fix(webapp): Vertically align checkboxes

This reverts commit c7a5aee1f8.

.clj-kondo/hooks/clojure/core.clj

@@ -1,200 +0,0 @@
-(ns hooks.clojure.core
-  (:require
-   [clj-kondo.hooks-api :as hooks]
-   [clojure.string :as str]))
-
-(defn- node->qualified-symbol [node]
-  (try
-   (when (hooks/token-node? node)
-     (let [sexpr (hooks/sexpr node)]
-       (when (symbol? sexpr)
-         (let [resolved (hooks/resolve {:name sexpr})]
-           (when-not (= :clj-kondo/unknown-namespace (:ns resolved))
-             (symbol (name (:ns resolved)) (name (:name resolved))))))))
-   ;; some symbols like `*count/Integer` aren't resolvable.
-   (catch Exception _
-     nil)))
-
-(def ^:private white-card-symbols
-  '#{;; these toucan methods might actually set global values if it's used outside of a transaction,
-     ;; but since mt/with-temp runs in a transaction, so we'll ignore them in this case.
-     toucan2.core/delete!
-     toucan2.core/update!
-     toucan2.core/insert!
-     toucan2.core/insert-returning-instance!
-     toucan2.core/insert-returning-instances!
-     toucan2.core/insert-returning-pk!
-     toucan2.core/insert-returning-pks!
-     clojure.core.async/<!!
-     clojure.core.async/>!!
-     clojure.core.async/alts!!
-     clojure.core.async/close!
-     clojure.core.async/poll!
-     clojure.core.memoize/memo-clear!
-     clojure.core/conj!
-     clojure.core/persistent!
-     clojure.core/reset!
-     clojure.core/swap!
-     clojure.core/volatile!
-     clojure.core/vreset!
-     clojure.core/vswap!
-     clojure.java.jdbc/execute!
-     methodical.core/add-aux-method-with-unique-key!
-     methodical.core/remove-aux-method-with-unique-key!
-     next.jdbc/execute!
-
-     ;; TODO: most of these symbols shouldn't be here, we should go through them and
-     ;; find the functions/macros that use them and make sure their names end with !
-     ;; best way to do this is try remove each of these and rely on kondo output to find places where it's used
-     clojure.test/grant-collection-perms!
-     clojure.test/grant-collection-perms-fn!
-     clojure.test/grant-perms-fn!
-     clojure.test/purge-old-entries!
-     clojure.test/revoke-collection-perms!
-     clojure.test/save-results!
-     metabase-enterprise.advanced-permissions.models.permissions/update-db-download-permissions!
-     metabase-enterprise.internal-user/install-internal-user!
-     metabase-enterprise.sso.integrations.saml-test/call-with-login-attributes-cleared!
-     metabase.actions/perform-action!
-     metabase.analytics.snowplow-test/fake-track-event-impl!
-     metabase.analytics.snowplow/track-event-impl!
-     metabase.api.public-test/add-card-to-dashboard!
-     metabase.cmd.dump-to-h2/dump-to-h2!
-     metabase.cmd.load-from-h2/load-from-h2!
-     metabase.core/ensure-audit-db-installed!
-     metabase.db.schema-migrations-test.impl/run-migrations-in-range!
-     metabase.db.setup/migrate!
-     metabase.db.setup/setup-db!
-     metabase.db/setup-db!
-     metabase.driver.mongo-test/create-database-from-row-maps!
-     metabase.driver.postgres-test/create-enums-db!
-     metabase.driver.postgres-test/drop-if-exists-and-create-db!
-     metabase.driver.sql-jdbc.execute/execute-statement!
-     metabase.email-test/reset-inbox!
-     metabase.email/send-email!
-     metabase.models.action/insert!
-     metabase.models.collection.graph-test/clear-graph-revisions!
-     metabase.models.collection.graph-test/do-with-n-temp-users-with-personal-collections!
-     metabase.models.field-values/create-or-update-full-field-values!
-     metabase.models.model-index/add-values!
-     metabase.models.moderation-review/create-review!
-     metabase.models.on-demand-test/add-dashcard-with-parameter-mapping!
-     metabase.models.permissions/grant-application-permissions!
-     metabase.models.permissions/grant-collection-read-permissions!
-     metabase.models.permissions/grant-collection-readwrite-permissions!
-     metabase.models.permissions/grant-full-data-permissions!
-     metabase.models.permissions/grant-native-readwrite-permissions!
-     metabase.models.permissions/grant-permissions!
-     metabase.models.permissions/revoke-application-permissions!
-     metabase.models.permissions/revoke-data-perms!
-     metabase.models.permissions/update-data-perms-graph!
-     metabase.models.permissions/update-group-permissions!
-     metabase.models.persisted-info/ready-database!
-     metabase.models.revision/revert!
-     metabase.models.setting-test/test-user-local-allowed-setting!
-     metabase.models.setting-test/test-user-local-only-setting!
-     metabase.models.setting.cache/restore-cache!
-     metabase.models.setting/set!
-     metabase.models.setting/validate-settings-formatting!
-     metabase.permissions.test-util/with-restored-perms!
-     metabase.pulse/send-notifications!
-     metabase.pulse/send-pulse!
-     metabase.query-processor.streaming.interface/begin!
-     metabase.query-processor.streaming.interface/finish!
-     metabase.query-processor.streaming.interface/write-row!
-     metabase.sample-data/try-to-extract-sample-database!
-     metabase.setup/create-token!
-     metabase.sync.sync-metadata.fields.sync-metadata/update-field-metadata-if-needed!
-     metabase.sync.sync-metadata/sync-db-metadata!
-     metabase.sync.util-test/sync-database!
-     metabase.sync.util/store-sync-summary!
-     metabase.sync/sync-database!
-     metabase.task.index-values/job-init!
-     metabase.task.persist-refresh/job-init!
-     metabase.task.persist-refresh/refresh-tables!
-     metabase.task.persist-refresh/schedule-persistence-for-database!
-     metabase.task/delete-task!
-     metabase.test.data.bigquery-cloud-sdk/execute!
-     metabase.test.data.impl/copy-db-tables-and-fields!
-     metabase.test.data.impl/get-or-create-database!
-     metabase.test.data.impl/get-or-create-test-data-db!
-     metabase.test.data.interface/create-db!
-     metabase.test.data.interface/destroy-db!
-     metabase.test.data.oracle/create-user!
-     metabase.test.data.oracle/drop-user!
-     metabase.test.data.sql-jdbc.load-data/make-insert!
-     metabase.test.data.users/clear-cached-session-tokens!
-     metabase.test.initialize/do-initialization!
-     metabase.test.initialize/initialize-if-needed!
-     metabase.test.integrations.ldap/start-ldap-server!
-     metabase.test.util.log/ensure-unique-logger!
-     metabase.test.util.log/set-ns-log-level!
-     metabase.test.util/do-with-temp-env-var-value!
-     metabase.test.util/restore-raw-setting!
-     metabase.test.util/upsert-raw-setting!
-     metabase.test/initialize-if-needed!
-     metabase.test/test-helpers-set-global-values!
-     metabase.test/with-temp-env-var-value!
-     metabase.upload-test/set-local-infile!
-     metabase.util.files/create-dir-if-not-exists!
-     metabase.util.ssh-test/start-mock-servers!
-     metabase.util.ssh-test/stop-mock-servers!})
-
-(defn- end-with-exclamation?
-  [s]
-  (str/ends-with? s "!"))
-
-(defn- non-thread-safe-form-should-end-with-exclamation*
-  [{[defn-or-defmacro form-name] :children, :as node}]
-  (when-not (and (:string-value form-name)
-                 (end-with-exclamation? (:string-value form-name)))
-    (letfn [(walk [f form]
-              (f form)
-              (doseq [child (:children form)]
-                (walk f child)))]
-      (walk (fn [form]
-              (when-let [qualified-symbol (node->qualified-symbol form)]
-                (when (and (not (contains? white-card-symbols qualified-symbol))
-                           (end-with-exclamation? qualified-symbol))
-                  (hooks/reg-finding! (assoc (meta form-name)
-                                             :message (format "The name of this %s should end with `!` because it contains calls to non thread safe form `%s`."
-                                                              (:string-value defn-or-defmacro) qualified-symbol)
-                                             :type :metabase/test-helpers-use-non-thread-safe-functions)))))
-            node))
-    node))
-
-(defn non-thread-safe-form-should-end-with-exclamation
-  "Used to ensure defn and defmacro in test namespace to have name ending with `!` if it's non-thread-safe.
-  A function or a macro can be defined as 'not thread safe' when their funciton name ends with a `!`.
-
-  Only used in tests to identify thread-safe/non-thread-safe test helpers. See #37126"
-  [{:keys [node cljc lang]}]
-  (when (or (not cljc)
-            (= lang :clj))
-    (non-thread-safe-form-should-end-with-exclamation* node))
-  {:node node})
-
-(comment
- (require '[clj-kondo.core :as clj-kondo])
- (def form (str '(defmacro a
-                   [x]
-                   `(fun-call x))))
-
- (def form "(defmacro a
-           [x]
-           `(some! ~x))")
-
- (def form "(defun f
-           [x]
-           (let [g! (fn [] 1)]
-           (g!)))")
-
- (str (hooks/parse-string form))
- (hooks/sexpr (hooks/parse-string form))
-
- (binding [hooks/*reload* true]
-   (-> form
-       (with-in-str (clj-kondo/run! {:lint ["-"]}))
-       :findings))
-
- (do (non-thread-safe-form-should-end-with-exclamation* (hooks/parse-string form)) nil))

.clj-kondo/hooks/common.clj

@@ -1,371 +0,0 @@
-(ns hooks.common
-  (:require [clj-kondo.hooks-api :as hooks]
-            [clojure.pprint]))
-
-(defn with-macro-meta
-  "When introducing internal nodes (let, defn, etc) it is important to provide a meta of an existing token
-   as the current version of kondo will use the whole form by default."
-  [new-node hook-node]
-  (with-meta new-node (meta (first (:children hook-node)))))
-
-;;; This stuff is to help debug hooks. Trace a function and it will pretty-print the before & after sexprs.
-;;;
-;;;    (hooks.common/trace #'calculate-bird-scarcity)
-
-(defn- trace* [f]
-  {:pre [(fn? f)]}
-  (fn traced-fn [node]
-    (println \newline)
-    (clojure.pprint/pprint (hooks/sexpr (:node node)))
-    (let [node* (f node)]
-      (println '=>)
-      (clojure.pprint/pprint (hooks/sexpr (:node node*)))
-      node*)))
-
-;;; this doesn't seem to work with SCI. Use [[defn-traced]] instead.
-
-;; (defn trace [varr]
-;;   {:pre [(var? varr)]}
-;;   (when-not (::traced? (meta varr))
-;;     (alter-var-root varr trace*)
-;;     (alter-meta! varr assoc ::traced? true)
-;;     (println "Traced" varr)))
-
-(defmacro defn-traced
-  "Replace a hook [[defn]] with this to trace the before and after sexprs."
-  [fn-name & fn-tail]
-  `(do
-     (defn fn# ~@fn-tail)
-     (def ~fn-name (trace* fn#))))
-
-;;;; Common hook definitions
-
-(defn do*
-  "This is the same idea as [[clojure.core/do]] but doesn't cause Kondo to complain about redundant dos or unused values."
-  [{{[_ & args] :children, :as node} :node}]
-  (let [node* (-> (hooks/list-node
-                   (list*
-                    (with-meta (hooks/token-node 'do) {:clj-kondo/ignore [:redundant-do]})
-                    (for [arg args]
-                      (vary-meta arg update :clj-kondo/ignore #(conj (vec %) :unused-value)))))
-                  (with-meta (meta node)))]
-    {:node node*}))
-
-(defn with-one-binding
-  "Helper for macros that have a shape like
-
-    (my-macro [x]
-      ...)
-
-    =>
-
-    (let [x nil]
-      ...)
-
-  Binding is optional and `_` will be substituted if not supplied."
-  [{{[_ {[x] :children} & body] :children} :node}]
-  (let [node* (hooks/list-node
-               (list*
-                (hooks/token-node 'let)
-                (hooks/vector-node
-                 [(or x (hooks/token-node '_)) (hooks/token-node 'nil)])
-                body))]
-    {:node node*}))
-
-(defn with-two-bindings
-  "Helper for macros that have a shape like
-
-    (my-macro [x y]
-      ...)
-
-    =>
-
-    (let [x nil, y nil]
-      ...)
-
-  All bindings are optional and `_` will be substituted if not supplied."
-  [{{[_ {[x y] :children} & body] :children} :node}]
-  (let [node* (hooks/list-node
-               (list*
-                (hooks/token-node 'let)
-                (hooks/vector-node
-                 [(or x (hooks/token-node '_)) (hooks/token-node 'nil)
-                  (or y (hooks/token-node '_)) (hooks/token-node 'nil)])
-                body))]
-    {:node node*}))
-
-(defn with-three-bindings
-  "Helper for macros that have a shape like
-
-    (my-macro [x y z]
-      ...)
-
-    =>
-
-    (let [x nil, y nil, z nil]
-      ...)
-
-  All bindings are optional and `_` will be substituted if not supplied."
-  [{{[_ {[x y z] :children} & body] :children} :node}]
-  (let [node* (hooks/list-node
-               (list*
-                (hooks/token-node 'let)
-                (hooks/vector-node
-                 [(or x (hooks/token-node '_)) (hooks/token-node 'nil)
-                  (or y (hooks/token-node '_)) (hooks/token-node 'nil)
-                  (or z (hooks/token-node '_)) (hooks/token-node 'nil)])
-                body))]
-    {:node node*}))
-
-(defn with-four-bindings
-  "Helper for macros that have a shape like
-
-    (my-macro [a b c d]
-      ...)
-
-    =>
-
-    (let [a nil, b nil, c nil, d nil]
-      ...)
-
-  All bindings are optional and `_` will be substituted if not supplied."
-  [{{[_ {[a b c d] :children} & body] :children} :node}]
-  (let [node* (hooks/list-node
-               (list*
-                (hooks/token-node 'let)
-                (hooks/vector-node
-                 [(or a (hooks/token-node '_)) (hooks/token-node 'nil)
-                  (or b (hooks/token-node '_)) (hooks/token-node 'nil)
-                  (or c (hooks/token-node '_)) (hooks/token-node 'nil)
-                  (or d (hooks/token-node '_)) (hooks/token-node 'nil)])
-                body))]
-    {:node node*}))
-
-(defn with-five-bindings
-  "Helper for macros that have a shape like
-
-    (my-macro [a b c d e]
-      ...)
-
-    =>
-
-    (let [a nil, b nil, c nil, d nil, e nil]
-      ...)
-
-  All bindings are optional and `_` will be substituted if not supplied."
-  [{{[_ {[a b c d e] :children} & body] :children} :node}]
-  (let [node* (hooks/list-node
-               (list*
-                (hooks/token-node 'let)
-                (hooks/vector-node
-                 [(or a (hooks/token-node '_)) (hooks/token-node 'nil)
-                  (or b (hooks/token-node '_)) (hooks/token-node 'nil)
-                  (or c (hooks/token-node '_)) (hooks/token-node 'nil)
-                  (or d (hooks/token-node '_)) (hooks/token-node 'nil)
-                  (or e (hooks/token-node '_)) (hooks/token-node 'nil)])
-                body))]
-    {:node node*}))
-
-(defn with-six-bindings
-  "Helper for macros that have a shape like
-
-    (my-macro [a b c d e f]
-      ...)
-
-    =>
-
-    (let [a nil, b nil, c nil, d nil, e nil, f nil]
-      ...)
-
-  All bindings are optional and `_` will be substituted if not supplied."
-  [{{[_ {[a b c d e f] :children} & body] :children} :node}]
-  (let [node* (hooks/list-node
-               (list*
-                (hooks/token-node 'let)
-                (hooks/vector-node
-                 [(or a (hooks/token-node '_)) (hooks/token-node 'nil)
-                  (or b (hooks/token-node '_)) (hooks/token-node 'nil)
-                  (or c (hooks/token-node '_)) (hooks/token-node 'nil)
-                  (or d (hooks/token-node '_)) (hooks/token-node 'nil)
-                  (or e (hooks/token-node '_)) (hooks/token-node 'nil)
-                  (or f (hooks/token-node '_)) (hooks/token-node 'nil)])
-                body))]
-    {:node node*}))
-
-(defn with-seven-bindings
-  "Helper for macros that have a shape like
-
-    (my-macro [a b c d e f g]
-      ...)
-
-    =>
-
-    (let [a nil, b nil, c nil, d nil, e nil, f nil, g nil]
-      ...)
-
-  All bindings are optional and `_` will be substituted if not supplied."
-  [{{[_ {[a b c d e f g] :children} & body] :children} :node}]
-  (let [node* (hooks/list-node
-               (list*
-                (hooks/token-node 'let)
-                (hooks/vector-node
-                 [(or a (hooks/token-node '_)) (hooks/token-node 'nil)
-                  (or b (hooks/token-node '_)) (hooks/token-node 'nil)
-                  (or c (hooks/token-node '_)) (hooks/token-node 'nil)
-                  (or d (hooks/token-node '_)) (hooks/token-node 'nil)
-                  (or e (hooks/token-node '_)) (hooks/token-node 'nil)
-                  (or f (hooks/token-node '_)) (hooks/token-node 'nil)
-                  (or g (hooks/token-node '_)) (hooks/token-node 'nil)])
-                body))]
-    {:node node*}))
-
-(defn with-one-top-level-binding
-  "Helper for macros that have a shape like
-
-    (my-macro x
-      ...)
-
-    =>
-
-    (let [x nil]
-      ...)"
-  [{{[_ x & body] :children} :node}]
-  (let [node* (hooks/list-node
-               (list*
-                (hooks/token-node 'let)
-                (hooks/vector-node
-                 [x (hooks/token-node 'nil)])
-                body))]
-    {:node node*}))
-
-(defn with-two-top-level-bindings
-  "Helper for macros that have a shape like
-
-    (my-macro x y
-      ...)
-
-    =>
-
-    (let [x nil, y nil]
-      ...)"
-  [{{[_ x y & body] :children} :node}]
-  (let [node* (hooks/list-node
-               (list*
-                (hooks/token-node 'let)
-                (hooks/vector-node
-                 [x (hooks/token-node 'nil)
-                  y (hooks/token-node 'nil)])
-                body))]
-    {:node node*}))
-
-(defn let-one-with-optional-value
-  "This is exactly like [[clojure.core/let]] but the right-hand side of the binding, `value`, is optional, and only one
-  binding can be established.
-
-    (some-macro [x] ...)
-    =>
-    (let [x nil] ...)
-
-    (some-macro [x 100] ...)
-    =>
-    (let [x 100] ...)"
-  [{{[_ {[binding value] :children} & body] :children} :node}]
-  (let [node* (hooks/list-node
-               (list*
-                (hooks/token-node 'let)
-                (hooks/vector-node
-                 [binding (or value (hooks/token-node 'nil))])
-                body))]
-    {:node node*}))
-
-(defn- let-second-inner [body bindings]
-  (let [binding-infos (for [[model {[binding value] :children}] (partition 2 bindings)]
-                        {:model   model
-                         :binding binding
-                         :value   (or value
-                                      (hooks/token-node 'nil))})]
-    (-> (hooks/vector-node
-         [(hooks/vector-node (map :model binding-infos))
-          (-> (hooks/list-node (list* (hooks/token-node `let)
-                                    (hooks/vector-node (mapcat (juxt :binding :value) binding-infos))
-                                    body))
-              (with-meta (meta body)))])
-        (with-meta (meta body)))))
-
-(defn let-second
-  "Helper for macros that have a shape like
-
-    (my-macro x [y]
-    ...)
-
-    where the let is for second arg.
-
-    =>
-
-    (let [y nil]
-    ...)"
-  [{:keys [node]}]
-  (let [[_ first-arg-ref binding+opts & body] (:children node)]
-    {:node (let-second-inner body [first-arg-ref binding+opts])}))
-
-(defn let-with-optional-value-for-last-binding
-  "This is exactly like [[clojure.core/let]] but the right-hand side of the *last* binding, `value`, is optional.
-
-    (some-macro [x] ...)
-    =>
-    (let [x nil] ...)
-
-    (some-macro [x 100] ...)
-    =>
-    (let [x 100] ...)"
-  [{{[_ {bindings :children} & body] :children} :node}]
-  (let [node* (hooks/list-node
-               (list*
-                (hooks/token-node 'let)
-                (hooks/vector-node
-                 (into []
-                       (comp (partition-all 2)
-                             (mapcat (fn [[binding value]]
-                                       [binding (or value (hooks/token-node 'nil))])))
-                       bindings))
-                body))]
-    {:node node*}))
-
-(defn with-ignored-first-arg
-  "For macros like
-
-    (discard-setting-changes [setting-1 setting-2]
-      ...)
-
-    =>
-
-    (do ...)
-
-  where the first arg ought to be ignored for linting purposes."
-  [{{[_ _x & body] :children} :node}]
-  (let [node* (hooks/list-node
-               (list*
-                (hooks/token-node 'do)
-                body))]
-    {:node node*}))
-
-(defn with-used-first-arg
-  "For macros like
-
-    (with-drivers (filter pred? some-drivers)
-      ...)
-
-    =>
-
-    (let [_1234 (filter pred? some-drivers)]
-      ...)
-
-  where the first arg should be linted and appear to be used."
-  [{{[_ arg & body] :children} :node}]
-  (let [node* (hooks/list-node
-                (list*
-                  (hooks/token-node 'let)
-                  (hooks/vector-node [(hooks/token-node (gensym "_"))
-                                      arg])
-                  body))]
-    {:node node*}))

.clj-kondo/hooks/metabase/api/common.clj

@@ -1,29 +0,0 @@
-(ns hooks.metabase.api.common
-  (:require
-   [clj-kondo.hooks-api :as hooks]
-   [clojure.string :as str]
-   [hooks.common :as common]))
-
-(defn route-fn-name
-  "route fn hook"
-  [method route]
-  (let [route (if (vector? route) (first route) route)]
-    (-> (str (name method) route)
-        (str/replace #"/" "_")
-        symbol)))
-
-(defn defendpoint
-  "defendpoint hook"
-  [{:keys [node]}]
-  (let [[method route & body] (rest (:children node))]
-    {:node
-     (hooks/vector-node [;; register usage of compojure core var
-                         (common/with-macro-meta (hooks/token-node (symbol (str "compojure.core")
-                                                                           (str method)))
-                           node)
-                         ;; define function with route-fn-name
-                         (hooks/list-node
-                           (list* (common/with-macro-meta (hooks/token-node 'clojure.core/defn)
-                                    node)
-                                  (route-fn-name (hooks/sexpr method) (hooks/sexpr route))
-                                  body))])}))

.clj-kondo/hooks/metabase/mbql/schemas/macros.clj

@@ -1,68 +0,0 @@
-(ns hooks.metabase.mbql.schemas.macros
-  (:require [clj-kondo.hooks-api :as hooks]))
-
-(defn- unwrap-defclause-clause-name
-  "The `clause-name-form` can be either a plain symbol, or a vector like `[var-name mbql-clause-name]`. For the vector
-  form, we are only interested in the `var-name`. For a plain symbol, the two names are the same. Return a token node."
-  [clause-name-form]
-  (-> (if (hooks/vector-node? clause-name-form)
-        (first (:children clause-name-form))
-        clause-name-form)
-      (with-meta (meta clause-name-form))))
-
-(defn- collect-defclause-body-schemas
-  "Collect the argument schemas in the body of a `defclause` form into a vector node.
-
-  The body is a sequence of <argument-name> <argument-schema> pairs. We can ignore the argument names.
-
-  <argument-schema> can optionally be wrapped be `(optional ...)` or `(rest ...)`... we can ignore these."
-  [arg-specs]
-  (hooks/vector-node
-   (for [[_arg-name arg-schema] (partition-all 2 arg-specs)
-         :let                   [arg-schema (if (and (hooks/list-node? arg-schema)
-                                                     ('#{optional rest} (hooks/sexpr (first (:children arg-schema)))))
-                                              (-> (second (:children arg-schema))
-                                                  (with-meta (meta arg-schema)))
-                                              arg-schema)]]
-     arg-schema)))
-
-(defn defclause
-  "e.g.
-
-    (defclause [ag:var var] field-or-expression FieldOrExpressionDef)
-    =>
-    (def ag:var [FieldOrExpressionDef])"
-  [{:keys [node]}]
-  (let [[_defclause clause-name-form & arg-specs] (:children node)]
-    {:node (-> (hooks/list-node
-                (list
-                 (hooks/token-node 'def)
-                 (unwrap-defclause-clause-name clause-name-form)
-                 (hooks/string-node "Docstring.")
-                 (collect-defclause-body-schemas arg-specs)))
-               (with-meta (meta node)))}))
-
-(comment
-  (defn- defclause* [form]
-    (hooks/sexpr
-     (:node
-      (defclause
-        {:node
-         (hooks/parse-string
-          (with-out-str
-            (clojure.pprint/pprint
-             form)))}))))
-
-  (defn- x []
-    (defclause* '(defclause [ag:var var]
-                   field-or-expression FieldOrExpressionDef)))
-  ;; =>
-  (def ag:var "Docstring." [FieldOrExpressionDef])
-
-  (defn- y []
-    (defclause* '(defclause var
-                   x (some-list-schema)
-                   y (optional FieldOrExpressionDef)
-                   z (rest (some-other-schema)))))
-  ;; =>
-  (def var "Docstring." [(some-list-schema) FieldOrExpressionDef (some-other-schema)]))

.clj-kondo/macros/metabase/api/common.clj

@@ -1,5 +1,7 @@
 (ns macros.metabase.api.common)
 
-(defmacro define-routes [& args]
+(defmacro define-routes
+  "Macro for api.common/define-routes"
+  [& args]
   `(do (def ~'routes "docstring" nil)
        ~@args))

.clj-kondo/macros/metabase/domain_entities/malli.clj

@@ -1,16 +0,0 @@
-(ns macros.metabase.domain-entities.malli)
-
-(defmacro define-getters-and-setters [schema & defs]
-  `(do
-     (comment ~schema) ;; Reference the schema
-     ~@(for [[sym _path] (partition 2 defs)]
-         `(do
-            (defn ~(vary-meta sym
-                              assoc :export true)
-              "docs" [_x#] nil)
-            (defn ~(vary-meta (symbol (str "with-" (name sym)))
-                              assoc :export true)
-              "docs" [x# _new#] x#)
-            (defn ~(vary-meta (symbol (str (name sym) "-js"))
-                              assoc :export true)
-              "docs" [x#] x#)))))

.clj-kondo/macros/metabase/models/query_field_test.clj

@@ -0,0 +1,9 @@
+(ns macros.metabase.models.query-field-test
+  (:require [macros.common]))
+
+(defmacro with-test-setup [& body]
+  `(let [~(macros.common/ignore-unused 'card-id)  1
+         ~(macros.common/ignore-unused 'table-id) 2
+         ~(macros.common/ignore-unused 'tax-id)   3
+         ~(macros.common/ignore-unused 'total-id) 4]
+     ~@body))

.clj-kondo/macros/metabase/task/setup/query_analysis_setup.clj

@@ -0,0 +1,12 @@
+(ns macros.metabase.task.setup.query-analysis-setup
+  (:require [macros.common]))
+
+(defmacro with-test-setup!
+  "Set up the data required to test the Query Analysis related tasks"
+  [& body]
+  `(let [~(macros.common/ignore-unused 'c1) 1
+         ~(macros.common/ignore-unused 'c2) 2
+         ~(macros.common/ignore-unused 'c3) 3
+         ~(macros.common/ignore-unused 'c4) 4
+         ~(macros.common/ignore-unused 'arch) 5]
+     ~@body))

.clj-kondo/macros/metabase/xrays/domain_entities/malli.clj

@@ -0,0 +1,16 @@
+(ns macros.metabase.xrays.domain-entities.malli)
+
+(defmacro define-getters-and-setters [schema & defs]
+  `(do
+     (comment ~schema) ;; Reference the schema
+     ~@(for [[sym _path] (partition 2 defs)]
+         `(do
+            (defn ~(vary-meta sym
+                              assoc :export true)
+              "docs" [_x#] nil)
+            (defn ~(vary-meta (symbol (str "with-" (name sym)))
+                              assoc :export true)
+              "docs" [x# _new#] x#)
+            (defn ~(vary-meta (symbol (str (name sym) "-js"))
+                              assoc :export true)
+              "docs" [x#] x#)))))

.clj-kondo/macros/metabase_enterprise/advanced_permissions/api/util_test.clj

@@ -0,0 +1,6 @@
+(ns macros.metabase-enterprise.advanced-permissions.api.util-test
+  (:require [macros.common]))
+
+(defmacro with-impersonations! [impersonations-and-attributes-map & body]
+  `(let [~(macros.common/ignore-unused '&group) ~impersonations-and-attributes-map]
+     ~@body))

.clj-kondo/macros/metabase_enterprise/query_reference_validation/api_test.clj

@@ -0,0 +1,11 @@
+(ns macros.metabase-enterprise.query-reference-validation.api-test
+  (:require [macros.common]))
+
+(defmacro with-test-setup [& body]
+  `(let [~(macros.common/ignore-unused 'card-1) 1
+         ~(macros.common/ignore-unused 'card-2) 2
+         ~(macros.common/ignore-unused 'card-3) 3
+         ~(macros.common/ignore-unused 'card-4) 4
+         ~(macros.common/ignore-unused 'coll-2) 100
+         ~(macros.common/ignore-unused 'coll-3) 200]
+     ~@body))

.clj-kondo/macros/metabase_enterprise/sandbox/test_util.clj

@@ -1,6 +1,6 @@
 (ns macros.metabase-enterprise.sandbox.test-util
   (:require [macros.common]))
 
-(defmacro with-gtaps [gtaps-definition & body]
+(defmacro with-gtaps! [gtaps-definition & body]
   `(let [~(macros.common/ignore-unused '&group) ~gtaps-definition]
      ~@body))

