Spike: sqlc -> Clojure query codegen with Malli schemas

Generate Clojure query fns with Malli result schemas from .sql files, using
sqlc for SQL parsing and type inference and sqlc-gen-json to expose its
analysis as JSON.

Verified end to end: migrations against Postgres 16 (1427 changesets, 190
tables), pg_dump fed to sqlc unmodified, real queries ported from the
glossary/sso HugSQL spike branches, and the generated file compiles with
schemas that accept valid rows and reject bad ones.

See dev/src/dev/sqlc/README.md for open issues (no H2 engine, weak param
type inference, no dynamic SQL).

.claude/agents/modules-backend-expert.md

@@ -81,7 +81,7 @@ Everything else in the module is **internal** and not allowed to be referenced f
 
 `dev/src/dev/modularization_help.clj` — `potemkin-ns!` helper that generates `.core` re-export boilerplate from a target namespace.
 
-`test/metabase/core/modules_test.clj` — runs on config changes; validates structure, team assignments, API and model boundaries.
+`dev/test/metabase/core/modules_test.clj` — runs on config changes; validates structure, team assignments, API and model boundaries.
 
 ### API Design Inside a Module
 
@@ -119,7 +119,7 @@ When the linter complains, the answer is **always refactoring**, never suppressi
 - `dev/src/dev/module_score.clj` — quality scoring
 - `dev/src/dev/modularization_help.clj` — Potemkin re-export helper
 - `dev/src/dev/model_boundary_config.clj` + `dev/src/dev/model_tracking.clj` — model-level enforcement
-- `test/metabase/core/modules_test.clj` — config validation tests
+- `dev/test/metabase/core/modules_test.clj` — config validation tests
 - `src/metabase/core/init.clj` — OSS module init aggregation
 - `enterprise/backend/src/metabase_enterprise/core/init.clj` — EE module init aggregation
 - `src/metabase/models/resolution.clj` — `:model/X` keyword → namespace map
@@ -198,6 +198,6 @@ Use the `clojure-eval` skill (preferred) or `clj-nrepl-eval` to drive the dev to
 (dev.module-score/scores (dev.module-score/deps) (dev.module-score/config))
 ```
 
-For tests of the config itself, use `./bin/test-agent :only '[metabase.core.modules-test]'`. After editing Clojure files, run `clj-paren-repair`. After editing `config.edn`, re-run the modules-test.
+For tests of the config itself, use `./bin/mage project-tests modules`. After editing Clojure files, run `clj-paren-repair`. After editing `config.edn`, re-run the modules-test.
 
 **Update your agent memory** as you discover idioms: which modules use `:friends` and why, which models are most-imported (suggesting they belong in their own module), which settings are accessed cross-module via `(setting/get …)` instead of `:uses` deps, and which refactors the team is actively running.

.claude/skills/_shared/clojure-style-guide.md

@@ -304,12 +304,13 @@ Tag response Malli `:map` schemas with `{:closed true}` so the generated OpenAPI
 
 **Linter Suppressions:**
 
-The right shape is a **reader-discard map** placed directly above the form being silenced, listing the rule keywords explicitly:
+The right shape is a **reader-discard map** placed directly above the form being silenced, listing the
+rule keywords explicitly and including the required explanation:
 
 ```clojure
-#_{:clj-kondo/ignore [:metabase/validate-defendpoint-route-uses-kebab-case
-                      :metabase/validate-defendpoint-has-response-schema]}
-(api.macros/defendpoint :post "/api_key" ...)
+;; Loaded by name from the plugin registry.
+#_{:clj-kondo/ignore [:clojure-lsp/unused-public-var]}
+(defn plugin-entrypoint ...)
 ```
 
 For a single require entry, hang it as metadata on that entry:
@@ -320,7 +321,12 @@ For a single require entry, hang it as metadata on that entry:
  [metabase.query-processor.store :as qp.store])
 ```
 
-Common Metabase-specific rules you'll see: `:metabase/modules`, `:metabase/validate-defendpoint-route-uses-kebab-case`, `:metabase/validate-defendpoint-has-response-schema`, `:metabase/prefer-with-dynamic-fn-redefs`, `:deprecated-namespace`, `:discouraged-namespace`. Don't use the keyword form (`#_:clj-kondo/ignore`); always the map form so it's grep-able by which rule(s) are suppressed.
+Use the map form, not the keyword form (`#_:clj-kondo/ignore`), so searches can identify the suppressed
+rules. Keep `:clj-kondo/ignore` as the map's first key; the ratchet scanner rejects other orderings.
+
+Fix the warning when possible. Adding a suppression is a last resort and requires approval. If one is
+necessary, add an explanatory `;;` comment directly above it or at the end of the same line. CI enforces
+these requirements with `./bin/mage kondo-ratchets`.
 
 **Configurable Options:**
 

.claude/skills/add-malli-schemas/SKILL.md

@@ -149,8 +149,7 @@ ms/NonBlankString               ;; Non-empty string
 ms/BooleanValue                 ;; String "true"/"false" or boolean
 ms/MaybeBooleanValue            ;; BooleanValue or nil
 ms/TemporalString               ;; ISO-8601 date/time string (for REQUEST params only!)
-ms/Map                          ;; Any map
-ms/JSONString                   ;; JSON-encoded string
+ms/OpaqueJSONObject             ;; JSON object whose keys are not ours to declare; string-keyed
 ms/PositiveNum                  ;; Positive number
 ms/IntGreaterThanOrEqualToZero  ;; 0 or positive
 ```

.claude/skills/clojure-review/SKILL.md

@@ -111,7 +111,12 @@ liability it usually is.
 ### Miscellaneous
 
 - [ ] Example data is bird-themed when possible
-- [ ] Kondo linter suppressions use proper format (not `#_:clj-kondo/ignore` keyword form)
+- [ ] Kondo suppressions use a reader-discard map, not `#_:clj-kondo/ignore`, with
+      `:clj-kondo/ignore` as the first key
+- [ ] Each new suppression is approved and has a `;;` comment explaining why the warning cannot be fixed
+- [ ] Any ratchet budget increase is explained in the PR
+- [ ] PRs that remove ignores leave ratchet budgets unchanged; the shrink workflow records reductions on
+      `master`
 
 ## Pattern matching table
 

.claude/skills/clojure-write/SKILL.md

@@ -123,5 +123,12 @@ breakage keeps happening, *that* is the signal a comment was warranted.
 - Spaces on a line with nothing after it is not allowed
 - After changing module boundaries (adding/removing/renaming a `src` namespace, a cross-module `require`
   or `:model/X` reference, or a new module), run `./bin/mage fix-modules-config` to regenerate
-  `.clj-kondo/config/modules/config.edn` and keep `metabase.core.modules-test` green. No-op when nothing
-  drifted; see "Module Boundaries" in the project `CLAUDE.md`.
+  `.clj-kondo/config/modules/config.edn`, then run `./bin/mage project-tests modules`. The fixer is a no-op when
+  nothing drifted; see "Module Boundaries" in the project `CLAUDE.md`.
+- Fix kondo warnings instead of suppressing them. Add a suppression only as a last resort, with approval
+  and a `;;` comment explaining why it is necessary.
+- Do not lower budgets in `.clj-kondo/ratchets.edn` after removing ignores. The shrink workflow records
+  reductions on `master`.
+- If `.clj-kondo/ratchets.edn` conflicts during a merge, rebase, or restack, run
+  `./bin/merge-kondo-ratchets`. It preserves one-sided changes, chooses the policy that allows fewer
+  suppressions when both sides change the same entry, and stops when the conflict needs a human decision.

.claude/skills/e2e-test/SKILL.md

@@ -37,14 +37,16 @@ First check if snapshots exist:
 ls e2e/snapshots/default.sql 2>/dev/null && echo "snapshots exist" || echo "snapshots missing"
 ```
 
+Always pass the spec path via `--spec`. The runner feeds its arguments to Cypress's CLI parser (`cypress.cli.parseRunArguments`), which silently drops bare positional paths and then runs the entire suite. A leading `run` argument is harmless, but the path itself must follow `--spec`. Sanity-check that the first `Running:` line says `(1 of 1)`.
+
 If snapshots exist, skip regeneration for speed:
 ```bash
-MB_EDITION=oss CYPRESS_VIDEO=false CYPRESS_RETRIES=0 CYPRESS_GUI=false GENERATE_SNAPSHOTS=false bun test-cypress $ARGUMENTS
+MB_EDITION=oss CYPRESS_VIDEO=false CYPRESS_RETRIES=0 CYPRESS_GUI=false GENERATE_SNAPSHOTS=false bun test-cypress --spec path/to/spec.cy.spec.js
 ```
 
 If snapshots are missing (first run), let the runner generate them:
 ```bash
-MB_EDITION=oss CYPRESS_VIDEO=false CYPRESS_RETRIES=0 CYPRESS_GUI=false bun test-cypress $ARGUMENTS
+MB_EDITION=oss CYPRESS_VIDEO=false CYPRESS_RETRIES=0 CYPRESS_GUI=false bun test-cypress --spec path/to/spec.cy.spec.js
 ```
 
 When running enterprise tests, replace `MB_EDITION=oss` with `MB_EDITION=ee` in the commands above.
@@ -67,9 +69,11 @@ GREP="test name here" MB_EDITION=oss bun test-cypress --spec path/to/spec.js
 When the user asks to verify a test is not flaky:
 
 ```bash
-MB_EDITION=oss bin/e2e-stress-test $ARGUMENTS
+MB_EDITION=oss bin/e2e-stress-test --spec path/to/spec.cy.spec.js
 ```
 
+(The stress script forwards its arguments to `bun test-cypress`, so the same `--spec` rule applies.)
+
 Set `E2E_STRESS_RUNS=N` for more iterations (default: 5). Stops on first failure and prints screenshot paths. Read those screenshots to analyze the failure.
 
 ## Analyzing failures

.claude/skills/emotion-migrate/SKILL.md

@@ -171,7 +171,7 @@ Create `ComponentName.module.css` alongside the component file:
 /* Use design system tokens — NEVER raw color/spacing values */
 .root {
   border: 1px solid var(--mb-color-border-neutral);
-  border-radius: var(--mantine-radius-md);
+  border-radius: var(--mantine-radius-sm);
   background-color: var(--mb-color-background_page-primary);
 }
 
@@ -246,7 +246,8 @@ Remove the old styled file entirely. Remove all imports of it from other files.
 
 **Spacing** (`p`, `px`, `py`, `pt`, `pb`, `pl`, `pr`, `m`, `mx`, `my`, `mt`, `mb`, `ml`, `mr`):
 
-- `"xs"` = 4px, `"sm"` = 8px, `"md"` = 16px, `"lg"` = 24px, `"xl"` = 32px
+- `"xxxs"` = 0.125rem, `"xxs"` = 0.25rem, `"xs"` = 0.375rem, `"sm"` = 0.5rem, `"md"` = 0.75rem, `"lg"` = 1rem, `"xl"` = 1.5rem, `"xxl"` = 2rem, `"xxxl"` = 2.5rem
+- Use numeric `0` for zero spacing.
 - Custom: `rem(48)` for non-standard values (import `rem` from `metabase/ui`)
 
 **Dimensions** (`w`, `h`, `maw`, `mah`, `miw`, `mih`):
@@ -289,11 +290,16 @@ Remove the old styled file entirely. Remove all imports of it from other files.
 
 **Mantine spacing** — `var(--mantine-spacing-<size>)`:
 
-- `--mantine-spacing-xs` (4px), `--mantine-spacing-sm` (8px), `--mantine-spacing-md` (16px), `--mantine-spacing-lg` (24px), `--mantine-spacing-xl` (32px)
+- `--mantine-spacing-xxxs` (0.125rem), `--mantine-spacing-xxs` (0.25rem), `--mantine-spacing-xs` (0.375rem), `--mantine-spacing-sm` (0.5rem), `--mantine-spacing-md` (0.75rem), `--mantine-spacing-lg` (1rem), `--mantine-spacing-xl` (1.5rem), `--mantine-spacing-xxl` (2rem), `--mantine-spacing-xxxl` (2.5rem)
 
 **Mantine radius** — `var(--mantine-radius-<size>)`:
 
-- `--mantine-radius-xs` (4px), `--mantine-radius-sm` (6px), `--mantine-radius-md` (8px), `--mantine-radius-xl` (40px)
+- `--mantine-radius-xxxs` (0.125rem), `--mantine-radius-xxs` (0.25rem), `--mantine-radius-xs` (0.375rem), `--mantine-radius-sm` (0.5rem), `--mantine-radius-md` (0.75rem), `--mantine-radius-lg` (1rem), `--mantine-radius-xl` (1.5rem)
+
+**Mantine shadows (elevation)** — `var(--mantine-shadow-<size>)`:
+
+- `--mantine-shadow-xs`, `--mantine-shadow-xs_outline`, `--mantine-shadow-sm`, `--mantine-shadow-sm_outline`, `--mantine-shadow-lg_outline`
+- Light and dark modes use different shadow values (defined in `frontend/src/metabase/ui/theme.ts`)
 
 **Mantine font sizes** — `var(--mantine-font-size-<size>)`:
 
@@ -313,24 +319,36 @@ When migrating, **never carry over hardcoded `rem`/`px` values** from the origin
 
 **Spacing** — snap to the nearest Mantine spacing token:
 
-| Hardcoded value                   | Nearest token | Style prop   | CSS variable                   |
-| --------------------------------- | ------------- | ------------ | ------------------------------ |
-| `0.125rem` (2px)                  | `2px`         | `2` (number) | `2px` (keep literal, no token) |
-| `0.2rem` (3.2px), `0.25rem` (4px) | **xs** (4px)  | `"xs"`       | `var(--mantine-spacing-xs)`    |
-| `0.5rem` (8px)                    | **sm** (8px)  | `"sm"`       | `var(--mantine-spacing-sm)`    |
-| `0.75rem` (12px)                  | between sm/md | `rem(12)`    | `0.75rem` (no exact token)     |
-| `1rem` (16px)                     | **md** (16px) | `"md"`       | `var(--mantine-spacing-md)`    |
-| `1.5rem` (24px)                   | **lg** (24px) | `"lg"`       | `var(--mantine-spacing-lg)`    |
-| `2rem` (32px)                     | **xl** (32px) | `"xl"`       | `var(--mantine-spacing-xl)`    |
+| Hardcoded value                   | Nearest token | Style prop | CSS variable                    |
+| --------------------------------- | ------------- | ---------- | ------------------------------- |
+| `0` (0px)                         | —             | `0`        | `0`                             |
+| `0.125rem` (2px)                  | **xxxs**      | `"xxxs"`   | `var(--mantine-spacing-xxxs)`   |
+| `0.2rem` (3.2px), `0.25rem` (4px) | **xxs**       | `"xxs"`    | `var(--mantine-spacing-xxs)`    |
+| `0.375rem` (6px)                  | **xs**        | `"xs"`     | `var(--mantine-spacing-xs)`     |
+| `0.5rem` (8px)                    | **sm**        | `"sm"`     | `var(--mantine-spacing-sm)`     |
+| `0.75rem` (12px)                  | **md**        | `"md"`     | `var(--mantine-spacing-md)`     |
+| `1rem` (16px)                     | **lg**        | `"lg"`     | `var(--mantine-spacing-lg)`     |
+| `1.5rem` (24px)                   | **xl**        | `"xl"`     | `var(--mantine-spacing-xl)`     |
+| `2rem` (32px)                     | **xxl**       | `"xxl"`    | `var(--mantine-spacing-xxl)`    |
+| `2.5rem` (40px)                   | **xxxl**      | `"xxxl"`   | `var(--mantine-spacing-xxxl)`   |
+
+Values between steps: keep the literal (e.g. `rem(10)`), don't round to a token.
 
 **Border radius** — snap to the nearest Mantine radius token:
 
-| Hardcoded value  | Nearest token                 | CSS variable               |
-| ---------------- | ----------------------------- | -------------------------- |
-| `0.25rem` (4px)  | **xs** (4px)                  | `var(--mantine-radius-xs)` |
-| `0.375rem` (6px) | **sm** (6px)                  | `var(--mantine-radius-sm)` |
-| `0.5rem` (8px)   | **md** (8px)                  | `var(--mantine-radius-md)` |
-| `1rem`+ (16px+)  | **xl** (40px) or keep literal | `var(--mantine-radius-xl)` |
+| Hardcoded value  | Nearest token | CSS variable                  |
+| ---------------- | ------------- | ----------------------------- |
+| `0` (0px)        | —             | `0`                           |
+| `0.125rem` (2px) | **xxxs**      | `var(--mantine-radius-xxxs)`  |
+| `0.25rem` (4px)  | **xxs**       | `var(--mantine-radius-xxs)`   |
+| `0.375rem` (6px) | **xs**        | `var(--mantine-radius-xs)`    |
+| `0.5rem` (8px)   | **sm**        | `var(--mantine-radius-sm)`    |
+| `0.75rem` (12px) | **md**        | `var(--mantine-radius-md)`    |
+| `1rem` (16px)    | **lg**        | `var(--mantine-radius-lg)`    |
+| `1.5rem` (24px)  | **xl**        | `var(--mantine-radius-xl)`    |
+
+Fully-round pills/badges (radius ≥ half the element height): keep a literal
+such as `9999px`.
 
 **Font sizes** — snap to the nearest Mantine font size token:
 

.claude/skills/fe-modularization/SKILL.md

@@ -0,0 +1,248 @@
+---
+name: fe-modularization
+description: Deciding where frontend code lives — tier model, move mechanics, extension points, side effects, naming, and the traps. Use when moving code between modules, carving new modules, fixing boundary violations, adding a barrel or an endpoint, or reviewing module-shape decisions.
+---
+
+# Frontend modularization
+
+The module is the unit of blast radius: dependency direction, test selection,
+bundle cones, and review scope all follow module boundaries. Every decision
+here serves one goal: **make the file locations tell the truth about who owns
+what and who may depend on whom.**
+
+## Hard rules (check these before anything else)
+
+- NEVER add an `export … from` re-export at an old path, and NEVER `export *`
+  from a barrel. Move the code, codemod every call site, delete the old path,
+  all in the same PR.
+- NEVER import past a module's `index.ts` when that module has
+  `enforcePublicApi: true`, and never past `metabase/ui`'s index at all. If
+  the barrel is heavy, the fix is making the module side-effect free (below),
+  not a deep import.
+- NEVER rewrite a consumer to a lower-level idiom to make the linter pass. If
+  the fix makes the consumer worse, the plan is wrong.
+- NEVER give a new module `enforceSharedTiers: false`; new modules ship
+  enforced with `enforcePublicApi: true` and an explicit `index.ts`.
+- NEVER move code without the consumer-tier check (procedure step 2).
+- ALWAYS delete a module's `enforceSharedTiers: false` line in the PR that
+  takes it to zero violations.
+- ALWAYS measure `bun run module-boundaries` before and after, and report the
+  numbers.
+- ALWAYS import `dayjs` from `metabase/dayjs`, routing from `metabase/router`,
+  Mantine from `metabase/ui`, react-redux hooks from `metabase/redux`; the
+  raw specifiers are lint-forbidden.
+
+## Files that are ground truth
+
+| what | where |
+|---|---|
+| module elements, tiers, `enforceSharedTiers`, `enforcePublicApi` | `frontend/lint/module-boundaries.mjs` |
+| shared sub-tiers and levels, cluster rules | `frontend/lint/shared-tiers.mjs` |
+| standalone boundaries lint (all violations, incl. grandfathered) | `bun run module-boundaries` (config `eslint.config.module-boundaries.mjs`) |
+| PR lint (only enforced modules fail CI) | `bun run lint-eslint-pure` |
+| side-effect-free directories and their exceptions | `frontend/build/shared/rspack/side-effect-free-modules.js` (`SIDE_EFFECT_FREE_PATHS`, `SIDE_EFFECT_PATHS`) |
+| the lint rules that enforce that promise | `metabase/no-module-side-effects`, `metabase/no-base-api-access` in `frontend/lint/eslint-plugin-metabase/rules/` |
+| public-api enforcement | `metabase/enforce-module-public-api` rule, driven by `getPublicApiModules()` |
+
+## The model
+
+Tiers: `lib < basic < shared < feature < app`. Imports point downward, never
+sideways at feature tier (features may not import features; app and EE may
+import anything). The shared tier is subdivided in `shared-tiers.mjs` into
+shared-utils (U0…), shared-platform (P0…), and shared-domain, each ordered
+into levels. A module imports only *strictly lower* levels of its sub-tier
+plus the sub-tiers below; same-level peers are deliberately forbidden, which
+is what makes cycles structurally impossible. A domain may hold two seats
+when consumers demand it: a low core and a high surface (metabase-lib below
+questions below query_builder; viz-core below visualizations).
+
+Enforcement is per module: `enforceSharedTiers: false` on an element exempts
+it from the level rules (counted by `bun run module-boundaries`, invisible to
+PR lint). Modules with `enforcePublicApi: true` may only be imported from
+outside via `metabase/<module>`, and import relatively inside.
+
+## Deciding where code lives (apply in order; first decisive test wins)
+
+1. **Who owns the concept?** Code lives with the module that owns its
+   concept, not the module that renders or calls it. A mode encoding dashboard
+   click behaviour is dashboard code even if viz executes it. Metabot
+   conversation state is metabot state even though the store registers it.
+2. **Consumer-tier check.** The destination must sit at or below the file's
+   *lowest* consumer. A single consumer below the proposed home vetoes the
+   move; report it, don't force it.
+3. **Only four legitimate fixes** for a bad edge: move the code to its
+   terminal home; invert through a designed extension point (a prop, an
+   injected component, a contract type owned by the socket); fix the tier
+   placement when the declared level is wrong; delete a thin wrapper (a rename
+   with no derivation isn't an abstraction — deleting it *is* the migration).
+4. **A bridge lives above the lower endpoint.** Code that needs both sides of
+   a boundary belongs in or above the higher module.
+5. **"Genuinely shared" is proven by consumers.** A shared address needs two
+   or more consumers the tier rules can't serve another way. One consumer
+   pretending to be shared is a feature module at the wrong address.
+
+## Extension points
+
+The socket's owner defines the contract; every plug lives with its extender.
+Visualization owns the `mode` prop and click interfaces, each surface supplies
+its mode; the editor owns its extension contract, metabot supplies tiptap
+extensions; querying owns `TemplateTagsSidebarProps`, parameters implements
+it.
+
+- Prefer plain props/injection at composition sites. `PLUGIN_*` registries are
+  for edition gating; single-reader slots move out to their reading module;
+  slots with many readers live in the module that owns the concept (every
+  slot the whitelabel plugin fills lives in `whitelabel`), tier permitting.
+  Keep contracts type-light so implementations can load lazily.
+- Identical injection at every callsite is acceptable until a fourth consumer
+  or second slot appears; then the composition deserves its own module above
+  both parts. Don't pre-build the wrapper.
+
+## Store shape
+
+A module that has redux state owns it:
+
+- `store/` is private: reducer, plain creators/action types, and selectors,
+  typed against the module's own state (`QueryBuilderStoreState`), never the
+  global `State`. Thunks live in `actions/` and import `store/`, never the
+  reverse.
+- The barrel is the state API: selectors for reads, creators/thunks for
+  writes.
+- Store roots (`reducers-main`, `reducers-public`, the SDK store) import each
+  slice from its module barrel and derive their own state type; no slice
+  registry, no `declare module` merging.
+- Cross-module writes: a callback prop when a composition point exists;
+  otherwise dispatch the owner's exported creator; an event only when the
+  emitter must not know its listeners. Raw `dispatch({ type: "…" })` strings
+  are banned. A reducer or listener matching another module's *internal*
+  action is the coupling to remove.
+- Slices that mirror one endpoint get deleted (the RTK cache is the state); a
+  fold over many sources with one writer (the metadata store) is kept as a
+  module-private slice behind the barrel.
+
+## Endpoints
+
+Endpoints migrate to their owning module via `Api.injectEndpoints` from the
+module's `api/` file (settings, metabot, transforms precedents); `metabase/api`
+trends toward the client only. There is one `Api` object per backend because
+tag invalidation only works within one instance. Consumers reach endpoints
+only through the owner's exports (`useGetCardQuery`, `cardApi.endpoints.…`),
+never by name through the base object; `metabase/no-base-api-access` allows
+injection only in `metabase/api` and `**/api/**` / `**/api.ts`, and reaching by
+name only in `metabase/api` and test support (`invalidateTags` /
+`resetApiState` are fine anywhere). Each endpoint move carries its
+metadata-store hookup: the owner calls `entitiesFetched` from its own
+`onQueryStarted`.
+
+## Import-time side effects
+
+Directories in `SIDE_EFFECT_FREE_PATHS` are marked `sideEffects: false` for
+rspack, so importing one export from their barrel no longer drags the whole
+barrel into a bundle. The price: nothing in those directories may do work at
+import time, or production silently drops it. `metabase/no-module-side-effects`
+enforces this over every listed directory (module-scope calls, writes to
+imported objects or globals, bare imports, control flow at import; escape
+hatches are `/* #__PURE__ */` and the rule's pure-callee list). Files that
+must run at import are listed in `SIDE_EFFECT_PATHS` (files or directories).
+
+- **A library the app configures gets a facade module** owning the vendor
+  import, the registrations, and the types, with the raw specifier
+  lint-forbidden outside it: `metabase/router`, `metabase/ui`,
+  `metabase/redux`, `metabase/dayjs`. Facades are the effect, so they never
+  enter `SIDE_EFFECT_FREE_PATHS`. Never re-register a vendor plugin locally
+  (`dayjs.extend`, `echarts` `use`).
+- **A patch a component needs is an explicit registration module,
+  bare-imported by the provider that needs it** and listed in
+  `SIDE_EFFECT_PATHS` (Mantine's `Popover.Dropdown` replacement, imported by
+  `ThemeProvider`).
+- **Effects with no value to import** (global CSS, polyfills, the CSP nonce,
+  EE plugin bootstrap) live in the entry's side-effects file and nowhere else.
+- **Registries are filled from the composition root at boot**
+  (`initializePlugins`, `registerVisualizations`), never by a module
+  registering itself at import.
+- **RTK injection stays at import**; when a module with an `api/` folder is
+  declared side-effect free, list `<module>/api/` in `SIDE_EFFECT_PATHS`.
+
+## Naming
+
+The feature keeps the plain product-surface name; a shared carve is named for
+what the shared part actually is: the concept when the concept is the shared
+thing (`settings`, `current-user`, `whitelabel`, `dayjs`), or a qualified
+capability when the plain noun is taken (`search-ui`, `metrics-ui`,
+`viz-core`, `data-studio-ui`). Never two modules distinguished only by tier
+prefix; never generic `-shared` / `-feature` suffixes.
+
+## Procedure for a move
+
+1. **Enumerate consumers honestly** (hook-name greps miss the last three):
+   ```
+   grep -rn "metabase/<module>" frontend/src enterprise/frontend/src frontend/test e2e
+   grep -rn "jest.mock(\"metabase/<module>" frontend enterprise/frontend
+   grep -rn "addMatcher(.*<endpoint>" frontend/src enterprise/frontend/src
+   ```
+   plus sibling files importing the moved file relatively. Classify each by
+   module and tier from `module-boundaries.mjs` / `shared-tiers.mjs`.
+2. **Consumer-tier check**: destination at or below the lowest consumer. If
+   not, stop and report the blocking consumer.
+3. **Measure before**: `bun run module-boundaries 2>&1 | tail -1` on the base
+   (write the number down).
+4. **Move**: `git mv`; codemod every importer to `metabase/<module>` (outside)
+   or a relative path (inside); add named exports to the destination barrel
+   for every symbol an outside consumer needs (each must have a real
+   consumer). Delete the old path. If the module didn't exist: add its element
+   in `module-boundaries.mjs` (ordered before any element it's carved from,
+   first match wins), its level in `shared-tiers.mjs`, `enforcePublicApi:
+   true`, an `index.ts`. If the move empties a module's violations, delete
+   its `enforceSharedTiers: false` line. If the module has an `api/` folder
+   and is side-effect free, list `<module>/api/` in `SIDE_EFFECT_PATHS`.
+5. **Verify** (all of these, report the numbers):
+   ```
+   grep -rn "<old path>" frontend enterprise/frontend e2e        # must be empty
+   bunx eslint --no-warn-ignored <touched files>
+   bun run lint-eslint-pure                                       # enforce-module-public-api included
+   bun run type-check-pure
+   bun run test-unit-keep-cljs <touched folders' specs>
+   bun run module-boundaries 2>&1 | tail -1                       # after; no violation may name the new files
+   bun run build-release:static-viz                               # only if viz/static-viz/ui/dayjs touched; hard 3.5 MiB budget
+   ```
+6. **Report**: count before/after (state count-neutral explicitly), the edges
+   removed by file, flags/rules deleted, barrel exports added, anything you
+   skipped and why, and any consumer you found that vetoed part of the move.
+
+## Traps (each has bitten at least once)
+
+- **Late binding.** A bare function reference in a `createSelector` input
+  array, a component identity captured for comparison, a `PLUGIN_*` object
+  read at module scope: all capture at import time and dodge jest spies, EE
+  overrides, and lazy loading. Read at call time (`(_state) => fn()`), or
+  inject.
+- **Plans go stale.** Verify every recipe against current code before
+  executing; things get merged, renamed, or turn out never to have existed.
+  Skip-and-report beats force.
+- **The linter's blind spots**: `export … from` re-exports, bare-specifier
+  packages (custom-viz), pre-seeded caches that never register tags. A grep
+  for the old path is the stronger claim than a green lint run.
+- **Path-keyed baselines reset on rename**: a generated per-file ledger
+  silently loses a file's history when it moves.
+- **A heavy barrel is a bundle hazard until its module is side-effect free.**
+  One constant imported from the `metabase/ui` barrel pulled Mantine into the
+  static-viz bundle and broke its budget; the fix was `SIDE_EFFECT_FREE_PATHS`,
+  never a deep import.
+- **Type augmentation is program-wide.** `declare module "dayjs"` (and
+  similar) makes plugin types available to any file in the same tsconfig, so
+  a passing type-check never proves the setup ran; only importing the facade
+  does.
+- **Environment before diagnosis**: after a dependency-touching merge,
+  `bun install` before declaring a failure real; worktrees share staleness
+  through the node_modules symlink, and a stale `target/cljs_dev` makes
+  `type-check-pure` fail on `metabase-lib/metric/core.ts` (rebuild cljs in the
+  worktree).
+
+## PR shape
+
+One logical change per PR; the body names the specific edges removed (files,
+imports, before/after count) and gives each move's ownership reason in plain
+language a reviewer outside the effort can follow, without campaign labels.
+Stack only for semantic dependency or same-hot-file serialisation, and say
+so. Consider codeowner surface when chunking. Open as a draft until measured
+and green.

.claude/skills/metabase-ui-component-from-figma/SKILL.md

@@ -31,6 +31,11 @@ Phases 1, 2, 5 and 6 are shared. The middle two differ in **order**: update mode
    - **The component's intended API** — variants, sizes, and states the design system supports for this component. This defines the axes of your showcase (Phase 3).
 3. Decide the mode (see **Two modes** above): search for an existing component — in `metabase/ui` or as a legacy component elsewhere. Found → **update**; nothing equivalent anywhere → **create**. Confirm with the user when unsure.
 4. **Verify a Figma desktop MCP is connected before doing the work** — this skill depends on it for exact tokens in Phase 4 (and styling can't proceed accurately without it). Do a quick read against the issue's node (e.g. `get_metadata`/`get_variable_defs`); if it errors with "nothing selected" or the server isn't connected, prompt the user to enable it (Switch to Dev Mode → MCP section in the right sidebar) and select the relevant layer before continuing.
+5. **Figma Desktop MCP environments only:** open the issue's exact page with [`figma-open`](./figma-open) before MCP reads. Do not run this helper when Desktop MCP is unavailable.
+   ```bash
+   .claude/skills/metabase-ui-component-from-figma/figma-open "<figma-url-with-node-id>"
+   ```
+   A URL with `node-id` needs no token. Bare page-name and `--list` lookups require an already-configured `FIGMA_TOKEN`.
 
 ## Phase 2 — Understand the component
 
@@ -205,7 +210,7 @@ Per `docs/developers-guide/frontend.md` ("Colors"): every color must be a **sema
 
 The same discipline applies to **dimensional** values — radius, spacing/padding/gap, elevation/shadow, and typography (font size, line-height, weight). Prefer the codebase's existing scale variable over a literal: `--mantine-radius-*`, `--mantine-spacing-*`, `--mantine-shadow-*`, and the Mantine font tokens.
 
-But Figma's scales don't always line up with the codebase's. When a Figma value **has no matching step** in the corresponding scale — e.g. Figma `radius/md = 12px` while `--mantine-radius-md` is `8px`, or a Figma `xxxs` spacing step with no Mantine equivalent — **don't silently bake in a literal.** Flag it to the user the same way you flag primitive colors: name the property, the Figma value, and the nearest codebase token, so it can be resolved with design / the scale owners (align the value, or add a scale step). Only fall back to a literal if the user confirms it's an accepted one-off, and leave a short comment in the code explaining why.
+But Figma's scales don't always line up with the codebase's. When a Figma value **has no matching step** in the corresponding scale — e.g. Figma `radius/md = 16px` while `--mantine-radius-md` is `0.75rem`, or a Figma spacing step that has no Mantine equivalent — **don't silently bake in a literal.** Flag it to the user the same way you flag primitive colors: name the property, the Figma value, and the nearest codebase token, so it can be resolved with design / the scale owners (align the value, or add a scale step). Only fall back to a literal if the user confirms it's an accepted one-off, and leave a short comment in the code explaining why. The codebase scales are defined in `frontend/src/metabase/ui/theme.ts` (`SPACING_SCALE`, `RADIUS_SCALE`, `LIGHT_SHADOWS`/`DARK_SHADOWS`).
 
 ### Mantine implementation notes (reference)
 
@@ -240,5 +245,6 @@ Only after sign-off:
 - [ ] Storybook showcase matrix built from the component's full state space (theme excluded — global toggle drives light/dark), single panel, hover/pressed forced via `storybook-addon-pseudo-states`, controls scoped per story; lint + type-check pass. (Update mode: built before styling, **component styles untouched**. Create mode: built after the component is implemented in Phase 4.)
 - [ ] Figma desktop MCP available; exact tokens extracted and mapped to semantic `--mb-color-*` (NO `color-mix`, NO primitives) and to existing scale vars for radius/spacing/elevation/type — any color *or* dimensional value with no matching token/scale step flagged to the user, not baked in as a literal.
 - [ ] Component styled; stylelint + eslint(+CSS modules) + type-check pass.
+- [ ] Loki coverage registered: `storiesFilter` matches exact story display names; targeted `loki update` generated references; reference PNGs and Playwright screenshots visually inspected; targeted `loki test` passes; `.loki/reference/*.png` included in the commit.
 - [ ] Iterated with the user until satisfied.
 - [ ] Committed (when asked); call sites migrated/verified (update) or export wired (create); findings doc handed back.

