   const select = (forceAll: boolean, affected: Set<string>, files: string[]) =>
     forceAll ? files : filterAffectedTests(nodes, affected, files);
@@ -97,14 +180,36 @@ export function createTestPlan({
   const unitUsage = select(unitForceAll, usageAffected, unit);
   const lokiRules = select(lokiForceAll, rulesAffected, loki);
   const lokiUsage = select(lokiForceAll, usageAffected, loki);
-  // No e2e-spec -> module mapping exists yet, so e2e always runs in full.
-  const e2eRules = e2e;
-  const e2eUsage = e2e;
+
+  // Precompute spec -> feature modules once (null when e2e runs in full).
+  const specFeatures =
+    e2eForceAll || e2eSpecFiles === null
+      ? null
+      : specFeatureModules(nodes, featureModules, e2eSpecFiles);
+  // A spec that was itself edited always runs, even when no app module changed.
+  const changedSet = new Set(changedFiles);
+  const selectE2e = (affected: Set<string>): string[] => {
+    if (specFeatures === null) {
+      return e2e;
+    }
+    const narrowed = new Set(
+      filterAffectedE2eSpecs(specFeatures, affected, e2e),
+    );
+    return e2e.filter((spec) => narrowed.has(spec) || changedSet.has(spec));
+  };
+  const e2eRules = selectE2e(rulesAffected);
+  const e2eUsage = selectE2e(usageAffected);
 
   return {
     stats: {
       fe_files_changed: feFilesChanged,
+      fe_files_total: feFilesTotal,
       be_files_changed: beFilesChanged,
+      be_files_total: beFilesTotal,
+      unit_infra_touched: unitInfraTouched,
+      loki_infra_touched: lokiInfraTouched,
+      shared_sources_touched: sharedSourcesTouched,
+      fe_modules_total: totalModules,
       fe_modules_changed: changedModules.size,
       fe_modules_affected_rules: rulesAffected.size,
       fe_modules_affected_usage: usageAffected.size,

.github/scripts/affected-tests.unit.spec.ts

@@ -28,11 +28,15 @@ const baseInput = {
   rules: RULES,
   fileDependencies: null,
   testFilesBySuite: { unit: UNIT_FILES, loki: LOKI_FILES, e2e: E2E_FILES },
+  e2eSpecFiles: null,
   unitInfraTouched: false,
   lokiInfraTouched: false,
+  e2eInfraTouched: false,
   sharedSourcesTouched: false,
   feFilesChanged: 0,
   beFilesChanged: 0,
+  feFilesTotal: 0,
+  beFilesTotal: 0,
 };
 
 describe("createTestPlan", () => {
@@ -93,7 +97,7 @@ describe("createTestPlan", () => {
     expect(plan.stats.loki_stories_to_run_rules).toBe(0);
   });
 
-  it("always runs the full e2e suite", () => {
+  it("runs the full e2e suite when no coverage manifest is available", () => {
     const plan = createTestPlan({ ...baseInput, changedFiles: ["src/foo/x.ts"] });
 
     expect(plan.stats.e2e_specs_to_run_rules).toBe(E2E_FILES.length);
@@ -101,6 +105,119 @@ describe("createTestPlan", () => {
     expect(plan.e2e_specs_to_run).toEqual(E2E_FILES);
   });
 
+  it("narrows e2e to specs covering affected feature modules", () => {
+    const e2e = [
+      "e2e/test/scenarios/foo.cy.spec.ts",
+      "e2e/test/scenarios/bar.cy.spec.ts",
+      "e2e/test/scenarios/new.cy.spec.ts",
+    ];
+    const plan = createTestPlan({
+      ...baseInput,
+      changedFiles: ["src/foo/x.ts"], // affects feature/foo only
+      testFilesBySuite: { unit: UNIT_FILES, loki: LOKI_FILES, e2e },
+      e2eSpecFiles: {
+        "e2e/test/scenarios/foo.cy.spec.ts": ["src/foo/a.ts"], // feature/foo
+        "e2e/test/scenarios/bar.cy.spec.ts": ["src/bar/b.ts"], // feature/bar
+        // new.cy.spec.ts intentionally absent from the manifest
+      },
+    });
+
+    // foo's feature module is affected; bar's is not; the unmapped new spec
+    // always runs.
+    expect(plan.e2e_specs_to_run.sort()).toEqual([
+      "e2e/test/scenarios/foo.cy.spec.ts",
+      "e2e/test/scenarios/new.cy.spec.ts",
+    ]);
+    expect(plan.stats.e2e_specs_all).toBe(3);
+  });
+
+  it("runs a spec that maps to no feature module (unknown scope)", () => {
+    const e2e = ["e2e/test/scenarios/lib-only.cy.spec.ts"];
+    const plan = createTestPlan({
+      ...baseInput,
+      changedFiles: ["src/foo/x.ts"], // affects feature/foo, NOT lib/utils
+      testFilesBySuite: { unit: UNIT_FILES, loki: LOKI_FILES, e2e },
+      e2eSpecFiles: {
+        // Covers only a non-feature module (e.g. a home/auth spec whose feature
+        // the baseline subtracted), so its feature scope is unknown.
+        "e2e/test/scenarios/lib-only.cy.spec.ts": ["src/utils/colors.ts"],
+      },
+    });
+
+    // No feature module to gate on -> can't bound scope -> always runs.
+    expect(plan.e2e_specs_to_run).toEqual(e2e);
+  });
+
+  it("force-runs all e2e on a backend change (invisible to FE coverage)", () => {
+    const e2e = ["e2e/test/scenarios/foo.cy.spec.ts"];
+    const plan = createTestPlan({
+      ...baseInput,
+      changedFiles: ["src/metabase/api/card.clj"],
+      beFilesChanged: 1,
+      testFilesBySuite: { unit: UNIT_FILES, loki: LOKI_FILES, e2e },
+      e2eSpecFiles: { "e2e/test/scenarios/bar.cy.spec.ts": ["src/bar/b.ts"] },
+    });
+
+    expect(plan.e2e_specs_to_run).toEqual(e2e);
+  });
+
+  it("force-runs all e2e when e2e infra (support/runner) changes", () => {
+    const e2e = ["e2e/test/scenarios/foo.cy.spec.ts"];
+    const plan = createTestPlan({
+      ...baseInput,
+      changedFiles: ["e2e/support/commands/api/createQuestion.js"],
+      e2eInfraTouched: true,
+      testFilesBySuite: { unit: UNIT_FILES, loki: LOKI_FILES, e2e },
+      e2eSpecFiles: { "e2e/test/scenarios/bar.cy.spec.ts": ["src/bar/b.ts"] },
+    });
+
+    expect(plan.e2e_specs_to_run).toEqual(e2e);
+  });
+
+  it("runs an edited spec even when no app module changed", () => {
+    const spec = "e2e/test/scenarios/foo.cy.spec.ts";
+    const e2e = [spec, "e2e/test/scenarios/bar.cy.spec.ts"];
+    const plan = createTestPlan({
+      ...baseInput,
+      changedFiles: [spec], // only the spec itself changed
+      testFilesBySuite: { unit: UNIT_FILES, loki: LOKI_FILES, e2e },
+      e2eSpecFiles: {
+        [spec]: ["src/bar/b.ts"], // covers feature/bar, which is NOT affected
+        "e2e/test/scenarios/bar.cy.spec.ts": ["src/bar/b.ts"],
+      },
+    });
+
+    // No module is affected, but the edited spec must still run.
+    expect(plan.e2e_specs_to_run).toEqual([spec]);
+  });
+
+  it("runs a spec whose coverage was fully baseline-subtracted (empty files)", () => {
+    const e2e = ["e2e/test/scenarios/empty.cy.spec.ts"];
+    const plan = createTestPlan({
+      ...baseInput,
+      changedFiles: ["src/foo/x.ts"], // affects feature/foo
+      testFilesBySuite: { unit: UNIT_FILES, loki: LOKI_FILES, e2e },
+      e2eSpecFiles: { "e2e/test/scenarios/empty.cy.spec.ts": [] },
+    });
+
+    // Empty coverage means unknown scope, so the spec runs.
+    expect(plan.e2e_specs_to_run).toEqual(e2e);
+  });
+
+  it("forces a full e2e run when shared (cljc) sources change", () => {
+    const e2e = ["e2e/test/scenarios/foo.cy.spec.ts"];
+    const plan = createTestPlan({
+      ...baseInput,
+      changedFiles: ["src/foo/x.ts"],
+      sharedSourcesTouched: true,
+      testFilesBySuite: { unit: UNIT_FILES, loki: LOKI_FILES, e2e },
+      e2eSpecFiles: { "e2e/test/scenarios/bar.cy.spec.ts": ["src/bar/b.ts"] },
+    });
+
+    // Manifest is present but cljc is invisible to JS coverage, so run all.
+    expect(plan.e2e_specs_to_run).toEqual(e2e);
+  });
+
   it("passes the FE/BE file counts through to stats", () => {
     const plan = createTestPlan({
       ...baseInput,

.github/scripts/bundle-size-stats-prepare.js

@@ -0,0 +1,152 @@
+/* eslint-disable import/no-commonjs */
+// Prepares the rows the bundle-size stats logger uploads to stats.metabase.com.
+//
+// For each measured (bundle, kind) it computes the delta — raw, gzipped and
+// brotli (as-served) bytes plus percent — against the previously *plotted* data
+// point (restored from a rolling cache), so the deltas can be charted directly.
+// It also decides whether this commit is worth recording at all: a point is kept
+// when the as-served size moved by at least MIN_DELTA_PERCENT, or when a new
+// bundle/kind appears. Only master builds run through here — releases form
+// non-linear lines whose deltas are meaningless, so they're not recorded (their
+// historical sizes are backfilled separately).
+//
+// buildStatsRows is pure (data in, data out) so it can be unit-tested; main()
+// is the thin I/O wrapper that reads env/files and writes the rows, cache and
+// step outputs.
+const fs = require("fs");
+const path = require("path");
+
+const deltaPercent = (current, base) =>
+  base ? Math.round(((current - base) * 10000) / base) / 100 : "";
+
+/**
+ * Turn the current measurements + the last plotted point into upload rows, the
+ * slim cache rows for the next diff, and the keep/skip decision.
+ *
+ * The significance threshold tracks the as-served size: brotli where the build
+ * ships a precompressed .br, otherwise gzip. Current measurements always carry
+ * brotliBytes (estimated when no .br shipped), but a cached base point recorded
+ * before brotli logging may not, so the delta still falls back to gzip per row.
+ */
+function buildStatsRows({ measurements, previous, threshold, date, commit, commitMessage, version }) {
+  const previousOf = (bundle, kind) => previous.find(row => row.bundle === bundle && row.kind === kind);
+
+  let maxServedDeltaPercent = 0;
+  let hasNewSeries = false;
+
+  const rows = measurements.map(measurement => {
+    const base = previousOf(measurement.bundle, measurement.kind);
+    const hasBrotli = measurement.brotliBytes != null && base?.brotliBytes != null;
+    const gzipDeltaPercent = deltaPercent(measurement.gzipBytes, base?.gzipBytes);
+    const brotliDeltaPercent = hasBrotli ? deltaPercent(measurement.brotliBytes, base.brotliBytes) : "";
+    if (!base) {
+      hasNewSeries = true;
+    } else {
+      const servedDeltaPercent = hasBrotli ? brotliDeltaPercent : gzipDeltaPercent;
+      maxServedDeltaPercent = Math.max(maxServedDeltaPercent, Math.abs(servedDeltaPercent));
+    }
+    return {
+      "Date": date,
+      "Version": version,
+      "Commit": commit,
+      "Bundle": measurement.bundle,
+      "Kind": measurement.kind, // "initial" or "total"
+      // The stats table carries a free-text Description column; append-csv
+      // requires every table column to be present. Populate it with the commit
+      // subject so the chart's points are self-describing.
+      "Description": commitMessage,
+      "Raw bytes": measurement.rawBytes,
+      "Gzip bytes": measurement.gzipBytes,
+      "Brotli bytes": measurement.brotliBytes, // as-served (shipped .br, else estimated)
+      "File count": measurement.fileCount,
+      "Raw bytes delta": base ? measurement.rawBytes - base.rawBytes : "",
+      "Gzip bytes delta": base ? measurement.gzipBytes - base.gzipBytes : "",
+      "Brotli bytes delta": hasBrotli ? measurement.brotliBytes - base.brotliBytes : "",
+      "Raw delta %": deltaPercent(measurement.rawBytes, base?.rawBytes),
+      "Gzip delta %": gzipDeltaPercent,
+      "Brotli delta %": brotliDeltaPercent,
+    };
+  });
+
+  const firstPoint = previous.length === 0;
+  const significant = firstPoint || hasNewSeries || maxServedDeltaPercent >= threshold;
+
+  // Slim rows the next run diffs against. The workflow only persists this to the
+  // cache when we actually push, so the cached reference always stays the last
+  // *plotted* point (cumulative drift is caught).
+  const cacheRows = measurements.map(({ bundle, kind, rawBytes, gzipBytes, brotliBytes }) => ({
+    bundle,
+    kind,
+    rawBytes,
+    gzipBytes,
+    brotliBytes,
+  }));
+
+  const reason = firstPoint
+    ? "first point"
+    : hasNewSeries
+      ? "new bundle/kind series"
+      : `max served Δ ${maxServedDeltaPercent.toFixed(2)}% (threshold ${threshold}%)`;
+
+  return { rows, cacheRows, significant, reason, maxServedDeltaPercent, firstPoint, hasNewSeries };
+}
+
+module.exports = { buildStatsRows };
+
+const readJson = filePath => (filePath && fs.existsSync(filePath) ? JSON.parse(fs.readFileSync(filePath, "utf8")) : null);
+const writeJson = (filePath, value) => {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  fs.writeFileSync(filePath, JSON.stringify(value));
+};
+const setOutput = (env, name, value) => {
+  if (env.GITHUB_OUTPUT) {
+    fs.appendFileSync(env.GITHUB_OUTPUT, `${name}=${value}\n`);
+  }
+};
+
+// version.properties (extracted from the uberjar) carries the build's tag.
+// Non-release (master) builds report tag=vUNKNOWN, so leave Version empty there.
+function readVersion(versionPropsPath) {
+  const raw =
+    versionPropsPath && fs.existsSync(versionPropsPath)
+      ? (fs.readFileSync(versionPropsPath, "utf8").match(/^tag=(.*)$/m)?.[1]?.trim() ?? "")
+      : "";
+  return raw === "vUNKNOWN" ? "" : raw;
+}
+
+function main() {
+  const env = process.env;
+
+  const measurements = readJson(env.CURRENT);
+  if (!Array.isArray(measurements) || measurements.length === 0) {
+    console.error(`::error::No bundle measurements found at ${env.CURRENT}`);
+    process.exit(1);
+  }
+
+  const result = buildStatsRows({
+    measurements,
+    // The last plotted point, as slim rows: [{ bundle, kind, rawBytes, gzipBytes, brotliBytes }].
+    previous: readJson(env.LAST) || [],
+    threshold: Number(env.MIN_DELTA_PERCENT ?? 1),
+    date: new Date().toISOString().slice(0, 10), // YYYY-MM-DD
+    commit: (env.HEAD_SHA || "").slice(0, 12),
+    commitMessage: (env.COMMIT_MESSAGE || "").split("\n")[0], // subject line only
+    version: readVersion(env.VERSION_PROPS),
+  });
+
+  writeJson(env.ROWS_OUT, result.rows);
+  writeJson(env.CACHE_OUT, result.cacheRows);
+
+  console.log(`${result.significant ? "RECORD" : "SKIP"} — ${result.reason}`);
+
+  setOutput(env, "significant", result.significant ? "true" : "false");
+  setOutput(
+    env,
+    "max_delta_percent",
+    result.firstPoint || result.hasNewSeries ? "" : result.maxServedDeltaPercent.toFixed(2),
+  );
+}
+
+if (require.main === module) {
+  main();
+}

.github/scripts/bundle-size-stats-prepare.unit.spec.js

@@ -0,0 +1,87 @@
+const { buildStatsRows } = require("./bundle-size-stats-prepare");
+
+const meta = { date: "2026-06-30", commit: "abc123", commitMessage: "Fix the thing (#123)", version: "" };
+const measurement = (over = {}) => ({
+  bundle: "embedding-sdk-chunked",
+  kind: "total",
+  rawBytes: 1000,
+  gzipBytes: 400,
+  brotliBytes: 300,
+  fileCount: 3,
+  ...over,
+});
+
+describe("buildStatsRows", () => {
+  it("records the first point and leaves every delta empty", () => {
+    const result = buildStatsRows({
+      ...meta,
+      measurements: [measurement()],
+      previous: [],
+      threshold: 1,
+    });
+
+    expect(result.firstPoint).toBe(true);
+    expect(result.significant).toBe(true);
+    expect(result.reason).toBe("first point");
+    expect(result.rows[0]["Gzip bytes delta"]).toBe("");
+    expect(result.rows[0]["Brotli delta %"]).toBe("");
+    expect(result.rows[0]["Description"]).toBe("Fix the thing (#123)");
+    expect(result.cacheRows[0]).toEqual({
+      bundle: "embedding-sdk-chunked",
+      kind: "total",
+      rawBytes: 1000,
+      gzipBytes: 400,
+      brotliBytes: 300,
+    });
+  });
+
+  it("records a never-seen bundle/kind as a new series", () => {
+    const result = buildStatsRows({
+      ...meta,
+      measurements: [measurement({ bundle: "app", kind: "initial" })],
+      previous: [{ bundle: "app", kind: "total", rawBytes: 1, gzipBytes: 1, brotliBytes: 1 }],
+      threshold: 99,
+    });
+
+    expect(result.hasNewSeries).toBe(true);
+    expect(result.significant).toBe(true);
+    expect(result.reason).toBe("new bundle/kind series");
+  });
+
+  it("gates significance on the brotli (as-served) delta when both sides have it", () => {
+    const previous = [{ bundle: "embedding-sdk-chunked", kind: "total", rawBytes: 1000, gzipBytes: 400, brotliBytes: 300 }];
+
+    const big = buildStatsRows({
+      ...meta,
+      measurements: [measurement({ brotliBytes: 315, gzipBytes: 400 })], // brotli +5%, gzip 0%
+      previous,
+      threshold: 1,
+    });
+    expect(big.maxServedDeltaPercent).toBeCloseTo(5);
+    expect(big.significant).toBe(true);
+    expect(big.rows[0]["Brotli delta %"]).toBeCloseTo(5);
+
+    const small = buildStatsRows({
+      ...meta,
+      measurements: [measurement({ brotliBytes: 301, gzipBytes: 999 })], // brotli +0.33%, gzip ignored
+      previous,
+      threshold: 1,
+    });
+    expect(small.significant).toBe(false);
+    expect(small.reason).toContain("threshold 1%");
+  });
+
+  it("falls back to the gzip delta when the cached base predates brotli logging", () => {
+    const result = buildStatsRows({
+      ...meta,
+      measurements: [measurement({ gzipBytes: 440, brotliBytes: 300 })], // gzip +10%
+      previous: [{ bundle: "embedding-sdk-chunked", kind: "total", rawBytes: 1000, gzipBytes: 400 }],
+      threshold: 1,
+    });
+
+    expect(result.maxServedDeltaPercent).toBeCloseTo(10);
+    expect(result.significant).toBe(true);
+    expect(result.rows[0]["Brotli bytes delta"]).toBe(""); // no base brotli to diff against
+    expect(result.rows[0]["Gzip delta %"]).toBeCloseTo(10);
+  });
+});

.github/scripts/conventional-commit-pr-title-reminder/utils.js

@@ -1,109 +0,0 @@
-const TYPES = new Set([
-  "feat",
-  "fix",
-  "perf",
-  "docs",
-  "style",
-  "refactor",
-  "test",
-  "build",
-  "ci",
-]);
-
-/**
- * @param title {string}
- */
-function isConventionalTitle(title) {
-  const match = /^(?<type>\w+)\((?<rawScopes>[^)]+)\):/.exec(title);
-
-  if (!match) {
-    return false;
-  }
-
-  const [, type, rawScopes] = match;
-  const scopes = rawScopes
-    .split(",")
-    .map((scope) => scope.trim())
-    .filter(Boolean);
-
-  return TYPES.has(type) && scopes.length > 0;
-}
-
-/** @param {import('@types/github-script').AsyncFunctionArguments} AsyncFunctionArguments */
-async function updateCommentForEmbedding({ github, context }) {
-  const githubUsername = context.payload.sender.login;
-
-  const comment = `${CONVENTIONAL_COMMENT_IDENTIFIER}
-@${githubUsername} You have modified embedding code. Please make sure the PR title follows [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/) style.
-Here are all the supported types:
-- \`feat\`
-- \`fix\`
-- \`perf\`
-- \`docs\`
-- \`style\`
-- \`refactor\`
-- \`test\`
-- \`build\`
-- \`ci\`
-
-Please also make sure to include a scope.
-
-For example, these are valid PR titles:
-- \`feat(sdk-bundle): Add interactive dashboard component\`
-- \`fix(sdk-package): Fixed MetabaseProviderPropsStore logic\`
-- \`fix(sdk-package, embed-js): Fix API\``;
-
-  return updateComment(comment, { github, context });
-}
-
-/**
- * @param comment {string}
- * @param {import('@types/github-script').AsyncFunctionArguments} AsyncFunctionArguments
- */
-async function updateComment(comment, { github, context }) {
-  const owner = context.repo.owner;
-  const repo = context.repo.repo;
-  const pullRequestNumber = context.issue.number;
-  const comments = await github.rest.issues.listComments({
-    owner,
-    repo,
-    issue_number: pullRequestNumber,
-  });
-
-  const existingComment = getExistingConventionalCommitReminderComment(
-    comments.data,
-  );
-
-  if (existingComment) {
-    return await github.rest.issues.updateComment({
-      owner,
-      repo,
-      comment_id: existingComment.id,
-      body: comment,
-    });
-  } else {
-    return await github.rest.issues.createComment({
-      owner,
-      repo,
-      issue_number: pullRequestNumber,
-      body: comment,
-    });
-  }
-}
-
-const CONVENTIONAL_COMMENT_IDENTIFIER =
-  "<!---conventional comment identifier-->";
-
-/**
- * @param comments {{body: string}[]}
- */
-function getExistingConventionalCommitReminderComment(comments) {
-  for (const comment of comments) {
-    if (comment.body.startsWith(CONVENTIONAL_COMMENT_IDENTIFIER)) {
-      return comment;
-    }
-  }
-}
-
-exports.isConventionalTitle = isConventionalTitle;
-exports.updateCommentForEmbedding = updateCommentForEmbedding;

.github/scripts/conventional-commit-pr-title-reminder/utils.unit.spec.js

@@ -1,45 +0,0 @@
-const { isConventionalTitle } = require("./utils");
-
-describe("isConventionalTitle", () => {
-  it("returns true for a simple conventional commit", () => {
-    expect(isConventionalTitle("feat: add new feature")).toBe(false);
-  });
-
-  it("returns true for a commit with a scope", () => {
-    expect(isConventionalTitle("fix(api): correct API bug")).toBe(true);
-  });
-
-  it("returns true for a commit with multiple scopes, comma separated", () => {
-    expect(isConventionalTitle("feat(build,deps): update dependencies")).toBe(
-      true,
-    );
-  });
-
-  it("returns true for a commit with multiple scopes, comma separated with space", () => {
-    expect(isConventionalTitle("feat(build, deps): update dependencies")).toBe(
-      true,
-    );
-  });
-
-  it("returns false for a commit with round brackets in a message", () => {
-    expect(isConventionalTitle("feat: (something) update dependencies")).toBe(
-      false,
-    );
-  });
-
-  it("returns false for missing colon", () => {
-    expect(isConventionalTitle("feat add feature")).toBe(false);
-  });
-
-  it("returns false for invalid type", () => {
-    expect(isConventionalTitle("invalidType: some message")).toBe(false);
-  });
-
-  it("returns false for empty message", () => {
-    expect(isConventionalTitle("feat:")).toBe(false);
-  });
-
-  it("returns false for empty input", () => {
-    expect(isConventionalTitle("")).toBe(false);
-  });
-});