.clj-kondo/src/hooks/clojure/core.clj

@@ -0,0 +1,329 @@
+(ns hooks.clojure.core
+  (:require
+   [clj-kondo.hooks-api :as hooks]
+   [clojure.set :as set]
+   [clojure.string :as str]))
+
+(defn- node->qualified-symbol [node]
+  (try
+   (when (hooks/token-node? node)
+     (let [sexpr (hooks/sexpr node)]
+       (when (symbol? sexpr)
+         (let [resolved (hooks/resolve {:name sexpr})]
+           (when-not (= :clj-kondo/unknown-namespace (:ns resolved))
+             (symbol (name (:ns resolved)) (name (:name resolved))))))))
+   ;; some symbols like `*count/Integer` aren't resolvable.
+   (catch Exception _
+     nil)))
+
+(def ^:private symbols-allowed-in-fns-not-ending-in-an-exclamation-point
+  '#{;; these toucan methods might actually set global values if it's used outside of a transaction,
+     ;; but since mt/with-temp runs in a transaction, so we'll ignore them in this case.
+     toucan2.core/delete!
+     toucan2.core/update!
+     toucan2.core/insert!
+     toucan2.core/insert-returning-instance!
+     toucan2.core/insert-returning-instances!
+     toucan2.core/insert-returning-pk!
+     toucan2.core/insert-returning-pks!
+     clojure.core.async/<!!
+     clojure.core.async/>!!
+     clojure.core.async/alts!!
+     clojure.core.async/close!
+     clojure.core.async/poll!
+     clojure.core.memoize/memo-clear!
+     clojure.core/conj!
+     clojure.core/persistent!
+     clojure.core/reset!
+     clojure.core/swap!
+     clojure.core/volatile!
+     clojure.core/vreset!
+     clojure.core/vswap!
+     clojure.java.jdbc/execute!
+     methodical.core/add-aux-method-with-unique-key!
+     methodical.core/remove-aux-method-with-unique-key!
+     next.jdbc/execute!
+
+     ;; Definitely thread safe
+     metabase.test.util.dynamic-redefs/patch-vars!
+
+     ;; TODO: most of these symbols shouldn't be here, we should go through them and
+     ;; find the functions/macros that use them and make sure their names end with !
+     ;; best way to do this is try remove each of these and rely on kondo output to find places where it's used
+     clojure.test/grant-collection-perms!
+     clojure.test/grant-collection-perms-fn!
+     clojure.test/grant-perms-fn!
+     clojure.test/purge-old-entries!
+     clojure.test/revoke-collection-perms!
+     clojure.test/save-results!
+     metabase-enterprise.advanced-permissions.models.permissions/update-db-download-permissions!
+     metabase-enterprise.internal-user/install-internal-user!
+     metabase-enterprise.sso.integrations.saml-test/call-with-login-attributes-cleared!
+     metabase.actions/perform-action!
+     metabase.analytics.snowplow-test/fake-track-event-impl!
+     metabase.analytics.snowplow/track-event-impl!
+     metabase.api.public-test/add-card-to-dashboard!
+     metabase.cmd.dump-to-h2/dump-to-h2!
+     metabase.cmd.load-from-h2/load-from-h2!
+     metabase.core/ensure-audit-db-installed!
+     metabase.db.schema-migrations-test.impl/run-migrations-in-range!
+     metabase.db.setup/migrate!
+     metabase.db.setup/setup-db!
+     metabase.db/migrate!
+     metabase.db/setup-db!
+     metabase.driver.mongo-test/create-database-from-row-maps!
+     metabase.driver.postgres-test/create-enums-db!
+     metabase.driver.postgres-test/drop-if-exists-and-create-db!
+     metabase.driver.sql-jdbc.execute/execute-statement!
+     metabase.email-test/reset-inbox!
+     metabase.email/send-email!
+     metabase.models.action/insert!
+     metabase.models.collection.graph-test/clear-graph-revisions!
+     metabase.models.collection.graph-test/do-with-n-temp-users-with-personal-collections!
+     metabase.models.field-values/create-or-update-full-field-values!
+     metabase.models.model-index/add-values!
+     metabase.models.moderation-review/create-review!
+     metabase.models.on-demand-test/add-dashcard-with-parameter-mapping!
+     metabase.models.permissions/grant-application-permissions!
+     metabase.models.permissions/grant-collection-read-permissions!
+     metabase.models.permissions/grant-collection-readwrite-permissions!
+     metabase.models.permissions/grant-full-data-permissions!
+     metabase.models.permissions/grant-native-readwrite-permissions!
+     metabase.models.permissions/grant-permissions!
+     metabase.models.permissions/revoke-application-permissions!
+     metabase.models.permissions/revoke-data-perms!
+     metabase.models.permissions/update-data-perms-graph!
+     metabase.models.permissions/update-group-permissions!
+     metabase.models.persisted-info/ready-database!
+     metabase.models.revision/revert!
+     metabase.models.setting-test/test-user-local-allowed-setting!
+     metabase.models.setting-test/test-user-local-only-setting!
+     metabase.models.setting.cache/restore-cache!
+     metabase.models.setting/set!
+     metabase.models.setting/validate-settings-formatting!
+     metabase.permissions.test-util/with-restored-perms!
+     metabase.pulse/send-notifications!
+     metabase.pulse/send-pulse!
+     metabase.query-processor.streaming.interface/begin!
+     metabase.query-processor.streaming.interface/finish!
+     metabase.query-processor.streaming.interface/write-row!
+     metabase.sample-data/try-to-extract-sample-database!
+     metabase.setup/create-token!
+     metabase.sync.sync-metadata.fields.sync-metadata/update-field-metadata-if-needed!
+     metabase.sync.sync-metadata/sync-db-metadata!
+     metabase.sync.util-test/sync-database!
+     metabase.sync.util/store-sync-summary!
+     metabase.sync/sync-database!
+     metabase.task.index-values/job-init!
+     metabase.task.persist-refresh/job-init!
+     metabase.task.persist-refresh/refresh-tables!
+     metabase.task.persist-refresh/schedule-persistence-for-database!
+     metabase.task/delete-task!
+     metabase.test.data.bigquery-cloud-sdk/execute!
+     metabase.test.data.impl/copy-db-tables-and-fields!
+     metabase.test.data.impl/get-or-create-database!
+     metabase.test.data.impl/get-or-create-default-dataset!
+     metabase.test.data.impl.get-or-create/set-test-db-permissions!
+     metabase.test.data.interface/create-db!
+     metabase.test.data.interface/destroy-db!
+     metabase.test.data.oracle/create-user!
+     metabase.test.data.oracle/drop-user!
+     metabase.test.data.sql-jdbc.load-data/make-insert!
+     metabase.test.data.users/clear-cached-session-tokens!
+     metabase.test.initialize/do-initialization!
+     metabase.test.initialize/initialize-if-needed!
+     metabase.test.integrations.ldap/start-ldap-server!
+     metabase.test.util.log/ensure-unique-logger!
+     metabase.test.util.log/set-ns-log-level!
+     metabase.test.util/do-with-temp-env-var-value!
+     metabase.test.util/restore-raw-setting!
+     metabase.test.util/upsert-raw-setting!
+     metabase.test/initialize-if-needed!
+     metabase.test/test-helpers-set-global-values!
+     metabase.test/with-temp-env-var-value!
+     metabase.upload-test/set-local-infile!
+     metabase.util.files/create-dir-if-not-exists!
+     metabase.util.ssh-test/start-mock-servers!
+     metabase.util.ssh-test/stop-mock-servers!})
+
+(defn- end-with-exclamation?
+  [s]
+  (str/ends-with? s "!"))
+
+(defn- non-thread-safe-form-should-end-with-exclamation*
+  [{[defn-or-defmacro form-name] :children, :as node}]
+  (when-not (and (:string-value form-name)
+                 (end-with-exclamation? (:string-value form-name)))
+    (letfn [(walk [f form]
+              (f form)
+              (doseq [child (:children form)]
+                (walk f child)))]
+      (walk (fn [form]
+              (when-let [qualified-symbol (node->qualified-symbol form)]
+                (when (and (not (contains? symbols-allowed-in-fns-not-ending-in-an-exclamation-point qualified-symbol))
+                           (end-with-exclamation? qualified-symbol))
+                  (hooks/reg-finding! (assoc (meta form-name)
+                                             :message (format "The name of this %s should end with `!` because it contains calls to non thread safe form `%s`."
+                                                              (:string-value defn-or-defmacro) qualified-symbol)
+                                             :type :metabase/test-helpers-use-non-thread-safe-functions)))))
+            node))
+    node))
+
+(defn non-thread-safe-form-should-end-with-exclamation
+  "Used to ensure defn and defmacro in test namespace to have name ending with `!` if it's non-thread-safe.
+  A function or a macro can be defined as 'not thread safe' when their funciton name ends with a `!`.
+
+  Only used in tests to identify thread-safe/non-thread-safe test helpers. See #37126"
+  [{:keys [node cljc lang]}]
+  (when (or (not cljc)
+            (= lang :clj))
+    (non-thread-safe-form-should-end-with-exclamation* node))
+  {:node node})
+
+(comment
+ (require '[clj-kondo.core :as clj-kondo])
+ (def form (str '(defmacro a
+                   [x]
+                   `(fun-call x))))
+
+ (def form "(defmacro a
+           [x]
+           `(some! ~x))")
+
+ (def form "(defun f
+           [x]
+           (let [g! (fn [] 1)]
+           (g!)))")
+
+ (str (hooks/parse-string form))
+ (hooks/sexpr (hooks/parse-string form))
+
+ (binding [hooks/*reload* true]
+   (-> form
+       (with-in-str (clj-kondo/run! {:lint ["-"]}))
+       :findings))
+
+ (do (non-thread-safe-form-should-end-with-exclamation* (hooks/parse-string form)) nil))
+
+(defn- ns-form-node->require-node [ns-form-node]
+  (some (fn [node]
+          (when (and (hooks/list-node? node)
+                     (let [first-child (first (:children node))]
+                       (and (hooks/keyword-node? first-child)
+                            (= (hooks/sexpr first-child) :require))))
+            node))
+        (:children ns-form-node)))
+
+(defn- lint-require-shapes [ns-form-node]
+  (doseq [node (-> ns-form-node
+                   ns-form-node->require-node
+                   :children
+                   rest)]
+    (cond
+      (not (hooks/vector-node? node))
+      (hooks/reg-finding! (assoc (meta node)
+                                 :message "All :required namespaces should be wrapped in vectors [:metabase/require-shape-checker]"
+                                 :type    :metabase/require-shape-checker))
+
+      (hooks/vector-node? (second (:children node)))
+      (hooks/reg-finding! (assoc (meta node)
+                                 :message "Don't use prefix forms inside :require [:metabase/require-shape-checker]"
+                                 :type    :metabase/require-shape-checker)))))
+
+(defn- require-node->namespace-symb-nodes [require-node]
+  (let [[_ns & args] (:children require-node)]
+    (into []
+          ;; prefixed namespace forms are NOT SUPPORTED!!!!!!!!1
+          (keep (fn [node]
+                  (cond
+                    (hooks/vector-node? node)
+                    ;; propagate the metadata attached to this vector in case there's a `:clj-kondo/ignore` form.
+                    (vary-meta (first (:children node)) (partial merge (meta require-node) (meta node)))
+
+                    ;; this should also be dead code since we require requires to be vectors
+                    (hooks/token-node? node)
+                    (vary-meta node (partial merge (meta require-node)))
+
+                    :else
+                    (printf "Don't know how to figure out what namespace is being required in %s\n" (pr-str node)))))
+          args)))
+
+(defn- ns-form-node->ns-symb [ns-form-node]
+  (some-> (some (fn [node]
+                  (when (and (hooks/token-node? node)
+                             (not= (hooks/sexpr node) 'ns))
+                    node))
+                (:children ns-form-node))
+          hooks/sexpr))
+
+(defn- module
+  "E.g.
+
+    (module 'metabase.qp.middleware.wow) => 'metabase.qp"
+  [ns-symb]
+  (some-> (re-find #"^metabase\.[^.]+" (str ns-symb)) symbol))
+
+(defn- ignored-namespace? [ns-symb config]
+  (some
+   (fn [pattern-str]
+     (re-find (re-pattern pattern-str) (str ns-symb)))
+   (:ignored-namespace-patterns config)))
+
+(defn- module-api-namespaces
+  "Set API namespaces for a given module. `:any` means you can use anything, there are no API namespaces for this
+  module (yet). If unspecified, the default is just the namespace with the same name as the module e.g.
+  `metabase.db`."
+  [module config]
+  (let [module-config (get-in config [:api-namespaces module])]
+    (cond
+      (= module-config :any)
+      nil
+
+      (set? module-config)
+      module-config
+
+      :else
+      #{module})))
+
+(defn- lint-modules [ns-form-node config]
+  (let [ns-symb (ns-form-node->ns-symb ns-form-node)]
+    (when-not (ignored-namespace? ns-symb config)
+      (when-let [current-module (module ns-symb)]
+        (let [allowed-modules               (get-in config [:allowed-modules current-module])
+              required-namespace-symb-nodes (-> ns-form-node
+                                                ns-form-node->require-node
+                                                require-node->namespace-symb-nodes)]
+          (doseq [node  required-namespace-symb-nodes
+                  :let  [clj-kondo-ignore (some-> (meta node) :clj-kondo/ignore hooks/sexpr set)]
+                  :when (not (contains? clj-kondo-ignore :metabase/ns-module-checker))
+                  :let  [required-namespace (hooks/sexpr node)
+                         required-module    (module required-namespace)]
+                  ;; ignore stuff not in a module i.e. non-Metabase stuff.
+                  :when required-module
+                  :let  [in-current-module? (= required-module current-module)]
+                  :when (not in-current-module?)
+                  :let  [allowed-module?           (or (= allowed-modules :any)
+                                                       (contains? (set allowed-modules) required-module))
+                         module-api-namespaces     (module-api-namespaces required-module config)
+                         allowed-module-namespace? (or (empty? module-api-namespaces)
+                                                       (contains? module-api-namespaces required-namespace))]]
+            (when-let [error (cond
+                               (not allowed-module?)
+                               (format "Module %s should not be used in the %s module. [:metabase/ns-module-checker :allowed-modules %s]"
+                                       required-module
+                                       current-module
+                                       current-module)
+
+                               (not allowed-module-namespace?)
+                               (format "Namespace %s is not an allowed external API namespace for the %s module. [:metabase/ns-module-checker :api-namespaces %s]"
+                                       required-namespace
+                                       required-module
+                                       required-module))]
+              (hooks/reg-finding! (assoc (meta node)
+                                         :message error
+                                         :type    :metabase/ns-module-checker)))))))))
+
+(defn lint-ns [x]
+  (lint-require-shapes (:node x))
+  (lint-modules (:node x) (get-in x [:config :linters :metabase/ns-module-checker]))
+  x)

.clj-kondo/src/hooks/clojure/test.clj

@@ -1,6 +1,8 @@
 (ns hooks.clojure.test
-  (:require [clj-kondo.hooks-api :as hooks]
-            [clojure.string :as str]))
+  (:require
+   [clj-kondo.hooks-api :as hooks]
+   [clojure.string :as str]
+   [hooks.common]))
 
 (def ^:private disallowed-parallel-forms
   "Things you should not be allowed to use inside parallel tests. Besides these, anything ending in `!` not whitelisted
@@ -8,11 +10,11 @@
   '#{clojure.core/alter-var-root
      clojure.core/with-redefs
      clojure.core/with-redefs-fn
-     metabase-enterprise.sandbox.test-util/with-gtaps
-     metabase-enterprise.sandbox.test-util/with-gtaps-for-user
+     metabase-enterprise.sandbox.test-util/with-gtaps!
+     metabase-enterprise.sandbox.test-util/with-gtaps-for-user!
      metabase-enterprise.sandbox.test-util/with-user-attributes
-     metabase-enterprise.test/with-gtaps
-     metabase-enterprise.test/with-gtaps-for-user
+     metabase-enterprise.test/with-gtaps!
+     metabase-enterprise.test/with-gtaps-for-user!
      metabase-enterprise.test/with-user-attributes
      metabase.actions.test-util/with-actions
      metabase.actions.test-util/with-actions-disabled
@@ -20,6 +22,7 @@
      metabase.actions.test-util/with-actions-test-data
      metabase.actions.test-util/with-actions-test-data-and-actions-enabled
      metabase.actions.test-util/with-actions-test-data-tables
+     metabase.analytics.snowplow-test/with-fake-snowplow-collector
      metabase.email-test/with-expected-messages
      metabase.email-test/with-fake-inbox
      metabase.test.data.users/with-group
@@ -28,9 +31,7 @@
      metabase.test.util.log/with-log-level
      metabase.test.util.log/with-log-messages-for-level
      metabase.test.util.misc/with-single-admin-user
-     metabase.test.util.timezone/with-system-timezone-id
      metabase.test.util/with-all-users-permission
-     metabase.test.util/with-column-remappings
      metabase.test.util/with-discarded-collections-perms-changes
      metabase.test.util/with-env-keys-renamed-by
      metabase.test.util/with-locale
@@ -48,7 +49,6 @@
      metabase.test/with-actions-test-data-and-actions-enabled
      metabase.test/with-actions-test-data-tables
      metabase.test/with-all-users-permission
-     metabase.test/with-column-remappings
      metabase.test/with-discarded-collections-perms-changes
      metabase.test/with-env-keys-renamed-by
      metabase.test/with-expected-messages
@@ -62,7 +62,6 @@
      metabase.test/with-non-admin-groups-no-root-collection-perms
      metabase.test/with-persistence-enabled
      metabase.test/with-single-admin-user
-     metabase.test/with-system-timezone-id
      metabase.test/with-temp-env-var-value
      metabase.test/with-temp-vals-in-db
      metabase.test/with-temporary-raw-setting-values
@@ -108,20 +107,9 @@
      clojure.core.async/to-chan!
      clojure.core.async/to-chan!!
      metabase.driver.sql-jdbc.execute/execute-prepared-statement!
-     metabase.query-processor/process-query-and-save-execution!
-     metabase.query-processor/process-query-and-save-with-max-results-constraints!
-     metabase.query-processor.store/store-database!})
-
-(defn- node->qualified-symbol [node]
-  (try
-    (when (hooks/token-node? node)
-      (let [sexpr (hooks/sexpr node)]
-        (when (symbol? sexpr)
-          (when-let [resolved (hooks/resolve {:name sexpr})]
-            (symbol (name (:ns resolved)) (name (:name resolved)))))))
-    ;; some symbols like `*count/Integer` aren't resolvable.
-    (catch Exception _
-      nil)))
+     metabase.pulse/send-pulse!
+     metabase.query-processor.store/store-database!
+     next.jdbc/execute!})
 
 (defn- warn-about-disallowed-parallel-forms [form]
   (letfn [(error! [form message]
@@ -129,7 +117,7 @@
                                        :message message
                                        :type :metabase/validate-deftest)))
           (f [form]
-            (when-let [qualified-symbol (node->qualified-symbol form)]
+            (when-let [qualified-symbol (hooks.common/node->qualified-symbol form)]
               (cond
                 (disallowed-parallel-forms qualified-symbol)
                 (error! form (format "%s is not allowed inside a ^:parallel test or test fixture" qualified-symbol))

.clj-kondo/src/hooks/common.clj

@@ -0,0 +1,409 @@
+(ns hooks.common
+  (:require
+   [clj-kondo.hooks-api :as hooks]
+   [clojure.pprint]))
+
+(defn with-macro-meta
+  "When introducing internal nodes (let, defn, etc) it is important to provide a meta of an existing token
+   as the current version of kondo will use the whole form by default."
+  [new-node hook-node]
+  (with-meta new-node (meta (first (:children hook-node)))))
+
+;;; This stuff is to help debug hooks. Trace a function and it will pretty-print the before & after sexprs.
+;;;
+;;;    (hooks.common/trace #'calculate-bird-scarcity)
+
+(defn- trace* [f]
+  {:pre [(fn? f)]}
+  (fn traced-fn [node]
+    (println \newline)
+    (clojure.pprint/pprint (hooks/sexpr (:node node)))
+    (let [node* (f node)]
+      (println '=>)
+      (clojure.pprint/pprint (hooks/sexpr (:node node*)))
+      node*)))
+
+;;; this doesn't seem to work with SCI. Use [[defn-traced]] instead.
+
+;; (defn trace [varr]
+;;   {:pre [(var? varr)]}
+;;   (when-not (::traced? (meta varr))
+;;     (alter-var-root varr trace*)
+;;     (alter-meta! varr assoc ::traced? true)
+;;     (println "Traced" varr)))
+
+(defmacro defn-traced
+  "Replace a hook [[defn]] with this to trace the before and after sexprs."
+  [fn-name & fn-tail]
+  `(do
+     (defn fn# ~@fn-tail)
+     (def ~fn-name (trace* fn#))))
+
+;;;; Common hook definitions
+
+(defn do*
+  "This is the same idea as [[clojure.core/do]] but doesn't cause Kondo to complain about redundant dos or unused values."
+  [{{[_ & args] :children, :as node} :node}]
+  (let [node* (-> (hooks/list-node
+                   (list*
+                    (with-meta (hooks/token-node 'do) {:clj-kondo/ignore [:redundant-do]})
+                    (for [arg args]
+                      (vary-meta arg update :clj-kondo/ignore #(conj (vec %) :unused-value)))))
+                  (with-meta (meta node)))]
+    {:node node*}))
+
+(defn with-one-binding
+  "Helper for macros that have a shape like
+
+    (my-macro [x]
+      ...)
+
+    =>
+
+    (let [x nil]
+      ...)
+
+  Binding is optional and `_` will be substituted if not supplied."
+  [{{[_ {[x] :children} & body] :children} :node}]
+  (let [node* (hooks/list-node
+               (list*
+                (hooks/token-node 'let)
+                (hooks/vector-node
+                 [(or x (hooks/token-node '_)) (hooks/token-node 'nil)])
+                body))]
+    {:node node*}))
+
+(defn with-two-bindings
+  "Helper for macros that have a shape like
+
+    (my-macro [x y]
+      ...)
+
+    =>
+
+    (let [x nil, y nil]
+      ...)
+
+  All bindings are optional and `_` will be substituted if not supplied."
+  [{{[_ {[x y] :children} & body] :children} :node}]
+  (let [node* (hooks/list-node
+               (list*
+                (hooks/token-node 'let)
+                (hooks/vector-node
+                 [(or x (hooks/token-node '_)) (hooks/token-node 'nil)
+                  (or y (hooks/token-node '_)) (hooks/token-node 'nil)])
+                body))]
+    {:node node*}))
+
+(defn with-three-bindings
+  "Helper for macros that have a shape like
+
+    (my-macro [x y z]
+      ...)
+
+    =>
+
+    (let [x nil, y nil, z nil]
+      ...)
+
+  All bindings are optional and `_` will be substituted if not supplied."
+  [{{[_ {[x y z] :children} & body] :children} :node}]
+  (let [node* (hooks/list-node
+               (list*
+                (hooks/token-node 'let)
+                (hooks/vector-node
+                 [(or x (hooks/token-node '_)) (hooks/token-node 'nil)
+                  (or y (hooks/token-node '_)) (hooks/token-node 'nil)
+                  (or z (hooks/token-node '_)) (hooks/token-node 'nil)])
+                body))]
+    {:node node*}))
+
+(defn with-four-bindings
+  "Helper for macros that have a shape like
+
+    (my-macro [a b c d]
+      ...)
+
+    =>
+
+    (let [a nil, b nil, c nil, d nil]
+      ...)
+
+  All bindings are optional and `_` will be substituted if not supplied."
+  [{{[_ {[a b c d] :children} & body] :children} :node}]
+  (let [node* (hooks/list-node
+               (list*
+                (hooks/token-node 'let)
+                (hooks/vector-node
+                 [(or a (hooks/token-node '_)) (hooks/token-node 'nil)
+                  (or b (hooks/token-node '_)) (hooks/token-node 'nil)
+                  (or c (hooks/token-node '_)) (hooks/token-node 'nil)
+                  (or d (hooks/token-node '_)) (hooks/token-node 'nil)])
+                body))]
+    {:node node*}))
+
+(defn with-five-bindings
+  "Helper for macros that have a shape like
+
+    (my-macro [a b c d e]
+      ...)
+
+    =>
+
+    (let [a nil, b nil, c nil, d nil, e nil]
+      ...)
+
+  All bindings are optional and `_` will be substituted if not supplied."
+  [{{[_ {[a b c d e] :children} & body] :children} :node}]
+  (let [node* (hooks/list-node
+               (list*
+                (hooks/token-node 'let)
+                (hooks/vector-node
+                 [(or a (hooks/token-node '_)) (hooks/token-node 'nil)
+                  (or b (hooks/token-node '_)) (hooks/token-node 'nil)
+                  (or c (hooks/token-node '_)) (hooks/token-node 'nil)
+                  (or d (hooks/token-node '_)) (hooks/token-node 'nil)
+                  (or e (hooks/token-node '_)) (hooks/token-node 'nil)])
+                body))]
+    {:node node*}))
+
+(defn with-six-bindings
+  "Helper for macros that have a shape like
+
+    (my-macro [a b c d e f]
+      ...)
+
+    =>
+
+    (let [a nil, b nil, c nil, d nil, e nil, f nil]
+      ...)
+
+  All bindings are optional and `_` will be substituted if not supplied."
+  [{{[_ {[a b c d e f] :children} & body] :children} :node}]
+  (let [node* (hooks/list-node
+               (list*
+                (hooks/token-node 'let)
+                (hooks/vector-node
+                 [(or a (hooks/token-node '_)) (hooks/token-node 'nil)
+                  (or b (hooks/token-node '_)) (hooks/token-node 'nil)
+                  (or c (hooks/token-node '_)) (hooks/token-node 'nil)
+                  (or d (hooks/token-node '_)) (hooks/token-node 'nil)
+                  (or e (hooks/token-node '_)) (hooks/token-node 'nil)
+                  (or f (hooks/token-node '_)) (hooks/token-node 'nil)])
+                body))]
+    {:node node*}))
+
+(defn with-seven-bindings
+  "Helper for macros that have a shape like
+
+    (my-macro [a b c d e f g]
+      ...)
+
+    =>
+
+    (let [a nil, b nil, c nil, d nil, e nil, f nil, g nil]
+      ...)
+
+  All bindings are optional and `_` will be substituted if not supplied."
+  [{{[_ {[a b c d e f g] :children} & body] :children} :node}]
+  (let [node* (hooks/list-node
+               (list*
+                (hooks/token-node 'let)
+                (hooks/vector-node
+                 [(or a (hooks/token-node '_)) (hooks/token-node 'nil)
+                  (or b (hooks/token-node '_)) (hooks/token-node 'nil)
+                  (or c (hooks/token-node '_)) (hooks/token-node 'nil)
+                  (or d (hooks/token-node '_)) (hooks/token-node 'nil)
+                  (or e (hooks/token-node '_)) (hooks/token-node 'nil)
+                  (or f (hooks/token-node '_)) (hooks/token-node 'nil)
+                  (or g (hooks/token-node '_)) (hooks/token-node 'nil)])
+                body))]
+    {:node node*}))
+
+(defn with-one-top-level-binding
+  "Helper for macros that have a shape like
+
+    (my-macro x
+      ...)
+
+    =>
+
+    (let [x nil]
+      ...)"
+  [{{[_ x & body] :children} :node}]
+  (let [node* (hooks/list-node
+               (list*
+                (hooks/token-node 'let)
+                (hooks/vector-node
+                 [x (hooks/token-node 'nil)])
+                body))]
+    {:node node*}))
+
+(defn with-two-top-level-bindings
+  "Helper for macros that have a shape like
+
+    (my-macro x y
+      ...)
+
+    =>
+
+    (let [x nil, y nil]
+      ...)"
+  [{{[_ x y & body] :children} :node}]
+  (let [node* (hooks/list-node
+               (list*
+                (hooks/token-node 'let)
+                (hooks/vector-node
+                 [x (hooks/token-node 'nil)
+                  y (hooks/token-node 'nil)])
+                body))]
+    {:node node*}))
+
+(defn let-one-with-optional-value
+  "This is exactly like [[clojure.core/let]] but the right-hand side of the binding, `value`, is optional, and only one
+  binding can be established.
+
+    (some-macro [x] ...)
+    =>
+    (let [x nil] ...)
+
+    (some-macro [x 100] ...)
+    =>
+    (let [x 100] ...)"
+  [{{[_ {[binding value] :children} & body] :children} :node}]
+  (let [node* (hooks/list-node
+               (list*
+                (hooks/token-node 'let)
+                (hooks/vector-node
+                 [binding (or value (hooks/token-node 'nil))])
+                body))]
+    {:node node*}))
+
+(defn- let-second-inner [body bindings]
+  (let [binding-infos (for [[model {[binding value] :children}] (partition 2 bindings)]
+                        {:model   model
+                         :binding binding
+                         :value   (or value
+                                      (hooks/token-node 'nil))})]
+    (-> (hooks/vector-node
+         [(hooks/vector-node (map :model binding-infos))
+          (-> (hooks/list-node (list* (hooks/token-node `let)
+                                    (hooks/vector-node (mapcat (juxt :binding :value) binding-infos))
+                                    body))
+              (with-meta (meta body)))])
+        (with-meta (meta body)))))
+
+(defn let-second
+  "Helper for macros that have a shape like
+
+    (my-macro x [y]
+    ...)
+
+    where the let is for second arg.
+
+    =>
+
+    (let [y nil]
+    ...)"
+  [{:keys [node]}]
+  (let [[_ first-arg-ref binding+opts & body] (:children node)]
+    {:node (let-second-inner body [first-arg-ref binding+opts])}))
+
+(defn let-with-optional-value-for-last-binding
+  "This is exactly like [[clojure.core/let]] but the right-hand side of the *last* binding, `value`, is optional.
+
+    (some-macro [x] ...)
+    =>
+    (let [x nil] ...)
+
+    (some-macro [x 100] ...)
+    =>
+    (let [x 100] ...)"
+  [{{[_ {bindings :children} & body] :children} :node}]
+  (let [node* (hooks/list-node
+               (list*
+                (hooks/token-node 'let)
+                (hooks/vector-node
+                 (into []
+                       (comp (partition-all 2)
+                             (mapcat (fn [[binding value]]
+                                       [binding (or value (hooks/token-node 'nil))])))
+                       bindings))
+                body))]
+    {:node node*}))
+
+(defn with-ignored-first-arg
+  "For macros like
+
+    (discard-setting-changes [setting-1 setting-2]
+      ...)
+
+    =>
+
+    (do ...)
+
+  where the first arg ought to be ignored for linting purposes."
+  [{{[_ _x & body] :children} :node}]
+  (let [node* (hooks/list-node
+               (list*
+                (hooks/token-node 'do)
+                body))]
+    {:node node*}))
+
+(defn with-used-first-arg
+  "For macros like
+
+    (with-drivers (filter pred? some-drivers)
+      ...)
+
+    =>
+
+    (let [_1234 (filter pred? some-drivers)]
+      ...)
+
+  where the first arg should be linted and appear to be used."
+  [{{[_ arg & body] :children} :node}]
+  (let [node* (hooks/list-node
+                (list*
+                  (hooks/token-node 'let)
+                  (hooks/vector-node [(hooks/token-node (gensym "_"))
+                                      arg])
+                  body))]
+    {:node node*}))
+
+(defn node->qualified-symbol [node]
+  (try
+    (when (hooks/token-node? node)
+      (let [sexpr (hooks/sexpr node)]
+        (when (symbol? sexpr)
+          (let [resolved (hooks/resolve {:name sexpr})]
+            (cond
+              (and resolved (:ns resolved))
+              (symbol (name (:ns resolved)) (name (:name resolved)))
+
+              ;; if it wasn't resolved but is still qualified it's probably using the full namespace name rather than an
+              ;; alias.
+              (qualified-symbol? sexpr)
+              sexpr)))))
+    ;; some symbols like `*count/Integer` aren't resolvable.
+    (catch Exception _
+      nil)))
+
+(defn format-string-specifier-count
+  "Number of things like `%s` in a format string, not counting newlines (`%n`) or escaped percent signs (`%%`). For
+  checking the number of args to something that takes a format string."
+  [format-string]
+  (count (re-seq #"(?<!%)%(?![%n])" format-string)))
+
+(comment
+  ;; should be 1
+  (format-string-specifier-count "%s %%")
+
+  ;; should be 2
+  (format-string-specifier-count "%s %%%n%s")
+
+  ;; should be 0
+  (format-string-specifier-count "%n%%%%")
+
+  ;; should be 1
+  (format-string-specifier-count "%-02d"))