.claude/skills/metabase-ui-component-from-figma/figma-open

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+# figma-open — open a Figma file (or a specific page) in the Figma desktop app
+#
+# Usage:
+#   figma-open <url-or-file-key>              open the file
+#   figma-open <url-or-file-key> <node-id>    open at a node/page id (e.g. 12-3 or 12:3)
+#   figma-open <url-or-file-key> --list       list pages with their ids
+#   figma-open <url-or-file-key> "Page name"  open a page by name
+#
+# Page lookup by name/--list needs a Figma personal access token:
+#   export FIGMA_TOKEN=figd_...   or put it in ~/.config/figma/token
+set -euo pipefail
+
+arg="${1:-}"
+[[ -n "$arg" ]] || { awk 'NR==1 && /^#!/ {next} /^#/ {sub(/^# ?/,""); print; next} {exit}' "$0"; exit 1; }
+
+token="${FIGMA_TOKEN:-}"
+[[ -f "$HOME/.config/figma/token" ]] && token="$(<"$HOME/.config/figma/token")"
+
+# Extract the file key from any Figma URL form, or use the arg as a bare key.
+key="$arg"
+case "$arg" in
+  *figma.com*|figma://*)
+    key="$(printf '%s' "$arg" | sed -E 's#https?://([a-z]+\.)?figma\.com##; s#^([a-z0-9-]+\.)?figma\.com##; s#^figma://##; s#^/?(file|design|proto|board)/##; s#^/##; s#/.*##; s#\?.*##')"
+    ;;
+esac
+
+req="${2:-}"
+
+# If no page arg was given but the URL carries a node-id, use it.
+url_node="$(printf '%s' "$arg" | sed -nE 's/.*[?&]node-id=([0-9]+([-:][0-9]+)*).*/\1/p')"
+
+open_fig() { # $1 = optional node id
+  if [[ -n "${1:-}" ]]; then
+    open "figma://file/${key}?node-id=${1//:/-}"
+  else
+    open "figma://file/${key}"
+  fi
+}
+
+# No page requested — open the file (or the node the URL points at).
+[[ -z "$req" ]] && { open_fig "${url_node:-}"; exit 0; }
+
+# Explicit node id (page ids work: pages are top-level nodes).
+if [[ "$req" =~ ^[0-9]+[:-][0-9]+$ ]]; then
+  open_fig "$req"
+  exit 0
+fi
+
+# Everything else needs the REST API.
+[[ -n "$token" ]] || { echo "error: page lookup needs FIGMA_TOKEN (env or ~/.config/figma/token)" >&2; exit 1; }
+
+pages_json="$(curl -sf -H "X-Figma-Token: ${token}" "https://api.figma.com/v1/files/${key}?depth=1")" \
+  || { echo "error: could not fetch file ${key} (bad key, no access, or bad token)" >&2; exit 1; }
+
+if [[ "$req" == "--list" || "$req" == "-l" ]]; then
+  printf '%s\n' "$pages_json" | jq -r '.document.children[] | "\(.id // .guid)\t\(.name)"' | column -t -s $'\t'
+  exit 0
+fi
+
+# Page by name (case-insensitive, exact match first, then substring).
+node_id="$(printf '%s' "$pages_json" | jq -r --arg n "$req" \
+  'first(.document.children[] | select((.name // "") | ascii_downcase == ($n | ascii_downcase)) | .id // .guid) //
+   first(.document.children[] | select((.name // "") | ascii_downcase | contains($n | ascii_downcase)) | .id // .guid) //
+   empty')"
+
+[[ -n "$node_id" ]] || { echo "error: no page matching \"$req\" in file ${key}" >&2; exit 1; }
+open_fig "$node_id"

.claude/skills/typescript-review/SKILL.md

@@ -17,10 +17,10 @@ Adherence to `typescript-write` is the **highest-priority** review dimension: ra
 
 Review in this priority order:
 
-1. **Violations of [`typescript-write`](../typescript-write/SKILL.md) provisions** — no-`any`, type tightening, type modeling, null/undefined handling, naming, structure, comments. Highest priority; block on the no-`any` rule.
+1. **Violations of [`typescript-write`](../typescript-write/SKILL.md) provisions** — no-`any`, type tightening, type modeling, function signatures, null/undefined handling, naming, structure, comments. Highest priority; block on the no-`any` rule. Apply conditional guidance in context: explain the unsupported type guarantee or concrete readability problem, rather than treating every preference as a blanket ban.
 2. Compliance with `frontend/CLAUDE.md`.
 3. Readability and maintainability.
-4. Appropriate test coverage.
+4. Appropriate test coverage. For internal typed callers, avoid requesting tests solely for inputs the type system excludes. External API data, deserialised values, storage and JavaScript callers can violate annotations: test runtime validation and nontrivial assumptions at those boundaries. Types do not replace behavioural, security or data-integrity tests.
 
 ## Blind spots — act as the missing reviewer
 
@@ -31,3 +31,4 @@ These rarely surface in team reviews, so this skill should raise them. They are
 - **Security.** Evaluate potential security issues in new code.
 - **Bundle size.** Flag new large dependencies, default imports from icon or util libs, and heavy modules imported at route-load time.
 - **Analytics.** User-facing flows should emit tracking events. If a PR adds a new flow (button, modal, navigation) without a tracking event, ask whether one is expected.
+- **Public API surface** (embedding SDK). Consumers should be able to use public signatures and name types they need to import. Export those types deliberately and document public behaviour, including `@deprecated` for deprecated APIs; a referenced structural type does not automatically need its own named export.

.claude/skills/typescript-write/SKILL.md

@@ -20,20 +20,27 @@ description: Write TypeScript and JavaScript code following Metabase coding stan
 - **Avoid type casts and loose `unknown`** — fix the signature instead.
 - **If a function only needs one field of a wide object, accept that field** — not the wide object. The cast often disappears once the signature is right.
 - **Reach for `Partial<T>`, `Pick<T, K>`, `Record<K, V>`, and generics** before reaching for a cast.
+- **Match dictionary keys to the data.** Use a finite key union when the keys are known. Open dictionaries can use an index signature, `Record<string, T>`, or `Map`; index signatures still constrain values, and changing their spelling to `Record<string, T>` does not make missing-key access safe.
 - **Prefer making props/components generic** (`<T>`) when a value flows through unchanged and the caller knows the type.
 - **Prefer `unknown` over loose typing** and narrow before use — an `unknown` value forces a guard at the point of use.
 - **`satisfies` for object literals** that must conform without widening (config objects, lookup maps, discriminated literals) — better than `: T` (widens) or `as T` (unsafe).
 - **Avoid non-null assertions (`!`)**. Prefer a guard, early return, or `?.`. Use `!` only when non-nullness is provably true and localized, with a comment.
+- **Guard indexed lookups that may miss.** Arrays and dictionaries can return `undefined` even when the inferred type omits it. Use an iteration form that preserves the key/value relationship, and only assert `keyof` when the runtime keys are known to belong to the declared type.
 - **No redundant runtime coercion** — don't wrap already-typed values in `Number()` / `String()` / `Boolean()`.
 - **Type guards belong in `frontend/src/metabase-types/guards/`**. Do not redefine them locally.
 - **A cast you can't avoid needs a real justification comment.** The `metabase/no-unjustified-type-casts` rule accepts any preceding comment — state the actual reason the cast is safe. NEVER write the legacy `// Unjustified type cast. FIXME` placeholder; it exists only on casts that predated the rule, and copying it sneaks an unjustified cast past the linter. If you can't articulate why the cast is correct, the cast is wrong — fix the types.
+- **Keep unavoidable assertions local.** Isolate a repeated or complex assertion behind a helper when that makes its invariant easier to enforce. Test nontrivial runtime assumptions that justify it; a trivial assertion does not automatically need a new helper or test. Do not weaken a public signature just to silence implementation errors.
 
 ## Type modeling
 
 - **Reuse existing types; don't re-declare them.** Use canonical IDs and domain entity types from `metabase-types/api` (`FieldId`, `TableId`, `ConcreteTableId`, `SchemaName`, …) and key data structures by them (`new Map<ConcreteTableId, …>()`). Don't duplicate generated/API types — compose or derive (`Pick`, `Omit`, indexed access `SomeType["field"]`, `ReturnType`).
-- **Use generics to allow TypeScript to infer correct types** when creating functions and components that need to be reusable and type-safe. Don't hesitate to introduce complex generics if they allow to derive types automatically instead of manual narrowing.
+- **Generics must make promises the implementation can keep.** A caller-selected `get<T>(): T` must not disguise an unchecked assertion about external data. Return `unknown` and validate, or accept a validator that establishes `T`. A factory such as `function empty<T>(): T[] { return []; }` is valid; judge the implementation, not how often `T` appears in the signature.
+- **Prefer an honest type over false precision.** Use generics when they express a real relationship. If a complex type cannot model the behaviour accurately, choose a simpler type or `unknown` with narrowing instead of asserting an unsupported guarantee.
 - **Model the actual data contract; keep types narrow.** Optional `field?: T` for a key that may be absent, `field: T | undefined` only when the key is always present but the value may be undefined, `| null` for explicit API nulls. Prefer domain unions over broad `string` / `number` / loose `Record`.
 - **Refer to API implementation** when defining or refining types to ensure they match the actual data structure. When considering a type cast, first consider if the type should be refined to match the actual data structure.
+- **Optionality must reflect absence.** Keep required fields required and optional fields optional. Normalise input when the application has a meaningful default, not merely to remove a type error. Preserve the actual wire shape in API types.
+- **Represent related absence together when modelling internal state.** If several fields exist or disappear together, consider a nullable containing object or a discriminated union. Do not reshape a raw API declaration unless the data actually has that shape.
+- **Prefer explicit special states when designing a format.** Use nullability or named union variants when sentinel values such as `-1` hide meaning. Preserve established protocol sentinel values unless the behaviour is deliberately changed, or normalise them at an explicit boundary.
 - **Discriminated unions for variant state, with exhaustive checks.** Model "one of N shapes" as a union with a literal discriminant rather than a bag of optional fields, and exhaust it with ts-pattern's `.exhaustive()` so adding a variant becomes a compile error:
   ```ts
   import { match } from "ts-pattern";
@@ -45,20 +52,30 @@ description: Write TypeScript and JavaScript code following Metabase coding stan
     .exhaustive(); // Compile-time guarantee all cases handled
   ```
 - **Derive union types from constants** (`as const` + `typeof`/`keyof`) so the type and the values can't drift.
-- **`readonly` / immutability where mutation isn't intended** — component props, shared constants, exported config. Prefer `readonly T[]` / `ReadonlyArray<T>` for inputs you don't mutate.
+- **`readonly` / immutability where mutation isn't intended** — component props, shared constants, exported config, and unmutated parameters. Prefer `readonly T[]` / `ReadonlyArray<T>` for inputs you don't mutate. Functions that mutate caller-owned data should make that behaviour explicit.
+- **Construct complete, well-typed objects where practical.** Prefer an object expression when it avoids partially initialised state or assertions. Incremental construction is fine when it is clearer and maintains the type's invariants.
+- **Treat `metabase-lib` opaque types as black boxes.** Use `metabase-lib` functions to work with types such as `Lib.Query`, rather than casting into their internal representation.
 - **Type async and error states explicitly** (a discriminated union or the data-layer's typed result) — never leave loading/error/empty implicit.
 
+## Function signatures
+
+- **Make public contracts explicit where it improves stability and clarity.** Annotate parameters and return types at shared boundaries when useful; let local values infer. Use `satisfies` or an annotation when a declaration needs an explicit shape check.
+- **Accept the inputs the operation supports and return the most precise honest result.** Narrow avoidable uncertainty inside the function, but preserve meaningful nullability and union variants in its return type.
+- **Use named options when positional arguments are easy to confuse.** Consecutive arguments with the same type are a useful warning sign, not an automatic requirement to rewrite a clear API.
+- **Use `async`/`await` when it clarifies control flow or error handling.** Returning an existing promise directly is also valid; a Promise return type alone does not require adding `async`.
+
 ## Null and undefined
 
 - **Narrow at the source**. If a value is optional only in a corner case, don't thread `undefined` through every layer — guard at the producer.
 - **Sensible defaults for optional values**. Use `?.` and `??` at the consumer.
-- **Lists should be filtered** before being used in a map or other iteration.
+- **Narrow nullable list elements when the operation requires present values.** Filter with a type guard when missing entries should be discarded; preserve them when their absence or position carries meaning.
 - **Avoid non-strict null comparisons** (`X != null`) when `X` can never be `null` — use a strict check or narrow the type. Use `checkNotNull` where necessary.
 - **Check actual nullability against API implementation**. Find the API endpoint implementation and check if the field can actually be null.
 
 ## Naming
 
 - **Names describe the entity, not the mechanism**. A name must reflect what the value holds.
+- **Use domain vocabulary and include units where useful** (`timeoutMs`, `widthPx`, `temperatureC`). Prefer a more specific name when `Info`, `Data`, or `Entity` obscures the meaning, while keeping established terminology when it is clear.
 - **Align sibling concepts**: keep verb conventions consistent across a related API.
 - **No names that encode implementation history** rather than current meaning. Suffixes like `Base`, `New`, `Old`, `Initial` need a real semantic distinction, otherwise drop them.
 - **Avoid cryptic identifiers** (`v`, `n`, `$n`) for domain values; short names are fine only in tiny conventional contexts (loop index `i`, coordinates `x`/`y`, generic params `T`/`K`/`V`).
@@ -75,10 +92,6 @@ description: Write TypeScript and JavaScript code following Metabase coding stan
 - **No comments by default**. Well-named identifiers carry the `what`.
 - **Comments should be concise**. Add a short, concise comment only when the `why` is non-obvious: a workaround, a hidden invariant, a subtle ordering constraint, a clever reduction. Never document the actual implementation, focus on the intent and the why.
 
-## TypeScript Migration
-
-**When touching existing JavaScript files, propose to convert them to TypeScript first**. Create a separate PR for the conversion, then implement the changes.
-
 ## Verify before done
 
 - **Run the project type-check** when finished (see the shared TypeScript commands above).

.clj-kondo/config.edn

@@ -72,6 +72,7 @@
   :metabase/namespace-name                                   {:level :warning}
   :metabase/no-jsqlparser-imports                            {:level :warning}
   :metabase/prefer-with-dynamic-fn-redefs                    {:level :warning}
+  :metabase/t2-query-namespace                               {:level :warning}
   :metabase/toucan-model-ns                                  {:level :warning}
   :metabase/require-shape-checker                            {:level :warning}
   :metabase/tests-must-live-in-known-modules                 {:level :warning}
@@ -180,7 +181,7 @@
      clojure.core.async/take!
      clojure.core.async/to-chan!
      clojure.core.async/to-chan!!
-     ;; only writes .clj-kondo/ratchets.edn, from a :once fixture that finishes before the parallel tests
+     ;; writes the ratchet files from a :once fixture that finishes before the parallel tests
      dev.kondo-ratchet/fix!
      metabase.ai-tracing.core/record!
      metabase.api.macros.defendpoint.tools-manifest/assert-optional-fields-nullable!
@@ -191,6 +192,8 @@
      metabase.channel.render.pdf.font/load-fonts!
      metabase.warehouses.models.database/assert-not-h2!
      metabase.driver.sql-jdbc.execute/execute-prepared-statement!
+     ;; only inspects a details map and throws; the `!` is for the throw, not for a mutation
+     metabase.driver/validate-db-details!
      metabase.mcp.usage/record-mcp-session!
      metabase.mcp.usage/record-mcp-session-end!
      metabase.mcp.usage/record-mcp-tool-call!
@@ -403,6 +406,7 @@
     metabase.channel.render.core              channel.render
     metabase.cloud-migration.core             cloud-migration
     metabase.eid-translation.core             eid-translation
+    metabase.llm.test-util                    llm.tu
     metabase.login-history.core               login-history
     metabase.model-persistence.core           model-persistence
     metabase.notification.core                notification
@@ -466,6 +470,7 @@
   metabase-enterprise.serialization.metadata-file-import.wire-format-test/with-tiny-fixture! clojure.core/fn
   metabase-enterprise.serialization.test-util/with-dbs                                  clojure.core/fn
   metabase-enterprise.serialization.test-util/with-random-dump-dir                      clojure.core/let
+  metabase-enterprise.tenants.pulse-api-test/with-tenant-pulse-fixture!                 clojure.core/fn
   metabase-enterprise.workspaces.test-util/with-resources!                              clojure.core/let
   metabase-enterprise.workspaces.test-util/with-workspaces!                             clojure.core/let
   metabase.actions.test-util/with-actions                                               clojure.core/let
@@ -495,6 +500,7 @@
   metabase.notification.test-util/with-card-notification                                clojure.core/let
   metabase.notification.test-util/with-system-event-notification!                       clojure.core/let
   metabase.notification.test-util/with-temp-notification                                clojure.core/let
+  metabase.oauth-server.test-util/with-oauth-client                                     clojure.core/fn
   metabase.osi.ai-context.api-test/with-test-entry                                      clojure.core/let
   metabase.premium-features.core/defenterprise-schema                                   clj-kondo.lint-as/def-catch-all
   metabase.premium-features.defenterprise/defenterprise-schema                          clj-kondo.lint-as/def-catch-all
@@ -628,6 +634,45 @@
    metabase.lib.schema.mbql-clause/define-tuple-mbql-clause                                                                  hooks.metabase.lib.schema.mbql-clause/define-mbql-clause
    methodical.core/defmethod                                                                                                 hooks.metabase.toucan.table-name/lint-defmethod
    methodical.macros/defmethod                                                                                               hooks.metabase.toucan.table-name/lint-defmethod
+   metabase.app-db.core/query                                                                                                hooks.metabase.toucan.db-ns/lint-query-call
+   metabase.app-db.core/streaming-reducible-query                                                                            hooks.metabase.toucan.db-ns/lint-query-call
+   metabase.app-db.core/select-or-insert!                                                                                    hooks.metabase.toucan.db-ns/lint-query-call
+   metabase.app-db.core/update-or-insert!                                                                                    hooks.metabase.toucan.db-ns/lint-query-call
+   metabase.app-db.core/current-timestamp-string                                                                             hooks.metabase.toucan.db-ns/lint-query-call
+   metabase.app-db.query/query                                                                                               hooks.metabase.toucan.db-ns/lint-query-call
+   metabase.app-db.query/streaming-reducible-query                                                                           hooks.metabase.toucan.db-ns/lint-query-call
+   metabase.app-db.query/select-or-insert!                                                                                   hooks.metabase.toucan.db-ns/lint-query-call
+   metabase.app-db.query/update-or-insert!                                                                                   hooks.metabase.toucan.db-ns/lint-query-call
+   metabase.app-db.query/current-timestamp-string                                                                            hooks.metabase.toucan.db-ns/lint-query-call
+   toucan2.core/count                                                                                                        hooks.metabase.toucan.db-ns/lint-query-call
+   toucan2.core/delete!                                                                                                      hooks.metabase.toucan.db-ns/lint-query-call
+   toucan2.core/exists?                                                                                                      hooks.metabase.toucan.db-ns/lint-query-call
+   toucan2.core/insert!                                                                                                      hooks.metabase.toucan.db-ns/lint-query-call
+   toucan2.core/insert-returning-instance!                                                                                   hooks.metabase.toucan.db-ns/lint-query-call
+   toucan2.core/insert-returning-instances!                                                                                  hooks.metabase.toucan.db-ns/lint-query-call
+   toucan2.core/insert-returning-pk!                                                                                         hooks.metabase.toucan.db-ns/lint-query-call
+   toucan2.core/insert-returning-pks!                                                                                        hooks.metabase.toucan.db-ns/lint-query-call
+   toucan2.core/query                                                                                                        hooks.metabase.toucan.db-ns/lint-query-call
+   toucan2.core/query-one                                                                                                    hooks.metabase.toucan.db-ns/lint-query-call
+   toucan2.core/reducible-query                                                                                              hooks.metabase.toucan.db-ns/lint-query-call
+   toucan2.core/reducible-select                                                                                             hooks.metabase.toucan.db-ns/lint-query-call
+   toucan2.core/reducible-update                                                                                             hooks.metabase.toucan.db-ns/lint-query-call
+   toucan2.core/reducible-update-returning-pks                                                                               hooks.metabase.toucan.db-ns/lint-query-call
+   toucan2.core/save!                                                                                                        hooks.metabase.toucan.db-ns/lint-query-call
+   toucan2.core/select                                                                                                       hooks.metabase.toucan.db-ns/lint-query-call
+   toucan2.core/select-fn->fn                                                                                                hooks.metabase.toucan.db-ns/lint-query-call
+   toucan2.core/select-fn->pk                                                                                                hooks.metabase.toucan.db-ns/lint-query-call
+   toucan2.core/select-fn-reducible                                                                                          hooks.metabase.toucan.db-ns/lint-query-call
+   toucan2.core/select-fn-set                                                                                                hooks.metabase.toucan.db-ns/lint-query-call
+   toucan2.core/select-fn-vec                                                                                                hooks.metabase.toucan.db-ns/lint-query-call
+   toucan2.core/select-one                                                                                                   hooks.metabase.toucan.db-ns/lint-query-call
+   toucan2.core/select-one-fn                                                                                                hooks.metabase.toucan.db-ns/lint-query-call
+   toucan2.core/select-one-pk                                                                                                hooks.metabase.toucan.db-ns/lint-query-call
+   toucan2.core/select-pk->fn                                                                                                hooks.metabase.toucan.db-ns/lint-query-call
+   toucan2.core/select-pks-set                                                                                               hooks.metabase.toucan.db-ns/lint-query-call
+   toucan2.core/select-pks-vec                                                                                               hooks.metabase.toucan.db-ns/lint-query-call
+   toucan2.core/update!                                                                                                      hooks.metabase.toucan.db-ns/lint-query-call
+   toucan2.core/update-returning-pks!                                                                                        hooks.metabase.toucan.db-ns/lint-query-call
    metabase.lib.test-util.macros/$ids                                                                                        hooks.metabase.test.data/$ids
    metabase.lib.test-util.macros/mbql-query                                                                                  hooks.metabase.test.data/mbql-query
    metabase.lib.test-util.macros/mbql-5-query                                                                                hooks.metabase.test.data/mbql-query
@@ -799,7 +844,7 @@
    :name    test-namespaces}
   {:pattern "^(?!.*-test(?:\\..*)?$)(?!.*test-util)(?!^metabase\\.test.*).*$"
    :name    source-namespaces}
-  {:pattern "(?:(?:^metabase\\.cmd.*)|(?:^build.*)|(?:^metabuild-common.*)|(?:^release.*)|(?:^i18n.*)|(?:^lint-migrations-file$))|(?:^mage.*)"
+  {:pattern "(?:(?:^metabase\\.cmd.*)|(?:^build.*)|(?:^metabuild-common.*)|(?:^release.*)|(?:^i18n.*)|(?:^lint-migrations-file$))|(?:^mage.*)|(?:^load-namespaces.*)|(?:^dev\\..*)"
    :name    printable-namespaces}
   {:pattern "^metabase\\.(?:(?:lib)|(?:legacy-mbql))\\..*"
    :name    metabase-lib}
@@ -836,7 +881,13 @@
   {:pattern "^metabase(?:((?:-enterprise\\.sandbox)?\\.query-processor)|(?:\\.driver\\.sql(?!server)(?!ite))).*-test$"
    :name    general-qp-and-driver-test-namespaces}
   {:pattern "(?:^mage.*)"
-   :name    mage-namespaces}]
+   :name    mage-namespaces}
+  ;;
+  ;; the app-db module is the application database layer itself (connections, migrations, encryption), so it gets to
+  ;; run Toucan 2 queries anywhere.
+  ;;
+  {:pattern "^metabase\\.app-db\\..*"
+   :name    app-db-namespaces}]
 
  :config-in-ns
  {test-namespaces
@@ -846,6 +897,7 @@
     :private-call                                        {:level :off}
     :metabase/defsetting-must-specify-export             {:level :off}
     :metabase/defsetting-namespace                       {:level :off}
+    :metabase/t2-query-namespace                         {:level :off}
     :metabase/test-helpers-use-non-thread-safe-functions {:level :warning} ; more config in `.clj-kondo/config/test-helpers/config.edn`
 
     :discouraged-var
@@ -853,6 +905,9 @@
      metabase.lib.convert/->legacy-MBQL {:level :off}
      metabase.lib.core/->legacy-MBQL    {:level :off}}}}
 
+  app-db-namespaces
+  {:linters {:metabase/t2-query-namespace {:level :off}}}
+
   ;; .cljc tests run in both Clojure and ClojureScript — `with-dynamic-fn-redefs` is JVM-only,
   ;; so leave these alone.
   metabase.lib.aggregation-test

.clj-kondo/config/modules/ratchets.edn

@@ -0,0 +1,6 @@
+;; Budgets for escape hatches in config.edn. Counts may fall but not exceed these values.
+;; Leave reductions to the post-merge shrink workflow; explain increases in the PR.
+{:api-any              1
+ :friend-edges         22
+ :model-imports-bypass 2
+ :uses-any             4}

.clj-kondo/config/test-helpers/config.edn

@@ -58,6 +58,7 @@
      metabase.app-db.core/finish-db-setup!
      metabase.app-db.core/migrate!
      metabase.app-db.core/setup-db!
+     metabase.app-db.encryption-test-util/do-with-encrypted-app-db!
      metabase.app-db.schema-migrations-test.impl/run-migrations-in-range!
      metabase.app-db.setup/migrate!
      metabase.app-db.setup/setup-db!

.clj-kondo/ratchets.edn

@@ -1,48 +1,81 @@
-;; Per-linter budgets for inline `:clj-kondo/ignore` forms.
-;; metabase.core.kondo-ratchet-test fails when the budgets drift from the actual counts.
-;; `./bin/mage fix-kondo-ratchets` lowers budgets to match the tree; local test runs do it
-;; automatically. Raising a budget, or adding one for a new linter (`--seed`), is a hand edit
-;; to defend in your PR.
+;; Budgets for kondo suppressions: inline `:clj-kondo/ignore` forms per linter (:ignore-counts), and
+;; config-level waivers in .clj-kondo/config.edn (:config-counts -- :off switches and :exclude entries).
+;; Each :ignore-counts value is a non-negative integer budget, or :unlimited for no ceiling.
+;; Checks fail when a count exceeds its numeric budget; unused budget is allowed.
+;; Any ignore outside :comment-exempt needs an explanatory comment directly above or trailing on its line.
+;; `./bin/mage kondo-ratchets-shrink` lowers budgets unless `--seed` explicitly adds or raises one.
+;; The workflow runs it on master, so feature branches do not need to record reductions.
+;; Raising or adding a budget (`--seed` for inline ignores, a manual edit otherwise) or widening the
+;; exemptions must be explained in the PR.
 ;; :all is the vector-less ignore form, which suppresses every linter on the next form.
-{:ignore-counts {:aliased-namespace-symbol                                            3
-                 :all                                                                 49
-                 :case-symbol-test                                                    1
-                 :clojure-lsp/unused-public-var                                       9
-                 :def-fn                                                              1
-                 :deprecated-namespace                                                95
-                 :deprecated-var                                                      79
-                 :discouraged-java-method                                             3
-                 :discouraged-namespace                                               79
-                 :discouraged-var                                                     107
-                 :equals-true                                                         1
-                 :main-without-gen-class                                              1
-                 :metabase/defsetting-namespace                                       2
-                 :metabase/disallow-hardcoded-driver-names-in-tests                   34
-                 :metabase/discourage-millis-duration                                 1
-                 :metabase/i-like-making-cams-eyes-bleed-with-horrifically-long-tests 13
-                 :metabase/modules                                                    7
-                 :metabase/namespace-name                                             4
-                 :metabase/prefer-with-dynamic-fn-redefs                              28
-                 :metabase/test-helpers-use-non-thread-safe-functions                 17
-                 :metabase/validate-defendpoint-has-response-schema                   441
-                 :metabase/validate-defendpoint-query-params-use-kebab-case           47
-                 :metabase/validate-defendpoint-route-uses-kebab-case                 44
-                 :metabase/validate-deftest                                           9
-                 :missing-docstring                                                   10
-                 :missing-protocol-method                                             3
-                 :non-arg-vec-return-type-hint                                        1
-                 :reduce-without-init                                                 3
-                 :redundant-fn-wrapper                                                1
-                 :syntax                                                              2
-                 :uninitialized-var                                                   1
-                 :unquote-not-syntax-quoted                                           1
-                 :unresolved-namespace                                                3
-                 :unresolved-require                                                  1
-                 :unresolved-symbol                                                   4
-                 :unsorted-required-namespaces                                        1
-                 :unused-alias                                                        1
-                 :unused-binding                                                      9
-                 :unused-excluded-var                                                 2
-                 :unused-namespace                                                    1
-                 :unused-private-var                                                  8
-                 :unused-value                                                        1}}
+{:ignore-counts  {:aliased-namespace-symbol                                            3
+                  :case-symbol-test                                                    1
+                  :clojure-lsp/unused-public-var                                       9
+                  :consistent-alias                                                    2
+                  :def-fn                                                              1
+                  :deprecated-namespace                                                95
+                  :deprecated-var                                                      86
+                  :discouraged-java-method                                             4
+                  :discouraged-namespace                                               71
+                  :discouraged-var                                                     130
+                  :duplicate-require                                                   1
+                  :equals-true                                                         1
+                  :main-without-gen-class                                              1
+                  :metabase/defsetting-namespace                                       1
+                  :metabase/disallow-hardcoded-driver-names-in-tests                   34
+                  :metabase/discourage-millis-duration                                 1
+                  :metabase/i-like-making-cams-eyes-bleed-with-horrifically-long-tests 13
+                  :metabase/modules                                                    23
+                  :metabase/namespace-name                                             4
+                  :metabase/prefer-with-dynamic-fn-redefs                              28
+                  :metabase/test-helpers-use-non-thread-safe-functions                 18
+                  :metabase/validate-defendpoint-has-response-schema                   427
+                  :metabase/validate-defendpoint-query-params-use-kebab-case           48
+                  :metabase/validate-defendpoint-route-uses-kebab-case                 44
+                  :metabase/validate-deftest                                           10
+                  :missing-docstring                                                   12
+                  :missing-protocol-method                                             3
+                  :non-arg-vec-return-type-hint                                        1
+                  :reduce-without-init                                                 3
+                  :redundant-do                                                        1
+                  :syntax                                                              2
+                  :type-mismatch                                                       8
+                  :uninitialized-var                                                   1
+                  :unquote-not-syntax-quoted                                           1
+                  :unresolved-namespace                                                3
+                  :unresolved-symbol                                                   11
+                  :unsorted-required-namespaces                                        :unlimited
+                  :unused-alias                                                        2
+                  :unused-binding                                                      9
+                  :unused-excluded-var                                                 2
+                  :unused-namespace                                                    2
+                  :unused-private-var                                                  8
+                  :unused-value                                                        1}
+ :config-counts  {:constant-condition                      1
+                  :deprecated-namespace                    7
+                  :deprecated-var                          16
+                  :discouraged-namespace                   14
+                  :discouraged-var                         14
+                  :inline-def                              1
+                  :main-without-gen-class                  1
+                  :metabase/defsetting-must-specify-export 1
+                  :metabase/defsetting-namespace           1
+                  :metabase/prefer-with-dynamic-fn-redefs  3
+                  :metabase/t2-query-namespace             2
+                  :missing-docstring                       1
+                  :private-call                            1
+                  :redundant-ignore                        1
+                  :redundant-primitive-coercion            1
+                  :refer-all                               1
+                  :type-mismatch                           1
+                  :unexpected-recur                        1
+                  :unresolved-symbol                       19
+                  :unresolved-var                          1
+                  :unused-referred-var                     4}
+ :comment-exempt #{:deprecated-namespace
+                   :discouraged-namespace
+                   :discouraged-var
+                   :metabase/modules
+                   :metabase/validate-defendpoint-has-response-schema
+                   :metabase/validate-defendpoint-query-params-use-kebab-case
+                   :metabase/validate-defendpoint-route-uses-kebab-case}}

.clj-kondo/src/hooks/clojure/core/ns.clj

@@ -71,10 +71,28 @@
   (some-> (ns-form-node->ns-symb-node ns-form-node)
           hooks/sexpr))
 
+(defn- lint-test-parallel-metadata [ns-form-node]
+  (when-let [ns-symb-node (ns-form-node->ns-symb-node ns-form-node)]
+    (let [ns-metadata (meta (hooks/sexpr ns-symb-node))]
+      (cond
+        (:synchronous ns-metadata)
+        (hooks/reg-finding!
+         (assoc (meta ns-symb-node)
+                :message (str "Use `^:synchronized` to mark this namespace explicitly non-parallel; "
+                              "`^:synchronous` is ignored by Hawk. [:metabase/validate-deftest]")
+                :type :metabase/validate-deftest))
+
+        (and (contains? ns-metadata :parallel)
+             (false? (:parallel ns-metadata)))
+        (hooks/reg-finding!
+         (assoc (meta ns-symb-node)
+                :message "Use `^:synchronized` instead of `^{:parallel false}`. [:metabase/validate-deftest]"
+                :type :metabase/validate-deftest))))))
+
 (defn- lint-modules [ns-form-node config]
   (let [ns-symb (ns-form-node->ns-symb ns-form-node)]
     (when-not (modules/ignored-namespace? config ns-symb)
-      (when-let [current-module (modules/module ns-symb)]
+      (when-let [current-module (modules/module config ns-symb)]
         (let [required-namespace-symb-nodes (-> ns-form-node
                                                 ns-form-node->require-node
                                                 require-node->namespace-symb-nodes)]
@@ -140,6 +158,7 @@
     lint-requires-on-new-lines
     (lint-modules (modules/config x))
     lint-namespace-name
+    lint-test-parallel-metadata
     lint-jsqlparser-imports)
   x)
 

.clj-kondo/src/hooks/clojure/core/require.clj

@@ -11,15 +11,32 @@
          (every? simple-symbol? required-namespaces)]}
   (when-not (modules/ignored-namespace? config current-ns)
     ;; ignore namespaces outside of the module system
-    (when-let [current-module (modules/module current-ns)]
+    (when-let [current-module (modules/module config current-ns)]
       (doseq [required-namespace required-namespaces]
         ;; ignore namespaces outside of the module system.
-        (when (modules/module required-namespace)
+        (when (modules/module config required-namespace)
           (when-let [error (modules/usage-error config current-module required-namespace)]
             (hooks/reg-finding! (assoc (meta node)
                                        :message error
                                        :type    :metabase/modules))))))))
 
+(defn- lint-dynamic-require* [node current-ns config]
+  (when (and (not (modules/ignored-namespace? config current-ns))
+             (modules/module config current-ns))
+    (hooks/reg-finding! (assoc (meta node)
+                               :message "Module dependency cannot be statically determined from a dynamic require"
+                               :type    :metabase/modules))))
+
+(defn- quoted-require? [node]
+  (or (= (hooks/tag node) :quote)
+      (and (= (hooks/tag node) :list)
+           (let [[x] (:children node)]
+             (and (hooks/token-node? x)
+                  (= (hooks/sexpr x) 'quote))))))
+
+(defn- keyword-node? [node]
+  (keyword? (hooks/sexpr node)))
+
 (defn- unwrap-require [node]
   (case (hooks/tag node)
     ;; some.namespace of some.namespace/some-var
@@ -42,7 +59,11 @@
 
     ;; something like [some.namespace :as whatever]
     :vector
-    (recur (first (:children node)))))
+    (recur (first (:children node)))
+
+    ;; anything else -- e.g. a runtime expression like `(requiring-resolve (:failing-test-var opts))` --
+    ;; has no statically-known namespace
+    nil))
 
 (comment
   (unwrap-require (-> "(requiring-resolve 'metabase.notification.payload.execute/execute-dashboard)"
@@ -51,20 +72,24 @@
                       second)))
 
 (defn- lint-require* [node current-ns config]
-  (let [[_require & args]   (:children node)
-        required-namespaces (->> (keep unwrap-require args)
-                                 ;; `require` runs through `cc/load-libs` which allows
-                                 ;; #{:as :reload :reload-all :require :use :verbose :refer :as-alias}
-                                 ;; as args. If you use a REPL tool that applies clj-kondo linting (e.g., Clojure MCP)
-                                 ;; you may wish to `:reload` or `:reload-all` a namespace. So we shouldn't assume all
-                                 ;; args are keywords:
-                                 (remove keyword?))]
-    (lint* node current-ns config required-namespaces)))
+  (let [[_require & args]    (:children node)
+        ;; Keywords such as `:reload` and `:reload-all` are options, not namespace dependencies.
+        namespace-nodes     (remove keyword-node? args)
+        static-nodes        (filter quoted-require? namespace-nodes)
+        required-namespaces (->> (keep unwrap-require static-nodes)
+                                 (filter simple-symbol?))]
+    (lint* node current-ns config required-namespaces)
+    (when (or (not= (count static-nodes) (count namespace-nodes))
+              (not= (count required-namespaces) (count static-nodes)))
+      (lint-dynamic-require* node current-ns config))))
 
 (defn- lint-requiring-resolve* [node current-ns config]
   (let [[_requiring-resolve symb-node] (:children node)
         required-namespace             (unwrap-require symb-node)]
-    (lint* node current-ns config [required-namespace])))
+    (if (and (quoted-require? symb-node)
+             (simple-symbol? required-namespace))
+      (lint* node current-ns config [required-namespace])
+      (lint-dynamic-require* node current-ns config))))
 
 (defn lint-require [x]
   (lint-require* (:node x) (:ns x) (modules/config x))

.clj-kondo/src/hooks/clojure/test.clj

@@ -28,11 +28,11 @@
     (walk form)))
 