.github/scripts/create-test-plan.ts

@@ -4,45 +4,36 @@
 import { execFileSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
 
+import micromatch from "micromatch";
+
 import { elements, rules } from "../../frontend/lint/module-boundaries.mjs";
 
 import { type FileDependency, parseCruiseModules } from "./affected-modules";
 import { createTestPlan } from "./affected-tests";
+import { listSpecFiles } from "./e2e-spec-globs.mjs";
 
+const UNIT_ROOTS = ["frontend/src", "enterprise/frontend/src"];
 const UNIT_GLOBS = [
-  "frontend/src/**/*.unit.spec.js",
-  "frontend/src/**/*.unit.spec.jsx",
-  "frontend/src/**/*.unit.spec.ts",
-  "frontend/src/**/*.unit.spec.tsx",
-  "enterprise/frontend/src/**/*.unit.spec.js",
-  "enterprise/frontend/src/**/*.unit.spec.jsx",
-  "enterprise/frontend/src/**/*.unit.spec.ts",
-  "enterprise/frontend/src/**/*.unit.spec.tsx",
+  "frontend/src/**/*.unit.spec.{js,jsx,ts,tsx}",
+  "enterprise/frontend/src/**/*.unit.spec.{js,jsx,ts,tsx}",
 ];
 
+const STORY_ROOTS = ["frontend", "enterprise/frontend"];
 const STORY_GLOBS = [
-  "frontend/**/*.stories.js",
-  "frontend/**/*.stories.jsx",
-  "frontend/**/*.stories.ts",
-  "frontend/**/*.stories.tsx",
-  "enterprise/frontend/**/*.stories.js",
-  "enterprise/frontend/**/*.stories.jsx",
-  "enterprise/frontend/**/*.stories.ts",
-  "enterprise/frontend/**/*.stories.tsx",
+  "frontend/**/*.stories.{js,jsx,ts,tsx}",
+  "enterprise/frontend/**/*.stories.{js,jsx,ts,tsx}",
 ];
 
-const E2E_GLOBS = [
-  "e2e/test/scenarios/**/*.cy.spec.js",
-  "e2e/test/scenarios/**/*.cy.spec.jsx",
-  "e2e/test/scenarios/**/*.cy.spec.ts",
-  "e2e/test/scenarios/**/*.cy.spec.tsx",
-];
-
-function listFiles(globs: string[]): string[] {
-  return execFileSync("git", ["ls-files", "--", ...globs], { encoding: "utf8" })
+// Returns the tracked files under `roots` that match `globs`. The `dot: true`
+// option means files inside dot-directories such as `.storybook` are included.
+function listFiles(roots: string[], globs: string[]): string[] {
+  const tracked = execFileSync("git", ["ls-files", "--", ...roots], {
+    encoding: "utf8",
+  })
     .split("\n")
     .map((line) => line.trim())
     .filter(Boolean);
+  return micromatch(tracked, globs, { dot: true });
 }
 
 // dorny outputs comma-separated lists; CHANGED_FILES is `all_changed_files`.
@@ -74,21 +65,48 @@ function readFileDependencies(): FileDependency[] | null {
   return null;
 }
 
+// Reads the nightly coverage manifest (E2E_SPEC_MANIFEST): { builtAt, specs:
+// { spec -> files } }. Returns the specs map, or null so e2e falls back to a
+// full run when the manifest is missing/unparseable.
+function readE2eSpecFiles(): Record<string, string[]> | null {
+  const path = process.env.E2E_SPEC_MANIFEST;
+  if (path && existsSync(path)) {
+    try {
+      const { specs } = JSON.parse(readFileSync(path, "utf8"));
+      if (specs && typeof specs === "object") {
+        process.stderr.write(`Using e2e coverage manifest from ${path}.\n`);
+        return specs;
+      }
+    } catch (error) {
+      process.stderr.write(
+        `Failed to read ${path}; e2e will run in full: ${error}\n`,
+      );
+    }
+  } else {
+    process.stderr.write("No E2E_SPEC_MANIFEST found; e2e will run in full.\n");
+  }
+  return null;
+}
+
 const testPlan = createTestPlan({
   elements,
   rules,
   changedFiles: csvToList(process.env.CHANGED_FILES),
   fileDependencies: readFileDependencies(),
   testFilesBySuite: {
-    unit: listFiles(UNIT_GLOBS),
-    loki: listFiles(STORY_GLOBS),
-    e2e: listFiles(E2E_GLOBS),
+    unit: listFiles(UNIT_ROOTS, UNIT_GLOBS),
+    loki: listFiles(STORY_ROOTS, STORY_GLOBS),
+    e2e: listSpecFiles(),
   },
+  e2eSpecFiles: readE2eSpecFiles(),
   unitInfraTouched: process.env.UNIT_INFRA_TOUCHED === "true",
   lokiInfraTouched: process.env.LOKI_INFRA_TOUCHED === "true",
+  e2eInfraTouched: process.env.E2E_INFRA_TOUCHED === "true",
   sharedSourcesTouched: process.env.SHARED_SOURCES_TOUCHED === "true",
   feFilesChanged: csvToList(process.env.FE_CHANGED_FILES).length,
   beFilesChanged: csvToList(process.env.BE_CHANGED_FILES).length,
+  feFilesTotal: listFiles(["frontend", "enterprise/frontend"], ["**"]).length,
+  beFilesTotal: listFiles(["src", "enterprise/backend"], ["**"]).length,
 });
 
 process.stdout.write(JSON.stringify(testPlan) + "\n");

.github/scripts/csv-to-mb.js

@@ -19,23 +19,73 @@ function jsonToCsvFormData(jsonData) {
   return formData;
 }
 
-async function uploadCsvToMb({ baseUrl, tableId, jsonData, mode = 'append' }) {
-  const formData = jsonToCsvFormData(jsonData);
-  const operation = mode === 'replace' ? 'replace-csv' : 'append-csv';
+// Transient failures worth retrying: throttling and server-side errors. A 4xx
+// (bad request, auth) won't succeed on retry, so those fail fast.
+const RETRYABLE_STATUS = new Set([429, 500, 502, 503, 504]);
 
-  const response = await fetch(`${baseUrl}/api/table/${tableId}/${operation}`, {
-    method: 'POST',
-    headers: {
-      "x-api-key": process.env.API_KEY
-    },
-    body: formData
-  });
-
-  if (!response.ok) {
-    const body = await response.text().catch(() => '');
-    throw new Error(`Upload failed: ${response.status} ${response.statusText} ${body}`.trim());
+class UploadError extends Error {
+  constructor(message, { retryable }) {
+    super(message);
+    this.retryable = retryable;
+  }
+}
+
+async function attemptUpload(url, jsonData, timeoutMs) {
+  let response;
+  try {
+    response = await fetch(url, {
+      method: 'POST',
+      headers: {
+        "x-api-key": process.env.API_KEY
+      },
+      // Rebuilt per attempt: a consumed request body can't be reused.
+      body: jsonToCsvFormData(jsonData),
+      // Without this the request can hang indefinitely on a stalled server,
+      // eating the whole job timeout. An abort surfaces below as a retryable
+      // network error, so it retries with backoff instead.
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+  } catch (networkError) {
+    throw new UploadError(networkError.message, { retryable: true });
+  }
+
+  if (response.ok) {
+    return;
+  }
+
+  const body = await response.text().catch(() => '');
+  throw new UploadError(
+    `Upload failed: ${response.status} ${response.statusText} ${body}`.trim(),
+    { retryable: RETRYABLE_STATUS.has(response.status) }
+  );
+}
+
+const sleep = ms => new Promise(resolve => setTimeout(resolve, ms));
+
+/**
+ * Uploads jsonData as CSV, retrying transient API errors with exponential
+ * backoff. `retries` is the number of extra attempts after the first (so the
+ * default 2 means up to 3 tries). `timeoutMs` is a per-attempt total deadline
+ * (default 60s) that aborts a stalled request. Throws the last error once
+ * attempts are exhausted or the error is non-retryable.
+ */
+async function uploadCsvToMb({ baseUrl, tableId, jsonData, mode = 'append', retries = 2, retryDelayMs = 1000, timeoutMs = 60_000 }) {
+  const operation = mode === 'replace' ? 'replace-csv' : 'append-csv';
+  const url = `${baseUrl}/api/table/${tableId}/${operation}`;
+
+  for (let attempt = 0; ; attempt++) {
+    try {
+      await attemptUpload(url, jsonData, timeoutMs);
+      return { success: true };
+    } catch (error) {
+      if (!error.retryable || attempt >= retries) {
+        throw error;
+      }
+      const delay = retryDelayMs * 2 ** attempt;
+      console.warn(`Upload attempt ${attempt + 1} failed (${error.message}); retrying in ${delay}ms`);
+      await sleep(delay);
+    }
   }
-  return { success: true };
 }
 
 module.exports = { uploadCsvToMb };

.github/scripts/csv-to-mb.unit.spec.js

@@ -0,0 +1,50 @@
+const { uploadCsvToMb } = require("./csv-to-mb");
+
+const ok = () => ({ ok: true });
+const fail = status => ({ ok: false, status, statusText: "err", text: async () => "" });
+
+const upload = (over = {}) =>
+  uploadCsvToMb({
+    baseUrl: "https://stats.example.com",
+    tableId: 1,
+    jsonData: [{ a: 1 }],
+    retryDelayMs: 1,
+    ...over,
+  });
+
+describe("uploadCsvToMb retries", () => {
+  afterEach(() => {
+    delete global.fetch;
+  });
+
+  it("retries transient server errors then succeeds", async () => {
+    global.fetch = jest.fn().mockResolvedValueOnce(fail(503)).mockResolvedValueOnce(fail(500)).mockResolvedValueOnce(ok());
+
+    await expect(upload({ retries: 2 })).resolves.toEqual({ success: true });
+    expect(global.fetch).toHaveBeenCalledTimes(3);
+  });
+
+  it("retries network errors", async () => {
+    global.fetch = jest
+      .fn()
+      .mockRejectedValueOnce(new Error("ECONNRESET"))
+      .mockResolvedValueOnce(ok());
+
+    await expect(upload({ retries: 2 })).resolves.toEqual({ success: true });
+    expect(global.fetch).toHaveBeenCalledTimes(2);
+  });
+
+  it("gives up after exhausting retries and throws the last error", async () => {
+    global.fetch = jest.fn().mockResolvedValue(fail(500));
+
+    await expect(upload({ retries: 2 })).rejects.toThrow("Upload failed: 500");
+    expect(global.fetch).toHaveBeenCalledTimes(3); // 1 initial + 2 retries
+  });
+
+  it("does not retry a non-transient 4xx", async () => {
+    global.fetch = jest.fn().mockResolvedValue(fail(400));
+
+    await expect(upload({ retries: 2 })).rejects.toThrow("Upload failed: 400");
+    expect(global.fetch).toHaveBeenCalledTimes(1);
+  });
+});

.github/scripts/e2e-spec-globs.mjs

@@ -0,0 +1,32 @@
+import { execFileSync } from "node:child_process";
+
+import micromatch from "micromatch";
+
+const SPEC_DIR = "e2e/test/scenarios";
+
+// This is the nightly-only baseline helper that runs in the instrumented pass to
+// capture boot-time coverage. It is not a product spec, so it is excluded from
+// the test plan universe and from the manifest backfill reconciliation.
+export const BASELINE_SPEC = `${SPEC_DIR}/coverage-baseline.cy.spec.js`;
+
+// This glob set defines the spec "universe". The test planner
+// (create-test-plan.ts) selects which specs to run from it, and the coverage
+// manifest builder (build-coverage-manifest.mjs) reconciles against it when
+// backfilling specs that did not run.
+export const E2E_SPEC_GLOBS = [`${SPEC_DIR}/**/*.cy.spec.{js,jsx,ts,tsx}`];
+
+// Returns the tracked e2e specs as repo-relative paths, excluding the baseline
+// helper.
+export function listSpecFiles(cwd = process.cwd()) {
+  const tracked = execFileSync("git", ["ls-files", "--", SPEC_DIR], {
+    cwd,
+    encoding: "utf8",
+  })
+    .split("\n")
+    .map((line) => line.trim())
+    .filter(Boolean);
+  return micromatch(tracked, E2E_SPEC_GLOBS, {
+    ignore: [BASELINE_SPEC],
+    dot: true,
+  });
+}

.github/scripts/fix-yarn-lock-aliases.ts

@@ -0,0 +1,66 @@
+/**
+ * Renames aliased dependency keys in a bun-generated yarn.lock.
+ *
+ * Yarn names an alias entry after the alias, for example
+ * `"typescript7@npm:typescript@7.0.2"`. Bun names it after the aliased package
+ * instead, for example `"typescript@npm:typescript@7.0.2"`. Snyk follows the
+ * yarn convention and fails to resolve the dependency.
+ */
+
+import { readFile, writeFile } from "node:fs/promises";
+
+async function main() {
+  const packageJsonPath = `${process.cwd()}/package.json`;
+  const lockPath = `${process.cwd()}/yarn.lock`;
+
+  const packageJson = JSON.parse(await readFile(packageJsonPath, "utf8"));
+
+  const dependencies = Object.entries<string>(
+    Object.assign(
+      {},
+      packageJson.dependencies,
+      packageJson.devDependencies,
+      packageJson.optionalDependencies,
+    ),
+  );
+
+  let lock = await readFile(lockPath, "utf8");
+  const renamedKeys: string[] = [];
+
+  for (const [alias, specifier] of dependencies) {
+    if (!specifier.startsWith("npm:")) {
+      continue;
+    }
+
+    const aliasedPackage = specifier
+      .slice("npm:".length)
+      .replace(/@[^@]*$/, "");
+
+    if (aliasedPackage === alias) {
+      continue;
+    }
+
+    const bunKey = `"${aliasedPackage}@${specifier}"`;
+    const yarnKey = `"${alias}@${specifier}"`;
+
+    if (lock.includes(bunKey)) {
+      lock = lock.replaceAll(bunKey, yarnKey);
+      renamedKeys.push(`${bunKey} -> ${yarnKey}`);
+    }
+  }
+
+  if (renamedKeys.length > 0) {
+    await writeFile(lockPath, lock);
+  }
+
+  process.stdout.write(
+    renamedKeys.length > 0
+      ? `Renamed alias keys in yarn.lock:\n${renamedKeys.join("\n")}\n`
+      : "No alias keys to rename in yarn.lock\n",
+  );
+}
+
+main().catch((error) => {
+  process.stderr.write(`Failed to rename alias keys in yarn.lock: ${error}\n`);
+  process.exit(1);
+});

.github/scripts/get-issue-data.js

@@ -1,84 +0,0 @@
-const githubSlackMap = require("../../release/github-slack-map.json");
-
-async function getIssueData({ context, github, manualIssueNumber }) {
-  let issueNumber;
-  let issueData;
-  let prReviews = [];
-  const triggerType = context.eventName;
-
-  if (context.eventName === "issues") {
-    issueNumber = context.payload.issue.number;
-    issueData = context.payload.issue;
-  } else if (context.eventName === "workflow_dispatch") {
-    issueNumber = parseInt(manualIssueNumber);
-    const { data } = await github.rest.issues.get({
-      owner: context.repo.owner,
-      repo: context.repo.repo,
-      issue_number: issueNumber,
-    });
-    issueData = data;
-  } else if (context.eventName === "pull_request_review") {
-    const prNumber = context.payload.pull_request.number;
-    const { data: prData } = await github.rest.pulls.get({
-      owner: context.repo.owner,
-      repo: context.repo.repo,
-      pull_number: prNumber,
-    });
-
-    // Extract issue number from branch name (e.g., "claude-fix/issue-12345-some-title")
-    const branchMatch = prData.head.ref.match(/claude-fix\/issue-(\d+)/);
-    if (!branchMatch) {
-      throw new Error(
-        `Could not extract issue number from branch name: ${prData.head.ref}`,
-      );
-    }
-
-    issueNumber = parseInt(branchMatch[1]);
-
-    const { data } = await github.rest.issues.get({
-      owner: context.repo.owner,
-      repo: context.repo.repo,
-      issue_number: issueNumber,
-    });
-    issueData = data;
-
-    const { data: reviews } = await github.rest.pulls.listReviews({
-      owner: context.repo.owner,
-      repo: context.repo.repo,
-      pull_number: prNumber,
-    });
-
-    prReviews = reviews.filter(
-      (review) =>
-        review.state === "CHANGES_REQUESTED" &&
-        isMetabaseMember(review.user.login),
-    );
-  }
-
-  const { data: comments } = await github.rest.issues.listComments({
-    owner: context.repo.owner,
-    repo: context.repo.repo,
-    issue_number: issueNumber,
-  });
-
-  const employeeComments = comments.filter((comment) =>
-    isMetabaseMember(comment.user.login),
-  );
-
-  return {
-    issueNumber,
-    issueData,
-    employeeComments,
-    prReviews,
-    triggerType,
-    isIssueAuthorEmployee: isMetabaseMember(issueData.user.login),
-  };
-}
-
-function isMetabaseMember(username) {
-  return username in githubSlackMap;
-}
-
-module.exports = {
-  getIssueData,
-};

.github/scripts/measure-bundle-sizes.js

@@ -1,68 +1,58 @@
 /* eslint-disable import/no-commonjs */
+// Measures the front-end bundles emitted into an extracted uberjar tree.
+//
+// Every bundle reports one or both of:
+//  - "initial": JS the browser downloads on first paint (the entry chunk plus
+//    its initial/sync split chunks). Never excludes initial chunks.
+//  - "total":   all *reachable* JS (initial plus async chunks that are actually
+//    loadable at runtime). Never includes unreachable/never-fetched chunks.
+// Reachability needs the per-entry asset list from the rspack stats file, so the
+// app and chunked SDK bundles require their stats file to be present.
+//
+// The pure pieces — the asset-name selection (initial vs reachable, runtime
+// filtering, the async-loadable flag) — are split out as select*Assets so they
+// can be unit-tested against a stats object. The measure* functions and main()
+// keep all the filesystem and env I/O, threading an explicit `config`.
 const fs = require("fs");
 const path = require("path");
 const zlib = require("zlib");
 
-// MEASURE_ROOT lets callers point at an extracted tree (e.g. the PR bundle-size
-// check measures a current and a base-ref tree); defaults to cwd for the stats
-// workflow. MEASURE_BUNDLES restricts which bundles are measured (comma-separated).
-const baseDir = process.env.MEASURE_ROOT ? path.resolve(process.env.MEASURE_ROOT) : process.cwd();
-const resolve = (...relativeParts) => path.resolve(baseDir, ...relativeParts);
-const bundleFilter = process.env.MEASURE_BUNDLES
-  ? new Set(process.env.MEASURE_BUNDLES.split(",").map(bundle => bundle.trim()))
-  : null;
-const isBundleWanted = bundle => !bundleFilter || bundleFilter.has(bundle);
-
+const APP_DIST = "resources/frontend_client/app/dist";
 const SDK_ROOT = "resources/frontend_client/app/embedding-sdk";
 
-/**
- * Async SDK chunks are reachable now that the runtime publicPath is set, so the
- * bootstrap can fetch import() chunks on demand. "total" therefore includes the
- * lazy chunks while "initial" stays the eager first-load set. There's no reliable
- * way to detect loadability from the build artifacts, so this stays a manual flag:
- * it was flipped to true alongside the publicPath fix.
- */
-const SDK_ASYNC_CHUNKS_LOADABLE = true;
-
 // The chunk runtime is inlined into the bootstrap, never sent as a standalone file.
 const SDK_RUNTIME_RE = /embedding-sdk-chunk-runtime\./;
+const notRuntime = name => !SDK_RUNTIME_RE.test(name);
 
-/**
- * Simple targets measured straight from emitted files.
- * - `dir`/`file`/`altFile`: what to measure (altFile is a fallback single file).
- * - `stats`: entrypoint whose initial assets are the "initial" download.
- * - `optional`: skip (don't fail) when the output is absent.
- * The hosted SDK is split into embedding-sdk-legacy (the self-contained
- * monolith) and embedding-sdk-chunked (handled separately below).
- */
-const simpleTargets = [
-  {
-    bundle: "app",
-    dir: "resources/frontend_client/app/dist",
-    stats: { file: "artifacts/stats-main.json", entrypoint: "app-main" },
-  },
-  {
-    bundle: "embedding-sdk-legacy",
-    dir: `${SDK_ROOT}/legacy`,
-    altFile: `${SDK_ROOT}.js`,
-    optional: true,
-  },
-  {
-    bundle: "embedding-sdk-package",
-    dir: "resources/embedding-sdk/dist",
-    optional: true,
-  },
-  {
-    bundle: "embed-js",
-    file: "resources/frontend_client/app/embed.js",
-  },
-];
+const assetFiles = (root, names) => names.map(name => path.join(root, name));
+const unique = files => [...new Set(files)];
+
+// MEASURE_ROOT lets callers point at an extracted tree (e.g. the PR bundle-size
+// check measures a current and a base-ref tree); defaults to cwd for the stats
+// workflow. MEASURE_BUNDLES restricts which bundles are measured (comma-separated).
+// SDK_ASYNC_CHUNKS_LOADABLE (see selectChunkedSdkAssets) toggles whether async
+// SDK chunks count toward "total".
+function buildConfig(env) {
+  const baseDir = env.MEASURE_ROOT ? path.resolve(env.MEASURE_ROOT) : process.cwd();
+  const bundleFilter = env.MEASURE_BUNDLES
+    ? new Set(env.MEASURE_BUNDLES.split(",").map(bundle => bundle.trim()))
+    : null;
+  return {
+    resolve: (...relativeParts) => path.resolve(baseDir, ...relativeParts),
+    isBundleWanted: bundle => !bundleFilter || bundleFilter.has(bundle),
+    // Async SDK chunks are reachable once output.publicPath is set so import()
+    // chunks are actually fetched at runtime — which landed in master. Defaults
+    // to true to match master; set SDK_ASYNC_CHUNKS_LOADABLE=false to measure an
+    // older commit built before the publicPath fix (async unreachable, so
+    // "total" collapses to "initial").
+    sdkAsyncChunksLoadable: env.SDK_ASYNC_CHUNKS_LOADABLE !== "false",
+  };
+}
 
 function sizeOf(files) {
   let rawBytes = 0;
   let gzipBytes = 0;
   let brotliBytes = 0;
-  let anyBrotli = false;
   for (const file of files) {
     const contents = fs.readFileSync(file);
     rawBytes += contents.length;
@@ -70,20 +60,17 @@ function sizeOf(files) {
     gzipBytes += zlib.gzipSync(contents).length;
     // brotli: as-served — count the precompressed .br the build ships; files
     // without one (static-viz, sub-threshold chunks) are served compressed on
-    // the fly, so estimate with brotli. Null when no .br shipped at all.
+    // the fly, so estimate with brotli. Always reported (like gzip).
     const brotliPath = `${file}.br`;
-    if (fs.existsSync(brotliPath)) {
-      anyBrotli = true;
-      brotliBytes += fs.statSync(brotliPath).size;
-    } else {
-      brotliBytes += zlib.brotliCompressSync(contents).length;
-    }
+    brotliBytes += fs.existsSync(brotliPath)
+      ? fs.statSync(brotliPath).size
+      : zlib.brotliCompressSync(contents).length;
   }
   return {
     fileCount: files.length,
     rawBytes,
     gzipBytes,
-    brotliBytes: anyBrotli ? brotliBytes : null,
+    brotliBytes,
   };
 }
 