.clj-kondo/src/hooks/metabase/api/common.clj

@@ -0,0 +1,45 @@
+(ns hooks.metabase.api.common
+  (:require
+   [clj-kondo.hooks-api :as api]
+   [clojure.string :as str]))
+
+(defn route-fn-name
+  "route fn hook"
+  [method route]
+  (let [route (if (vector? route) (first route) route)]
+    (-> (str (name method) route)
+        (str/replace #"/" "_")
+        symbol)))
+
+(defn defendpoint
+  [arg]
+  (letfn [(update-defendpoint [node]
+            (let [[_defendpoint method route & body] (:children node)]
+              (api/list-node
+               (list
+                (api/token-node 'do)
+                (api/token-node (symbol "compojure.core" (str (api/sexpr method))))
+                (-> (api/list-node
+                     (list*
+                      (api/token-node 'clojure.core/defn)
+                      (api/token-node (route-fn-name (api/sexpr method) (api/sexpr route)))
+                      body))
+                    (with-meta (meta node)))))))]
+    (update arg :node update-defendpoint)))
+
+(comment
+  (-> {:node (-> '(api/defendpoint POST "/:id/copy"
+                    "Copy a `Card`, with the new name 'Copy of _name_'"
+                    [id]
+                    {id [:maybe ms/PositiveInt]}
+                    (let [orig-card (api/read-check Card id)
+                          new-name  (str (trs "Copy of ") (:name orig-card))
+                          new-card  (assoc orig-card :name new-name)]
+                      (-> (card/create-card! new-card @api/*current-user*)
+                          hydrate-card-details
+                          (assoc :last-edit-info (last-edit/edit-information-for-user @api/*current-user*)))))
+                 pr-str
+                 api/parse-string)}
+      defendpoint
+      :node
+      api/sexpr))

.clj-kondo/src/hooks/metabase/driver.clj

@@ -0,0 +1,18 @@
+(ns hooks.metabase.driver
+  (:require
+   [clj-kondo.hooks-api :as api]))
+
+(defn register!
+  "Register the driver keyword so LSP can jump to it."
+  [x]
+  (letfn [(update-driver-keyword [k]
+            (api/reg-keyword! k 'metabase.driver/register!))
+          (update-children [[_register! k :as children]]
+            (if (api/keyword-node? k)
+              (update (vec children) 1 update-driver-keyword)
+              children))
+          (update-node [node]
+            (if (api/list-node? node)
+              (update node :children update-children)
+              node))]
+    (update x :node update-node)))

.clj-kondo/src/hooks/metabase/legacy_mbql/schemas/macros.clj

@@ -0,0 +1,69 @@
+(ns hooks.metabase.legacy-mbql.schemas.macros
+  (:require
+   [clj-kondo.hooks-api :as hooks]))
+
+(defn- unwrap-defclause-clause-name
+  "The `clause-name-form` can be either a plain symbol, or a vector like `[var-name mbql-clause-name]`. For the vector
+  form, we are only interested in the `var-name`. For a plain symbol, the two names are the same. Return a token node."
+  [clause-name-form]
+  (-> (if (hooks/vector-node? clause-name-form)
+        (first (:children clause-name-form))
+        clause-name-form)
+      (with-meta (meta clause-name-form))))
+
+(defn- collect-defclause-body-schemas
+  "Collect the argument schemas in the body of a `defclause` form into a vector node.
+
+  The body is a sequence of <argument-name> <argument-schema> pairs. We can ignore the argument names.
+
+  <argument-schema> can optionally be wrapped be `(optional ...)` or `(rest ...)`... we can ignore these."
+  [arg-specs]
+  (hooks/vector-node
+   (for [[_arg-name arg-schema] (partition-all 2 arg-specs)
+         :let                   [arg-schema (if (and (hooks/list-node? arg-schema)
+                                                     ('#{optional rest} (hooks/sexpr (first (:children arg-schema)))))
+                                              (-> (second (:children arg-schema))
+                                                  (with-meta (meta arg-schema)))
+                                              arg-schema)]]
+     arg-schema)))
+
+(defn defclause
+  "e.g.
+
+    (defclause [ag:var var] field-or-expression FieldOrExpressionDef)
+    =>
+    (def ag:var [FieldOrExpressionDef])"
+  [{:keys [node]}]
+  (let [[_defclause clause-name-form & arg-specs] (:children node)]
+    {:node (-> (hooks/list-node
+                (list
+                 (hooks/token-node 'def)
+                 (unwrap-defclause-clause-name clause-name-form)
+                 (hooks/string-node "Docstring.")
+                 (collect-defclause-body-schemas arg-specs)))
+               (with-meta (meta node)))}))
+
+(comment
+  (defn- defclause* [form]
+    (hooks/sexpr
+     (:node
+      (defclause
+        {:node
+         (hooks/parse-string
+          (with-out-str
+            (clojure.pprint/pprint
+             form)))}))))
+
+  (defn- x []
+    (defclause* '(defclause [ag:var var]
+                   field-or-expression FieldOrExpressionDef)))
+  ;; =>
+  (def ag:var "Docstring." [FieldOrExpressionDef])
+
+  (defn- y []
+    (defclause* '(defclause var
+                   x (some-list-schema)
+                   y (optional FieldOrExpressionDef)
+                   z (rest (some-other-schema)))))
+  ;; =>
+  (def var "Docstring." [(some-list-schema) FieldOrExpressionDef (some-other-schema)]))

.clj-kondo/src/hooks/metabase/lib/schema/mbql_clause.clj

@@ -0,0 +1,21 @@
+(ns hooks.metabase.lib.schema.mbql-clause
+  (:require
+   [clj-kondo.hooks-api :as api]))
+
+(defn define-mbql-clause
+  "Register the schema keyword so LSP can jump to it."
+  [x]
+  (letfn [(update-def-keyword [k]
+            (-> (api/keyword-node (keyword "mbql.clause" (name (api/sexpr k))))
+                (with-meta (meta k))
+                (api/reg-keyword! 'metabase.lib.schema.mbql-clause/define-mbql-clause)))
+          (update-children [[_def k :as children]]
+            (if (api/keyword-node? k)
+              (update (vec children) 1 update-def-keyword)
+              children))
+          (update-node [node]
+            (if (api/list-node? node)
+              (-> (api/list-node (update-children (:children node)))
+                  (with-meta (meta node)))
+              node))]
+    (update x :node update-node)))

.clj-kondo/src/hooks/metabase/models/setting.clj

@@ -38,8 +38,6 @@
      engines
      enum-cardinality-threshold
      follow-up-email-sent
-     ga-code
-     ga-enabled
      google-auth-auto-create-accounts-domain
      google-auth-client-id
      google-auth-configured
@@ -65,6 +63,7 @@
      jwt-user-provisioning-enabled?
      jwt-shared-secret
      last-acknowledged-version
+     last-used-native-database-id
      ldap-attribute-email
      ldap-attribute-firstname
      ldap-attribute-lastname
@@ -91,6 +90,8 @@
      metabot-get-prompt-templates-url
      metabot-prompt-generator-token-limit
      multi-setting-read-only
+     notebook-native-preview-shown
+     notebook-native-preview-sidebar-width
      notification-link-base-url
      num-metabot-choices
      openai-api-key
@@ -161,7 +162,6 @@
      token-status
      toucan-name
      uncached-setting
-     uploads-table-prefix
      user-visibility
      version
      version-info

.clj-kondo/src/hooks/metabase/test/data.clj

@@ -139,7 +139,7 @@
     (when-not ((some-fn symbol? nil?) (hooks/sexpr table))
       (hooks/reg-finding! (assoc (meta table)
                                  :message "First arg to mbql-query should be either a table name symbol or nil."
-                                 :type ::mbql-query-first-arg)))
+                                 :type :metabase/mbql-query-first-arg)))
     (let [result (replace-$id-special-tokens query)
           ;; HACK I'm not sure WHY it works but I ran into https://github.com/clj-kondo/clj-kondo/issues/1773 when
           ;; trying to get this working -- for some magical reason wrapping the whole thing in a `do` form seems to fix

.clj-kondo/src/hooks/metabase/util.clj

@@ -0,0 +1,17 @@
+(ns hooks.metabase.util
+  (:require
+   [clj-kondo.hooks-api :as api]
+   [hooks.common]))
+
+(defn format-color [{:keys [node], :as x}]
+  (let [[_format-color _color format-string-node & args] (:children node)]
+    (when (api/string-node? format-string-node)
+      (let [expected-arg-count (hooks.common/format-string-specifier-count (api/sexpr format-string-node))
+            actual-arg-count   (count args)]
+        (when-not (= expected-arg-count actual-arg-count)
+          (api/reg-finding! (assoc (meta node)
+                                   :message (format "metabase.util/format-color format string expects %d arguments instead of %d."
+                                                    expected-arg-count
+                                                    actual-arg-count)
+                                   :type :format))))))
+  x)

.clj-kondo/src/hooks/metabase/util/log.clj

@@ -0,0 +1,126 @@
+(ns hooks.metabase.util.log
+  (:require
+   [clj-kondo.hooks-api :as api]
+   [clojure.string :as str]
+   [clojure.walk :as walk]
+   [hooks.common]))
+
+;;;; Checks for both log + logf
+
+(defn- disallow-i18n [node]
+  (walk/postwalk
+   (fn [x]
+     (when-let [qualified-symbol (hooks.common/node->qualified-symbol x)]
+       (when (and (= (namespace qualified-symbol) "metabase.util.i18n")
+                  (or (str/includes? (name qualified-symbol) "tru")
+                      (str/includes? (name qualified-symbol) "trs")))
+         (api/reg-finding! (assoc (meta x)
+                                  :message "do not i18n the logs!"
+                                  :type :metabase/validate-logging)))))
+   node))
+
+(defn- check-position-of-exception-arg
+  "Tell people to do (info e \"whatever\") instead of (info \"whatever\" e)."
+  [node]
+  (let [[f _first-arg & args] (:children node)]
+    (doseq [arg args]
+      (when (and (api/token-node? arg)
+                 (= (api/sexpr arg) 'e))
+        (api/reg-finding! (assoc (meta arg)
+                                 :message (format "pass exceptions as the first arg to %s" (api/sexpr f))
+                                 :type :metabase/validate-logging))))))
+
+(defn- common-checks [node]
+  (check-position-of-exception-arg node)
+  (disallow-i18n node))
+
+(defn- check-for-i18n-format-specifiers
+  "Make sure people aren't using things like {0} in their log messages."
+  [node string-node]
+  (when (re-find #"\{\d+\}" (api/sexpr string-node))
+    (api/reg-finding! (assoc (meta node)
+                             :message "this looks like an i18n format string. Don't use identifiers like {0} in logging."
+                             :type :metabase/validate-logging))))
+
+;;; log only
+
+(defn- check-not-format-string
+  "Make sure we're not using something like log/trace with a format string."
+  [{[f] :children, :as node} string-node]
+  (when (pos? (hooks.common/format-string-specifier-count (api/sexpr string-node)))
+    (api/reg-finding! (assoc (meta node)
+                             :message (format "%s used with a format string, use %s instead."
+                                              (api/sexpr f)
+                                              (str (api/sexpr f) "f"))
+                             :type :metabase/validate-logging))))
+
+(defn- format-node? [node]
+  (when (api/list-node? node)
+    (let [[x] (:children node)]
+      (and (api/token-node? x)
+           (or (= (hooks.common/node->qualified-symbol x) 'clojure.core/format)
+               (= (api/sexpr x) 'format))))))
+
+(defn- warn-against-log+format-instead-of-logf
+  "Tell people to use things like infof instead of info + format."
+  [{[f] :children, :as node} [x :as args]]
+  (when (and (= (count args) 1)
+             (api/list-node? x))
+    (when (format-node? x)
+      (api/reg-finding! (assoc (meta node)
+                               :message (format "Use %s instead of %s + format"
+                                                (str (api/sexpr f) "f")
+                                                (api/sexpr f))
+                               :type :metabase/validate-logging)))))
+
+(defn info
+  "Valid log, debug, etc."
+  [{:keys [node], :as x}]
+  (common-checks node)
+  (let [[_f & args]         (:children node)
+        [_e & [x :as args]] (if (and (api/token-node? (first args))
+                                     (or (api/string-node? (second args))
+                                         (format-node? (second args))))
+                              args
+                              (cons nil args))]
+    (when (api/string-node? x)
+      (check-for-i18n-format-specifiers node x)
+      (check-not-format-string node x))
+    (warn-against-log+format-instead-of-logf node args))
+  x)
+
+;;;; logf only
+
+(defn- check-format-string-arg-count
+  "Make sure the number of args passed to something like tracef match the number of format string specifiers."
+  [{[f] :children, :as node} format-string args]
+  (let [expected-arg-count (hooks.common/format-string-specifier-count (api/sexpr format-string))
+        actual-arg-count   (count args)]
+    (when (zero? expected-arg-count)
+      (api/reg-finding! (assoc (meta node)
+                               :message (format "Don't use %s with no format string arguments, use %s instead."
+                                                (api/sexpr f)
+                                                (str/replace (str (api/sexpr f)) #"f$" ""))
+                               :type :metabase/validate-logging)))
+    (when-not (= expected-arg-count actual-arg-count)
+      (api/reg-finding! (assoc (meta node)
+                               :message (format "log format string expects %d arguments instead of %d."
+                                                expected-arg-count
+                                                actual-arg-count)
+                               :type :metabase/validate-logging)))))
+
+
+
+(defn infof
+  "Valid logf, debugf, etc."
+  [{:keys [node], :as x}]
+  (common-checks node)
+  (let [[_f & args]               (:children node)
+        [_e format-string & args] (if (api/string-node? (first args))
+                                    (cons nil args)
+                                    args)]
+    ;; TODO -- maybe we can error if you did not pass a format string, e.g. (log/infof 1 2) is obviously incorrect.
+    (when (api/string-node? format-string)
+      (check-for-i18n-format-specifiers node format-string)
+      (check-format-string-arg-count node format-string args)))
+  x)

.clj-kondo/test/hooks/common_test.clj

@@ -0,0 +1,19 @@
+(ns ^:mb/once hooks.common-test
+  (:require
+   [clj-kondo.hooks-api :as api]
+   [clj-kondo.impl.utils]
+   [clojure.test :refer :all]
+   [hooks.common]))
+
+(deftest ^:parallel node->qualified-symbol-test
+  (binding [clj-kondo.impl.utils/*ctx* {:namespaces (atom nil)}]
+    (is (= 'metabase.util.i18n/tru
+           (hooks.common/node->qualified-symbol (api/parse-string "metabase.util.i18n/tru"))))))
+
+(deftest ^:parallel node->qualified-symbol-test-2
+  (binding [clj-kondo.impl.utils/*ctx* {:namespaces (atom {:clj {:clj '{hooks.common-test {:qualify-ns {i18n metabase.util.i18n}}}}})
+                                        :lang       :clj
+                                        :base-lang  :clj
+                                        :ns         {:name 'hooks.common-test}}]
+    (is (= 'metabase.util.i18n/tru
+           (hooks.common/node->qualified-symbol (api/parse-string "i18n/tru"))))))

.clj-kondo/test/hooks/metabase/util/log_test.clj

@@ -0,0 +1,77 @@
+(ns ^:mb/once hooks.metabase.util.log-test
+  (:require
+   [clj-kondo.hooks-api :as api]
+   [clj-kondo.impl.utils]
+   [clojure.string :as str]
+   [clojure.test :refer :all]
+   [hooks.metabase.util.log]))
+
+(defn- warnings
+  [form]
+  (let [f (if (str/ends-with? (name (first form)) "f")
+            hooks.metabase.util.log/infof
+            hooks.metabase.util.log/info)]
+    (binding [clj-kondo.impl.utils/*ctx* {:config     {:linters {:metabase/validate-logging {:level :warning}}}
+                                          :ignores    (atom nil)
+                                          :findings   (atom [])
+                                          :namespaces (atom {})}]
+      (f {:node (api/parse-string (pr-str form))})
+      (mapv :message @(:findings clj-kondo.impl.utils/*ctx*)))))
+
+(deftest ^:parallel warn-on-missing-format-args-test
+  (testing "should fail, missing a format arg"
+    (are [form] (= ["log format string expects 1 arguments instead of 0."]
+                   (warnings (quote form)))
+      (metabase.util.log/warnf "Migration lock was acquired after %d retries.")
+      (metabase.util.log/warnf e "Migration lock was acquired after %d retries."))))
+
+(deftest ^:parallel warn-on-too-many-format-args-test-1
+  (testing "should fail, too many format args"
+    (are [form] (= ["log format string expects 1 arguments instead of 2."]
+                   (warnings (quote form)))
+      (metabase.util.log/warnf "Migration lock was acquired after %d retries." 1 2)
+      (metabase.util.log/warnf e "Migration lock was acquired after %d retries." 1 2))))
+
+(deftest ^:parallel warn-on-too-many-format-args-test-2
+  (testing "should fail, too many format args"
+    (are [form] (= ["this looks like an i18n format string. Don't use identifiers like {0} in logging."
+                    "Don't use metabase.util.log/warnf with no format string arguments, use metabase.util.log/warn instead."
+                    "log format string expects 0 arguments instead of 1."]
+                   (warnings (quote form)))
+      (metabase.util.log/warnf "Migration lock was acquired after {0} retries." 1)
+      (metabase.util.log/warnf e "Migration lock was acquired after {0} retries." 1))))
+
+(deftest ^:parallel warn-on-format-args-without-logf-test
+  (testing "should fail, has format args but is warn rather than warnf"
+    (are [form] (= ["metabase.util.log/warn used with a format string, use metabase.util.log/warnf instead."]
+                   (warnings (quote form)))
+      (metabase.util.log/warn "Migration lock was acquired after %d retries." 1)
+      (metabase.util.log/warn e "Migration lock was acquired after %d retries." 1))))
+
+(deftest ^:parallel warn-on-format-without-logf-test
+  (testing "should fail, has format args but is warn rather than warnf"
+    (are [form] (= ["Use metabase.util.log/warnf instead of metabase.util.log/warn + format"]
+                   (warnings (quote form)))
+      (metabase.util.log/warn (format "Migration lock was acquired after %d retries." 1))
+      (metabase.util.log/warn e (format "Migration lock was acquired after %d retries." 1)))))
+
+(deftest ^:parallel warn-on-logf-with-no-format-args-test
+  (testing "should fail, has format args but is warn rather than warnf"
+    (are [form] (= ["Don't use metabase.util.log/warnf with no format string arguments, use metabase.util.log/warn instead."]
+                   (warnings (quote form)))
+      (metabase.util.log/warnf "Migration lock cleared.")
+      (metabase.util.log/warnf e "Migration lock cleared."))))
+
+(deftest ^:parallel warn-on-i18n-test-1
+  (testing "should fail -- should not use i18n/tru or i18n/trs"
+    (are [form] (= ["do not i18n the logs!"]
+                   (warnings (quote form)))
+      (metabase.util.log/warnf (metabase.util.i18n/tru "Migration lock was acquired after {0} retries." 1))
+      (metabase.util.log/warnf e (metabase.util.i18n/tru "Migration lock was acquired after {0} retries." 1)))))
+
+(deftest ^:parallel warn-on-i18n-test-2
+  (testing "should fail -- should not use i18n/tru or i18n/trs"
+    (are [form] (= ["do not i18n the logs!"]
+                   (warnings (quote form)))
+      (metabase.util.log/warn (metabase.util.i18n/trs "Migration lock was acquired after {0} retries." 1))
+      (metabase.util.log/warn e (metabase.util.i18n/trs "Migration lock was acquired after {0} retries." 1)))))

.cljfmt.edn

@@ -7,7 +7,7 @@
   defprotocol+                                                     [[:block 1] [:inner 1]]
   potemkin/defprotocol+                                            [[:block 1] [:inner 1]]
   let-404                                                          [[:block 1]]
-  metabase.mbql.util/match-one                                     [[:inner 0]]
+  metabase.legacy-mbql.util/match-one                              [[:inner 0]]
   merge-with                                                       [[:inner 0]]
   metabase.test/dataset                                            [[:inner 0]]
   metabase.test/formatted-rows                                     [[:inner 0]]

.dir-locals.el

@@ -35,6 +35,7 @@
   (eval . (put 'methodical/defmulti 'clojure-doc-string-elt 2))
   (eval . (put 'mi/define-simple-hydration-method 'clojure-doc-string-elt 3))
   (eval . (put 'mi/define-batched-hydration-method 'clojure-doc-string-elt 3))
+  (eval . (put 'mr/def 'clojure-doc-string-elt 2))
   (eval . (put 'mu/defn 'clojure-doc-string-elt 2))
   ;; Define custom indentation for functions inside metabase.
   ;; This list isn't complete; add more forms as we come across them.
@@ -45,25 +46,27 @@
   (eval . (put-clojure-indent 'c/step 1))
   (eval . (put-clojure-indent 'impl/test-migrations 2))
   (eval . (put-clojure-indent 'let-404 0))
+  (eval . (put-clojure-indent 'lib.schema.match/match 1))
+  (eval . (put-clojure-indent 'lib.schema.match/match-one 1))
+  (eval . (put-clojure-indent 'lib.schema.match/replace 1))
+  (eval . (put-clojure-indent 'lib.schema.match/replace-in 2))
+  (eval . (put-clojure-indent 'lib.util.match/replace 1))
   (eval . (put-clojure-indent 'macros/case 0))
   (eval . (put-clojure-indent 'match 1))
-  (eval . (put-clojure-indent 'mbql.match/match 1))
-  (eval . (put-clojure-indent 'mbql.match/match-one 1))
-  (eval . (put-clojure-indent 'mbql.match/replace 1))
-  (eval . (put-clojure-indent 'mbql.match/replace-in 2))
-  (eval . (put-clojure-indent 'mbql.u/replace 1))
   (eval . (put-clojure-indent 'mi/define-methods '(:form)))
   (eval . (put-clojure-indent 'mt/dataset 1))
   (eval . (put-clojure-indent 'mt/format-rows-by 1))
   (eval . (put-clojure-indent 'mt/query 1))
-  (eval . (put-clojure-indent 'mt/test-drivers 1))
   (eval . (put-clojure-indent 'mt/test-driver 1))
+  (eval . (put-clojure-indent 'mt/test-drivers 1))
+  (eval . (put-clojure-indent 'mt/with-anaphora 1))
   (eval . (put-clojure-indent 'prop/for-all 1))
   (eval . (put-clojure-indent 'qp.streaming/streaming-response 1))
+  (eval . (put-clojure-indent 'tc/quick-check 1))
+  (eval . (put-clojure-indent 'u/profile 1))
   (eval . (put-clojure-indent 'u/prog1 1))
   (eval . (put-clojure-indent 'u/select-keys-when 1))
   (eval . (put-clojure-indent 'with-meta '(:form)))
-  (eval . (put-clojure-indent 'tc/quick-check 1))
   ;; these ones have to be done with `define-clojure-indent' for now because of upstream bug
   ;; https://github.com/clojure-emacs/clojure-mode/issues/600 once that's resolved we should use `put-clojure-indent'
   ;; instead. Please don't add new entries unless they don't work with `put-clojure-indent'
@@ -83,6 +86,7 @@
   (clojure-indent-style . always-align)
   (cljr-favor-prefix-notation . nil)
   (cljr-insert-newline-after-require . t)
+  (cljr-print-right-margin . 118)
   (clojure-docstring-fill-column . 118)
   (cider-preferred-build-tool . clojure-cli)
   (cider-default-cljs-repl . shadow-select)

.eslintignore

@@ -1,2 +1,4 @@
 frontend/src/cljs
 frontend/src/cljs_release
+e2e/support/cypress_sample_database.js
+e2e/support/cypress_sample_instance_data.js

.eslintrc

@@ -1,216 +0,0 @@
-{
-  "rules": {
-    "strict": [2, "never"],
-    "no-undef": 2,
-    "no-var": 1,
-    "no-unused-vars": [
-      "error",
-      {
-        "vars": "all",
-        "args": "none",
-        "varsIgnorePattern": "^_",
-        "ignoreRestSiblings": true
-      }
-    ],
-    "no-empty": [1, { "allowEmptyCatch": true }],
-    "no-restricted-imports": [
-      "error",
-      {
-        "paths": [
-          {
-            "name": "moment",
-            "message": "Moment is deprecated, please use dayjs"
-          },
-          {
-            "name": "moment-timezone",
-            "message": "Moment is deprecated, please use dayjs"
-          }
-        ]
-      }
-    ],
-    "curly": [1, "all"],
-    "eqeqeq": [1, "smart"],
-    "import/no-default-export": 2,
-    "import/no-named-as-default": 0,
-    "import/no-commonjs": 1,
-    "import/order": [
-      "error",
-      {
-        "pathGroups": [
-          {
-            "pattern": "react",
-            "group": "builtin",
-            "position": "before"
-          },
-          {
-            "pattern": "metabase/**",
-            "group": "internal"
-          },
-          {
-            "pattern": "metabase/**/components",
-            "group": "internal",
-            "position": "before"
-          },
-          {
-            "pattern": "__**",
-            "group": "internal",
-            "position": "before"
-          },
-          {
-            "pattern": "metabase-lib/**",
-            "group": "internal",
-            "position": "after"
-          }
-        ],
-        "groups": [
-          "builtin",
-          "external",
-          "internal",
-          "parent",
-          "sibling",
-          "index",
-          "object"
-        ]
-      }
-    ],
-    "no-console": [2, { "allow": ["warn", "error"] }],
-    "react/no-is-mounted": 2,
-    "react/prefer-es6-class": 2,
-    "react/display-name": 1,
-    "react/prop-types": 2,
-    "react/no-did-mount-set-state": 0,
-    "react/no-did-update-set-state": 0,
-    "react/no-find-dom-node": 0,
-    "react/no-children-prop": 2,
-    "react/no-string-refs": 2,
-    "react/no-unescaped-entities": 2,
-    "react/jsx-no-target-blank": 2,
-    "react/jsx-key": 2,
-    "react/forbid-component-props": [2, { "forbid": ["sx"] }],
-    "react-hooks/exhaustive-deps": [
-      "warn",
-      { "additionalHooks": "(useSyncedQueryString|useSafeAsyncFunction)" }
-    ],
-    "prefer-const": [1, { "destructuring": "all" }],
-    "no-useless-escape": 0,
-    "no-only-tests/no-only-tests": [
-      "error",
-      {
-        "block": [
-          "describe",
-          "it",
-          "context",
-          "test",
-          "tape",
-          "fixture",
-          "serial",
-          "Feature",
-          "Scenario",
-          "Given",
-          "And",
-          "When",
-          "Then",
-          "describeWithSnowplow",
-          "describeEE"
-        ]
-      }
-    ],
-    "complexity": ["error", { "max": 54 }]
-  },
-  "globals": {
-    "before": true,
-    "cy": true,
-    "Cypress": true
-  },
-  "env": {
-    "browser": true,
-    "es6": true,
-    "commonjs": true,
-    "jest": true,
-    "jest/globals": true
-  },
-  "parser": "babel-eslint",
-  "plugins": ["react", "no-only-tests"],
-  "extends": [
-    "eslint:recommended",
-    "plugin:react/recommended",
-    "plugin:react/jsx-runtime",
-    "plugin:react-hooks/recommended",
-    "plugin:import/errors",
-    "plugin:import/warnings",
-    "plugin:import/typescript"
-  ],
-  "settings": {
-    "import/internal-regex": "^metabase/|^metabase-lib/",
-    "import/resolver": {
-      "webpack": {
-        "typescript": true
-      }
-    },
-    "import/ignore": ["\\.css$"],
-    "react": {
-      "version": "detect"
-    }
-  },
-  "parserOptions": {
-    "ecmaFeatures": {
-      "legacyDecorators": true
-    }
-  },
-  "overrides": [
-    {
-      "files": ["*.js", "*.jsx", "*.ts", "*.tsx"],
-      "rules": {
-        "no-unconditional-metabase-links-render": "error"
-      }
-    },
-    {
-      "files": ["*.unit.spec.*", "frontend/src/metabase/admin/**/*"],
-      "rules": {
-        "no-unconditional-metabase-links-render": "off"
-      }
-    },
-    {
-      "extends": ["plugin:@typescript-eslint/recommended"],
-      "files": ["*.ts", "*.tsx"],
-      "parser": "@typescript-eslint/parser",
-      "plugins": ["@typescript-eslint"],
-      "rules": {
-        "prefer-rest-params": "off",
-        "@typescript-eslint/explicit-module-boundary-types": "off",
-        "@typescript-eslint/no-inferrable-types": "off",
-        "@typescript-eslint/no-explicit-any": "off",
-        "@typescript-eslint/no-this-alias": "off",
-        "@typescript-eslint/consistent-type-imports": "error",
-        "@typescript-eslint/no-unused-vars": [
-          "error",
-          {
-            "argsIgnorePattern": "^_",
-            "varsIgnorePattern": "^_",
-            "ignoreRestSiblings": true,
-            "destructuredArrayIgnorePattern": "^_"
-          }
-        ],
-        // This was introduced in 6.0.0
-        "@typescript-eslint/no-unsafe-declaration-merging": "off"
-      }
-    },
-    {
-      "extends": [
-        "plugin:jest/recommended",
-        "plugin:jest-dom/recommended",
-        "plugin:testing-library/react"
-      ],
-      "plugins": ["jest", "jest-dom", "testing-library"],
-      "files": [
-        "*.unit.spec.ts",
-        "*.unit.spec.tsx",
-        "*.unit.spec.js",
-        "*.unit.spec.jsx"
-      ],
-      "rules": {
-        "jest/valid-title": ["error", { "ignoreTypeOfDescribeName": true }]
-      }
-    }
-  ]
-}