 (defn- deftest-check-parallel
-  "1. Check if test is marked ^:parallel / ^:synchronized correctly.
+  "1. Check if test is marked `^:parallel` / `^:synchronized` correctly.
    2. Make sure disallowed forms are not used in ^:parallel tests.
-   3. Disallow ^:parallel tests in namespaces marked ^:synchronous -- the
-      ns marker is the author's blanket promise that nothing inside runs
-      in parallel, so an individual ^:parallel deftest contradicts it."
+   3. Disallow `^:parallel` tests in namespaces marked `^:synchronized` --
+      the ns marker is the author's blanket promise that nothing inside runs
+      in parallel, so an individual `^:parallel` deftest contradicts it."
   [{[_ test-name & body] :children, :as _node} ns-sym config]
   (let [test-metadata     (:meta test-name)
         metadata-sexprs   (map hooks/sexpr test-metadata)
@@ -44,28 +44,48 @@
                            (completing merge)
                            {}
                            metadata-sexprs)
-        parallel?     (:parallel combined-metadata)
-        synchronized? (:synchronized combined-metadata)
-        ns-synchronous? (boolean (:synchronous (meta ns-sym)))]
+        parallel?                  (true? (:parallel combined-metadata))
+        synchronized?              (true? (:synchronized combined-metadata))
+        explicitly-nonparallel?    (or synchronized?
+                                       (and (contains? combined-metadata :parallel)
+                                            (false? (:parallel combined-metadata))))
+        ns-metadata                (meta ns-sym)
+        ns-explicitly-nonparallel? (or (true? (:synchronized ns-metadata))
+                                       (and (contains? ns-metadata :parallel)
+                                            (false? (:parallel ns-metadata))))]
+    (when (and (contains? combined-metadata :parallel)
+               (false? (:parallel combined-metadata)))
+      (hooks/reg-finding! (assoc (meta test-name)
+                                 :message (str "Use `^:synchronized` instead of `^{:parallel false}`. "
+                                               "[:metabase/validate-deftest]")
+                                 :type :metabase/validate-deftest)))
+    (when (:sequential combined-metadata)
+      (hooks/reg-finding! (assoc (meta test-name)
+                                 :message (str "Use `^:synchronized` to mark this test explicitly non-parallel; "
+                                               "`^:sequential` is ignored by Hawk. "
+                                               "[:metabase/validate-deftest]")
+                                 :type :metabase/validate-deftest)))
     (when (and parallel? synchronized?)
       (hooks/reg-finding! (assoc (meta test-name)
-                                 :message "Test should not be marked both ^:parallel and ^:synchronized"
+                                 :message "Test should not be marked both `^:parallel` and `^:synchronized`"
                                  :type :metabase/validate-deftest)))
-    (when (and parallel? ns-synchronous?)
+    (when (and parallel? ns-explicitly-nonparallel?)
       (hooks/reg-finding!
        (assoc (meta test-name)
-              :message (str "Test should not be marked ^:parallel in a namespace marked ^:synchronous -- "
+              :message (str "Test should not be marked `^:parallel` in a namespace marked "
+                            "`^:synchronized` -- "
                             "the ns marker promises no parallel execution. "
-                            "Drop ^:parallel from the deftest, or drop ^:synchronous from the ns. "
+                            "Drop `^:parallel` from the deftest, or drop `^:synchronized` from the ns. "
                             "[:metabase/validate-deftest]")
               :type :metabase/validate-deftest)))
-    ;; only when the custom `:metabase/deftest-not-marked-parallel-or-synchronized` is enabled: complain if tests are
-    ;; not explicitly marked `^:parallel` or `^:synchronized`. This is mostly to encourage people to mark everything
-    ;; `^:parallel` in places like `metabase.lib` tests unless there is a really good reason not to.
-    (when-not (or parallel? synchronized?)
+    ;; Only when the custom `:metabase/deftest-not-marked-parallel-or-synchronized` is enabled:
+    ;; complain if tests are not explicitly marked `^:parallel` or `^:synchronized`. This is
+    ;; mostly to encourage people to mark everything `^:parallel` in places like `metabase.lib`
+    ;; tests unless there is a really good reason not to.
+    (when-not (or parallel? explicitly-nonparallel?)
       (hooks/reg-finding!
        (assoc (meta test-name)
-              :message "Test should be marked either ^:parallel or ^:synchronized"
+              :message "Test should be marked either `^:parallel` or `^:synchronized`"
               :type :metabase/deftest-not-marked-parallel-or-synchronized)))
     (when parallel?
       (doseq [form body]
@@ -151,8 +171,10 @@
           (str/starts-with? (name ns-symb) prefix))
         ["build-drivers."
          "build."
+         "hooks." ; clj-kondo hook tests, outside the module system
          "i18n." ; bin/i18n
          "lint-migrations-file-test"
+         "load-namespaces." ; bin/load-namespaces
          "mage."
          "main-test" ; bin/release-list
          "metabase.deps-edn-test"
@@ -172,7 +194,7 @@
                (not (contains? @warned-namespaces ns-symb)))
       (swap! warned-namespaces conj ns-symb)
       (let [known-modules  (set (keys (:metabase/modules (modules/config input))))
-            current-module (modules/module ns-symb)]
+            current-module (modules/module (modules/config input) ns-symb)]
         (when (or (not current-module)
                   (not (contains? known-modules current-module)))
           (hooks/reg-finding! (assoc (meta node)
@@ -232,18 +254,20 @@
 
 (defn use-fixtures
   "Flag `:parallel/unsafe` forms inside fixtures. Skipped when the surrounding
-  namespace is marked `^:synchronous` -- the ns marker is the author's
+  namespace is marked `^:synchronized` -- the ns marker is the author's
   explicit opt-in to a single-threaded test ns where destructive setup is
   safe. Without that opt-in, kondo can't know whether sibling deftests will
   be `^:parallel`, so the conservative default is to flag.
 
   Sister to [[deftest-check-parallel]]: the deftest hook rejects `^:parallel`
-  tests inside a `^:synchronous` ns, so the two checks together form a
-  coherent opt-in: either the whole ns is synchronous (fixtures can be
+  tests inside a `^:synchronized` ns, so the two checks together form a
+  coherent opt-in: either the whole ns is explicitly non-parallel (fixtures can be
   anything; no parallel tests allowed) or it isn't (fixtures must be
   parallel-safe)."
   [{:keys [node config], ns-sym :ns, :as input}]
-  (when-not (:synchronous (meta ns-sym))
+  (when-not (or (true? (:synchronized (meta ns-sym)))
+                (and (contains? (meta ns-sym) :parallel)
+                     (false? (:parallel (meta ns-sym)))))
     (let [linter-config (get-in config [:linters :metabase/validate-deftest])]
       (doseq [form (rest (:children node))]
         (warn-about-disallowed-parallel-forms form linter-config))))

.clj-kondo/src/hooks/common/modules.clj

@@ -1,4 +1,8 @@
 (ns hooks.common.modules
+  "Resolves namespaces to modules and enforces module boundaries.
+
+  The Kondo linter, config generator, and CI tooling share this namespace so
+  they apply the same rules."
   (:require
    [clojure.string :as str]))
 
@@ -12,25 +16,130 @@
   (merge (get-in config [:linters :metabase/modules])
          (select-keys config [:metabase/modules])))
 
-(defn module
+;;;; Module tree. These functions take the `:metabase/modules` map, or the prefix map built from it.
+;;;;
+;;;; Dots express nesting: `lib.schema` is a child of `lib`. A declared
+;;;; `enterprise/X` module is also a child of OSS module `X`. A namespace
+;;;; belongs to the module with the most specific matching `:ns-prefix`.
+
+(defn default-ns-prefix
+  "Namespace prefix a module owns unless it sets `:ns-prefix`: `metabase.lib.schema` for `lib.schema`,
+  `metabase-enterprise.foo` for `enterprise/foo`."
+  [module]
+  (str (if (= "enterprise" (namespace module)) "metabase-enterprise." "metabase.") (name module)))
+
+(defn module-ns-prefix
+  "Namespace prefix `module` owns: its `:ns-prefix`, else [[default-ns-prefix]]."
+  [modules module]
+  (or (get-in modules [module :ns-prefix])
+      (default-ns-prefix module)))
+
+(defn build-prefix->module
+  "Map each declared namespace prefix to its module, for [[declared-module]]."
+  [modules]
+  (into {}
+        (map (fn [module] [(module-ns-prefix modules module) module]))
+        (keys modules)))
+
+(defn declared-module
+  "Resolve `ns-symb` to its declared module, or `nil`.
+
+  Chooses the most specific dotted prefix and ignores a trailing `-test`."
+  [prefix->module ns-symb]
+  (loop [candidate (str/replace (str ns-symb) #"-test$" "")]
+    (or (get prefix->module candidate)
+        (when-let [dot (str/last-index-of candidate ".")]
+          (recur (subs candidate 0 dot))))))
+
+(defn resolve-module
   "E.g.
 
-    (module 'metabase.qp.middleware.wow) => 'qp
-    (module 'metabase-enterprise.whatever.core) => enterprise/whatever"
-  [ns-symb]
+    (resolve-module prefix->module 'metabase.qp.middleware.wow) => 'qp
+    (resolve-module prefix->module 'metabase-enterprise.whatever.core) => enterprise/whatever
+
+  An unmatched Metabase namespace resolves to its first segment so the linter can report an undeclared module."
+  [prefix->module ns-symb]
   {:pre [(simple-symbol? ns-symb)]}
   ;; treat something like `metabase.driver-test` (for a module that hasn't fully been updated to use `.core`
   ;; namespaces) as being in the `driver` module
   (let [ns-symb (if (str/ends-with? (name ns-symb) "-test")
                   (symbol (str/replace (name ns-symb) #"-test$" ""))
                   ns-symb)]
-    (or (some->> (re-find #"^metabase-enterprise\.([^.]+)" (str ns-symb))
+    (or (declared-module prefix->module ns-symb)
+        (some->> (re-find #"^metabase-enterprise\.([^.]+)" (str ns-symb))
                  second
                  (symbol "enterprise"))
         (some-> (re-find #"^metabase\.([^.]+)" (str ns-symb))
                 second
                 symbol))))
 
+(defn parent-module
+  "The direct parent of `module`, or `nil` when it is top-level."
+  [modules module]
+  (let [module-name (name module)]
+    (if-let [dot (str/last-index-of module-name ".")]
+      (symbol (namespace module) (subs module-name 0 dot))
+      (when (= "enterprise" (namespace module))
+        (let [oss (symbol module-name)]
+          (when (contains? modules oss)
+            oss))))))
+
+(defn descendant-of?
+  "Whether `module` is `ancestor` or one of its descendants."
+  [modules module ancestor]
+  (boolean (some #{ancestor} (take-while some? (iterate #(parent-module modules %) module)))))
+
+(defn- exports-child?
+  [modules parent child]
+  (or (contains? (set (get-in modules [parent :module-exports])) child)
+      ;; OSS module `X` implicitly exports its `enterprise/X` companion.
+      (and (not= (namespace parent) (namespace child))
+           (contains? modules child))))
+
+(defn- blocking-export
+  "The first missing export from `module` toward the root.
+
+  Returns `{:ancestor parent, :child child}`, or `nil` when every link is
+  exported."
+  [modules module]
+  (loop [child module]
+    (when-let [ancestor (parent-module modules child)]
+      (if (exports-child? modules ancestor child)
+        (recur ancestor)
+        {:ancestor ancestor, :child child}))))
+
+(defn namability-error
+  "Explain why `caller` may not refer to `target` in `:uses`, or return `nil` if it may.
+
+  A nested module is private to the nearest ancestor with a missing export.
+  Exporting every link makes it public."
+  [modules caller target]
+  (when-let [{:keys [ancestor child]} (blocking-export modules target)]
+    (when-not (descendant-of? modules caller ancestor)
+      (format (str "Module %s is nested and not exported by its ancestors; %s may not use it. Add %s to %s's "
+                   ":module-exports, or move the caller into the %s subtree. [:metabase/modules %s :module-exports]")
+              target caller child ancestor ancestor ancestor))))
+
+;;;; Lint rules. These functions take the full linter config.
+
+(defonce ^:private prefix->module-cache
+  (atom nil))
+
+(defn- prefix->module
+  "[[build-prefix->module]] for `config`, cached because Kondo hands every hook call the same `:metabase/modules` map."
+  [config]
+  (let [modules (:metabase/modules config)
+        cached  @prefix->module-cache]
+    (if (identical? modules (:modules cached))
+      (:prefix->module cached)
+      (:prefix->module (reset! prefix->module-cache {:modules        modules
+                                                     :prefix->module (build-prefix->module modules)})))))
+
+(defn module
+  "Resolve `ns-symb` to its module under `config`; see [[resolve-module]]."
+  [config ns-symb]
+  (resolve-module (prefix->module config) ns-symb))
+
 (defn- module-api-namespaces
   "Set of API namespace symbols for a given module. `:any` means you can use anything, there are no API namespaces for
   this module (yet). If unspecified, the default is just the `<module>.core` namespace."
@@ -44,9 +153,7 @@
       module-config
 
       :else
-      (let [ns-prefix (if (= (namespace module) "enterprise")
-                        (str "metabase-enterprise." (name module))
-                        (name module))]
+      (let [ns-prefix (module-ns-prefix (:metabase/modules config) module)]
         #{(symbol (str ns-prefix ".api"))
           (symbol (str ns-prefix ".core"))
           (symbol (str ns-prefix ".init"))}))))
@@ -68,15 +175,17 @@
         (contains? (set allowed-modules) required-module))))
 
 (defn- allowed-module-namespace? [config current-module ns-symb]
-  (let [module                (module ns-symb)
+  (let [module                (module config ns-symb)
         module-api-namespaces (module-api-namespaces config module)
         module-friends        (module-friends config module)]
-    (or (empty? module-api-namespaces)
+    (or (nil? module-api-namespaces)
         (contains? module-api-namespaces ns-symb)
-        (contains? module-friends current-module))))
+        (contains? module-friends current-module)
+        ;; a child may use its ancestors' internals; a parent still goes through its child's `:api`
+        (descendant-of? (:metabase/modules config) current-module module))))
 
 (defn- rest-module? [module]
-  (str/ends-with? module "-rest"))
+  (re-find #"[.-]rest$" (str module)))
 
 (defn- routes-module? [module]
   (str/ends-with? module "-routes"))
@@ -89,7 +198,7 @@
   error type if there is one, otherwise `nil` if there are no errors."
   [config current-module required-namespace]
   ;; ignore stuff not in a module i.e. non-Metabase stuff.
-  (when-let [required-module (module required-namespace)]
+  (when-let [required-module (module config required-namespace)]
     (when-not (= current-module required-module)
       (cond
         (not (allowed-module? config current-module required-module))
@@ -113,4 +222,8 @@
                 required-module
                 current-module
                 required-module
-                (symbol (str/replace required-module #"-rest$" "")))))))
+                (symbol (str/replace required-module #"[.-]rest$" "")))
+
+        ;; Config tests check explicit `:uses`; wildcard callers are checked here.
+        (= :any (allowed-modules config current-module))
+        (namability-error (:metabase/modules config) current-module required-module)))))

.clj-kondo/src/hooks/metabase/settings/models/setting.clj

@@ -4,9 +4,9 @@
    [hooks.common :as common]))
 
 (defn lint-defsetting-namespace [node context]
-  (when-not (re-matches #"^metabase(?:-enterprise)?\.[^\.]+\.settings$" (name (:ns context)))
+  (when-not (re-matches #"^metabase(?:-enterprise)?\.([^\.]+\.)+settings$" (name (:ns context)))
     (hooks/reg-finding! (assoc (meta node)
-                               :message "All defsettings should live in metabase[-enterprise].<module>.settings namespaces"
+                               :message "All defsettings should live in a namespace ending in .settings under metabase[-enterprise]"
                                :type :metabase/defsetting-namespace))))
 
 ;;; TODO -- move this into a Kondo config file in `.clj-kondo/config/`
@@ -286,6 +286,7 @@
     (update context :node update-node)))
 
 (comment
+  (require '[clojure.pprint])
   (defn- defsetting* [form]
     (hooks/sexpr
      (:node
@@ -293,7 +294,6 @@
         {:node
          (hooks/parse-string
           (with-out-str
-            #_{:clj-kondo/ignore [:unresolved-namespace]}
             (clojure.pprint/pprint
              form)))}))))
 

.clj-kondo/src/hooks/metabase/toucan/db_ns.clj

@@ -0,0 +1,45 @@
+(ns hooks.metabase.toucan.db-ns
+  "Lint that application database query calls -- Toucan 2's `t2/select`, `t2/query`, `t2/insert!`, `t2/update!`,
+  `t2/delete!` and friends, plus the `metabase.app-db.core` wrappers around them such as `mdb/query` and
+  `mdb/update-or-insert!` -- live in a module's `db` namespace, i.e. `metabase[-enterprise].<module>.db` (or `metabase.driver.<driver>.db` for
+  driver modules). Every other namespace in a module goes through those functions instead of talking to the
+  application database directly.
+
+  Registered as an `:analyze-call` hook on each of those functions in `.clj-kondo/config.edn`. The hook
+  returns its input unchanged so Kondo's normal analysis of the call (arity, var usage) still runs."
+  (:require
+   [clj-kondo.hooks-api :as hooks]
+   [hooks.common.modules :as modules]))
+
+(def ^:private driver-db-namespace
+  "Matches `metabase.driver.<driver>.db`; individual drivers are not modules."
+  #"^metabase\.driver\.[^.]+\.db$")
+
+(defn- db-namespace? [config ns-sym]
+  (let [ns-str (name ns-sym)]
+    (boolean
+     ;; Resolve ownership first: a nested `.db` name alone does not make a module.
+     (or (when-let [module (modules/module config ns-sym)]
+           (= ns-str (str (modules/module-ns-prefix (:metabase/modules config) module) ".db")))
+         (re-matches driver-db-namespace ns-str)))))
+
+(defn- test-file?
+  "Whether `filename` is in a test source tree. Test namespaces are exempt through the `test-namespaces` group in
+  `config.edn`, but helper namespaces like `metabase.sso.test-helpers` don't match that group's pattern."
+  [filename]
+  (boolean (and filename (re-find #"(?:^|/)test/" filename))))
+
+(defn lint-query-call
+  "Register a `:metabase/t2-query-namespace` finding when a Toucan 2 query call appears outside a `<module>.db`
+  namespace."
+  [{:keys [node ns filename] :as input}]
+  (when (and ns
+             (not (db-namespace? (modules/config input) ns))
+             (not (test-file? filename)))
+    (let [fn-node (first (:children node))]
+      (hooks/reg-finding!
+       (assoc (meta fn-node)
+              :message (format "Application database query calls like `%s` must live in metabase[-enterprise].<module>.db (or metabase.driver.<driver>.db) namespaces"
+                               (hooks/sexpr fn-node))
+              :type :metabase/t2-query-namespace))))
+  input)

.clj-kondo/test/hooks/clojure/core/ns_test.clj

@@ -19,6 +19,19 @@
 (defn- lint-modules [form config]
   (lint-ns form (assoc-in config [:linters :metabase/modules :level] :warning)))
 
+(deftest ^:parallel explicit-nonparallel-namespace-metadata-test
+  (let [config {:linters {:metabase/validate-deftest {:level :warning}}}]
+    (testing "Hawk's supported namespace marker passes"
+      (is (empty? (lint-ns '(ns ^:synchronized example.test) config))))
+    (testing "the verbose Hawk spelling is not accepted as Metabase style"
+      (is (=? [{:type    :metabase/validate-deftest
+                :message #(re-find #"Use `\^:synchronized` instead" %)}]
+              (lint-ns '(ns ^{:parallel false} example.test) config))))
+    (testing "the legacy marker explains that Hawk ignores it"
+      (is (=? [{:type    :metabase/validate-deftest
+                :message #(re-find #"`\^:synchronous` is ignored by Hawk" %)}]
+              (lint-ns '(ns ^:synchronous example.test) config))))))
+
 (deftest ^:parallel module-checker-allowed-modules-test
   (are [task-namespace] (=? [{:message "Module task should not be used in the api module. [:metabase/modules api :uses]"
                               :type :metabase/modules}]
@@ -43,6 +56,16 @@
            '{:metabase/modules {api    {:uses #{search}}
                                 search {:api  #{metabase.search.core}}}}))))
 
+(deftest ^:parallel module-checker-empty-api-test
+  (is (=? [{:message "Namespace metabase.embeddings.core is not an allowed external API namespace for the embeddings module. [:metabase/modules embeddings :api]"
+            :type :metabase/modules}]
+          (lint-modules
+           '(ns metabase.metabot.core
+              (:require
+               [metabase.embeddings.core :as embeddings]))
+           '{:metabase/modules {metabot   {:uses #{embeddings}}
+                                embeddings {:api #{}}}}))))
+
 (deftest ^:parallel module-checker-friends-test
   (is (= []
          (lint-modules

.clj-kondo/test/hooks/clojure/core/require_test.clj

@@ -0,0 +1,65 @@
+(ns hooks.clojure.core.require-test
+  (:require
+   [clj-kondo.hooks-api :as hooks]
+   [clj-kondo.impl.utils]
+   [clojure.test :refer :all]
+   [hooks.clojure.core.require]))
+
+(def ^:private config
+  '{:linters          {:metabase/modules {:level :warning}}
+    :metabase/modules {search {:uses #{}}
+                       task   {:api #{metabase.task.core}}}})
+
+(defn- lint [hook form current-ns]
+  (binding [clj-kondo.impl.utils/*ctx* {:config     config
+                                        :ignores    (atom nil)
+                                        :findings   (atom [])
+                                        :namespaces (atom {})}]
+    (hook {:node   (hooks/parse-string (pr-str form))
+           :ns     current-ns
+           :config config})
+    @(:findings clj-kondo.impl.utils/*ctx*)))
+
+(defn- lint-require [form current-ns]
+  (lint hooks.clojure.core.require/lint-require form current-ns))
+
+(defn- lint-requiring-resolve [form current-ns]
+  (lint hooks.clojure.core.require/lint-requiring-resolve form current-ns))
+
+(def ^:private dynamic-require-finding
+  {:message "Module dependency cannot be statically determined from a dynamic require"
+   :type    :metabase/modules})
+
+(def ^:private cross-module-finding
+  {:message "Module task should not be used in the search module. [:metabase/modules search :uses]"
+   :type    :metabase/modules})
+
+(deftest ^:parallel dynamic-requiring-resolve-test
+  (testing "outside the module system"
+    (is (= [] (lint-requiring-resolve '(requiring-resolve (:failing-test-var opts)) 'dev))))
+  (testing "inside a module"
+    (are [form] (=? [dynamic-require-finding]
+                    (lint-requiring-resolve form 'metabase.search.core))
+      '(requiring-resolve (:failing-test-var opts))
+      '(requiring-resolve @some-atom)
+      '(requiring-resolve some-local)
+      '(requiring-resolve "not-a-symbol"))))
+
+(deftest ^:parallel dynamic-require-test
+  (testing "outside the module system"
+    (is (= [] (lint-require '(require some-local) 'dev))))
+  (testing "inside a module"
+    (is (=? [dynamic-require-finding]
+            (lint-require '(require some-local) 'metabase.search.core)))))
+
+(deftest ^:parallel static-requiring-resolve-still-linted-test
+  (is (=? [cross-module-finding]
+          (lint-requiring-resolve '(requiring-resolve 'metabase.task.impl/go)
+                                  'metabase.search.core))
+      "a statically-known cross-module violation is still reported"))
+
+(deftest ^:parallel static-require-still-linted-test
+  (is (=? [cross-module-finding]
+          (lint-require '(require 'metabase.task.impl :reload)
+                        'metabase.search.core))
+      "a statically-known cross-module violation is still reported while keyword flags are ignored"))

.clj-kondo/test/hooks/clojure/test_test.clj

@@ -21,6 +21,54 @@
                                             #{:athena}}}}})
     (mapv :message @(:findings clj-kondo.impl.utils/*ctx*))))
 
+(defn- parallel-metadata-findings
+  ([form]
+   (parallel-metadata-findings form 'example.test))
+  ([form ns-sym]
+   (let [linters {:metabase/deftest-not-marked-parallel-or-synchronized {:level :warning}
+                  :metabase/validate-deftest                             {:level :warning}}]
+     (binding [clj-kondo.impl.utils/*ctx* {:config     {:linters linters}
+                                           :ignores    (atom nil)
+                                           :findings   (atom [])
+                                           :namespaces (atom {})}]
+       (hooks.clojure.test/deftest {:node   (api/parse-string form)
+                                    :lang   :clj
+                                    :ns     ns-sym
+                                    :config {:linters {:metabase/validate-deftest {}}}})
+       @(:findings clj-kondo.impl.utils/*ctx*)))))
+
+(deftest ^:parallel explicit-nonparallel-metadata-test
+  (testing "Hawk's supported test markers satisfy the explicit metadata linter"
+    (are [metadata] (empty? (parallel-metadata-findings
+                             (format "(deftest %s example-test (is true))" metadata)))
+      "^:parallel"
+      "^:synchronized"))
+  (testing "an unmarked test still gets the opt-in linter's guidance"
+    (is (=? [{:type    :metabase/deftest-not-marked-parallel-or-synchronized
+              :message "Test should be marked either `^:parallel` or `^:synchronized`"}]
+            (parallel-metadata-findings "(deftest example-test (is true))"))))
+  (testing "the unsupported marker explains that Hawk ignores it"
+    (is (some #(and (= (:type %) :metabase/validate-deftest)
+                    (re-find #"ignored by Hawk" (:message %)))
+              (parallel-metadata-findings
+               "(deftest ^:sequential example-test (is true))"))))
+  (testing "the verbose Hawk spelling is not accepted as Metabase style"
+    (is (some #(and (= (:type %) :metabase/validate-deftest)
+                    (re-find #"Use `\^:synchronized` instead" (:message %)))
+              (parallel-metadata-findings
+               "(deftest ^{:parallel false} example-test (is true))"))))
+  (testing "a test cannot request both execution modes"
+    (is (some #(and (= (:type %) :metabase/validate-deftest)
+                    (re-find #"both `\^:parallel` and `\^:synchronized`" (:message %)))
+              (parallel-metadata-findings
+               "(deftest ^:parallel ^:synchronized example-test (is true))"))))
+  (testing "a namespace-level non-parallel promise rejects parallel tests"
+    (is (=? [{:type    :metabase/validate-deftest
+              :message #(re-find #"namespace marked.*`\^:synchronized`" %)}]
+            (parallel-metadata-findings
+             "(deftest ^:parallel example-test (is true))"
+             (with-meta 'example.test {:synchronized true}))))))
+
 (deftest ^:parallel disallow-hardcoded-driver-names-in-tests-test
   (is (= []
          (deftest-warnings

.clj-kondo/test/hooks/common/modules_test.clj

@@ -5,6 +5,6 @@
 
 (deftest ^:parallel module-test
   (are [symb expected] (= expected
-                          (hooks.common.modules/module symb))
+                          (hooks.common.modules/module {} symb))
     'metabase.qp.middleware.wow        'qp
     'metabase-enterprise.whatever.core 'enterprise/whatever))

.clj-kondo/test/hooks/metabase/toucan/db_ns_test.clj

@@ -0,0 +1,73 @@
+(ns hooks.metabase.toucan.db-ns-test
+  (:require
+   [clj-kondo.hooks-api :as hooks]
+   [clj-kondo.impl.utils]
+   [clojure.test :refer :all]
+   [hooks.metabase.toucan.db-ns :as toucan.db-ns]))
+
+(defn- lint-query-call [form ns-sym & [filename modules]]
+  (binding [clj-kondo.impl.utils/*ctx* {:config     {:linters {:metabase/t2-query-namespace {:level :warning}}}
+                                        :ignores    (atom nil)
+                                        :findings   (atom [])
+                                        :namespaces (atom {})}]
+    (let [input  {:node     (hooks/parse-string (pr-str form))
+                  :ns       ns-sym
+                  :filename (or filename "src/metabase/foo/bar.clj")
+                  :config   {:metabase/modules modules}}
+          output (toucan.db-ns/lint-query-call input)]
+      (is (identical? (:node input) (:node output))
+          "the hook must return the node unchanged so Kondo's normal analysis still runs")
+      @(:findings clj-kondo.impl.utils/*ctx*))))
+
+(deftest ^:parallel t2-query-must-live-in-db-namespace-test
+  (testing "a query call outside a db namespace is flagged"
+    (is (=? [{:type    :metabase/t2-query-namespace
+              :message #".*`t2/select-one`.*"}]
+            (lint-query-call '(t2/select-one :model/Card :id 1) 'metabase.queries.models.card))))
+  (testing "metabase.<module>.db is allowed"
+    (is (empty? (lint-query-call '(t2/select-one :model/Card :id 1) 'metabase.queries.db))))
+  (testing "metabase-enterprise.<module>.db is allowed"
+    (is (empty? (lint-query-call '(t2/select-one :model/Card :id 1) 'metabase-enterprise.sandbox.db))))
+  (testing "metabase.driver.<driver>.db is allowed for driver modules"
+    (is (empty? (lint-query-call '(t2/select-one :model/Database :id 1) 'metabase.driver.bigquery-cloud-sdk.db))))
+  (testing "a nested db namespace is not a module db namespace"
+    (is (=? [{:type :metabase/t2-query-namespace}]
+            (lint-query-call '(t2/query {:select [:*]}) 'metabase.queries.models.db))))
+  (testing "a namespace merely ending in db is not a module db namespace"
+    (is (=? [{:type :metabase/t2-query-namespace}]
+            (lint-query-call '(t2/delete! :model/Card :id 1) 'metabase.queries.dashboards-db))))
+  (testing "files in a test source tree are exempt even when the namespace name doesn't look like a test"
+    (is (empty? (lint-query-call '(t2/update! :model/User 1 {:sso_source nil}) 'metabase.sso.test-helpers
+                                 "test/metabase/sso/test_helpers.clj")))
+    (is (empty? (lint-query-call '(t2/select :model/Card) 'metabase-enterprise.remote-sync.test-helpers
+                                 "/repo/enterprise/backend/test/metabase_enterprise/remote_sync/test_helpers.clj"))))
+  (testing "app-db wrappers around Toucan 2 are reported the same way"
+    (is (=? [{:type    :metabase/t2-query-namespace
+              :message #".*`mdb/update-or-insert!`.*"}]
+            (lint-query-call '(mdb/update-or-insert! :model/Foo {:id 1}) 'metabase.foo.models.foo))))
+  (testing "fully-qualified calls are reported by their written name"
+    (is (=? [{:type    :metabase/t2-query-namespace
+              :message #".*`toucan2.core/insert!`.*"}]
+            (lint-query-call '(toucan2.core/insert! :model/Card {}) 'metabase.queries.models.card)))))
+
+(deftest ^:parallel t2-query-namespace-follows-the-module-tree-test
+  (let [modules '{queries            {}
+                  metabot            {}
+                  metabot.llm        {}
+                  lib.be             {:ns-prefix "metabase.lib-be"}
+                  enterprise/sandbox {}}]
+    (testing "a nested module owns its own db namespace"
+      (is (empty? (lint-query-call '(t2/select :model/Card) 'metabase.metabot.llm.db nil modules))))
+    (testing "the parent's db namespace stays its own"
+      (is (empty? (lint-query-call '(t2/select :model/Card) 'metabase.metabot.db nil modules))))
+    (testing "a module with an explicit :ns-prefix is resolved through it, not its dotted name"
+      (is (empty? (lint-query-call '(t2/select :model/Card) 'metabase.lib-be.db nil modules)))
+      (is (=? [{:type :metabase/t2-query-namespace}]
+              (lint-query-call '(t2/select :model/Card) 'metabase.lib.be.db nil modules))))
+    (testing "a db namespace under a directory naming no module is still a finding"
+      (is (=? [{:type :metabase/t2-query-namespace}]
+              (lint-query-call '(t2/query {:select [:*]}) 'metabase.queries.models.db nil modules)))
+      (is (=? [{:type :metabase/t2-query-namespace}]
+              (lint-query-call '(t2/query {:select [:*]}) 'metabase.metabot.llm.models.db nil modules))))
+    (testing "enterprise modules resolve through the metabase-enterprise root"
+      (is (empty? (lint-query-call '(t2/select :model/Card) 'metabase-enterprise.sandbox.db nil modules))))))

.cljfmt.edn

@@ -12,6 +12,7 @@
   "enterprise/backend"
   "bin/build"
   "bin/lint-migrations-file"
+  "bin/load-namespaces"
   "bin/release-list"
   #_"mage/src"
   #_"mage/test"

.codespellrc

@@ -16,7 +16,7 @@ skip =
     frontend/src/metabase/querying/expressions/tokenizer/lezer.js,
     frontend/src/metabase/query_builder/components/NativeQueryEditor/CodeMirrorEditor/language.ts,
     frontend/src/metabase/static-viz/constants/char-sizes.ts,
-    frontend/src/metabase/visualizations/lib/mapping_codes.ts,
+    frontend/src/metabase/viz-core/lib/mapping_codes.ts,
     frontend/*/mocks/*,
     modules/drivers/mongo/src/metabase/driver/mongo/operators.clj,
     src/metabase/analyze/classifiers/name.clj,

.github/CODEOWNERS

@@ -42,6 +42,9 @@ docs/api.json # auto-generated
 docs/configuring-metabase/environment-variables.md # auto-generated
 docs/configuring-metabase/config-template.md # auto-generated
 docs/installation-and-operation/commands.md # auto-generated
+docs/ai/providers.md # auto-generated
+docs/embedding/sdk/api # auto-generated
+docs/embedding/eajs/snippets # auto-generated
 
 # @metabase/devexp
 .github @metabase/devexp
@@ -52,3 +55,15 @@ src/metabase/analytics/prometheus.clj @metabase/cloud-ops
 # @metabase/metabot-frontend
 enterprise/frontend/src/metabase-enterprise/metabot @metabase/metabot-frontend
 frontend/src/metabase/metabot @metabase/metabot-frontend
+
+# @metabase/core-frontend-gadget
+bin/custom-viz @metabase/core-frontend-gadget
+docs/developers-guide/custom-visualizations.md @metabase/core-frontend-gadget
+enterprise/frontend/src/custom-viz @metabase/core-frontend-gadget
+enterprise/frontend/src/metabase-enterprise/api/custom-viz-plugin.ts @metabase/core-frontend-gadget
+enterprise/frontend/src/metabase-enterprise/custom_viz @metabase/core-frontend-gadget
+frontend/src/metabase-types/api/custom-viz-plugin.ts @metabase/core-frontend-gadget
+frontend/src/metabase/plugins/oss/custom-viz.ts @metabase/core-frontend-gadget
+frontend/src/metabase/visualizations/custom-visualizations @metabase/core-frontend-gadget
+frontend/test/__support__/custom-viz-fixtures @metabase/core-frontend-gadget
+.github/workflows/release-custom-viz.yml @metabase/devexp @metabase/core-frontend-gadget

.github/actionlint.yaml

@@ -8,6 +8,12 @@ paths:
   # GitHub added parallel steps (`parallel`, `background`, `wait`, `wait-all`,
   # `cancel`) in June 2026, and actionlint 1.7.12 does not know the schema yet:
   # https://github.blog/changelog/2026-06-25-actions-steps-can-now-be-run-in-parallel/
+  .github/workflows/backend.yml:
+    ignore:
+      - 'step must run script with "run" section or run action with "uses" section'
   .github/workflows/lint.yml:
     ignore:
       - 'step must run script with "run" section or run action with "uses" section'
+  .github/workflows/pr.checks.yml:
+    ignore:
+      - 'step must run script with "run" section or run action with "uses" section'

.github/actions/bundle-size-check/action.yml

@@ -3,17 +3,15 @@ description: |
   Measures app + embedding SDK bundle sizes from the current and base-ref
   uberjars (reusing the builds that already ran) plus their bundle-stats
   artifacts, and flags gzipped size changes beyond the threshold for the main
-  app's initial bundle and the chunked SDK's reachable total. Skips when the
-  base-ref artifacts aren't available rather than rebuilding from source (which
-  would compare across pipelines).
+  app's initial bundle and the chunked SDK's reachable total. The base ref is
+  read back off the current uberjar so that both sides differ only by the PR.
+  Skips when the base-ref artifacts aren't available rather than rebuilding from
+  source (which would compare across pipelines).
 