@@ -102,104 +89,170 @@ function collectJsFiles(absolutePath) {
     });
 }
 
-function readStats(statsFile) {
-  const statsPath = resolve(statsFile);
+function readStats(config, statsFile) {
+  const statsPath = config.resolve(statsFile);
   return fs.existsSync(statsPath) ? JSON.parse(fs.readFileSync(statsPath, "utf8")) : null;
 }
 
-function entrypointJsAssets(stats, name) {
+// An entrypoint's .js assets for a given field: "assets" = its initial
+// (synchronous) load; "reachableAssets" = initial plus everything it can lazily
+// import (the chunk graph walked at build time in bundle-stats.js).
+function entrypointJsAssets(stats, name, field = "assets") {
   const entry = stats && stats.entrypoints && stats.entrypoints[name];
-  if (!entry) {
+  if (!entry || !entry[field]) {
     return null;
   }
-  return entry.assets.map(asset => asset.name || asset).filter(name => name.endsWith(".js"));
-}
-
-function initialJsFiles({ file: statsFile, entrypoint, root }, joinRoot) {
-  const stats = readStats(statsFile);
-  if (!stats) {
-    console.warn(`Stats file missing (${statsFile}); reporting initial == total.`);
-    return null;
-  }
-  const assets = entrypointJsAssets(stats, entrypoint);
-  if (!assets) {
-    console.warn(`Entrypoint "${entrypoint}" missing in ${statsFile}; reporting initial == total.`);
-    return null;
-  }
-  const base = root ? resolve(root) : joinRoot;
-  return assets.map(name => path.join(base, name));
-}
-
-function measureSimpleTarget({ bundle, dir, file, altFile, stats, optional }) {
-  const candidates = [dir, file, altFile].filter(Boolean);
-  const chosen = candidates.find(c => fs.existsSync(resolve(c)));
-  if (!chosen) {
-    if (optional) {
-      console.warn(`Skipping "${bundle}": output not found (${candidates.join(", ")})`);
-      return [];
-    }
-    throw new Error(`Bundle output not found for "${bundle}": ${candidates.join(", ")}`);
-  }
-
-  const root = resolve(chosen);
-  const total = sizeOf(collectJsFiles(root));
-  const initialFiles = stats ? initialJsFiles(stats, root) : null;
-  const initial = initialFiles ? sizeOf(initialFiles) : total;
-
-  return [
-    { bundle, kind: "initial", ...initial },
-    { bundle, kind: "total", ...total },
-  ];
+  return entry[field].map(asset => asset.name || asset).filter(assetName => assetName.endsWith(".js"));
 }
 
 /**
- * Chunked SDK delivery. "Reachable" = what the bootstrap actually sends: the
- * bootstrap (with its inlined runtime) + the chunked entry's initial chunks,
- * minus the standalone runtime file. Async chunks are excluded (initial == total)
- * unless SDK_ASYNC_CHUNKS_LOADABLE is set, at which point "total" includes them.
+ * Main app = the app-main entrypoint only (app/dist also holds other pages like
+ * app-public, app-embed*, which are not the app). `reachableAssets` is null on
+ * older stats built before the chunk-graph enrichment — the caller then falls
+ * back to sizing the whole app/dist.
  */
-function measureChunkedSdk(statsFile) {
-  const chunksDir = resolve(SDK_ROOT, "chunks");
+function selectAppAssets(stats) {
+  const initialAssets = entrypointJsAssets(stats, "app-main", "assets");
+  if (!initialAssets) {
+    throw new Error('app: stats-main.json / "app-main" entrypoint missing');
+  }
+  return { initialAssets, reachableAssets: entrypointJsAssets(stats, "app-main", "reachableAssets") };
+}
+
+/**
+ * Legacy SDK: the "embedding-sdk" entry, a single eager file in legacy/. It still
+ * emits on-demand chunks (jspdf, echarts, leaflet, ...) into the shared chunks/
+ * dir via dynamic import(). initial = the eager legacy file; total = initial plus
+ * its reachable async chunks, but only when those are loadable at runtime
+ * (sdkAsyncChunksLoadable), otherwise total collapses to initial. Returns null
+ * when the stats lack the entry (older layout) so the caller can fall back.
+ */
+function selectLegacySdkAssets(stats, { sdkAsyncChunksLoadable }) {
+  const initialNames = entrypointJsAssets(stats, "embedding-sdk", "assets");
+  if (!initialNames) {
+    return null;
+  }
+  const reachableNames = entrypointJsAssets(stats, "embedding-sdk", "reachableAssets") || initialNames;
+  const initial = unique(initialNames).filter(notRuntime);
+  return {
+    initialNames: initial,
+    reachableNames: sdkAsyncChunksLoadable ? unique(reachableNames).filter(notRuntime) : initial,
+  };
+}
+
+/**
+ * Chunked SDK delivery. initial = bootstrap (minus its inlined runtime) + the
+ * chunked entry's initial chunks. total = the chunked entry's reachable set
+ * (initial + async children, from the chunk graph). includesAsyncChunks is true
+ * only when the stats carry the reachable chunk graph AND those chunks are
+ * loadable at runtime (sdkAsyncChunksLoadable). A base ref built before the
+ * reachableAssets enrichment has no graph, so its "total" must collapse to
+ * "initial" — the flag lets the comparison avoid measuring a reachable total
+ * against a collapsed one (an apples-to-oranges ~30% phantom).
+ */
+function selectChunkedSdkAssets(stats, { sdkAsyncChunksLoadable }) {
+  const chunkedInitial = entrypointJsAssets(stats, "embedding-sdk-chunked", "assets");
+  if (!chunkedInitial) {
+    throw new Error('embedding-sdk-chunked: stats-embedding-sdk.json / "embedding-sdk-chunked" entrypoint missing');
+  }
+  const bootstrapInitial = entrypointJsAssets(stats, "embedding-sdk-bootstrap", "assets") || [];
+  const chunkedReachableAssets = entrypointJsAssets(stats, "embedding-sdk-chunked", "reachableAssets");
+  const chunkedReachable = chunkedReachableAssets || chunkedInitial;
+  const bootstrapReachable = entrypointJsAssets(stats, "embedding-sdk-bootstrap", "reachableAssets") || bootstrapInitial;
+  return {
+    initialNames: unique([...bootstrapInitial, ...chunkedInitial]).filter(notRuntime),
+    reachableNames: unique([...bootstrapReachable, ...chunkedReachable]).filter(notRuntime),
+    includesAsyncChunks: chunkedReachableAssets != null && sdkAsyncChunksLoadable,
+  };
+}
+
+function measureApp(config) {
+  const dist = config.resolve(APP_DIST);
+  if (!fs.existsSync(dist)) {
+    throw new Error(`Bundle output not found for "app": ${dist}`);
+  }
+  const { initialAssets, reachableAssets } = selectAppAssets(readStats(config, "artifacts/stats-main.json"));
+  if (!reachableAssets) {
+    console.warn("app: stats has no reachableAssets; app total falls back to the whole app/dist");
+  }
+  const totalFiles = reachableAssets ? assetFiles(dist, reachableAssets) : collectJsFiles(dist);
+  return [
+    { bundle: "app", kind: "initial", ...sizeOf(assetFiles(dist, initialAssets)) },
+    { bundle: "app", kind: "total", ...sizeOf(totalFiles) },
+  ];
+}
+
+function measureLegacySdk(config) {
+  const absRoot = config.resolve(SDK_ROOT);
+  const selected = selectLegacySdkAssets(readStats(config, "artifacts/stats-embedding-sdk.json"), config);
+  if (!selected) {
+    // No stats / older layout: fall back to whatever sits in the legacy dir.
+    const candidates = [`${SDK_ROOT}/legacy`, `${SDK_ROOT}.js`];
+    const chosen = candidates.find(candidate => fs.existsSync(config.resolve(candidate)));
+    if (!chosen) {
+      console.warn(`Skipping "embedding-sdk-legacy": output not found (${candidates.join(", ")})`);
+      return [];
+    }
+    return [{ bundle: "embedding-sdk-legacy", kind: "total", ...sizeOf(collectJsFiles(config.resolve(chosen))) }];
+  }
+  return [
+    { bundle: "embedding-sdk-legacy", kind: "initial", ...sizeOf(assetFiles(absRoot, selected.initialNames)) },
+    { bundle: "embedding-sdk-legacy", kind: "total", ...sizeOf(assetFiles(absRoot, selected.reachableNames)) },
+  ];
+}
+
+function measureChunkedSdk(config) {
+  const chunksDir = config.resolve(SDK_ROOT, "chunks");
   if (!fs.existsSync(chunksDir)) {
     // pre-chunked layout (monolith only) — nothing to measure here
     return [];
   }
-
-  const absRoot = resolve(SDK_ROOT);
-  const everything = collectJsFiles(chunksDir).filter(f => !SDK_RUNTIME_RE.test(f));
-
-  const stats = readStats(statsFile);
-  const chunked = entrypointJsAssets(stats, "embedding-sdk-chunked");
-  let reachableFiles;
-  if (chunked) {
-    const bootstrap = entrypointJsAssets(stats, "embedding-sdk-bootstrap") || [];
-    const names = [...new Set([...bootstrap, ...chunked])].filter(n => !SDK_RUNTIME_RE.test(n));
-    reachableFiles = names.map(n => path.join(absRoot, n));
-  } else {
-    console.warn(`embedding-sdk-chunked: entrypoint missing in ${statsFile}; counting whole chunks/ dir`);
-    reachableFiles = everything;
-  }
-
-  const initial = sizeOf(reachableFiles);
-  const total = SDK_ASYNC_CHUNKS_LOADABLE ? sizeOf(everything) : sizeOf(reachableFiles);
-
+  const absRoot = config.resolve(SDK_ROOT);
+  const { initialNames, reachableNames, includesAsyncChunks } = selectChunkedSdkAssets(
+    readStats(config, "artifacts/stats-embedding-sdk.json"),
+    config,
+  );
+  const initial = sizeOf(assetFiles(absRoot, initialNames));
+  const total = includesAsyncChunks ? sizeOf(assetFiles(absRoot, reachableNames)) : initial;
   return [
     { bundle: "embedding-sdk-chunked", kind: "initial", ...initial },
-    { bundle: "embedding-sdk-chunked", kind: "total", ...total },
+    { bundle: "embedding-sdk-chunked", kind: "total", reachable: includesAsyncChunks, ...total },
   ];
 }
 
-function measureBundleSizes() {
-  return [
-    ...simpleTargets.filter(target => isBundleWanted(target.bundle)).flatMap(measureSimpleTarget),
-    ...(isBundleWanted("embedding-sdk-chunked")
-      ? measureChunkedSdk("artifacts/stats-embedding-sdk.json")
-      : []),
-  ];
+// Single-file/dir bundles loaded in one shot — total only.
+function measureWholeDir(config, bundle, candidates) {
+  const chosen = candidates.find(candidate => fs.existsSync(config.resolve(candidate)));
+  if (!chosen) {
+    console.warn(`Skipping "${bundle}": output not found (${candidates.join(", ")})`);
+    return [];
+  }
+  return [{ bundle, kind: "total", ...sizeOf(collectJsFiles(config.resolve(chosen))) }];
 }
 
-module.exports = { measureBundleSizes };
+const bundles = {
+  app: measureApp,
+  "embedding-sdk-legacy": measureLegacySdk,
+  "embedding-sdk-chunked": measureChunkedSdk,
+  "embedding-sdk-package": config => measureWholeDir(config, "embedding-sdk-package", ["resources/embedding-sdk/dist"]),
+  "embed-js": config => measureWholeDir(config, "embed-js", ["resources/frontend_client/app/embed.js"]),
+};
+
+function measureBundleSizes(config) {
+  return Object.entries(bundles)
+    .filter(([bundle]) => config.isBundleWanted(bundle))
+    .flatMap(([, measure]) => measure(config));
+}
+
+module.exports = {
+  measureBundleSizes,
+  buildConfig,
+  entrypointJsAssets,
+  selectAppAssets,
+  selectLegacySdkAssets,
+  selectChunkedSdkAssets,
+};
 
 if (require.main === module) {
-  console.log(JSON.stringify(measureBundleSizes(), null, 2));
+  console.log(JSON.stringify(measureBundleSizes(buildConfig(process.env)), null, 2));
 }

.github/scripts/measure-bundle-sizes.unit.spec.js

@@ -0,0 +1,87 @@
+const {
+  entrypointJsAssets,
+  selectAppAssets,
+  selectLegacySdkAssets,
+  selectChunkedSdkAssets,
+} = require("./measure-bundle-sizes");
+
+const RUNTIME = "embedding-sdk-chunk-runtime.deadbeef.js";
+
+const stats = entrypoints => ({ entrypoints });
+
+describe("entrypointJsAssets", () => {
+  it("returns the .js asset names for a field, accepting strings or {name}", () => {
+    const s = stats({ app: { assets: [{ name: "a.js" }, "b.js", { name: "c.css" }] } });
+    expect(entrypointJsAssets(s, "app", "assets")).toEqual(["a.js", "b.js"]);
+  });
+
+  it("returns null when the entrypoint or field is absent", () => {
+    expect(entrypointJsAssets(stats({}), "missing")).toBeNull();
+    expect(entrypointJsAssets(null, "app")).toBeNull();
+  });
+});
+
+describe("selectAppAssets", () => {
+  it("returns the initial set and a null reachable set on pre-enrichment stats", () => {
+    const s = stats({ "app-main": { assets: ["main.js"] } });
+    expect(selectAppAssets(s)).toEqual({ initialAssets: ["main.js"], reachableAssets: null });
+  });
+
+  it("throws when the app-main entrypoint is missing", () => {
+    expect(() => selectAppAssets(stats({}))).toThrow("app-main");
+  });
+});
+
+describe("selectChunkedSdkAssets", () => {
+  const base = {
+    "embedding-sdk-chunked": { assets: ["a.js", RUNTIME], reachableAssets: ["a.js", "b.js", RUNTIME] },
+    "embedding-sdk-bootstrap": { assets: ["boot.js"], reachableAssets: ["boot.js"] },
+  };
+
+  it("merges bootstrap + chunked, drops the inlined runtime, and counts async chunks", () => {
+    const result = selectChunkedSdkAssets(stats(base), { sdkAsyncChunksLoadable: true });
+    expect(result.initialNames).toEqual(["boot.js", "a.js"]);
+    expect(result.reachableNames).toEqual(["boot.js", "a.js", "b.js"]);
+    expect(result.includesAsyncChunks).toBe(true);
+  });
+
+  it("collapses total to initial when async chunks are not loadable", () => {
+    const result = selectChunkedSdkAssets(stats(base), { sdkAsyncChunksLoadable: false });
+    expect(result.includesAsyncChunks).toBe(false);
+  });
+
+  it("collapses total to initial when the stats carry no reachable graph", () => {
+    const noGraph = { "embedding-sdk-chunked": { assets: ["a.js"] } };
+    const result = selectChunkedSdkAssets(stats(noGraph), { sdkAsyncChunksLoadable: true });
+    expect(result.reachableNames).toEqual(["a.js"]);
+    expect(result.includesAsyncChunks).toBe(false);
+  });
+
+  it("throws when the chunked entrypoint is missing", () => {
+    expect(() => selectChunkedSdkAssets(stats({}), { sdkAsyncChunksLoadable: true })).toThrow(
+      "embedding-sdk-chunked",
+    );
+  });
+});
+
+describe("selectLegacySdkAssets", () => {
+  it("returns null when the legacy entry is absent so the caller can fall back", () => {
+    expect(selectLegacySdkAssets(stats({}), { sdkAsyncChunksLoadable: true })).toBeNull();
+  });
+
+  it("expands total to the reachable async set when loadable", () => {
+    const s = stats({ "embedding-sdk": { assets: ["legacy.js"], reachableAssets: ["legacy.js", "chunk.js"] } });
+    expect(selectLegacySdkAssets(s, { sdkAsyncChunksLoadable: true })).toEqual({
+      initialNames: ["legacy.js"],
+      reachableNames: ["legacy.js", "chunk.js"],
+    });
+  });
+
+  it("collapses total to initial when async chunks are not loadable", () => {
+    const s = stats({ "embedding-sdk": { assets: ["legacy.js"], reachableAssets: ["legacy.js", "chunk.js"] } });
+    expect(selectLegacySdkAssets(s, { sdkAsyncChunksLoadable: false })).toEqual({
+      initialNames: ["legacy.js"],
+      reachableNames: ["legacy.js"],
+    });
+  });
+});

.github/scripts/resolve-coverage-manifest.mjs

@@ -0,0 +1,94 @@
+/**
+ * Resolves the nightly e2e coverage manifest closest to a commit's point in
+ * history, so the test planner can narrow the e2e run.
+ *
+ * The whole flow lives here so callers "just get a manifest": list the retained
+ * manifest artifacts, find the one whose nightly commit is the nearest ancestor
+ * of `headSha` (via the GitHub compare API — no deep clone), download and unzip
+ * just that one, and return its parsed contents.
+ *
+ * `github` is an authenticated Octokit, as injected by actions/github-script.
+ * Returns { builtAt, specs, path, behindBy } or null when nothing is an
+ * ancestor (caller then runs e2e in full). Never throws: any API/IO failure is
+ * logged and resolves to null, because coverage resolution must not break the
+ * test plan.
+ */
+
+import { execFileSync } from "node:child_process";
+import fs from "node:fs";
+
+const ARTIFACT_NAME = "spec-file-manifest";
+const EXTRACT_DIR = "e2e/coverage";
+const MANIFEST_PATH = `${EXTRACT_DIR}/${ARTIFACT_NAME}.json`;
+
+export async function resolveCoverageManifest({
+  github,
+  owner,
+  repo,
+  headSha,
+  log = console.log,
+}) {
+  try {
+    // Every retained manifest artifact, newest first. Each carries its
+    // nightly's head_sha — the commit it was built from (== builtAt).
+    const artifacts = await github.paginate(
+      github.rest.actions.listArtifactsForRepo,
+      { owner, repo, name: ARTIFACT_NAME, per_page: 100 },
+    );
+    const candidates = artifacts
+      .filter((artifact) => !artifact.expired && artifact.workflow_run?.head_sha)
+      .sort(
+        (a, b) =>
+          new Date(b.created_at).getTime() - new Date(a.created_at).getTime(),
+      );
+
+    // First candidate that is an ancestor of head is the closest in history
+    // (master is linear, candidates are chronological). compare base...head:
+    // behind_by === 0 ⇒ base is an ancestor of head; ahead_by is the distance.
+    let chosen = null;
+    for (const artifact of candidates) {
+      const base = artifact.workflow_run.head_sha;
+      // A stale candidate (force-pushed/GC'd commit) makes compare 404 — skip
+      // it rather than lose the optimization for everyone.
+      let comparison;
+      try {
+        ({ data: comparison } =
+          await github.rest.repos.compareCommitsWithBasehead({
+            owner,
+            repo,
+            basehead: `${base}...${headSha}`,
+          }));
+      } catch {
+        continue;
+      }
+      if (comparison.behind_by === 0) {
+        chosen = { artifact, base, behindBy: comparison.ahead_by };
+        break;
+      }
+    }
+
+    if (!chosen) {
+      log("No ancestor coverage manifest found; e2e will run in full.");
+      return null;
+    }
+
+    const download = await github.rest.actions.downloadArtifact({
+      owner,
+      repo,
+      artifact_id: chosen.artifact.id,
+      archive_format: "zip",
+    });
+    fs.writeFileSync(`${ARTIFACT_NAME}.zip`, Buffer.from(download.data));
+    execFileSync("unzip", ["-o", `${ARTIFACT_NAME}.zip`, "-d", EXTRACT_DIR]);
+
+    const manifest = JSON.parse(fs.readFileSync(MANIFEST_PATH, "utf8"));
+    log(
+      `Using coverage manifest ${chosen.base.slice(0, 12)} ` +
+        `(${chosen.behindBy} commits behind HEAD).`,
+    );
+    return { ...manifest, path: MANIFEST_PATH, behindBy: chosen.behindBy };
+  } catch (error) {
+    log(`Coverage manifest resolution failed; e2e will run in full: ${error}`);
+    return null;
+  }
+}

.github/scripts/run-presto-kerberos-integration-test.sh

@@ -1,65 +0,0 @@
-#! /usr/bin/env bash
-# runs one or more Metabase test(s) against a Kerberized Presto instance
-set -eo pipefail
-
-# Need Java commands on $PATH, which apparently is not yet the case
-export JAVA_HOME="/usr/lib/jvm/msopenjdk-current"
-export PATH="$PATH:$JAVA_HOME/bin"
-
-# ensure java commmand is available
-which java
-
-# install clojure version needed for Metabase
-curl -O https://download.clojure.org/install/linux-install-1.12.0.1488.sh
-chmod +x linux-install-1.12.0.1488.sh
-./linux-install-1.12.0.1488.sh
-
-RESOURCES_DIR=/app/source/resources
-
-# ensure the expected files are in place, in the resources dir
-if [ ! -f "$RESOURCES_DIR/ssl_keystore.jks" ]; then
-  echo "$RESOURCES_DIR/ssl_keystore.jks does not exist; cannot run test" >&2
-  exit 11
-fi
-
-if [ ! -f "$RESOURCES_DIR/krb5.conf" ]; then
-  echo "$RESOURCES_DIR/krb5.conf does not exist; cannot run test" >&2
-  exit 12
-fi
-
-if [ ! -f "$RESOURCES_DIR/client.keytab" ]; then
-  echo "$RESOURCES_DIR/client.keytab does not exist; cannot run test" >&2
-  exit 13
-fi
-
-# Copy the JDK cacerts file to our resources
-cp $JAVA_HOME/lib/security/cacerts $RESOURCES_DIR/cacerts-with-presto-ca.jks
-
-# Capture the Presto server self signed CA in PEM format
-openssl s_client -showcerts -connect presto-kerberos:7778 </dev/null \
-  | openssl x509 -outform PEM >$RESOURCES_DIR/presto-ssl-root-ca.pem
-
-# Convert the Presto server self signed CA to DER format
-openssl x509 -outform der -in $RESOURCES_DIR/presto-ssl-root-ca.pem  -out $RESOURCES_DIR/presto-ssl-root-ca.der
-
-# Add Presto's self signed CA to the truststore
-keytool -noprompt -import -alias presto-kerberos -keystore $RESOURCES_DIR/cacerts-with-presto-ca.jks \
-        -storepass changeit -file $RESOURCES_DIR/presto-ssl-root-ca.der -trustcacerts
-
-# Set up the environment variables pointing to all of this, and run some tests
-DRIVERS=presto-jdbc \
-MB_ENABLE_PRESTO_JDBC_DRIVER=true \
-MB_PRESTO_JDBC_TEST_HOST=presto-kerberos \
-MB_PRESTO_JDBC_TEST_PORT=7778 \
-MB_PRESTO_JDBC_TEST_SSL=true \
-MB_PRESTO_JDBC_TEST_SSL_KEYSTORE_PATH=$RESOURCES_DIR/ssl_keystore.jks \
-MB_PRESTO_JDBC_TEST_SSL_KEYSTORE_PASSWORD=presto \
-MB_PRESTO_JDBC_TEST_SSL_TRUSTSTORE_PATH=$RESOURCES_DIR/cacerts-with-presto-ca.jks \
-MB_PRESTO_JDBC_TEST_SSL_TRUSTSTORE_PASSWORD=changeit \
-MB_PRESTO_JDBC_TEST_KERBEROS=true \
-MB_PRESTO_JDBC_TEST_USER=bob@EXAMPLE.COM \
-MB_PRESTO_JDBC_TEST_KERBEROS_PRINCIPAL=bob@EXAMPLE.COM \
-MB_PRESTO_JDBC_TEST_KERBEROS_REMOTE_SERVICE_NAME=HTTP \
-MB_PRESTO_JDBC_TEST_KERBEROS_KEYTAB_PATH=$RESOURCES_DIR/client.keytab \
-MB_PRESTO_JDBC_TEST_KERBEROS_CONFIG_PATH=$RESOURCES_DIR/krb5.conf \
-clojure -X:dev:test:drivers:drivers-dev :only metabase.driver.presto-jdbc-test