.eslintrc.js

@@ -0,0 +1,230 @@
+/* eslint-disable import/no-commonjs */
+/* eslint-disable no-undef */
+
+// `postcss-modules` lints css modules class names, but it currently crashes
+// eslint on vscode. If you use webstorm or want to run the lint for the cli, you
+// can use this flag to enable it. This is set to true in CI
+const shouldLintCssModules =
+  process.env.LINT_CSS_MODULES === "true" || process.env.CI;
+
+module.exports = {
+  rules: {
+    strict: [2, "never"],
+    "no-undef": 2,
+    "no-var": 1,
+    "no-unused-vars": [
+      "error",
+      {
+        vars: "all",
+        args: "none",
+        varsIgnorePattern: "^_",
+        ignoreRestSiblings: true,
+      },
+    ],
+    "no-empty": [1, { allowEmptyCatch: true }],
+    "no-restricted-imports": [
+      "error",
+      {
+        paths: [
+          {
+            name: "moment",
+            message: "Moment is deprecated, please use dayjs",
+          },
+          {
+            name: "moment-timezone",
+            message: "Moment is deprecated, please use dayjs",
+          },
+        ],
+      },
+    ],
+    curly: [1, "all"],
+    eqeqeq: [1, "smart"],
+    "import/no-default-export": 2,
+    "import/no-named-as-default": 0,
+    "import/no-commonjs": 1,
+    "import/order": [
+      "error",
+      {
+        "newlines-between": "always",
+        alphabetize: {
+          order: "asc",
+          orderImportKind: "asc",
+          caseInsensitive: false,
+        },
+        groups: [
+          "builtin",
+          "external",
+          "internal",
+          "parent",
+          "sibling",
+          "index",
+        ],
+        warnOnUnassignedImports: false,
+      },
+    ],
+    "no-console": [2, { allow: ["warn", "error", "errorBuffer"] }],
+    "react/no-is-mounted": 2,
+    "react/prefer-es6-class": 2,
+    "react/display-name": 1,
+    "react/prop-types": 2,
+    "react/no-did-mount-set-state": 0,
+    "react/no-did-update-set-state": 0,
+    "react/no-find-dom-node": 0,
+    "react/no-children-prop": 2,
+    "react/no-string-refs": 2,
+    "react/no-unescaped-entities": 2,
+    "react/jsx-no-target-blank": 2,
+    "react/jsx-key": 2,
+    "react/forbid-component-props": [2, { forbid: ["sx"] }],
+    "react-hooks/exhaustive-deps": [
+      "warn",
+      { additionalHooks: "(useSafeAsyncFunction)" },
+    ],
+    "prefer-const": [1, { destructuring: "all" }],
+    "no-useless-escape": 0,
+    "no-only-tests/no-only-tests": [
+      "error",
+      {
+        block: [
+          "describe",
+          "it",
+          "context",
+          "test",
+          "tape",
+          "fixture",
+          "serial",
+          "Feature",
+          "Scenario",
+          "Given",
+          "And",
+          "When",
+          "Then",
+          "describeWithSnowplow",
+          "describeEE",
+        ],
+      },
+    ],
+    complexity: ["error", { max: 54 }],
+    ...(shouldLintCssModules
+      ? {
+          "postcss-modules/no-undef-class": "error",
+        }
+      : {}),
+  },
+  globals: {
+    before: true,
+    cy: true,
+    Cypress: true,
+  },
+  env: {
+    browser: true,
+    es6: true,
+    commonjs: true,
+    jest: true,
+    "jest/globals": true,
+  },
+  parser: "babel-eslint",
+  plugins: ["react", "no-only-tests", "postcss-modules"],
+  extends: [
+    "eslint:recommended",
+    "plugin:react/recommended",
+    "plugin:react/jsx-runtime",
+    "plugin:react-hooks/recommended",
+    "plugin:import/errors",
+    "plugin:import/warnings",
+    "plugin:import/typescript",
+  ],
+  settings: {
+    "import/internal-regex": "^metabase/|^metabase-lib/",
+    "import/resolver": {
+      webpack: {
+        typescript: true,
+      },
+    },
+    "import/ignore": ["\\.css$"],
+    react: {
+      version: "detect",
+    },
+    "postcss-modules": {
+      baseDir: "./frontend/src",
+    },
+  },
+  parserOptions: {
+    ecmaFeatures: {
+      legacyDecorators: true,
+    },
+  },
+  overrides: [
+    {
+      files: ["*.js", "*.jsx", "*.ts", "*.tsx"],
+      rules: {
+        "no-unconditional-metabase-links-render": "error",
+        "no-literal-metabase-strings": "error",
+      },
+    },
+    {
+      files: [
+        "*.unit.spec.*",
+        "frontend/src/metabase/admin/**/*",
+        "frontend/src/metabase/setup/**/*",
+        "frontend/lint/**/*",
+        "*.stories.*",
+        "e2e/**/*",
+        "**/tests/*",
+        "release/**/*",
+      ],
+      rules: {
+        "no-unconditional-metabase-links-render": "off",
+        "no-literal-metabase-strings": "off",
+      },
+    },
+    {
+      extends: ["plugin:@typescript-eslint/recommended"],
+      files: ["*.ts", "*.tsx"],
+      parser: "@typescript-eslint/parser",
+      plugins: ["@typescript-eslint"],
+      rules: {
+        "prefer-rest-params": "off",
+        "@typescript-eslint/explicit-module-boundary-types": "off",
+        "@typescript-eslint/no-inferrable-types": "off",
+        "@typescript-eslint/no-explicit-any": "off",
+        "@typescript-eslint/no-this-alias": "off",
+        "@typescript-eslint/consistent-type-imports": [
+          "error",
+          {
+            fixStyle: "inline-type-imports",
+          },
+        ],
+        "@typescript-eslint/no-import-type-side-effects": "error",
+        "@typescript-eslint/no-unused-vars": [
+          "error",
+          {
+            argsIgnorePattern: "^_",
+            varsIgnorePattern: "^_",
+            ignoreRestSiblings: true,
+            destructuredArrayIgnorePattern: "^_",
+          },
+        ],
+        // This was introduced in 6.0.0
+        "@typescript-eslint/no-unsafe-declaration-merging": "off",
+      },
+    },
+    {
+      extends: [
+        "plugin:jest/recommended",
+        "plugin:jest-dom/recommended",
+        "plugin:testing-library/react",
+      ],
+      plugins: ["jest", "jest-dom", "testing-library"],
+      files: [
+        "*.unit.spec.ts",
+        "*.unit.spec.tsx",
+        "*.unit.spec.js",
+        "*.unit.spec.jsx",
+      ],
+      rules: {
+        "jest/valid-title": ["error", { ignoreTypeOfDescribeName: true }],
+      },
+    },
+  ],
+};

.github/CODEOWNERS

@@ -1,3 +1,14 @@
+# Before changing this file, make sure you have read how we use it:
+# https://www.notion.so/metabase/Pull-Request-Code-Review-Guide-374f05df889748b69d67af753f9bc9b8?pvs=4#36550c04ceab40b5a8b8bee6264b090c
+# TL;DR: if @camsaul hasn't been involved you're probably doing it wrong
+
 src/metabase @camsaul
 modules @camsaul
 enterprise/backend @camsaul
+enterprise/backend/src/metabase_enterprise/advanced_permissions @noahmoss
+enterprise/backend/src/metabase_enterprise/audit_app @noahmoss
+enterprise/backend/src/metabase_enterprise/sso @noahmoss
+enterprise/backend/src/metabase_enterprise/task/truncate_audit_table.clj @noahmoss
+enterprise/backend/src/metabase_enterprise/internal_user.clj @noahmoss
+src/metabase/**/*permissions* @noahmoss
+src/metabase/integrations @noahmoss

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -38,7 +38,7 @@ body:
     validations:
       required: true
 
-  - type: input
+  - type: textarea
     id: expected-behavior
     attributes:
       label: Expected behavior
@@ -82,7 +82,6 @@ body:
       label: Severity
       description: |
         How severe an issue is this bug to you? Is this annoying, blocking some users, blocking an upgrade or blocking your usage of Metabase entirely?
-        _Note: the more honest and specific you are here the more we will take you seriously._
     validations:
       required: true
 

.github/ISSUE_TEMPLATE/feature_request.md

@@ -17,7 +17,6 @@ A clear and concise description of what you want to happen.
 A clear and concise description of any alternative solutions or features you've considered.
 
 **How important is this feature to you?**
-Note: the more honest and specific you are here the more we will take you seriously. 
 
 **Additional context**
 Add any other context or screenshots about the feature request here.

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,5 +1,5 @@
 > [!IMPORTANT]
-> If you are merging into master, please add either a `backport` or a `no-backport` label to this PR. You will not be able to merge until you do this step. Refer to the section [Do I need to backport this PR?](https://www.notion.so/metabase/Metabase-Branching-Strategy-6eb577d5f61142aa960a626d6bbdfeb3?pvs=4#89f80d6f17714a0198aeb66c0efd1b71) in the Metabase Branching Strategy document for more details.
+> For those employed by Metabase: if you are merging into master, please add either a `backport` or a `no-backport` label to this PR. You will not be able to merge until you do this step. Refer to the section [Do I need to backport this PR?](https://www.notion.so/metabase/Metabase-Branching-Strategy-6eb577d5f61142aa960a626d6bbdfeb3?pvs=4#89f80d6f17714a0198aeb66c0efd1b71) in the Metabase Branching Strategy document for more details. If you're not employed by Metabase, this section does not apply to you, and the label will be taken care of by your reviewer.
 
 > **Warning**
 >

.github/actions/build-e2e-matrix/action.yml

@@ -16,7 +16,6 @@ runs:
           const java = 11;
 
           const defaultRunner = "ubuntu-22.04";
-          const beefierRunner = "buildjet-2vcpu-ubuntu-2204";
 
           const defaultOptions = {
             "java-version": java,
@@ -36,8 +35,11 @@ runs:
             ["dashboard-cards", {} ],
             ["dashboard-filters", {} ],
             ["embedding", {} ],
+            ["embedding-sdk", { context: "embedding-sdk" } ],
             ["filters", {} ],
+            ["filters-reproductions", {}],
             ["joins", {} ],
+            ["metrics", {} ],
             ["models", {} ],
             ["native", {} ],
             ["native-filters", {} ],
@@ -45,12 +47,14 @@ runs:
             ["organization", {} ],
             ["permissions", {} ],
             ["question", {} ],
+            ["question-reproductions", {} ],
+            ["search", {}],
             ["sharing", {} ],
             ["visualizations-charts", {} ],
             ["visualizations-tabular", {} ],
             ["oss-subset", { edition: 'oss', context: "special" } ],
-            ["slow", { runner: beefierRunner, context: "special" } ],
-            ["flaky", { runner: beefierRunner, context: "special" } ],
+            ["slow", { context: "special" } ],
+            ["flaky", { context: "special" } ],
             ["mongo", { context: "qa-database" } ],
           ];
 

.github/actions/cross-branch-migration-test/action.yml

@@ -0,0 +1,67 @@
+name: Cross-branch migration test
+
+inputs:
+  base-ref:
+    required: true
+
+runs:
+  using: "composite"
+  steps:
+    - name: Check out base branch
+      uses: actions/checkout@v4
+      with:
+        ref: ${{ inputs.base-ref }}
+
+    - name: Prepare backend environment
+      uses: ./.github/actions/prepare-backend
+      with:
+        m2-cache-key: cross-branch-migrations
+
+    - name: Run backend on base branch
+      run: |
+        clojure -M:run:ee > metabase.log 2>&1 & echo $! > metabase_pid
+        tail -F metabase.log &
+      shell: bash
+
+    - name: Wait for Metabase to start
+      run: |
+        while ! curl -s 'http://localhost:3000/api/health' | grep '{"status":"ok"}' > /dev/null; do
+          if ! kill -0 $(cat metabase_pid) 2>/dev/null; then
+            cat metabase.log
+            echo "Metabase process has exited."
+            exit 1
+          fi
+          sleep 1
+        done
+      shell: bash
+
+    - name: Stop Metabase on base branch
+      run: kill $(cat metabase_pid)
+      shell: bash
+
+    - name: Check out pull request branch
+      uses: actions/checkout@v4
+      with:
+        ref: ${{ github.head_ref }}
+
+    - name: Run backend on pull request branch
+      run: |
+        clojure -M:run:ee > metabase.log 2>&1 & echo $! > metabase_pid
+        tail -F metabase.log &
+      shell: bash
+
+    - name: Wait for Metabase to start
+      run: |
+        while ! curl -s 'http://localhost:3000/api/health' | grep '{"status":"ok"}' > /dev/null; do
+          if ! kill -0 $(cat metabase_pid) 2>/dev/null; then
+            cat metabase.log
+            echo "Metabase process has exited. Check that your migration changes work on an instance that has been previously initialized on your PR's target branch."
+            exit 1
+          fi
+          sleep 1
+        done
+      shell: bash
+
+    - name: Stop Metabase on pull request branch
+      run: kill $(cat metabase_pid)
+      shell: bash

.github/actions/e2e-prepare-containers/action.yml

@@ -8,23 +8,23 @@ inputs:
     description: DockerHub password/token
     required: true
   maildev:
-    description: Maildev
+    description: Maildev container
     required: true
     default: 'false'
   openldap:
-    description: Maildev
+    description: OpenLDAP container
     required: true
     default: 'false'
   postgres:
-    description: Maildev
+    description: Postgres container
     required: true
     default: 'false'
   mysql:
-    description: Maildev
+    description: MySQL container
     required: true
     default: 'false'
   mongo:
-    description: Maildev
+    description: Mongo container
     required: true
     default: 'false'
 

.github/actions/prepare-cypress/action.yml

@@ -1,12 +1,20 @@
 name: Prepare cypress environment
 description: Cypress preparation steps
 
+outputs:
+  chrome-path:
+    description: Path to the custom Chrome executable
+    value: ${{ steps.setup-chrome.outputs.chrome-path }}
+
 runs:
   using: "composite"
   steps:
-    - name: Install Replay.io browser
-      run: npx @replayio/cypress install
-      shell: bash
+    - name: Install Chrome v111
+      uses: browser-actions/setup-chrome@v1
+      with:
+        # https://chromium.cypress.io/linux/stable/111.0.5563.146
+        chrome-version: 1097615
+      id: setup-chrome
 
     - name: Check to see if dependencies should be cached
       if: ${{ contains(github.event.head_commit.message, '[ci nocache]') }}

.github/actions/prepare-frontend/action.yml

@@ -1,10 +1,15 @@
 name: Prepare front-end environment
+inputs:
+  node-version:
+    description: "The version of Node.js to use, overriding .nvmrc"
+    required: false
 runs:
   using: "composite"
   steps:
     - name: Prepare Node.js
       uses: actions/setup-node@v4
       with:
+        node-version: ${{ inputs.node-version }} # this overrides, if present
         node-version-file: ".nvmrc"
     - name: Check to see if dependencies should be cached
       if: ${{ contains(github.event.head_commit.message, '[ci nocache]') }}
@@ -23,6 +28,6 @@ runs:
       if: ${{ !contains(github.event.head_commit.message, '[ci nocache]') }}
       with:
         path: node_modules
-        key: ${{ runner.os }}-node-modules-${{ hashFiles('**/yarn.lock') }}
+        key: ${{ runner.os }}-node-modules-${{ hashFiles('**/yarn.lock', '**/patches/*.patch') }}
     - run: yarn install --frozen-lockfile --prefer-offline
       shell: bash

.github/actions/run-embedding-sdk-storybook/action.yml

@@ -0,0 +1,33 @@
+name: Run Embedding SDK Storybook
+runs:
+  using: "composite"
+  steps:
+    - name: Prepare frontend environment
+      uses: ./.github/actions/prepare-frontend
+
+    - name: Prepare back-end environment
+      uses: ./.github/actions/prepare-backend
+      with:
+        m2-cache-key: "cljs"
+
+    - name: Compile CLJS
+      run: yarn build-pure:cljs
+      shell: bash
+
+    - name: Build Storybook
+      run: yarn build-storybook-embedding-sdk
+      shell: bash
+
+    - name: Serve Storybook
+      run: yarn http-server storybook-static -p 6006 &
+      shell: bash
+
+    - name: Wait for Storybook to become available
+      run: |
+        echo "Waiting for Storybook to be served..."
+        while ! curl --silent --fail http://localhost:6006; do
+          sleep 5
+          echo "Retrying..."
+        done
+        echo "Storybook is being served!"
+      shell: bash

.github/auto_request_review.yml

@@ -0,0 +1,17 @@
+# The reviewers configuration for the auto_request_review workflow
+# See https://github.com/necojackarc/auto-request-review/tree/master?tab=readme-ov-file#reviewers-configuration
+# for the spec
+
+files:
+  # migrations related files
+  'resources/migrations/**':
+    - team:core-backend-components
+  'src/metabase/db/custom_migrations.clj':
+    - team:core-backend-components
+
+options:
+  ignore_draft: true
+  ignored_keywords:
+    - DO NOT REVIEW
+    - WIP
+  enable_group_assignment: false

.github/file-paths.yaml

@@ -23,24 +23,34 @@ frontend_sources: &frontend_sources
   - "**/tsconfig*.json"
   - "package.json"
   - "babel.config.json"
-  - ".eslintrc"
+  - ".eslintrc.js"
   - "postcss.config.js"
   - "webpack.config.js"
+  - "webpack.embedding-sdk.config.js"
   - "webpack.static-viz.config.js"
+  - ".nvmrc"
 
 frontend_specs: &frontend_specs
   - *shared_specs
   - "frontend/test/**"
   - "frontend/**/tests/**"
   - "frontend/**/*.unit.*"
-  - "jest.config.json"
+  - "jest.config.js"
   - "jest.tz.unit.conf.json"
 
+release_source: &release_sources
+  - "release/**"
+
 frontend_all: &frontend_all
   - *frontend_ci
   - *frontend_sources
   - *frontend_specs
 
+frontend_loki_ci: &frontend_loki_ci
+  - ".github/workflows/loki.yml"
+  - ".loki/**"
+  - ".storybook/**"
+
 backend_ci: &backend_ci
   - ".github/actions/prepare-frontend/**"
   - ".github/actions/prepare-backend/**"
@@ -93,10 +103,15 @@ e2e_ci: &e2e_ci
 
 e2e_specs: &e2e_specs
   - "**/*.cy.*.js"
+  - "**/*.cy.*.ts"
   - "e2e/runner/**"
   - "e2e/support/**"
   - "e2e/snapshot*/**"
 
+e2e_cross_version: &e2e_cross_version
+  - ".github/workflows/e2e-cross-version.yml"
+  - "e2e/test/scenarios/cross-version/**"
+
 e2e_all:
   - *default
   - *e2e_ci

.github/team.json

@@ -3,11 +3,10 @@
     {
       "name": "Querying Components",
       "label": ".Team/QueryingComponents",
+      "projectUrl": "https://github.com/orgs/metabase/projects/97/views/1",
       "members": [
         "ranquild",
-        "uladzimirdev",
         "kamilmielnik",
-        "oleggromov",
         "nemanjaglumac",
         "romeovs"
       ]
@@ -15,16 +14,13 @@
     {
       "name": "Embedding",
       "label": ".Team/Embedding",
-      "members": [
-        "WiNloSt",
-        "deniskaber",
-        "oisincoveney",
-        "npretto"
-      ]
+      "projectUrl": "https://github.com/orgs/metabase/projects/88/views/1",
+      "members": ["WiNloSt", "deniskaber", "oisincoveney", "npretto", "heypoom"]
     },
     {
       "name": "BEC",
       "label": ".Team/BackendComponents",
+      "projectUrl": "https://github.com/orgs/metabase/projects/50/views/1",
       "members": [
         "tsmacdonald",
         "qnkhuat",
@@ -36,13 +32,8 @@
     {
       "name": "Query Processor",
       "label": ".Team/QueryProcessor",
-      "members": [
-        "camsaul",
-        "snoe",
-        "bshepherdson",
-        "metamben",
-        "lbrdnk"
-      ]
+      "projectUrl": "https://github.com/orgs/metabase/projects/83/views/8",
+      "members": ["camsaul", "snoe", "bshepherdson", "metamben", "lbrdnk"]
     },
     {
       "name": "Admin Webapp",
@@ -50,13 +41,11 @@
       "members": [
         "noahmoss",
         "escherize",
-        "qwef",
-        "iethree",
         "npfitz",
-        "shaunlebron",
         "johnswanson",
         "rafpaf",
-        "sloansparger"
+        "sloansparger",
+        "iethree"
       ]
     },
     {
@@ -67,9 +56,15 @@
         "EmmadUsmani",
         "JesseSDevaney",
         "kulyk",
-        "markbastian",
         "adam-james-v"
       ]
+    },
+    {
+      "name": "DevEx",
+      "label": ".Team/DevEx",
+      "members": [
+        "uladzimirdev"
+      ]
     }
   ]
 }

.github/workflows/auto-assign.yml

@@ -30,7 +30,7 @@ jobs:
             const prNumber = context.payload.pull_request.number;
 
             if (prAuthor.endsWith('[bot]')) {
-              return false;
+              return null;
             }
 
             // Assign PR author
@@ -44,7 +44,7 @@ jobs:
             const team = teamConfig.teams.find(t => t.members.includes(prAuthor));
             if (!team) {
               console.log('You are not assigned to any team. If you need one, update .github/team.json');
-              return false;
+              return null;
             }
 
             try {
@@ -55,7 +55,7 @@ jobs:
               });
             } catch (e) {
               console.log(`The label ${team.label} does not exist, create it first`);
-              return false;
+              return null;
             }
 
             // Add team label
@@ -66,9 +66,9 @@ jobs:
               labels: [team.label]
             });
 
-            return true;
+            return team.projectUrl || null;
       - uses: actions/add-to-project@v0.5.0
-        if: ${{ fromJSON(steps.auto-assign.outputs.result) }}
+        if: ${{ steps.auto-assign.outputs.result != 'null' }}
         with:
-          project-url: https://github.com/orgs/metabase/projects/50/views/1
+          project-url: ${{ steps.auto-assign.outputs.result }}
           github-token: ${{ steps.generate-token.outputs.token }}

.github/workflows/auto-backport.yml

@@ -11,11 +11,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: tibdex/github-app-token@v2.1.0
-        id: generate-token
-        with:
-          app_id: ${{ secrets.METABASE_BOT_APP_ID }}
-          private_key: ${{ secrets.METABASE_BOT_APP_PRIVATE_KEY }}
+          token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
       - uses: ./.github/actions/find-squashed-commit
         name: Find commit
         id: find_commit
@@ -82,7 +78,7 @@ jobs:
           TARGET_BRANCH: ${{ steps.get_latest_release_branch.outputs.branch-name }}
           ORIGINAL_PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}
           ORIGINAL_TITLE: ${{ github.event.pull_request.title }}
-          GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
+          GITHUB_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
           COMMIT: ${{ steps.find_commit.outputs.commit }}
 
       - name: Auto approve backport PR
@@ -96,7 +92,7 @@ jobs:
         if: ${{ steps.create_backport_pull_request.outputs.has-conflicts == 'false' }}
         uses: peter-evans/enable-pull-request-automerge@v2
         with:
-          token: ${{ steps.generate-token.outputs.token }}
+          token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
           pull-request-number: ${{ steps.create_backport_pull_request.outputs.backport_pr_number }}
           merge-method: squash
 

.github/workflows/auto-request-review.yml

@@ -0,0 +1,21 @@
+# Config is in .github/auto_request_review.yml
+name: Auto Request Review
+
+on:
+  pull_request:
+    types: [opened, ready_for_review, reopened, synchronize]
+
+jobs:
+  auto-request-review:
+    # Don't run on forked repos
+    if: ${{ !github.event.pull_request.head.repo.fork }}
+    permissions:
+      contents: read
+      pull-requests: write
+    name: Auto Request Review
+    runs-on: ubuntu-latest
+    steps:
+      - name: Request review based on files changes and/or groups the author belongs to
+        uses: necojackarc/auto-request-review@v0.13.0
+        with:
+          token: '${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}'

.github/workflows/backend-cloverage.yml

@@ -0,0 +1,27 @@
+name: Backend-Cloverage
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 10 * * 1-5' # every weekday at 5am US eastern time
+
+jobs:
+  be-linter-cloverage:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 90
+    steps:
+      - uses: actions/checkout@v4
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: "cloverage"
+      - name: Build static viz frontend
+        run: yarn build-static-viz
+      - name: Collect the test coverage
+        run: clojure -X:dev:ci:ee:ee-dev:test:cloverage
+      - name: Upload coverage to codecov.io
+        uses: codecov/codecov-action@v4
+        with:
+          token: ${{ secrets.CODECOV_TOKEN }}
+          files: ./target/coverage/codecov.json
+          flags: back-end

.github/workflows/backend.yml

@@ -6,7 +6,7 @@ on:
       - "master"
       - "release-**"
   pull_request:
-    types: [opened, synchronize, reopened, ready_for_review]
+    types: [opened, synchronize, reopened, ready_for_review, labeled]
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
@@ -63,27 +63,6 @@ jobs:
           token: ${{ github.token }}
           filters: .github/static-viz-sources.yaml
 
-  be-linter-cloverage:
-    needs: files-changed
-    if: github.ref_name == 'master' && needs.files-changed.outputs.backend_all == 'true'
-    runs-on: ubuntu-22.04
-    timeout-minutes: 90
-    steps:
-      - uses: actions/checkout@v4
-      - name: Prepare back-end environment
-        uses: ./.github/actions/prepare-backend
-        with:
-          m2-cache-key: "cloverage"
-      - name: Build static viz frontend
-        run: yarn build-static-viz
-      - name: Collect the test coverage
-        run: clojure -X:dev:ci:ee:ee-dev:test:cloverage
-      - name: Upload coverage to codecov.io
-        uses: codecov/codecov-action@v3
-        with:
-          files: ./target/coverage/codecov.json
-          flags: back-end
-
   be-linter-clj-kondo:
     needs: [files-changed, static-viz-files-changed]
     if: |
@@ -206,7 +185,7 @@ jobs:
         if: matrix.java-version != 21
         run: clojure -X:dev:ci:test:${{ matrix.edition }}:${{ matrix.edition }}-dev
 
-      - name: Run tests using Java 21 on `master` only
+      - name: If using Java 21, only run tests on `master`
         id: run-java-tests-21
         if: matrix.java-version == 21 && github.ref_name == 'master'
         run: clojure -X:dev:ci:test:${{ matrix.edition }}:${{ matrix.edition }}-dev

.github/workflows/build-for-release.yml

@@ -13,6 +13,56 @@ on:
         required: true
 
 jobs:
+  start-message:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: release
+      - name: Prepare build scripts
+        run: cd ${{ github.workspace }}/release && yarn && yarn build
+      - name: Send build start message
+        uses: actions/github-script@v7
+        env:
+          SLACK_RELEASE_CHANNEL: ${{ vars.SLACK_RELEASE_CHANNEL }}
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+        with:
+          script: | # js
+            const { sendPreReleaseMessage } = require('${{ github.workspace }}/release/dist/index.cjs');
+
+            await sendPreReleaseMessage({
+              github,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              version: '${{ inputs.version }}',
+              runId: '${{ github.run_id }}',
+              releaseSha: '${{ inputs.commit }}',
+              userName: '${{ github.actor }}',
+              channelName: '${{ vars.SLACK_RELEASE_CHANNEL }}',
+            }).catch(console.error);
+
+  trigger-milestone-check:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    needs: start-message
+    steps:
+      - name: trigger pre-release milestone check
+        uses: actions/github-script@v7
+        with:
+          script: | # js
+            await github.rest.actions.createWorkflowDispatch({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              workflow_id: 'release-milestone-check.yml',
+              ref: '${{ github.ref }}',
+              inputs: {
+                commit: '${{ inputs.commit }}',
+                version: '${{ inputs.version }}',
+              }
+            });
+
+
   check-version:
     runs-on: ubuntu-22.04
     timeout-minutes: 10
@@ -85,7 +135,7 @@ jobs:
       uses: actions/github-script@v7
       id: release_branch
       with:
-        result_encoding: string
+        result-encoding: string
         script: | # js
           const { getReleaseBranch } = require('${{ github.workspace }}/release/dist/index.cjs');
           const version = '${{ inputs.version }}';

.github/workflows/check-milestone.yml

@@ -1,80 +1,41 @@
-name: Milestone Reminder
+name: Automatically set milestone
+run-name: Set milestone for ${{ github.event.head_commit.message }}
 
 on:
-  pull_request:
-    types: [closed]
+  push:
     branches:
-      - "master"
+      - release-x.**
 
 jobs:
-  milestone-reminder:
-    if: github.event.pull_request.merged == true
-    name: Remind to set milestone
+  set-milestone:
+    name: Automatically set milestone
     runs-on: ubuntu-22.04
     timeout-minutes: 5
     permissions:
       pull-requests: write
-      issues: read
+      issues: write
+      contents: read
     steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: release
+          ref: master # we want the logic from master, even though we're triggering on a release branch
+      - name: Prepare build scripts
+        run: cd ${{ github.workspace }}/release && yarn && yarn build
       - uses: actions/github-script@v7
         with:
           script: | # js
+            const { setMilestoneForCommits } = require('${{ github.workspace }}/release/dist/index.cjs');
             const owner = context.repo.owner;
             const repo = context.repo.repo;
 
-            const pullNumber = '${{ github.event.pull_request.number }}';
+            const branchName = `${{ github.ref }}`;
+            const commitMessage = context?.payload?.head_commit?.message ?? '';
 
-            // the github API doesn't expose linked issues, so we have to parse the body ourselves
-            function getLinkedIssueId(pull) {
-              // https://regexr.com/7mjnp
-              const match = pull.data.body.match(/(\/issues\/|#)(\d+)/);
-              return match && match?.[2];
-            }
-
-            function getMilestone(pullOrIssue) {
-              // pull has pull.data.milestone, issue has issue.milestone
-              return pullOrIssue?.data?.milestone || pullOrIssue?.milestone;
-            }
-
-            const pull = await github.rest.pulls.get({
+            await setMilestoneForCommits({
+              github,
               owner,
               repo,
-              pull_number: pullNumber,
-            });
-
-            if (getMilestone(pull)) {
-              console.log("Pull request has milestone", pull.data.milestone?.title);
-              process.exit(0);
-            }
-
-            const issueId = getLinkedIssueId(pull);
-
-            if (issueId) {
-              console.log('linked issue found', issueId);
-
-              const issue = await github.rest.issues.get({
-                owner,
-                repo,
-                issue_number: issueId,
-              });
-
-              const milestone = getMilestone(issue);
-
-              if (milestone) {
-                console.log("Linked issue has milestone", milestone.title);
-                process.exit(0);
-              }
-            }
-
-            console.log("No milestone found");
-
-            const author = pull.data.user.login;
-            const guideLink = "https://www.notion.so/metabase/Metabase-Branching-Strategy-6eb577d5f61142aa960a626d6bbdfeb3?pvs=4#3dea255ffa3b4f74942a227844e889fa";
-            const message = `@${author} Did you forget to add a milestone to the issue for this PR? _[When and where should I add a milestone?](${guideLink})_`;
-
-            await github.rest.issues.createComment({
-              owner,
-              repo,
-              issue_number: pullNumber,
-              body: message,
+              branchName,
+              commitMessages: [commitMessage],
             });