 inputs:
   edition:
     description: 'Metabase edition (ee or oss)'
     required: true
-  base-ref-commit:
-    description: 'Commit SHA of the base ref.'
-    required: true
   threshold-percent:
     description: 'Percent threshold for bundle size change'
     required: true
@@ -41,12 +39,35 @@ runs:
         commit: ${{ github.event.pull_request.head.sha || github.sha }}
         edition: ${{ inputs.edition }}
         extract-path: temp/current-uberjar
+    - name: Resolve the base ref the current uberjar was built against
+      id: base-ref
+      shell: bash
+      env:
+        GH_TOKEN: ${{ github.token }}
+      run: |
+        set -uo pipefail
+
+        # The uberjar job checks out refs/pull/<n>/merge (the PR head already
+        # merged into the base branch tip) but names its artifact after head.sha,
+        # so the comparable base ref is that merge's first parent. Reading it back
+        # off the jar describes the artifact actually being measured. Using
+        # pull_request.base.sha instead compares against a stale snapshot of the
+        # base branch, reporting everything that landed in between as this PR's
+        # own bundle delta.
+        unzip -o -j temp/current-uberjar/metabase.jar version.properties -d temp/current-version >/dev/null
+        built=$(sed -n 's/^hash=//p' temp/current-version/version.properties)
+        base=$(gh api "/repos/${GITHUB_REPOSITORY}/commits/${built}" \
+          --jq 'if (.parents | length) == 2 then .parents[0].sha else empty end' 2>/dev/null) || base=""
+
+        echo "sha=${base}" >> "$GITHUB_OUTPUT"
+        echo "The current uberjar was built from ${built}; its base ref is ${base:-unknown}"
     - name: Download base-ref uberjar
       id: base-jar
+      if: steps.base-ref.outputs.sha != ''
       continue-on-error: true
       uses: ./.github/actions/fetch-artifact
       with:
-        commit: ${{ inputs.base-ref-commit }}
+        commit: ${{ steps.base-ref.outputs.sha }}
         edition: ${{ inputs.edition }}
         extract-path: temp/base-uberjar
     - name: Measure and compare bundle sizes
@@ -56,7 +77,7 @@ runs:
         GH_TOKEN: ${{ github.token }}
         EDITION: ${{ inputs.edition }}
         HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
-        BASE_SHA: ${{ inputs.base-ref-commit }}
+        BASE_SHA: ${{ steps.base-ref.outputs.sha }}
         THRESHOLD: ${{ inputs.threshold-percent }}
         MEASURE_BUNDLES: app,embedding-sdk-legacy,embedding-sdk-chunked
         # The gated bundles, as "<bundle>/<kind>". Each one's step outputs are
@@ -79,6 +100,7 @@ runs:
         # The base ref needs an already-built uberjar. Rebuilding it from source
         # would compare across two build pipelines (the bug this check used to
         # have), so skip instead when it — or its stats — isn't available.
+        [ -n "${BASE_SHA}" ] || skip "no comparable base ref for the current uberjar"
         [ -f temp/base-uberjar/metabase.jar ] || skip "base-ref uberjar not found for ${BASE_SHA}"
 
         extract_js() { # $1=jar  $2=dest-root

.github/actions/collect-profile/action.yml

@@ -0,0 +1,61 @@
+name: Collect profile
+description: >-
+  Attach a flamegraph and per-test wall times to a job whose tests ran under clj-async-profiler.
+  Does nothing when the run was not profiled.
+
+inputs:
+  profiled:
+    required: true
+    description: >-
+      "true" when the test step ran under the profiler. Passed in rather than read from the
+      environment so the decision stays recorded by the step that made it.
+  artifact-name:
+    required: true
+    description: Name for the uploaded artifact. Must be unique across the jobs of one run.
+
+runs:
+  using: "composite"
+  steps:
+    # Unlike a JUnit failure report, these run on a green build too — a suite that passes slowly is
+    # exactly what profiling is for.
+    #
+    # `awk 'NR<=25'` rather than `head -25`: the runner ignores SIGPIPE, so `head` exiting early
+    # leaves `sort` with an EPIPE write error and `pipefail` fails the step. `|| true` covers `grep`
+    # finding no junit files.
+    - name: Summarize test wall times
+      if: ${{ inputs.profiled == 'true' }}
+      continue-on-error: true
+      shell: bash
+      run: |
+        {
+          echo "### Slowest test namespaces (seconds)"
+          echo '```'
+          grep -h '<testsuite' target/junit/*.xml 2>/dev/null \
+            | sed -E 's|.*<testsuite name="([^"]*)" time="([^"]*)".*|\2 \1|' \
+            | sort -rn | awk 'NR<=25' || true
+          echo '```'
+          echo "### Slowest tests (seconds)"
+          echo '```'
+          grep -h '<testcase' target/junit/*.xml 2>/dev/null \
+            | sed -E 's|.*classname="([^"]*)" name="([^"]*)" time="([^"]*)".*|\3 \1/\2|' \
+            | sort -rn | awk 'NR<=25' || true
+          echo '```'
+        } >> "$GITHUB_STEP_SUMMARY"
+
+    # Only the rendered flamegraph is kept: the raw collapsed stacks it was built from run to
+    # hundreds of MB on a long suite, and are reproducible locally from the same test selection.
+    #
+    # The info-level test log rides along on a green profiled run too. The failure-only log artifact
+    # the test jobs upload is not written when nothing failed, which is exactly the run being profiled.
+    - name: Upload profile
+      if: ${{ inputs.profiled == 'true' }}
+      continue-on-error: true
+      uses: actions/upload-artifact@v7
+      with:
+        name: ${{ inputs.artifact-name }}
+        path: |
+          target/clj-async-profiler/results/*flamegraph.html
+          target/junit/*.xml
+          logs/test-log.json
+        retention-days: 14
+        if-no-files-found: warn

.github/actions/create-backport/action.yml

@@ -25,6 +25,8 @@ runs:
         COMMIT: ${{ inputs.backport-commit }}
       shell: bash
       run: | # bash
+        source "${{ github.action_path }}/kondo-ratchets.sh"
+
         git config --global user.email "metabase-bot@metabase.com"
         git config --global user.name "Metabase bot"
 
@@ -34,7 +36,7 @@ runs:
         git checkout ${TARGET_BRANCH}
         git fetch --all
         git checkout -b ${BACKPORT_BRANCH}
-        git cherry-pick ${COMMIT} || true
+        cherry_pick_backport "${COMMIT}"
 
         CONFLICT_LIST=$(git ls-files -u)
 
@@ -46,10 +48,7 @@ runs:
           echo "has-conflicts=true" >> "$GITHUB_OUTPUT"
 
           # Add a shell script for resolving conflicts
-          echo "git reset HEAD~1" > ./backport.sh
-          echo "rm ./backport.sh" >> ./backport.sh
-          echo "git cherry-pick ${COMMIT}" >> ./backport.sh
-          echo "echo 'Resolve conflicts and force push this branch.\n\nTo backport translations run: bin/i18n/merge-translations <release-branch>'" >> ./backport.sh
+          write_backport_script "${COMMIT}"
           chmod +x ./backport.sh
           git add ./backport.sh
           git commit -m "Add backport resolution script"
@@ -73,7 +72,7 @@ runs:
 
         git push -u origin ${BACKPORT_BRANCH}
 
-        PR_ARGS=(--base "${TARGET_BRANCH}" --head "${BACKPORT_BRANCH}" --label "was-backported" --assignee "${{ github.event.pull_request.user.login }}" --title "🤖 backported \"${ORIGINAL_TITLE}\"" --body "${PR_BODY}")
+        PR_ARGS=(--base "${TARGET_BRANCH}" --head "${BACKPORT_BRANCH}" --label "was-backported" --assignee "${{ github.event.pull_request.user.login }}" --title "🤖 v${TARGET_VERSION} backported \"${ORIGINAL_TITLE}\"" --body "${PR_BODY}")
         if [ "$CONFLICTS" -gt 0 ]; then
           PR_ARGS+=(--draft)
         fi
@@ -86,19 +85,15 @@ runs:
 
         git checkout ${{ github.sha }}
 
-    - name: Auto approve backport PR
+    - name: Approve and Merge the PR
       if: ${{ steps.create_backport_pull_request.outputs.has-conflicts == 'false' }}
-      uses: juliangruber/approve-pull-request-action@68fcc9a5a73b5641cadf757cf99d73720dcb05d0 # v2.1.0
-      with:
-        github-token: ${{ inputs.github-token-2 }}
-        number: ${{ steps.create_backport_pull_request.outputs.backport_pr_number }}
-
-    - name: Enable Pull Request Automerge
-      if: ${{ steps.create_backport_pull_request.outputs.has-conflicts == 'false' }}
-      run: gh pr merge --squash --auto "$PR_NUMBER"
+      run: |
+        gh pr review --approve "$PR_NUMBER"
+        gh pr merge --squash --auto "$PR_NUMBER"
       shell: bash
       env:
-        GH_TOKEN: ${{ inputs.github-token }}
+        # uses a different token than the token that created the PR so we can approve and merge it
+        GH_TOKEN: ${{ inputs.github-token-2 }}
         PR_NUMBER: ${{ steps.create_backport_pull_request.outputs.backport_pr_number }}
 
     - uses: ./.github/actions/notify-pull-request

.github/actions/create-backport/create-backport-test.sh

@@ -0,0 +1,375 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+action_dir=$(cd "$(dirname "$0")" && pwd)
+cut_release_workflow="$action_dir/../../workflows/cut-release-branch.yml"
+
+# shellcheck source=.github/actions/create-backport/kondo-ratchets.sh
+source "$action_dir/kondo-ratchets.sh"
+
+# Any editor launch fails the run, so a continuation that waits on an editor cannot pass.
+export GIT_EDITOR=false
+
+test_root=
+trap '[ -z "$test_root" ] || rm -rf -- "$test_root"' EXIT
+trap 'exit 129' HUP
+trap 'exit 130' INT
+trap 'exit 143' TERM
+test_root=$(mktemp -d)
+
+active_ratchets='{:ignore-counts {:example 1}}'
+disabled_ratchets=';; Kondo ignore ratchets apply only to master; this release branch opts out.
+;; The test and fixer recognize this explicit opt-out.
+{:disabled true}'
+
+# Coverage:
+#
+# Target state       Incoming change       Other conflict   Expected result
+# -----------------  --------------------  ---------------  ------------------------------------------
+# active ratchets    unrelated file        none             leave ratchets unchanged
+# active ratchets    ratchets              none             install the release opt-out
+# disabled ratchets  ratchets              none             keep the opt-out; finish with an empty commit
+# divergent ratchets ratchets              none             resolve ratchets and finish the cherry-pick
+# divergent ratchets ratchets (on a pty)   none             finish without opening an editor
+# active ratchets    unrelated file        app.txt          leave the conflict for manual resolution
+# divergent ratchets ratchets + app.txt    app.txt          resolve only ratchets
+# release cut        ratchets              none             cut and backport commit the same opt-out
+# n/a                cut-release workflow  n/a              the workflow calls the shared writer
+# any                invalid commit        n/a              propagate the cherry-pick failure
+# divergent ratchets generated backport.sh app.txt          resolve only ratchets through the manual script
+#
+# Known gaps: an older target with no ratchets file, and an incoming commit that
+# deletes the ratchets file.
+
+test_unrelated_backport_preserves_target_ratchets() (
+  local repo="$test_root/unrelated"
+  init_repo "$repo"
+  local commit
+  commit=$(feature_commit "$repo" change_app)
+  git -C "$repo" checkout -q release
+
+  cd "$repo"
+  cherry_pick_backport "$commit"
+
+  assert_eq feature "$(cat app.txt)" "the unrelated change was not cherry-picked"
+  assert_ratchets "$active_ratchets"
+  assert_cherry_pick_completed
+  assert_worktree_clean
+)
+
+test_clean_ratchet_backport_installs_release_opt_out() (
+  local repo="$test_root/clean-ratchet"
+  init_repo "$repo"
+  local commit
+  commit=$(feature_commit "$repo" change_ratchets)
+  git -C "$repo" checkout -q release
+
+  cd "$repo"
+  cherry_pick_backport "$commit"
+
+  assert_ratchets_disabled
+  assert_cherry_pick_completed
+  assert_worktree_clean
+)
+
+test_disabled_release_absorbs_ratchet_only_backport() (
+  local repo="$test_root/disabled-release"
+  init_repo "$repo"
+  local commit
+  commit=$(feature_commit "$repo" change_ratchets)
+  git -C "$repo" checkout -q release
+  commit_release_change "$repo" disable_release_ratchets "Disable release ratchets"
+
+  cd "$repo"
+  cherry_pick_backport "$commit"
+
+  assert_ratchets_disabled
+  assert_cherry_pick_completed
+  assert_empty_commit
+  assert_worktree_clean
+)
+
+test_ratchet_only_conflict_is_resolved() (
+  local repo="$test_root/ratchet-conflict"
+  init_repo "$repo"
+  local commit
+  commit=$(conflicting_ratchet_commit "$repo")
+
+  cd "$repo"
+  cherry_pick_backport "$commit"
+
+  assert_ratchets_disabled
+  assert_cherry_pick_completed
+  assert_worktree_clean
+)
+
+test_continuation_never_opens_an_editor() (
+  local repo="$test_root/editor"
+  init_repo "$repo"
+  local commit
+  commit=$(conflicting_ratchet_commit "$repo")
+
+  cd "$repo"
+  # Git only opens an editor for the continuation when stdin is a terminal, so run it on a pty. The
+  # exported GIT_EDITOR=false turns any editor launch into a failure. The single quotes are deliberate:
+  # $1 and $2 are for the inner bash, not this shell.
+  # shellcheck disable=SC2016
+  python3 -c 'import os, pty, sys; sys.exit(os.waitstatus_to_exitcode(pty.spawn(sys.argv[1:])))' \
+    bash -c 'source "$1/kondo-ratchets.sh" && cherry_pick_backport "$2"' bash "$action_dir" "$commit" >/dev/null ||
+    fail "the cherry-pick continuation opened an editor"
+
+  assert_ratchets_disabled
+  assert_cherry_pick_completed
+)
+
+test_non_ratchet_conflict_remains_manual() (
+  local repo="$test_root/non-ratchet-conflict"
+  init_repo "$repo"
+  local commit
+  commit=$(feature_commit "$repo" change_app)
+  git -C "$repo" checkout -q release
+  commit_release_change "$repo" change_release_app "Change release app"
+
+  cd "$repo"
+  cherry_pick_backport "$commit"
+
+  assert_ratchets "$active_ratchets"
+  assert_only_conflicts app.txt
+  assert_cherry_pick_pending
+)
+
+test_mixed_conflict_resolves_only_ratchets() (
+  local repo="$test_root/mixed-conflict"
+  init_repo "$repo"
+  local commit
+  commit=$(feature_commit "$repo" change_app_and_ratchets)
+  git -C "$repo" checkout -q release
+  commit_release_change "$repo" change_release_app_and_ratchets "Change release app and ratchets"
+
+  cd "$repo"
+  cherry_pick_backport "$commit"
+
+  assert_ratchets_disabled
+  assert_only_conflicts app.txt
+  assert_cherry_pick_pending
+)
+
+test_release_cut_and_backport_commit_the_same_opt_out() (
+  local cut_repo="$test_root/release-cut"
+  init_repo "$cut_repo"
+  cd "$cut_repo"
+  git checkout -qb release-x.99.x
+  write_disabled_ratchets
+  git add --sparse .clj-kondo/ratchets.edn
+  git commit -q --allow-empty --no-verify -m "Cut release-x.99.x branch"
+  git show HEAD:.clj-kondo/ratchets.edn > "$test_root/release-cut.edn"
+
+  local backport_repo="$test_root/release-cut-backport"
+  init_repo "$backport_repo"
+  local commit
+  commit=$(feature_commit "$backport_repo" change_ratchets)
+  git -C "$backport_repo" checkout -q release
+  cd "$backport_repo"
+  cherry_pick_backport "$commit"
+  git show HEAD:.clj-kondo/ratchets.edn > "$test_root/backport.edn"
+
+  cmp -s "$test_root/release-cut.edn" "$test_root/backport.edn" ||
+    fail "the release cut and the backport committed different opt-out files"
+  assert_eq "$disabled_ratchets" "$(cat "$test_root/release-cut.edn")" \
+    "the release cut did not install the expected opt-out"
+)
+
+test_cut_release_workflow_uses_the_shared_writer() (
+  grep -Fq 'source .github/actions/create-backport/kondo-ratchets.sh' "$cut_release_workflow" ||
+    fail "the cut-release workflow does not source kondo-ratchets.sh"
+  grep -Fq 'write_disabled_ratchets' "$cut_release_workflow" ||
+    fail "the cut-release workflow does not call write_disabled_ratchets"
+  ! grep -Fq ':disabled' "$cut_release_workflow" ||
+    fail "the cut-release workflow carries its own copy of the opt-out"
+)
+
+test_invalid_commit_failure_is_propagated() (
+  local repo="$test_root/invalid"
+  init_repo "$repo"
+  cd "$repo"
+
+  if cherry_pick_backport deadbeef; then
+    fail "an invalid commit succeeded"
+  fi
+)
+
+test_generated_script_resolves_ratchets_end_to_end() (
+  local repo="$test_root/generated-script"
+  init_repo "$repo"
+  local commit
+  commit=$(feature_commit "$repo" change_app_and_ratchets)
+  git -C "$repo" checkout -q release
+  commit_release_change "$repo" change_release_app_and_ratchets "Change release app and ratchets"
+
+  cd "$repo"
+  cherry_pick_backport "$commit"
+  git cherry-pick --abort
+
+  local release_commit
+  release_commit=$(git rev-parse HEAD)
+  write_backport_script "$commit"
+  chmod +x backport.sh
+  git add backport.sh
+  git commit -qm "Add manual backport script"
+
+  bash -n backport.sh
+  grep -Fq 'write_disabled_ratchets ()' backport.sh || fail "the generated script omitted write_disabled_ratchets"
+  ./backport.sh
+
+  assert_ratchets_disabled
+  assert_only_conflicts app.txt
+  assert_cherry_pick_pending
+  assert_eq "$release_commit" "$(git rev-parse HEAD)" "the generated script did not return HEAD to the release commit"
+  [ ! -e backport.sh ] || fail "the generated script did not remove itself"
+  ! git ls-files --error-unmatch backport.sh >/dev/null 2>&1 || fail "the generated script is still tracked"
+  ! git status --porcelain | grep -q backport.sh || fail "the generated script left a status entry"
+)
+
+# Test harness
+
+fail() {
+  echo "FAIL: $*" >&2
+  exit 1
+}
+
+assert_eq() {
+  local expected=$1
+  local actual=$2
+  local message=$3
+  [ "$expected" = "$actual" ] || fail "$message (expected '$expected', got '$actual')"
+}
+
+assert_ratchets() {
+  assert_eq "$1" "$(cat .clj-kondo/ratchets.edn)" "unexpected ratchet state"
+}
+
+assert_ratchets_disabled() {
+  assert_ratchets "$disabled_ratchets"
+}
+
+assert_cherry_pick_completed() {
+  ! git rev-parse -q --verify CHERRY_PICK_HEAD >/dev/null || fail "the cherry-pick is still pending"
+}
+
+assert_cherry_pick_pending() {
+  git rev-parse -q --verify CHERRY_PICK_HEAD >/dev/null || fail "the cherry-pick state was lost"
+}
+
+assert_only_conflicts() {
+  local expected
+  local actual
+  expected=$(printf '%s\n' "$@" | sort)
+  actual=$(git diff --name-only --diff-filter=U | sort)
+  assert_eq "$expected" "$actual" "unexpected unresolved files"
+}
+
+assert_empty_commit() {
+  git diff --quiet HEAD^ HEAD || fail "the backport commit was not empty"
+}
+
+assert_worktree_clean() {
+  [ -z "$(git status --porcelain)" ] || fail "the backport left worktree changes"
+}
+
+init_repo() {
+  local repo=$1
+  git init -q -b release "$repo"
+  git -C "$repo" config user.email test@example.com
+  git -C "$repo" config user.name "Backport test"
+  printf 'base\n' > "$repo/app.txt"
+  mkdir -p "$repo/.clj-kondo"
+  printf '%s\n' "$active_ratchets" > "$repo/.clj-kondo/ratchets.edn"
+  git -C "$repo" add .
+  git -C "$repo" commit -qm "Base"
+}
+
+feature_commit() {
+  local repo=$1
+  shift
+  git -C "$repo" checkout -qb feature
+  "$@" "$repo"
+  git -C "$repo" add .
+  git -C "$repo" commit -qm "Feature"
+  git -C "$repo" rev-parse HEAD
+}
+
+# Sets up a release branch whose ratchets conflict with the feature commit, and prints that commit.
+conflicting_ratchet_commit() {
+  local repo=$1
+  local commit
+  commit=$(feature_commit "$repo" change_ratchets)
+  git -C "$repo" checkout -q release
+  commit_release_change "$repo" change_release_ratchets "Change release ratchets"
+  echo "$commit"
+}
+
+change_app() {
+  printf 'feature\n' > "$1/app.txt"
+}
+
+change_ratchets() {
+  printf '{:ignore-counts {:example 2}}\n' > "$1/.clj-kondo/ratchets.edn"
+}
+
+change_app_and_ratchets() {
+  change_app "$1"
+  change_ratchets "$1"
+}
+
+change_release_app() {
+  printf 'release\n' > "$1/app.txt"
+}
+
+change_release_ratchets() {
+  printf '{:ignore-counts {:release 1}}\n' > "$1/.clj-kondo/ratchets.edn"
+}
+
+change_release_app_and_ratchets() {
+  change_release_app "$1"
+  change_release_ratchets "$1"
+}
+
+# Setup writes the opt-out through the shared writer; the only copy is the expected text at the top.
+disable_release_ratchets() {
+  (cd "$1" && write_disabled_ratchets)
+}
+
+commit_release_change() {
+  local repo=$1
+  local change=$2
+  local message=$3
+  "$change" "$repo"
+  git -C "$repo" add .
+  git -C "$repo" commit -qm "$message"
+}
+
+run_test() {
+  local description=$1
+  local test=${description// /_}
+  test=${test//-/_}
+  test="test_$test"
+
+  declare -F "$test" >/dev/null || fail "missing test function: $test"
+
+  printf 'TEST: %s\n' "$description"
+  "$test"
+  printf 'PASS: %s\n' "$description"
+}
+
+run_test "unrelated backport preserves target ratchets"
+run_test "clean ratchet backport installs release opt-out"
+run_test "disabled release absorbs ratchet-only backport"
+run_test "ratchet-only conflict is resolved"
+run_test "continuation never opens an editor"
+run_test "non-ratchet conflict remains manual"
+run_test "mixed conflict resolves only ratchets"
+run_test "release cut and backport commit the same opt-out"
+run_test "cut-release workflow uses the shared writer"
+run_test "invalid commit failure is propagated"
+run_test "generated script resolves ratchets end-to-end"

.github/actions/create-backport/kondo-ratchets.sh

@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+# The only place that knows what a release branch's opt-out looks like. The cut-release workflow, the
+# backport helper, and the tests all go through this function.
+write_disabled_ratchets() {
+  mkdir -p .clj-kondo
+  printf '%s\n' \
+    ';; Kondo ignore ratchets apply only to master; this release branch opts out.' \
+    ';; The test and fixer recognize this explicit opt-out.' \
+    '{:disabled true}' \
+    > .clj-kondo/ratchets.edn
+}
+
+disable_ratchets() {
+  local commit=$1
+  local file=.clj-kondo/ratchets.edn
+  [ -n "$(git diff-tree --root --no-commit-id --name-only -r "$commit" -- "$file")" ] || return 0
+
+  echo "$file: disabling kondo ratchets on the release branch"
+  write_disabled_ratchets
+  git add -- "$file"
+
+  if ! git rev-parse -q --verify CHERRY_PICK_HEAD >/dev/null; then
+    if ! git diff --cached --quiet HEAD; then
+      git commit --amend --no-edit
+    fi
+    return 0
+  fi
+
+  if [ -z "$(git ls-files -u)" ]; then
+    echo "$file was the only conflict, finishing the cherry-pick"
+    if git diff --cached --quiet HEAD; then
+      echo "nothing left to apply, committing the backport empty"
+      git commit --allow-empty --no-edit
+    else
+      # GIT_EDITOR outranks core.editor, VISUAL, and EDITOR, so the continuation can never wait on
+      # an editor; the repository's own editor configuration is left alone.
+      GIT_EDITOR=true git cherry-pick --continue
+    fi
+  fi
+}
+
+cherry_pick_backport() {
+  local commit=$1
+  local status=0
+  git cherry-pick "$commit" || status=$?
+  if [ "$status" -ne 0 ] && ! git rev-parse -q --verify CHERRY_PICK_HEAD >/dev/null; then
+    echo "cherry-pick failed without entering a resolvable conflict state" >&2
+    return "$status"
+  fi
+
+  disable_ratchets "$commit"
+  if [ "$status" -ne 0 ] &&
+     git rev-parse -q --verify CHERRY_PICK_HEAD >/dev/null &&
+     [ -z "$(git ls-files -u)" ]; then
+    echo "cherry-pick stopped without a file conflict to resolve" >&2
+    return "$status"
+  fi
+}
+
+write_backport_script() {
+  local commit=$1
+  {
+    echo "#!/usr/bin/env bash"
+    echo "set -euo pipefail"
+    echo "git reset HEAD~1"
+    echo "rm ./backport.sh"
+    declare -f write_disabled_ratchets disable_ratchets cherry_pick_backport
+    printf 'cherry_pick_backport %q\n' "$commit"
+    printf '%s\n' "printf 'Resolve conflicts and force push this branch.\\n\\nTo backport translations run: bin/i18n/merge-translations <release-branch>\\n'"
+  } > ./backport.sh
+}

.github/actions/e2e-prepare-containers/action.yml

@@ -93,8 +93,8 @@ runs:
 
         if ${{ inputs.maildev }}; then
           echo -e "${Y}checking maildev container..." &&
-          while ! nc -z localhost 1080; do sleep 1; done &&
-          while ! nc -z localhost 1025; do sleep 1; done &&
+          while ! nc -z localhost 1180; do sleep 1; done &&
+          while ! nc -z localhost 1125; do sleep 1; done &&
           echo -e "${G}Maildev is up and running!"
 
           echo -e "${Y}checking maildev-ssl container..." &&

.github/actions/fetch-artifact/action.yml

@@ -20,6 +20,15 @@ inputs:
     description: Directory path where the jar should be extracted (defaults to current directory)
     required: false
     default: "."
+  download:
+    description: Default is true. Set to false to only look the artifact up and report `fetch-hit`.
+    required: false
+    default: "true"
+
+outputs:
+  fetch-hit:
+    description: Boolean indicating if an artifact was successfully found and downloaded.
+    value: ${{ steps.find_release_artifact.outputs.fetch-hit }}
 
 runs:
   using: "composite"
@@ -28,11 +37,12 @@ runs:
       id: find_release_artifact
       uses: actions/github-script@v9
       with:
-        result-encoding: string
         script: | # js
           const fs = require('fs');
 
           const isRelease = "${{ inputs.release }}" === "true";
+          const failOnMiss = "${{ inputs.fail-on-fetch-miss }}" !== "false";
+          const shouldDownload = "${{ inputs.download }}" !== "false";
           const prefix = isRelease ? "metabase-release" : "metabase";
           const artifactName = `${prefix}-${{ inputs.edition }}-${{ inputs.commit }}-uberjar`;
           console.log(`Looking for artifact: ${artifactName}`);
@@ -44,12 +54,18 @@ runs:
             per_page: 1,
           });
 
-          if (!artifacts.data?.artifacts?.[0]?.id) {
-            core.setFailed(`No artifacts found for ${artifactName}`);
-            return;
+          const artifact_id = artifacts.data?.artifacts?.[0]?.id;
+
+          if (!artifact_id) {
+            core.setOutput('fetch-hit', 'false');
+          } else {
+            core.setOutput('fetch-hit', 'true');
           }
 
-          const artifact_id = artifacts.data.artifacts[0].id;
+          if (!shouldDownload) {
+            console.log(`skipping download (download: false)`);
+            return;
+          }
 
           let download;
           const maxAttempts = 3;
@@ -74,6 +90,7 @@ runs:
           fs.writeFileSync(`${process.env.GITHUB_WORKSPACE}/mb.zip`, Buffer.from(download.data));
 
     - name: Extract and rename JAR
+      if: ${{ steps.find_release_artifact.outputs.fetch-hit == 'true' && inputs.download != 'false' }}
       shell: bash
       run: | # bash
         OUTPUT_NAME="${{ inputs.output-name }}"
@@ -119,12 +136,14 @@ runs:
         fi
 
     - name: Verify that this is a valid JAR file
+      if: ${{ steps.find_release_artifact.outputs.fetch-hit == 'true' && inputs.download != 'false' }}
       shell: bash
       run: |
         echo "Verifying JAR at: $JAR_PATH"
         file --mime-type "$JAR_PATH"
 
     - name: Reveal its version.properties
+      if: ${{ steps.find_release_artifact.outputs.fetch-hit == 'true' && inputs.download != 'false' }}
       shell: bash
       run: |
         echo "Extracting version.properties from: $JAR_PATH"

.github/actions/get-cache-keys/action.yml

@@ -1,45 +0,0 @@
-name: Get cache keys
-description: |
-  Get deterministic cache keys for Maven and Node.js caches based on the centrally controlled cache prefix,
-  and the suffix based on the runner OS and the current week of the year.
-
-outputs:
-  m2-cache-key:
-    description: "The cache key for the Maven cache."
-    value: ${{ steps.keys-factory.outputs.m2-cache-key }}
-  m2-restore-key:
-    description: "The fallback restore key prefix for the Maven cache."
-    value: ${{ steps.keys-factory.outputs.m2-restore-key }}
-  node-cache-key:
-    description: "The cache key for the Node.js cache."
-    value: ${{ steps.keys-factory.outputs.node-cache-key }}
-  node-restore-key:
-    description: "The fallback restore key prefix for the Node.js cache."
-    value: ${{ steps.keys-factory.outputs.node-restore-key }}
-  eslint-cache-key:
-    description: "The cache key for Eslint cache"
-    value: ${{ steps.keys-factory.outputs.eslint-cache-key }}
-  cypress-cache-key:
-    description: "The cache key for Cypress cache"
-    value: ${{ steps.keys-factory.outputs.cypress-cache-key }}
-
-runs:
-  using: "composite"
-  steps:
-    - name: Generate and output cache keys
-      id: keys-factory
-      run: |
-        M2_CACHE_PREFIX='M2'
-        NODE_CACHE_PREFIX='node-modules'
-        ESLINT_CACHE_PREFIX='eslint'
-        CYPRESS_CACHE_PREFIX='cypress'
-        WEEK_OF_YEAR=$(/bin/date "+%G-%V")
-        CACHE_SUFFIX="${{ runner.os }}-$WEEK_OF_YEAR"
-
-        echo "m2-cache-key=$M2_CACHE_PREFIX-$CACHE_SUFFIX" >> "$GITHUB_OUTPUT"
-        echo "m2-restore-key=$M2_CACHE_PREFIX-" >> "$GITHUB_OUTPUT"
-        echo "node-cache-key=$NODE_CACHE_PREFIX-$CACHE_SUFFIX" >> "$GITHUB_OUTPUT"
-        echo "node-restore-key=$NODE_CACHE_PREFIX-" >> "$GITHUB_OUTPUT"
-        echo "eslint-cache-key=$ESLINT_CACHE_PREFIX-$CACHE_SUFFIX" >> "$GITHUB_OUTPUT"
-        echo "cypress-cache-key=$CYPRESS_CACHE_PREFIX-$CACHE_SUFFIX" >> "$GITHUB_OUTPUT"
-      shell: bash

.github/actions/get-docker-info/action.yml

@@ -1,7 +1,15 @@
 name: Get Docker Info
-description: Determines Docker repository and tag based on branch and edition
+description: Determines the registry, repository, and tag a container image is pushed to.
 
 inputs:
+  repo:
+    description: Registry and repo, e.g. "metabase/metabase". Overrides branch derived repo.
+    required: false
+    default: ''
+  tag:
+    description: Docker tag, e.g. v1.87.2. Overrides a branch derived tag.
+    required: false
+    default: ''
   branch:
     description: Branch name (defaults to current branch)
     required: false
@@ -25,9 +33,6 @@ outputs:
   full_image:
     description: Full Docker image name (repo:tag)
     value: ${{ steps.docker-info.outputs.full_image }}
-  editions:
-    description: JSON array of editions to build
-    value: ${{ steps.docker-info.outputs.editions }}
 
 runs:
   using: "composite"
@@ -41,34 +46,22 @@ runs:
           const edition = '${{ inputs.edition }}';
           const owner = '${{ inputs.owner }}';
 
-          console.log(`Determining Docker info for branch: ${branch}, edition: ${edition}`);
-
-          let repo, tag, editions;
-
-          if (branch === 'master') {
-            // Master builds both editions with specific repos
-            editions = ['ee', 'oss'];
-            tag = 'latest';
-
-            if (edition === 'ee') {
-              repo = `${owner}/metabase-enterprise-head`;
-            } else {
-              repo = `${owner}/metabase-head`;
-            }
-          } else {
-            // All other branches only build EE to metabase-dev
-            editions = ['ee'];
-            tag = branch.replaceAll('/', '-'); // slashes make docker sad
-            repo = `${owner}/metabase-dev`;
+          let tag = '${{ inputs.tag}}';
+          if (!tag) {
+            tag = branch === 'master' ? 'latest' : `${branch.replaceAll('/', '-')}-${edition}`;
           }
 
-          const fullImage = `${repo}:${tag}`;
+          let repo = '${{ inputs.repo }}';
+          if (!repo) {
+            if (branch === 'master') {
+              repo = edition === 'ee' ? `${owner}/metabase-enterprise-head` : `${owner}/metabase-head`;
+            } else {
+              repo = `${owner}/metabase-dev`;
+            }
+          }
 
-          // Set outputs
           core.setOutput('repo', repo);
           core.setOutput('tag', tag);
-          core.setOutput('full_image', fullImage);
-          core.setOutput('editions', JSON.stringify(editions));
+          core.setOutput('full_image', `${repo}:${tag}`);
 
-          console.log(`Docker image: ${fullImage}`);
-          console.log(`Editions: ${JSON.stringify(editions)}`);
+          console.log(`Resolved: repo = ${repo}, tag = ${tag}`);

.github/actions/prepare-backend/action.yml

@@ -5,9 +5,6 @@ inputs:
   java-version:
     required: true
     default: "25"
-  clojure-version:
-    required: true
-    default: "1.12.0.1488"
 
 runs:
   using: "composite"
@@ -17,12 +14,40 @@ runs:
       with:
         java-version: ${{ inputs.java-version }}
         distribution: "temurin"
+    - name: Cache spec
+      id: cache-spec
+      shell: bash
+      run: .github/scripts/cache-keys.sh | tee -a "$GITHUB_OUTPUT"
+
+    - name: Restore Clojure CLI
+      uses: actions/cache/restore@v5
+      with:
+        path: ${{ steps.cache-spec.outputs.clojure-path }}
+        key: ${{ steps.cache-spec.outputs.clojure-key }}
+
     - name: Install Clojure CLI
       shell: bash
+      env:
+        CLOJURE_PREFIX: ${{ steps.cache-spec.outputs.clojure-path }}
+        CLOJURE_VERSION: ${{ steps.cache-spec.outputs.clojure-version }}
       run: |
+        set -uo pipefail
+        echo "$CLOJURE_PREFIX/bin" >> "$GITHUB_PATH"
+        export PATH="$CLOJURE_PREFIX/bin:$PATH"
+
+        # Whether the prefix already holds the right install is decided by running it, not by the
+        # cache-hit flag. The installer bakes the prefix into the clj/clojure shims, so a tree restored
+        # under a different $HOME points at a directory that is not there; and on a runner that is not
+        # ephemeral, a previous version's prefix outlives the cache entry that stopped matching it.
+        if clojure --version | grep -qF "$CLOJURE_VERSION"; then
+          clojure --version
+          exit 0
+        fi
+
+        cd "$RUNNER_TEMP"
         for attempt in 1 2 3; do
-          curl --retry 3 --retry-delay 5 --fail -O https://download.clojure.org/install/linux-install-${{ inputs.clojure-version }}.sh \
-            && sudo bash ./linux-install-${{ inputs.clojure-version }}.sh \
+          curl --retry 3 --retry-delay 5 --fail -O "https://download.clojure.org/install/linux-install-$CLOJURE_VERSION.sh" \
+            && bash "./linux-install-$CLOJURE_VERSION.sh" --prefix "$CLOJURE_PREFIX" \
             && break
           echo "::warning::Clojure install attempt $attempt failed, retrying in 10s..."
           sleep 10
@@ -32,10 +57,6 @@ runs:
           exit 1
         fi
 