.github/scripts/upload-affected-tests-stats.js

@@ -5,44 +5,60 @@
 const { uploadCsvToMb } = require("./csv-to-mb.js");
 
 // "FE Affected Tests" uploaded table on stats.metabase.com.
-const TABLE_ID = 79841;
+const TABLE_ID = 81818;
 
-const s = JSON.parse(process.env.STATS_JSON);
-console.log("stats", s);
+async function main() {
+  // create-test-plan doesn't always produce stats (e.g. on release branches
+  // running an older planner), leaving STATS_JSON empty. Nothing to upload.
+  const raw = (process.env.STATS_JSON || "").trim();
+  if (!raw || raw === "null") {
+    console.log("No STATS_JSON to upload; skipping.");
+    return;
+  }
 
-const row = {
-  Date: new Date().toISOString(),
-  // "pr_update" or "merge_to_master". ("Trigger" is a reserved SQL word.)
-  "Triggered By": process.env.TRIGGERED_BY,
-  PR: Number(process.env.PR_NUMBER),
-  "Head SHA": process.env.HEAD_SHA,
-  "Base SHA": process.env.BASE_SHA,
-  "FE Files Changed": s.fe_files_changed,
-  "BE Files Changed": s.be_files_changed,
-  "FE Modules Changed": s.fe_modules_changed,
-  "FE Modules Affected (Rules)": s.fe_modules_affected_rules,
-  "FE Modules Affected (Usage)": s.fe_modules_affected_usage,
-  "Unit Specs All": s.unit_specs_all,
-  "Unit Specs To Run (Rules)": s.unit_specs_to_run_rules,
-  "Unit Specs To Run (Usage)": s.unit_specs_to_run_usage,
-  "Loki Stories All": s.loki_stories_all,
-  "Loki Stories To Run (Rules)": s.loki_stories_to_run_rules,
-  "Loki Stories To Run (Usage)": s.loki_stories_to_run_usage,
-  "E2E Specs All": s.e2e_specs_all,
-  "E2E Specs To Run (Rules)": s.e2e_specs_to_run_rules,
-  "E2E Specs To Run (Usage)": s.e2e_specs_to_run_usage,
-};
+  const s = JSON.parse(raw);
+  console.log("stats", s);
 
-uploadCsvToMb({
-  baseUrl: "https://stats.metabase.com",
-  tableId: TABLE_ID,
-  jsonData: [row],
-  mode: "append",
-})
-  .then(() => {
-    console.log("Data uploaded successfully");
-  })
-  .catch((error) => {
-    console.error("Error uploading data:", error);
-    process.exit(1);
+  const row = {
+    Date: new Date().toISOString(),
+    // "pr_update" or "merge_to_master". ("Trigger" is a reserved SQL word.)
+    "Triggered By": process.env.TRIGGERED_BY,
+    PR: Number(process.env.PR_NUMBER),
+    "Head SHA": process.env.HEAD_SHA,
+    "Base SHA": process.env.BASE_SHA,
+    "FE Files Changed": s.fe_files_changed,
+    "FE Files Total": s.fe_files_total,
+    "BE Files Changed": s.be_files_changed,
+    "BE Files Total": s.be_files_total,
+    "Unit Infra Touched": s.unit_infra_touched,
+    "Loki Infra Touched": s.loki_infra_touched,
+    "Shared Sources Touched": s.shared_sources_touched,
+    "FE Modules Total": s.fe_modules_total,
+    "FE Modules Changed": s.fe_modules_changed,
+    "FE Modules Affected (Rules)": s.fe_modules_affected_rules,
+    "FE Modules Affected (Usage)": s.fe_modules_affected_usage,
+    "Unit Specs All": s.unit_specs_all,
+    "Unit Specs To Run (Rules)": s.unit_specs_to_run_rules,
+    "Unit Specs To Run (Usage)": s.unit_specs_to_run_usage,
+    "Loki Stories All": s.loki_stories_all,
+    "Loki Stories To Run (Rules)": s.loki_stories_to_run_rules,
+    "Loki Stories To Run (Usage)": s.loki_stories_to_run_usage,
+    "E2E Specs All": s.e2e_specs_all,
+    "E2E Specs To Run (Rules)": s.e2e_specs_to_run_rules,
+    "E2E Specs To Run (Usage)": s.e2e_specs_to_run_usage,
+  };
+
+  await uploadCsvToMb({
+    baseUrl: "https://stats.metabase.com",
+    tableId: TABLE_ID,
+    jsonData: [row],
+    mode: "append",
   });
+  console.log("Data uploaded successfully");
+}
+
+// Best-effort: never let a telemetry failure turn the job red.
+main().catch((error) => {
+  console.error("Skipping stats upload after error:", error);
+  process.exit(0);
+});

.github/team.json

@@ -47,7 +47,8 @@
       "members": [
         "fraserdrops",
         "nemanjaglumac",
-        "romeovs"
+        "romeovs",
+        "ChrisVandoo"
       ]
     },
     {
@@ -63,7 +64,9 @@
         "lbrdnk",
         "piranha",
         "crisptrutski",
-        "undrfined"
+        "undrfined",
+        "andreis",
+        "prascuna"
       ]
     },
     {
@@ -92,7 +95,8 @@
         "deniskaber",
         "andsalves",
         "kevinkelleher12",
-        "AndreyChernykh"
+        "AndreyChernykh",
+        "bowbahdoe"
       ]
     },
     {
@@ -122,6 +126,13 @@
         "losrebellos",
         "tmashara"
       ]
+    },
+    {
+      "name": "Security Engineering",
+      "label": ".Team/SecurityEngineering",
+      "members": [
+        "enthym-aa"
+      ]
     }
   ]
 }

.github/workflows/ai-benchmark.yml

@@ -1,21 +1,172 @@
 name: AI Benchmark
-
-# Runs the ai-benchmark E2E test suite against a Metabase instance.
-#
-# NOTE: This is a stub. The real workflow — which builds the benchmark Docker
-# image, boots Metabase + Postgres with a preloaded data dump, runs the
-# benchmark suite, and uploads results as artifacts — is being developed on a
-# feature branch. This stub exists on master so that the "Run workflow" button
-# is available in the GitHub Actions UI, which lets us dispatch the real
-# workflow against feature branches during development.
+run-name: "dispatch evals · ${{ github.event_name == 'pull_request' && format('smoke PR#{0}', github.event.pull_request.number) || (inputs.pr != '' && format('PR#{0}', inputs.pr) || (inputs.ref != '' && inputs.ref || 'master')) }}"
 
 on:
+  pull_request:
+    types: [labeled]
   workflow_dispatch:
+    inputs:
+      pr:
+        description: "Metabase PR number (sets ref to the PR head)"
+        required: false
+        default: ""
+      ref:
+        description: "Metabase ref"
+        required: false
+        default: ""
+      scope:
+        description: "Scope"
+        required: true
+        type: choice
+        options: [smoke, full, "all (EXPENSIVE)"]
+        default: smoke
+      sample:
+        description: "Sample (0 = full suite)"
+        required: false
+        default: "5"
+      evals_branch:
+        description: "Evals branch"
+        default: main
+
+concurrency:
+  group: evals-dispatch-${{ (github.event.label.name == 'evals/smoke' && github.event.pull_request.number) || github.run_id }}
+  cancel-in-progress: true
 
 jobs:
-  placeholder:
-    name: Placeholder
-    runs-on: ubuntu-latest
+  unsupported:
+    if: >-
+      github.event_name == 'pull_request'
+      && github.event.label.name == 'evals/smoke'
+      && github.event.pull_request.head.repo.full_name != github.repository
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 5
     steps:
-      - name: Stub
-        run: echo "ai-benchmark workflow stub — real implementation pending"
+      - run: |
+          echo "::error::evals/smoke only runs on same-repo PRs; this PR's head is on a fork"
+          exit 1
+
+  announce:
+    if: >-
+      github.event_name == 'pull_request'
+      && github.event.label.name == 'evals/smoke'
+      && github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 5
+    outputs:
+      comment_id: ${{ steps.post.outputs.comment_id }}
+    steps:
+      - name: Comment (building)
+        id: post
+        uses: actions/github-script@v9
+        with:
+          github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+          script: |
+            const runUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
+            const body = `🤖 **Evals smoke** — ⏳ building the image… ([logs](${runUrl}))`;
+            const { owner, repo } = context.repo;
+            const issue_number = context.payload.pull_request.number;
+            // Drop earlier verdicts first: they describe shas that are no longer head, and a stale
+            // green one reads as this PR passing. The prefix survives eval-run's rewrites.
+            const existing = await github.paginate(github.rest.issues.listComments, { owner, repo, issue_number });
+            for (const c of existing.filter(c => c.body.startsWith('🤖 **Evals'))) {
+              await github.rest.issues.deleteComment({ owner, repo, comment_id: c.id }).catch(() => {});
+            }
+            const { data } = await github.rest.issues.createComment({ owner, repo, issue_number, body });
+            core.setOutput('comment_id', String(data.id));
+
+  uberjar:
+    needs: [announce]
+    if: >-
+      github.event_name == 'pull_request'
+      && github.event.label.name == 'evals/smoke'
+      && github.event.pull_request.head.repo.full_name == github.repository
+    uses: ./.github/workflows/uberjar.yml
+    secrets: inherit
+
+  smoke:
+    needs: [announce, uberjar]
+    if: >-
+      github.event_name == 'pull_request'
+      && github.event.label.name == 'evals/smoke'
+      && github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 5
+    env:
+      COMMENT_ID: ${{ needs.announce.outputs.comment_id }}
+    steps:
+      - name: Dispatch smoke eval-run
+        env:
+          GH_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+          PR: ${{ github.event.pull_request.number }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          EVALS_BRANCH: main
+        run: |
+          gh api repos/metabase/evals/actions/workflows/eval-run.yml/dispatches \
+            -f ref="$EVALS_BRANCH" \
+            -f "inputs[pr]=$PR" \
+            -f "inputs[ref]=$HEAD_SHA" \
+            -f "inputs[scope]=smoke" \
+            -f "inputs[surfaces]=all" \
+            -f "inputs[sample]=5" \
+            -f "inputs[evals_branch]=$EVALS_BRANCH" \
+            -f "inputs[comment_id]=$COMMENT_ID"
+
+  finalize:
+    # If the build or dispatch fell over, eval-run never took over the comment — leave a
+    # failure verdict instead of a comment stuck at "building the image…".
+    needs: [announce, uberjar, smoke]
+    if: always() && needs.announce.result == 'success' && needs.smoke.result != 'success'
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 5
+    env:
+      COMMENT_ID: ${{ needs.announce.outputs.comment_id }}
+      SMOKE_RESULT: ${{ needs.smoke.result }}
+      UBERJAR_RESULT: ${{ needs.uberjar.result }}
+    steps:
+      - name: Comment (build/dispatch failed)
+        uses: actions/github-script@v9
+        with:
+          github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+          script: |
+            const runUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
+            // A concurrency-cancelled retrigger lands here too; don't stamp it as an infra failure.
+            const cancelled = [process.env.SMOKE_RESULT, process.env.UBERJAR_RESULT].includes('cancelled');
+            const body = cancelled
+              ? `🤖 **Evals smoke** — ⚪ cancelled before evals started ([logs](${runUrl}))`
+              : `🤖 **Evals smoke** — ❌ build or dispatch failed before evals started ([logs](${runUrl}))`;
+            // The replacement run deletes this comment on its way in, so a concurrency cancel can
+            // land here with nothing to patch. Losing the stamp is fine; failing the job isn't.
+            await github.rest.issues.updateComment({
+              owner: context.repo.owner, repo: context.repo.repo,
+              comment_id: Number(process.env.COMMENT_ID), body })
+              .catch(e => core.warning(`could not update comment (deleted?): ${e.message}`));
+            // eval-run only consumes the label once it has taken the run over, so anything failing
+            // before the dispatch leaves it applied — and `labeled` only fires on a transition, which
+            // makes re-applying it to retry a no-op. Hand it back.
+            await github.rest.issues.removeLabel({
+              owner: context.repo.owner, repo: context.repo.repo,
+              issue_number: context.payload.pull_request.number,
+              name: 'evals/smoke',
+            }).catch(() => {});
+
+  dispatch:
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 5
+    steps:
+      - name: Dispatch eval-run
+        env:
+          GH_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+          EVALS_BRANCH: ${{ github.event.inputs.evals_branch }}
+          PR: ${{ inputs.pr }}
+          REF: ${{ inputs.ref }}
+          SCOPE: ${{ inputs.scope }}
+          SAMPLE: ${{ inputs.sample }}
+        run: |
+          gh api repos/metabase/evals/actions/workflows/eval-run.yml/dispatches \
+            -f ref="$EVALS_BRANCH" \
+            -f "inputs[pr]=$PR" \
+            -f "inputs[ref]=$REF" \
+            -f "inputs[scope]=$SCOPE" \
+            -f "inputs[sample]=${SAMPLE:-5}" \
+            -f "inputs[evals_branch]=$EVALS_BRANCH"

.github/workflows/app-db.yml

@@ -61,6 +61,9 @@ jobs:
     services:
       mysql:
         image: ${{ matrix.version.image }}
+        # disposable CI database: a RAM-backed datadir makes the ~90k fsyncs of a full
+        # migration chain free (measured: setup-db! 59s -> 16s)
+        options: --tmpfs /var/lib/mysql:rw
         ports:
           - "3306:3306"
         env:
@@ -76,7 +79,7 @@ jobs:
             github.event_name == 'push' &&
             (
               github.ref_name == 'master' ||
-              startsWith(github.ref_name, 'release-')
+              startsWith(github.ref_name, 'release-x')
             ) &&
             ''
           ) ||
@@ -117,20 +120,11 @@ jobs:
         with:
           build-static-viz: ${{ matrix.job.build-static-viz }}
           junit-name: ${{ matrix.version.junit-name }}
+          artifact-suffix: ${{ matrix.job.name }}
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[ ${{ matrix.job.exclude-tag }} ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
-      - name: Upload Test Results
-        uses: ./.github/actions/upload-test-results
-        if: always()
-        with:
-          input-path: ./target/junit/
-          output-name: ${{ github.job }}
-          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-          aws-region: ${{ vars.AWS_REGION }}
-          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+          quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
 
   be-tests-mysql:
     if: ${{ !inputs.skip }}
@@ -146,12 +140,21 @@ jobs:
             env:
               enable-ssl-tests: 'false'
               enable-aws-iam-tests: 'false'
-          - name: MySQL Latest
-            junit-name: be-tests-mysql-latest-ee
-            image: mysql:latest
+          - name: MySQL 9
+            junit-name: be-tests-mysql-9-ee
+            image: mysql:9
             env:
               enable-ssl-tests: 'true'
               enable-aws-iam-tests: 'true'
+          # `mysql:latest` now resolves to MySQL 26.x, which fails in a way that floods the log
+          # until the runner cancels the job. A cancelled job can't be soft-failed with
+          # continue-on-error, so the leg is disabled until 26.x is supported.
+          # - name: MySQL Latest
+          #   junit-name: be-tests-mysql-latest-ee
+          #   image: mysql:latest
+          #   env:
+          #     enable-ssl-tests: 'false'
+          #     enable-aws-iam-tests: 'false'
         job:
           - name: Enterprise Tests
             build-static-viz: false
@@ -176,6 +179,9 @@ jobs:
     services:
       mysql:
         image: ${{ matrix.version.image }}
+        # disposable CI database: a RAM-backed datadir makes the ~90k fsyncs of a full
+        # migration chain free (measured: setup-db! 59s -> 16s)
+        options: --tmpfs /var/lib/mysql:rw
         ports:
           - "3306:3306"
         env:
@@ -191,7 +197,7 @@ jobs:
             github.event_name == 'push' &&
             (
               github.ref_name == 'master' ||
-              startsWith(github.ref_name, 'release-')
+              startsWith(github.ref_name, 'release-x')
             ) &&
             ''
           ) ||
@@ -240,20 +246,11 @@ jobs:
         with:
           build-static-viz: ${{ matrix.job.build-static-viz }}
           junit-name: ${{ matrix.version.junit-name }}
+          artifact-suffix: ${{ matrix.job.name }}
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[ ${{ matrix.job.exclude-tag }} ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
-      - name: Upload Test Results
-        uses: ./.github/actions/upload-test-results
-        if: always()
-        with:
-          input-path: ./target/junit/
-          output-name: ${{ github.job }}
-          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-          aws-region: ${{ vars.AWS_REGION }}
-          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+          quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
 
   be-tests-postgres:
     if: ${{ !inputs.skip }}
@@ -307,7 +304,7 @@ jobs:
             github.event_name == 'push' &&
             (
               github.ref_name == 'master' ||
-              startsWith(github.ref_name, 'release-')
+              startsWith(github.ref_name, 'release-x')
             ) &&
             ''
           ) ||
@@ -350,20 +347,11 @@ jobs:
         with:
           build-static-viz: ${{ matrix.job.build-static-viz }}
           junit-name: 'be-tests-${{ matrix.version.junit-name }}'
+          artifact-suffix: ${{ matrix.job.name }}
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[ ${{ matrix.job.exclude-tag }} ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
-      - name: Upload Test Results
-        uses: ./.github/actions/upload-test-results
-        if: always()
-        with:
-          input-path: ./target/junit/
-          output-name: ${{ github.job }}
-          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-          aws-region: ${{ vars.AWS_REGION }}
-          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+          quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
 
   app-db-tests-result:
     needs:

.github/workflows/auto-backport.yml

@@ -99,6 +99,36 @@ jobs:
       )
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     steps:
+      - name: "!! double-backport and triple-backport label deprecation warning !!"
+        if:
+          |
+          github.event.pull_request.merged == true && (
+            github.event.action == 'closed' && (
+              contains(github.event.pull_request.labels.*.name, 'double-backport') ||
+              contains(github.event.pull_request.labels.*.name, 'triple-backport')
+            ) ||
+            github.event.action == 'labeled' && (
+              github.event.label.name == 'double-backport' ||
+              github.event.label.name == 'triple-backport'
+            )
+          )
+        env:
+          REPO: ${{ github.repository }}
+          PR: ${{ github.event.pull_request.number }}
+          GH_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+        run: |
+          msg="🚨🚨 Backport failed because \`double-backport\` and \`triple-backport\` labels are **deprecated**! Use the \`backport\` label to port changes to all supported releases instead. 🚨🚨"
+
+          gh api \
+            --silent \
+            --method POST \
+            -H "Accept: application/vnd.github+json" \
+            -H "X-GitHub-Api-Version: 2026-03-10" \
+            /repos/"$REPO"/issues/"$PR"/comments \
+            -f "body=$msg"
+
+          echo "::error::$msg"
+          exit 1
       - uses: actions/checkout@v6
         with:
           fetch-depth: 0
@@ -110,29 +140,6 @@ jobs:
           pull-request-number: ${{ github.event.pull_request.number }}
           base-ref: ${{ github.event.pull_request.base.ref }}
 
-      - name: how many backports?
-        id: how-many-backports
-        uses: actions/github-script@v9
-        with:
-          script: | # js
-            const labels = [
-              ...${{ toJson(github.event.pull_request.labels) }},
-              { name:"${{ github.event.label.name }}" }
-            ];
-
-            const backportLabelNames = labels.filter(label => label.name.includes('backport')).map(label => label.name);
-
-            let result = 1;
-
-            if (backportLabelNames.includes("triple-backport")) {
-              result = 3;
-            } else if (backportLabelNames.includes("double-backport")) {
-              result = 2;
-            }
-
-            console.log("backports", result);
-            return result;
-
       - name: get release versions
         id: get-latest-release-version
         uses: actions/github-script@v9
@@ -157,21 +164,3 @@ jobs:
           backport-commit: ${{ steps.find_commit.outputs.commit }}
           github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
           github-token-2: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Double Backport
-        if: ${{ always() && fromJson(steps.how-many-backports.outputs.result) >= 2 }}
-        uses: ./.github/actions/create-backport
-        with:
-          target-version: ${{ fromJson(steps.get-latest-release-version.outputs.result).secondLatest }}
-          backport-commit: ${{ steps.find_commit.outputs.commit }}
-          github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
-          github-token-2: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Triple Backport
-        if: ${{ always() && fromJson(steps.how-many-backports.outputs.result) >= 3 }}
-        uses: ./.github/actions/create-backport
-        with:
-          target-version: ${{ fromJson(steps.get-latest-release-version.outputs.result).thirdLatest }}
-          backport-commit: ${{ steps.find_commit.outputs.commit }}
-          github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
-          github-token-2: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/backend-cloverage.yml

@@ -24,8 +24,8 @@ jobs:
       - uses: actions/checkout@v6
       - id: get-modules
         run: |
-          modules=$(ls -1d src/metabase/*/ | xargs -n1 basename | tr '_' '-' | jq -R -s -c 'split("\n") | map(select(length > 0))')
-          echo "modules=$modules" >> $GITHUB_OUTPUT
+          modules=$(for d in src/metabase/*/; do basename "$d"; done | tr '_' '-' | jq -R -s -c 'split("\n") | map(select(length > 0))')
+          echo "modules=$modules" >> "$GITHUB_OUTPUT"
 
   be-linter-cloverage:
     needs: setup-oss
@@ -71,8 +71,8 @@ jobs:
       - uses: actions/checkout@v6
       - id: get-modules
         run: |
-          modules=$(ls -1d enterprise/backend/src/metabase_enterprise/*/ | xargs -n1 basename | tr '_' '-' | jq -R -s -c 'split("\n") | map(select(length > 0))')
-          echo "modules=$modules" >> $GITHUB_OUTPUT
+          modules=$(for d in enterprise/backend/src/metabase_enterprise/*/; do basename "$d"; done | tr '_' '-' | jq -R -s -c 'split("\n") | map(select(length > 0))')
+          echo "modules=$modules" >> "$GITHUB_OUTPUT"
 
   be-linter-cloverage-enterprise:
     needs: setup-ee

.github/workflows/backend.yml

@@ -45,7 +45,7 @@ jobs:
 
   be-linter-eastwood-test:
     # Master / release safety net: lint every backend test namespace.
-    if: ${{ !inputs.skip && github.event_name == 'push' && (github.ref_name == 'master' || startsWith(github.ref_name, 'release-')) }}
+    if: ${{ !inputs.skip && github.event_name == 'push' && (github.ref_name == 'master' || startsWith(github.ref_name, 'release-x')) }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 45
     name: Eastwood (tests only)
@@ -121,7 +121,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        java-version: [21]
+        java-version: [25]
         job:
           - name: Enterprise Tests
             edition: ee
@@ -167,7 +167,7 @@ jobs:
             github.event_name == 'push' &&
             (
               github.ref_name == 'master' ||
-              startsWith(github.ref_name, 'release-')
+              startsWith(github.ref_name, 'release-x')
             ) &&
             ''
           ) ||
@@ -191,40 +191,95 @@ jobs:
         # below can link failures to this exact job. Best-effort.
         uses: ./.github/actions/resolve-job-id
 