.github/workflows/conventional-commit-pr-title-reminder.yml

@@ -0,0 +1,57 @@
+name: Conventional commit PR Title Reminder
+
+on:
+  pull_request:
+    branches:
+      - master
+    paths:
+      - enterprise/frontend/src/embedding-sdk/**
+
+jobs:
+  pr-title-reminder:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    permissions:
+      pull-requests: write
+    steps:
+      - name: Check if the PR title is already following Conventional Commits style
+        uses: actions/github-script@v7
+        id: is-conventional-commit
+        with:
+          result-encoding: string
+          script: | # js
+            const pullRequestTitle = context.payload.pull_request.title
+            const conventionalCommitRegex = /^(?<type>\w+)\((?<scope>\w+)\):/
+            const match = pullRequestTitle.match(conventionalCommitRegex)
+            if (match) {
+              const { type, scope } = match.groups
+              return ['feat', 'fix', 'perf', 'docs', 'style', 'refactor', 'test', 'build', 'ci'].includes(type) && scope === 'sdk'
+            }
+
+      - name: Checkout repository so `gh` CLI works
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.head_ref }}
+
+      - name: Remind PR authors to use conventional commit in the title
+        if: ${{ steps.is-conventional-commit.outputs.result != 'true' }}
+        run: |
+          comment='@${{ github.event.pull_request.user.login }} You have modified embedding SDK code. Please make sure the PR title follows [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/) style.
+
+          Here are all the supported types that will be shown in the changelog:
+          - `feat`
+          - `fix`
+          - `perf`
+
+          These types `docs`, `style`, `refactor`, `test`, `build`, and `ci` are also encouraged for non-changelog related tasks.
+
+          Please also make sure to include `sdk` scope, otherwise, the changelog will not include this task.
+
+          For example, these are valid PR titles:
+          - `feat(sdk): Add interactive dashboard component`
+          - `feat(sdk): Support theming pie chart`
+          - `fix(sdk): Fix static dashboard crash`'
+
+          gh pr comment -b "$comment" --edit-last || gh pr comment -b "$comment"
+        env:
+          GH_TOKEN: ${{ github.token }}

.github/workflows/cross-branch-migrations.yml

@@ -0,0 +1,162 @@
+name: Cross-branch migration tests
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+    paths:
+      - "resources/migrations/**"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  migrations-h2-ee:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    env:
+      CI: 'true'
+      MB_DB_TYPE: h2
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/cross-branch-migration-test
+        with:
+          base-ref: ${{ github.base_ref }}
+
+  migrations-postgres-12-ee:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    env:
+      CI: 'true'
+      MB_DB_TYPE: postgres
+      MB_DB_PORT: 5432
+      MB_DB_HOST: localhost
+      MB_DB_DBNAME: circle_test
+      MB_DB_USER: circle_test
+    services:
+      postgres:
+        image: postgres:12-alpine
+        ports:
+          - "5432:5432"
+        env:
+          POSTGRES_USER: circle_test
+          POSTGRES_DB: circle_test
+          POSTGRES_HOST_AUTH_METHOD: trust
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/cross-branch-migration-test
+        with:
+          base-ref: ${{ github.base_ref }}
+
+  migrations-postgres-latest-ee:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    env:
+      CI: 'true'
+      MB_DB_TYPE: postgres
+      MB_DB_PORT: 5432
+      MB_DB_HOST: localhost
+      MB_DB_DBNAME: circle_test
+      MB_DB_USER: circle_test
+    services:
+      postgres:
+        image: circleci/postgres:latest
+        ports:
+          - "5432:5432"
+        env:
+          POSTGRES_USER: circle_test
+          POSTGRES_DB: circle_test
+          POSTGRES_HOST_AUTH_METHOD: trust
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/cross-branch-migration-test
+        with:
+          base-ref: ${{ github.base_ref }}
+
+  migrations-mysql-8-0-ee:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    env:
+      CI: 'true'
+      MB_DB_TYPE: mysql
+      MB_DB_HOST: localhost
+      MB_DB_PORT: 3306
+      MB_DB_DBNAME: circle_test
+      MB_DB_USER: root
+    services:
+      mysql:
+        image: cimg/mysql:8.0
+        ports:
+          - "3306:3306"
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/cross-branch-migration-test
+        with:
+          base-ref: ${{ github.base_ref }}
+
+  migrations-mysql-latest-ee:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    env:
+      CI: 'true'
+      MB_DB_TYPE: mysql
+      MB_DB_HOST: localhost
+      MB_DB_PORT: 3306
+      MB_DB_DBNAME: circle_test
+      MB_DB_USER: root
+      MB_MYSQL_TEST_USER: root
+    services:
+      mysql:
+        image: mysql:latest
+        env:
+          MYSQL_ALLOW_EMPTY_PASSWORD: true
+          MYSQL_DATABASE: circle_test
+        ports:
+          - "3306:3306"
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/cross-branch-migration-test
+        with:
+          base-ref: ${{ github.base_ref }}
+
+  migrations-mariadb-10-2-ee:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    env:
+      CI: 'true'
+      MB_DB_TYPE: mysql
+      MB_DB_HOST: localhost
+      MB_DB_PORT: 3306
+      MB_DB_DBNAME: circle_test
+      MB_DB_USER: root
+    services:
+      mariadb:
+        image: circleci/mariadb:10.2.23
+        ports:
+          - "3306:3306"
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/cross-branch-migration-test
+        with:
+          base-ref: ${{ github.base_ref }}
+
+  migrations-mariadb-latest-ee:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    env:
+      CI: 'true'
+      MB_DB_TYPE: mysql
+      MB_DB_HOST: localhost
+      MB_DB_PORT: 3306
+      MB_DB_DBNAME: circle_test
+      MB_DB_USER: root
+    services:
+      mariadb:
+        image: circleci/mariadb:latest
+        ports:
+          - "3306:3306"
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/cross-branch-migration-test
+        with:
+          base-ref: ${{ github.base_ref }}

.github/workflows/drivers-stress-test.yml

@@ -21,7 +21,6 @@ on:
           - Athena
           - BigQuery
           - Druid
-          - Google Analytics
           - Google Classpath Test
           - Maria DB
           - Maria DB (latest)
@@ -109,42 +108,6 @@ jobs:
         junit-name: 'be-tests-druid-ee'
         test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
 
-  be-tests-googleanalytics-ee:
-    if: inputs.driver == 'Google Analytics'
-    runs-on: ubuntu-22.04
-    timeout-minutes: 90
-    env:
-      CI: 'true'
-      DRIVERS: googleanalytics
-    steps:
-    - uses: actions/checkout@v4
-    - name: Test Google Analytics driver
-      uses: ./.github/actions/test-driver
-      with:
-        junit-name: 'be-tests-googleanalytics-ee'
-        test-args: ":only ${{ inputs.test }} :times ${{ inputs.times }}"
-
-  be-google-related-drivers-classpath-test:
-    if: inputs.driver == 'Google Classpath Test'
-    runs-on: ubuntu-22.04
-    timeout-minutes: 90
-    env:
-      CI: 'true'
-      DRIVERS: 'googleanalytics,bigquery-cloud-sdk'
-      MB_BIGQUERY_TEST_PROJECT_ID: ${{ secrets.BIGQUERY_TEST_PROJECT_ID }}
-      MB_BIGQUERY_TEST_CLIENT_ID: ${{ secrets.MB_BIGQUERY_TEST_CLIENT_ID }}
-      MB_BIGQUERY_TEST_CLIENT_SECRET: ${{ secrets.MB_BIGQUERY_TEST_CLIENT_SECRET }}
-      MB_BIGQUERY_TEST_ACCESS_TOKEN: ${{ secrets.MB_BIGQUERY_TEST_ACCESS_TOKEN }}
-      MB_BIGQUERY_TEST_REFRESH_TOKEN: ${{ secrets.MB_BIGQUERY_TEST_REFRESH_TOKEN }}
-      MB_BIGQUERY_CLOUD_SDK_TEST_SERVICE_ACCOUNT_JSON: ${{ secrets.MB_BIGQUERY_CLOUD_SDK_TEST_SERVICE_ACCOUNT_JSON }}
-    steps:
-    - uses: actions/checkout@v4
-    - name: Test Google Related Drivers Classpath
-      uses: ./.github/actions/test-driver
-      with:
-        junit-name: 'be-google-related-drivers-classpath-test'
-        test-args: ':only "[metabase.query-processor-test.expressions-test metabase.driver.google-test metabase.driver.googleanalytics-test ${{ inputs.test }}] :times ${{ inputs.times }}"'
-
   be-tests-mariadb-10-2-ee:
     if: inputs.driver == 'Maria DB'
     runs-on: ubuntu-22.04

.github/workflows/drivers.yml

@@ -40,6 +40,9 @@ jobs:
       MB_ATHENA_TEST_ACCESS_KEY: ${{ secrets.MB_ATHENA_TEST_ACCESS_KEY }}
       MB_ATHENA_TEST_SECRET_KEY: ${{ secrets.MB_ATHENA_TEST_SECRET_KEY }}
       MB_ATHENA_TEST_S3_STAGING_DIR: ${{ secrets.MB_ATHENA_TEST_S3_STAGING_DIR }}
+      # These credentials are used to test the driver when the user does not have the athena:GetTableMetadata permission
+      MB_ATHENA_TEST_WITHOUT_GET_TABLE_METADATA_ACCESS_KEY: ${{ secrets.MB_ATHENA_TEST_WITHOUT_GET_TABLE_METADATA_ACCESS_KEY }}
+      MB_ATHENA_TEST_WITHOUT_GET_TABLE_METADATA_SECRET_KEY: ${{ secrets.MB_ATHENA_TEST_WITHOUT_GET_TABLE_METADATA_SECRET_KEY }}
     steps:
     - uses: actions/checkout@v4
     - name: Test Athena driver
@@ -126,20 +129,27 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
-  be-tests-googleanalytics-ee:
+  be-tests-druid-jdbc-ee:
     needs: files-changed
     if: github.event.pull_request.draft == false && needs.files-changed.outputs.backend_all == 'true'
     runs-on: ubuntu-22.04
     timeout-minutes: 90
     env:
       CI: 'true'
-      DRIVERS: googleanalytics
+      DRIVERS: druid-jdbc
+    services:
+      druid:
+        image: metabase/druid:29.0.1-json-no-ingestion
+        ports:
+          - "8888:8888"
+        env:
+          CLUSTER_SIZE: nano-quickstart
     steps:
     - uses: actions/checkout@v4
-    - name: Test Google Analytics driver
+    - name: Test Druid JDBC driver
       uses: ./.github/actions/test-driver
       with:
-        junit-name: 'be-tests-googleanalytics-ee'
+        junit-name: 'be-tests-druid-jdbc-ee'
         test-args: ":exclude-tags '[:mb/once]'"
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
@@ -153,39 +163,6 @@ jobs:
         aws-region: ${{ vars.AWS_REGION }}
         trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
 
-  be-google-related-drivers-classpath-test:
-    needs: files-changed
-    if: github.event.pull_request.draft == false && needs.files-changed.outputs.backend_all == 'true'
-    runs-on: ubuntu-22.04
-    timeout-minutes: 90
-    env:
-      CI: 'true'
-      DRIVERS: 'googleanalytics,bigquery-cloud-sdk'
-      MB_BIGQUERY_TEST_PROJECT_ID: ${{ secrets.BIGQUERY_TEST_PROJECT_ID }}
-      MB_BIGQUERY_TEST_CLIENT_ID: ${{ secrets.MB_BIGQUERY_TEST_CLIENT_ID }}
-      MB_BIGQUERY_TEST_CLIENT_SECRET: ${{ secrets.MB_BIGQUERY_TEST_CLIENT_SECRET }}
-      MB_BIGQUERY_TEST_ACCESS_TOKEN: ${{ secrets.MB_BIGQUERY_TEST_ACCESS_TOKEN }}
-      MB_BIGQUERY_TEST_REFRESH_TOKEN: ${{ secrets.MB_BIGQUERY_TEST_REFRESH_TOKEN }}
-      MB_BIGQUERY_CLOUD_SDK_TEST_SERVICE_ACCOUNT_JSON: ${{ secrets.MB_BIGQUERY_CLOUD_SDK_TEST_SERVICE_ACCOUNT_JSON }}
-    steps:
-    - uses: actions/checkout@v4
-    - name: Test Google Related Drivers Classpath
-      uses: ./.github/actions/test-driver
-      with:
-        junit-name: 'be-google-related-drivers-classpath-test'
-        test-args: ':only "[metabase.query-processor-test.expressions-test metabase.driver.google-test metabase.driver.googleanalytics-test]"'
-    - name: Upload Test Results
-      uses: ./.github/actions/upload-test-results
-      if: always()
-      with:
-        input-path: ./target/junit/
-        output-name: ${{ github.job }}
-        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
-        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
-        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
-        aws-region: ${{ vars.AWS_REGION }}
-        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
-
   be-tests-mariadb-10-2-ee:
     needs: files-changed
     if: github.event.pull_request.draft == false && needs.files-changed.outputs.backend_all == 'true'
@@ -281,7 +258,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-mongo-4-4-ee'
-        test-args: ":exclude-tags '[:mb/once]'"
+        test-args: ":exclude-tags '[:mb/once :mongo-sharded-cluster-tests]'"
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -327,7 +304,7 @@ jobs:
         uses: ./.github/actions/test-driver
         with:
           junit-name: 'be-tests-mongo-4-4-ee'
-          test-args: ":exclude-tags '[:mb/once]'"
+          test-args: ":exclude-tags '[:mb/once :mongo-sharded-cluster-tests]'"
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
         if: always()
@@ -361,7 +338,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-mongo-5-0-ee'
-        test-args: ":exclude-tags '[:mb/once]'"
+        test-args: ":exclude-tags '[:mb/once :mongo-sharded-cluster-tests]'"
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -407,7 +384,7 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-mongo-5-0-ee'
-        test-args: ":exclude-tags '[:mb/once]'"
+        test-args: ":exclude-tags '[:mb/once :mongo-sharded-cluster-tests]'"
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -444,7 +421,39 @@ jobs:
       uses: ./.github/actions/test-driver
       with:
         junit-name: 'be-tests-mongo-latest-ee'
-        test-args: ":exclude-tags '[:mb/once]'"
+        test-args: ":exclude-tags '[:mb/once :mongo-sharded-cluster-tests]'"
+    - name: Upload Test Results
+      uses: ./.github/actions/upload-test-results
+      if: always()
+      with:
+        input-path: ./target/junit/
+        output-name: ${{ github.job }}
+        bucket: ${{ vars.AWS_S3_TEST_RESULTS_BUCKET }}
+        aws-access-key-id: ${{ secrets.AWS_TEST_RESULTS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_TEST_RESULTS_SECRET_ACCESS_KEY }}
+        aws-region: ${{ vars.AWS_REGION }}
+        trunk-api-token: ${{ secrets.TRUNK_API_TOKEN }}
+
+  be-tests-mongo-sharded-cluster-ee:
+    needs: files-changed
+    if: github.event.pull_request.draft == false && needs.files-changed.outputs.backend_all == 'true'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 90
+    env:
+      CI: 'true'
+      DRIVERS: mongo
+    services:
+      mongodb:
+        image: metabase/mongo-sharded-cluster:6
+        ports:
+          - "27017:17017"
+    steps:
+    - uses: actions/checkout@v4
+    - name: Test MongoDB driver (Sharded cluster)
+      uses: ./.github/actions/test-driver
+      with:
+        junit-name: 'be-tests-mongo-sharded-cluster-ee'
+        test-args: ':only "[metabase.driver.mongo.sharded-cluster-test]"'
     - name: Upload Test Results
       uses: ./.github/actions/upload-test-results
       if: always()
@@ -800,6 +809,11 @@ jobs:
       MB_SNOWFLAKE_TEST_WAREHOUSE: ${{ secrets.MB_SNOWFLAKE_TEST_WAREHOUSE }}
       MB_SNOWFLAKE_TEST_PK_USER: METABASE PK
       MB_SNOWFLAKE_TEST_PK_PRIVATE_KEY: ${{ secrets.MB_SNOWFLAKE_TEST_PK_PRIVATE_KEY }}
+      # RSA Role testing:
+      MB_SNOWFLAKE_TEST_RSA_ROLE_TEST_DEFAULT_USER: RSA_ROLE_TEST_DEFAULT_USER
+      MB_SNOWFLAKE_TEST_RSA_ROLE_TEST_CUSTOM_USER: RSA_ROLE_TEST_CUSTOM_USER
+      MB_SNOWFLAKE_TEST_RSA_ROLE_TEST_ROLE: RSA_ROLE_TEST_ROLE
+      MB_SNOWFLAKE_TEST_RSA_ROLE_TEST_DB: RSA_ROLE_TEST_DB
     steps:
     - uses: actions/checkout@v4
     - name: Test Snowflake driver

.github/workflows/e2e-cross-version.yml

@@ -2,15 +2,36 @@ name: E2E Cross-version Tests
 
 on:
   schedule:
-    - cron: '0 9 * * 0'
+    - cron: '0 9 * * 1-5'
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
 
 jobs:
-  cross-version-testing:
+  files-changed:
+    name: Check which files changed
     runs-on: ubuntu-22.04
-    timeout-minutes: 60
+    timeout-minutes: 3
+    outputs:
+      e2e_cross_version: ${{ steps.changes.outputs.e2e_cross_version }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Test which files changed
+        uses: dorny/paths-filter@v3.0.0
+        id: changes
+        with:
+          token: ${{ github.token }}
+          filters: .github/file-paths.yaml
+
+  cross-version-testing:
+    needs: files-changed
+    if: ${{ needs.files-changed.outputs.e2e_cross_version == 'true' || github.event_name == 'schedule'}}
+    runs-on: ubuntu-22.04
+    timeout-minutes: 20
     strategy:
       matrix:
         version: [
+          # Major OSS upgrade
+          { source: v0.42.2, target: v0.48.7 },
           # OSS upgrade
           { source: v0.41.3.1, target: v0.42.2 },
           # EE upgrade
@@ -50,11 +71,12 @@ jobs:
     - name: Wait for Metabase to start on port 3000
       run: while ! curl -s 'http://localhost:3000/api/health' | grep '{"status":"ok"}'; do sleep 1; done
     - name: Prepare Cypress environment
+      id: cypress-prep
       uses: ./.github/actions/prepare-cypress
     - name: Run Cypress on the source
       run: |
         yarn cypress run \
-          --browser chrome \
+          --browser ${{ steps.cypress-prep.outputs.chrome-path }} \
           --config-file e2e/test/scenarios/cross-version/source/shared/cross-version-source.config.js \
           --spec e2e/test/scenarios/cross-version/source/**/*.cy.spec.js
     - name: Stop Metabase ${{ matrix.version.source }}
@@ -82,7 +104,7 @@ jobs:
     - name: Run Cypress on the target
       run: |
         yarn cypress run \
-          --browser chrome \
+          --browser ${{ steps.cypress-prep.outputs.chrome-path }} \
           --config-file e2e/test/scenarios/cross-version/target/shared/cross-version-target.config.js \
           --spec e2e/test/scenarios/cross-version/target/**/*.cy.spec.js
     - name: Upload Cypress Artifacts upon failure
@@ -93,3 +115,51 @@ jobs:
         path: |
           ./cypress
         if-no-files-found: ignore
+  notify-on-failure:
+    needs: cross-version-testing
+    if: ${{ always() && contains(needs.*.result, 'failure') && github.event_name == 'schedule' }}
+    name: Cross-version test failure
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    steps:
+      - uses: actions/setup-node@v4
+        with:
+          node-version: lts/Hydrogen # 18.x.x
+      - run: npm install @slack/web-api
+      - name: notify slack of failure
+        uses: actions/github-script@v7
+        with:
+          script: | # js
+            const FAILED_RUN_URL = "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}";
+            const REF_NAME = "${{ github.ref_name }}";
+
+            // notify slack of failure
+            const { WebClient } = require('@slack/web-api');
+            const slack = new WebClient('${{ secrets.SLACK_BOT_TOKEN }}');
+
+            await slack.chat.postMessage({
+              channel: 'engineering-ci',
+              text: 'Cross-version Tests Have Failed',
+              blocks: [
+                {
+                  "type": "header",
+                  "text": {
+                    "type": "plain_text",
+                    "text": `:broken_heart:   Cross-version tests are failing on ${REF_NAME}`,
+                    "emoji": true,
+                  }
+                },
+              ],
+              attachments: [{
+                color: "#BF40BF",
+                blocks: [
+                  {
+                    "type": "section",
+                    "text": {
+                      "type": "mrkdwn",
+                      "text": `See <${FAILED_RUN_URL}|failing run details>.`
+                    }
+                  },
+                ]
+              }]
+            });

.github/workflows/e2e-stress-test-flake-fix.yml

@@ -20,6 +20,15 @@ on:
         type: string
         required: false
         default: "ee"
+      qa_db:
+        description: 'Select the type of Database you want to run your tests with'
+        type: choice
+        required: true
+        default: "none"
+        options:
+          - none
+          - sql
+          - mongo
 
 jobs:
   workflow-summary:
@@ -35,6 +44,7 @@ jobs:
           echo '- `spec`: ${{ inputs.spec }}' >> $GITHUB_STEP_SUMMARY
           echo '- `burn_in`: ${{ inputs.burn_in }}' >> $GITHUB_STEP_SUMMARY
           echo '- `grep`: "${{ inputs.grep }}"' >> $GITHUB_STEP_SUMMARY
+          echo '- `qa_db`: "${{ inputs.qa_db }}"' >> $GITHUB_STEP_SUMMARY
           echo '' >> $GITHUB_STEP_SUMMARY
           echo 'triggered by: @${{ github.event.sender.login }}' >> $GITHUB_STEP_SUMMARY
 
@@ -44,8 +54,8 @@ jobs:
     name: Stress test E2E flake fix
     env:
       DISPLAY: ""
-      QA_DB_ENABLED: true
-      CYPRESS_REPLAYIO_ENABLED: 1
+      QA_DB_ENABLED: ${{ contains(fromJSON('["sql", "mongo"]'), inputs.qa_db) }}
+      CYPRESS_QA_DB_MONGO: ${{ inputs.qa_db == 'mongo' }}
       CYPRESS_ALL_FEATURES_TOKEN: ${{ secrets.ENTERPRISE_TOKEN }}
       CYPRESS_NO_FEATURES_TOKEN: ${{ secrets.E2E_STARTER_TOKEN }}
       MB_SNOWPLOW_AVAILABLE: true
@@ -66,9 +76,9 @@ jobs:
           password: ${{ secrets.DOCKERHUB_TOKEN }}
           maildev: true
           openldap: true
-          postgres: true
-          mysql: true
-          mongo: true
+          postgres: ${{ inputs.qa_db == 'sql' }}
+          mysql: ${{ inputs.qa_db == 'sql' }}
+          mongo: ${{ inputs.qa_db == 'mongo' }}
 
       - name: Download Metabase ${{ matrix.edition }} uberjar
         uses: ./.github/actions/e2e-download-uberjar
@@ -83,6 +93,7 @@ jobs:
           java-version: 11
           distribution: "temurin"
       - name: Prepare Cypress environment
+        id: cypress-prep
         uses: ./.github/actions/prepare-cypress
       - name: Run Snowplow micro
         uses: ./.github/actions/run-snowplow-micro
@@ -95,7 +106,7 @@ jobs:
           --spec '${{ github.event.inputs.spec }}' \
           --env burn=${{ github.event.inputs.burn_in }},grep='${{ github.event.inputs.grep }}' \
           --config-file e2e/support/cypress-stress-test.config.js \
-          --browser 'replay-chromium'
+          --browser ${{ steps.cypress-prep.outputs.chrome-path }}
 
       - name: Upload Cypress Artifacts upon failure
         uses: actions/upload-artifact@v4

.github/workflows/e2e-tests.yml

@@ -4,7 +4,7 @@ on:
   push:
     branches:
       - "master"
-      - 'release-**'
+      - "release-**"
   pull_request:
     types: [opened, synchronize, reopened, ready_for_review]
 
@@ -39,8 +39,39 @@ jobs:
         id: e2e-matrix
         uses: ./.github/actions/build-e2e-matrix
 
+  # if this is a test on a release branch, we need to check the build requirements
+  get-build-requirements:
+    if: |
+      !cancelled() &&
+      contains(github.ref, 'release-x')
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    outputs:
+      java_version: ${{ fromJson(steps.dependencies.outputs.result).java_version }}
+      node_version: ${{ fromJson(steps.dependencies.outputs.result).node_version }}
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        sparse-checkout: release
+    - name: Prepare build scripts
+      run: cd ${{ github.workspace }}/release && yarn && yarn build
+    - name: Get build dependencies
+      uses: actions/github-script@v7
+      id: dependencies
+      with:
+        script: | # js
+          const { getBuildRequirements, getVersionFromReleaseBranch } = require('${{ github.workspace }}/release/dist/index.cjs');
+
+          const version = getVersionFromReleaseBranch('${{ github.ref }}');
+          const requirements = getBuildRequirements(version);
+
+          return {
+            java_version: requirements.java,
+            node_version: requirements.node,
+          };
+
   build:
-    needs: [files-changed, e2e-matrix-builder]
+    needs: [files-changed, e2e-matrix-builder, get-build-requirements]
     if: |
       !cancelled() &&
       github.event.pull_request.draft == false &&
@@ -54,14 +85,19 @@ jobs:
     env:
       MB_EDITION: ${{ matrix.edition }}
       INTERACTIVE: false
+      # make sure that builds on release branches get licenses, because we use them for releases
+      SKIP_LICENSES: ${{ github.event_name == 'pull_request' }}
     steps:
       - uses: actions/checkout@v4
       - name: Prepare front-end environment
         uses: ./.github/actions/prepare-frontend
+        with:
+          node-version: '${{ needs.get-build-requirements.outputs.node_version }}'
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
         with:
           m2-cache-key: e2e-tests
+          java-version: '${{ needs.get-build-requirements.outputs.java_version || 11 }}'
 
       - name: Build uberjar with ./bin/build.sh
         run: ./bin/build.sh
@@ -87,13 +123,9 @@ jobs:
       CYPRESS_ALL_FEATURES_TOKEN: ${{ secrets.ENTERPRISE_TOKEN }}
       CYPRESS_NO_FEATURES_TOKEN: ${{ secrets.E2E_STARTER_TOKEN }}
       CYPRESS_PULL_REQUEST_ID: ${{ github.event.pull_request.number || '' }}
-      COMMIT_INFO_MESSAGE : ${{ github.event.pull_request.title || github.event.head_commit.message || github.even.head.sha }}
+      COMMIT_INFO_MESSAGE: ${{ github.event.pull_request.title || github.event.head_commit.message || github.even.head.sha }}
       MB_SNOWPLOW_AVAILABLE: true
       MB_SNOWPLOW_URL: "http://localhost:9090" # Snowplow micro
-      CYPRESS_REPLAYIO_ENABLED: 1
-      RECORD_REPLAY_METADATA_FILE: /tmp/replay-metadata.json
-      RECORD_REPLAY_METADATA_TEST_RUN_ID: ${{ github.run_id }}
-      REPLAY_API_KEY: ${{ secrets.REPLAY_IO_TOKEN }}
       TZ: US/Pacific # to make node match the instance tz
     strategy:
       fail-fast: false
@@ -133,6 +165,7 @@ jobs:
           distribution: "temurin"
 
       - name: Prepare Cypress environment
+        id: cypress-prep
         uses: ./.github/actions/prepare-cypress
 
       - name: Run Snowplow micro
@@ -143,24 +176,24 @@ jobs:
         run: |
           yarn run test-cypress-run \
           --env grepTags=@OSS,grepOmitFiltered=true \
-          --spec './e2e/test/scenarios/**/*.cy.spec.js' \
-          --browser 'replay-chromium'
+          --spec './e2e/test/scenarios/**/*.cy.spec.(js|ts)' \
+          --browser ${{ steps.cypress-prep.outputs.chrome-path }}
 
       - name: Run slow and resource-intensive Cypress tests
         if: matrix.name == 'slow' && github.event_name != 'schedule'
         run: |
           yarn run test-cypress-run \
           --env grepTags="@slow",grepOmitFiltered=true \
-          --spec './e2e/test/scenarios/**/*.cy.spec.js' \
-          --browser 'replay-chromium'
+          --spec './e2e/test/scenarios/**/*.cy.spec.(js|ts)' \
+          --browser ${{ steps.cypress-prep.outputs.chrome-path }}
 
       - name: Run Flaky Cypress tests
         if: matrix.name == 'flaky' && github.event_name != 'schedule'
         run: |
           yarn run test-cypress-run \
-          --env grepTags="@flaky",grepOmitFiltered=true \
-          --spec './e2e/test/scenarios/**/*.cy.spec.js' \
-          --browser 'replay-chromium'
+          --env grepTags="@flaky --@quarantine",grepOmitFiltered=true \
+          --spec './e2e/test/scenarios/**/*.cy.spec.(js|ts)' \
+          --browser ${{ steps.cypress-prep.outputs.chrome-path }}
 
       - name: Run EE Cypress tests on ${{ matrix.name }}
         if: matrix.context == 'folder' && github.event_name != 'schedule'
@@ -168,18 +201,33 @@ jobs:
           yarn run test-cypress-run \
           --env grepTags="-@slow+-@mongo+-@flaky --@quarantine",grepOmitFiltered=true \
           --folder ${{ matrix.name }} \
-          --browser 'replay-chromium'
+          --browser ${{ steps.cypress-prep.outputs.chrome-path }}
 
       - name: Run E2E tests that depend on Mongo
         if: matrix.name == 'mongo'
         run: |
           yarn run test-cypress-run \
           --env grepTags="@mongo --@quarantine",grepOmitFiltered=true \
-          --spec './e2e/test/scenarios/**/*.cy.spec.js' \
-          --browser 'replay-chromium'
+          --spec './e2e/test/scenarios/**/*.cy.spec.(js|ts)' \
+          --browser ${{ steps.cypress-prep.outputs.chrome-path }}
         env:
           CYPRESS_QA_DB_MONGO: true
 
+      - name: Run Embedding SDK Storybook
+        if: matrix.context == 'embedding-sdk' && github.event_name != 'schedule'
+        uses: ./.github/actions/run-embedding-sdk-storybook
+
+      - name: Run E2E tests for Embedding SDK
+        if: matrix.context == 'embedding-sdk' && github.event_name != 'schedule'
+        run: |
+          yarn run test-cypress-run \
+          --env grepTags="-@slow+-@flaky --@quarantine",grepOmitFiltered=true \
+          --folder 'embedding-sdk' \
+          --browser ${{ steps.cypress-prep.outputs.chrome-path }}
+        env:
+          CYPRESS_IS_EMBEDDING_SDK: true
+        shell: bash
+
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
         if: always()
@@ -217,46 +265,10 @@ jobs:
       - run: |
           echo "Didn't run due to conditional filtering"
 