-    - name: Get M2 cache key
-      uses: ./.github/actions/get-cache-keys
-      id: get-cache-keys
-
     - name: Install uv (for Python package installation)
       uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
       with:
@@ -46,9 +67,6 @@ runs:
     - name: Restore M2 cache
       uses: actions/cache/restore@v5
       with:
-        path: |
-          ~/.m2
-          ~/.gitlibs
-        key: ${{ steps.get-cache-keys.outputs.m2-cache-key }}
-        restore-keys: |
-          ${{ steps.get-cache-keys.outputs.m2-restore-key }}
+        path: ${{ steps.cache-spec.outputs.m2-path }}
+        key: ${{ steps.cache-spec.outputs.m2-key }}
+        restore-keys: ${{ steps.cache-spec.outputs.m2-restore-key }}

.github/actions/prepare-cypress/action.yml

@@ -25,15 +25,17 @@ runs:
         chrome-version: 144
       id: setup-chrome
 
-    - name: Get cache keys
-      uses: ./.github/actions/get-cache-keys
-      id: get-cache-keys
+    - name: Cache spec
+      id: cache-spec
+      shell: bash
+      run: .github/scripts/cache-keys.sh | tee -a "$GITHUB_OUTPUT"
 
-    - name: Get Cypress cache
+    - name: Restore Cypress binary
       uses: actions/cache/restore@v5
       with:
-        path: ~/.cache/Cypress
-        key: ${{ steps.get-cache-keys.outputs.cypress-cache-key }}
+        path: ${{ steps.cache-spec.outputs.cypress-path }}
+        key: ${{ steps.cache-spec.outputs.cypress-key }}
+        restore-keys: ${{ steps.cache-spec.outputs.cypress-restore-key }}
 
     - name: Ensure that Cypress executable is ready
       run: |

.github/actions/prepare-frontend/action.yml

@@ -16,50 +16,38 @@ runs:
       with:
         node-version: ${{ inputs.node-version }}
 
-    - name: Get cache keys
-      uses: ./.github/actions/get-cache-keys
-      id: get-cache-keys
-
-    - name: Restore M2 cache
-      uses: actions/cache/restore@v5
-      with:
-        path: |
-          ~/.m2
-          ~/.gitlibs
-        key: ${{ steps.get-cache-keys.outputs.m2-cache-key }}
-        restore-keys: |
-          ${{ steps.get-cache-keys.outputs.m2-restore-key }}
-
-    - name: Get bun cache directory
-      id: bun-cache
-      run: |
-        BUN_CACHE_DIR=$(bun pm cache)
-        echo "Bun cache directory: $BUN_CACHE_DIR"
-        echo "dir=$BUN_CACHE_DIR" >> "$GITHUB_OUTPUT"
+    - name: Cache spec
+      id: cache-spec
       shell: bash
+      run: .github/scripts/cache-keys.sh | tee -a "$GITHUB_OUTPUT"
 
-    - name: Restore node_modules cache
+    # The spec names the store path rather than discovering it, so that a job can restore the cache
+    # before bun exists. Exported job-wide rather than per-step because every later bun invocation has
+    # to resolve against the same store. Confirm bun agreed: if the variable stopped taking effect, bun
+    # would fill its default directory and the cache would silently save an empty tree.
+    - name: Point bun at the cached store
+      shell: bash
+      env:
+        STORE: ${{ steps.cache-spec.outputs.bun-store-path }}
+      run: |
+        echo "BUN_INSTALL_CACHE_DIR=$STORE" >> "$GITHUB_ENV"
+        ACTUAL=$(BUN_INSTALL_CACHE_DIR="$STORE" bun pm cache)
+        if [ "$ACTUAL" != "$STORE" ]; then
+          echo "::error::bun reports its store at $ACTUAL, not $STORE; BUN_INSTALL_CACHE_DIR is not taking effect"
+          exit 1
+        fi
+
+    - name: Restore bun store
       uses: actions/cache/restore@v5
-      id: node-modules-cache
       with:
-        path: |
-          ${{ steps.bun-cache.outputs.dir }}
-          node_modules
-        key: ${{ steps.get-cache-keys.outputs.node-cache-key }}
-        restore-keys: |
-          ${{ steps.get-cache-keys.outputs.node-restore-key }}
+        path: ${{ steps.cache-spec.outputs.bun-store-path }}
+        key: ${{ steps.cache-spec.outputs.bun-store-key }}
+        restore-keys: ${{ steps.cache-spec.outputs.bun-store-restore-key }}
 
     # postinstall lifecycle hook can be dangerous in CI so we only run it locally (see package.json)
     # If a job wants to patch packages, it does so explicitly in the CI. This setting is opt-out.
-    # For example, we never want to cache node_modules with patches already applied so cache-generator.yml skips that step.
-    - name: Clean install
-      # Remove the restored node_modules before installing. The os-week cache can
-      # carry a stale tree (for example a different React major), and
-      # `--frozen-lockfile` alone does not prune it. Rebuilding from the cached bun
-      # store gives an exact, lockfile-correct node_modules with no extra download.
-      run: |
-        rm -rf node_modules
-        bun install --frozen-lockfile
+    - name: Install front-end dependencies
+      run: bun install --frozen-lockfile
       shell: bash
     - name: Patch frontend dependencies
       if: inputs.apply-patches == 'true'

.github/actions/prepare-shoppy-e2e/action.yml

@@ -14,21 +14,6 @@ inputs:
   staging-mb-all-features-token:
     description: "Staging MB all features token"
     required: true
-  shoppy-iam-role:
-    description: "Shoppy IAM role for AWS credentials"
-    required: true
-  shoppy-metabase-app-db-s3-bucket:
-    description: "S3 bucket for Shoppy app DB dump"
-    required: true
-  shoppy-metabase-app-db-s3-key:
-    description: "S3 key for Shoppy app DB dump"
-    required: true
-  shoppy-metabase-app-db-user:
-    description: "Shoppy Metabase app DB user"
-    required: true
-  shoppy-metabase-app-db-database:
-    description: "Shoppy Metabase app DB database"
-    required: true
   metastore-dev-server-url:
     description: "Metastore dev server URL"
     required: true
@@ -93,20 +78,6 @@ runs:
           echo "sample_app_branch_exists=false" >> "$GITHUB_OUTPUT"
         fi
 
-    - name: Configure AWS credentials
-      if: ${{ steps.check-sample-app-branch.outputs.sample_app_branch_exists == 'true' }}
-      uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885
-      with:
-        role-to-assume: ${{ inputs.shoppy-iam-role }}
-        role-session-name: GitHub_to_AWS_via_FederatedOIDC
-        aws-region: us-east-1
-
-    - name: Download Shoppy's App DB PostgreSQL dump from S3
-      if: ${{ steps.check-sample-app-branch.outputs.sample_app_branch_exists == 'true' }}
-      shell: bash
-      run: |
-        aws s3 cp s3://${{ inputs.shoppy-metabase-app-db-s3-bucket }}/${{ inputs.shoppy-metabase-app-db-s3-key }} ./e2e/tmp/db_dumps/shoppy_metabase_app_db_dump.sql
-
     - name: Prepare and launch Shoppy containers
       if: ${{ steps.check-sample-app-branch.outputs.sample_app_branch_exists == 'true' }}
       shell: bash
@@ -115,8 +86,6 @@ runs:
         SAMPLE_APP_ENVIRONMENT: ${{ inputs.sample-app-environment }}
         CYPRESS_MB_ALL_FEATURES_TOKEN: ${{ inputs.staging-mb-all-features-token }}
         METASTORE_DEV_SERVER_URL: ${{ inputs.metastore-dev-server-url }}
-        METABASE_APP_DB_USER: ${{ inputs.shoppy-metabase-app-db-user }}
-        METABASE_APP_DB: ${{ inputs.shoppy-metabase-app-db-database }}
         SHOPPY_DATADOG_APPLICATION_ID: ${{ inputs.shoppy-datadog-application-id }}
         SHOPPY_DATADOG_CLIENT_TOKEN: ${{ inputs.shoppy-datadog-client-token }}
         SHOPPY_DATADOG_SITE: "us5.datadoghq.com"

.github/actions/report-failures-to-ci-conductor/action.yml

@@ -25,6 +25,7 @@ runs:
         TARGET_BRANCH: ${{ github.event.pull_request.base.ref || github.ref_name }}
         CI_CONDUCTOR_TEST_SUITE: ${{ inputs.test-suite }}
         ADAPTER: ${{ inputs.adapter }}
+        IS_RERUN: ${{ github.run_attempt != '1' }}
       # Keep the path constrained to known entrypoints.
       run: |
         case "$ADAPTER" in

.github/actions/test-driver/action.yml

@@ -20,8 +20,30 @@ inputs:
     required: false
     default: "ee"
     description: Edition to test (oss or ee)
-  quarantine-engine:
+  runner-index:
     required: false
+    description: >-
+      The index of this runner among those sharing a partitioned suite. See
+      `be-tests-bigquery-cloud-sdk-ee` in `.github/workflows/drivers.yml` for an example.
+  runner-count:
+    required: false
+    description: >-
+      How many runners share the suite. Recommended to set to `strategy.job-total` rather
+      than a literal so that it doesn't need updating if the `runner-index` matrix changes.
+  jvms-per-runner:
+    required: false
+    default: "1"
+    description: >-
+      Concurrent JVMs per runner. Recommended to raise above 1 for drivers whose tests
+      spend a lot of time waiting on a remote warehouse.
+  heap-per-jvm:
+    required: false
+    default: "4g"
+    description: >-
+      `-Xmx` per JVM, applied only when `jvms-per-runner` is more than 1 (otherwise the
+      the `:ci` alias's `-Xmx12g` is used). To size it: reserve ~1G for the OS and ~2G
+      of non-heap per JVM, then divide what's left. On a 16G runner that's ~4G each for
+      two JVMs.
   granular-rerun:
     required: false
     default: "true"
@@ -100,21 +122,50 @@ runs:
       # Otherwise run exactly as before. Quote the file so the whole `[ns/var ...]`
       # vector reaches clojure -X as a single argument.
       run: |
+        ALIASES="dev:ci:${{ inputs.edition }}:${{ inputs.edition }}-dev:drivers:drivers-dev:test"
         BASE="clojure -X:dev:ci:${{ inputs.edition }}:${{ inputs.edition }}-dev:drivers:drivers-dev:test"
-        if [ "${{ inputs.granular-rerun }}" = "true" ] && [ "${{ github.run_attempt }}" != "1" ] && [ -s target/failed-tests ]; then
+        # `:profile-tests` overrides `:test`'s exec-fn, so it has to come last. See dev.profile-tests.
+        # The `profiled` output is what the collection steps below key off, so that the decision is
+        # recorded by the step that acts on it rather than re-derived from the environment.
+        if [ "$PROFILE_TESTS" = "true" ]; then
+          echo "Profiling this run; a flamegraph will be attached to the job."
+          echo "profiled=true" >> "$GITHUB_OUTPUT"
+          BASE="$BASE:profile-tests"
+        fi
+        # An explicit selection wins over the rerun narrowing below: it was asked for by hand, on this
+        # attempt. Names may be separated by commas or spaces; hawk wants them as one vector argument.
+        if [ -n "$ONLY_TESTS" ]; then
+          ONLY="[$(echo "$ONLY_TESTS" | tr ',' ' ')]"
+          echo "Running only: $ONLY"
+          $BASE :only "$ONLY"
+        elif [ "${{ inputs.granular-rerun }}" = "true" ] && [ "${{ github.run_attempt }}" != "1" ] && [ -s target/failed-tests ]; then
           echo "Granular rerun of previously-failed tests: $(cat target/failed-tests)"
-          $BASE :only "$(cat target/failed-tests)"
+          clojure -X:"$ALIASES" :only "$(cat target/failed-tests)"
+        elif [ -n "$TEST_RUNNER_INDEX" ]; then
+          CLOJURE_ALIASES="$ALIASES" ./.github/scripts/run-backend-test-jvms.sh ${{ inputs.test-args }}
         else
-          $BASE ${{ inputs.test-args }}
+          clojure -X:"$ALIASES" ${{ inputs.test-args }}
         fi
       shell: bash
       id: run-test
+      env:
+        TEST_RUNNER_INDEX: ${{ inputs.runner-index }}
+        TEST_RUNNER_COUNT: ${{ inputs.runner-count }}
+        TEST_JVMS_PER_RUNNER: ${{ inputs.jvms-per-runner }}
+        TEST_HEAP_PER_JVM: ${{ inputs.heap-per-jvm }}
       # Keep this step continue-on-error because the quarantine gate below controls whether it
       # ultimately fails.
       continue-on-error: true
 
+    - name: Collect profile
+      if: ${{ !cancelled() }}
+      uses: ./.github/actions/collect-profile
+      with:
+        profiled: ${{ steps.run-test.outputs.profiled }}
+        artifact-name: ${{ format('profile-{0}{1}', inputs.junit-name, inputs.artifact-suffix && format('-{0}', inputs.artifact-suffix) || '') }}
+
     - name: Report failed tests to ci-conductor
-      if: ${{ !cancelled() && steps.run-test.outcome == 'failure' }}
+      if: ${{ !cancelled() && ( steps.run-test.outcome == 'failure' || github.run_attempt != '1' ) }}
       # This step should NEVER fail the job!
       continue-on-error: true
       uses: ./.github/actions/report-failures-to-ci-conductor
@@ -165,7 +216,9 @@ runs:
       uses: actions/upload-artifact@v7
       with:
         name: ${{ format('test-logs-{0}{1}', github.job, inputs.artifact-suffix && format('-{0}', inputs.artifact-suffix) || '') }}
-        path: logs/test-log.json
+        # Glob: a single-JVM run writes `logs/test-log.json`; a multi-JVM run merges one
+        # `logs/test-log-p<index>.json` per JVM.
+        path: logs/test-log*.json
         retention-days: 1
       # Failing to upload the artifact should never affect the outcome of the whole test run.
       continue-on-error: true
@@ -178,4 +231,4 @@ runs:
       with:
         adapter: backend
         test-suite: ${{ inputs.junit-name }}
-        enforce-quarantine: ${{ inputs.quarantine-engine == 'ci-conductor' }}
+        enforce-quarantine: "true"

.github/actions/update-cache/action.yml

@@ -1,41 +0,0 @@
-name: Update cache
-description: |
-  Update a GitHub Actions cache based on a provided path and key.
-  If a cache entry already exists for the given key, it is first removed.
-  This ensures immutability of cache entries, and prevents runtime errors.
-
-inputs:
-  path:
-    description: "The path(s) to cache, separated by newlines."
-    required: true
-  key:
-    description: "The cache key to use."
-    required: true
-
-runs:
-  using: "composite"
-  steps:
-    - name: Check if the cache entry exists
-      id: cache-lookup
-      uses: actions/cache/restore@v5
-      with:
-        path: ${{ inputs.path }}
-        key: ${{ inputs.key }}
-        lookup-only: true # Important bit: the action will not fetch anything, just check for the cache existence.
-    - name: Delete the cache entry if it exists
-      if: ${{ steps.cache-lookup.outputs.cache-hit == 'true' }}
-      run: |
-        echo "Cache entry found for key '${{ inputs.key }}'. Deleting it to ensure immutability."
-        gh api \
-          --method DELETE \
-          -H "Accept: application/vnd.github+json" \
-          -H "X-GitHub-Api-Version: 2022-11-28" \
-          /repos/${{ github.repository }}/actions/caches?key=${{ inputs.key }}
-      env:
-        GH_TOKEN: ${{ github.token }}
-      shell: bash
-    - name: Save the new cache entry
-      uses: actions/cache/save@v5
-      with:
-        path: ${{ inputs.path }}
-        key: ${{ inputs.key }}

.github/file-paths.yaml

@@ -7,9 +7,8 @@ default: &default
   - "locales/**"
   - "bin/**/!(*.md)"
 
-actionlint:
-  - added|modified: ".github/workflows/*.yml"
-  - added|modified: ".github/workflows/*.yaml"
+workflows:
+  - added|modified: ".github/workflows/*.{yml,yaml}"
 
 shared_sources: &shared_sources
   - "src/**/*.cljc"
@@ -65,6 +64,9 @@ frontend_specs: &frontend_specs
   - "frontend/**/*.unit.*"
   - "enterprise/frontend/**/*.unit.*"
   - ".github/**/*.unit.spec.*"
+  # file-paths.unit.spec.ts asserts what this file's own patterns match, so a change to it has to
+  # run the specs that guard it.
+  - ".github/file-paths.yaml"
   - "jest.config.js"
   - "jest.tz.unit.conf.json"
 
@@ -113,11 +115,15 @@ backend_sources: &backend_sources
   - "src/**"
   - "modules/drivers/{*,*/{*,!(test)/**}}"
   - "resources/**"
-  - ".clj-kondo/**"
+  # Ratchet files drive project_ratchet_checks alone, so automation PRs that lower budgets
+  # run the Project tests job by themselves. Patterns are OR-ed, so a separate "!..." entry would match
+  # every other path instead of excluding this one.
+  - ".clj-kondo/**/!(ratchets.edn)"
 
 backend_specs: &backend_specs
   - *shared_specs
   - "test/**"
+  - "dev/test/**"
   - "enterprise/backend/test/**"
   - "test_modules/**"
   - "modules/drivers/*/test/**"
@@ -130,6 +136,48 @@ backend_all: &backend_all
   - *backend_sources
   - *backend_specs
 
+# Project checks have narrower triggers than the backend matrix.
+# Changes to their shared CI entry points exercise every suite; otherwise each
+# suite follows only the files that can affect its result.
+project_tests_infra: &project_tests_infra
+  - ".github/actions/prepare-backend/**"
+  - ".github/file-paths.yaml"
+  - ".github/workflows/backend.yml"
+  - ".github/workflows/run-tests.yml"
+  - "bb.edn"
+  - "bin/mage"
+  - "bin/mage.bb"
+  - "mage/src/mage/color.clj"
+  - "mage/src/mage/project_tests.clj"
+  - "mage/src/mage/shell.clj"
+  - "mage/src/mage/util.clj"
+
+project_backend_checks:
+  - *project_tests_infra
+  - "{src,test,enterprise,dev,bin,mage}/**/*.{clj,cljc,cljs}"
+  - "modules/**/*.clj"
+  - "modules/**/*.cljc"
+  - "modules/**/*.cljs"
+  - "**deps.edn"
+  - ".clj-kondo/{src,test}/**/*.{clj,cljc,cljs}"
+  - "{resources,test_resources,test_config}/**/*.{clj,cljc,cljs}"
+  - ".clj-kondo/config.edn"
+  - ".clj-kondo/config/modules/config.edn"
+  - ".github/team.json"
+  - "dev/resources/dev/modules_config_test/**"
+
+# Only the ratchet check reads the budgets, so a diff that touches nothing else runs that suite alone.
+project_ratchet_checks:
+  - ".clj-kondo/ratchets.edn"
+  - ".clj-kondo/config/modules/ratchets.edn"
+
+project_migration_checks:
+  - *project_tests_infra
+  - "bin/lint-migrations-file/**"
+  - "resources/migrations/**/*.{yaml,yml}"
+  - "src/metabase/app_db/custom_migrations.clj"
+  - "src/metabase/app_db/custom_migrations/**"
+
 sources: &sources
   - *shared_sources
   - *frontend_sources
@@ -222,6 +270,28 @@ cljs:
   - ".github/workflows/cljs.yml"
   - "shadow-cljs.edn"
 
+embedder_plugin:
+  - ".github/actions/prepare-backend/**"
+  - ".github/file-paths.yaml"
+  - ".github/workflows/build-scripts.yml"
+  - "bin/build-embedder-plugin.sh"
+  - "bin/build/src/build/embedder_model.clj"
+  - "bin/build/src/build/plugin_uberjar.clj"
+  - "bin/build/src/build_embedder_plugin.clj"
+  - "deps.edn"
+  - "modules/embedder/**"
+  - "enterprise/backend/src/metabase_enterprise/data_complexity_score/complexity_embedders.clj"
+  - "enterprise/backend/src/metabase_enterprise/data_complexity_score/settings.clj"
+  - "enterprise/backend/src/metabase_enterprise/data_complexity_score/synonym_source.clj"
+  - "enterprise/backend/src/metabase_enterprise/semantic_search/embedding.clj"
+  - "enterprise/backend/src/metabase_enterprise/semantic_search/settings.clj"
+  - "enterprise/backend/test/metabase_enterprise/semantic_search/appdb_pgvector_mode_test.clj"
+  - "enterprise/backend/test/metabase_enterprise/semantic_search/embedding_test.clj"
+  - "src/metabase/embeddings/provider.clj"
+  - "src/metabase/embeddings/startup.clj"
+  - "src/metabase/plugins/**"
+  - "test/metabase/embeddings/embedder_plugin_artifact_test.clj"
+
 serialization_baseline:
   - ".github/workflows/serialization.yml"
   - "test_resources/serialization_baseline/**"

.github/instructions/e2e.instructions.md

@@ -0,0 +1,12 @@
+---
+applyTo: "e2e/**/*.cy.spec.{js,ts}"
+---
+
+# Cypress E2E Spec Review
+
+When reviewing Cypress E2E specs, apply the guidelines in these files:
+
+- `.claude/skills/_shared/cypress-conventions.md`
+- `.claude/skills/e2e-test-review/SKILL.md`
+
+These are in addition to the TypeScript/JavaScript instructions, which also match these files.

.github/scripts/bundle-size-stats-prepare.js

@@ -1,152 +0,0 @@
-/* eslint-disable import/no-commonjs */
-// Prepares the rows the bundle-size stats logger uploads to stats.metabase.com.
-//
-// For each measured (bundle, kind) it computes the delta — raw, gzipped and
-// brotli (as-served) bytes plus percent — against the previously *plotted* data
-// point (restored from a rolling cache), so the deltas can be charted directly.
-// It also decides whether this commit is worth recording at all: a point is kept
-// when the as-served size moved by at least MIN_DELTA_PERCENT, or when a new
-// bundle/kind appears. Only master builds run through here — releases form
-// non-linear lines whose deltas are meaningless, so they're not recorded (their
-// historical sizes are backfilled separately).
-//
-// buildStatsRows is pure (data in, data out) so it can be unit-tested; main()
-// is the thin I/O wrapper that reads env/files and writes the rows, cache and
-// step outputs.
-const fs = require("fs");
-const path = require("path");
-
-const deltaPercent = (current, base) =>
-  base ? Math.round(((current - base) * 10000) / base) / 100 : "";
-
-/**
- * Turn the current measurements + the last plotted point into upload rows, the
- * slim cache rows for the next diff, and the keep/skip decision.
- *
- * The significance threshold tracks the as-served size: brotli where the build
- * ships a precompressed .br, otherwise gzip. Current measurements always carry
- * brotliBytes (estimated when no .br shipped), but a cached base point recorded
- * before brotli logging may not, so the delta still falls back to gzip per row.
- */
-function buildStatsRows({ measurements, previous, threshold, date, commit, commitMessage, version }) {
-  const previousOf = (bundle, kind) => previous.find(row => row.bundle === bundle && row.kind === kind);
-
-  let maxServedDeltaPercent = 0;
-  let hasNewSeries = false;
-
-  const rows = measurements.map(measurement => {
-    const base = previousOf(measurement.bundle, measurement.kind);
-    const hasBrotli = measurement.brotliBytes != null && base?.brotliBytes != null;
-    const gzipDeltaPercent = deltaPercent(measurement.gzipBytes, base?.gzipBytes);
-    const brotliDeltaPercent = hasBrotli ? deltaPercent(measurement.brotliBytes, base.brotliBytes) : "";
-    if (!base) {
-      hasNewSeries = true;
-    } else {
-      const servedDeltaPercent = hasBrotli ? brotliDeltaPercent : gzipDeltaPercent;
-      maxServedDeltaPercent = Math.max(maxServedDeltaPercent, Math.abs(servedDeltaPercent));
-    }
-    return {
-      "Date": date,
-      "Version": version,
-      "Commit": commit,
-      "Bundle": measurement.bundle,
-      "Kind": measurement.kind, // "initial" or "total"
-      // The stats table carries a free-text Description column; append-csv
-      // requires every table column to be present. Populate it with the commit
-      // subject so the chart's points are self-describing.
-      "Description": commitMessage,
-      "Raw bytes": measurement.rawBytes,
-      "Gzip bytes": measurement.gzipBytes,
-      "Brotli bytes": measurement.brotliBytes, // as-served (shipped .br, else estimated)
-      "File count": measurement.fileCount,
-      "Raw bytes delta": base ? measurement.rawBytes - base.rawBytes : "",
-      "Gzip bytes delta": base ? measurement.gzipBytes - base.gzipBytes : "",
-      "Brotli bytes delta": hasBrotli ? measurement.brotliBytes - base.brotliBytes : "",
-      "Raw delta %": deltaPercent(measurement.rawBytes, base?.rawBytes),
-      "Gzip delta %": gzipDeltaPercent,
-      "Brotli delta %": brotliDeltaPercent,
-    };
-  });
-
-  const firstPoint = previous.length === 0;
-  const significant = firstPoint || hasNewSeries || maxServedDeltaPercent >= threshold;
-
-  // Slim rows the next run diffs against. The workflow only persists this to the
-  // cache when we actually push, so the cached reference always stays the last
-  // *plotted* point (cumulative drift is caught).
-  const cacheRows = measurements.map(({ bundle, kind, rawBytes, gzipBytes, brotliBytes }) => ({
-    bundle,
-    kind,
-    rawBytes,
-    gzipBytes,
-    brotliBytes,
-  }));
-
-  const reason = firstPoint
-    ? "first point"
-    : hasNewSeries
-      ? "new bundle/kind series"
-      : `max served Δ ${maxServedDeltaPercent.toFixed(2)}% (threshold ${threshold}%)`;
-
-  return { rows, cacheRows, significant, reason, maxServedDeltaPercent, firstPoint, hasNewSeries };
-}
-
-module.exports = { buildStatsRows };
-
-const readJson = filePath => (filePath && fs.existsSync(filePath) ? JSON.parse(fs.readFileSync(filePath, "utf8")) : null);
-const writeJson = (filePath, value) => {
-  fs.mkdirSync(path.dirname(filePath), { recursive: true });
-  fs.writeFileSync(filePath, JSON.stringify(value));
-};
-const setOutput = (env, name, value) => {
-  if (env.GITHUB_OUTPUT) {
-    fs.appendFileSync(env.GITHUB_OUTPUT, `${name}=${value}\n`);
-  }
-};
-
-// version.properties (extracted from the uberjar) carries the build's tag.
-// Non-release (master) builds report tag=vUNKNOWN, so leave Version empty there.
-function readVersion(versionPropsPath) {
-  const raw =
-    versionPropsPath && fs.existsSync(versionPropsPath)
-      ? (fs.readFileSync(versionPropsPath, "utf8").match(/^tag=(.*)$/m)?.[1]?.trim() ?? "")
-      : "";
-  return raw === "vUNKNOWN" ? "" : raw;
-}
-
-function main() {
-  const env = process.env;
-
-  const measurements = readJson(env.CURRENT);
-  if (!Array.isArray(measurements) || measurements.length === 0) {
-    console.error(`::error::No bundle measurements found at ${env.CURRENT}`);
-    process.exit(1);
-  }
-
-  const result = buildStatsRows({
-    measurements,
-    // The last plotted point, as slim rows: [{ bundle, kind, rawBytes, gzipBytes, brotliBytes }].
-    previous: readJson(env.LAST) || [],
-    threshold: Number(env.MIN_DELTA_PERCENT ?? 1),
-    date: new Date().toISOString().slice(0, 10), // YYYY-MM-DD
-    commit: (env.HEAD_SHA || "").slice(0, 12),
-    commitMessage: (env.COMMIT_MESSAGE || "").split("\n")[0], // subject line only
-    version: readVersion(env.VERSION_PROPS),
-  });
-
-  writeJson(env.ROWS_OUT, result.rows);
-  writeJson(env.CACHE_OUT, result.cacheRows);
-
-  console.log(`${result.significant ? "RECORD" : "SKIP"} — ${result.reason}`);
-
-  setOutput(env, "significant", result.significant ? "true" : "false");
-  setOutput(
-    env,
-    "max_delta_percent",
-    result.firstPoint || result.hasNewSeries ? "" : result.maxServedDeltaPercent.toFixed(2),
-  );
-}
-
-if (require.main === module) {
-  main();
-}

.github/scripts/bundle-size-stats-prepare.ts

@@ -0,0 +1,225 @@
+// Prepares the rows the bundle-size stats logger imports into eng-stats-importer.
+//
+// For each measured (bundle, kind) it computes the delta — raw, gzipped and
+// brotli (as-served) bytes plus percent — against the previously *plotted* data
+// point (restored from a rolling cache), so the deltas can be charted directly.
+// It also decides whether this commit is worth recording at all: a point is kept
+// when the as-served size moved by at least MIN_DELTA_PERCENT, or when a new
+// bundle/kind appears. Only master builds run through here — releases form
+// non-linear lines whose deltas are meaningless, so they're not recorded (their
+// historical sizes are backfilled separately).
+//
+// buildStatsRows is pure (data in, data out) so it can be unit-tested; main()
+// is the thin I/O wrapper that reads env/files and writes the rows, cache and
+// step outputs.
+import {
+  appendFileSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  writeFileSync,
+} from "node:fs";
+import { dirname } from "node:path";
+
+/** One measurement emitted by measure-bundle-sizes. */
+export interface Measurement {
+  bundle: string;
+  kind: "initial" | "total";
+  rawBytes: number;
+  gzipBytes: number;
+  brotliBytes: number;
+  fileCount: number;
+}
+
+/**
+ * The slim row cached between runs, holding the last *plotted* point.
+ * `brotliBytes` is optional because a point cached before brotli logging
+ * landed does not carry it — see buildStatsRows' per-row gzip fallback.
+ */
+export type CacheRow = Pick<Measurement, "bundle" | "kind" | "rawBytes" | "gzipBytes"> & {
+  brotliBytes?: number;
+};
+
+export interface BuildStatsRowsInput {
+  measurements: Measurement[];
+  previous: CacheRow[];
+  threshold: number;
+  date: string;
+  commit: string;
+  commitMessage: string;
+  version: string;
+}
+
+/** An upload row, keyed by the importer's column display names. */
+export type StatsRow = Record<string, string | number | null>;
+
+export interface BuildStatsRowsResult {
+  rows: StatsRow[];
+  cacheRows: CacheRow[];
+  significant: boolean;
+  reason: string;
+  maxServedDeltaPercent: number;
+  firstPoint: boolean;
+  hasNewSeries: boolean;
+}
+
+// null, not "", for an absent delta: the stats importer coerces values
+// strictly and rejects "" for a numeric column.
+const deltaPercent = (current: number, base: number | undefined | null): number | null =>
+  base ? Math.round(((current - base) * 10000) / base) / 100 : null;
+
+/**
+ * Turn the current measurements + the last plotted point into upload rows, the
+ * slim cache rows for the next diff, and the keep/skip decision.
+ *
+ * The significance threshold tracks the as-served size: brotli where the build
+ * ships a precompressed .br, otherwise gzip. Current measurements always carry
+ * brotliBytes (estimated when no .br shipped), but a cached base point recorded
+ * before brotli logging may not, so the delta still falls back to gzip per row.
+ */
+export function buildStatsRows({
+  measurements,
+  previous,
+  threshold,
+  date,
+  commit,
+  commitMessage,
+  version,
+}: BuildStatsRowsInput): BuildStatsRowsResult {
+  const previousOf = (bundle: string, kind: string) =>
+    previous.find((row) => row.bundle === bundle && row.kind === kind);
+
+  let maxServedDeltaPercent = 0;
+  let hasNewSeries = false;
+
+  const rows = measurements.map((measurement): StatsRow => {
+    const base = previousOf(measurement.bundle, measurement.kind);
+    // Non-null only when BOTH sides carry brotli: a point cached before brotli
+    // logging landed has none, and that row falls back to the gzip delta.
+    const baseBrotli =
+      measurement.brotliBytes != null && base?.brotliBytes != null ? base.brotliBytes : null;
+    const gzipDeltaPercent = deltaPercent(measurement.gzipBytes, base?.gzipBytes);
+    const brotliDeltaPercent =
+      baseBrotli != null ? deltaPercent(measurement.brotliBytes, baseBrotli) : null;
+    if (!base) {
+      hasNewSeries = true;
+    } else {
+      const servedDeltaPercent = baseBrotli != null ? brotliDeltaPercent : gzipDeltaPercent;
+      maxServedDeltaPercent = Math.max(maxServedDeltaPercent, Math.abs(servedDeltaPercent ?? 0));
+    }
+    return {
+      Date: date,
+      Version: version,
+      Commit: commit,
+      Bundle: measurement.bundle,
+      Kind: measurement.kind, // "initial" or "total"
+      // The stats table carries a free-text Description column. Populate it
+      // with the commit subject so the chart's points are self-describing.
+      Description: commitMessage,
+      "Raw bytes": measurement.rawBytes,
+      "Gzip bytes": measurement.gzipBytes,
+      "Brotli bytes": measurement.brotliBytes, // as-served (shipped .br, else estimated)
+      "File count": measurement.fileCount,
+      "Raw bytes delta": base ? measurement.rawBytes - base.rawBytes : null,
+      "Gzip bytes delta": base ? measurement.gzipBytes - base.gzipBytes : null,
+      "Brotli bytes delta": baseBrotli != null ? measurement.brotliBytes - baseBrotli : null,
+      "Raw delta %": deltaPercent(measurement.rawBytes, base?.rawBytes),
+      "Gzip delta %": gzipDeltaPercent,
+      "Brotli delta %": brotliDeltaPercent,
+    };
+  });
+
+  const firstPoint = previous.length === 0;
+  const significant = firstPoint || hasNewSeries || maxServedDeltaPercent >= threshold;
+
+  // Slim rows the next run diffs against. The workflow only persists this to the
+  // cache when we actually push, so the cached reference always stays the last
+  // *plotted* point (cumulative drift is caught).
+  const cacheRows = measurements.map(
+    ({ bundle, kind, rawBytes, gzipBytes, brotliBytes }): CacheRow => ({
+      bundle,
+      kind,
+      rawBytes,
+      gzipBytes,
+      brotliBytes,
+    }),
+  );
+
+  const reason = firstPoint
+    ? "first point"
+    : hasNewSeries
+      ? "new bundle/kind series"
+      : `max served Δ ${maxServedDeltaPercent.toFixed(2)}% (threshold ${threshold}%)`;
+
+  return {
+    rows,
+    cacheRows,
+    significant,
+    reason,
+    maxServedDeltaPercent,
+    firstPoint,
+    hasNewSeries,
+  };
+}
+
+const readJson = <T,>(filePath: string | undefined): T | null =>
+  filePath && existsSync(filePath) ? (JSON.parse(readFileSync(filePath, "utf8")) as T) : null;
+
+const writeJson = (filePath: string, value: unknown) => {
+  mkdirSync(dirname(filePath), { recursive: true });
+  writeFileSync(filePath, JSON.stringify(value));
+};
+
+const setOutput = (name: string, value: string) => {
+  if (process.env.GITHUB_OUTPUT) {
+    appendFileSync(process.env.GITHUB_OUTPUT, `${name}=${value}\n`);
+  }
+};
+
+// version.properties (extracted from the uberjar) carries the build's tag.
+// Non-release (master) builds report tag=vUNKNOWN, so leave Version empty there.
+function readVersion(versionPropsPath: string | undefined): string {
+  const raw =
+    versionPropsPath && existsSync(versionPropsPath)
+      ? (readFileSync(versionPropsPath, "utf8").match(/^tag=(.*)$/m)?.[1]?.trim() ?? "")
+      : "";
+  return raw === "vUNKNOWN" ? "" : raw;
+}
+
+export function main() {
+  const env = process.env;
+
+  const measurements = readJson<Measurement[]>(env.CURRENT);
+  if (!Array.isArray(measurements) || measurements.length === 0) {
+    console.error(`::error::No bundle measurements found at ${env.CURRENT}`);
+    process.exit(1);
+  }
+
+  const result = buildStatsRows({
+    measurements,
+    // The last plotted point, as slim rows: [{ bundle, kind, rawBytes, gzipBytes, brotliBytes }].
+    previous: readJson<CacheRow[]>(env.LAST) || [],
+    threshold: Number(env.MIN_DELTA_PERCENT ?? 1),
+    date: new Date().toISOString().slice(0, 10), // YYYY-MM-DD
+    commit: (env.HEAD_SHA || "").slice(0, 12),
+    commitMessage: (env.COMMIT_MESSAGE || "").split("\n")[0], // subject line only
+    version: readVersion(env.VERSION_PROPS),
+  });
+
+  writeJson(env.ROWS_OUT!, result.rows);
+  writeJson(env.CACHE_OUT!, result.cacheRows);
+
+  console.log(`${result.significant ? "RECORD" : "SKIP"} — ${result.reason}`);
+
+  setOutput("significant", result.significant ? "true" : "false");
+  setOutput(
+    "max_delta_percent",
+    result.firstPoint || result.hasNewSeries ? "" : result.maxServedDeltaPercent.toFixed(2),
+  );
+}
+
+// Only run the I/O wrapper when invoked directly, so importing buildStatsRows
+// (from the spec) has no side effects.
+if ((import.meta as ImportMeta & { main?: boolean }).main) {
+  main();
+}