+      # Granular rerun: on a re-run of a failed job, restore the list of tests
+      # that failed on the previous attempt (uploaded below) so the test step
+      # can target only those instead of the whole partition. Best-effort: a
+      # missing/empty artifact leaves no file and the run falls back to the full
+      # partition. First attempts skip this entirely.
+      #
+      # Scoped to the IMMEDIATELY preceding attempt: an attempt that passed, or
+      # that failed with nothing attributable to a var, uploads no artifact, and
+      # a narrow set must not outlive it. Reading `attempt - 1` means "only what
+      # the last attempt actually recorded" — anything else falls back to the
+      # full partition. Workflow expressions have no arithmetic, so the shell
+      # computes it.
+      - name: Resolve previous attempt
+        if: ${{ github.run_attempt != '1' }}
+        run: echo "RERUN_PREV_ATTEMPT=$((GITHUB_RUN_ATTEMPT - 1))" >> "$GITHUB_ENV"
+
+      # `pattern` (not `name`) because the artifact is legitimately absent whenever the
+      # previous attempt recorded nothing: `name` treats that as an error, `pattern`
+      # downloads nothing and moves on. The value is a literal — no glob metacharacters —
+      # so it matches exactly one artifact, which lands at `target/failed-tests`. A pattern
+      # that ever matched two would nest them under their artifact names instead, leaving
+      # the file absent and falling back to the full partition.
+      - name: Restore previously-failed tests
+        if: ${{ github.run_attempt != '1' }}
+        continue-on-error: true
+        uses: actions/download-artifact@v8
+        with:
+          pattern: failed-tests-be-tests-java-${{ matrix.java-version }}-${{ matrix.job.test-group-name }}-attempt-${{ env.RERUN_PREV_ATTEMPT }}
+          path: target
+
       - name: "Test Java ${{ matrix.java-version }} ${{ matrix.job.name }}"
         id: run-java-tests
-        run: >-
-          clojure -X:dev:ci:test:${{ matrix.job.edition }}:${{ matrix.job.edition }}-dev
-          :exclude-tags '[:mb/driver-tests ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
-          ${{ matrix.job.test-args }}
-        # Trunk Quarantine controls the final state of the run in the CI!
-        # Even if this step fails we let it pass, and then `trunk-io/analytics-uploader` determines
-        # whether to fail or to pass the whole job, based on the quarantine list.
+        # On a rerun with a non-empty failed-tests file, target only those vars
+        # via hawk `:only`, dropping the tag/partition args — the listed vars are
+        # exactly this job's failures, already filtered and partitioned on the
+        # first attempt. Otherwise run exactly as before. Quote the file so the
+        # whole `[ns/var ...]` vector reaches clojure -X as a single argument.
+        run: |
+          BASE="clojure -X:dev:ci:test:${{ matrix.job.edition }}:${{ matrix.job.edition }}-dev"
+          if [ "${{ github.run_attempt }}" != "1" ] && [ -s target/failed-tests ]; then
+            echo "Granular rerun of previously-failed tests: $(cat target/failed-tests)"
+            $BASE :only "$(cat target/failed-tests)"
+          else
+            $BASE :exclude-tags '[:mb/driver-tests ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]' ${{ matrix.job.test-args }}
+          fi
+        # Keep this step continue-on-error because the quarantine logic controls whether it ultimately fails.
         continue-on-error: true
 
       - name: Report failed tests to ci-conductor
-        # Positioned between the test run and "Upload Test Results" so it reads
-        # pristine JUnit (before Trunk quarantine processing). Gated to non-clean
-        # runs + continue-on-error so it can never change the job outcome — Trunk
-        # Quarantine remains the sole arbiter. See DEV-2224 / DEV-2235.
-        if: ${{ always() && steps.run-java-tests.outcome != 'success' }}
+        if: ${{ !cancelled() && steps.run-java-tests.outcome == 'failure' }}
+        # This step should NEVER fail the job!
         continue-on-error: true
         uses: ./.github/actions/report-failures-to-ci-conductor
         with:
           test-suite: be-tests-java-${{ matrix.java-version }}-${{ matrix.job.test-group-name }}
           adapter: backend
 
-      - name: Upload Test Results
-        uses: ./.github/actions/upload-test-results
-        if: always() && (steps.run-java-tests.conclusion != 'skipped' || steps.run-java-tests-21.conclusion != 'skipped')
+      # Granular rerun: record which tests failed so a re-run of this job targets
+      # only those (restored above). Reuses the backend JUnit adapter from the
+      # ci-conductor sources the report step just prepared. Best-effort: writes
+      # nothing unless every failure is attributable to a var, so an
+      # unattributable failure falls back to a full partition rerun.
+      - name: Collect failed tests for rerun
+        if: ${{ !cancelled() && steps.run-java-tests.outcome == 'failure' }}
+        continue-on-error: true
+        # Clear the restored set first, so a collector that dies before deciding
+        # can't leave the previous attempt's file to be uploaded as this one's.
+        run: |
+          rm -f target/failed-tests
+          bun release/ci-conductor/src/collect-failed-backend.ts
+
+      - name: Upload failed tests for rerun
+        if: ${{ !cancelled() && steps.run-java-tests.outcome == 'failure' }}
+        continue-on-error: true
+        uses: actions/upload-artifact@v7
         with:
-          input-path: ./target/junit/
-          output-name: be-tests-java-${{ matrix.java-version }}-${{ matrix.job.edition }}
-          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-          aws-region: ${{ vars.AWS_REGION }}
-          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-          previous-step-outcome: ${{ steps.run-java-tests.outcome }}
+          name: failed-tests-be-tests-java-${{ matrix.java-version }}-${{ matrix.job.test-group-name }}-attempt-${{ github.run_attempt }}
+          path: target/failed-tests
+          if-no-files-found: ignore
+
+      - name: Quarantine gate
+        if: ${{ !cancelled() && steps.run-java-tests.outcome == 'failure' }}
+        continue-on-error: ${{ vars.QUARANTINE_ENGINE != 'ci-conductor' }}
+        timeout-minutes: 3
+        uses: ./.github/actions/quarantine-gate
+        with:
+          adapter: backend
+          test-suite: be-tests-java-${{ matrix.java-version }}-${{ matrix.job.test-group-name }}
+          enforce-quarantine: ${{ vars.QUARANTINE_ENGINE == 'ci-conductor' }}
 
       - name: Publish Test Report (JUnit)
         uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
@@ -253,7 +308,7 @@ jobs:
     timeout-minutes: 10
     strategy:
       matrix:
-        java-version: [21]
+        java-version: [25]
     name: "Check Java ${{ matrix.java-version }}"
     steps:
       - uses: actions/checkout@v6

.github/workflows/block-master-source-branch-prs.yml

@@ -5,10 +5,10 @@ on:
 
 jobs:
   check-source-branch:
+    if: github.head_ref == 'master'
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     steps:
       - name: Block master branch PRs
-        if: github.head_ref == 'master'
         run: |
-          echo "PRs from `master` branches are not allowed, please use a new branch name for your PR."
+          echo "PRs from \`master\` branches are not allowed, please use a new branch name for your PR."
           exit 1

.github/workflows/build-for-release.yml

@@ -1,270 +0,0 @@
-# Builds a fresh release JAR from scratch at a given commit.
-#
-# You should almost never have to use this. The normal release flow relies on a
-# commit that has already been built and tested on its branch — see
-# `tag-for-release.yml`, which tags that existing JAR. Building from scratch
-# here is only for exceptional cases.
-name: Release 0 - Build Release Artifact
-run-name: Build ${{ inputs.version }}
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: 'Metabase version (e.g. v0.46.3)'
-        type: string
-        required: true
-      commit:
-        description: 'A full-length commit SHA-1 hash'
-        required: true
-
-jobs:
-  start-message:
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          sparse-checkout: |
-            release
-            .github
-      - name: Prepare release scripts
-        uses: ./.github/actions/prepare-release-scripts
-      - name: Send build start message
-        uses: actions/github-script@v9
-        env:
-          SLACK_RELEASE_CHANNEL: ${{ vars.SLACK_RELEASE_CHANNEL }}
-          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
-        with:
-          script: | # js
-            const { sendPreReleaseMessage } = require('${{ github.workspace }}/release/dist/index.cjs');
-
-            await sendPreReleaseMessage({
-              github,
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              version: '${{ inputs.version }}',
-              runId: '${{ github.run_id }}',
-              releaseSha: '${{ inputs.commit }}',
-              userName: '${{ github.actor }}',
-              channelName: '${{ vars.SLACK_RELEASE_CHANNEL }}',
-            }).catch(console.error);
-
-  trigger-milestone-check:
-    # Posts a Slack FYI about issues that still need review for this release.
-    # Informational only — nothing depends on it, so it never blocks the release.
-    needs: [check-version, check-commit]
-    permissions:
-      contents: read
-      issues: read
-    uses: ./.github/workflows/release-milestone-check.yml
-    secrets: inherit
-    with:
-      version: ${{ inputs.version }}
-      commit: ${{ inputs.commit }}
-
-  check-version:
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 10
-    outputs:
-      ee: ${{ fromJson(steps.canonical_version.outputs.result).ee }}
-      oss: ${{ fromJson(steps.canonical_version.outputs.result).oss }}
-    steps:
-    - name: Fail early on the incorrect version format
-      if: ${{ !(startsWith(inputs.version,'v0.') || startsWith(inputs.version,'v1.')) }}
-      run: |
-        echo "The version format is invalid!"
-        echo "It must start with either 'v0.' or 'v1.'."
-        echo "Please, try again."
-        exit 1
-    - uses: actions/checkout@v6
-      with:
-        sparse-checkout: |
-          release
-          .github
-    - name: Prepare release scripts
-      uses: ./.github/actions/prepare-release-scripts
-    - name: Get Release Version
-      uses: actions/github-script@v9
-      id: canonical_version
-      with:
-        script: | # js
-          const { isValidVersionString, getCanonicalVersion, hasBeenReleased } = require('${{ github.workspace }}/release/dist/index.cjs');
-
-          const version = '${{ inputs.version }}';
-
-          if (!isValidVersionString(version)) {
-            throw new Error("The version format is invalid! It must start with either 'v0.' or 'v1.'.");
-          }
-
-          const versions = {
-            ee: getCanonicalVersion(version, 'ee'),
-            oss: getCanonicalVersion(version, 'oss'),
-          };
-
-          const released = await hasBeenReleased({
-            github,
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-            version: versions.oss,
-          });
-
-          if (released) {
-            throw new Error("This version has already been released!", version);
-          }
-
-          return versions;
-
-  check-commit:
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 10
-    steps:
-    - name: Check out the code to verify the release branch
-      uses: actions/checkout@v6
-      with:
-        fetch-depth: 0  # IMPORTANT! to get all the branches
-        sparse-checkout: |
-          release
-          .github
-    - name: Prepare release scripts
-      uses: ./.github/actions/prepare-release-scripts
-    - name: Get Release Branch
-      uses: actions/github-script@v9
-      id: release_branch
-      with:
-        result-encoding: string
-        script: | # js
-          const { getReleaseBranch } = require('${{ github.workspace }}/release/dist/index.cjs');
-          const version = '${{ inputs.version }}';
-          const releaseBranch = getReleaseBranch(version);
-          return releaseBranch;
-    - name: Ensure that the specified commit exists in the ${{ steps.release_branch.outputs.result }} release branch
-      run: | # bash
-        RELEASE_BRANCH=${{ steps.release_branch.outputs.result }}
-        git checkout $RELEASE_BRANCH
-        git branch --contains ${{ inputs.commit }} | grep -q $RELEASE_BRANCH \
-          && echo "Commit found in correct release branch" \
-          || (echo "Commit not found in correct release branch" && exit 1)
-        git checkout -
-
-  get-build-requirements:
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 10
-    outputs:
-      java_version: ${{ fromJson(steps.dependencies.outputs.result).java_version }}
-      node_version: ${{ fromJson(steps.dependencies.outputs.result).node_version }}
-      build_process: ${{ fromJson(steps.dependencies.outputs.result).build_process }}
-    steps:
-    - uses: actions/checkout@v6
-      with:
-        sparse-checkout: |
-          release
-          .github
-    - name: Prepare release scripts
-      uses: ./.github/actions/prepare-release-scripts
-    - name: Get build dependencies
-      uses: actions/github-script@v9
-      id: dependencies
-      with:
-        script: | # js
-          const { getBuildRequirements, getMajorVersion } = require('${{ github.workspace }}/release/dist/index.cjs');
-
-          const version = '${{ inputs.version }}';
-
-          const requirements = getBuildRequirements(version);
-          const build_process = getMajorVersion(version) < 46 ? 'legacy' : 'new';
-          console.log('Build process:', build_process);
-
-          return {
-            java_version: requirements.java,
-            node_version: requirements.node,
-            build_process,
-          };
-
-  manage-milestones:
-    # Close the milestone we're about to ship and open the next one BEFORE building,
-    # so any PRs that merge while the build is in flight are tagged with the next
-    # milestone (not the one about to be released).
-    #
-    # Sequenced after trigger-milestone-check so that the check sees the milestone
-    # in its open state. milestone-check is informational and must never block, so
-    # we run regardless of its outcome; only preflight failures suppress this.
-    needs: [check-version, check-commit, trigger-milestone-check]
-    if: ${{ !cancelled() && needs.check-version.result == 'success' && needs.check-commit.result == 'success' }}
-    permissions:
-      contents: read
-      issues: write
-    uses: ./.github/workflows/release-milestone-manage.yml
-    with:
-      version: ${{ inputs.version }}
-
-  build-uberjar-for-release:
-    needs: [check-version, check-commit, get-build-requirements]
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 50
-    strategy:
-      matrix:
-        edition: [oss, ee]
-    env:
-      INTERACTIVE: false
-    steps:
-    - name: Get correct version number
-      run: | # bash
-        if [ '${{matrix.edition}}' == 'ee' ]; then
-          version='${{ needs.check-version.outputs.ee }}'
-        else
-          version='${{ needs.check-version.outputs.oss }}'
-        fi
-
-        echo "VERSION=$version" >> $GITHUB_ENV
-    - name: Setup Java ${{ needs.get-build-requirements.outputs.java_version }}
-      uses: actions/setup-java@v5.2.0
-      with:
-        distribution: 'temurin'
-        java-version: ${{ needs.get-build-requirements.outputs.java_version }}
-    - name: Setup Node.js ${{ needs.get-build-requirements.outputs.node_version }}
-      uses: actions/setup-node@v6.4.0
-      with:
-        node-version: ${{ needs.get-build-requirements.outputs.node_version }}.x
-    - name: Check out the code
-      uses: actions/checkout@v6
-      with:
-        ref: ${{ github.event.inputs.commit }}
-    - name: Prepare front-end environment
-      uses: ./.github/actions/prepare-frontend
-
-    - name: Prepare back-end environment
-      uses: ./.github/actions/prepare-backend
-
-    - name: Build Metabase
-      if: ${{ needs.get-build-requirements.outputs.build_process != 'legacy' }}
-      run: ./bin/build.sh :edition :${{ matrix.edition }} :version $VERSION
-
-    - name: Build Metabase (legacy)
-      if: ${{ needs.get-build-requirements.outputs.build_process == 'legacy' }}
-      run: cd ./bin/build-mb && clojure -X build/build! :edition :${{ matrix.edition }} :version $VERSION
-
-    - name: Store commit's SHA-1 hash
-      run:  echo ${{ inputs.commit }} > COMMIT-ID
-      shell: bash
-    - run: mv ./target/uberjar/metabase.jar ./metabase.jar
-    - name: Calculate SHA256 checksum
-      run: sha256sum ./metabase.jar > SHA256.sum
-      shell: bash
-    - name: Upload JARs as artifact
-      uses: actions/upload-artifact@v7
-      with:
-        name: metabase-release-${{ matrix.edition }}-${{ inputs.commit }}-uberjar
-        path: |
-          ./metabase.jar
-          ./COMMIT-ID
-          ./SHA256.sum
-
-  run-pre-release-tests:
-    name: Run pre-release tests for ${{ inputs.version }}
-    needs: build-uberjar-for-release
-    uses: ./.github/workflows/pre-release.yml
-    secrets: inherit
-    with:
-      commit: ${{ inputs.commit }}
-      version: ${{ inputs.version }}

.github/workflows/bundle-size-stats.yml

@@ -8,6 +8,8 @@ on:
   workflow_run:
     workflows: ["Build Uberjar"]
     types: [completed]
+    # Master only: releases form non-linear lines whose deltas are meaningless,
+    # so their sizes are backfilled separately rather than logged here.
     branches: [master]
 
 concurrency:
@@ -21,6 +23,10 @@ jobs:
     timeout-minutes: 15
     env:
       HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
+      # Only record a data point when a bundle's as-served size (brotli where the
+      # build ships .br, else gzip) moved by at least this percent vs the last
+      # plotted point, keeping the chart to real changes.
+      MIN_DELTA_PERCENT: "0.5"
     steps:
       - name: Check out the code
         uses: actions/checkout@v6
@@ -78,9 +84,30 @@ jobs:
           mkdir -p artifacts resources/embedding-sdk
           if [ -n "$STATS_ZIP" ]; then unzip -o "$STATS_ZIP" -d artifacts; fi
           if [ -n "$PKG_ZIP" ]; then unzip -o "$PKG_ZIP" -d resources/embedding-sdk; fi
+      - name: Restore last plotted bundle sizes
+        uses: actions/cache/restore@v4
+        with:
+          path: bundle-size-cache
+          key: bundle-size-last-${{ github.run_id }}
+          restore-keys: |
+            bundle-size-last-
       - name: Measure bundle sizes
         run: node ./.github/scripts/measure-bundle-sizes.js | tee artifacts/bundle-sizes.json
-      - name: Upload sizes to Stats
+      - name: Compute deltas and decide whether to record this point
+        id: prepare
+        env:
+          CURRENT: artifacts/bundle-sizes.json
+          LAST: bundle-size-cache/last.json
+          CACHE_OUT: bundle-size-cache/last.json
+          ROWS_OUT: artifacts/upload-rows.json
+          VERSION_PROPS: artifacts/version.properties
+          # Passed via env (not interpolated into the shell) so the commit
+          # message can't inject commands; the script keeps only the subject.
+          COMMIT_MESSAGE: ${{ github.event.workflow_run.head_commit.message }}
+        run: node ./.github/scripts/bundle-size-stats-prepare.js
+      - name: Upload sizes (with deltas) to Stats
+        id: upload
+        if: steps.prepare.outputs.significant == 'true'
         uses: actions/github-script@v9
         env:
           API_KEY: ${{ secrets.STATS_API_KEY }}
@@ -89,43 +116,33 @@ jobs:
             const fs = require("fs");
             const { uploadCsvToMb } = require("${{ github.workspace }}/.github/scripts/csv-to-mb.js");
 
-            const measurements = JSON.parse(
-              fs.readFileSync("${{ github.workspace }}/artifacts/bundle-sizes.json", "utf8"),
+            const data = JSON.parse(
+              fs.readFileSync("${{ github.workspace }}/artifacts/upload-rows.json", "utf8"),
             );
 
-            const date = new Date().toISOString().slice(0, 10); // YYYY-MM-DD
-            const commit = process.env.HEAD_SHA.slice(0, 12);
-
-            // version.properties (extracted from the uberjar) carries the build's tag.
-            // Non-release (master) builds report tag=vUNKNOWN, so leave Version empty there.
-            const versionProps = "${{ github.workspace }}/artifacts/version.properties";
-            const rawVersion = fs.existsSync(versionProps)
-              ? (fs.readFileSync(versionProps, "utf8").match(/^tag=(.*)$/m)?.[1]?.trim() ?? "")
-              : "";
-            const version = rawVersion === "vUNKNOWN" ? "" : rawVersion;
-
-            const data = measurements.map(measurement => ({
-              "Date": date,
-              "Version": version,
-              "Commit": commit,
-              "Bundle": measurement.bundle,
-              "Kind": measurement.kind, // "initial" or "total"
-              "Raw bytes": measurement.rawBytes,
-              "Gzip bytes": measurement.gzipBytes,
-              "Brotli bytes": measurement.brotliBytes ?? "", // as-served; empty when no .br shipped
-              "File count": measurement.fileCount,
-            }));
-
             console.table(data);
 
-            uploadCsvToMb({
-              baseUrl: "https://stats.metabase.com",
-              tableId: 79417,
-              jsonData: data,
-              mode: "append",
-            }).then(() => {
+            try {
+              await uploadCsvToMb({
+                baseUrl: "https://stats.metabase.com",
+                tableId: 79702,
+                jsonData: data,
+                mode: "append",
+              });
               console.log("Bundle sizes uploaded successfully");
-            }).catch(error => {
-              console.error("Error uploading bundle sizes:", error);
-              process.exit(1);
-            });
+              core.setOutput("uploaded", "true");
+            } catch (error) {
+              // Stats logging is best-effort: if stats.metabase.com is still
+              // unreachable after the client's retries, keep the run green. The
+              // last-plotted cache is only saved on a successful upload (below),
+              // so this point is re-attempted on the next master build and
+              // nothing is silently dropped.
+              core.warning(`Bundle-size upload failed after retries; leaving run green: ${error.message}`);
+              core.setOutput("uploaded", "false");
+            }
+      - name: Remember this as the last plotted point
+        if: steps.upload.outputs.uploaded == 'true'
+        uses: actions/cache/save@v4
+        with:
+          path: bundle-size-cache
+          key: bundle-size-last-${{ github.run_id }}