-  visual-regression-tests:
-    runs-on: ubuntu-22.04
-    timeout-minutes: 60
+  pr-env:
     needs: [build]
     if: |
-      !cancelled() && needs.build.result == 'success'
-    name: percy-visual-regression-tests
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Prepare Docker containers
-        uses: ./.github/actions/e2e-prepare-containers
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-          maildev: true
-
-      - name: Retrieve uberjar artifact for ${{ matrix.edition }}
-        uses: actions/download-artifact@v4
-        with:
-          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
-
-      - name: Get the version info
-        run: |
-          jar xf target/uberjar/metabase.jar version.properties
-          mv version.properties resources/
-
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-
-      - name: Prepare JDK 11
-        uses: actions/setup-java@v4
-        with:
-          java-version: 11
-          distribution: 'temurin'
-
-      - name: Prepare Cypress environment
-        uses: ./.github/actions/prepare-cypress
-
-      - name: Percy Test
-        run: yarn run test-visual-run
-        env:
-          PERCY_TOKEN: ${{ github.ref == 'refs/heads/master' && secrets.PERCY_TOKEN || ''}}
+      !cancelled() &&
+      contains(github.event.pull_request.labels.*.name, 'PR-Env')
+    uses: ./.github/workflows/pr-env.yml
+    secrets: inherit

.github/workflows/embedding-sdk.yml

@@ -0,0 +1,39 @@
+name: Embedding SDK
+
+on:
+  push:
+    branches:
+      - "master"
+      - "release-**"
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  sdk-build:
+    if: contains(github.event.pull_request.labels.*.name, 'embedding-sdk-build')
+    runs-on: ubuntu-22.04
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: "cljs"
+      - name: Build SDK bundle
+        run: yarn run build-embedding-sdk
+      - name: Generate SDK package.json
+        run: yarn run embedding-sdk:generate-package "$GITHUB_SHA"
+      - name: Generate .npmrc for Github npm registry
+        uses: actions/setup-node@v4
+        with:
+          registry-url: "https://npm.pkg.github.com"
+      - name: Publish package
+        run: yarn run embedding-sdk:publish
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/flake-issue-creator.yml

@@ -0,0 +1,34 @@
+name: Flake Issue Creator
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 6 * * 1-5' # every weekday at 1am US eastern time
+
+jobs:
+  flake-issue-creator:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        sparse-checkout: release
+    - name: Prepare build scripts
+      run: cd ${{ github.workspace }}/release && yarn --frozen-lockfile && yarn build
+    - name: Update flake issues
+      uses: actions/github-script@v7
+      env:
+        SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+      with:
+        script: | # js
+          const { updateFlakeIssues } = require('${{ github.workspace }}/release/dist/index.cjs');
+
+          if (!process.env.SLACK_BOT_TOKEN) {
+            throw new Error('SLACK_BOT_TOKEN is required');
+          }
+
+          await updateFlakeIssues({
+            github,
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+          });

.github/workflows/flake-status.yml

@@ -0,0 +1,35 @@
+name: Flake Status Report
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 6 * * 2,5' # Tuesdays and Fridays at 1am US eastern time
+
+jobs:
+  flake-status-report:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        sparse-checkout: release
+    - name: Prepare build scripts
+      run: cd ${{ github.workspace }}/release && yarn --frozen-lockfile && yarn build
+    - name: Post Flake Status Report
+      uses: actions/github-script@v7
+      env:
+        SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+      with:
+        script: | # js
+          const { summarizeFlakes } = require('${{ github.workspace }}/release/dist/index.cjs');
+
+          if (!process.env.SLACK_BOT_TOKEN) {
+            throw new Error('SLACK_BOT_TOKEN is required');
+          }
+
+          await summarizeFlakes({
+            github,
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+            channelName: 'engineering-ci'
+          });

.github/workflows/frontend-unit-test-stress-test-flake-fix.yml

@@ -4,15 +4,15 @@ on:
   workflow_dispatch:
     inputs:
       spec:
-        description: 'Relative path of the target spec'
+        description: "Relative path of the target spec"
         type: string
         required: true
       burn_in:
-        description: 'Number of times to run the test (e.g. 20)'
+        description: "Number of times to run the test (e.g. 20)"
         type: string
         required: true
       grep:
-        description: 'Grep and filter tests to run in isolation'
+        description: "Grep and filter tests to run in isolation"
         type: string
         required: false
 
@@ -45,10 +45,12 @@ jobs:
         uses: ./.github/actions/prepare-backend
         with:
           m2-cache-key: "cljs"
+      - name: Build cljs
+        run: yarn build:cljs
       - name: Stress-test ${{ github.event.inputs.spec }} ${{ github.event.inputs.burn_in }} times
         run: |
           for i in {1..${{ github.event.inputs.burn_in }}}; do
-            yarn test-unit \
+            yarn jest --runInBand --ci --silent --no-cache \
               --testPathPattern '${{ github.event.inputs.spec }}' \
               --testNamePattern '${{ github.event.inputs.grep }}'
             if [[ "$?" != 0 ]]; then

.github/workflows/frontend.yml

@@ -70,7 +70,7 @@ jobs:
   fe-tests-unit:
     needs: files-changed
     if: github.event.pull_request.draft == false && needs.files-changed.outputs.frontend_all == 'true'
-    runs-on: buildjet-2vcpu-ubuntu-2204
+    runs-on: ubuntu-22.04
     timeout-minutes: 60
     env:
       JEST_JUNIT_OUTPUT_DIR: ./target/junit
@@ -91,10 +91,11 @@ jobs:
         run: yarn run test-unit --silent
       - name: Upload coverage to codecov.io
         if: github.ref_name == 'master'
-        uses: codecov/codecov-action@v3
+        uses: codecov/codecov-action@v4
         with:
           files: ./coverage/lcov.info
           flags: front-end
+          token: ${{ secrets.CODECOV_TOKEN }}
       - name: Upload Test Results
         uses: ./.github/actions/upload-test-results
         if: always()

.github/workflows/loki-update.yml

@@ -0,0 +1,67 @@
+name: Update Loki Snapshots
+
+on:
+  pull_request:
+    types: [labeled]
+
+jobs:
+  check-label-and-update-snapshot:
+    if: contains(github.event.pull_request.labels.*.name, 'loki-update')
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+          ref: ${{ github.head_ref }}
+
+      - name: Prepare frontend environment
+        uses: ./.github/actions/prepare-frontend
+
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: "cljs"
+
+      - name: Compile CLJS
+        run: yarn build-pure:cljs
+
+      - name: Build Storybook
+        run: yarn build-storybook
+
+      - name: Serve Storybook
+        run: yarn http-server storybook-static -p 6006 &
+        shell: bash
+
+      - name: Wait for Storybook to become available
+        run: |
+          echo "Waiting for Storybook to be served..."
+          while ! curl --silent --fail http://localhost:6006; do
+            sleep 5
+            echo "Retrying..."
+          done
+          echo "Storybook is being served!"
+
+      - name: Update Loki Snapshots
+        run: yarn test-visual:loki-update
+
+      - name: Commit and Push Changes
+        run: |
+          git config --global user.name "Metabase Automation"
+          git config --global user.email "github-automation@metabase.com"
+          git add .loki/**
+          git commit -m "Update Loki Snapshots"
+          git push
+        env:
+          GITHUB_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+      - name: Remove 'loki-update' label
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{secrets.METABASE_AUTOMATION_USER_TOKEN}}
+          script: |
+            github.issues.removeLabel({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              name: 'loki-update'
+            })

.github/workflows/loki.yml

@@ -0,0 +1,85 @@
+name: Loki Visual Regression Testing
+
+on: [pull_request]
+
+jobs:
+  files-changed:
+    name: Check which files changed
+    runs-on: ubuntu-22.04
+    timeout-minutes: 3
+    outputs:
+      frontend_ci: ${{ steps.changes.outputs.frontend_ci }}
+      frontend_sources: ${{ steps.changes.outputs.frontend_sources }}
+      frontend_loki_ci: ${{ steps.changes.outputs.frontend_loki_ci }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Test which files changed
+        uses: dorny/paths-filter@v3.0.0
+        id: changes
+        with:
+          token: ${{ github.token }}
+          filters: .github/file-paths.yaml
+
+  visual-test:
+    needs: files-changed
+    if: needs.files-changed.outputs.frontend_ci == 'true' || needs.files-changed.outputs.frontend_sources == 'true' || needs.files-changed.outputs.frontend_loki_ci == 'true'
+    runs-on: ubuntu-latest
+    services:
+      docker:
+        image: docker:19.03.12
+        options: --privileged
+        ports:
+          - 2376:2376
+        env:
+          DOCKER_TLS_CERTDIR: /certs
+        volumes:
+          - /var/run/docker.sock:/var/run/docker.sock
+          - /tmp/docker-certs:/certs/client
+
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v4
+
+      - name: Prepare frontend environment
+        uses: ./.github/actions/prepare-frontend
+
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: "cljs"
+
+      - name: Compile CLJS
+        run: yarn build-pure:cljs
+
+      - name: Build Storybook
+        run: yarn build-storybook
+
+      - name: Serve Storybook
+        run: yarn http-server storybook-static -p 6006 &
+        shell: bash
+
+      - name: Wait for Storybook to become available
+        run: |
+          echo "Waiting for Storybook to be served..."
+          while ! curl --silent --fail http://localhost:6006; do
+            sleep 5
+            echo "Retrying..."
+          done
+          echo "Storybook is being served!"
+
+      - name: Run Loki Visual Tests
+        run: |
+          yarn test-visual:loki
+
+      - name: Generate Visual Report on Failure
+        if: failure()
+        run: yarn test-visual:loki-report
+
+      - name: Upload Artifact
+        id: artifact-upload-step
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: loki-report
+          path: .loki/
+          if-no-files-found: ignore

.github/workflows/mbql-library-changelog.yml

@@ -0,0 +1,32 @@
+name: Update changelog for MBQL library changes
+on:
+  pull_request:
+    types:
+      - opened
+      - reopened
+      - labeled
+      - unlabeled
+      - synchronize
+    paths:
+      - src/metabase/lib/js.cljs
+jobs:
+  mbql-library-changelog-check:
+    runs-on: ubuntu-latest
+    if: ${{ !contains( github.event.pull_request.labels.*.name, '.metabase-lib/no-change' ) }}
+    steps:
+      # - uses: jesusvasquez333/verify-pr-label-action@v1.4.0
+      #   with:
+      #     github-token: '${{ secrets.GITHUB_TOKEN }}'
+      #     valid-labels: '.metabase-lib/no-change'
+      #     disable-reviews: true
+      - uses: actions/checkout@v4
+      - name: Check for updated MBQL library changelog
+        run: |
+          if [[ $(git show HEAD -- docs/developers-guide/mbql-library-changelog.md) ]]; then
+            echo "Library and changelog updated together - all good"
+          else
+            echo "metabase.lib.js namespace changed but docs/developers/guide/mbql-library-changelog.md did not"
+            echo "Update the changelog with the changes made to the library's API."
+            echo "If the edits did not change the API, add the `.metabase-lib/no-change` label."
+            exit 1
+          fi

.github/workflows/migrations.yml

@@ -1,4 +1,4 @@
-name: Migrations
+name: Lint migrations
 
 on:
   push:
@@ -9,14 +9,14 @@ on:
 
 jobs:
 
-  check-migrations:
+  lint-migrations:
     runs-on: ubuntu-22.04
     timeout-minutes: 15
     steps:
-    - uses: actions/checkout@v4
-    - name: Prepare back-end environment
-      uses: ./.github/actions/prepare-backend
-      with:
-        m2-cache-key: check-migrations
-    - name: Verify Liquibase Migrations
-      run: ./bin/lint-migrations-file.sh
+      - uses: actions/checkout@v4
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: lint-migrations
+      - name: Verify Liquibase Migrations
+        run: ./bin/lint-migrations-file.sh

.github/workflows/percy-issue-comment.yml

@@ -1,91 +0,0 @@
-# Triggers Percy job by "@metabase-bot run visual tests" comment in a PR
-name: PercyIssueComment
-
-on:
-  issue_comment:
-    types: [created]
-
-jobs:
-  pr_info:
-    if: github.event.comment.body == '@metabase-bot run visual tests'
-    runs-on: ubuntu-22.04
-    outputs:
-      pull_request_number: ${{ fromJson(steps.fetch_pr.outputs.data).head.number }}
-      branch_name: ${{ fromJson(steps.fetch_pr.outputs.data).head.ref }}
-      commit_sha: ${{ fromJson(steps.fetch_pr.outputs.data).head.sha }}
-    steps:
-      - uses: tibdex/github-app-token@v2.1.0
-        id: generate-token
-        with:
-          app_id: ${{ secrets.METABASE_BOT_APP_ID }}
-          private_key: ${{ secrets.METABASE_BOT_APP_PRIVATE_KEY }}
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ needs.pr_info.outputs.branch_name }}
-          token: ${{ secrets.GITHUB_TOKEN }}
-      - name: Verify Membership
-        id: verify-membership
-        uses: ./.github/actions/verify-membership
-        with:
-          github_token: ${{ steps.generate-token.outputs.token }}
-          organization_name: metabase
-          username: ${{ github.event.comment.user.login }}
-      - run: |
-          result=${{ steps.verify-membership.outputs.is_member }}
-          if [ $result == false ]; then
-              echo User ${{ github.event.comment.user.login }} is not a member of Metabase organization
-              exit 1
-          fi
-      - name: Fetch issue
-        uses: octokit/request-action@v2.x
-        id: fetch_issue
-        with:
-          route: GET ${{ github.event.issue.url }}
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - name: Fetch PR
-        uses: octokit/request-action@v2.x
-        id: fetch_pr
-        with:
-          route: GET ${{ fromJson(steps.fetch_issue.outputs.data).pull_request.url }}
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-  percy:
-    timeout-minutes: 30
-    runs-on: buildjet-4vcpu-ubuntu-2004
-    needs: [pr_info]
-    env:
-      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      MB_EDITION: ee
-      CYPRESS_ALL_FEATURES_TOKEN: ${{ secrets.ENTERPRISE_TOKEN }}
-      CYPRESS_NO_FEATURES_TOKEN: ${{ secrets.E2E_STARTER_TOKEN }}
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ needs.pr_info.outputs.branch_name }}
-          token: ${{ secrets.GITHUB_TOKEN }}
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-      - name: Prepare back-end environment
-        uses: ./.github/actions/prepare-backend
-        with:
-          m2-cache-key: percy-issue-comment
-
-      - name: Prepare cypress environment
-        uses: ./.github/actions/prepare-cypress
-      - run: ./bin/build.sh
-      - name: Get the version info
-        run: |
-          jar xf target/uberjar/metabase.jar version.properties
-          mv version.properties resources/
-      - name: Run maildev
-        run: docker run -d -p 1080:1080 -p 1025:1025 maildev/maildev:2.0.5
-      - name: Percy Test
-        run: yarn run test-visual-run
-        env:
-          PERCY_TOKEN: ${{ secrets.PERCY_TOKEN }}
-          PERCY_COMMIT: ${{ needs.pr_info.outputs.commit_sha }}
-          PERCY_BRANCH: ${{ needs.pr_info.outputs.branch_name }}
-          PERCY_PULL_REQUEST: ${{ needs.pr_info.outputs.pull_request_number }}

.github/workflows/percy-visual-label.yml

@@ -1,39 +0,0 @@
-# Triggers Percy job on pull requests that contain "visual" label
-name: Percy visual tests
-
-on:
-  pull_request:
-    types: [synchronize, labeled]
-
-jobs:
-  percy:
-    if: contains(github.event.pull_request.labels.*.name, 'visual')
-    timeout-minutes: 30
-    runs-on: buildjet-4vcpu-ubuntu-2004
-    env:
-      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      MB_EDITION: ee
-      CYPRESS_ALL_FEATURES_TOKEN: ${{ secrets.ENTERPRISE_TOKEN }}
-      CYPRESS_NO_FEATURES_TOKEN: ${{ secrets.E2E_STARTER_TOKEN }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Prepare front-end environment
-        uses: ./.github/actions/prepare-frontend
-      - name: Prepare back-end environment
-        uses: ./.github/actions/prepare-backend
-        with:
-          m2-cache-key: percy-visual-label
-      - name: Prepare cypress environment
-        uses: ./.github/actions/prepare-cypress
-      - run: ./bin/build.sh
-      - name: Get the version info
-        run: |
-          jar xf target/uberjar/metabase.jar version.properties
-          mv version.properties resources/
-      - name: Run maildev
-        run: docker run -d -p 1080:1080 -p 1025:1025 maildev/maildev:2.0.5
-      - name: Percy Test
-        run: yarn run test-visual-run
-        env:
-          PERCY_TOKEN: ${{ secrets.PERCY_TOKEN }}

.github/workflows/pr-env-close-unlabel.yml

@@ -0,0 +1,15 @@
+name: PR Closed or Unlabeled
+
+on:
+  pull_request:
+    types: [ closed, unlabeled ]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  pr-env:
+    if: ${{ github.event.action == 'closed' && contains(github.event.pull_request.labels.*.name, 'PR-Env') || github.event.label.name == 'PR-Env' }}
+    uses: ./.github/workflows/pr-env-destroy.yml
+    secrets: inherit

.github/workflows/pr-env-destroy.yml

@@ -0,0 +1,71 @@
+name: CI for PR Review ENV Destroy
+run-name: Destroying Dynamic PR Environment for ${{ github.ref_name }} by @${{ github.actor }}
+
+on:
+  workflow_call:
+
+jobs:
+  destroy_pr:
+    runs-on: ubuntu-latest
+    name: PR Review ENV Destroy
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - name: Checkout source code
+        uses: actions/checkout@v4
+      - name: Tailscale
+        uses: tailscale/github-action@v2
+        with:
+          oauth-client-id: ${{ secrets.PR_ENV_TAILSCALE_OAUTH_CLIENT_ID }}
+          oauth-secret: ${{ secrets.PR_ENV_TAILSCALE_OAUTH_SECRET }}
+          tags: tag:ci
+          version: 1.50.1
+          sha256sum: d9fe6b480fb5078f0aa57dace686898dda7e2a768884271159faa74846bfb576
+      - name: Create OIDC Token
+        id: create-oidc-token
+        shell: bash
+        run: |
+          export OIDC_URL_WITH_AUDIENCE="$ACTIONS_ID_TOKEN_REQUEST_URL&audience=${{ secrets.PR_ENV_K8S_AUDIENCE }}"
+          IDTOKEN=$(curl -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" -H "Accept: application/json; api-version=2.0" "$OIDC_URL_WITH_AUDIENCE" | jq -r .value)
+          echo "::add-mask::${IDTOKEN}"
+          echo "idToken=${IDTOKEN}" >>$GITHUB_OUTPUT
+      - name: Setup Kube Context
+        uses: azure/k8s-set-context@v2
+        with:
+          method: kubeconfig
+          kubeconfig: |
+            kind: Config
+            apiVersion: v1
+            current-context: default
+            clusters:
+            - name: default
+              cluster:
+                certificate-authority-data: ${{ secrets.PR_ENV_K8S_CERTIFICATE_AUTHORITY_DATA }}
+                server: ${{ secrets.PR_ENV_K8S_SERVER }}
+            users:
+            - name: oidc-token
+              user:
+                token: ${{ steps.create-oidc-token.outputs.IDTOKEN }}
+            contexts:
+            - name: default
+              context:
+                cluster: default
+                namespace: default
+                user: oidc-token
+      - name: Destroy PR Review ENV
+        run: |
+          kubectl delete metabase -n hosting-pr${{ github.event.number }} hosting-pr${{ github.event.number }}
+          kubectl delete ns hosting-pr${{ github.event.number }}
+      - name: Setup psql client
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y postgresql-client
+      - name: Drop app database if exists
+        run: |
+          PGPASSWORD='${{ secrets.PR_ENV_DB_PASSWORD }}' \
+          psql \
+          -h ${{ secrets.PR_ENV_DB_HOST }} \
+          -U ${{ secrets.PR_ENV_DB_USER }} \
+          -d ${{ secrets.PR_ENV_DB_NAME }} \
+          -c "DROP DATABASE IF EXISTS hosting_pr${{ github.event.number }};"

.github/workflows/pr-env-labeled.yml

@@ -0,0 +1,17 @@
+name: PR-Env labeled
+
+on:
+  pull_request:
+    types: [ labeled ]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  pr-env:
+    if: ${{ github.event.label.name == 'PR-Env' }}
+    uses: ./.github/workflows/pr-env.yml
+    with:
+      wait_for_uberjar: true
+    secrets: inherit

.github/workflows/pr-env.yml

@@ -0,0 +1,169 @@
+name: CI for PR Review ENV
+run-name: Building Dynamic PR Environment for ${{ github.ref_name }} by @${{ github.actor }}
+
+on:
+  workflow_call:
+    inputs:
+      wait_for_uberjar:
+        description: "Wait for uberjar build"
+        required: false
+        type: boolean
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    if: github.event.pull_request.head.repo.full_name == github.repository
+    name: Build Metabase Docker image
+    timeout-minutes: 60
+    permissions:
+      id-token: write
+      contents: read
+      actions: read
+    steps:
+      - name: Checkout source code
+        uses: actions/checkout@v4
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.PR_ENV_IAM_ROLE }}
+          role-session-name: GitHub_to_AWS_via_FederatedOIDC
+          aws-region: us-east-1
+      - name: Login to Amazon ECR
+        uses: aws-actions/amazon-ecr-login@v2
+        with:
+          registries: "${{ secrets.PR_ENV_AWS_ACCOUNT_ID }}"
+      - name: Wait for uberjar
+        id: wait_for_uberjar
+        if: ${{ inputs.wait_for_uberjar == true }}
+        run: |
+          ## Get workflow run id for uberjar build
+          curl -Ls --output e2e-tests.json \
+          -H "Accept: application/vnd.github+json" \
+          -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
+          -H "X-GitHub-Api-Version: 2022-11-28" \
+          https://api.github.com/repos/${{ github.repository }}/actions/workflows/e2e-tests.yml/runs?head_sha=${{ github.event.pull_request.head.sha || github.sha }}
+          ID=$(jq -r '.workflow_runs[0].id' e2e-tests.json)
+          ## Wait for uberjar build to complete
+          while [ true ]; do
+            curl -Ls --output uberjar.json \
+            -H "Accept: application/vnd.github+json" \
+            -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            https://api.github.com/repos/${{ github.repository }}/actions/runs/${ID}/jobs?filter=latest
+            jq -r '.jobs[] | select(.name == "build (ee)") | .steps[] | select(.name == "Prepare uberjar artifact") | .status' uberjar.json | grep -q "completed" && break
+            echo "Waiting for uberjar build..."
+            sleep 10
+          done
+          echo "run_id=$(jq -r '.workflow_runs[0].id' e2e-tests.json)" >> $GITHUB_OUTPUT
+      - name: Retrieve uberjar artifact for ee
+        uses: actions/download-artifact@v4
+        with:
+          name: metabase-ee-${{ github.event.pull_request.head.sha || github.sha }}-uberjar
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          run-id: ${{ inputs.wait_for_uberjar && steps.wait_for_uberjar.outputs.run_id || github.run_id }}
+      - name: Move uberjar to bin/docker
+        run: |
+          jar xf target/uberjar/metabase.jar
+          mv target/uberjar/metabase.jar bin/docker/metabase.jar
+      - name: Build container
+        uses: docker/build-push-action@v6
+        with:
+          context: bin/docker/
+          platforms: linux/amd64
+          network: host
+          tags: ${{ secrets.PR_ENV_AWS_ACCOUNT_ID }}.dkr.ecr.us-east-1.amazonaws.com/metabase-enterprise:pr${{ github.event.number }}
+          push: true
+  deploy_pr:
+    needs: [ build ]
+    runs-on: ubuntu-latest
+    name: PR Review ENV
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - name: Checkout source code
+        uses: actions/checkout@v4
+      - name: Tailscale
+        uses: tailscale/github-action@v2
+        with:
+          oauth-client-id: ${{ secrets.PR_ENV_TAILSCALE_OAUTH_CLIENT_ID }}
+          oauth-secret: ${{ secrets.PR_ENV_TAILSCALE_OAUTH_SECRET }}
+          tags: tag:ci
+          version: 1.50.1
+          sha256sum: d9fe6b480fb5078f0aa57dace686898dda7e2a768884271159faa74846bfb576
+      - name: Create OIDC Token
+        id: create-oidc-token
+        shell: bash
+        run: |
+          export OIDC_URL_WITH_AUDIENCE="$ACTIONS_ID_TOKEN_REQUEST_URL&audience=${{ secrets.PR_ENV_K8S_AUDIENCE }}"
+          IDTOKEN=$(curl -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" -H "Accept: application/json; api-version=2.0" "$OIDC_URL_WITH_AUDIENCE" | jq -r .value)
+          echo "::add-mask::${IDTOKEN}"
+          echo "idToken=${IDTOKEN}" >>$GITHUB_OUTPUT
+      - name: Setup Kube Context
+        uses: azure/k8s-set-context@v2
+        with:
+          method: kubeconfig
+          kubeconfig: |
+            kind: Config
+            apiVersion: v1
+            current-context: default
+            clusters:
+            - name: default
+              cluster:
+                certificate-authority-data: ${{ secrets.PR_ENV_K8S_CERTIFICATE_AUTHORITY_DATA }}
+                server: ${{ secrets.PR_ENV_K8S_SERVER }}
+            users:
+            - name: oidc-token
+              user:
+                token: ${{ steps.create-oidc-token.outputs.IDTOKEN }}
+            contexts:
+            - name: default
+              context:
+                cluster: default
+                namespace: default
+                user: oidc-token
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.PR_ENV_IAM_ROLE }}
+          role-session-name: GitHub_to_AWS_via_FederatedOIDC
+          aws-region: us-east-1
+      - name: Setup psql client
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y postgresql-client
+      - name: Create app database if not exists
+        run: |
+          export PGPASSWORD='${{ secrets.PR_ENV_DB_PASSWORD }}'
+          export PGUSER=${{ secrets.PR_ENV_DB_USER }}
+          export PGHOST=${{ secrets.PR_ENV_DB_HOST }}
+          export PGDATABASE=${{ secrets.PR_ENV_DB_NAME }}
+          psql -tc "SELECT 1 FROM pg_database WHERE datname = 'hosting_pr${{ github.event.number }}'" \
+          | grep -q 1 \
+          || psql -c "CREATE DATABASE hosting_pr${{ github.event.number }}"
+      - name: Download Deployment YAML template
+        run: aws s3 cp s3://metabase-pr-env/metabase.yml.tmpl ./metabase.yml.tmpl
+      - name: Render Deployment YAML
+        uses: nowactions/envsubst@v1
+        with:
+          input: ./metabase.yml.tmpl
+          output: ./metabase.yml
+        env:
+          IMAGE_TAG: pr${{ github.event.number }}
+          PR_NUMBER: ${{ github.event.number }}
+          MB_PREMIUM_EMBEDDING_TOKEN: ${{ secrets.PR_ENV_MB_PREMIUM_EMBEDDING_TOKEN }}
+          SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+      - name: Deploy PR Review ENV
+        run: |
+          kubectl apply -f ./metabase.yml
+  preview_links:
+    runs-on: ubuntu-latest
+    needs: [ deploy_pr ]
+    steps:
+      - uses: marocchino/sticky-pull-request-comment@v2
+        with:
+          recreate: true
+          message: |
+            👋 Deploying a preview environment for commit ${{ github.event.pull_request.head.sha || github.sha }}.
+            ✅ Preview:
+                https://pr${{ github.event.number }}.coredev.metabase.com
+            🗒️ [login instructions](https://www.notion.so/metabase/Ephemeral-PR-Environments-c74a3710c87a460dbf4fc0007a001458)

.github/workflows/pre-release.yml

@@ -5,12 +5,16 @@ on:
   workflow_dispatch:
     inputs:
       version:
-        description: 'Metabase version (e.g. v0.46.3)'
+        description: "Metabase version (e.g. v0.46.3)"
         type: string
         required: true
       commit:
-        description: 'A full-length commit SHA-1 hash'
+        description: "A full-length commit SHA-1 hash"
         required: true
+      auto:
+        description: 'auto-patch release DO NOT SET MANUALLY'
+        type: boolean
+        default: false
 
 jobs:
   release-artifact:
@@ -91,26 +95,26 @@ jobs:
         edition: [oss, ee]
         java-version: [11, 17]
     steps:
-    - name: Prepare JRE (Java Run-time Environment)
-      uses: actions/setup-java@v4
-      with:
-        java-package: jre
-        java-version: ${{ matrix.java-version }}
-        distribution: 'temurin'
-    - run: java -version
-    - uses: actions/download-artifact@v4
-      name: Retrieve uberjar artifact
-      with:
-        name: metabase-${{ matrix.edition }}-uberjar
-    - name: Launch uberjar (and keep it running)
-      run: java -jar ./metabase.jar &
-    - name: Wait for Metabase to start
-      run: while ! curl -s 'http://localhost:3000/api/health' | grep '{"status":"ok"}'; do sleep 1; done
+      - name: Prepare JRE (Java Run-time Environment)
+        uses: actions/setup-java@v4
+        with:
+          java-package: jre
+          java-version: ${{ matrix.java-version }}
+          distribution: "temurin"
+      - run: java -version
+      - uses: actions/download-artifact@v4
+        name: Retrieve uberjar artifact
+        with:
+          name: metabase-${{ matrix.edition }}-uberjar
+      - name: Launch uberjar (and keep it running)
+        run: java -jar ./metabase.jar &
+      - name: Wait for Metabase to start
+        run: while ! curl -s 'http://localhost:3000/api/health' | grep '{"status":"ok"}'; do sleep 1; done
 
   run-sanity-check:
     runs-on: ubuntu-22.04
     timeout-minutes: 30
-    needs: [release-artifact, check-uberjar-health]
+    needs: [release-artifact]
     strategy:
       matrix:
         edition: [oss, ee]
@@ -119,59 +123,63 @@ jobs:
       DISPLAY: ""
       CYPRESS_ALL_FEATURES_TOKEN: ${{ secrets.ENTERPRISE_TOKEN }}
       CYPRESS_NO_FEATURES_TOKEN: ${{ secrets.E2E_STARTER_TOKEN }}
+      # disabled because of out of memory issues
+      # probably related to https://github.com/cypress-io/cypress/issues/27415
+      CYPRESS_NO_COMMAND_LOG: 1
       MB_SNOWPLOW_AVAILABLE: true
       MB_SNOWPLOW_URL: "http://localhost:9090" # Snowplow micro
       TERM: xterm
-    services:
-      maildev:
-        image: maildev/maildev:2.0.5
-        ports:
-          - "1080:1080"
-          - "1025:1025"
-        credentials:
+    steps:
+      - name: Check out the code
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ needs.release-artifact.outputs.commit }}
+      - name: Prepare Docker containers
+        uses: ./.github/actions/e2e-prepare-containers
+        with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
-    steps:
-    - name: Check out the code
-      uses: actions/checkout@v4
-      with:
-        ref: ${{ needs.release-artifact.outputs.commit }}
-    - name: Prepare front-end environment
-      uses: ./.github/actions/prepare-frontend
-    - name: Prepare JDK 11
-      uses: actions/setup-java@v4
-      with:
-        java-version: 11
-        distribution: "temurin"
-    - name: Prepare Cypress environment
-      uses: ./.github/actions/prepare-cypress
-    - name: Run Snowplow micro
-      uses: ./.github/actions/run-snowplow-micro
-    - uses: actions/download-artifact@v4
-      name: Retrieve uberjar artifact for ${{ matrix.edition }}
-      with:
-        name: metabase-${{ matrix.edition }}-uberjar
-    - name: Get the version info
-      run: |
-        jar xf metabase.jar version.properties
-        mv version.properties resources/
-    - name: Run a few important Cypress tests as sanity check
-      run: |
-        mkdir -p ./target/uberjar && cp metabase.jar ./target/uberjar/metabase.jar
-        yarn test-cypress-run --folder onboarding
+          maildev: true
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+      - name: Prepare JDK 11
+        uses: actions/setup-java@v4
+        with:
+          java-version: 11
+          distribution: "temurin"
+      - name: Prepare Cypress environment
+        id: cypress-prep
+        uses: ./.github/actions/prepare-cypress
+      - name: Run Snowplow micro
+        uses: ./.github/actions/run-snowplow-micro
+      - uses: actions/download-artifact@v4
+        name: Retrieve uberjar artifact for ${{ matrix.edition }}
+        with:
+          name: metabase-${{ matrix.edition }}-uberjar
+      - name: Get the version info
+        run: |
+          jar xf metabase.jar version.properties
+          mv version.properties resources/
+      - name: Run a few important Cypress tests as sanity check
+        run: |
+          mkdir -p ./target/uberjar && cp metabase.jar ./target/uberjar/metabase.jar
+          yarn test-cypress-run \
+            --env grepTags="@smoke",grepOmitFiltered=true \
+            --spec './e2e/test/scenarios/**/*.cy.spec.(js|ts)' \
+            --browser ${{ steps.cypress-prep.outputs.chrome-path }}
 