.github/scripts/bundle-size-stats-prepare.unit.spec.ts

@@ -1,7 +1,16 @@
-const { buildStatsRows } = require("./bundle-size-stats-prepare");
+import {
+  buildStatsRows,
+  type CacheRow,
+  type Measurement,
+} from "./bundle-size-stats-prepare";
 
-const meta = { date: "2026-06-30", commit: "abc123", commitMessage: "Fix the thing (#123)", version: "" };
-const measurement = (over = {}) => ({
+const meta = {
+  date: "2026-06-30",
+  commit: "abc123",
+  commitMessage: "Fix the thing (#123)",
+  version: "",
+};
+const measurement = (over: Partial<Measurement> = {}): Measurement => ({
   bundle: "embedding-sdk-chunked",
   kind: "total",
   rawBytes: 1000,
@@ -23,8 +32,8 @@ describe("buildStatsRows", () => {
     expect(result.firstPoint).toBe(true);
     expect(result.significant).toBe(true);
     expect(result.reason).toBe("first point");
-    expect(result.rows[0]["Gzip bytes delta"]).toBe("");
-    expect(result.rows[0]["Brotli delta %"]).toBe("");
+    expect(result.rows[0]["Gzip bytes delta"]).toBeNull();
+    expect(result.rows[0]["Brotli delta %"]).toBeNull();
     expect(result.rows[0]["Description"]).toBe("Fix the thing (#123)");
     expect(result.cacheRows[0]).toEqual({
       bundle: "embedding-sdk-chunked",
@@ -49,7 +58,15 @@ describe("buildStatsRows", () => {
   });
 
   it("gates significance on the brotli (as-served) delta when both sides have it", () => {
-    const previous = [{ bundle: "embedding-sdk-chunked", kind: "total", rawBytes: 1000, gzipBytes: 400, brotliBytes: 300 }];
+    const previous: CacheRow[] = [
+      {
+        bundle: "embedding-sdk-chunked",
+        kind: "total",
+        rawBytes: 1000,
+        gzipBytes: 400,
+        brotliBytes: 300,
+      },
+    ];
 
     const big = buildStatsRows({
       ...meta,
@@ -75,13 +92,14 @@ describe("buildStatsRows", () => {
     const result = buildStatsRows({
       ...meta,
       measurements: [measurement({ gzipBytes: 440, brotliBytes: 300 })], // gzip +10%
+      // No brotliBytes: this point was cached before brotli logging landed.
       previous: [{ bundle: "embedding-sdk-chunked", kind: "total", rawBytes: 1000, gzipBytes: 400 }],
       threshold: 1,
     });
 
     expect(result.maxServedDeltaPercent).toBeCloseTo(10);
     expect(result.significant).toBe(true);
-    expect(result.rows[0]["Brotli bytes delta"]).toBe(""); // no base brotli to diff against
+    expect(result.rows[0]["Brotli bytes delta"]).toBeNull(); // no base brotli to diff against
     expect(result.rows[0]["Gzip delta %"]).toBeCloseTo(10);
   });
 });

.github/scripts/cache-keys.sh

@@ -0,0 +1,162 @@
+#!/usr/bin/env bash
+# Single definition of every CI dependency cache: what it holds, what identifies it, what it falls back to.
+#
+# A GitHub cache entry is identified by its key, a hash of the declared path list, and the ref that saved
+# it. A step declaring a different path list than the one a cache was saved with computes a different
+# identity and can never match it, whatever its key says. So paths and keys are emitted together here and
+# every cache step takes both from this script.
+#
+# Emits `name=value` lines in $GITHUB_OUTPUT format:
+#
+#   .github/scripts/cache-keys.sh >> "$GITHUB_OUTPUT"
+#
+# Run it with no redirect to see the whole scheme, or pass one name to print a single value:
+#
+#   .github/scripts/cache-keys.sh
+#   .github/scripts/cache-keys.sh m2-key
+#
+# Hashes are computed here rather than with GitHub's hashFiles() so that a local run and a CI run of the
+# same commit produce the same keys, and so that an empty match can fail loudly - a hashFiles() call that
+# matches nothing silently yields "", collapsing the key onto its own restore prefix and pointing every
+# dependency set at one entry.
+
+set -euo pipefail
+
+cd "$(git rev-parse --show-toplevel)"
+
+OS="${RUNNER_OS:-$(uname -s)}"
+[ "$OS" = "Darwin" ] && OS="macOS"
+
+sha256() {
+  if command -v sha256sum >/dev/null 2>&1; then
+    sha256sum | cut -d' ' -f1
+  else
+    shasum -a 256 | cut -d' ' -f1
+  fi
+}
+
+# Digest of a set of files: hash each one, then hash the concatenation, so the result depends on every
+# file's contents and on which files exist.
+digest() {
+  local f
+  if [ "$#" -eq 0 ]; then
+    echo "::error::cache-keys.sh: no files matched; refusing to emit a key that would collide across dependency sets" >&2
+    exit 1
+  fi
+  for f in "$@"; do
+    [ -f "$f" ] || { echo "::error::cache-keys.sh: $f does not exist" >&2; exit 1; }
+    sha256 < "$f"
+  done | sha256
+}
+
+shopt -s nullglob
+DEPS_FILES=(deps.edn
+            bin/lint-migrations-file/deps.edn
+            bin/load-namespaces/deps.edn
+            modules/drivers/deps.edn
+            modules/drivers/*/deps.edn)
+shopt -u nullglob
+
+DEPS_HASH="$(digest "${DEPS_FILES[@]}")"
+LOCK_HASH="$(digest bun.lock)"
+
+# The Cypress binary depends on the Cypress version alone, so keying it on the whole lockfile would
+# throw away a 200MB download every time any frontend dependency moved.
+#
+# Reading a version out of a lockfile with a regex is only safe while exactly one line matches. Insist
+# on that rather than taking the first of several: a second match means the format moved under us, and
+# picking one at random would key the binary under a version it is not.
+CYPRESS_VERSIONS="$(sed -n 's/.*"cypress": \["cypress@\([^"]*\)".*/\1/p' bun.lock)"
+CYPRESS_MATCHES="$(printf '%s\n' "$CYPRESS_VERSIONS" | grep -c . || true)"
+if [ "$CYPRESS_MATCHES" != "1" ]; then
+  echo "::error::cache-keys.sh: expected exactly one resolved cypress version in bun.lock, found $CYPRESS_MATCHES" >&2
+  exit 1
+fi
+CYPRESS_VERSION="$CYPRESS_VERSIONS"
+
+# The Clojure CLI version CI installs. It lives here rather than in prepare-backend so that the version
+# and the key that identifies its cache entry cannot drift apart.
+CLOJURE_VERSION="1.12.0.1488"
+
+# An incremental lint cache is only ever an accelerator, so it keys on the commit and always falls back
+# to the newest entry on the prefix. The exact key never pre-exists, which keeps the entry current.
+ESLINT_SHA="${GITHUB_SHA:-$(git rev-parse HEAD)}"
+
+emit_multiline() {
+  local name="$1"; shift
+  printf '%s<<CACHE_KEYS_EOF\n' "$name"
+  printf '%s\n' "$@"
+  printf 'CACHE_KEYS_EOF\n'
+}
+
+# Paths under the home directory are emitted absolute rather than as `~/...`. actions/cache would expand
+# a tilde, but a shell assigning one of these to a variable would not, and would go on to create a
+# directory named `~`. Paths inside the checkout stay relative; actions/cache resolves those against the
+# workspace.
+spec() {
+  emit_multiline m2-path "$HOME/.m2" "$HOME/.gitlibs" "$HOME/.deps.clj" 'bin/bb'
+  echo "m2-key=M2-$OS-$DEPS_HASH"
+  echo "m2-restore-key=M2-$OS-"
+
+  # Pinned rather than discovered via `bun pm cache` so that the path is known before bun is installed;
+  # prepare-frontend exports BUN_INSTALL_CACHE_DIR to match and fails if bun disagrees.
+  echo "bun-store-path=$HOME/.bun/install/cache"
+  echo "bun-store-key=bun-store-$OS-$LOCK_HASH"
+  echo "bun-store-restore-key=bun-store-$OS-"
+
+  # No restore-key: an entry from another version installs a working `clojure` of the wrong version, and
+  # the freshness check in prepare-backend - running the binary - would accept it.
+  #
+  # The installer bakes this prefix into the clj/clojure shims, so the tree only works when restored to
+  # the same absolute path it was built at; prepare-backend reinstalls when it is not.
+  echo "clojure-path=$HOME/.clojure-cli"
+  echo "clojure-key=clojure-cli-$OS-$CLOJURE_VERSION"
+  echo "clojure-version=$CLOJURE_VERSION"
+
+  echo "cypress-path=$HOME/.cache/Cypress"
+  echo "cypress-key=cypress-$OS-$CYPRESS_VERSION"
+  echo "cypress-restore-key=cypress-$OS-"
+
+  echo "eslint-path=.eslintcache"
+  echo "eslint-key=eslint-$OS-$ESLINT_SHA"
+  echo "eslint-restore-key=eslint-$OS-"
+}
+
+# Print one output's value, including the multiline form, and fail on a name that does not exist. A
+# caller that silently received "" would go on to build a key with a hole in it.
+query() {
+  local want="$1" line delim found=0 in_block=0
+  while IFS= read -r line; do
+    if [ "$in_block" = 1 ]; then
+      if [ "$line" = "$delim" ]; then
+        in_block=0
+      else
+        printf '%s\n' "$line"
+      fi
+      continue
+    fi
+    case "$line" in
+      "$want="*)
+        printf '%s\n' "${line#*=}"
+        found=1
+        ;;
+      "$want<<"*)
+        delim="${line#*<<}"
+        in_block=1
+        found=1
+        ;;
+    esac
+  done <<EOF
+$(spec)
+EOF
+  if [ "$found" = 0 ]; then
+    echo "::error::cache-keys.sh: no output named '$want'" >&2
+    exit 1
+  fi
+}
+
+if [ "$#" -eq 0 ]; then
+  spec
+else
+  query "$1"
+fi

.github/scripts/cache-keys.unit.spec.ts

@@ -0,0 +1,80 @@
+import { execFileSync } from "child_process";
+import { join } from "path";
+
+const SCRIPT = join(__dirname, "cache-keys.sh");
+
+const CACHES = ["m2", "bun-store", "cypress", "eslint"];
+
+// stderr is inherited by default, so the deliberate-failure case below would print a literal
+// `::error::` line - which GitHub Actions reads as an annotation directive, making a passing run
+// annotate itself with an error.
+const run = (args: string[] = [], env: NodeJS.ProcessEnv = {}, quiet = false) =>
+  execFileSync(SCRIPT, args, {
+    encoding: "utf8",
+    stdio: quiet ? ["ignore", "pipe", "ignore"] : "pipe",
+    env: { ...process.env, RUNNER_OS: "Linux", GITHUB_SHA: "abc123", ...env },
+  });
+
+const get = (name: string, env: NodeJS.ProcessEnv = {}) =>
+  run([name], env).trimEnd();
+
+describe("cache-keys.sh", () => {
+  it("is deterministic for a given tree", () => {
+    expect(run()).toEqual(run());
+  });
+
+  it("emits every cache's path, key and restore key", () => {
+    for (const cache of CACHES) {
+      expect(get(`${cache}-path`)).not.toEqual("");
+      expect(get(`${cache}-key`)).not.toEqual("");
+      expect(get(`${cache}-restore-key`)).not.toEqual("");
+    }
+  });
+
+  // Silently returning "" for a name that does not exist is how a caller ends up building a key with a
+  // hole in it.
+  it("fails on an unknown output name", () => {
+    expect(() => run(["no-such-output"], {}, true)).toThrow();
+  });
+
+  // A key equal to its own restore prefix points every dependency set at one entry, and nothing reports
+  // it. This is the failure the script exists to prevent.
+  it("never emits a key equal to its own restore prefix", () => {
+    for (const cache of CACHES) {
+      const key = get(`${cache}-key`);
+      const prefix = get(`${cache}-restore-key`);
+      expect(key.startsWith(prefix)).toBe(true);
+      expect(key.length).toBeGreaterThan(prefix.length);
+    }
+  });
+
+  it("scopes every key to the runner OS", () => {
+    for (const cache of CACHES) {
+      expect(get(`${cache}-key`, { RUNNER_OS: "Linux" })).not.toEqual(
+        get(`${cache}-key`, { RUNNER_OS: "macOS" }),
+      );
+    }
+  });
+
+  // Home paths must be absolute: actions/cache expands a tilde but a shell assigning one to a variable
+  // does not, and would create a directory literally named `~`.
+  it("emits absolute paths for home directory locations", () => {
+    expect(get("bun-store-path").startsWith("/")).toBe(true);
+    expect(get("cypress-path").startsWith("/")).toBe(true);
+    for (const line of get("m2-path").split("\n")) {
+      expect(line.startsWith("~")).toBe(false);
+    }
+  });
+
+  // The Cypress binary depends on the Cypress version alone, so an unrelated dependency bump must not
+  // invalidate a 200MB download.
+  it("keys the Cypress binary on the resolved version, not the lockfile", () => {
+    expect(get("cypress-key")).toMatch(/^cypress-Linux-\d+\.\d+\.\d+/);
+  });
+
+  it("keys the ESLint cache on the commit", () => {
+    expect(get("eslint-key", { GITHUB_SHA: "deadbeef" })).toEqual(
+      "eslint-Linux-deadbeef",
+    );
+  });
+});

.github/scripts/check-job-timeouts.sh

@@ -0,0 +1,71 @@
+#!/usr/bin/env bash
+# Fails when a job in .github/workflows/ does not set `timeout-minutes`.
+#
+# Without it a job inherits GitHub's 6-hour default, so a hung job burns six hours of runner time -
+# and holds up everything queued behind it - before anyone notices. actionlint cannot check this: its
+# rule set is compiled in and .github/actionlint.yaml only takes `self-hosted-runner`,
+# `config-variables`, and `paths` (which suppresses findings rather than adding them). Hence this
+# script.
+#
+# The rule is per job: a `timeout-minutes` on a step does not satisfy it, and steps are not required
+# to carry one of their own.
+#
+# Jobs that call a reusable workflow (`uses:` at the job level) are skipped - GitHub rejects
+# `timeout-minutes` there. The called workflow's own jobs are checked when it lives in this repo.
+#
+#   .github/scripts/check-job-timeouts.sh [workflow-file ...]
+#
+# With no arguments it checks every workflow; CI passes the files that changed, like actionlint does.
+
+set -euo pipefail
+
+# Arguments are used as given, so the paths in the annotations match what the caller passed. Without
+# them the full scan has to run from the repo root.
+if [ $# -gt 0 ]; then
+  workflows=("$@")
+else
+  cd "$(git rev-parse --show-toplevel)"
+
+  shopt -s nullglob
+  workflows=(.github/workflows/*.yml .github/workflows/*.yaml)
+
+  if [ ${#workflows[@]} -eq 0 ]; then
+    echo "::error::check-job-timeouts.sh: no workflow files found under .github/workflows/" >&2
+    exit 1
+  fi
+fi
+
+status=0
+
+for file in "${workflows[@]}"; do
+  # `awk NF` drops the blank line yq emits when a file has nothing to report.
+  missing="$(
+    # --header-preprocess=false: yq otherwise slurps any leading comment block before parsing, which
+    # shifts every line number it reports by the size of that block.
+    yq --header-preprocess=false '
+      .jobs
+      | to_entries
+      | .[]
+      | select(((.value | has("timeout-minutes")) or (.value | has("uses"))) | not)
+      | [(.key | line), .key]
+      | @tsv
+    ' "$file" | awk NF
+  )"
+
+  [ -n "$missing" ] || continue
+
+  while IFS=$'\t' read -r line job; do
+    echo "::error file=${file},line=${line}::Job \"${job}\" does not set a job-level timeout-minutes" >&2
+  done <<< "$missing"
+
+  status=1
+done
+
+if [ "$status" -ne 0 ]; then
+  echo >&2
+  echo "Every job must set an explicit timeout-minutes; without one it inherits GitHub's 6-hour default." >&2
+  echo "Pick a value with headroom over the job's normal runtime." >&2
+  exit 1
+fi
+
+echo "All jobs in the ${#workflows[@]} workflow file(s) checked set timeout-minutes."

.github/scripts/check-preresolve-aliases.sh

@@ -0,0 +1,109 @@
+#!/usr/bin/env bash
+# Fails when a Clojure classpath used by CI is not pre-resolved by cache-warm.
+#
+# tools.deps selects dependency versions globally per classpath, so two alias combinations can resolve
+# the same transitive library to different versions. A combination the warm job never resolved is
+# therefore not merely absent from the cache - the cache holds *a* version of those libraries, just not
+# the one this classpath wants, and the job fetches its delta straight from Maven Central on every run.
+# That is the intermittent-403 failure of DEV-2094, and it is invisible: the build still passes.
+#
+# Nothing about a missing combination shows up at runtime, so this check is the only thing standing
+# between a newly added alias combination and a permanently half-cold cache.
+#
+#   .github/scripts/check-preresolve-aliases.sh
+
+set -euo pipefail
+
+cd "$(git rev-parse --show-toplevel)"
+
+WARM=.github/workflows/cache-warm.yml
+
+# Invocations deliberately left out of the warm job. Each needs a reason, because the default answer is
+# to add the combination to the list instead.
+WAIVED="$(
+  cat <<'EOF'
+:deps
+:outdated
+EOF
+)"
+# :deps      - tools.deps built-in used by write-poms.sh; contributes no dependencies of its own.
+# :outdated  - scheduled dependency-bump workflow only; a cold resolve there costs nothing anyone waits on.
+
+# Dependency roots and alias combinations the warm job pre-resolves.
+declared="$({
+  sed -n '/^[[:space:]]*combos=(/,/^ *)/p' "$WARM" \
+    | grep -oE '":[^"]*"' \
+    | tr -d '"' \
+    | sed 's#^#.|#'
+  sed -n '/^[[:space:]]*nested_combos=(/,/^ *)/p' "$WARM" \
+    | grep -oE '"[^"]+\|:[^"]+"' \
+    | tr -d '"'
+} | sort -u)"
+if [ -z "$declared" ]; then
+  echo "::error::check-preresolve-aliases.sh: found no pre-resolved classpaths in $WARM" >&2
+  exit 1
+fi
+
+# Expressions we know how to expand. An unrecognised one has to stop the check rather than be skipped:
+# silently ignoring it is how a whole matrix of combinations would go unchecked.
+unknown="$(grep -rhoE '\$\{\{[^}]*\}\}' --include='*' \
+             --exclude='*.png' --exclude='*.jpg' .github/ 2>/dev/null \
+           | sort -u | grep -v 'edition' || true)"
+
+scan() { # scan <edition>: dependency root and aliases used by .github Clojure invocations
+  grep -rhE 'clojure[[:space:]]+(-P[[:space:]]+)?-[XMATP]?:' \
+       --include='*' --exclude='*.png' --exclude='*.jpg' .github/ 2>/dev/null \
+    | sed "s/\\\${{[^}]*edition[^}]*}}/$1/g" \
+    | grep -oE 'clojure[[:space:]]+(-P[[:space:]]+)?-[XMATP]?:[A-Za-z0-9:_./-]+' \
+    | grep -oE ':[A-Za-z0-9:_./-]+' \
+    | sed -e 's/:$//' -e 's#^#.|#'
+}
+
+scan_project_tests() { # scan_project_tests <function> <dependency-root>
+  # Mage shell commands are vectors split across lines, so flatten each function body before
+  # extracting its alias.
+  sed -n "/(defn- $1 /,/^(defn/p" mage/src/mage/project_tests.clj \
+    | tr '\n' ' ' \
+    | grep -oE '"clojure"[[:space:]]+("-P"[[:space:]]+)?"-[XMATP]?:[A-Za-z0-9:_./-]+' \
+    | grep -oE ':[A-Za-z0-9:_./-]+' \
+    | sed -e 's/:$//' -e "s#^#$2|#"
+}
+
+# Check each scan separately. One scan still finding commands would otherwise conceal that another has
+# stopped matching, which silently drops everything it used to cover.
+require_scan() { # require_scan <what> <result>
+  [ -n "$2" ] && return
+  echo "::error::check-preresolve-aliases.sh: found no Clojure invocation in $1; the scan pattern no longer matches" >&2
+  exit 1
+}
+workflow_checks=$( { scan ee; scan oss; } || true)
+clojure_checks=$(scan_project_tests run-clojure-checks! . || true)
+migration_checks=$(scan_project_tests run-migration-checks! bin/lint-migrations-file || true)
+require_scan ".github/" "$workflow_checks"
+require_scan "run-clojure-checks! (mage/src/mage/project_tests.clj)" "$clojure_checks"
+require_scan "run-migration-checks! (mage/src/mage/project_tests.clj)" "$migration_checks"
+
+scanned="$(printf '%s\n' "$workflow_checks" "$clojure_checks" "$migration_checks" | sort -u)"
+
+found="$( {
+  printf '%s\n' "$scanned"
+  # build-scripts.yml runs this classpath from its own dependency root.
+  printf '%s\n' 'bin/load-namespaces|:test'
+} | sort -u )"
+
+covered="$( {
+  printf '%s\n' "$declared"
+  printf '%s\n' "$WAIVED" | sed 's#^#.|#'
+} | sort -u)"
+missing="$(comm -23 <(printf '%s\n' "$found") <(printf '%s\n' "$covered") || true)"
+
+if [ -n "$missing" ]; then
+  echo "::error::Clojure classpaths used by CI that cache-warm does not pre-resolve:" >&2
+  printf '%s\n' "$missing" | sed 's/^/  /' >&2
+  echo >&2
+  echo "Add each to the matching root or nested combo list in $WARM, or waive it here with a reason." >&2
+  echo "Leaving it uncovered means those jobs re-fetch their version deltas from Maven on every run." >&2
+  exit 1
+fi
+
+echo "All $(printf '%s\n' "$found" | grep -c .) Clojure classpaths used by CI are pre-resolved."

.github/scripts/create-test-plan.ts

@@ -24,11 +24,17 @@ const STORY_GLOBS = [
   "enterprise/frontend/**/*.stories.{js,jsx,ts,tsx}",
 ];
 
+// `git ls-files -- frontend enterprise/frontend` already prints just over a
+// megabyte of paths, and node's default maxBuffer is exactly 1 MiB: past that
+// the spawn dies with ENOBUFS. Give the listings room to grow.
+const LS_FILES_MAX_BUFFER = 64 * 1024 * 1024;
+
 // Returns the tracked files under `roots` that match `globs`. The `dot: true`
 // option means files inside dot-directories such as `.storybook` are included.
 function listFiles(roots: string[], globs: string[]): string[] {
   const tracked = execFileSync("git", ["ls-files", "--", ...roots], {
     encoding: "utf8",
+    maxBuffer: LS_FILES_MAX_BUFFER,
   })
     .split("\n")
     .map((line) => line.trim())

.github/scripts/csv-to-mb.js

@@ -1,91 +0,0 @@
-/**
- * jsonData must be in the format:
- * [
- *   { column1: value1, column2: value2, ... },
- *   { column1: value3, column2: value4, ... },
- *   ...
- * ]
- */
-function jsonToCsvFormData(jsonData) {
-  const formData = new FormData();
-  const csvHeader = Object.keys(jsonData[0]).join(',') + '\n';
-  const csvContent = jsonData.map(row =>
-    Object.values(row).map(value => `"${String(value).replace(/"/g, '""')}"`).join(',')
-  ).join('\n');
-
-  const blob = new Blob([csvHeader + csvContent], { type: 'text/csv' });
-  formData.append('file', blob, 'data.csv');
-
-  return formData;
-}
-
-// Transient failures worth retrying: throttling and server-side errors. A 4xx
-// (bad request, auth) won't succeed on retry, so those fail fast.
-const RETRYABLE_STATUS = new Set([429, 500, 502, 503, 504]);
-
-class UploadError extends Error {
-  constructor(message, { retryable }) {
-    super(message);
-    this.retryable = retryable;
-  }
-}
-
-async function attemptUpload(url, jsonData, timeoutMs) {
-  let response;
-  try {
-    response = await fetch(url, {
-      method: 'POST',
-      headers: {
-        "x-api-key": process.env.API_KEY
-      },
-      // Rebuilt per attempt: a consumed request body can't be reused.
-      body: jsonToCsvFormData(jsonData),
-      // Without this the request can hang indefinitely on a stalled server,
-      // eating the whole job timeout. An abort surfaces below as a retryable
-      // network error, so it retries with backoff instead.
-      signal: AbortSignal.timeout(timeoutMs)
-    });
-  } catch (networkError) {
-    throw new UploadError(networkError.message, { retryable: true });
-  }
-
-  if (response.ok) {
-    return;
-  }
-
-  const body = await response.text().catch(() => '');
-  throw new UploadError(
-    `Upload failed: ${response.status} ${response.statusText} ${body}`.trim(),
-    { retryable: RETRYABLE_STATUS.has(response.status) }
-  );
-}
-
-const sleep = ms => new Promise(resolve => setTimeout(resolve, ms));
-
-/**
- * Uploads jsonData as CSV, retrying transient API errors with exponential
- * backoff. `retries` is the number of extra attempts after the first (so the
- * default 2 means up to 3 tries). `timeoutMs` is a per-attempt total deadline
- * (default 60s) that aborts a stalled request. Throws the last error once
- * attempts are exhausted or the error is non-retryable.
- */
-async function uploadCsvToMb({ baseUrl, tableId, jsonData, mode = 'append', retries = 2, retryDelayMs = 1000, timeoutMs = 60_000 }) {
-  const operation = mode === 'replace' ? 'replace-csv' : 'append-csv';
-  const url = `${baseUrl}/api/table/${tableId}/${operation}`;
-
-  for (let attempt = 0; ; attempt++) {
-    try {
-      await attemptUpload(url, jsonData, timeoutMs);
-      return { success: true };
-    } catch (error) {
-      if (!error.retryable || attempt >= retries) {
-        throw error;
-      }
-      const delay = retryDelayMs * 2 ** attempt;
-      console.warn(`Upload attempt ${attempt + 1} failed (${error.message}); retrying in ${delay}ms`);
-      await sleep(delay);
-    }
-  }
-}
-
-module.exports = { uploadCsvToMb };

.github/scripts/csv-to-mb.unit.spec.js

@@ -1,50 +0,0 @@
-const { uploadCsvToMb } = require("./csv-to-mb");
-
-const ok = () => ({ ok: true });
-const fail = status => ({ ok: false, status, statusText: "err", text: async () => "" });
-
-const upload = (over = {}) =>
-  uploadCsvToMb({
-    baseUrl: "https://stats.example.com",
-    tableId: 1,
-    jsonData: [{ a: 1 }],
-    retryDelayMs: 1,
-    ...over,
-  });
-
-describe("uploadCsvToMb retries", () => {
-  afterEach(() => {
-    delete global.fetch;
-  });
-
-  it("retries transient server errors then succeeds", async () => {
-    global.fetch = jest.fn().mockResolvedValueOnce(fail(503)).mockResolvedValueOnce(fail(500)).mockResolvedValueOnce(ok());
-
-    await expect(upload({ retries: 2 })).resolves.toEqual({ success: true });
-    expect(global.fetch).toHaveBeenCalledTimes(3);
-  });
-
-  it("retries network errors", async () => {
-    global.fetch = jest
-      .fn()
-      .mockRejectedValueOnce(new Error("ECONNRESET"))
-      .mockResolvedValueOnce(ok());
-
-    await expect(upload({ retries: 2 })).resolves.toEqual({ success: true });
-    expect(global.fetch).toHaveBeenCalledTimes(2);
-  });
-
-  it("gives up after exhausting retries and throws the last error", async () => {
-    global.fetch = jest.fn().mockResolvedValue(fail(500));
-
-    await expect(upload({ retries: 2 })).rejects.toThrow("Upload failed: 500");
-    expect(global.fetch).toHaveBeenCalledTimes(3); // 1 initial + 2 retries
-  });
-
-  it("does not retry a non-transient 4xx", async () => {
-    global.fetch = jest.fn().mockResolvedValue(fail(400));
-
-    await expect(upload({ retries: 2 })).rejects.toThrow("Upload failed: 400");
-    expect(global.fetch).toHaveBeenCalledTimes(1);
-  });
-});

.github/scripts/file-paths.unit.spec.ts

@@ -0,0 +1,66 @@
+import { readFileSync } from "fs";
+import { join } from "path";
+
+import { load } from "js-yaml";
+import { isMatch } from "micromatch";
+
+const FILTERS = join(__dirname, "..", "file-paths.yaml");
+
+type Filter = string | Filter[] | { [changeType: string]: Filter };
+
+// A filter is a list of patterns, and an entry may name the change types it applies to as
+// { "added|modified": pattern }. Either way the patterns are what matters here.
+const patterns = (value: Filter): string[] => {
+  if (typeof value === "string") return [value];
+  if (Array.isArray(value)) return value.flatMap(patterns);
+  return Object.values(value).flatMap(patterns);
+};
+
+describe("file-paths.yaml", () => {
+  const filters = load(readFileSync(FILTERS, "utf8")) as Record<string, Filter>;
+
+  // dorny/paths-filter matches with picomatch, which micromatch wraps, so this asks the same
+  // question CI asks of a changed path.
+  const matches = (name: string, path: string) =>
+    patterns(filters[name]).some((pattern) =>
+      isMatch(path, pattern, { dot: true }),
+    );
+
+  // dorny/paths-filter ORs the patterns in a filter, so a "!..." entry does not subtract from the
+  // other entries - it matches every path they don't, turning the filter permanently on. Excluding
+  // a path means writing the exclusion inside one pattern, the way backend_sources keeps
+  // ratchet files out with ".clj-kondo/**/!(ratchets.edn)".
+  it("never excludes a path with a standalone negation", () => {
+    const negated = Object.entries(filters).flatMap(([name, filter]) =>
+      patterns(filter)
+        .filter((pattern) => pattern.startsWith("!"))
+        .map((pattern) => `${name}: ${pattern}`),
+    );
+
+    expect(negated).toEqual([]);
+  });
+
+  it.each(["backend_sources", "backend_all"])(
+    "%s skips a ratchets-only change and still follows the rest of .clj-kondo",
+    (name) => {
+      expect(matches(name, ".clj-kondo/ratchets.edn")).toBe(false);
+      expect(
+        matches(name, ".clj-kondo/config/modules/ratchets.edn"),
+      ).toBe(false);
+      expect(matches(name, ".clj-kondo/config.edn")).toBe(true);
+      expect(matches(name, ".clj-kondo/config/modules/config.edn")).toBe(true);
+    },
+  );
+
+  it("runs the ratchet check on the ratchets file", () => {
+    expect(matches("project_ratchet_checks", ".clj-kondo/ratchets.edn")).toBe(
+      true,
+    );
+    expect(
+      matches(
+        "project_ratchet_checks",
+        ".clj-kondo/config/modules/ratchets.edn",
+      ),
+    ).toBe(true);
+  });
+});

.github/scripts/find-linear-issue.js

@@ -1,40 +0,0 @@
-async function findLinearIssue({ githubIssueUrl, linearApiKey }) {
-  const response = await fetch("https://api.linear.app/graphql", {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/json",
-      Authorization: linearApiKey,
-    },
-    body: JSON.stringify({
-      query: `
-        query {
-          attachmentsForURL(url: "${githubIssueUrl}") {
-            nodes {
-              issue { identifier }
-            }
-          }
-        }
-      `,
-    }),
-  });
-
-  const data = await response.json();
-
-  if (!response.ok) {
-    return { success: false, message: `Linear API error: ${response.status}` };
-  }
-
-  if (!data.data?.attachmentsForURL?.nodes?.length) {
-    return {
-      success: false,
-      message: `No Linear issue linked to ${githubIssueUrl}`,
-    };
-  }
-
-  return {
-    success: true,
-    issue: data.data.attachmentsForURL.nodes[0].issue.identifier,
-  };
-}
-
-module.exports = { findLinearIssue };

.github/scripts/linear-issues.js

@@ -0,0 +1,109 @@
+async function findLinearIssue({ githubIssueUrl, linearApiKey }) {
+  const response = await fetch("https://api.linear.app/graphql", {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: linearApiKey,
+    },
+    body: JSON.stringify({
+      query: `
+        query {
+          attachmentsForURL(url: "${githubIssueUrl}") {
+            nodes {
+              issue { identifier }
+            }
+          }
+        }
+      `,
+    }),
+  });
+
+  const data = await response.json();
+
+  if (!response.ok) {
+    return { success: false, message: `Linear API error: ${response.status}` };
+  }
+
+  if (!data.data?.attachmentsForURL?.nodes?.length) {
+    return {
+      success: false,
+      message: `No Linear issue linked to ${githubIssueUrl}`,
+    };
+  }
+
+  return {
+    success: true,
+    issue: data.data.attachmentsForURL.nodes[0].issue.identifier,
+  };
+}
+
+async function createLinearIssue({
+  teamId,
+  title,
+  description,
+  projectId,
+  labelIds,
+  linearApiKey,
+}) {
+  const response = await fetch("https://api.linear.app/graphql", {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: linearApiKey,
+    },
+    body: JSON.stringify({
+      query: `
+        mutation CreateIssue($input: IssueCreateInput!) {
+          issueCreate(input: $input) {
+            success
+            issue {
+              id
+              identifier
+              title
+              url
+            }
+          }
+        }
+      `,
+      variables: {
+        input: {
+          teamId,
+          title,
+          ...(description ? { description } : {}),
+          ...(projectId ? { projectId } : {}),
+          ...(labelIds?.length ? { labelIds } : {}),
+        },
+      },
+    }),
+  });
+
+  if (!response.ok) {
+    return { success: false, message: `Linear API error: ${response.status}` };
+  }
+
+  const data = await response.json();
+
+  if (data.errors?.length) {
+    return {
+      success: false,
+      message: `Linear API error: ${data.errors.map((e) => e.message).join(", ")}`,
+    };
+  }
+
+  if (!data.data?.issueCreate?.success) {
+    return {
+      success: false,
+      message: `Failed to create Linear issue "${title}"`,
+    };
+  }
+
+  return {
+    success: true,
+    issue: data.data.issueCreate.issue,
+  };
+}
+
+module.exports = {
+  findLinearIssue,
+  createLinearIssue,
+};