.github/workflows/bundle-size.yml

@@ -0,0 +1,88 @@
+name: Bundle Size
+
+# Warns on PRs that move a shipped bundle's gzipped size past the threshold,
+# comparing the PR's uberjar against the base ref's. Both gates are measured in
+# a single job: downloading and extracting two uberjars is the expensive part,
+# so adding a bundle costs a comment step, not another job.
+
+on:
+  workflow_call:
+    inputs:
+      skip:
+        description: Whether to skip the check (e.g. no front-end sources changed, or the uberjar failed to build).
+        required: true
+        type: boolean
+
+concurrency:
+  group: bundle-size-${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  bundle-size-check:
+    name: "Bundle size check"
+    if: ${{ !inputs.skip }}
+    continue-on-error: true
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 20
+    env:
+      BUNDLE_SIZE_THRESHOLD_PERCENT: 2
+    steps:
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/bundle-size-check
+        id: compare
+        with:
+          edition: ee
+          base-ref-commit: ${{ github.event.pull_request.base.sha }}
+          threshold-percent: ${{ env.BUNDLE_SIZE_THRESHOLD_PERCENT }}
+
+      - name: Comment on PR if app bundle size has increased
+        uses: ./.github/actions/notify-pull-request
+        if: success() && steps.compare.outputs.app_status == 'increased'
+        with:
+          remove-previous-comment: true
+          add-new-comment: true
+          message: "⚠️ Main app initial bundle size (gzipped) increased by ${{ steps.compare.outputs.app_size_change_percent }}% compared to the ${{ github.base_ref }} branch (threshold: ${{ env.BUNDLE_SIZE_THRESHOLD_PERCENT }}%). This is the JavaScript every user downloads before the app renders, so check whether the new code can be loaded lazily instead."
+          include-log: false
+
+      - name: Comment on PR if app bundle size has decreased
+        uses: ./.github/actions/notify-pull-request
+        if: success() && steps.compare.outputs.app_status == 'decreased'
+        with:
+          remove-previous-comment: true
+          add-new-comment: true
+          message: "🎉 Main app initial bundle size (gzipped) decreased by ${{ steps.compare.outputs.app_size_change_percent }}% compared to the ${{ github.base_ref }} branch. Nice work!"
+          include-log: false
+
+      - name: Comment on PR if SDK bundle size has increased
+        uses: ./.github/actions/notify-pull-request
+        if: success() && steps.compare.outputs.sdk_status == 'increased'
+        with:
+          remove-previous-comment: true
+          add-new-comment: true
+          message: "⚠️ Embedding SDK chunked bundle size (gzipped) increased by ${{ steps.compare.outputs.sdk_size_change_percent }}% compared to the ${{ github.base_ref }} branch (threshold: ${{ env.BUNDLE_SIZE_THRESHOLD_PERCENT }}%). Please contact Embedding team."
+          include-log: false
+
+      - name: Send notification to Slack via Zapier
+        if: success() && steps.compare.outputs.sdk_status == 'increased'
+        shell: bash
+        env:
+          ZAPIER_WEBHOOK_URL: ${{ secrets.EMBEDDING_ZAPIER_WEBHOOK_URL }}
+          SIZE_CHANGE_PERCENT: ${{ steps.compare.outputs.sdk_size_change_percent }}
+          BUNDLE_SIZE_THRESHOLD_PERCENT: ${{ env.BUNDLE_SIZE_THRESHOLD_PERCENT }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+        run: |
+          curl -s -X POST "$ZAPIER_WEBHOOK_URL" \
+            -d "⚠️ Embedding SDK chunked bundle size (gzipped) increased by ${SIZE_CHANGE_PERCENT}% (threshold: ${BUNDLE_SIZE_THRESHOLD_PERCENT}%)
+
+          PR #${PR_NUMBER} ${PR_TITLE} (${PR_URL})"
+
+      - name: Comment on PR if SDK bundle size has decreased
+        uses: ./.github/actions/notify-pull-request
+        if: success() && steps.compare.outputs.sdk_status == 'decreased'
+        with:
+          remove-previous-comment: true
+          add-new-comment: true
+          message: "🎉 Embedding SDK chunked bundle size (gzipped) decreased by ${{ steps.compare.outputs.sdk_size_change_percent }}% compared to the ${{ github.base_ref }} branch. Nice work!"
+          include-log: false

.github/workflows/cache-cleanup-codeql.yml

@@ -0,0 +1,83 @@
+# CodeQL's overlay analysis saves a ~400MB "base database" cache on every master run, keyed by commit SHA.
+#
+# Only the newest entry is ever restored: CodeQL looks its cache up by key *prefix* and takes the most recent match,
+# so everything behind it is dead weight. This job keeps the newest few and deletes the rest.
+name: CodeQL Cache Cleanup
+
+on:
+  schedule:
+    - cron: "0 4 * * *" # daily at 04:00 UTC
+  workflow_dispatch:
+    inputs:
+      keep:
+        description: "How many of the newest CodeQL caches to keep"
+        required: false
+        default: "2"
+      dry-run:
+        description: "List what would be deleted without deleting it"
+        type: boolean
+        required: false
+        default: false
+
+concurrency:
+  group: cache-cleanup-codeql
+  cancel-in-progress: false
+
+permissions:
+  actions: write # required to delete cache entries
+  contents: read
+
+jobs:
+  cleanup:
+    # don't run the schedule on forks
+    if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 10
+    env:
+      GH_TOKEN: ${{ github.token }}
+      KEEP: ${{ github.event.inputs.keep || '2' }}
+      DRY_RUN: ${{ github.event.inputs.dry-run || 'false' }}
+      PREFIX: codeql-overlay-base-database-
+    steps:
+      - name: Delete superseded CodeQL caches
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          # created_at is ISO-8601, so a reverse lexicographic sort is newest-first.
+          gh api --paginate "/repos/${GITHUB_REPOSITORY}/actions/caches?per_page=100" \
+            --jq ".actions_caches[] | select(.key | startswith(\"${PREFIX}\")) | \"\(.created_at)\t\(.id)\t\(.size_in_bytes)\t\(.key)\"" \
+            | sort -r > all.tsv || true
+
+          found=$(wc -l < all.tsv | tr -d ' ')
+          echo "Found $found cache(s) matching '${PREFIX}'; keeping the newest $KEEP."
+          if [ "$found" -eq 0 ]; then
+            echo "Nothing to do." >> "$GITHUB_STEP_SUMMARY"
+            exit 0
+          fi
+
+          tail -n +$((KEEP + 1)) all.tsv > doomed.tsv || true
+          doomed=$(wc -l < doomed.tsv | tr -d ' ')
+
+          freed=0
+          while IFS=$'\t' read -r created id size key; do
+            [ -z "${id:-}" ] && continue
+            echo "  deleting $key ($((size / 1000000))MB, created $created)"
+            if [ "$DRY_RUN" = "true" ]; then
+              echo "    (dry run — not deleted)"
+            else
+              # A cache can vanish between listing and deleting (concurrent eviction); don't fail the job over it.
+              gh api --method DELETE "/repos/${GITHUB_REPOSITORY}/actions/caches/${id}" >/dev/null \
+                || echo "    (already gone, skipping)"
+            fi
+            freed=$((freed + size))
+          done < doomed.tsv
+
+          {
+            echo "### CodeQL cache cleanup"
+            echo ""
+            echo "- matched: **$found**"
+            echo "- kept (newest): **$KEEP**"
+            echo "- deleted: **$doomed**"
+            echo "- reclaimed: **$((freed / 1000000)) MB**${DRY_RUN:+ (dry run: $DRY_RUN)}"
+          } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/cache-generator.yml

@@ -93,10 +93,10 @@ jobs:
             ":dev:ee:ee-dev:drivers:drivers-dev:test:eastwood"  # backend.yml (eastwood + eastwood/test)
             ":dev:ci:ee:ee-dev:drivers:drivers-dev:test"        # test-driver.yml (ee) -> covers data.json:2.4.0
             ":dev:ci:oss:oss-dev:drivers:drivers-dev:test"      # test-driver.yml (oss)
-            ":dev:ci:test:ee:ee-dev"                            # backend.yml matrix (ee) + generative-query-test.yml
+            ":dev:ci:test:ee:ee-dev"                            # backend.yml matrix (ee)
             ":dev:ci:test:oss:oss-dev"                          # backend.yml matrix (oss)
             ":dev:ci:ee:ee-dev:test:cloverage"                  # backend-cloverage.yml
-            ":dev:drivers:drivers-dev:test"                     # reset-cloud-test-dataset.yml + presto script
+            ":dev:drivers:drivers-dev:test"                     # reset-cloud-test-dataset.yml
             ":dev:drivers:build:build-dev:build-test:ci"        # build-scripts.yml
             ":ee:drivers:check"                                 # backend.yml (check; git dep athos/clj-check)
             ":ee:doc"                                           # docs-generate-base.yml
@@ -135,7 +135,7 @@ jobs:
         run: |
           BUN_CACHE_DIR=$(bun pm cache)
           echo "Bun cache directory: $BUN_CACHE_DIR"
-          echo "dir=$BUN_CACHE_DIR" >> $GITHUB_OUTPUT
+          echo "dir=$BUN_CACHE_DIR" >> "$GITHUB_OUTPUT"
 
       - name: Ensure that Cypress executable is ready
         run: |

.github/workflows/codeql.yml

@@ -1,39 +0,0 @@
-name: "CodeQL"
-
-on:
-  push:
-    branches:
-      - 'master'
-      - 'release-**'
-  pull_request:
-
-jobs:
-  files-changed:
-    name: Check which files changed
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 3
-    outputs:
-      codeql: ${{ steps.changes.outputs.codeql }}
-    steps:
-      - uses: actions/checkout@v6
-      - name: Test which files changed
-        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
-        id: changes
-        with:
-          token: ${{ github.token }}
-          filters: .github/file-paths.yaml
-  analyze:
-    needs: files-changed
-    if: needs.files-changed.outputs.codeql == 'true'
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v6
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4
-      with:
-        languages: javascript
-        config-file: ./.github/codeql/codeql-config.yml
-        trap-caching: false
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4

.github/workflows/codespell.yml

@@ -27,7 +27,7 @@ jobs:
 
       - name: Get current date
         id: date
-        run: echo "date=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT
+        run: echo "date=$(date +'%Y-%m-%d')" >> "$GITHUB_OUTPUT"
 
       - name: Run codespell check
         id: codespell_check

.github/workflows/containerize-jar.yml

@@ -16,8 +16,8 @@ on:
       commit:
         type: string
       release:
-        type: string
-        default: 'false'
+        type: boolean
+        default: false
       build-args:
         type: string
   workflow_dispatch:
@@ -40,11 +40,8 @@ on:
         type: string
       release:
         description: Whether this is a release artifact (uses metabase-release- prefix)
-        type: choice
-        options:
-          - "false"
-          - "true"
-        default: "false"
+        type: boolean
+        default: false
 
 jobs:
   containerize:
@@ -88,8 +85,8 @@ jobs:
     - name: Login to Docker Hub
       uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
       with:
-        username: ${{ inputs.release == 'true' && secrets.DOCKERHUB_RELEASE_USERNAME || secrets.DOCKERHUB_USERNAME }}
-        password: ${{ inputs.release == 'true' && secrets.DOCKERHUB_RELEASE_TOKEN || secrets.DOCKERHUB_TOKEN }}
+        username: ${{ inputs.release && secrets.DOCKERHUB_RELEASE_USERNAME || secrets.DOCKERHUB_USERNAME }}
+        password: ${{ inputs.release && secrets.DOCKERHUB_RELEASE_TOKEN || secrets.DOCKERHUB_TOKEN }}
     - name: Set up QEMU
       if: contains(steps.platforms.outputs.result, 'arm')
       uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
@@ -126,8 +123,8 @@ jobs:
     - name: Login to Docker Hub
       uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
       with:
-        username: ${{ inputs.release == 'true' && secrets.DOCKERHUB_RELEASE_USERNAME || secrets.DOCKERHUB_USERNAME }}
-        password: ${{ inputs.release == 'true' && secrets.DOCKERHUB_RELEASE_TOKEN || secrets.DOCKERHUB_TOKEN }}
+        username: ${{ inputs.release && secrets.DOCKERHUB_RELEASE_USERNAME || secrets.DOCKERHUB_USERNAME }}
+        password: ${{ inputs.release && secrets.DOCKERHUB_RELEASE_TOKEN || secrets.DOCKERHUB_TOKEN }}
     - name: Pull the container image
       run: docker pull ${{ inputs.repo }}:${{ inputs.tag }}
     - name: Launch container
@@ -146,8 +143,8 @@ jobs:
     - name: Login to Docker Hub
       uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
       with:
-        username: ${{ inputs.release == 'true' && secrets.DOCKERHUB_RELEASE_USERNAME || secrets.DOCKERHUB_USERNAME }}
-        password: ${{ inputs.release == 'true' && secrets.DOCKERHUB_RELEASE_TOKEN || secrets.DOCKERHUB_TOKEN }}
+        username: ${{ inputs.release && secrets.DOCKERHUB_RELEASE_USERNAME || secrets.DOCKERHUB_USERNAME }}
+        password: ${{ inputs.release && secrets.DOCKERHUB_RELEASE_TOKEN || secrets.DOCKERHUB_TOKEN }}
     - name: Pull the container image
       run: docker pull ${{ inputs.repo }}:${{ inputs.tag }}
     - name: Launch container

.github/workflows/containerize-uberjar.yml

@@ -3,6 +3,10 @@ name: Containerize Uberjar
 on:
   workflow_call:
   workflow_dispatch:
+    inputs:
+      commit:
+        description: the full commit hash to containerize (defaults to the triggering commit)
+        type: string
 
 jobs:
   get-container-info:
@@ -59,7 +63,7 @@ jobs:
       commit: ${{ github.event.inputs.commit || github.event.pull_request.head.sha || github.sha }}
       repo: ${{ fromJson(needs.get-container-info.outputs[matrix.edition]).repo }}
       tag: ${{ fromJson(needs.get-container-info.outputs[matrix.edition]).tag }}
-      release: "false"
+      release: false
       build-args: |
         GIT_COMMIT_SHA=${{ github.event.inputs.commit || github.event.pull_request.head.sha || github.sha }}
 

.github/workflows/conventional-commit-pr-title-reminder.yml

@@ -1,56 +0,0 @@
-name: Conventional commit PR Title Reminder
-
-on:
-  pull_request:
-    branches:
-      - master
-
-jobs:
-  files-changed:
-    name: Check which files changed
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 3
-    outputs:
-      frontend_embedding_sources: ${{ steps.changes.outputs.frontend_embedding_sources }}
-    steps:
-      - uses: actions/checkout@v6
-      - name: Test which files changed
-        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
-        id: changes
-        with:
-          token: ${{ github.token }}
-          filters: .github/file-paths.yaml
-
-  pr-title-reminder:
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 5
-    permissions:
-      pull-requests: write
-    needs: [ files-changed ]
-    if: |
-      !cancelled() &&
-      needs.files-changed.outputs.frontend_embedding_sources == 'true'
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          ref: ${{ github.head_ref }}
-
-      - name: Check if the PR title is already following Conventional Commits style
-        uses: actions/github-script@v9
-        id: is-conventional-commit
-        with:
-          result-encoding: string
-          script: | # js
-            const { isConventionalTitle } = require(".github/scripts/conventional-commit-pr-title-reminder/utils.js")
-            const pullRequestTitle = context.payload.pull_request.title
-
-            return isConventionalTitle(pullRequestTitle)
-
-      - name: Remind PR authors to use conventional commit in the title
-        if: ${{ steps.is-conventional-commit.outputs.result != 'true' }}
-        uses: actions/github-script@v9
-        with:
-          script: | #js
-            const { updateCommentForEmbedding } = require(".github/scripts/conventional-commit-pr-title-reminder/utils.js")
-
-            await updateCommentForEmbedding({github, context})

.github/workflows/cross-branch-migrations.yml

@@ -26,7 +26,7 @@ concurrency:
 jobs:
   migrations-h2-ee:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 10
+    timeout-minutes: 15
     env:
       CI: 'true'
       MB_DB_TYPE: h2
@@ -40,7 +40,7 @@ jobs:
 
   migrations-postgres-14-ee:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 10
+    timeout-minutes: 15
     env:
       CI: 'true'
       MB_DB_TYPE: postgres
@@ -66,7 +66,7 @@ jobs:
 
   migrations-postgres-latest-ee:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 10
+    timeout-minutes: 15
     env:
       CI: 'true'
       MB_DB_TYPE: postgres
@@ -92,7 +92,7 @@ jobs:
 
   migrations-mysql-8-0-ee:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 10
+    timeout-minutes: 15
     env:
       CI: 'true'
       MB_DB_TYPE: mysql
@@ -103,6 +103,8 @@ jobs:
     services:
       mysql:
         image: mysql:8.0
+        # disposable CI database: a RAM-backed datadir makes migration fsyncs free
+        options: --tmpfs /var/lib/mysql:rw
         ports:
           - "3306:3306"
         env:
@@ -115,9 +117,9 @@ jobs:
           base-ref: ${{ env.BASE_REF }}
           head-ref: ${{ env.HEAD_REF }}
 
-  migrations-mysql-latest-ee:
+  migrations-mysql-9-ee:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 10
+    timeout-minutes: 15
     env:
       CI: 'true'
       MB_DB_TYPE: mysql
@@ -128,7 +130,9 @@ jobs:
       MB_MYSQL_TEST_USER: root
     services:
       mysql:
-        image: mysql:latest
+        image: mysql:9
+        # disposable CI database: a RAM-backed datadir makes migration fsyncs free
+        options: --tmpfs /var/lib/mysql:rw
         env:
           MYSQL_ALLOW_EMPTY_PASSWORD: true
           MYSQL_DATABASE: mb_test
@@ -141,9 +145,38 @@ jobs:
           base-ref: ${{ env.BASE_REF }}
           head-ref: ${{ env.HEAD_REF }}
 
+  # `mysql:latest` now resolves to MySQL 26.x, which fails in a way that floods the log until the
+  # runner cancels the job. A cancelled job can't be soft-failed with continue-on-error, so this
+  # job is disabled until 26.x is supported.
+  # migrations-mysql-latest-ee:
+  #   runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+  #   timeout-minutes: 15
+  #   env:
+  #     CI: 'true'
+  #     MB_DB_TYPE: mysql
+  #     MB_DB_HOST: localhost
+  #     MB_DB_PORT: 3306
+  #     MB_DB_DBNAME: mb_test
+  #     MB_DB_USER: root
+  #     MB_MYSQL_TEST_USER: root
+  #   services:
+  #     mysql:
+  #       image: mysql:latest
+  #       env:
+  #         MYSQL_ALLOW_EMPTY_PASSWORD: true
+  #         MYSQL_DATABASE: mb_test
+  #       ports:
+  #         - "3306:3306"
+  #   steps:
+  #     - uses: actions/checkout@v6
+  #     - uses: ./.github/actions/cross-branch-migration-test
+  #       with:
+  #         base-ref: ${{ env.BASE_REF }}
+  #         head-ref: ${{ env.HEAD_REF }}
+
   migrations-mariadb-10-6-ee:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 10
+    timeout-minutes: 15
     env:
       CI: 'true'
       MB_DB_TYPE: mysql
@@ -154,6 +187,8 @@ jobs:
     services:
       mariadb:
         image: metabase/mariadb:10.6 # https://github.com/metabase/metabase-mariadb-docker-image
+        # disposable CI database: a RAM-backed datadir makes migration fsyncs free
+        options: --tmpfs /var/lib/mysql:rw
         ports:
           - "3306:3306"
         env:
@@ -168,7 +203,7 @@ jobs:
 
   migrations-mariadb-latest-ee:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 10
+    timeout-minutes: 15
     env:
       CI: 'true'
       MB_DB_TYPE: mysql
@@ -179,6 +214,8 @@ jobs:
     services:
       mariadb:
         image: mariadb:latest
+        # disposable CI database: a RAM-backed datadir makes migration fsyncs free
+        options: --tmpfs /var/lib/mysql:rw
         ports:
           - "3306:3306"
         env:

.github/workflows/cross-version.yml

@@ -12,15 +12,16 @@ on:
         required: true
         type: string
 
-  pull_request:
-    paths:
-      - "cross-version/**"
-      - ".github/workflows/cross-version.yml"
-      - ".github/scripts/build-cross-version-matrix.js"
+  # NOTE: this workflow is temporarily disabled until the cross version tests are fixed.
+  # pull_request:
+  #   paths:
+  #     - "cross-version/**"
+  #     - ".github/workflows/cross-version.yml"
+  #     - ".github/scripts/build-cross-version-matrix.js"
 
-  schedule:
-    # Run nightly at 3 AM UTC
-    - cron: "0 3 * * *"
+  # schedule:
+  #   # Run nightly at 3 AM UTC
+  #   - cron: "0 3 * * *"
 
 jobs:
   # Generate matrix for scheduled/PR runs

.github/workflows/cut-release-branch.yml

@@ -250,8 +250,7 @@ jobs:
 
             const message = [
               `:announcement-animated: ${eng} The v${next} release branch has been cut.`,
-              `- \`backport\`s will go to v${next} now`,
-              `- If you want to go back to v${current}, you'll need to add the double-backport tag`,
+              `Add the \`backport\` label to backport changes to all supported release branches.`,
             ].join('\n');
 
             await sendSlackMessage({

.github/workflows/disabled-drivers-slack-notification.yml

@@ -34,18 +34,18 @@ jobs:
             const lastUpdated = config.metadata?.last_updated || 'unknown';
             const reason = config.metadata?.reason || 'No reason provided';
 
+            // "skip" is the only status CI reads: the driver is not run at all. A driver that
+            // runs but must not gate is expressed as a suite-level rule in CI Conductor, which
+            // reports it in its own UI.
             const skipped = drivers.filter(d => d.status === 'skip').map(d => d.name);
-            const info = drivers.filter(d => d.status === 'info').map(d => d.name);
 
-            if (skipped.length === 0 && info.length === 0) {
-              console.log('No drivers are disabled or collecting data. Skipping Slack notification.');
+            if (skipped.length === 0) {
+              console.log('No drivers are disabled. Skipping Slack notification.');
               return;
             }
 
             const list = (names) => names.map(d => `\`${d}\``).join('  ');
-            const lines = [];
-            if (skipped.length) lines.push(`:no_entry: *Disabled (not run):* ${list(skipped)}`);
-            if (info.length) lines.push(`:information_source: *Collecting data (non-blocking):* ${list(info)}`);
+            const lines = [`:no_entry: *Disabled (not run):* ${list(skipped)}`];
 
             if (!process.env.SLACK_BOT_TOKEN) {
               throw new Error('SLACK_BOT_TOKEN is required');

.github/workflows/docs-generate-base.yml

@@ -79,10 +79,10 @@ jobs:
         id: check_changes
         run: |
           if git diff --quiet docs/; then
-            echo "changes=false" >> $GITHUB_OUTPUT
+            echo "changes=false" >> "$GITHUB_OUTPUT"
             echo "No changes detected in docs directory"
           else
-            echo "changes=true" >> $GITHUB_OUTPUT
+            echo "changes=true" >> "$GITHUB_OUTPUT"
             echo "Changes detected in docs directory"
           fi
 
@@ -109,7 +109,7 @@ jobs:
           git commit -m "Update generated docs (${{ inputs.target_branch }})" --no-verify
           git push -u origin "$BRANCH_NAME"
 
-          echo "branch_name=$BRANCH_NAME" >> $GITHUB_OUTPUT
+          echo "branch_name=$BRANCH_NAME" >> "$GITHUB_OUTPUT"
           echo "Successfully created and pushed branch"
 
       - name: Create pull request
@@ -155,7 +155,7 @@ jobs:
               break
             else
               echo "PR creation failed on attempt $i"
-              if [ $i -eq 3 ]; then
+              if [ "$i" -eq 3 ]; then
                 echo "All attempts failed. Exiting with error."
                 exit 1
               fi
@@ -172,22 +172,24 @@ jobs:
       - name: Workflow summary
         if: always()
         run: |
-          if [ "${{ steps.check_changes.outputs.changes }}" == "true" ]; then
-            if [ "${{ steps.commit_and_push.outcome }}" == "success" ]; then
-              if [ "${{ steps.create_pr.outcome }}" == "success" ]; then
-                echo "## ✅ Documentation Updated Successfully" >> $GITHUB_STEP_SUMMARY
-                echo "- Branch: \`${{ steps.commit_and_push.outputs.branch_name }}\`" >> $GITHUB_STEP_SUMMARY
-                echo "- PR created targeting **${{ inputs.target_branch }}**" >> $GITHUB_STEP_SUMMARY
+          {
+            if [ "${{ steps.check_changes.outputs.changes }}" == "true" ]; then
+              if [ "${{ steps.commit_and_push.outcome }}" == "success" ]; then
+                if [ "${{ steps.create_pr.outcome }}" == "success" ]; then
+                  echo "## ✅ Documentation Updated Successfully"
+                  echo "- Branch: \`${{ steps.commit_and_push.outputs.branch_name }}\`"
+                  echo "- PR created targeting **${{ inputs.target_branch }}**"
+                else
+                  echo "## ⚠️ Branch Created but PR Failed"
+                  echo "- Branch: \`${{ steps.commit_and_push.outputs.branch_name }}\`"
+                  echo "- Manual PR creation required"
+                fi
               else
-                echo "## ⚠️ Branch Created but PR Failed" >> $GITHUB_STEP_SUMMARY
-                echo "- Branch: \`${{ steps.commit_and_push.outputs.branch_name }}\`" >> $GITHUB_STEP_SUMMARY
-                echo "- Manual PR creation required" >> $GITHUB_STEP_SUMMARY
+                echo "## ❌ Failed to Create Branch"
+                echo "- Check workflow logs for details"
               fi
             else
-              echo "## ❌ Failed to Create Branch" >> $GITHUB_STEP_SUMMARY
-              echo "- Check workflow logs for details" >> $GITHUB_STEP_SUMMARY
+              echo "## ℹ️ No Changes Detected"
+              echo "- Documentation is up to date on **${{ inputs.target_branch }}**"
             fi
-          else
-            echo "## ℹ️ No Changes Detected" >> $GITHUB_STEP_SUMMARY
-            echo "- Documentation is up to date on **${{ inputs.target_branch }}**" >> $GITHUB_STEP_SUMMARY
-          fi
+          } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/docs-links.yml