-    - name: Upload Cypress Artifacts upon failure
-      uses: actions/upload-artifact@v4
-      if: failure()
-      with:
-        name: cypress-failed-tests-recording
-        path: |
-          ./cypress
-          ./logs/test.log
-        if-no-files-found: ignore
+      - name: Upload Cypress Artifacts upon failure
+        uses: actions/upload-artifact@v4
+        if: failure()
+        with:
+          name: cypress-failed-tests-recording
+          path: |
+            ./cypress
+            ./logs/test.log
+          if-no-files-found: ignore
 
   containerize:
-    needs: [release-artifact, run-sanity-check]
+    needs: [release-artifact]
     runs-on: ubuntu-22.04
     timeout-minutes: 15
     strategy:
@@ -185,71 +193,71 @@ jobs:
     outputs:
       image_tag: ${{ steps.target.outputs.image_tag }}
     steps:
-    - name: Get the version
-      run: |
-        if [[ "${{ matrix.edition }}" == "ee" ]]; then
-          echo "VERSION=${{ needs.release-artifact.outputs.ee_version }}" >> $GITHUB_ENV
-        else
-          echo "VERSION=${{ needs.release-artifact.outputs.oss_version }}" >> $GITHUB_ENV
-        fi
-    - name: Check out the code
-      uses: actions/checkout@v4
-      with:
-        ref: ${{ needs.release-artifact.outputs.commit }}
-    - uses: actions/download-artifact@v4
-      name: Retrieve uberjar artifact
-      with:
-        name: metabase-${{ matrix.edition }}-uberjar
-    - name: Move the Uberjar to the context dir
-      run: mv metabase.jar bin/docker/.
-    - name: Set up Docker Buildx
-      id: buildx
-      uses: docker/setup-buildx-action@v2
-      with:
-        driver-opts: network=host
-    - name: Build ${{ matrix.edition }} container
-      uses: docker/build-push-action@v3
-      with:
-        context: bin/docker/.
-        platforms: linux/amd64
-        network: host
-        tags: localhost:5000/local-metabase:${{ env.VERSION }}
-        no-cache: true
-        push: true
+      - name: Get the version
+        run: |
+          if [[ "${{ matrix.edition }}" == "ee" ]]; then
+            echo "VERSION=${{ needs.release-artifact.outputs.ee_version }}" >> $GITHUB_ENV
+          else
+            echo "VERSION=${{ needs.release-artifact.outputs.oss_version }}" >> $GITHUB_ENV
+          fi
+      - name: Check out the code
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ needs.release-artifact.outputs.commit }}
+      - uses: actions/download-artifact@v4
+        name: Retrieve uberjar artifact
+        with:
+          name: metabase-${{ matrix.edition }}-uberjar
+      - name: Move the Uberjar to the context dir
+        run: mv metabase.jar bin/docker/.
+      - name: Set up Docker Buildx
+        id: buildx
+        uses: docker/setup-buildx-action@v2
+        with:
+          driver-opts: network=host
+      - name: Build ${{ matrix.edition }} container
+        uses: docker/build-push-action@v3
+        with:
+          context: bin/docker/.
+          platforms: linux/amd64
+          network: host
+          tags: localhost:5000/local-metabase:${{ env.VERSION }}
+          no-cache: true
+          push: true
 
-    - name: Launch container
-      run: docker run --rm -dp 3000:3000 localhost:5000/local-metabase:${{ env.VERSION }}
-      timeout-minutes: 5
-    - name: Wait for Metabase to start
-      run: while ! curl -s 'http://localhost:3000/api/health' | grep '{"status":"ok"}'; do sleep 1; done
-      timeout-minutes: 3
+      - name: Launch container
+        run: docker run --rm -dp 3000:3000 localhost:5000/local-metabase:${{ env.VERSION }}
+        timeout-minutes: 5
+      - name: Wait for Metabase to start
+        run: while ! curl -s 'http://localhost:3000/api/health' | grep '{"status":"ok"}'; do sleep 1; done
+        timeout-minutes: 3
 
-    - name: Login to Docker Hub
-      uses: docker/login-action@v2
-      with:
-        username: ${{ secrets.DOCKERHUB_RELEASE_USERNAME }}
-        password: ${{ secrets.DOCKERHUB_RELEASE_TOKEN }}
-    - name: Retag and push container image to ${{ vars.DOCKERHUB_OWNER }} staging Docker Hub repo
-      id: target
-      run: |
-        # SHA-1 truncated to 7 digits should be enough
-        SHORT_HASH=${COMMIT:0:7}
+      - name: Login to Docker Hub
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKERHUB_RELEASE_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_RELEASE_TOKEN }}
+      - name: Retag and push container image to ${{ vars.DOCKERHUB_OWNER }} staging Docker Hub repo
+        id: target
+        run: |
+          # SHA-1 truncated to 7 digits should be enough
+          SHORT_HASH=${COMMIT:0:7}
 
-        IMAGE_TAG=$VERSION-$SHORT_HASH
-        CONTAINER_IMAGE=${{ vars.DOCKERHUB_OWNER }}/${{ vars.DOCKERHUB_STAGING_REPO }}:$IMAGE_TAG
+          IMAGE_TAG=$VERSION-$SHORT_HASH
+          CONTAINER_IMAGE=${{ vars.DOCKERHUB_OWNER }}/${{ vars.DOCKERHUB_STAGING_REPO }}:$IMAGE_TAG
 
-        echo "image_tag=$IMAGE_TAG" >> $GITHUB_OUTPUT
+          echo "image_tag=$IMAGE_TAG" >> $GITHUB_OUTPUT
 
-        echo "Retag local image for staging"
-        docker tag localhost:5000/local-metabase:$VERSION $CONTAINER_IMAGE
+          echo "Retag local image for staging"
+          docker tag localhost:5000/local-metabase:$VERSION $CONTAINER_IMAGE
 
-        echo "Pushing container image $CONTAINER_IMAGE ..."
-        docker push $CONTAINER_IMAGE
+          echo "Pushing container image $CONTAINER_IMAGE ..."
+          docker push $CONTAINER_IMAGE
 
-        echo "Finished!"
-      shell: bash
-      env:
-        COMMIT: ${{ needs.release-artifact.outputs.commit }}
+          echo "Finished!"
+        shell: bash
+        env:
+          COMMIT: ${{ needs.release-artifact.outputs.commit }}
 
   verify-docker-pull:
     runs-on: ubuntu-22.04
@@ -261,22 +269,80 @@ jobs:
     env:
       IMAGE_TAG: ${{ needs.containerize.outputs.image_tag }}
     steps:
-    - name: Login to Docker Hub # authenticated, to avoid being rate-throttled
-      uses: docker/login-action@v2
-      with:
-        username: ${{ secrets.DOCKERHUB_RELEASE_USERNAME }}
-        password: ${{ secrets.DOCKERHUB_RELEASE_TOKEN }}
-    - name: Pull the container image
-      run: |
-        CONTAINER_IMAGE=${{ vars.DOCKERHUB_OWNER }}/${{ vars.DOCKERHUB_STAGING_REPO }}:$IMAGE_TAG
-        echo "Pulling container image $CONTAINER_IMAGE ..."
-        docker pull $CONTAINER_IMAGE
-        echo "Successful!"
-    - name: Launch container
-      run: |
-        CONTAINER_IMAGE=${{ vars.DOCKERHUB_OWNER }}/${{ vars.DOCKERHUB_STAGING_REPO }}:$IMAGE_TAG
-        docker run --rm -dp 3000:3000 $CONTAINER_IMAGE
-      timeout-minutes: 5
-    - name: Wait for Metabase to start
-      run: while ! curl -s 'http://localhost:3000/api/health' | grep '{"status":"ok"}'; do sleep 1; done
-      timeout-minutes: 3
+      - name: Login to Docker Hub # authenticated, to avoid being rate-throttled
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKERHUB_RELEASE_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_RELEASE_TOKEN }}
+      - name: Pull the container image
+        run: |
+          CONTAINER_IMAGE=${{ vars.DOCKERHUB_OWNER }}/${{ vars.DOCKERHUB_STAGING_REPO }}:$IMAGE_TAG
+          echo "Pulling container image $CONTAINER_IMAGE ..."
+          docker pull $CONTAINER_IMAGE
+          echo "Successful!"
+      - name: Launch container
+        run: |
+          CONTAINER_IMAGE=${{ vars.DOCKERHUB_OWNER }}/${{ vars.DOCKERHUB_STAGING_REPO }}:$IMAGE_TAG
+          docker run --rm -dp 3000:3000 $CONTAINER_IMAGE
+        timeout-minutes: 5
+      - name: Wait for Metabase to start
+        run: while ! curl -s 'http://localhost:3000/api/health' | grep '{"status":"ok"}'; do sleep 1; done
+        timeout-minutes: 3
+
+  trigger-auto-publish:
+    if: ${{ inputs.auto }}
+    needs: [run-sanity-check, check-uberjar-health, verify-docker-pull]
+    permissions:
+      actions: write
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: trigger auto publish
+        uses: actions/github-script@v7
+        with:
+          script: | # js
+            await github.rest.actions.createWorkflowDispatch({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              workflow_id: 'release.yml',
+              ref: '${{ github.ref }}',
+              inputs: {
+                commit: '${{ inputs.commit }}',
+                version: '${{ inputs.version }}',
+                auto: true,
+              }
+            });
+
+  tests-complete-message:
+    if: always()
+    runs-on: ubuntu-22.04
+    needs: [run-sanity-check, check-uberjar-health, verify-docker-pull]
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: release
+      - name: Prepare build scripts
+        run: cd ${{ github.workspace }}/release && yarn && yarn build
+      - name: Send tests complete message
+        uses: actions/github-script@v7
+        env:
+          SLACK_RELEASE_CHANNEL: ${{ vars.SLACK_RELEASE_CHANNEL }}
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+        with:
+          script: | # js
+            const { sendTestsCompleteMessage } = require('${{ github.workspace }}/release/dist/index.cjs');
+
+            const allJobsSuccessful =
+              '${{ needs.run-sanity-check.result }}' === 'success' &&
+              '${{ needs.check-uberjar-health.result }}' === 'success' &&
+              '${{ needs.verify-docker-pull.result }}' === 'success';
+
+            await sendTestsCompleteMessage({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              version: '${{ inputs.version }}',
+              runId: '${{ github.run_id }}',
+              channelName: '${{ vars.SLACK_RELEASE_CHANNEL }}',
+              testStatus: allJobsSuccessful ? 'success' : 'failure',
+            }).catch(console.error);

.github/workflows/release-embedding-sdk.yml

@@ -0,0 +1,254 @@
+name: Release Metabase Embedding SDK for React
+
+on:
+  workflow_dispatch:
+    inputs:
+      # TODO: Add a version validation, so the workflow won't fail when publishing to npm
+      sdk_version:
+        description: 'SDK version (e.g. 0.1.3)'
+        type: string
+        required: true
+      git_ref:
+        description: 'A git commit hash that will be used to build the SDK'
+        type: string
+        required: true
+
+concurrency:
+  # We want to ensure only one job is running at a time because
+  # there could be a conflict when updating the readme file.
+  group: ${{ github.workflow }}
+  cancel-in-progress: true
+
+jobs:
+  check-git-tag:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 20
+    env:
+      tag: embedding-sdk-${{ inputs.sdk_version }}
+    steps:
+      - name: Check out the code using the provided ref
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.git_ref }}
+          fetch-depth: 0
+          fetch-tags: true
+
+      - name: check tags
+        run: |
+          if [ $(git tag -l | grep $tag$) ]
+          then
+            echo "::error::Tag '${{ env.tag }}' already exists. If you expect to run this workflow with the same tag, please remove the tag first and rerun this workflow again."
+            exit 1
+          else
+            exit 0
+          fi
+
+  test:
+    needs: check-git-tag
+    runs-on: ubuntu-22.04
+    timeout-minutes: 20
+    steps:
+      - name: Check out the code using the provided ref
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.git_ref }}
+
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: "release-sdk"
+
+      - name: Run unit tests
+        run: yarn embedding-sdk:test-unit
+
+  build-sdk:
+    needs: test
+    runs-on: ubuntu-22.04
+    timeout-minutes: 20
+    steps:
+      - name: Check out the code using the provided ref
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.git_ref }}
+          fetch-depth: 0
+          fetch-tags: true
+
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: "release-sdk"
+
+      - name: Update readme
+        run: |
+          ./bin/embedding-sdk/release_utils.bash update_readme ${{ inputs.sdk_version }}
+
+      - name: Bump published npm package version
+        # NOTE: this should happen before "Build SDK bundle" as we inject SDK version into the code during build step
+        run: |
+          ./bin/embedding-sdk/release_utils.bash update_package_json_template ${{ inputs.sdk_version }}
+
+      - name: Update changelog
+        run: |
+          yarn embedding-sdk:generate-changelog -o changelog-diff
+
+      - name: Build SDK bundle
+        run: yarn run build-embedding-sdk
+
+      - name: Generate SDK package.json in the build directory
+        run: yarn run embedding-sdk:generate-package
+
+      - name: Upload built SDK package as artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: metabase-sdk
+          path: ./resources/embedding-sdk
+
+      - name: Upload changelog diff
+        uses: actions/upload-artifact@v4
+        with:
+          name: sdk-changelog-diff
+          path: ./changelog-diff
+
+  build-jar:
+    needs: test
+    uses: ./.github/workflows/uberjar-sdk.yml
+    with:
+      git_ref: ${{ inputs.git_ref }}
+      image_name: embedding-sdk-${{ inputs.sdk_version }}
+    secrets: inherit
+
+  upload-jar:
+    needs: build-jar
+    runs-on: ubuntu-22.04
+    timeout-minutes: 20
+    steps:
+      - uses: actions/download-artifact@v4
+        name: Retrieve uberjar artifact
+        with:
+          name: metabase-ee-uberjar
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-access-key-id: ${{ secrets.AWS_S3_RELEASE_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_S3_RELEASE_SECRET_ACCESS_KEY }}
+          aws-region: ${{ vars.AWS_REGION }}
+
+      - name: Upload uberjar to S3
+        env:
+          BUCKET: ${{ vars.AWS_S3_DOWNLOADS_BUCKET }}
+          BUCKET_PATH: sdk/v${{ inputs.sdk_version }}/metabase.jar
+          FILE: ./target/uberjar/metabase.jar
+        shell: bash
+        run: |
+          aws s3 cp $FILE s3://$BUCKET/$BUCKET_PATH
+
+  publish-npm:
+    needs: [build-sdk, upload-jar]
+    runs-on: ubuntu-22.04
+    timeout-minutes: 20
+    steps:
+      - name: Check out master to prepare for a SDK version bump PR
+        uses: actions/checkout@v4
+        with:
+          # when we created version update PR, it would only have diff from 2 files SDK readme and SDK package.json template
+          ref: master
+
+      - name: Setup git user
+        run: |
+          git config --global user.email "github-automation@metabase.com"
+          git config --global user.name "Metabase Automation"
+
+      - name: Update readme
+        run: |
+          bash ./bin/embedding-sdk/release_utils.bash update_readme ${{ inputs.sdk_version }}
+
+      - name: Bump published npm package version
+        run: |
+          bash ./bin/embedding-sdk/release_utils.bash update_package_json_template ${{ inputs.sdk_version }}
+
+      - name: Retrieve SDK changelog diff
+        uses: actions/download-artifact@v4
+        with:
+          name: sdk-changelog-diff
+
+      - name: Update changelog
+        run: |
+          cat changelog-diff enterprise/frontend/src/embedding-sdk/CHANGELOG.md > new-changelog
+          mv new-changelog enterprise/frontend/src/embedding-sdk/CHANGELOG.md
+
+      - name: Create a PR updating readme + published version, and changelog (using GitHub Metabase Automation account)
+        run: |
+          git checkout -b update-sdk-version-${{ inputs.sdk_version }}
+          git commit -a -m 'Update Readme version references and published npm version to ${{ inputs.sdk_version }}'
+          git push origin HEAD
+          gh pr create --base master\
+                       --assignee "${GITHUB_ACTOR}"\
+                       --title "Update SDK version to ${{ inputs.sdk_version }}"\
+                       --body "Update Readme version references and published npm package version to ${{ inputs.sdk_version }}"
+        env:
+          GH_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+
+      - uses: actions/create-github-app-token@v1
+        id: app-token
+        with:
+          app-id: ${{ secrets.METABASE_BOT_APP_ID }}
+          private-key: ${{ secrets.METABASE_BOT_APP_PRIVATE_KEY }}
+
+      - name: Edit PR adding useful information (using Metabase bot app)
+        run: |
+          gh pr edit --add-reviewer @metabase/embedding --add-label no-backport
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+
+      - name: Auto approve PR (using GitHub Actions account)
+        run: |
+          gh pr review --approve
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Enable Pull request auto-merge (using GitHub Metabase Automation account)
+        run: |
+          gh pr merge --auto --squash
+        env:
+          GH_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+
+      - name: Retrieve build SDK package artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: metabase-sdk
+          path: sdk
+
+      - name: Publish to NPM
+        run: |
+          cd sdk
+          echo //registry.npmjs.org/:_authToken=${{ secrets.NPM_RELEASE_TOKEN }} > .npmrc
+          npm publish
+
+  git-tag:
+    needs: publish-npm
+    runs-on: ubuntu-22.04
+    timeout-minutes: 20
+    env:
+      tag: embedding-sdk-${{ inputs.sdk_version }}
+    steps:
+      - name: Check out the code using the provided ref
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.git_ref }}
+
+      # Lightweight tags don't need committer name and email
+      - name: Create a new git tag
+        run: |
+          git tag ${{ env.tag }}
+
+      - name: Push the new tag
+        id : push-tag
+        run: |
+          git push origin ${{ env.tag }}

.github/workflows/release-milestone-check.yml

@@ -0,0 +1,52 @@
+name: Release Milestone Check
+run-name: Pre-release Milestone check for ${{ inputs.version }}
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Metabase version (e.g. v0.46.3)"
+        type: string
+        required: true
+      commit:
+        description: "A full-length commit SHA-1 hash"
+        required: true
+
+jobs:
+  check-milestone:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: release
+      - name: Prepare build scripts
+        run: yarn --cwd release --frozen-lockfile && yarn --cwd release build
+      - uses: actions/github-script@v7
+        env:
+          SLACK_RELEASE_CHANNEL: ${{ vars.SLACK_RELEASE_CHANNEL }}
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+        with:
+          script: | # js
+            const {
+              checkMilestoneForRelease,
+              sendMilestoneCheckMessage,
+            } = require('${{ github.workspace }}/release/dist/index.cjs');
+
+            const version = '${{ inputs.version }}';
+            const commitHash = '${{ inputs.commit }}';
+
+            const issueCount = await checkMilestoneForRelease({
+              github,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              version,
+              commitHash,
+            });
+
+            await sendMilestoneCheckMessage({
+              channelName: process.env.SLACK_RELEASE_CHANNEL,
+              issueCount,
+              version,
+            });

.github/workflows/release-notes-preview.yml

@@ -0,0 +1,55 @@
+name: Release Notes Preview
+run-name: Preview ${{ inputs.version }} release notes
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Metabase version (e.g. v0.46.3)'
+        type: string
+        required: true
+
+jobs:
+  preview-release-notes:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    steps:
+    - name: Fail early on the incorrect version format
+      if: ${{ !(startsWith(inputs.version,'v0.') || startsWith(inputs.version,'v1.')) }}
+      run: |
+        echo "The version format is invalid!"
+        echo "It must start with either 'v0.' or 'v1.'."
+        echo "Please, try again."
+        exit 1
+    - uses: actions/checkout@v4
+      with:
+        sparse-checkout: release
+    - name: Prepare build scripts
+      run: cd ${{ github.workspace }}/release && yarn && yarn build
+    - name: Get Release Version
+      uses: actions/github-script@v7
+      env:
+        DOCKERHUB_OWNER: test_owner
+        DOCKERHUB_REPO: test_repo
+        AWS_S3_DOWNLOADS_BUCKET: test_bucket
+      with:
+        script: | # js
+          const { getChangelog } = require('${{ github.workspace }}/release/dist/index.cjs');
+          const fs = require('fs');
+
+          const version = '${{ inputs.version }}';
+
+          const notes = await getChangelog({
+            version,
+            github,
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+          });
+
+          fs.writeFileSync(`release-notes-preview-${version}.md`, notes);
+    - name: Upload Release Notes
+      uses: actions/upload-artifact@v4
+      with:
+        name: release-notes-preview-${{inputs.version}}.md
+        path: |
+          ${{ github.workspace }}/release-notes-preview-*.md

.github/workflows/release-patch.yml

@@ -0,0 +1,91 @@
+name: Release 1b - Auto Patch
+run-name: Patch Release ${{ inputs.version }}
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Major Metabase version (e.g. 45, 52, 68)'
+        type: number
+        required: true
+  schedule:
+    - cron: '15 0 * * 1-5' # every weekday at 7/8:15 pm Eastern Time
+
+jobs:
+  auto-patch-trigger:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: release
+      - name: Prepare build scripts
+        run: yarn --cwd release --frozen-lockfile && yarn --cwd release build
+      - name: Trigger auto-patch
+        uses: actions/github-script@v7
+        with:
+          script: | # js
+            const {
+              getLatestGreenCommit,
+              getNextPatchVersion,
+              hasCommitBeenReleased,
+            } = require('${{ github.workspace }}/release/dist/index.cjs');
+
+            // Don't forget to update this for the next major release 🤞
+            const AUTO_RELEASE_VERSIONS = [49, 50];
+
+            async function releasePatchFor(majorVersion) {
+              const nextPatch = await getNextPatchVersion({
+                github,
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                majorVersion,
+              });
+
+              const goodCommit = await getLatestGreenCommit({
+                github,
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                branch: `release-x.${majorVersion}.x`,
+              });
+
+              const hasBeenReleased = await hasCommitBeenReleased({
+                github,
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                ref: goodCommit,
+                majorVersion: Number(majorVersion),
+              });
+
+              if (nextPatch && goodCommit && !hasBeenReleased) {
+                await github.rest.actions.createWorkflowDispatch({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  workflow_id: 'tag-for-release.yml',
+                  ref: 'refs/heads/master',
+                  inputs: {
+                    commit: goodCommit,
+                    version: nextPatch,
+                    auto: true,
+                  }
+                });
+              } else {
+                console.log(
+                  { nextPatch, goodCommit, hasBeenReleased }
+                );
+                console.error(`No new patch version or no green commit found for v${majorVersion}`);
+              }
+            }
+
+            if (context.eventName === 'workflow_dispatch') {
+              const inputVersion = Number(context.payload.inputs.version);
+
+              if (typeof inputVersion !== 'number') {
+                console.log('Invalid version number', inputVersion);
+                throw new Error(`Invalid version number: ${inputVersion}`);
+              }
+
+              await releasePatchFor(inputVersion);
+            } else { // scheduled release of AUTO_RELEASE_VERSIONS
+              await Promise.all(AUTO_RELEASE_VERSIONS.map(releasePatchFor));
+            }

.github/workflows/release-status.yml

@@ -1,9 +1,9 @@
-name: Release Status Check
+name: Release and Backport Status Check
 
 on:
   workflow_dispatch:
   schedule:
-    - cron: '0 13 * * *' # every day at 8am US eastern time
+    - cron: '0 7 * * 1-5' # every weekday at 8am/9am Central European Time
 
 jobs:
   check-release-status:
@@ -38,3 +38,31 @@ jobs:
             repo: context.repo.repo,
             channelName: process.env.SLACK_RELEASE_CHANNEL,
           });
+
+  open-backport-reminder:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    steps:
+    - uses: actions/checkout@v4
+      with:
+        sparse-checkout: release
+    - name: Prepare build scripts
+      run: cd ${{ github.workspace }}/release && yarn --frozen-lockfile && yarn build
+    - name: Check release status and post to Slack
+      uses: actions/github-script@v7
+      env:
+        SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+      with:
+        script: | # js
+          const { checkOpenBackports } = require('${{ github.workspace }}/release/dist/index.cjs');
+
+          if (!process.env.SLACK_BOT_TOKEN) {
+            throw new Error('SLACK_BOT_TOKEN is required');
+          }
+
+          const ossReleased = await checkOpenBackports({
+            github,
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+            channelName: 'engineering-ci',
+          });

.github/workflows/release-tests.yml

@@ -0,0 +1,72 @@
+name: Release Code Tests
+
+on:
+  push:
+    branches:
+      - "master"
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  files-changed:
+    name: Check which files changed
+    runs-on: ubuntu-22.04
+    timeout-minutes: 3
+    outputs:
+      release_source: ${{ steps.changes.outputs.release_source }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Test which files changed
+        uses: dorny/paths-filter@v3.0.0
+        id: changes
+        with:
+          token: ${{ github.token }}
+          filters: .github/file-paths.yaml
+
+  release-type-check:
+    needs: files-changed
+    if: needs.files-changed.outputs.release_source == 'true'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: "release"
+      - name: prepare dependencies in release directory
+        run: yarn --cwd release --frozen-lockfile
+      - name: Run frontend type-check
+        run: yarn --cwd release type-check
+
+  release-tests-unit:
+    needs: files-changed
+    if: needs.files-changed.outputs.release_source == 'true'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: "release"
+      - name: prepare dependencies in release directory
+        run: yarn --cwd release --frozen-lockfile
+      - name: Run release unit tests
+        run: yarn --cwd release test:unit
+
+  release-test-build:
+    needs: files-changed
+    if: needs.files-changed.outputs.release_source == 'true'
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: "release"
+      - name: prepare dependencies in release directory
+        run: yarn --cwd release --frozen-lockfile
+      - name: Build release bundle
+        run: yarn --cwd release build
+      - name: Smoke test release bundle
+        run: node release/dist/index.cjs

.github/workflows/release.yml

@@ -31,6 +31,10 @@ on:
         description: 'Skip publishing release notes'
         type: boolean
         default: false
+      auto:
+        description: 'auto-patch release DO NOT SET MANUALLY'
+        type: boolean
+        default: false
 
 jobs:
   check-version:
@@ -90,6 +94,34 @@ jobs:
 
           return versions;
 
+  publish-start-message:
+    runs-on: ubuntu-22.04
+    needs: [check-version]
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: release
+      - name: Prepare build scripts
+        run: cd ${{ github.workspace }}/release && yarn && yarn build
+      - name: Send publish start message
+        uses: actions/github-script@v7
+        env:
+          SLACK_RELEASE_CHANNEL: ${{ vars.SLACK_RELEASE_CHANNEL }}
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+        with:
+          script: | # js
+            const { sendPublishStartMessage } = require('${{ github.workspace }}/release/dist/index.cjs');
+
+            await sendPublishStartMessage({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              version: '${{ inputs.version }}',
+              runId: '${{ github.run_id }}',
+              channelName: '${{ vars.SLACK_RELEASE_CHANNEL }}',
+            }).catch(console.error);
+
+
   download-uberjar:
     needs: check-version
     runs-on: ubuntu-22.04
@@ -228,7 +260,7 @@ jobs:
     - name: Upload to S3
       run: aws s3 cp ./metabase.jar s3://${{ vars.AWS_S3_DOWNLOADS_BUCKET }}/${{ steps.version_path.outputs.result }}/metabase.jar
     - name: Upload to s3 latest path
-      if: ${{ steps.latest_path.outputs.result != 'false' }}
+      if: ${{ !inputs.auto && steps.latest_path.outputs.result != 'false' }}
       run: aws s3 cp ./metabase.jar s3://${{ vars.AWS_S3_DOWNLOADS_BUCKET }}/${{ steps.latest_path.outputs.result }}/metabase.jar
     - name: Create cloudfront invalidation
       run: |
@@ -374,7 +406,7 @@ jobs:
         echo "Finished!"
 