.github/scripts/run-backend-test-jvms.sh

@@ -0,0 +1,160 @@
+#!/usr/bin/env bash
+#
+# Run this runner's share of a partitioned backend test suite as one or more concurrent
+# JVMs. The caller says how many runners share the suite and how many JVMs each gets.
+#
+# WHY MULTIPLE JVMS PER RUNNER
+# ----------------------------
+# Driver tests spend most of their wall time waiting on the remote warehouse, and they
+# can't use the idle CPU by using more threads because some tests mutate global state.
+# A second JVM gets that isolation for free.
+#
+# Two paths are NOT safe to share:
+#   * `target/junit` — hawk deletes the whole directory at `:begin-test-run`, so a JVM
+#     starting late would wipe an earlier one's results.
+#   * `logs/test-log.json` — the log4j2 File appender truncates it on open.
+# So each JVM runs in its own hardlinked copy of the checkout (inodes, not disk) and
+# outputs are merged back into the workspace afterwards.
+#
+# INPUTS (environment)
+# --------------------
+#   CLOJURE_ALIASES        alias string for `clojure -X`, e.g. dev:ci:ee:ee-dev:drivers:drivers-dev:test
+#   TEST_RUNNER_INDEX      index of this runner among those sharing the suite
+#   TEST_RUNNER_COUNT      how many runners share the suite
+#   TEST_JVMS_PER_RUNNER   concurrent JVMs per runner (default 1)
+#   TEST_HEAP_PER_JVM      -Xmx per JVM, applied only when running more than one
+#
+# Exits non-zero if any JVM fails.
+
+set -uo pipefail
+
+: "${CLOJURE_ALIASES:?CLOJURE_ALIASES is required}"
+: "${TEST_RUNNER_INDEX:?TEST_RUNNER_INDEX is required}"
+: "${TEST_RUNNER_COUNT:?TEST_RUNNER_COUNT is required}"
+TEST_ARGS=("$@")
+TEST_JVMS_PER_RUNNER="${TEST_JVMS_PER_RUNNER:-1}"
+TEST_HEAP_PER_JVM="${TEST_HEAP_PER_JVM:-4g}"
+
+die() {
+  echo "::error::run-backend-test-jvms.sh: $1"
+  exit 1
+}
+
+[[ "$TEST_RUNNER_INDEX" =~ ^[0-9]+$ ]] || die "TEST_RUNNER_INDEX must be a non-negative integer, got '$TEST_RUNNER_INDEX'"
+[[ "$TEST_RUNNER_COUNT" =~ ^[0-9]+$ ]] || die "TEST_RUNNER_COUNT must be a positive integer, got '$TEST_RUNNER_COUNT'"
+[[ "$TEST_JVMS_PER_RUNNER" =~ ^[0-9]+$ ]] || die "TEST_JVMS_PER_RUNNER must be a positive integer, got '$TEST_JVMS_PER_RUNNER'"
+[ "$TEST_RUNNER_COUNT" -ge 1 ] || die "TEST_RUNNER_COUNT must be at least 1"
+[ "$TEST_JVMS_PER_RUNNER" -ge 1 ] || die "TEST_JVMS_PER_RUNNER must be at least 1"
+[ "$TEST_RUNNER_INDEX" -lt "$TEST_RUNNER_COUNT" ] ||
+  die "runner index $TEST_RUNNER_INDEX is out of range for $TEST_RUNNER_COUNT runner(s) — a matrix entry was added without raising runner-count"
+
+# Partition indexes are split across runners rather than handed out in contiguous
+# blocks. E.g. with 2 runners and 2 JVMs the first runner gets partition 0 and 2, and
+# the second runner gets partitions 1 and 3. Hawk partitions in namespace order, so
+# neighbouring partitions have similar runtimes — contiguous blocks would group the slow
+# ones together onto one runner.
+PARTITION_TOTAL=$((TEST_RUNNER_COUNT * TEST_JVMS_PER_RUNNER))
+INDEXES=()
+for ((k = 0; k < TEST_JVMS_PER_RUNNER; k++)); do
+  INDEXES+=($((TEST_RUNNER_INDEX + k * TEST_RUNNER_COUNT)))
+done
+
+# One JVM: run directly in the workspace with no heap override, exactly as a
+# partitioned run behaved before this script existed.
+if [ "$TEST_JVMS_PER_RUNNER" -eq 1 ]; then
+  echo "Running partition ${INDEXES[0]} of $PARTITION_TOTAL"
+  exec clojure -X:"$CLOJURE_ALIASES" "${TEST_ARGS[@]}" \
+    :partition/total "$PARTITION_TOTAL" \
+    :partition/index "${INDEXES[0]}"
+fi
+
+
+WORKSPACE="$PWD"
+# Sibling of the checkout: same filesystem (so `cp -al` can hardlink) but outside the
+# repo, so one JVM's directory never gets copied into another's.
+JVM_DIRS_ROOT="$(dirname "$WORKSPACE")/backend-test-jvms"
+STATUS_DIR="$JVM_DIRS_ROOT/status"
+
+# Merge every JVM's results into the workspace the rest of the job reads from.
+#
+# Each partition's junit XML goes into its own subdirectory: `mb_hawk_var_less_errors.xml`
+# has a fixed name, so a flat copy would silently overwrite it. Nesting is safe because
+# both consumers (dorny/test-reporter and ci-conductor's backend adapter) walk
+# `target/junit` recursively and match on filename suffix.
+#
+# Runs from an EXIT trap so a cancelled or timed-out job still publishes whatever
+# finished.
+# shellcheck disable=SC2329  # invoked by the EXIT trap below, which shellcheck can't see.
+merge_outputs() {
+  mkdir -p "$WORKSPACE/target/junit" "$WORKSPACE/logs"
+  local idx jvm_dir
+  for idx in "${INDEXES[@]}"; do
+    jvm_dir="$JVM_DIRS_ROOT/partition-$idx"
+    if [ -d "$jvm_dir/target/junit" ]; then
+      mkdir -p "$WORKSPACE/target/junit/p$idx"
+      cp -a "$jvm_dir/target/junit/." "$WORKSPACE/target/junit/p$idx/" || true
+    fi
+    # `logs/test-log*.json` is what the action uploads on failure.
+    if [ -f "$jvm_dir/logs/test-log.json" ]; then
+      cp -a "$jvm_dir/logs/test-log.json" "$WORKSPACE/logs/test-log-p$idx.json" || true
+    fi
+  done
+}
+trap merge_outputs EXIT
+trap 'exit 143' TERM
+trap 'exit 130' INT
+
+# Hardlinked copy of the checkout. Skips the paths a run writes to (`target`, `logs`, `.cpcache`)
+# and the two most expensive trees nothing on the test classpath reads (`.git`, `node_modules`).
+prepare_jvm_dir() {
+  local jvm_dir="$1" entry
+  rm -rf "$jvm_dir"
+  mkdir -p "$jvm_dir"
+  for entry in "$WORKSPACE"/* "$WORKSPACE"/.[!.]*; do
+    [ -e "$entry" ] || continue
+    case "$(basename "$entry")" in
+      .git | node_modules | target | logs | .cpcache) continue ;;
+    esac
+    # Fall back to a real copy if the filesystem refuses the hardlink.
+    cp -al "$entry" "$jvm_dir/" 2>/dev/null || cp -a "$entry" "$jvm_dir/"
+  done
+}
+
+# Prefix output with the partition index so interleaved JVM logs stay readable.
+run_partition() {
+  local idx="$1" jvm_dir="$2" rc line
+  (
+    cd "$jvm_dir" || exit 1
+    # `-J` options land after the aliases' `:jvm-opts`, overriding the `:ci` alias's
+    # `-Xms12g -Xmx12g`. Xms stays small so JVMs sharing a runner grow into memory on
+    # demand rather than each committing its ceiling up front.
+    exec clojure -J-Xms512m -J-Xmx"$TEST_HEAP_PER_JVM" -X:"$CLOJURE_ALIASES" \
+      "${TEST_ARGS[@]}" \
+      :partition/total "$PARTITION_TOTAL" \
+      :partition/index "$idx"
+  ) 2>&1 | while IFS= read -r line || [ -n "$line" ]; do printf '[p%s] %s\n' "$idx" "$line"; done
+  rc="${PIPESTATUS[0]}"
+  echo "$rc" > "$STATUS_DIR/p$idx"
+}
+
+rm -rf "$JVM_DIRS_ROOT"
+mkdir -p "$STATUS_DIR"
+
+echo "Runner $TEST_RUNNER_INDEX of $TEST_RUNNER_COUNT: running $TEST_JVMS_PER_RUNNER concurrent JVMs for partition(s) ${INDEXES[*]} of $PARTITION_TOTAL (-Xmx$TEST_HEAP_PER_JVM each)"
+
+for idx in "${INDEXES[@]}"; do
+  prepare_jvm_dir "$JVM_DIRS_ROOT/partition-$idx"
+done
+
+for idx in "${INDEXES[@]}"; do
+  run_partition "$idx" "$JVM_DIRS_ROOT/partition-$idx" &
+done
+wait
+
+overall=0
+for idx in "${INDEXES[@]}"; do
+  rc="$(cat "$STATUS_DIR/p$idx" 2>/dev/null || echo 1)"
+  echo "partition $idx exited $rc"
+  [ "$rc" -eq 0 ] || overall=1
+done
+exit "$overall"

.github/scripts/stats-import.ts

@@ -0,0 +1,140 @@
+// Pushes stats rows to eng-stats-importer, which writes them to Postgres.
+//
+// The importer's origin comes from ENG_STATS_URL and its key from API_KEY, both
+// repository secrets — this repo is public, so neither is hardcoded here. Visit
+// the importer to see the tables and mint keys.
+
+// Transient failures worth retrying: throttling and server-side errors. A 4xx
+// (bad request, auth, unknown table) won't succeed on retry, so those fail fast.
+const RETRYABLE_STATUS = new Set([429, 500, 502, 503, 504]);
+
+/**
+ * One row, keyed by column. Values are `unknown` rather than a scalar union
+ * because a `json` column takes arbitrary nested data.
+ */
+export type StatsRow = Record<string, unknown>;
+
+export interface ImportStatsOptions {
+  /** Table name as it appears in `/api/import/{table}`, e.g. `emotion_files`. */
+  table: string;
+  rows: StatsRow[];
+  /** Importer origin. Defaults to ENG_STATS_URL. */
+  baseUrl?: string;
+  /** Extra attempts after the first, so the default 2 means up to 3 tries. */
+  retries?: number;
+  retryDelayMs?: number;
+  /** Per-attempt total deadline; aborts a stalled request. */
+  timeoutMs?: number;
+}
+
+export interface ImportStatsResult {
+  success: true;
+  inserted?: number;
+  /** Payload keys with no matching column, when `ignoreUnknown` is in play. */
+  ignoredKeys?: string[];
+}
+
+class ImportError extends Error {
+  retryable: boolean;
+
+  constructor(message: string, { retryable }: { retryable: boolean }) {
+    super(message);
+    this.retryable = retryable;
+  }
+}
+
+async function attemptImport(
+  url: string,
+  rows: StatsRow[],
+  timeoutMs: number,
+): Promise<ImportStatsResult> {
+  let response: Response;
+  try {
+    response = await fetch(url, {
+      method: "PUT",
+      headers: {
+        "x-api-key": process.env.API_KEY ?? "",
+        "content-type": "application/json",
+      },
+      body: JSON.stringify(rows),
+      // Without this the request can hang indefinitely on a stalled server,
+      // eating the whole job timeout. An abort surfaces below as a retryable
+      // network error, so it retries with backoff instead.
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+  } catch (networkError) {
+    const message =
+      networkError instanceof Error ? networkError.message : String(networkError);
+    throw new ImportError(message, { retryable: true });
+  }
+
+  if (!response.ok) {
+    // Failures carry an `{ error }` body naming the offending row and column,
+    // which is the only way to tell a type mismatch from a typo'd key.
+    const body = await response.text().catch(() => "");
+    throw new ImportError(
+      `Import failed: ${response.status} ${response.statusText} ${body}`.trim(),
+      { retryable: RETRYABLE_STATUS.has(response.status) },
+    );
+  }
+
+  // Best-effort: the row count is for logging, so a body that doesn't parse
+  // shouldn't turn a successful import into a failure.
+  const result = (await response.json().catch(() => ({}))) as {
+    inserted?: number;
+    ignoredKeys?: string[];
+  };
+  return { success: true, inserted: result.inserted, ignoredKeys: result.ignoredKeys };
+}
+
+const sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));
+
+/**
+ * Imports `rows` into the `table` table, retrying transient API errors with
+ * exponential backoff.
+ *
+ * Keys are matched leniently against the table's columns -- `Emotion Files`,
+ * `emotionFiles` and `emotion_files` all land in `emotion_files` -- but values
+ * are matched strictly, and a key matching no column is an error rather than a
+ * silent drop. Rows are appended; the importer has no replace mode.
+ *
+ * Throws the last error once attempts are exhausted or the error is
+ * non-retryable.
+ */
+export async function importStats({
+  table,
+  rows,
+  baseUrl = process.env.ENG_STATS_URL,
+  retries = 2,
+  retryDelayMs = 1000,
+  timeoutMs = 60_000,
+}: ImportStatsOptions): Promise<ImportStatsResult> {
+  // The importer accepts an empty payload, but there's no point spending a
+  // request (and a rate-limit slot) to insert nothing.
+  if (rows.length === 0) {
+    return { success: true, inserted: 0 };
+  }
+
+  if (!baseUrl) {
+    throw new Error("ENG_STATS_URL is not set, so there is no importer to push to");
+  }
+
+  // Tolerate a trailing slash: the origin comes from a hand-entered secret.
+  const url = `${baseUrl.replace(/\/+$/, "")}/api/import/${table}`;
+
+  for (let attempt = 0; ; attempt++) {
+    try {
+      return await attemptImport(url, rows, timeoutMs);
+    } catch (error) {
+      const importError = error as ImportError;
+      if (!importError.retryable || attempt >= retries) {
+        throw error;
+      }
+      const delay = retryDelayMs * 2 ** attempt;
+      console.warn(
+        `Import attempt ${attempt + 1} failed (${importError.message}); retrying in ${delay}ms`,
+      );
+      await sleep(delay);
+    }
+  }
+}

.github/scripts/stats-import.unit.spec.ts

@@ -0,0 +1,160 @@
+import { importStats } from "./stats-import";
+
+const ok = (body: unknown = { inserted: 1 }) => ({ ok: true, json: async () => body });
+const fail = (status: number) => ({
+  ok: false,
+  status,
+  statusText: "err",
+  text: async () => "",
+});
+
+const load = (over: Record<string, unknown> = {}) =>
+  importStats({
+    baseUrl: "https://stats.example.com",
+    table: "emotion_files",
+    rows: [{ a: 1 }],
+    retryDelayMs: 1,
+    ...over,
+  });
+
+describe("importStats requests", () => {
+  afterEach(() => {
+    // @ts-expect-error -- removing the stub the tests installed
+    delete global.fetch;
+    delete process.env.API_KEY;
+    delete process.env.ENG_STATS_URL;
+  });
+
+  it("defaults the origin to ENG_STATS_URL", async () => {
+    const fetchMock = jest.fn().mockResolvedValue(ok());
+    global.fetch = fetchMock;
+    process.env.ENG_STATS_URL = "https://importer.example.com";
+
+    await load({ baseUrl: undefined });
+
+    expect(fetchMock.mock.calls[0][0]).toBe(
+      "https://importer.example.com/api/import/emotion_files",
+    );
+  });
+
+  it("tolerates a trailing slash on the origin", async () => {
+    const fetchMock = jest.fn().mockResolvedValue(ok());
+    global.fetch = fetchMock;
+
+    await load({ baseUrl: "https://importer.example.com/" });
+
+    expect(fetchMock.mock.calls[0][0]).toBe(
+      "https://importer.example.com/api/import/emotion_files",
+    );
+  });
+
+  it("fails loudly when no origin is configured", async () => {
+    const fetchMock = jest.fn();
+    global.fetch = fetchMock;
+
+    await expect(load({ baseUrl: undefined })).rejects.toThrow("ENG_STATS_URL is not set");
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it("PUTs the rows as JSON to the table's import endpoint", async () => {
+    const fetchMock = jest.fn().mockResolvedValue(ok());
+    global.fetch = fetchMock;
+    process.env.API_KEY = "secret";
+
+    await expect(load({ rows: [{ a: 1 }, { a: 2 }] })).resolves.toEqual({
+      success: true,
+      inserted: 1,
+      ignoredKeys: undefined,
+    });
+
+    const [url, options] = fetchMock.mock.calls[0];
+    expect(url).toBe("https://stats.example.com/api/import/emotion_files");
+    expect(options.method).toBe("PUT");
+    expect(options.headers).toMatchObject({
+      "x-api-key": "secret",
+      "content-type": "application/json",
+    });
+    expect(JSON.parse(options.body)).toEqual([{ a: 1 }, { a: 2 }]);
+  });
+
+  it("skips the request entirely when there are no rows", async () => {
+    const fetchMock = jest.fn();
+    global.fetch = fetchMock;
+
+    await expect(load({ rows: [] })).resolves.toEqual({ success: true, inserted: 0 });
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it("succeeds even if the response body does not parse", async () => {
+    global.fetch = jest.fn().mockResolvedValue({
+      ok: true,
+      json: async () => {
+        throw new Error("not json");
+      },
+    });
+
+    await expect(load()).resolves.toMatchObject({ success: true });
+  });
+});
+
+describe("importStats retries", () => {
+  afterEach(() => {
+    // @ts-expect-error -- removing the stub the tests installed
+    delete global.fetch;
+  });
+
+  it("retries transient server errors then succeeds", async () => {
+    const fetchMock = jest
+      .fn()
+      .mockResolvedValueOnce(fail(503))
+      .mockResolvedValueOnce(fail(500))
+      .mockResolvedValueOnce(ok());
+    global.fetch = fetchMock;
+
+    await expect(load({ retries: 2 })).resolves.toMatchObject({ success: true });
+    expect(fetchMock).toHaveBeenCalledTimes(3);
+  });
+
+  it("retries throttling", async () => {
+    const fetchMock = jest.fn().mockResolvedValueOnce(fail(429)).mockResolvedValueOnce(ok());
+    global.fetch = fetchMock;
+
+    await expect(load({ retries: 2 })).resolves.toMatchObject({ success: true });
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+  });
+
+  it("retries network errors", async () => {
+    const fetchMock = jest
+      .fn()
+      .mockRejectedValueOnce(new Error("ECONNRESET"))
+      .mockResolvedValueOnce(ok());
+    global.fetch = fetchMock;
+
+    await expect(load({ retries: 2 })).resolves.toMatchObject({ success: true });
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+  });
+
+  it("gives up after exhausting retries and throws the last error", async () => {
+    const fetchMock = jest.fn().mockResolvedValue(fail(500));
+    global.fetch = fetchMock;
+
+    await expect(load({ retries: 2 })).rejects.toThrow("Import failed: 500");
+    expect(fetchMock).toHaveBeenCalledTimes(3); // 1 initial + 2 retries
+  });
+
+  it("does not retry a non-transient 4xx", async () => {
+    const fetchMock = jest.fn().mockResolvedValue(fail(400));
+    global.fetch = fetchMock;
+
+    await expect(load({ retries: 2 })).rejects.toThrow("Import failed: 400");
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+  });
+
+  it("does not retry an unknown table", async () => {
+    const fetchMock = jest.fn().mockResolvedValue(fail(404));
+    global.fetch = fetchMock;
+
+    await expect(load({ retries: 2 })).rejects.toThrow("Import failed: 404");
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+  });
+});

.github/scripts/upload-affected-tests-stats.ts

@@ -1,11 +1,11 @@
 // Appends the test-plan stats row produced by create-test-plan.ts to the
-// "FE Affected Tests" table on stats.metabase.com.
-// Reads STATS_JSON, TRIGGERED_BY, PR_NUMBER, HEAD_SHA, BASE_SHA, API_KEY from env.
+// "FE Affected Tests" table in eng-stats-importer.
+// Reads STATS_JSON, PR_NUMBER, HEAD_SHA, BASE_SHA, API_KEY from env.
 
-const { uploadCsvToMb } = require("./csv-to-mb.js");
+import type { TestPlanStats } from "./affected-tests";
+import { importStats } from "./stats-import";
 
-// "FE Affected Tests" uploaded table on stats.metabase.com.
-const TABLE_ID = 81818;
+const TABLE = "fe_affected_tests";
 
 async function main() {
   // create-test-plan doesn't always produce stats (e.g. on release branches
@@ -16,13 +16,13 @@ async function main() {
     return;
   }
 
-  const s = JSON.parse(raw);
+  const s = JSON.parse(raw) as TestPlanStats;
   console.log("stats", s);
 
   const row = {
     Date: new Date().toISOString(),
-    // "pr_update" or "merge_to_master". ("Trigger" is a reserved SQL word.)
-    "Triggered By": process.env.TRIGGERED_BY,
+    // ("Trigger" is a reserved SQL word.)
+    "Triggered By": "pr_update",
     PR: Number(process.env.PR_NUMBER),
     "Head SHA": process.env.HEAD_SHA,
     "Base SHA": process.env.BASE_SHA,
@@ -43,17 +43,15 @@ async function main() {
     "Loki Stories All": s.loki_stories_all,
     "Loki Stories To Run (Rules)": s.loki_stories_to_run_rules,
     "Loki Stories To Run (Usage)": s.loki_stories_to_run_usage,
-    "E2E Specs All": s.e2e_specs_all,
-    "E2E Specs To Run (Rules)": s.e2e_specs_to_run_rules,
-    "E2E Specs To Run (Usage)": s.e2e_specs_to_run_usage,
+    // Spelled as the column name rather than a display name: the importer
+    // splits a digit-then-capital run, so "E2E Specs All" would normalize to
+    // `e2_e_specs_all` instead of `e2e_specs_all`.
+    e2e_specs_all: s.e2e_specs_all,
+    e2e_specs_to_run_rules: s.e2e_specs_to_run_rules,
+    e2e_specs_to_run_usage: s.e2e_specs_to_run_usage,
   };
 
-  await uploadCsvToMb({
-    baseUrl: "https://stats.metabase.com",
-    tableId: TABLE_ID,
-    jsonData: [row],
-    mode: "append",
-  });
+  await importStats({ table: TABLE, rows: [row] });
   console.log("Data uploaded successfully");
 }
 

.github/scripts/upload-bundle-load-stats.ts

@@ -0,0 +1,97 @@
+// Appends the measured load times to the "Bundle Load Times" table in
+// eng-stats-importer. Reads ROWS (the JSON matrix.js prints) and API_KEY from
+// env, and stamps each row with the commit it came from.
+
+import { readFileSync } from "node:fs";
+
+import { importStats } from "./stats-import";
+
+/** One condition, as `frontend/test/bench/matrix.ts` reports it. */
+interface Condition {
+  network: string;
+  networkMbps: number;
+  latencyMs: number;
+  cpu: string;
+  cpuThrottle: number;
+  coldMs: number;
+  warmMs: number;
+  steadyMs: number;
+  coldSpreadPercent: number;
+  coldTtfbMs: number;
+  coldFirstPaintMs: number;
+  coldAppMountedMs: number;
+  coldLargestPaintMs: number;
+  coldPageReadyMs: number;
+  warmPageReadyMs: number;
+  scripts: number;
+  scriptKb: number;
+  runs: number;
+}
+
+interface CommitStamp {
+  sha: string;
+  subject: string;
+}
+
+type LoadTimeRow = Record<string, string | number>;
+
+function buildRows(
+  conditions: Condition[],
+  { sha, subject }: CommitStamp,
+): LoadTimeRow[] {
+  return conditions.map((condition) => ({
+    Date: new Date().toISOString().slice(0, 10),
+    // Truncated the same way the bundle-size table does, so the two join.
+    Commit: sha.slice(0, 12),
+    // The stats table carries a free-text Description column. Populate it with
+    // the commit subject so the chart's points are self-describing.
+    Description: subject.split("\n")[0],
+    Network: condition.network,
+    "Network mbps": condition.networkMbps,
+    "Latency ms": condition.latencyMs,
+    CPU: condition.cpu,
+    "CPU throttle": condition.cpuThrottle,
+    "Cold ms": condition.coldMs,
+    "Warm ms": condition.warmMs,
+    "Steady ms": condition.steadyMs,
+    "Cold spread %": condition.coldSpreadPercent,
+    // The cold load broken up. A zero means the browser or the route never
+    // reported that one, rather than that it happened at time zero.
+    "Cold ttfb ms": condition.coldTtfbMs,
+    "Cold first paint ms": condition.coldFirstPaintMs,
+    "Cold app mounted ms": condition.coldAppMountedMs,
+    "Cold largest paint ms": condition.coldLargestPaintMs,
+    "Cold page ready ms": condition.coldPageReadyMs,
+    "Warm page ready ms": condition.warmPageReadyMs,
+    Scripts: condition.scripts,
+    "Script kb": condition.scriptKb,
+    Runs: condition.runs,
+  }));
+}
+
+async function main() {
+  const path = process.env.ROWS || "artifacts/load-times.json";
+  // matrix.js wrote this file, and Condition is the shape it prints.
+  const conditions = JSON.parse(readFileSync(path, "utf8")) as Condition[];
+
+  const rows = buildRows(conditions, {
+    sha: process.env.HEAD_SHA || "",
+    subject: process.env.COMMIT_MESSAGE || "",
+  });
+
+  console.table(rows);
+
+  try {
+    await importStats({ table: "bundle_load_times", rows });
+    console.log("Load times uploaded successfully");
+  } catch (error) {
+    // Stats logging is best-effort. A point lost to an unreachable importer is
+    // worth less than a red build on master, and the next commit plots another.
+    const message = error instanceof Error ? error.message : String(error);
+    console.log(
+      `::warning::Load-time upload failed after retries; leaving run green: ${message}`,
+    );
+  }
+}
+
+main();

.github/scripts/upload-bundle-size-stats.ts

@@ -0,0 +1,38 @@
+// Appends the measured bundle sizes (with deltas) to the "Bundle Sizes" table
+// in eng-stats-importer. Reads ROWS (a JSON file of rows) and API_KEY from env,
+// and reports whether the import landed via the `uploaded` step output.
+
+import { appendFileSync, readFileSync } from "node:fs";
+
+import { importStats, type StatsRow } from "./stats-import";
+
+/** `core.setOutput` without the github-script runtime. */
+function setOutput(name: string, value: string) {
+  const file = process.env.GITHUB_OUTPUT;
+  if (file) {
+    appendFileSync(file, `${name}=${value}\n`);
+  }
+}
+
+async function main() {
+  const rowsPath = process.env.ROWS || "artifacts/upload-rows.json";
+  const rows = JSON.parse(readFileSync(rowsPath, "utf8")) as StatsRow[];
+
+  console.table(rows);
+
+  try {
+    await importStats({ table: "bundle_sizes", rows });
+    console.log("Bundle sizes uploaded successfully");
+    setOutput("uploaded", "true");
+  } catch (error) {
+    // Stats logging is best-effort: if the importer is still unreachable after
+    // the client's retries, keep the run green. The last-plotted cache is only
+    // saved on a successful upload, so this point is re-attempted on the next
+    // master build and nothing is silently dropped.
+    const message = error instanceof Error ? error.message : String(error);
+    console.log(`::warning::Bundle-size upload failed after retries; leaving run green: ${message}`);
+    setOutput("uploaded", "false");
+  }
+}
+
+main();

.github/scripts/upload-emotion-stats.ts

@@ -0,0 +1,25 @@
+// Appends the weekly @emotion/* importer count to the "Emotion Files" table in
+// eng-stats-importer. Reads EMOTION_FILES and API_KEY from env.
+
+import { importStats } from "./stats-import";
+
+async function main() {
+  console.log("EMOTION_FILES", Number(process.env.EMOTION_FILES));
+
+  // Keys must match the target table's columns (the importer normalizes both
+  // sides, so casing/spacing is forgiving).
+  const rows = [
+    {
+      Date: new Date().toISOString().slice(0, 10), // YYYY-MM-DD
+      "Emotion Files": Number(process.env.EMOTION_FILES),
+    },
+  ];
+
+  await importStats({ table: "emotion_stats", rows });
+  console.log("Data uploaded successfully");
+}
+
+main().catch((error) => {
+  console.error("Error uploading data:", error);
+  process.exit(1);
+});

.github/scripts/upload-module-boundaries-stats.ts

@@ -0,0 +1,30 @@
+// Appends the weekly module-boundary counts to the "Module Boundaries" table in
+// eng-stats-importer. Reads NAMED_MODULES, ENFORCED_MODULES, UNMODULED,
+// VIOLATIONS and API_KEY from env.
+
+import { importStats } from "./stats-import";
+
+async function main() {
+  console.log("NAMED_MODULES", Number(process.env.NAMED_MODULES));
+  console.log("ENFORCED_MODULES", Number(process.env.ENFORCED_MODULES));
+  console.log("UNMODULED", Number(process.env.UNMODULED));
+  console.log("VIOLATIONS", Number(process.env.VIOLATIONS));
+
+  const rows = [
+    {
+      Date: new Date().toISOString().slice(0, 10), // YYYY-MM-DD
+      Modules: Number(process.env.NAMED_MODULES),
+      "Enforced modules": Number(process.env.ENFORCED_MODULES),
+      "Unmoduled folders": Number(process.env.UNMODULED),
+      Violations: Number(process.env.VIOLATIONS),
+    },
+  ];
+
+  await importStats({ table: "module_boundaries", rows });
+  console.log("Data uploaded successfully");
+}
+
+main().catch((error) => {
+  console.error("Error uploading data:", error);
+  process.exit(1);
+});

.github/team.json

@@ -56,17 +56,15 @@
       "label": ".Team/Metabot",
       "members": [
         "appleby",
-        "noahmoss",
         "retro",
         "sloansparger",
-        "somtom",
         "tsplude",
         "lbrdnk",
-        "piranha",
         "crisptrutski",
         "undrfined",
         "andreis",
-        "prascuna"
+        "prascuna",
+        "krever"
       ]
     },
     {
@@ -113,7 +111,10 @@
         "uladzimirdev",
         "egorgrushin",
         "metatyb",
-        "olehk-mb"
+        "olehk-mb",
+        "annatomka",
+        "brybacki",
+        "BillyBobFry"
       ]
     },
     {

.github/workflows/ai-benchmark.yml

@@ -1,5 +1,5 @@
 name: AI Benchmark
-run-name: "dispatch evals · ${{ github.event_name == 'pull_request' && format('smoke PR#{0}', github.event.pull_request.number) || (inputs.pr != '' && format('PR#{0}', inputs.pr) || (inputs.ref != '' && inputs.ref || 'master')) }}"
+run-name: "Evals · ${{ github.event_name == 'pull_request' && github.event.label.name || format('manual · {0}', inputs.scope) }} · ${{ github.event.pull_request.number || inputs.pr || inputs.ref || github.sha }}"
 
 on:
   pull_request:
@@ -11,14 +11,23 @@ on:
         required: false
         default: ""
       ref:
-        description: "Metabase ref"
+        description: "Metabase branch, tag or sha (resolved to a full sha; overrides the PR head, and must sit on the PR's branch when both are given)"
         required: false
         default: ""
       scope:
         description: "Scope"
         required: true
         type: choice
-        options: [smoke, full, "all (EXPENSIVE)"]
+        options:
+          - smoke
+          - full
+          - embarrassing-plain
+          - embarrassing-human
+          - embarrassing-all
+          - goldens-plain
+          - goldens-human
+          - goldens-all
+          - "all (EXPENSIVE)"
         default: smoke
       sample:
         description: "Sample (0 = full suite)"
@@ -29,99 +38,202 @@ on:
         default: main
 
 concurrency:
-  group: evals-dispatch-${{ (github.event.label.name == 'evals/smoke' && github.event.pull_request.number) || github.run_id }}
+  group: evals-dispatch-${{ github.event_name == 'pull_request' && format('{0}-{1}', github.event.pull_request.number, github.event.label.name) || github.run_id }}
   cancel-in-progress: true
 
 jobs:
-  unsupported:
+  prepare:
     if: >-
-      github.event_name == 'pull_request'
-      && github.event.label.name == 'evals/smoke'
-      && github.event.pull_request.head.repo.full_name != github.repository
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+      (github.event_name == 'pull_request'
+        && github.event.pull_request.head.repo.full_name == github.repository
+        && startsWith(github.event.label.name, 'evals:'))
+      || github.event_name == 'workflow_dispatch'
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
     timeout-minutes: 5
+    outputs:
+      pr: ${{ steps.prepare.outputs.pr }}
+      ref: ${{ steps.prepare.outputs.ref }}
+      scope: ${{ steps.prepare.outputs.scope }}
+      sample: ${{ steps.prepare.outputs.sample }}
+      label: ${{ steps.prepare.outputs.label }}
+      evals_branch: ${{ steps.prepare.outputs.evals_branch }}
     steps:
-      - run: |
-          echo "::error::evals/smoke only runs on same-repo PRs; this PR's head is on a fork"
-          exit 1
+      - name: Prepare
+        id: prepare
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          LABEL_PR: ${{ github.event.pull_request.number }}
+          LABEL: ${{ github.event.label.name }}
+          INPUT_PR: ${{ inputs.pr }}
+          INPUT_REF: ${{ inputs.ref }}
+          INPUT_SCOPE: ${{ inputs.scope }}
+          INPUT_SAMPLE: ${{ inputs.sample }}
+          INPUT_EVALS_BRANCH: ${{ inputs.evals_branch }}
+        run: |
+          set -euo pipefail
+          # The two paths are mutually exclusive, and `on:` admits no other trigger.
+          if [[ "$EVENT_NAME" == 'pull_request' ]]; then
+            SCOPE="${LABEL#evals:}"
+            case "$SCOPE" in
+              embarrassing-plain|embarrassing-human|embarrassing-all|goldens-plain|goldens-human|goldens-all)
+                SAMPLE='0' ;;
+              smoke|full)
+                SAMPLE='5' ;;
+              *)
+                echo "::error::'${LABEL}' is not a known evals trigger label; add its scope here and to the workflow's \`scope\` options, or remove the label"
+                exit 1 ;;
+            esac
+            PR="$LABEL_PR"; REF=''; EVALS_BRANCH='main'
+          else
+            PR="$INPUT_PR"; REF="$INPUT_REF"; SCOPE="$INPUT_SCOPE"
+            SAMPLE="${INPUT_SAMPLE:-5}"; EVALS_BRANCH="$INPUT_EVALS_BRANCH"
+            LABEL=''   # nothing to consume: a manual dispatch was not triggered by a label
+          fi
+          # None of these is ever multi-line; a newline would forge extra output entries.
+          for v in PR REF SCOPE SAMPLE LABEL EVALS_BRANCH; do
+            if [[ "${!v}" == *$'\n'* ]]; then
+              echo "::error::${v} must be a single line"
+              exit 1
+            fi
+          done
+          {
+            echo "pr=$PR"
+            echo "ref=$REF"
+            echo "scope=$SCOPE"
+            echo "sample=$SAMPLE"
+            echo "label=$LABEL"
+            echo "evals_branch=$EVALS_BRANCH"
+          } >> "$GITHUB_OUTPUT"
 
   announce:
-    if: >-
-      github.event_name == 'pull_request'
-      && github.event.label.name == 'evals/smoke'
-      && github.event.pull_request.head.repo.full_name == github.repository
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    needs: prepare
+    if: github.event_name == 'pull_request'
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
     timeout-minutes: 5
     outputs:
       comment_id: ${{ steps.post.outputs.comment_id }}
     steps:
       - name: Comment (building)
         id: post
+        env:
+          SCOPE: ${{ needs.prepare.outputs.scope }}
         uses: actions/github-script@v9
         with:
           github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
           script: |
             const runUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
-            const body = `🤖 **Evals smoke** — ⏳ building the image… ([logs](${runUrl}))`;
+            const prefix = `🤖 **Evals (${process.env.SCOPE})**`;
+            const body = `${prefix} — ⏳ building the image… ([logs](${runUrl}))`;
             const { owner, repo } = context.repo;
             const issue_number = context.payload.pull_request.number;
-            // Drop earlier verdicts first: they describe shas that are no longer head, and a stale
-            // green one reads as this PR passing. The prefix survives eval-run's rewrites.
+            // Drop this scope's earlier verdicts first: they describe shas that are no longer head,
+            // and a stale green one reads as this PR passing. Only this scope's, though — a sibling
+            // scope's comment is a live report on a run still going.
             const existing = await github.paginate(github.rest.issues.listComments, { owner, repo, issue_number });
-            for (const c of existing.filter(c => c.body.startsWith('🤖 **Evals'))) {
+            // The second form is what the single `evals/smoke` trigger wrote before the labels were
+            // split per scope; nothing writes it any more, so this clause is only here to tidy PRs
+            // that predate the split and can go once none are open.
+            const stale = c => c.body.startsWith(prefix) || c.body.startsWith('🤖 **Evals smoke**');
+            for (const c of existing.filter(stale)) {
               await github.rest.issues.deleteComment({ owner, repo, comment_id: c.id }).catch(() => {});
             }
             const { data } = await github.rest.issues.createComment({ owner, repo, issue_number, body });
             core.setOutput('comment_id', String(data.id));
 