@@ -27,7 +27,7 @@ jobs:
 
       - name: Run link checker
         id: link-check
-        uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2.8.0
+        uses: lycheeverse/lychee-action@e7477775783ea5526144ba13e8db5eec57747ce8 # v2.9.0
         with:
           fail: true
           args: docs --config ./.lychee/config.toml --offline

.github/workflows/docs-release-generate.yml

@@ -8,7 +8,7 @@ on:
       target_branch:
         description: "Target branch for documentation update"
         required: false
-        default: "release-x.62.x"
+        default: "release-x.63.x"
         type: string
 
 jobs:
@@ -17,6 +17,6 @@ jobs:
     name: Call documentation update for release branch
     uses: ./.github/workflows/docs-generate-base.yml
     with:
-      target_branch: ${{ inputs.target_branch || 'release-x.62.x' }}
+      target_branch: ${{ inputs.target_branch || 'release-x.63.x' }}
     secrets:
       automation_token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}

.github/workflows/drivers-stress-test.yml

@@ -34,6 +34,7 @@ on:
           - Mongo 5 (SSL)
           - Mongo (latest)
           - MySQL
+          - MySQL 9
           - MySQL (latest)
           - Oracle 18
           - Oracle 21
@@ -68,6 +69,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-athena-ee'
+        granular-rerun: 'false'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-bigquery-cloud-sdk-ee:
@@ -90,6 +92,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-bigquery-cloud-sdk-ee'
+        granular-rerun: 'false'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-druid-ee:
@@ -112,6 +115,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-druid-ee'
+        granular-rerun: 'false'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-mariadb-10-6-ee:
@@ -141,6 +145,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-mariadb-10-6-ee'
+        granular-rerun: 'false'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-mariadb-latest-ee:
@@ -170,6 +175,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-mariadb-latest-ee'
+        granular-rerun: 'false'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-mongo-4-4-ee:
@@ -192,6 +198,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-mongo-4-4-ee'
+        granular-rerun: 'false'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-mongo-4-4-ssl-ee:
@@ -226,6 +233,7 @@ jobs:
         uses: ./.github/actions/test-driver
         with:
           junit-name: 'be-tests-mongo-4-4-ee'
+          granular-rerun: 'false'
           test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-mongo-5-0-ee:
@@ -248,6 +256,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-mongo-5-0-ee'
+        granular-rerun: 'false'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-mongo-5-0-ssl-ee:
@@ -282,6 +291,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-mongo-5-0-ee'
+        granular-rerun: 'false'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-mongo-latest-ee:
@@ -307,6 +317,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-mongo-latest-ee'
+        granular-rerun: 'false'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-mysql-8-0-ee:
@@ -336,6 +347,37 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-mysql-8-0-ee'
+        granular-rerun: 'false'
+        test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
+
+  be-tests-mysql-9-ee:
+    if: inputs.driver == 'MySQL 9'
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 90
+    env:
+      CI: 'true'
+      DRIVERS: mysql
+      MB_DB_TYPE: mysql
+      MB_DB_HOST: localhost
+      MB_DB_PORT: 3306
+      MB_DB_DBNAME: mb_test
+      MB_DB_USER: root
+      MB_MYSQL_TEST_USER: root
+    services:
+      mysql:
+        image: mysql:9
+        ports:
+          - "3306:3306"
+        env:
+          MYSQL_ALLOW_EMPTY_PASSWORD: true
+          MYSQL_DATABASE: mb_test
+    steps:
+    - uses: actions/checkout@v6
+    - name: Test MySQL driver (9)
+      uses: ./.github/actions/test-driver
+      with:
+        junit-name: 'be-tests-mysql-9-ee'
+        granular-rerun: 'false'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-mysql-latest-ee:
@@ -374,6 +416,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-mysql-latest-ee'
+        granular-rerun: 'false'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-oracle-18-4-ee:
@@ -400,6 +443,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-oracle-18-4-ee'
+        granular-rerun: 'false'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-oracle-21-3-ee:
@@ -435,6 +479,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-oracle-21-3-ee'
+        granular-rerun: 'false'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-postgres-ee:
@@ -465,6 +510,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-postgres-ee'
+        granular-rerun: 'false'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-postgres-latest-ee:
@@ -498,6 +544,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-postgres-latest-ee'
+        granular-rerun: 'false'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-presto-jdbc-ee:
@@ -528,7 +575,7 @@ jobs:
       run: while ! nc -z localhost ${{ env.MB_PRESTO_JDBC_TEST_PORT }}; do sleep 0.1; done
       timeout-minutes: 15
     - name: Create temp cacerts file based on bundled JDK one
-      run: cp $JAVA_HOME/lib/security/cacerts /tmp/cacerts-with-presto-ssl.jks
+      run: cp "$JAVA_HOME/lib/security/cacerts" /tmp/cacerts-with-presto-ssl.jks
     - name: Capture Presto server self signed CA
       run: |
           while [[ ! -s /tmp/presto-ssl-ca.pem ]];
@@ -547,6 +594,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-presto-jdbc-ee'
+        granular-rerun: 'false'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-redshift-ee:
@@ -566,6 +614,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-redshift-ee'
+        granular-rerun: 'false'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-snowflake-ee:
@@ -597,6 +646,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-snowflake-ee'
+        granular-rerun: 'false'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-sparksql-ee:
@@ -617,6 +667,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-sparksql-ee'
+        granular-rerun: 'false'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-sqlite-ee:
@@ -632,6 +683,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-sqlite-ee'
+        granular-rerun: 'false'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-sqlserver-2017-ee:
@@ -659,6 +711,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-sqlserver-ee'
+        granular-rerun: 'false'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-sqlserver-2022-ee:
@@ -686,6 +739,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-sqlserver-2022-ee'
+        granular-rerun: 'false'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   be-tests-starburst-ee:
@@ -711,6 +765,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-starburst-ee'
+        granular-rerun: 'false'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
   login-to-ecr:
@@ -734,9 +789,11 @@ jobs:
 
         REGISTRY="$(aws sts get-caller-identity --query Account --output text).dkr.ecr.us-east-1.amazonaws.com"
 
-        echo "docker_username=AWS" >> $GITHUB_OUTPUT
-        echo "docker_password=$PASSWORD" >> $GITHUB_OUTPUT
-        echo "registry=$REGISTRY" >> $GITHUB_OUTPUT
+        {
+          echo "docker_username=AWS"
+          echo "docker_password=$PASSWORD"
+          echo "registry=$REGISTRY"
+        } >> "$GITHUB_OUTPUT"
     outputs:
       registry: ${{ steps.login-ecr.outputs.registry }}
       docker_username: ${{ steps.login-ecr.outputs.docker_username }}
@@ -766,4 +823,5 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-vertica-ee'
+        granular-rerun: 'false'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"

.github/workflows/drivers.yml

@@ -45,24 +45,6 @@ jobs:
       sqlite-should-run: ${{ steps.driver-decisions.outputs.sqlite-should-run }}
       sqlserver-should-run: ${{ steps.driver-decisions.outputs.sqlserver-should-run }}
       vertica-should-run: ${{ steps.driver-decisions.outputs.vertica-should-run }}
-      # Per-driver configured status from ci-test-config (skip | info | required)
-      athena-status: ${{ steps.driver-decisions.outputs.athena-status }}
-      bigquery-status: ${{ steps.driver-decisions.outputs.bigquery-status }}
-      clickhouse-status: ${{ steps.driver-decisions.outputs.clickhouse-status }}
-      databricks-status: ${{ steps.driver-decisions.outputs.databricks-status }}
-      druid-jdbc-status: ${{ steps.driver-decisions.outputs.druid-jdbc-status }}
-      mongo-status: ${{ steps.driver-decisions.outputs.mongo-status }}
-      mongo-ssl-status: ${{ steps.driver-decisions.outputs.mongo-ssl-status }}
-      mongo-sharded-cluster-status: ${{ steps.driver-decisions.outputs.mongo-sharded-cluster-status }}
-      mysql-mariadb-status: ${{ steps.driver-decisions.outputs.mysql-mariadb-status }}
-      oracle-status: ${{ steps.driver-decisions.outputs.oracle-status }}
-      presto-jdbc-status: ${{ steps.driver-decisions.outputs.presto-jdbc-status }}
-      redshift-status: ${{ steps.driver-decisions.outputs.redshift-status }}
-      snowflake-status: ${{ steps.driver-decisions.outputs.snowflake-status }}
-      sparksql-status: ${{ steps.driver-decisions.outputs.sparksql-status }}
-      sqlite-status: ${{ steps.driver-decisions.outputs.sqlite-status }}
-      sqlserver-status: ${{ steps.driver-decisions.outputs.sqlserver-status }}
-      vertica-status: ${{ steps.driver-decisions.outputs.vertica-status }}
       # Per-driver quarantine conflict flags (set when driver is quarantined but has file changes)
       athena-quarantine-conflict: ${{ steps.driver-decisions.outputs.athena-quarantine-conflict }}
       bigquery-quarantine-conflict: ${{ steps.driver-decisions.outputs.bigquery-quarantine-conflict }}
@@ -84,28 +66,6 @@ jobs:
       sqlserver-quarantine-conflict: ${{ steps.driver-decisions.outputs.sqlserver-quarantine-conflict }}
       vertica-quarantine-conflict: ${{ steps.driver-decisions.outputs.vertica-quarantine-conflict }}
     steps:
-      # Up front (before any driver job), drop info-driver comments from older commits so a
-      # superseded comment disappears immediately rather than waiting for this run's drivers.
-      # Keeps this commit's comment (if any) so a re-run doesn't flicker.
-      - name: Remove stale info-driver comments
-        if: ${{ github.event_name == 'pull_request' }}
-        uses: actions/github-script@v9
-        continue-on-error: true
-        with:
-          script: | # js
-            const pr = context.payload.pull_request;
-            if (!pr) return;
-            const { owner, repo } = context.repo;
-            const PREFIX = "<!-- info-driver-result";
-            const keep = `<!-- info-driver-results:${pr.head.sha} -->`;
-            const { data: comments } = await github.rest.issues.listComments({
-              owner, repo, issue_number: pr.number, per_page: 100,
-            });
-            for (const c of comments) {
-              if (c.body.includes(PREFIX) && !c.body.includes(keep)) {
-                await github.rest.issues.deleteComment({ owner, repo, comment_id: c.id }).catch(() => {});
-              }
-            }
       - name: Checkout repository
         uses: actions/checkout@v6
       - name: Fetch base branch
@@ -125,7 +85,7 @@ jobs:
             --skip="${{ inputs.skip }}"
           )
           echo "Running:"
-          echo "./bin/mage -driver-decisions ${MAGE_ARGS[@]}"
+          echo "./bin/mage -driver-decisions ${MAGE_ARGS[*]}"
           echo ""
           # First call: show human-readable output for debugging
           ./bin/mage -driver-decisions "${MAGE_ARGS[@]}"
@@ -133,10 +93,10 @@ jobs:
           echo "Want to force-run a specific driver? Add a ci:run-<driver> or ci:run-all-drivers label to your PR."
           echo "Run './bin/mage -driver-decisions -h' locally for the full list of drivers and labels."
           # Second call: output only key=value lines for GITHUB_OUTPUT
-          ./bin/mage -driver-decisions "${MAGE_ARGS[@]}" --github-output-only >> $GITHUB_OUTPUT
+          ./bin/mage -driver-decisions "${MAGE_ARGS[@]}" --github-output-only >> "$GITHUB_OUTPUT"
         env:
           BASE_REF: ${{ github.event.pull_request.base.ref || github.ref_name }}
-          IS_MASTER_OR_RELEASE: ${{ github.ref_name == 'master' || startsWith(github.ref_name, 'release-') }}
+          IS_MASTER_OR_RELEASE: ${{ github.ref_name == 'master' || startsWith(github.ref_name, 'release-x') }}
         shell: bash
 
   be-tests-athena-ee:
@@ -177,25 +137,13 @@ jobs:
         test-args: >-
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
-        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.athena-status }}
-        report-variant: ${{ matrix.job.name }}
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
 
   be-tests-bigquery-cloud-sdk-ee:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.bigquery-should-run == 'true' || needs.determine-driver-skips.outputs.bigquery-quarantine-conflict == 'true' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 60
+    timeout-minutes: 70
     strategy:
       fail-fast: false
       matrix:
@@ -252,26 +200,14 @@ jobs:
       with:
         junit-name: 'be-tests-bigquery-cloud-sdk-ee'
         test-args: ${{ matrix.job.test-args }}
-        logs-artifact-suffix: ${{ matrix.job.name }}
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
-        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.bigquery-status }}
-        report-variant: ${{ matrix.job.name }}
+        artifact-suffix: ${{ matrix.job.name }}
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
       with:
         upload-logs: ${{ steps.test-driver.outcome == 'failure' }}
-        logs-artifact-suffix: ${{ matrix.job.name }} ${{ matrix.version.name }}
+        logs-artifact-suffix: ${{ matrix.job.name }}
 
   be-tests-clickhouse-ee:
     needs: determine-driver-skips
@@ -337,24 +273,14 @@ jobs:
       with:
         junit-name: 'be-tests-clickhouse-ee'
         test-args: ${{ matrix.job.test-args }}
-        logs-artifact-suffix: ${{ matrix.job.name }}
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
-        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+        artifact-suffix: ${{ matrix.job.name }}
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
       with:
         upload-logs: ${{ steps.test-driver.outcome == 'failure' }}
-        logs-artifact-suffix: ${{ matrix.job.name }} ${{ matrix.version.name }}
+        logs-artifact-suffix: ${{ matrix.job.name }}
 
   be-tests-druid-jdbc-ee:
     needs: determine-driver-skips
@@ -392,23 +318,38 @@ jobs:
         test-args: >-
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
-        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
 
   be-tests-databricks-ee:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.databricks-should-run == 'true' || needs.determine-driver-skips.outputs.databricks-quarantine-conflict == 'true' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 40
+    timeout-minutes: 50
+    strategy:
+      fail-fast: false
+      matrix:
+        job:
+          - name: Driver Tests Part 1
+            test-args: >-
+              :only-tags [:mb/driver-tests]
+              :exclude-tags [:mb/transforms-python-test]
+              :fail-fast? true
+              :partition/total 3
+              :partition/index 0
+          - name: Driver Tests Part 2
+            test-args: >-
+              :only-tags [:mb/driver-tests]
+              :exclude-tags [:mb/transforms-python-test]
+              :fail-fast? true
+              :partition/total 3
+              :partition/index 1
+          - name: Driver Tests Part 3
+            test-args: >-
+              :only-tags [:mb/driver-tests]
+              :exclude-tags [:mb/transforms-python-test]
+              :fail-fast? true
+              :partition/total 3
+              :partition/index 2
     env:
       CI: 'true'
       DRIVERS: databricks
@@ -437,28 +378,40 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-databricks-ee'
-        test-args: >-
-          :only-tags [:mb/driver-tests]
-          :exclude-tags [:mb/transforms-python-test]
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
-        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.databricks-status }}
-        report-variant: ${{ matrix.job.name }}
+        artifact-suffix: ${{ matrix.job.name }}
+        test-args: ${{ matrix.job.test-args }}
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
 
   be-tests-databricks-multi-catalog-ee:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.databricks-should-run == 'true' || needs.determine-driver-skips.outputs.databricks-quarantine-conflict == 'true' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 40
+    timeout-minutes: 50
+    strategy:
+      fail-fast: false
+      matrix:
+        job:
+          - name: Driver Tests Part 1
+            test-args: >-
+              :only-tags [:mb/driver-tests]
+              :exclude-tags [:mb/transforms-python-test]
+              :fail-fast? true
+              :partition/total 3
+              :partition/index 0
+          - name: Driver Tests Part 2
+            test-args: >-
+              :only-tags [:mb/driver-tests]
+              :exclude-tags [:mb/transforms-python-test]
+              :fail-fast? true
+              :partition/total 3
+              :partition/index 1
+          - name: Driver Tests Part 3
+            test-args: >-
+              :only-tags [:mb/driver-tests]
+              :exclude-tags [:mb/transforms-python-test]
+              :fail-fast? true
+              :partition/total 3
+              :partition/index 2
     env:
       CI: 'true'
       DRIVERS: databricks
@@ -488,22 +441,9 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-databricks-multi-catalog-ee'
-        test-args: >-
-          :only-tags [:mb/driver-tests]
-          :exclude-tags [:mb/transforms-python-test]
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
-        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.databricks-status }}
-        report-variant: ${{ matrix.job.name }}
+        artifact-suffix: ${{ matrix.job.name }}
+        test-args: ${{ matrix.job.test-args }}
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
 
   be-tests-h2:
     needs: determine-driver-skips
@@ -523,17 +463,7 @@ jobs:
         test-args: >-
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
-        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
 
   be-tests-h2-oss:
     needs: determine-driver-skips
@@ -554,17 +484,7 @@ jobs:
         test-args: >-
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
-        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
 
   be-tests-mysql-mariadb:
     needs: determine-driver-skips
@@ -593,12 +513,21 @@ jobs:
             env:
               enable-ssl-tests: 'false'
               enable-aws-iam-tests: 'false'
-          - name: MySQL Latest
-            junit-name: be-tests-mysql-latest-ee
-            image: mysql:latest
+          - name: MySQL 9
+            junit-name: be-tests-mysql-9-ee
+            image: mysql:9
             env:
               enable-ssl-tests: 'true'
               enable-aws-iam-tests: 'true'
+          # `mysql:latest` now resolves to MySQL 26.x, which fails in a way that floods the log
+          # until the runner cancels the job. A cancelled job can't be soft-failed with
+          # continue-on-error, so the leg is disabled until 26.x is supported.
+          # - name: MySQL Latest
+          #   junit-name: be-tests-mysql-latest-ee
+          #   image: mysql:latest
+          #   env:
+          #     enable-ssl-tests: 'false'
+          #     enable-aws-iam-tests: 'false'
         job:
           - name: Driver Tests
             test-args: >-
@@ -612,6 +541,8 @@ jobs:
     services:
       mysql:
         image: ${{ matrix.version.image }}
+        # disposable CI database: a RAM-backed datadir makes DDL/insert fsyncs free
+        options: --tmpfs /var/lib/mysql:rw
         ports:
           - "3306:3306"
         env:
@@ -627,7 +558,7 @@ jobs:
             github.event_name == 'push' &&
             (
               github.ref_name == 'master' ||
-              startsWith(github.ref_name, 'release-')
+              startsWith(github.ref_name, 'release-x')
             ) &&
             ''
           ) ||
@@ -680,21 +611,11 @@ jobs:
         uses: ./.github/actions/test-driver
         with:
           junit-name: ${{ matrix.version.junit-name }}
-          logs-artifact-suffix: ${{ matrix.version.name }}
+          artifact-suffix: ${{ matrix.version.name }}-${{ matrix.job.name }}
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[ ${{ matrix.job.exclude-tag }} ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
-      - name: Upload Test Results
-        uses: ./.github/actions/upload-test-results
-        if: always()
-        with:
-          input-path: ./target/junit/
-          output-name: ${{ github.job }}
-          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-          aws-region: ${{ vars.AWS_REGION }}
-          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+          quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
       - name: Cleanup python-runner
         if: always()
         uses: ./.github/actions/cleanup-python-runner
@@ -763,18 +684,8 @@ jobs:
       with:
         junit-name: ${{ matrix.version.junit-name }}
         test-args: ${{ matrix.job.test-args }}
-        logs-artifact-suffix: ${{ matrix.job.name }}
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
-        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+        artifact-suffix: ${{ matrix.version.name }}-${{ matrix.job.name }}
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -846,17 +757,7 @@ jobs:
           test-args: >-
             :exclude-tags '[:mongo-sharded-cluster-tests :mb/transforms-python-test]'
             :only-tags [:mb/driver-tests]
-      - name: Upload Test Results
-        uses: ./.github/actions/upload-test-results
-        if: always()
-        with:
-          input-path: ./target/junit/
-          output-name: ${{ github.job }}
-          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-          aws-region: ${{ vars.AWS_REGION }}
-          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+          quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
 
   be-tests-mongo-sharded-cluster-ee:
     needs: determine-driver-skips
@@ -891,17 +792,7 @@ jobs:
         junit-name: 'be-tests-mongo-sharded-cluster-ee'
         test-args: >-
           :only metabase.driver.mongo.sharded-cluster-test
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
-        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
 
   be-tests-oracle:
     needs: determine-driver-skips
@@ -972,27 +863,17 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: ${{ matrix.version.junit-name }}
-        logs-artifact-suffix: ${{ matrix.version.name }}
+        artifact-suffix: ${{ matrix.version.name }}
         test-args: >-
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
-        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
 
   be-tests-postgres:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.postgres-should-run == 'true' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 40
+    timeout-minutes: 50
     strategy:
       fail-fast: false
       matrix:
@@ -1029,7 +910,7 @@ jobs:
             github.event_name == 'push' &&
             (
               github.ref_name == 'master' ||
-              startsWith(github.ref_name, 'release-')
+              startsWith(github.ref_name, 'release-x')
             ) &&
             ''
           ) ||
@@ -1076,21 +957,11 @@ jobs:
         uses: ./.github/actions/test-driver
         with:
           junit-name: 'be-tests-${{ matrix.version.junit-name }}'
-          logs-artifact-suffix: ${{ matrix.version.name }}-${{ matrix.job.name }}
+          artifact-suffix: ${{ matrix.version.name }}-${{ matrix.job.name }}
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[ ${{ matrix.job.exclude-tag }} ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
-      - name: Upload Test Results
-        uses: ./.github/actions/upload-test-results
-        if: always()
-        with:
-          input-path: ./target/junit/
-          output-name: ${{ github.job }}
-          bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-          role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-          aws-region: ${{ vars.AWS_REGION }}
-          trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-          previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+          quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
       - name: Cleanup python-runner
         if: always()
         uses: ./.github/actions/cleanup-python-runner
@@ -1139,7 +1010,7 @@ jobs:
          port: ${{ env.MB_PRESTO_JDBC_TEST_PORT }}
       timeout-minutes: 5
     - name: Create temp cacerts file based on bundled JDK one
-      run: cp $JAVA_HOME/lib/security/cacerts /tmp/cacerts-with-presto-ssl.jks
+      run: cp "$JAVA_HOME/lib/security/cacerts" /tmp/cacerts-with-presto-ssl.jks
     - name: Capture Presto server self signed CA
       run: |
           while [[ ! -s /tmp/presto-ssl-ca.pem ]]; do
@@ -1167,23 +1038,13 @@ jobs:
         test-args: >-
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
-        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
 