     - name: Tag the container image as latest
-      if: ${{ steps.latest_version_check.outputs.result == 'latest' }}
+      if: ${{ !inputs.auto && steps.latest_version_check.outputs.result == 'latest' }}
       run: |
         echo "Pushing ${{ env.DOCKERHUB_REPO }}:latest ..."
         docker tag localhost:5000/local-metabase:${{ steps.canonical_version.outputs.result }} ${{ env.DOCKERHUB_REPO }}:latest
@@ -482,16 +514,25 @@ jobs:
         $GITHUB_WORKSPACE/release/reorder-tags.sh ${{ needs.check-version.outputs.ee }} ${{ inputs.commit }}
 
   trigger-docs-update:
-    if: ${{ inputs.skip-release-notes != true }}
-    needs: push-tags
+    if: ${{ !inputs.auto && inputs.skip-release-notes != true }}
+    needs:
+      - push-tags
+      - check-version
     runs-on: ubuntu-22.04
     timeout-minutes: 10
+    permissions:
+      contents: write
+      pull-requests: write
+    env:
+      NEW_OSS_VERSION: ${{ needs.check-version.outputs.oss }}
+      NEW_EE_VERSION: ${{ needs.check-version.outputs.ee }}
+      GH_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
     steps:
       - uses: actions/github-script@v7
         with:
-          github-token: ${{ secrets.DOCS_UPDATE_TOKEN }}
-          script: |
-            github.rest.repos.createDispatchEvent({
+          github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+          script: | # js
+            await github.rest.repos.createDispatchEvent({
               owner: '${{ github.repository_owner }}',
               repo: '${{ secrets.DOCS_REPO }}',
               event_type: 'trigger-docs-update',
@@ -499,9 +540,96 @@ jobs:
                 version: '${{ inputs.version }}'
               }
             });
+      - uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+      - name: update releases.md
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+          script: | # js
+            const fs = require('fs');
+
+            const releaseText = fs.readFileSync('./docs/releases.md', 'utf8');
+
+            const newReleaseText = releaseText
+              .replace(
+                /## Metabase Enterprise Edition releases\n\n/,
+                `## Metabase Enterprise Edition releases\n\n- [${process.env.NEW_EE_VERSION}](https://github.com/metabase/metabase/releases/tag/${process.env.NEW_EE_VERSION})\n`
+              )
+              .replace(
+                /## Metabase Open Source Edition releases\n\n/,
+                `## Metabase Open Source Edition releases\n\n- [${process.env.NEW_OSS_VERSION}](https://github.com/metabase/metabase/releases/tag/${process.env.NEW_OSS_VERSION})\n`
+              );
+
+            fs.writeFileSync('./docs/releases.md', newReleaseText);
+
+      - name: commit and push updates
+        run: | # bash
+          git config --global user.email "metabase-bot@metabase.com"
+          git config --global user.name "Metabase bot"
+
+          git checkout -b docs-add-$NEW_OSS_VERSION
+          cd docs/
+
+          git add releases.md
+          git commit -m "Add $NEW_OSS_VERSION to the list of releases"
+          git push origin docs-add-$NEW_OSS_VERSION --force
+
+      - name: open pr with updates
+        run: | # bash
+          gh pr create --fill \
+            --body "Like it says on the tin 😁" \
+            --label "Type:Documentation" \
+            --label "backport" \
+            --reviewer "jeff-bruemmer" \
+            --assignee "jeff-bruemmer"
+
+  trigger-cloud-issues:
+    needs: push-tags
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+          script: | # js
+            const version = '${{ inputs.version }}';
+            const enterpriseVersion = version.replace(/^v0\./, "v1.");
+
+            github.rest.repos.createDispatchEvent({
+              owner: '${{ github.repository_owner }}',
+              repo: '${{ vars.OPS_REPO }}',
+              event_type: 'create-release-issues',
+              client_payload: {
+                version: enterpriseVersion,
+              }
+            });
+
+  trigger-ee-extra-pr:
+    needs: verify-s3-download
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    steps:
+      - uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
+          script: | # js
+            const version = '${{ inputs.version }}';
+            const enterpriseVersion = version.replace(/^v0\./, "v1.");
+
+            github.rest.repos.createDispatchEvent({
+              owner: '${{ github.repository_owner }}',
+              repo: 'metabase-ee-extra',
+              event_type: 'update-ee-extra-build',
+              client_payload: {
+                version: enterpriseVersion,
+                auto: '${{ inputs.auto }}',
+              }
+            });
 
   draft-release-notes:
-    if: ${{ inputs.skip-release-notes != true }}
+    if: ${{ !inputs.auto && inputs.skip-release-notes != true }}
     needs: push-tags
     runs-on: ubuntu-22.04
     timeout-minutes: 15
@@ -553,7 +681,7 @@ jobs:
             });
 
   publish-version-info:
-    if: ${{ inputs.skip-version-info != true }}
+    if: ${{ !inputs.auto && inputs.skip-version-info != true }}
     runs-on: ubuntu-22.04
     needs: [push-tags, check-version]
     timeout-minutes: 15
@@ -611,7 +739,66 @@ jobs:
         --distribution-id ${{ vars.AWS_CLOUDFRONT_STATIC_ID }} \
         --paths "/version-info.json" "/version-info-ee.json"
 
+  publish-complete-message:
+    if: ${{ !inputs.auto }}
+    runs-on: ubuntu-22.04
+    needs: [draft-release-notes, verify-docker-pull, verify-s3-download, publish-version-info]
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: release
+      - name: Prepare build scripts
+        run: cd ${{ github.workspace }}/release && yarn && yarn build
+      - name: Send publish complete message
+        uses: actions/github-script@v7
+        env:
+          SLACK_RELEASE_CHANNEL: ${{ vars.SLACK_RELEASE_CHANNEL }}
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+        with:
+          script: | # js
+            const { sendPublishCompleteMessage } = require('${{ github.workspace }}/release/dist/index.cjs');
+
+            await sendPublishCompleteMessage({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              version: '${{ inputs.version }}',
+              runId: '${{ github.run_id }}',
+              channelName: '${{ vars.SLACK_RELEASE_CHANNEL }}',
+              generalChannelName: 'general',
+            }).catch(console.error);
+
+  auto-publish-complete-message:
+    if: ${{ inputs.auto }}
+    runs-on: ubuntu-22.04
+    needs: [push-tags, verify-docker-pull, verify-s3-download]
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: release
+      - name: Prepare build scripts
+        run: cd ${{ github.workspace }}/release && yarn && yarn build
+      - name: Send auto publish complete message
+        uses: actions/github-script@v7
+        env:
+          SLACK_RELEASE_CHANNEL: ${{ vars.SLACK_RELEASE_CHANNEL }}
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+        with:
+          script: | # js
+            const { sendPublishCompleteMessage } = require('${{ github.workspace }}/release/dist/index.cjs');
+
+            await sendPublishCompleteMessage({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              version: '${{ inputs.version }}',
+              runId: '${{ github.run_id }}',
+              channelName: '${{ vars.SLACK_RELEASE_CHANNEL }}',
+              generalChannelName: '',
+            }).catch(console.error);
+
   manage-milestones:
+    if: ${{ !inputs.auto }}
     permissions: write-all
     runs-on: ubuntu-22.04
     needs: [draft-release-notes, publish-version-info] # this will ensure that the milestone stays open until the release notes are published

.github/workflows/require-percy-tests.yml

@@ -1,44 +0,0 @@
-name: Require Percy specs
-
-on:
-  pull_request:
-    types: [opened, synchronize, reopened, ready_for_review]
-
-jobs:
-  files-changed:
-    if: github.event.pull_request.draft == false && !contains(github.event.pull_request.labels.*.name, 'visual')
-    name: Check which files changed
-    runs-on: ubuntu-22.04
-    timeout-minutes: 3
-    outputs:
-      visualizations: ${{ steps.changes.outputs.visualizations }}
-    steps:
-      - uses: actions/checkout@v4
-      - name: Test which files changed
-        uses: dorny/paths-filter@v3.0.0
-        id: changes
-        with:
-          token: ${{ github.token }}
-          filters: .github/file-paths.yaml
-
-  add-label:
-    needs: files-changed
-    if: needs.files-changed.outputs.visualizations == 'true'
-    runs-on: ubuntu-22.04
-    timeout-minutes: 20
-    steps:
-      - uses: tibdex/github-app-token@v2.1.0
-        id: generate-token
-        with:
-          app_id: ${{ secrets.METABASE_BOT_APP_ID }}
-          private_key: ${{ secrets.METABASE_BOT_APP_PRIVATE_KEY }}
-      - uses: actions/github-script@v7
-        with:
-          github-token: ${{ steps.generate-token.outputs.token }}
-          script: |
-            github.rest.issues.addLabels({
-              issue_number: context.issue.number,
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              labels: ["visual"]
-            })

.github/workflows/rerun-workflows.yml

@@ -2,7 +2,7 @@ name: Re-run Flaky Workflows
 
 on:
   workflow_run:
-    workflows: [Backend, Driver Tests, E2E Tests, Frontend]
+    workflows: [Backend, Driver Tests, E2E Tests, Frontend, Backend-Cloverage]
     types: [completed]
     branches: [master, 'release-x.**', 'backport-**']
 
@@ -10,7 +10,7 @@ jobs:
   rerun-on-failure:
     name: 'Re-run ''${{ github.event.workflow_run.name }}'' workflow'
     runs-on: ubuntu-22.04
-    # Do not re-run scheduled workflow runs. That's only Replay.io E2E tests for now.
+    # Do not re-run scheduled workflow runs
     if: github.event.workflow_run.conclusion == 'failure' && github.event.workflow_run.event != 'schedule'
     env:
       BRANCH_NAME: ${{ github.event.workflow_run.head_branch }}
@@ -45,7 +45,7 @@ jobs:
                 repo: context.repo.repo,
                 run_id: ${{ github.event.workflow_run.id }},
               });
-            } else {
+            } else if (!BRANCH.includes('backport-')) {
               // notify slack of repeated failure
               const { WebClient } = require('@slack/web-api');
               const slack = new WebClient('${{ secrets.SLACK_BOT_TOKEN }}');

.github/workflows/security-slack-notification.yml

@@ -0,0 +1,38 @@
+name: Security Issue Slack Notification
+
+on:
+  issues:
+    types:
+      - labeled
+
+jobs:
+  on-issue-opened:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    if: github.event.label.name == 'SECURITY'
+    steps:
+      - name: Setting title
+        uses: actions/github-script@v7
+        id: vars
+        with:
+          script: |
+            core.setOutput('issue_title', ${{ toJson(github.event.issue.title) }}.replaceAll(/"/g, '\\"'));
+      - name: Send the issue ${{ github.event.issue.number }} to Slack
+        id: slack
+        uses: slackapi/slack-github-action@v1.26.0
+        with:
+          payload: |
+            {
+              "blocks": [
+                {
+                  "type": "section",
+                  "text": {
+                    "type": "mrkdwn",
+                    "text": "${{ steps.vars.outputs.issue_title }}\n${{ github.event.issue.html_url }}"
+                  }
+                }
+              ]
+            }
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_SECURITY_WEBHOOK_URL }}
+          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK

.github/workflows/tag-for-release.yml

@@ -0,0 +1,257 @@
+name: Release 1a - Tag Release Artifact
+run-name: Tag ${{ inputs.version }}
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Metabase version (e.g. v0.46.3)'
+        type: string
+        required: true
+      commit:
+        description: 'A full-length commit SHA-1 hash'
+        required: true
+      auto:
+        description: 'auto-patch release DO NOT SET MANUALLY'
+        type: boolean
+        default: false
+
+jobs:
+  start-message:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: release
+      - name: Prepare build scripts
+        run: cd ${{ github.workspace }}/release && yarn && yarn build
+      - name: Send build start message
+        uses: actions/github-script@v7
+        env:
+          SLACK_RELEASE_CHANNEL: ${{ vars.SLACK_RELEASE_CHANNEL }}
+          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
+        with:
+          script: | # js
+            const { sendPreReleaseMessage } = require('${{ github.workspace }}/release/dist/index.cjs');
+
+            await sendPreReleaseMessage({
+              github,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              version: '${{ inputs.version }}',
+              runId: '${{ github.run_id }}',
+              releaseSha: '${{ inputs.commit }}',
+              userName: '${{ github.actor }}',
+              channelName: '${{ vars.SLACK_RELEASE_CHANNEL }}',
+            }).catch(console.error);
+
+  check-version:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    outputs:
+      ee: ${{ fromJson(steps.canonical_version.outputs.result).ee }}
+      oss: ${{ fromJson(steps.canonical_version.outputs.result).oss }}
+    steps:
+    - name: Fail early on the incorrect version format
+      if: ${{ !(startsWith(inputs.version,'v0.') || startsWith(inputs.version,'v1.')) }}
+      run: |
+        echo "The version format is invalid!"
+        echo "It must start with either 'v0.' or 'v1.'."
+        echo "Please, try again."
+        exit 1
+    - uses: actions/checkout@v4
+      with:
+        sparse-checkout: release
+    - name: Prepare build scripts
+      run: cd ${{ github.workspace }}/release && yarn && yarn build
+    - name: Get Release Version
+      uses: actions/github-script@v7
+      id: canonical_version
+      with:
+        script: | # js
+          const { isValidVersionString, getCanonicalVersion, hasBeenReleased } = require('${{ github.workspace }}/release/dist/index.cjs');
+
+          const version = '${{ inputs.version }}';
+
+          if (!isValidVersionString(version)) {
+            throw new Error("The version format is invalid! It must start with either 'v0.' or 'v1.'.");
+          }
+
+          const versions = {
+            ee: getCanonicalVersion(version, 'ee'),
+            oss: getCanonicalVersion(version, 'oss'),
+          };
+
+          const ossReleased = await hasBeenReleased({
+            github,
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+            version: versions.oss,
+          });
+
+          const eeReleased = await hasBeenReleased({
+            github,
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+            version: versions.ee,
+          });
+
+          if (ossReleased || eeReleased) {
+            throw new Error("This version has already been released!", version);
+          }
+
+          return versions;
+
+  check-commit:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    steps:
+    - name: Check out the code to verify the release branch
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0  # IMPORTANT! to get all the branches
+        sparse-checkout: release
+    - name: Prepare build scripts
+      run: cd ${{ github.workspace }}/release && yarn && yarn build
+    - name: Get Release Branch
+      uses: actions/github-script@v7
+      id: release_branch
+      with:
+        result_encoding: string
+        script: | # js
+          const { getReleaseBranch } = require('${{ github.workspace }}/release/dist/index.cjs');
+          const version = '${{ inputs.version }}';
+          const releaseBranch = getReleaseBranch(version);
+          return releaseBranch;
+    - name: Ensure that the specified commit exists in the ${{ steps.release_branch.outputs.result }} release branch
+      run: |
+        RELEASE_BRANCH=${{ steps.release_branch.outputs.result }}
+        git checkout $RELEASE_BRANCH
+        git branch --contains ${{ inputs.commit }} | grep -q $RELEASE_BRANCH \
+          && echo "Commit found in correct release branch" \
+          || (echo "Commit not found in correct release branch" && exit 1)
+
+  tag-uberjar-for-release:
+    needs: [check-version, check-commit]
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+    strategy:
+      matrix:
+        edition: [oss, ee]
+    env:
+      INTERACTIVE: false
+    steps:
+    - name: Get correct version number
+      run: | # bash
+        if [ '${{matrix.edition}}' == 'ee' ]; then
+          version='${{ needs.check-version.outputs.ee }}'
+        else
+          version='${{ needs.check-version.outputs.oss }}'
+        fi
+
+        echo "VERSION=$version" >> $GITHUB_ENV
+    - name: Setup Java
+      uses: actions/setup-java@v4
+      with:
+        distribution: 'temurin'
+        java-version: 17 # 11 throws an error on jar uf
+
+    - name: Retrieve test build uberjar artifact for ${{ matrix.edition }}
+      id: find_release_artifact
+      uses: actions/github-script@v7
+      with:
+        result-encoding: string
+        script: | # js
+          const fs = require('fs');
+
+          const artifacts = await github.rest.actions.listArtifactsForRepo({
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+            name: `metabase-${{ matrix.edition }}-${{ inputs.commit }}-uberjar`,
+            per_page: 1,
+          });
+
+          if (!artifacts.data?.artifacts?.[0]?.id) {
+            console.warn(`No existing artifacts found for ${{ inputs.commit }}, need to build jar`);
+
+            if ("${{matrix.edition}}" === 'oss') {
+              // only trigger the build job on OSS, otherwise we'll get double builds
+              github.rest.actions.createWorkflowDispatch({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                workflow_id: 'build-for-release.yml',
+                ref: 'refs/heads/master',
+                inputs: {
+                  commit: '${{ inputs.commit }}',
+                  version: '${{ inputs.version }}',
+                }
+              });
+            }
+
+            throw new Error('aborting in favor of build script');
+          }
+
+          const artifact_id = artifacts.data.artifacts[0].id;
+
+          const download = await github.rest.actions.downloadArtifact({
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+            artifact_id: artifact_id,
+            archive_format: 'zip',
+          });
+
+          fs.writeFileSync(`${process.env.GITHUB_WORKSPACE}/mb.zip`, Buffer.from(download.data));
+    - name: Unzip Metabase artifact containing an uberjar
+      run: |
+        unzip mb.zip
+        mv target/uberjar/metabase.jar metabase.jar
+
+    - name: Update version.properties in jar
+      run: | # sh
+        jar xf metabase.jar version.properties
+        echo "Old version.properties:"
+        cat version.properties
+        sed -i "s/^tag=.*/tag=$VERSION/" version.properties
+        echo "\n\nNew version.properties:"
+        cat version.properties
+        echo "\n\nUpdating metabase.jar with new version.properties"
+        jar uf metabase.jar version.properties
+
+    - name: Store commit's SHA-1 hash
+      run:  echo ${{ inputs.commit }} > COMMIT-ID
+      shell: bash
+    - name: Calculate SHA256 checksum
+      run: sha256sum ./metabase.jar > SHA256.sum
+      shell: bash
+    - name: Upload JARs as artifact
+      uses: actions/upload-artifact@v4
+      with:
+        name: metabase-release-${{ matrix.edition }}-${{ inputs.commit }}-uberjar
+        path: |
+          ./metabase.jar
+          ./COMMIT-ID
+          ./SHA256.sum
+
+  trigger-tests:
+    needs: [tag-uberjar-for-release]
+    permissions:
+      actions: write
+    runs-on: ubuntu-22.04
+    timeout-minutes: 5
+    steps:
+      - name: trigger pre-release testing
+        uses: actions/github-script@v7
+        with:
+          script: | # js
+            github.rest.actions.createWorkflowDispatch({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              workflow_id: 'pre-release.yml',
+              ref: '${{ github.ref }}',
+              inputs: {
+                commit: '${{ inputs.commit }}',
+                version: '${{ inputs.version }}',
+                auto: '${{ inputs.auto }}',
+              }
+            });

.github/workflows/translation-update.yml

@@ -0,0 +1,134 @@
+name: Update Translations
+run-name: Update Translations for v${{ inputs.version }} - ${{ inputs.step }}
+on:
+  workflow_dispatch:
+    inputs:
+      step:
+        type: choice
+        description: Upload untranslated strings | Download translated strings
+        options:
+          - upload
+          - download
+        required: true
+      version:
+        type: string
+        description: "The version number for which to update translations (e.g. 43, 58.7)"
+        required: true
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  upload-translations:
+    name: Upload Translations
+    if: ${{ inputs.step  == 'upload' }}
+    runs-on: ubuntu-22.04
+    timeout-minutes: 20
+    env:
+      POEDITOR_API_TOKEN: ${{ secrets.POEDITOR_API_TOKEN }}
+      POEDITOR_PROJECT_ID: 200535
+      VERSION: ${{ inputs.version }}
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+    - name: Prepare front-end environment
+      uses: ./.github/actions/prepare-frontend
+    - name: Prepare back-end environment
+      uses: ./.github/actions/prepare-backend
+      with:
+        m2-cache-key: manage-translations
+    - name: install gettext
+      run: sudo apt-get install gettext
+
+    # TODO: check for untranslated strings
+
+    - name: Upload strings to be translated
+      run: | # sh
+        ./bin/i18n/update-translation-template
+        ./bin/i18n/export-pot-to-poeditor
+        echo "Strings uploaded to POEditor"
+
+    - name: Commit changes
+      env:
+        GH_TOKEN: ${{ github.token }}
+      run: | # sh
+        git config user.name github-actions
+        git config user.email github-actions@github.com
+
+        BRANCH_NAME="update-translations-v$VERSION"
+
+        git checkout -b $BRANCH_NAME
+        git add locales/
+
+        git commit -m "Add new strings for v$VERSION"
+        git push -u origin $BRANCH_NAME
+
+        gh pr create \
+        --reviewer "${GITHUB_ACTOR}" \
+        --assignee "${GITHUB_ACTOR}" \
+        --title "Update Translations for v$VERSION" \
+        --body "Update translations from POEditor for v$VERSION
+
+        See [translation update documentation](https://www.notion.so/metabase/Process-for-updating-translations-421db70048fe400da1153ad0b61102f4)
+
+        ## To Do
+
+        - [x] Upload new strings to POEditor
+        - [ ] Message contributors on POEditor (manual)
+        - [ ] Copy source strings to english language (manual)
+        - [ ] Download translations from POEditor (github action)
+        - [ ] Merge this PR and backport to the release branch (manual)
+        " \
+        --label "backport" \
+        --label "Customization/i18n"
+
+    # TODO: notify contributors
+    # TODO: copy source strings to english language
+
+  download-translations:
+    name: Download Translations
+    if: ${{ inputs.step == 'download' }}
+    runs-on: ubuntu-22.04
+    timeout-minutes: 20
+    env:
+      POEDITOR_API_TOKEN: ${{ secrets.POEDITOR_API_TOKEN }}
+      POEDITOR_PROJECT_ID: 200535
+      VERSION: ${{ inputs.version }}
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+      with:
+        # assumes there's already a branch with that name from the upload step
+        ref: update-translations-v${{inputs.VERSION}}
+    - name: Prepare back-end environment
+      uses: ./.github/actions/prepare-backend
+      with:
+        m2-cache-key: manage-translations
+
+    - name: Prepare build scripts
+      run: cd ${{ github.workspace }}/release && yarn && yarn build
+    - name: Automatically translate untranslated strings
+      uses: actions/github-script@v7
+      with:
+        script: | # js
+          const { autoTranslateSupportedLanguages } = require('${{ github.workspace }}/release/dist/index.cjs');
+
+          await autoTranslateSupportedLanguages();
+
+    - name: Download translated strings
+      run: | # sh
+        cd ${{ github.workspace }}
+        ./bin/i18n/import-po-from-poeditor
+        ./bin/i18n/build-translation-resources
+    - name: Commit changes
+      run: | # sh
+        git config user.name github-actions
+        git config user.email github-actions@github.com
+
+        BRANCH_NAME="update-translations-v$VERSION"
+
+        git add locales/
+
+        git commit -m "Update translations"
+        git push -u origin $BRANCH_NAME

.github/workflows/tusk-sanity-check.yml

@@ -0,0 +1,72 @@
+# This allows Tusk to manually run workflows to check lint/build/tests before creating a PR.
+# If you have any questions, please reach out to support@usetusk.ai.
+
+name: Tusk Sanity Check
+
+on:
+  workflow_dispatch:
+    inputs:
+      taskId:
+        description: "Tusk Task ID"
+        required: true
+      runType:
+        description: "Tusk Run Type"
+        required: true
+      runId:
+        description: "Tusk Run ID"
+        required: true
+
+jobs:
+  sanity_check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Log inputs
+        run: |
+          echo "Tusk Task ID: ${{ github.event.inputs.taskId }}"
+          echo "Tusk Run Type: ${{ github.event.inputs.runType }}"
+          echo "Tusk Run ID: ${{ github.event.inputs.runId }}"
+          echo "Current Branch: ${{ github.ref }}"
+          echo "Repository default branch: ${{ github.event.repository.default_branch }}"
+
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.ref }}
+          fetch-depth: 0
+
+      - name: Check which files changed
+        uses: dorny/paths-filter@v3.0.0
+        id: changes
+        with:
+          token: ${{ github.token }}
+          filters: .github/file-paths.yaml
+
+      # Similar to .github/workflows/frontend.yml
+      - name: Prepare front-end environment
+        if: steps.changes.outputs.frontend_all == 'true'
+        uses: ./.github/actions/prepare-frontend
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+        with:
+          m2-cache-key: "cljs"
+      - run: yarn build-pure:cljs
+        name: Compile CLJS
+
+      - name: Run lint-staged
+        if: steps.changes.outputs.frontend_all == 'true'
+        run: |
+          BASE_COMMIT=$(git merge-base origin/${{ github.event.repository.default_branch }} HEAD)
+          npx lint-staged --shell --no-stash --diff="$BASE_COMMIT...HEAD"
+
+      # You must include this step after running all auto-fixing steps
+      - uses: stefanzweifel/git-auto-commit-action@v5
+        with:
+          commit_message: "fix(${{ github.run_id }}): auto linting" # The commit message MUST start with "fix(${{ github.run_id }}):"
+          commit_options: "--no-verify" # No verify because we already ran it above
+          skip_fetch: true
+          skip_checkout: true
+          status_options: "--untracked-files=no"
+          add_options: "--update"
+
+      - name: Check types
+        if: steps.changes.outputs.frontend_all == 'true'
+        run: yarn type-check-pure

.github/workflows/uberjar-sdk.yml

@@ -0,0 +1,157 @@
+name: Build + Docker Uberjar for SDK
+
+on:
+  # This workflow will be called from "release-embedding-sdk.yml"
+  workflow_call:
+    inputs:
+      git_ref:
+        description: 'Valid git reference e.g. branches, tags, hashes'
+        type: string
+        required: true
+      image_name:
+        description: Docker image used to upload to Dockerhub
+        type: string
+        required: true
+
+jobs:
+  build:
+    name: Build MB ${{ matrix.edition }}
+    runs-on: ubuntu-22.04
+    timeout-minutes: 40
+    strategy:
+      matrix:
+        edition: [ee]
+    env:
+      MB_EDITION: ${{ matrix.edition }}
+      INTERACTIVE: false
+    steps:
+    - name: Check out the code
+      uses: actions/checkout@v4
+      with:
+        ref: ${{ inputs.git_ref }}
+    - name: Prepare front-end environment
+      uses: ./.github/actions/prepare-frontend
+    - name: Prepare back-end environment
+      uses: ./.github/actions/prepare-backend
+      with:
+        m2-cache-key: uberjar
+    - name: Build
+      run: ./bin/build.sh
+    - name: Prepare uberjar artifact
+      uses: ./.github/actions/prepare-uberjar-artifact
+      with:
+        name: metabase-ee-uberjar
+
+  check_jar_health:
+    runs-on: ubuntu-22.04
+    name: Is ${{ matrix.edition }} (java ${{ matrix.java-version }}) healthy?
+    needs: build
+    timeout-minutes: 10
+    strategy:
+      matrix:
+        edition: [ee]
+        java-version: [11, 17]
+    steps:
+    - name: Prepare JRE (Java Run-time Environment)
+      uses: actions/setup-java@v4
+      with:
+        java-package: jre
+        java-version: ${{ matrix.java-version }}
+        distribution: 'temurin'
+    - run: java -version
+    - uses: actions/download-artifact@v4
+      name: Retrieve uberjar artifact
+      with:
+        name: metabase-ee-uberjar
+    - name: Launch uberjar
+      run: java -jar ./target/uberjar/metabase.jar &
+    - name: Wait for Metabase to start
+      run: while ! curl 'http://localhost:3000/api/health' | grep '{"status":"ok"}'; do sleep 1; done
+
+  containerize_test_and_push_container:
+    runs-on: ubuntu-22.04
+    name: Containerize ${{ matrix.edition }}
+    needs: check_jar_health
+    strategy:
+      matrix:
+        edition: [ee]
+    services:
+      registry:
+        image: registry:2
+        ports:
+          - 5000:5000
+    steps:
+      - name: Extract and clean branch name
+        shell: bash
+        run: echo "branch=$(echo $GITHUB_REF_NAME | sed 's/[^-._a-zA-Z0-9]/-/g')" >> $GITHUB_OUTPUT
+        id: extract_branch
+
+      - name: Set image name to env
+        run: echo "image_name=${{ inputs.image_name || steps.extract_branch.outputs.branch }}" >> "$GITHUB_ENV"
+
+      - name: Verify the intended tag of the container image
+        run: echo "Container image will be tagged as ${{ env.image_name }}-${{ matrix.edition }}"
+
+      - name: Check out the code (Dockerfile needed)
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.git_ref }}
+
+      - name: Download uploaded artifacts to insert into container
+        uses: actions/download-artifact@v4
+        with:
+          name: metabase-ee-uberjar
+          path: bin/docker/
+
+      - name: Move the ${{ matrix.edition }} uberjar to the context dir
+        run: mv bin/docker/target/uberjar/metabase.jar bin/docker/.
+
+      - name: Set up Docker Buildx
+        id: buildx
+        uses: docker/setup-buildx-action@v2.5.0
+        with:
+          driver-opts: network=host
+
+      - name: Build ${{ matrix.edition }} container
+        uses: docker/build-push-action@v3
+        with:
+          context: bin/docker/.
+          platforms: linux/amd64
+          network: host
+          tags: localhost:5000/metabase-dev:${{ env.image_name }}-${{ matrix.edition }}
+          no-cache: true
+          push: true
+
+      - name: Launch ${{ matrix.edition }} container
+        run: docker run --rm -dp 3000:3000 localhost:5000/metabase-dev:${{ env.image_name }}-${{ matrix.edition }}
+        timeout-minutes: 5
+
+      - name: Is Docker running?
+        run: docker ps
+
+      - name: Wait for Metabase to start and reach 100% health
+        run: while ! curl -s 'http://localhost:3000/api/health' | grep '{"status":"ok"}'; do sleep 1; done
+        timeout-minutes: 3
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Retag and push images
+        run: docker tag localhost:5000/metabase-dev:${{ env.image_name }}-ee ${{ github.repository_owner }}/metabase-dev:${{ env.image_name }} && docker push ${{ github.repository_owner }}/metabase-dev:${{ env.image_name }}
+
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@master
+        env:
+          TRIVY_OFFLINE_SCAN: true
+        with:
+          image-ref: docker.io/${{ github.repository_owner }}/metabase-dev:${{ env.image_name }}
+          format: sarif
+          output: trivy-results.sarif
+
+      - name: Upload Trivy scan results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v2
+        with:
+          sarif_file: 'trivy-results.sarif'

.github/workflows/uberjar.yml

@@ -116,6 +116,8 @@ jobs:
         platforms: linux/amd64
         network: host
         tags: localhost:5000/metabase-dev:${{ steps.extract_branch.outputs.branch }}-${{ matrix.edition }}
+        build-args: |
+          GIT_COMMIT_SHA=${{ github.sha }}
         no-cache: true
         push: true
     - name: Launch ${{ matrix.edition }} container
@@ -240,6 +242,8 @@ jobs:
           file: bin/docker/Dockerfile_ubuntu
           network: host
           tags: localhost:5000/metabase-dev:${{ steps.extract_branch.outputs.branch }}-${{ matrix.edition }}-ubuntu
+          build-args: |
+            GIT_COMMIT_SHA=${{ github.sha }}
           no-cache: true
           push: true
       - name: Launch ${{ matrix.edition }} Ubuntu based container

.gitignore

@@ -1,4 +1,5 @@
 *.class
+*.*.rej
 *.iml
 *.jar
 *.log
@@ -26,7 +27,7 @@
 /.lein-repl-history
 /.sqlite.db
 /backend-checksums.txt
-/backend-docs/uberdoc.html
+/backend-docs
 /build.xml
 /checkouts
 /classes
@@ -50,6 +51,7 @@
 /resources/frontend_client/embed.html
 /resources/frontend_client/index.html
 /resources/frontend_client/public.html
+/resources/embedding-sdk
 /resources/i18n/*.edn
 /resources/instance_analytics.zip
 /resources/license-backend-third-party.txt
@@ -94,7 +96,8 @@ modules/drivers/*/.lsp/*
 .clj-kondo/*
 !.clj-kondo/README.md
 !.clj-kondo/config.edn
-!.clj-kondo/hooks/
+!.clj-kondo/src/
+!.clj-kondo/test/
 !.clj-kondo/macros/
 
 # Editor- or environment-specific local files
@@ -106,3 +109,9 @@ modules/drivers/*/.lsp/*
 .clj-kondo/metosin/malli-types-clj
 
 .github/static-viz-sources.yaml
+
+# airgap
+/resources/airgap/
+
+# swc
+.swc/