   be-tests-redshift-ee:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.redshift-should-run == 'true' || needs.determine-driver-skips.outputs.redshift-quarantine-conflict == 'true' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 40
+    timeout-minutes: 50
     strategy:
       fail-fast: false
       matrix:
@@ -1250,32 +1111,20 @@ jobs:
         junit-name: 'be-tests-redshift-ee'
         test-args: >-
           ${{ matrix.job.test-args }}
-        logs-artifact-suffix: ${{ matrix.job.name }}
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: ${{ !matrix.job.skip && !cancelled() }}
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
-        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.redshift-status }}
-        report-variant: ${{ matrix.job.name }}
+        artifact-suffix: ${{ matrix.job.name }}
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
       with:
         upload-logs: ${{ steps.test-driver.outcome == 'failure' }}
-        logs-artifact-suffix: ${{ matrix.job.name }} ${{ matrix.version.name }}
+        logs-artifact-suffix: ${{ matrix.job.name }}
 
   be-tests-snowflake-ee:
     needs: determine-driver-skips
     if: ${{ needs.determine-driver-skips.outputs.snowflake-should-run == 'true' || needs.determine-driver-skips.outputs.snowflake-quarantine-conflict == 'true' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 60
+    timeout-minutes: 70
     strategy:
       fail-fast: false
       matrix:
@@ -1283,8 +1132,11 @@ jobs:
           - name: Driver Tests
             test-args: >-
               :only-tags [:mb/driver-tests]
-              :exclude-tags [:mb/transforms-python-test]
+              :exclude-tags '[:mb/upload-tests :mb/transforms-python-test]'
               :fail-fast? true
+          - name: Upload Tests
+            test-args: >-
+              :only-tags [:mb/upload-tests]
           - name: Transforms Python Tests
             test-args: >-
               :only-tags [:mb/transforms-python-test]
@@ -1332,26 +1184,14 @@ jobs:
       with:
         junit-name: 'be-tests-snowflake-ee'
         test-args: ${{ matrix.job.test-args }}
-        logs-artifact-suffix: ${{ matrix.job.name }}
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
-        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
-        driver-status: ${{ needs.determine-driver-skips.outputs.snowflake-status }}
-        report-variant: ${{ matrix.job.name }}
+        artifact-suffix: ${{ matrix.job.name }}
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
       with:
         upload-logs: ${{ steps.test-driver.outcome == 'failure' }}
-        logs-artifact-suffix: ${{ matrix.job.name }} ${{ matrix.version.name }}
+        logs-artifact-suffix: ${{ matrix.job.name }}
 
   be-tests-sparksql-ee:
     needs: determine-driver-skips
@@ -1387,17 +1227,7 @@ jobs:
         test-args: >-
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
-        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
 
   be-tests-sqlite-ee:
     needs: determine-driver-skips
@@ -1428,17 +1258,7 @@ jobs:
         test-args: >-
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
-        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
 
   be-tests-sqlserver:
     needs: determine-driver-skips
@@ -1503,18 +1323,8 @@ jobs:
       with:
         junit-name: ${{ matrix.version.junit-name }}
         test-args: ${{ matrix.job.test-args }}
-        logs-artifact-suffix: ${{ matrix.version.name }}
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
-        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+        artifact-suffix: ${{ matrix.version.name }}-${{ matrix.job.name }}
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -1549,16 +1359,6 @@ jobs:
   #       junit-name: 'be-tests-starburst-ee'
   #       test-args: >-
   #         :only-tags [:mb/driver-tests]
-  #   - name: Upload Test Results
-  #     uses: ./.github/actions/upload-test-results
-  #     if: always()
-  #     with:
-  #       input-path: ./target/junit/
-  #       output-name: ${{ github.job }}
-  #       bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-  #       role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-  #       aws-region: ${{ vars.AWS_REGION }}
-  #       trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
   login-to-ecr:
     needs: determine-driver-skips
@@ -1582,9 +1382,11 @@ jobs:
 
         REGISTRY="$(aws sts get-caller-identity --query Account --output text).dkr.ecr.us-east-1.amazonaws.com"
 
-        echo "docker_username=AWS" >> $GITHUB_OUTPUT
-        echo "docker_password=$PASSWORD" >> $GITHUB_OUTPUT
-        echo "registry=$REGISTRY" >> $GITHUB_OUTPUT
+        {
+          echo "docker_username=AWS"
+          echo "docker_password=$PASSWORD"
+          echo "registry=$REGISTRY"
+        } >> "$GITHUB_OUTPUT"
     outputs:
       registry: ${{ steps.login-ecr.outputs.registry }}
       docker_username: ${{ steps.login-ecr.outputs.docker_username }}
@@ -1629,31 +1431,14 @@ jobs:
         test-args: >-
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        role-to-assume: ${{ secrets.CI_TEST_RESULTS_IAM_ROLE }}
-        aws-region: ${{ vars.AWS_REGION }}
-        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-        previous-step-outcome: ${{ steps.test-driver.outputs.test-outcome }}
+        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
 
   drivers-tests-result:
     needs:
-      # Supplies each driver's configured status (info/skip/required) so this gate can ignore
-      # "info" drivers regardless of their result -- including cancelled or timed-out runs, which
-      # the per-job continue-on-error cannot force green because the controlling step never
-      # completes. Not a driver job; it is filtered out of the pass/fail check below.
       - determine-driver-skips
       # if you add a driver job, you must add it to this list for it to be a required check
       - be-tests-h2
       - be-tests-athena-ee
-      # Listed unconditionally; ci-test-config controls their effect via per-driver status.
-      # An "info" driver is reported as passing, so it never blocks this check; flip it to
-      # "required" in the config to make a real failure gate, with no change here.
       - be-tests-snowflake-ee
       - be-tests-bigquery-cloud-sdk-ee
       - be-tests-databricks-ee
@@ -1682,44 +1467,18 @@ jobs:
         uses: actions/github-script@v9
         env:
           needs: ${{ toJson(needs) }}
-          # Job name -> configured driver status, from determine-driver-skips. An "info" driver is
-          # data-collection only and must never gate; a cancelled/timed-out info job lands here as
-          # cancelled/failure (its own continue-on-error can't force it green), so we drop info jobs
-          # from the gate entirely. Empty/unknown status falls back to "required" (gates as before).
-          statuses: |
-            {
-              "be-tests-athena-ee": "${{ needs.determine-driver-skips.outputs.athena-status }}",
-              "be-tests-bigquery-cloud-sdk-ee": "${{ needs.determine-driver-skips.outputs.bigquery-status }}",
-              "be-tests-clickhouse-ee": "${{ needs.determine-driver-skips.outputs.clickhouse-status }}",
-              "be-tests-databricks-ee": "${{ needs.determine-driver-skips.outputs.databricks-status }}",
-              "be-tests-druid-jdbc-ee": "${{ needs.determine-driver-skips.outputs.druid-jdbc-status }}",
-              "be-tests-mongo": "${{ needs.determine-driver-skips.outputs.mongo-status }}",
-              "be-tests-mongo-ssl": "${{ needs.determine-driver-skips.outputs.mongo-ssl-status }}",
-              "be-tests-mongo-sharded-cluster-ee": "${{ needs.determine-driver-skips.outputs.mongo-sharded-cluster-status }}",
-              "be-tests-mysql-mariadb": "${{ needs.determine-driver-skips.outputs.mysql-mariadb-status }}",
-              "be-tests-oracle": "${{ needs.determine-driver-skips.outputs.oracle-status }}",
-              "be-tests-presto-jdbc-ee": "${{ needs.determine-driver-skips.outputs.presto-jdbc-status }}",
-              "be-tests-redshift-ee": "${{ needs.determine-driver-skips.outputs.redshift-status }}",
-              "be-tests-snowflake-ee": "${{ needs.determine-driver-skips.outputs.snowflake-status }}",
-              "be-tests-sparksql-ee": "${{ needs.determine-driver-skips.outputs.sparksql-status }}",
-              "be-tests-sqlite-ee": "${{ needs.determine-driver-skips.outputs.sqlite-status }}",
-              "be-tests-sqlserver": "${{ needs.determine-driver-skips.outputs.sqlserver-status }}"
-            }
         with:
           script: | # js
             const needs = JSON.parse(process.env.needs);
-            const statuses = JSON.parse(process.env.statuses);
 
-            // Drop the determine-driver-skips bookkeeping job, then drop "info" drivers: they are
-            // non-gating, so their result (including cancelled/timed-out) must not fail this check.
+            // Drop the determine-driver-skips bookkeeping job; every remaining job is a driver
+            // job whose result gates this check.
             const jobs = Object.entries(needs)
               .filter(([jobName]) => jobName !== 'determine-driver-skips')
               .map(([jobName, jobValues]) => ({
                 name: jobName,
-                result: jobValues.result,
-                status: statuses[jobName] || 'required'
-              }))
-              .filter(job => job.status !== 'info');
+                result: jobValues.result
+              }));
 
             // are all jobs skipped or successful?
             if (jobs.every(job => (job.result === 'skipped' || job.result === 'success'))) {

.github/workflows/e2e-coverage-manifest.yml

@@ -0,0 +1,182 @@
+name: E2E Coverage Manifest
+
+# Nightly: builds an instrumented frontend, runs the e2e suite sharded to
+# record which source files each spec exercises, and publishes a spec -> files
+# manifest used for selective e2e runs on PRs.
+#
+# Isolated from the PR e2e path on purpose - the per-shard worker
+# (e2e-coverage-shard.yml) is a dedicated, trimmed copy so coverage runs can
+# never affect PR test results.
+
+on:
+  schedule:
+    # Nightly, after the day's merges have settled (UTC).
+    - cron: "0 7 * * *"
+  workflow_dispatch:
+    inputs:
+      edition:
+        description: "Edition to instrument"
+        type: choice
+        options: ["ee", "oss"]
+        default: "ee"
+
+concurrency:
+  group: e2e-coverage-manifest-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build-instrumented:
+    name: Build instrumented uberjar
+    runs-on: ubuntu-22.04
+    timeout-minutes: 60
+    env:
+      MB_EDITION: ${{ inputs.edition || 'ee' }}
+      INSTRUMENT_COVERAGE: "true"
+    steps:
+      - uses: actions/checkout@v6
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+      # build.clj forwards INSTRUMENT_COVERAGE to the rspack build, so only the
+      # bundled FE is instrumented; everything else builds normally.
+      - name: Build instrumented uberjar
+        run: ./bin/build.sh
+      - name: Upload instrumented uberjar
+        uses: actions/upload-artifact@v7
+        with:
+          name: instrumented-uberjar
+          path: target/uberjar/metabase.jar
+          retention-days: 1
+      # Regenerate the OpenAPI spec from this SHA's defendpoint definitions so
+      # route normalization in the merge job matches against the endpoints
+      # that actually served this run, not the checked-in file (which is only
+      # refreshed by the label-gated openapi-check workflow and drifts).
+      - name: Generate OpenAPI route table
+        run: bun run generate-openapi
+      - name: Upload OpenAPI route table
+        uses: actions/upload-artifact@v7
+        with:
+          name: openapi-spec
+          path: resources/openapi/openapi.json
+          retention-days: 1
+
+  # Fixed-N sharding — coverage doesn't need the PR matrix-builder's tag/edition
+  # groups, just an even split of the regular spec set. The shard count lives in
+  # one place (SHARDS below); the matrix is generated from it.
+  setup:
+    name: Build shard matrix
+    runs-on: ubuntu-22.04
+    outputs:
+      matrix: ${{ steps.gen.outputs.matrix }}
+      count: ${{ steps.gen.outputs.count }}
+    steps:
+      - id: gen
+        env:
+          SHARDS: 100
+        run: |
+          matrix=$(node -e "console.log(JSON.stringify({split_index:[...Array(Number(process.env.SHARDS)).keys()]}))")
+          echo "matrix=$matrix" >> "$GITHUB_OUTPUT"
+          echo "count=$SHARDS" >> "$GITHUB_OUTPUT"
+
+  shards:
+    name: Shard
+    needs: [build-instrumented, setup]
+    strategy:
+      fail-fast: false
+      matrix: ${{ fromJson(needs.setup.outputs.matrix) }}
+    uses: ./.github/workflows/e2e-coverage-shard.yml
+    secrets: inherit
+    with:
+      edition: ${{ inputs.edition || 'ee' }}
+      total_chunks: ${{ fromJson(needs.setup.outputs.count) }}
+      split_index: ${{ matrix.split_index }}
+
+  merge:
+    name: Merge and publish manifest
+    needs: shards
+    if: always()
+    runs-on: ubuntu-22.04
+    timeout-minutes: 15
+    # github-script lists/downloads the previous manifest artifact.
+    permissions:
+      actions: read
+      contents: read
+    steps:
+      - uses: actions/checkout@v6
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+      # merge-multiple unions every shard's per-spec dir into one tree; the
+      # per-spec file design means no conflict resolution is needed.
+      - name: Download all shard coverage
+        uses: actions/download-artifact@v8
+        with:
+          pattern: coverage-shard-*
+          path: e2e/coverage-manifest-raw
+          merge-multiple: true
+      # Backfill source: the newest existing manifest is the previous nightly
+      # (this run hasn't uploaded yet). build-coverage-manifest.mjs carries over
+      # any still-existing spec that didn't run today.
+      - name: Download previous manifest for backfill
+        id: prev
+        uses: actions/github-script@v9
+        with:
+          script: | # js
+            const fs = require("fs");
+            const { owner, repo } = context.repo;
+            const { data } = await github.rest.actions.listArtifactsForRepo({
+              owner, repo, name: "spec-file-manifest", per_page: 20,
+            });
+            const art = (data.artifacts ?? [])
+              .filter((a) => !a.expired)
+              .sort((a, b) => new Date(b.created_at) - new Date(a.created_at))[0];
+            if (!art) {
+              console.log("No previous manifest; nothing to backfill.");
+              return;
+            }
+            const dl = await github.rest.actions.downloadArtifact({
+              owner, repo, artifact_id: art.id, archive_format: "zip",
+            });
+            fs.writeFileSync("prev-manifest.zip", Buffer.from(dl.data));
+            core.setOutput("found", "true");
+      - name: Unzip previous manifest
+        if: steps.prev.outputs.found == 'true'
+        run: unzip -o prev-manifest.zip -d prev-manifest
+      # Overwrites the checked-out resources/openapi/openapi.json with the one
+      # generated from this run's SHA. If the artifact is somehow missing, the
+      # checked-in file is still there and the builder falls back to it.
+      - name: Download OpenAPI route table
+        continue-on-error: true
+        uses: actions/download-artifact@v8
+        with:
+          name: openapi-spec
+          path: resources/openapi
+      # GITHUB_SHA (the master commit this nightly built from) is stamped into
+      # the manifest as `builtAt`, so a PR can later pick the manifest closest
+      # to its own point in history. See resolve-coverage-manifest.mjs.
+      - name: Build coverage manifest
+        env:
+          PREV_MANIFEST: ${{ steps.prev.outputs.found == 'true' && 'prev-manifest/spec-file-manifest.json' || '' }}
+        run: node e2e/coverage/build-coverage-manifest.mjs
+      # Manifest routes are stored table-independent; consumers match them
+      # against an endpoint spec at selection time. Ship this run's generated
+      # spec alongside so they can choose it over their checkout's copy.
+      # Copied into e2e/coverage so the artifact stays flat — the backfill
+      # step expects the manifests at the archive root.
+      - name: Include OpenAPI spec in artifact
+        run: |
+          if [ -f resources/openapi/openapi.json ]; then
+            cp resources/openapi/openapi.json e2e/coverage/openapi.json
+          fi
+      # All files share one artifact so the per-test manifest always travels
+      # with the spec manifest it was built from (backfill and PR-side
+      # resolution read them as siblings).
+      - name: Upload manifests
+        uses: actions/upload-artifact@v7
+        with:
+          name: spec-file-manifest
+          path: |
+            e2e/coverage/spec-file-manifest.json
+            e2e/coverage/spec-test-manifest.json
+            e2e/coverage/openapi.json
+          retention-days: 30

.github/workflows/e2e-coverage-shard.yml

@@ -0,0 +1,112 @@
+name: E2E Coverage Shard
+
+# Reusable per-shard worker for the coverage manifest run. Trimmed extract of
+# e2e-test.yml: runs one cypress-split shard against an instrumented build and
+# uploads that shard's per-spec coverage. Intentionally omits the PR-only
+# concerns (failed-spec retry, quarantine, S3 result upload, timing
+# output) since this is a nightly, non-blocking job.
+
+on:
+  workflow_call:
+    inputs:
+      edition:
+        type: string
+        default: ee
+      total_chunks:
+        type: number
+        required: true
+      split_index:
+        type: number
+        required: true
+
+env:
+  DISPLAY: ""
+  TERM: xterm
+  TZ: US/Pacific
+  INSTRUMENT_COVERAGE: "true"
+
+jobs:
+  run:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 60
+    name: coverage-shard-${{ inputs.split_index }}
+    env:
+      MB_EDITION: ${{ inputs.edition }}
+      CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ secrets.STAGING_MB_ALL_FEATURES_TOKEN }}
+      CYPRESS_MB_STARTER_CLOUD_TOKEN: ${{ secrets.STAGING_MB_STARTER_CLOUD_TOKEN }}
+      CYPRESS_MB_PRO_CLOUD_TOKEN: ${{ secrets.STAGING_MB_PRO_CLOUD_TOKEN }}
+      CYPRESS_MB_PRO_SELF_HOSTED_TOKEN: ${{ secrets.STAGING_MB_PRO_SELF_HOSTED_TOKEN }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          submodules: true
+          token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+
+      - name: Prepare Docker containers
+        uses: ./.github/actions/e2e-prepare-containers
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          maildev: true
+          openldap: true
+          webhook: true
+          snowplow: true
+          postgres: true
+          mysql: true
+          mongo: true
+
+      # The orchestrator built and uploaded this in an earlier job of the same run.
+      - name: Download instrumented uberjar
+        uses: actions/download-artifact@v8
+        with:
+          name: instrumented-uberjar
+          path: target/uberjar
+
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+      - name: Prepare Cypress environment
+        id: cypress-prep
+        uses: ./.github/actions/prepare-cypress
+
+      - name: Compile CLJS
+        run: bun run build-pure:cljs
+
+      - name: Run Metabase
+        run: node e2e/runner/run_cypress_ci.js start
+
+      - name: Generate database snapshots
+        env:
+          CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
+        run: node e2e/runner/run_cypress_ci.js snapshot
+
+      # cypress-split divides the spec set by timing data; INSTRUMENT_COVERAGE
+      # makes the support hook drain __coverage__ into e2e/coverage-manifest-raw/.
+      - name: Run shard ${{ inputs.split_index }}
+        # No SPLIT_FILE: cypress-split shards evenly by spec count using
+        # SPLIT/SPLIT_INDEX alone. Omitting it means no timings are read or
+        # written, which avoids cypress-split's after:run writeback (it would
+        # otherwise try to overwrite ./e2e/support/timings.json from a cwd where
+        # that subpath isn't reachable, crashing the run). Even-by-count is fine
+        # here — every spec runs exactly once across the shards.
+        env:
+          SPLIT: ${{ inputs.total_chunks }}
+          SPLIT_INDEX: ${{ inputs.split_index }}
+          SPLIT_SUMMARY: false
+          CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
+        run: |
+          node e2e/runner/run_cypress_ci.js e2e \
+            --expose grepTags="-@mongo+-@python+-@OSS+-@skip"
+        # Don't let a single failing/flaky spec abort the shard — we still want
+        # coverage from the specs that did run.
+        continue-on-error: true
+
+      - name: Upload shard coverage
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: coverage-shard-${{ inputs.split_index }}
+          path: e2e/coverage-manifest-raw/
+          retention-days: 7
+          if-no-files-found: warn

.github/workflows/e2e-matrix-builder.yml

@@ -4,7 +4,7 @@ on:
   workflow_call:
     inputs:
       chunks:
-        required: true
+        required: false
         type: number
         default: 30
       specs:
@@ -46,7 +46,7 @@ jobs:
             const { buildMatrix } = require('${{ github.workspace }}/.github/scripts/build-e2e-matrix.js');
             const inputSpecs = "${{ inputs.specs }}";
             const inputChunks = Number(process.env.chunks);
-            const java = 21;
+            const java = 25;
             const defaultRunner = "${{ vars.DEFAULT_RUNNER_KEY }}";
             const options = {
               java,

.github/workflows/e2e-stress-test-flake-fix.yml

@@ -98,9 +98,9 @@ jobs:
         run: |
           SPEC='${{ inputs.spec }}'
           if [[ "$SPEC" == e2e/test-component/scenarios/embedding-sdk/* ]]; then
-            echo "type=component" >> $GITHUB_OUTPUT
+            echo "type=component" >> "$GITHUB_OUTPUT"
           else
-            echo "type=e2e" >> $GITHUB_OUTPUT
+            echo "type=e2e" >> "$GITHUB_OUTPUT"
           fi
 
   workflow-summary:
@@ -110,20 +110,33 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Generate workflow summary
+        env:
+          BRANCH: ${{ github.ref_name }}
+          SPEC: ${{ inputs.spec }}
+          TEST_TYPE: ${{ needs.determine-test-type.outputs.type }}
+          BURN_IN: ${{ inputs.burn_in }}
+          GREP: ${{ inputs.grep }}
+          QA_DB: ${{ inputs.qa_db }}
+          ENABLE_NETWORK_THROTTLING: ${{ inputs.enable_network_throttling }}
+          FAIL_FAST: ${{ inputs.fail_fast }}
+          BUILD_JAR: ${{ inputs.build_jar }}
+          SENDER: ${{ github.event.sender.login }}
         run: |
-          echo '**Inputs:**' >> $GITHUB_STEP_SUMMARY
-          echo '' >> $GITHUB_STEP_SUMMARY
-          echo '- `branch`: ${{ github.ref_name }}' >> $GITHUB_STEP_SUMMARY
-          echo '- `spec`: ${{ inputs.spec }}' >> $GITHUB_STEP_SUMMARY
-          echo '- `test_type` (inferred): ${{ needs.determine-test-type.outputs.type }}' >> $GITHUB_STEP_SUMMARY
-          echo '- `burn_in`: ${{ inputs.burn_in }}' >> $GITHUB_STEP_SUMMARY
-          echo '- `grep`: "${{ inputs.grep }}"' >> $GITHUB_STEP_SUMMARY
-          echo '- `qa_db`: "${{ inputs.qa_db }}"' >> $GITHUB_STEP_SUMMARY
-          echo '- `enable_network_throttling`: "${{ inputs.enable_network_throttling }}"' >> $GITHUB_STEP_SUMMARY
-          echo '- `fail_fast`: "${{ inputs.fail_fast }}"' >> $GITHUB_STEP_SUMMARY
-          echo '- `build_jar`: "${{ inputs.build_jar }}"' >> $GITHUB_STEP_SUMMARY
-          echo '' >> $GITHUB_STEP_SUMMARY
-          echo 'triggered by: @${{ github.event.sender.login }}' >> $GITHUB_STEP_SUMMARY
+          {
+            echo '**Inputs:**'
+            echo ''
+            echo "- \`branch\`: $BRANCH"
+            echo "- \`spec\`: $SPEC"
+            echo "- \`test_type\` (inferred): $TEST_TYPE"
+            echo "- \`burn_in\`: $BURN_IN"
+            echo "- \`grep\`: \"$GREP\""
+            echo "- \`qa_db\`: \"$QA_DB\""
+            echo "- \`enable_network_throttling\`: \"$ENABLE_NETWORK_THROTTLING\""
+            echo "- \`fail_fast\`: \"$FAIL_FAST\""
+            echo "- \`build_jar\`: \"$BUILD_JAR\""
+            echo ''
+            echo "triggered by: @$SENDER"
+          } >> "$GITHUB_STEP_SUMMARY"
 
   stress-test-flake-fix:
     needs: [determine-test-type]