-  uberjar:
-    needs: [announce]
-    if: >-
-      github.event_name == 'pull_request'
-      && github.event.label.name == 'evals/smoke'
-      && github.event.pull_request.head.repo.full_name == github.repository
-    uses: ./.github/workflows/uberjar.yml
-    secrets: inherit
-
-  smoke:
-    needs: [announce, uberjar]
-    if: >-
-      github.event_name == 'pull_request'
-      && github.event.label.name == 'evals/smoke'
-      && github.event.pull_request.head.repo.full_name == github.repository
+  resolve:
+    needs: prepare
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 5
-    env:
-      COMMENT_ID: ${{ needs.announce.outputs.comment_id }}
+    permissions:
+      contents: read
+      pull-requests: read
+    outputs:
+      sha: ${{ steps.sha.outputs.sha }}
     steps:
-      - name: Dispatch smoke eval-run
+      - name: Resolve pr/ref to a full commit sha
+        id: sha
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR: ${{ needs.prepare.outputs.pr }}
+          REF: ${{ needs.prepare.outputs.ref }}
+          DEFAULT_SHA: ${{ github.sha }}
+        run: |
+          set -euo pipefail
+          # `ref` wins over `pr`, matching evals' eval-run.yml, which this dispatches into — same two
+          # inputs with opposite precedence in chained workflows would be a trap. eval-run also
+          # rejects a ref that doesn't sit on the PR's branch; that check stays there rather than
+          # being duplicated here.
+          if [[ -n "$REF" ]]; then
+            # `ref` accepts a branch or tag; fetch-artifact and the image tag need a full sha.
+            SHA=$(gh api "repos/${GITHUB_REPOSITORY}/commits/${REF}" --jq .sha)
+            echo "ref ${REF} -> ${SHA}"
+          elif [[ -n "$PR" ]]; then
+            SHA=$(gh api "repos/${GITHUB_REPOSITORY}/pulls/${PR}" --jq .head.sha)
+            echo "PR #${PR} head -> ${SHA}"
+          else
+            SHA="$DEFAULT_SHA"
+            echo "neither pr nor ref given; using this run's commit -> ${SHA}"
+          fi
+          if [[ ! "$SHA" =~ ^[0-9a-f]{40}$ ]]; then
+            echo "::error::could not resolve a full commit sha (got '${SHA}')"
+            exit 1
+          fi
+          echo "sha=${SHA}" >> "$GITHUB_OUTPUT"
+
+  image:
+    needs: resolve
+    uses: ./.github/workflows/build-private-ee-docker-image.yml
+    secrets:
+      PR_ENV_IAM_ROLE: ${{ secrets.PR_ENV_IAM_ROLE }}
+      PR_ENV_AWS_ACCOUNT_ID: ${{ secrets.PR_ENV_AWS_ACCOUNT_ID }}
+    with:
+      commit: ${{ needs.resolve.outputs.sha }}
+
+  dispatch:
+    needs: [prepare, announce, resolve, image]
+    if: >-
+      !cancelled()
+      && needs.prepare.result == 'success'
+      && (needs.announce.result == 'success' || needs.announce.result == 'skipped')
+      && needs.resolve.result == 'success'
+      && needs.image.result == 'success'
+    timeout-minutes: 5
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
+    steps:
+      - name: Dispatch eval-run
         env:
           GH_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
-          PR: ${{ github.event.pull_request.number }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-          EVALS_BRANCH: main
+          EVALS_BRANCH: ${{ needs.prepare.outputs.evals_branch }}
+          PR: ${{ needs.prepare.outputs.pr }}
+          SHA: ${{ needs.resolve.outputs.sha }}
+          SCOPE: ${{ needs.prepare.outputs.scope }}
+          SAMPLE: ${{ needs.prepare.outputs.sample }}
+          LABEL: ${{ needs.prepare.outputs.label }}
+          COMMENT_ID: ${{ needs.announce.outputs.comment_id }}
         run: |
+          # `label` is the one eval-run consumes once it has taken the run over; empty on a manual
+          # dispatch, where there is nothing to consume.
           gh api repos/metabase/evals/actions/workflows/eval-run.yml/dispatches \
             -f ref="$EVALS_BRANCH" \
             -f "inputs[pr]=$PR" \
-            -f "inputs[ref]=$HEAD_SHA" \
-            -f "inputs[scope]=smoke" \
+            -f "inputs[ref]=$SHA" \
+            -f "inputs[scope]=$SCOPE" \
             -f "inputs[surfaces]=all" \
-            -f "inputs[sample]=5" \
+            -f "inputs[sample]=$SAMPLE" \
+            -f "inputs[label]=$LABEL" \
             -f "inputs[evals_branch]=$EVALS_BRANCH" \
             -f "inputs[comment_id]=$COMMENT_ID"
 
   finalize:
-    # If the build or dispatch fell over, eval-run never took over the comment — leave a
-    # failure verdict instead of a comment stuck at "building the image…".
-    needs: [announce, uberjar, smoke]
-    if: always() && needs.announce.result == 'success' && needs.smoke.result != 'success'
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    needs: [prepare, announce, resolve, image, dispatch]
+    if: always() && needs.announce.result == 'success' && needs.dispatch.result != 'success'
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
     timeout-minutes: 5
     env:
       COMMENT_ID: ${{ needs.announce.outputs.comment_id }}
-      SMOKE_RESULT: ${{ needs.smoke.result }}
-      UBERJAR_RESULT: ${{ needs.uberjar.result }}
+      SCOPE: ${{ needs.prepare.outputs.scope }}
+      LABEL: ${{ needs.prepare.outputs.label }}
+      NEEDS_JSON: ${{ toJSON(needs) }}
     steps:
       - name: Comment (build/dispatch failed)
         uses: actions/github-script@v9
@@ -129,11 +241,12 @@ jobs:
           github-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
           script: |
             const runUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
-            // A concurrency-cancelled retrigger lands here too; don't stamp it as an infra failure.
-            const cancelled = [process.env.SMOKE_RESULT, process.env.UBERJAR_RESULT].includes('cancelled');
+            const cancelled = Object.values(JSON.parse(process.env.NEEDS_JSON))
+              .some(j => j.result === 'cancelled');
+            const prefix = `🤖 **Evals (${process.env.SCOPE})**`;
             const body = cancelled
-              ? `🤖 **Evals smoke** — ⚪ cancelled before evals started ([logs](${runUrl}))`
-              : `🤖 **Evals smoke** — ❌ build or dispatch failed before evals started ([logs](${runUrl}))`;
+              ? `${prefix} — ⚪ cancelled before evals started ([logs](${runUrl}))`
+              : `${prefix} — ❌ build or dispatch failed before evals started ([logs](${runUrl}))`;
             // The replacement run deletes this comment on its way in, so a concurrency cancel can
             // land here with nothing to patch. Losing the stamp is fine; failing the job isn't.
             await github.rest.issues.updateComment({
@@ -146,27 +259,5 @@ jobs:
             await github.rest.issues.removeLabel({
               owner: context.repo.owner, repo: context.repo.repo,
               issue_number: context.payload.pull_request.number,
-              name: 'evals/smoke',
+              name: process.env.LABEL,
             }).catch(() => {});
-
-  dispatch:
-    if: github.event_name == 'workflow_dispatch'
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 5
-    steps:
-      - name: Dispatch eval-run
-        env:
-          GH_TOKEN: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
-          EVALS_BRANCH: ${{ github.event.inputs.evals_branch }}
-          PR: ${{ inputs.pr }}
-          REF: ${{ inputs.ref }}
-          SCOPE: ${{ inputs.scope }}
-          SAMPLE: ${{ inputs.sample }}
-        run: |
-          gh api repos/metabase/evals/actions/workflows/eval-run.yml/dispatches \
-            -f ref="$EVALS_BRANCH" \
-            -f "inputs[pr]=$PR" \
-            -f "inputs[ref]=$REF" \
-            -f "inputs[scope]=$SCOPE" \
-            -f "inputs[sample]=${SAMPLE:-5}" \
-            -f "inputs[evals_branch]=$EVALS_BRANCH"

.github/workflows/app-db.yml

@@ -6,6 +6,34 @@ on:
       skip:
         type: boolean
         default: false
+      force-run:
+        description: Run the full suite regardless of the diff (master / release branches).
+        type: boolean
+        default: false
+
+  # Run one app-DB job on demand, against the ref you dispatch on, optionally under a profiler.
+  # Everything else about the job -- services, matrix legs, test args, quarantine gating -- is
+  # whatever the normal CI run uses, because it is the same job.
+  workflow_dispatch:
+    inputs:
+      app-db:
+        description: 'Which app-DB job to run. Only this one runs; the others are skipped.'
+        type: choice
+        required: true
+        options:
+          - mariadb
+          - mysql
+          - postgres
+      tests:
+        description: 'Optional: run only these tests, comma- or space-separated, e.g. metabase.db.custom-migrations-test/some-test. Bare namespaces work too. Blank runs the job''s usual set.'
+        type: string
+        required: false
+        default: ''
+      profile:
+        description: 'Profile the test run and attach a flamegraph to the job. Adds sampling overhead.'
+        type: boolean
+        required: false
+        default: false
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}-app-db
@@ -15,28 +43,105 @@ concurrency:
 # ci-conductor (secrets: inherit is already set on the app-db call in
 # run-tests.yml). See DEV-2224.
 env:
-  CI_CONDUCTOR_BASE_URL: ${{ secrets.CI_CONDUCTOR_BASE_URL }}
+  CI_CONDUCTOR_BASE_URL: ${{ vars.CI_CONDUCTOR_BASE_URL }}
   CI_CONDUCTOR_WEBHOOK_SECRET: ${{ secrets.CI_CONDUCTOR_WEBHOOK_SECRET }}
+  # Both read by the test-driver action, which is what actually runs the tests. Set here rather than
+  # passed as inputs to each job so that turning either on is one line, not one line per job.
+  # Empty (and so off) on workflow_call, where neither input exists.
+  #
+  # ONLY_TESTS replaces the job's own test selection, so every matrix leg of the chosen job runs the
+  # whole list -- each app DB has three.
+  PROFILE_TESTS: ${{ inputs.profile }}
+  ONLY_TESTS: ${{ inputs.tests }}
 
 jobs:
-  be-tests-mariadb:
+  app-db-matrix:
     if: ${{ !inputs.skip }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 5
+    name: Determine app DB versions
+    outputs:
+      mariadb: ${{ steps.versions.outputs.mariadb }}
+      mysql: ${{ steps.versions.outputs.mysql }}
+      postgres: ${{ steps.versions.outputs.postgres }}
+    steps:
+      - name: Select versions to test
+        id: versions
+        uses: actions/github-script@v9
+        env:
+          RUN_ALL: ${{ inputs.force-run }}
+        with:
+          script: | # js
+            const runAll = process.env.RUN_ALL === 'true';
+
+            const versions = {
+              mariadb: [
+                {
+                  name: 'MariaDB 10.6',
+                  image: 'metabase/mariadb:10.6',
+                  'junit-name': 'be-tests-mariadb-10-6-ee',
+                  env: { 'enable-ssl-tests': 'false' },
+                  latest: false
+                },
+                {
+                  name: 'MariaDB Latest',
+                  image: 'mariadb:latest',
+                  'junit-name': 'be-tests-mariadb-latest-ee',
+                  env: { 'enable-ssl-tests': 'false' },
+                  latest: true
+                },
+              ],
+              mysql: [
+                {
+                  name: 'MySQL 8.0',
+                  image: 'mysql:8.0',
+                  'junit-name': 'be-tests-mysql-8-0-ee',
+                  env: { 'enable-ssl-tests': 'false', 'enable-aws-iam-tests': 'false' },
+                  latest: false
+                },
+                {
+                  name: 'MySQL 9',
+                  image: 'mysql:9',
+                  'junit-name': 'be-tests-mysql-9-ee',
+                  env: { 'enable-ssl-tests': 'true', 'enable-aws-iam-tests': 'true' },
+                  // treating 9.0 as latest until we introduce mysql 26+ support
+                  latest: true
+                },
+              ],
+              postgres: [
+                {
+                  name: 'Postgres 14.x',
+                  'junit-name': 'be-tests-postgres-ee',
+                  image: 'postgres:14-alpine',
+                  env: { 'enable-ssl-tests': 'false', 'enable-aws-iam-tests': 'false' },
+                  latest: false,
+                },
+                {
+                  name: 'Postgres Latest',
+                  'junit-name': 'be-tests-postgres-latest-ee',
+                  image: 'postgres:latest',
+                  env: { 'enable-ssl-tests': 'true', 'enable-aws-iam-tests': 'true' },
+                  latest: true,
+                },
+              ],
+            };
+
+
+            for (const [db, dbVersions] of Object.entries(versions)) {
+              const selected = runAll ? dbVersions : dbVersions.filter((version) => version.latest);
+              core.info(`${db}: ${selected.map((version) => version.name).join(', ')}`);
+              core.setOutput(db, JSON.stringify(selected));
+            }
+
+  be-tests-mariadb:
+    needs: app-db-matrix
+    if: ${{ !inputs.skip && (inputs.app-db == '' || inputs.app-db == 'mariadb') }}
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
-        version:
-          - name: MariaDB 10.6
-            junit-name: be-tests-mariadb-10-6-ee
-            image: metabase/mariadb:10.6 # https://github.com/metabase/metabase-mariadb-docker-image
-            env:
-              enable-ssl-tests: 'false'
-          - name: MariaDB Latest
-            junit-name: be-tests-mariadb-latest-ee
-            image: mariadb:latest
-            env:
-              enable-ssl-tests: 'false'
+        version: ${{ fromJSON(needs.app-db-matrix.outputs.mariadb) }}
         job:
           - name: Enterprise Tests
             build-static-viz: false
@@ -70,21 +175,9 @@ jobs:
           MARIADB_ALLOW_EMPTY_ROOT_PASSWORD: true
           MARIADB_DATABASE: mb_test
     env:
-      # Only run old migrations tests on pushes to master or release branches. All other branches should skip tests
-      # with the tag `mb/old-migrations-test`. `__ADDITIONAL_EXCLUDED_TAG__` is not used anywhere outside of splicing
-      # it in to the command below.
-      __ADDITIONAL_EXCLUDED_TAG__: >-
-        ${{
-          (
-            github.event_name == 'push' &&
-            (
-              github.ref_name == 'master' ||
-              startsWith(github.ref_name, 'release-x')
-            ) &&
-            ''
-          ) ||
-          ':mb/old-migrations-test'
-        }}
+      # __ADDITIONAL_EXCLUDED_TAG__: ${{ !inputs.force-run && ':mb/old-migrations-test' || '' }}
+      # GDGT-3126: re-enable and properly fix old migrations tests
+      __ADDITIONAL_EXCLUDED_TAG__: ':mb/old-migrations-test'
       # actual serious env vars below
       CI: 'true'
       DRIVERS: mysql
@@ -124,37 +217,16 @@ jobs:
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[ ${{ matrix.job.exclude-tag }} ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
-          quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
 
   be-tests-mysql:
-    if: ${{ !inputs.skip }}
+    needs: app-db-matrix
+    if: ${{ !inputs.skip && (inputs.app-db == '' || inputs.app-db == 'mysql') }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
-        version:
-          - name: MySQL 8.0
-            junit-name: be-tests-mysql-8-0-ee
-            image: mysql:8.0
-            env:
-              enable-ssl-tests: 'false'
-              enable-aws-iam-tests: 'false'
-          - name: MySQL 9
-            junit-name: be-tests-mysql-9-ee
-            image: mysql:9
-            env:
-              enable-ssl-tests: 'true'
-              enable-aws-iam-tests: 'true'
-          # `mysql:latest` now resolves to MySQL 26.x, which fails in a way that floods the log
-          # until the runner cancels the job. A cancelled job can't be soft-failed with
-          # continue-on-error, so the leg is disabled until 26.x is supported.
-          # - name: MySQL Latest
-          #   junit-name: be-tests-mysql-latest-ee
-          #   image: mysql:latest
-          #   env:
-          #     enable-ssl-tests: 'false'
-          #     enable-aws-iam-tests: 'false'
+        version: ${{ fromJSON(needs.app-db-matrix.outputs.mysql) }}
         job:
           - name: Enterprise Tests
             build-static-viz: false
@@ -188,21 +260,9 @@ jobs:
           MYSQL_ALLOW_EMPTY_PASSWORD: true
           MYSQL_DATABASE: mb_test
     env:
-      # Only run old migrations tests on pushes to master or release branches. All other branches should skip tests
-      # with the tag `mb/old-migrations-test`. `__ADDITIONAL_EXCLUDED_TAG__` is not used anywhere outside of splicing
-      # it in to the command below.
-      __ADDITIONAL_EXCLUDED_TAG__: >-
-        ${{
-          (
-            github.event_name == 'push' &&
-            (
-              github.ref_name == 'master' ||
-              startsWith(github.ref_name, 'release-x')
-            ) &&
-            ''
-          ) ||
-          ':mb/old-migrations-test'
-        }}
+      # __ADDITIONAL_EXCLUDED_TAG__: ${{ !inputs.force-run && ':mb/old-migrations-test' || '' }}
+      # GDGT-3126: re-enable and properly fix old migrations tests
+      __ADDITIONAL_EXCLUDED_TAG__: ':mb/old-migrations-test'
       # actual serious env vars below
       CI: 'true'
       DRIVERS: mysql
@@ -250,28 +310,16 @@ jobs:
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[ ${{ matrix.job.exclude-tag }} ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
-          quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
 
   be-tests-postgres:
-    if: ${{ !inputs.skip }}
+    needs: app-db-matrix
+    if: ${{ !inputs.skip && (inputs.app-db == '' || inputs.app-db == 'postgres') }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
-        version:
-          - name: Postgres 14.x
-            junit-name: postgres-ee
-            docker-image: postgres:14-alpine
-            env:
-              enable-ssl-tests: 'false'
-              enable-aws-iam-tests: 'false'
-          - name: Postgres Latest
-            junit-name: postgres-latest-ee
-            docker-image: postgres:latest
-            env:
-              enable-ssl-tests: 'true'
-              enable-aws-iam-tests: 'true'
+        version: ${{ fromJSON(needs.app-db-matrix.outputs.postgres) }}
         job:
           - name: Enterprise Tests
             build-static-viz: false
@@ -282,7 +330,6 @@ jobs:
             build-static-viz: true
             test-args: >-
               :only '"test"'
-              :exclude-tags [:mb/driver-tests]
               :partition/total 2
               :partition/index 0
             exclude-tag: ':mb/driver-tests :mb/transforms-python-test'
@@ -295,21 +342,9 @@ jobs:
             exclude-tag: ':mb/driver-tests :mb/transforms-python-test'
     name: "${{ matrix.version.name }} ${{ matrix.job.name }}"
     env:
-      # Only run old migrations tests on pushes to master or release branches. All other branches should skip tests
-      # with the tag `mb/old-migrations-test`. `__ADDITIONAL_EXCLUDED_TAG__` is not used anywhere outside of splicing
-      # it in to the command below.
-      __ADDITIONAL_EXCLUDED_TAG__: >-
-        ${{
-          (
-            github.event_name == 'push' &&
-            (
-              github.ref_name == 'master' ||
-              startsWith(github.ref_name, 'release-x')
-            ) &&
-            ''
-          ) ||
-          ':mb/old-migrations-test'
-        }}
+      # __ADDITIONAL_EXCLUDED_TAG__: ${{ !inputs.force-run && ':mb/old-migrations-test' || '' }}
+      # GDGT-3126: re-enable and properly fix old migrations tests
+      __ADDITIONAL_EXCLUDED_TAG__: ':mb/old-migrations-test'
       # actual serious env vars below
       CI: 'true'
       DRIVERS: postgres
@@ -332,7 +367,7 @@ jobs:
       AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_AURORA_IAM_SECRET_ACCESS_KEY }}
     services:
       postgres:
-        image: ${{ matrix.version.docker-image }}
+        image: ${{ matrix.version.image }}
         ports:
           - "5432:5432"
         env:
@@ -346,19 +381,19 @@ jobs:
         uses: ./.github/actions/test-driver
         with:
           build-static-viz: ${{ matrix.job.build-static-viz }}
-          junit-name: 'be-tests-${{ matrix.version.junit-name }}'
+          junit-name: ${{ matrix.version.junit-name }}
           artifact-suffix: ${{ matrix.job.name }}
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[ ${{ matrix.job.exclude-tag }} ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
-          quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
 
   app-db-tests-result:
     needs:
+      - app-db-matrix
       - be-tests-mariadb
       - be-tests-mysql
       - be-tests-postgres
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
     timeout-minutes: 5
     name: app-db-tests-result
     if: always() && !cancelled()

.github/workflows/auto-assign.yml

@@ -7,7 +7,8 @@ on:
 
 jobs:
   update_pr:
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
+    timeout-minutes: 5
 
     steps:
       - uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a # v2.1.0

.github/workflows/backend-cloverage.yml

@@ -17,7 +17,8 @@ on:
 
 jobs:
   setup-oss:
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
+    timeout-minutes: 5
     outputs:
       modules: ${{ steps.get-modules.outputs.modules }}
     steps:
@@ -64,7 +65,8 @@ jobs:
           flags: back-end
 
   setup-ee:
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
+    timeout-minutes: 5
     outputs:
       modules: ${{ steps.get-modules.outputs.modules }}
     steps:

.github/workflows/backend.yml

@@ -6,6 +6,38 @@ on:
       skip:
         type: boolean
         default: false
+      force-run:
+        description: Run the full suite regardless of the diff (master / release branches).
+        type: boolean
+        default: false
+      run-project-backend-checks:
+        description: Run project-level backend checks.
+        type: boolean
+        default: false
+      run-project-migration-checks:
+        description: Run project-level migration checks.
+        type: boolean
+        default: false
+      run-project-ratchet-checks:
+        description: Run the ratchet check for a diff that touches nothing but the ratchets file.
+        type: boolean
+        default: false
+
+  # Run the backend test suite on demand, against the ref you dispatch on, optionally under a
+  # profiler. Everything else about the jobs -- matrix legs, tag filters, quarantine gating -- is
+  # whatever the normal CI run uses, because they are the same jobs.
+  workflow_dispatch:
+    inputs:
+      tests:
+        description: 'Optional: run only these tests, comma- or space-separated, e.g. metabase.query-processor-test/some-test. Bare namespaces work too. Blank runs each leg''s usual set.'
+        type: string
+        required: false
+        default: ''
+      profile:
+        description: 'Profile the test run and attach a flamegraph to the job. Adds sampling overhead.'
+        type: boolean
+        required: false
+        default: false
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}-backend
@@ -15,10 +47,106 @@ concurrency:
 # (secrets: inherit is already set on the backend call in run-tests.yml).
 # See DEV-2224.
 env:
-  CI_CONDUCTOR_BASE_URL: ${{ secrets.CI_CONDUCTOR_BASE_URL }}
+  CI_CONDUCTOR_BASE_URL: ${{ vars.CI_CONDUCTOR_BASE_URL }}
   CI_CONDUCTOR_WEBHOOK_SECRET: ${{ secrets.CI_CONDUCTOR_WEBHOOK_SECRET }}
+  # Both read by the be-tests run step below. Set here rather than passed per job so that turning
+  # either on is one line. Empty (and so off) on workflow_call, where neither input exists.
+  #
+  # ONLY_TESTS replaces the leg's own test selection, so every matrix leg runs the whole list: the
+  # partition args no longer apply, and legs that hold none of the named tests run nothing.
+  PROFILE_TESTS: ${{ inputs.profile }}
+  ONLY_TESTS: ${{ inputs.tests }}
 
 jobs:
+  project-checks:
+    name: 'Project tests: Suites'
+    if: >-
+      ${{ inputs.force-run ||
+      inputs.run-project-backend-checks ||
+      inputs.run-project-migration-checks ||
+      inputs.run-project-ratchet-checks }}
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v6
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+      # Bootstrap the shared Mage runtime before concurrent commands try to install it themselves.
+      - name: Prepare Mage
+        run: ./bin/mage
+      - parallel:
+        - name: Run backend checks
+          if: ${{ inputs.force-run || inputs.run-project-backend-checks }}
+          run: ./bin/mage project-tests backend
+        - name: Run migration checks
+          if: ${{ inputs.force-run || inputs.run-project-migration-checks }}
+          run: ./bin/mage project-tests migrations
+        # Babashka, not a JVM test run, so it is cheap enough to run alongside the backend checks.
+        # It still needs the JDK prepare-backend installs, to resolve clj-kondo on a cold cache.
+        - name: Run ratchet checks
+          if: ${{ inputs.force-run || inputs.run-project-backend-checks || inputs.run-project-ratchet-checks }}
+          run: ./bin/mage kondo-ratchets
+
+  project-tests:
+    name: Project tests
+    needs: project-checks
+    if: ${{ always() && !cancelled() }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
+    timeout-minutes: 5
+    steps:
+      - name: Check Project tests status
+        uses: actions/github-script@v9
+        env:
+          needs: ${{ toJson(needs) }}
+        with:
+          script: | # js
+            const needs = JSON.parse(process.env.needs);
+            const jobs = Object.entries(needs).map(
+              ([jobName, jobValues]) => ({
+                name: jobName,
+                result: jobValues.result
+              }));
+
+            if (jobs.every(job => job.result === 'skipped' || job.result === 'success')) {
+              console.log('');
+              console.log('          |>>>             |>>>             |>>>');
+              console.log('          |                |                |');
+              console.log('      _  _|_  _        _  _|_  _        _  _|_  _');
+              console.log('     | |_| |_| |______| |_| |_| |______| |_| |_| |');
+              console.log('     |         |      |         |      |         |');
+              console.log('     | []   [] |      | []   [] |      | []   [] |');
+              console.log('     |         |______|         |______|         |');
+              console.log('     |                    ___                    |');
+              console.log('     |___________________|   |___________________|');
+              console.log('                         |___|');
+              console.log('');
+              console.log('Everything is up to code and structurally sound.');
+              process.exit(0);
+            }
+
+            console.log('');
+            console.log('              .-===========-.____');
+            console.log('             /_______________\\   \\____');
+            console.log('            |  .-----------.  |        \\___');
+            console.log('            |  |  x     x  |  |            \\__');
+            console.log('            |  |     ~     |  |              _\\_');
+            console.log("            |  `-----------'  |             /___\\");
+            console.log('            |    o     o      |');
+            console.log("            `-----------------'");
+            console.log('              /=============\\');
+            console.log('             / O O O O O O O \\');
+            console.log('             \\_______________/');
+            console.log('');
+            console.log('One or more project checks are off the blueprint. Hard hats required.');
+
+            jobs.forEach((job) => {
+              if (job.result !== 'success' && job.result !== 'skipped') {
+                console.log(`${job.name} - ${job.result}`);
+              }
+            });
+
+            process.exit(1);
+
   be-linter-clj-kondo:
     if: ${{ !inputs.skip }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
@@ -45,7 +173,7 @@ jobs:
 
   be-linter-eastwood-test:
     # Master / release safety net: lint every backend test namespace.
-    if: ${{ !inputs.skip && github.event_name == 'push' && (github.ref_name == 'master' || startsWith(github.ref_name, 'release-x')) }}
+    if: ${{ !inputs.skip && inputs.force-run }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 45
     name: Eastwood (tests only)
@@ -53,12 +181,12 @@ jobs:
       - uses: actions/checkout@v6
       - name: Prepare back-end environment
         uses: ./.github/actions/prepare-backend
-      - run: clojure -X:dev:ee:ee-dev:drivers:drivers-dev:test:eastwood/test
+      - run: clojure -X:dev:dev/test:ee:ee-dev:drivers:drivers-dev:test:eastwood/test
         name: Run Eastwood linter on our backend tests
 
   be-linter-eastwood-test-changed:
-    # PR / merge queue: lint only the test namespaces touched by the diff.
-    if: ${{ !inputs.skip && (github.event_name == 'pull_request' || github.event_name == 'merge_group') }}
+    # Lint only the test namespaces touched by the diff.
+    if: ${{ !inputs.skip && !inputs.force-run && github.event_name == 'pull_request' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 15
     name: Eastwood (changed tests only)
@@ -72,8 +200,8 @@ jobs:
       - name: Compute changed test namespaces
         id: changed
         env:
-          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.event.merge_group.head_sha || github.sha }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
         run: |
           set -euo pipefail
 
@@ -81,13 +209,14 @@ jobs:
           # last synced don't widen our scope. Falls back to BASE_SHA if older than fetched depth.
           git fetch --no-tags --depth=200 origin "$BASE_SHA"
           DIFF_BASE=$(git merge-base "$BASE_SHA" "$HEAD_SHA" 2>/dev/null || echo "$BASE_SHA")
-          # Test roots we lint: core, EE, and each driver module's test tree.
+          # Test roots we lint: core, EE, dev/test, and each driver module's test tree.
           # :eastwood/test derives matching :source-paths from the classpath, so any
           # namespace we name here is reachable. Include renames (R) so a test that
           # was just renamed still gets linted under its new name.
           FILES=$(git diff --name-only --diff-filter=AMR "$DIFF_BASE" "$HEAD_SHA" \
                     -- 'test/**/*.clj' 'test/**/*.cljc' \
                        'enterprise/backend/test/**/*.clj' 'enterprise/backend/test/**/*.cljc' \
+                       'dev/test/**/*.clj' 'dev/test/**/*.cljc' \
                        'modules/drivers/**/test/**/*.clj' 'modules/drivers/**/test/**/*.cljc')
 
           if [ -z "$FILES" ]; then
@@ -103,7 +232,14 @@ jobs:
             exit 1
           fi
 
-          NS=$(sed -E 's#^(test/|enterprise/backend/test/|modules/drivers/[^/]+/test/)##; s#\.cljc?$##; s#/#.#g; s#_#-#g' <<<"$FILES" \
+          # Convert each test path to a Clojure namespace: strip its known test root and
+          # extension, then translate path separators and underscores. Keep these roots
+          # aligned with FILES above and the Eastwood classpath aliases below.
+          NS=$(sed -E \
+                 -e 's#^(test/|enterprise/backend/test/|dev/test/|modules/drivers/[^/]+/test/)##' \
+                 -e 's#\.cljc?$##' \
+                 -e 's#/#.#g' \
+                 -e 's#_#-#g' <<<"$FILES" \
                  | sort -u \
                  | paste -sd' ' -)
           echo "Changed test namespaces: $NS"
@@ -112,7 +248,7 @@ jobs:
         if: steps.changed.outputs.namespaces != ''
         env:
           NAMESPACES: ${{ steps.changed.outputs.namespaces }}
-        run: clojure -X:dev:ee:ee-dev:drivers:drivers-dev:test:eastwood/test :namespaces "[$NAMESPACES]"
+        run: clojure -X:dev:dev/test:ee:ee-dev:drivers:drivers-dev:test:eastwood/test :namespaces "[$NAMESPACES]"
 
   be-tests:
     if: ${{ !inputs.skip }}
@@ -158,21 +294,9 @@ jobs:
               :partition/index 1
     name: "Java ${{ matrix.java-version }} ${{ matrix.job.name }}"
     env:
-      # Only run old migrations tests on pushes to master or release branches. All other branches should skip tests
-      # with the tag `mb/old-migrations-test`. `__ADDITIONAL_EXCLUDED_TAG__` is not used anywhere outside of splicing
-      # it in to the command below.
-      __ADDITIONAL_EXCLUDED_TAG__: >-
-        ${{
-          (
-            github.event_name == 'push' &&
-            (
-              github.ref_name == 'master' ||
-              startsWith(github.ref_name, 'release-x')
-            ) &&
-            ''
-          ) ||
-          ':mb/old-migrations-test'
-        }}
+      # __ADDITIONAL_EXCLUDED_TAG__: ${{ !inputs.force-run && ':mb/old-migrations-test' || '' }}
+      # GDGT-3126: re-enable and properly fix old migrations tests
+      __ADDITIONAL_EXCLUDED_TAG__: ':mb/old-migrations-test'
     steps:
       - uses: actions/checkout@v6
       - name: Prepare front-end environment
@@ -230,7 +354,21 @@ jobs:
         # whole `[ns/var ...]` vector reaches clojure -X as a single argument.
         run: |
           BASE="clojure -X:dev:ci:test:${{ matrix.job.edition }}:${{ matrix.job.edition }}-dev"
-          if [ "${{ github.run_attempt }}" != "1" ] && [ -s target/failed-tests ]; then
+          # `:profile-tests` overrides `:test`'s exec-fn, so it has to come last. See dev.profile-tests.
+          # The `profiled` output is what the collection steps below key off, so that the decision is
+          # recorded by the step that acts on it rather than re-derived from the environment.
+          if [ "$PROFILE_TESTS" = "true" ]; then
+            echo "Profiling this run; a flamegraph will be attached to the job."
+            echo "profiled=true" >> "$GITHUB_OUTPUT"
+            BASE="$BASE:profile-tests"
+          fi
+          # An explicit selection wins over the rerun narrowing below: it was asked for by hand, on this
+          # attempt. Names may be separated by commas or spaces; hawk wants them as one vector argument.
+          if [ -n "$ONLY_TESTS" ]; then
+            ONLY="[$(echo "$ONLY_TESTS" | tr ',' ' ')]"
+            echo "Running only: $ONLY"
+            $BASE :only "$ONLY"
+          elif [ "${{ github.run_attempt }}" != "1" ] && [ -s target/failed-tests ]; then
             echo "Granular rerun of previously-failed tests: $(cat target/failed-tests)"
             $BASE :only "$(cat target/failed-tests)"
           else
@@ -239,8 +377,15 @@ jobs:
         # Keep this step continue-on-error because the quarantine logic controls whether it ultimately fails.
         continue-on-error: true
 
+      - name: Collect profile
+        if: ${{ !cancelled() }}
+        uses: ./.github/actions/collect-profile
+        with:
+          profiled: ${{ steps.run-java-tests.outputs.profiled }}
+          artifact-name: profile-be-tests-java-${{ matrix.java-version }}-${{ matrix.job.test-group-name }}
+
       - name: Report failed tests to ci-conductor
-        if: ${{ !cancelled() && steps.run-java-tests.outcome == 'failure' }}
+        if: ${{ !cancelled() && ( steps.run-java-tests.outcome == 'failure' || github.run_attempt != '1' ) }}
         # This step should NEVER fail the job!
         continue-on-error: true
         uses: ./.github/actions/report-failures-to-ci-conductor
@@ -316,7 +461,7 @@ jobs:
         uses: ./.github/actions/prepare-backend
       # TODO -- we should probably also check WITHOUT ee -- do a check with only OSS namespaces on the classpath
       - name: Check namespaces
-        run: clojure -M:ee:drivers:check
+        run: clojure -M:ee:drivers:load-namespaces
 
   be-cljfmt:
     if: ${{ !inputs.skip }}
@@ -332,6 +477,7 @@ jobs:
 
   be-tests-result:
     needs:
+      - project-tests
       - be-linter-eastwood
       - be-linter-eastwood-test
       - be-linter-eastwood-test-changed
@@ -340,7 +486,7 @@ jobs:
       - be-check
       - be-tests
     if: always() && !cancelled()
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
     timeout-minutes: 5
     env:
       needs: ${{ toJson(needs) }}

.github/workflows/backport-reminder.yml

@@ -12,7 +12,8 @@ concurrency:
 
 jobs:
   flags:
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
+    timeout-minutes: 5
     outputs:
       has_backport_label: ${{ steps.c.outputs.value }}
     steps:
@@ -27,7 +28,7 @@ jobs:
 
   files-changed:
     name: Check which files changed
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
     timeout-minutes: 3
     outputs:
       docs: ${{ steps.changes.outputs.docs }}
@@ -44,7 +45,7 @@ jobs:
     needs: [ files-changed, flags ]
     if: ${{ !cancelled() }}
     name: Decide whether to backport or not
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
     timeout-minutes: 5
     permissions: {}
     steps:
@@ -59,7 +60,7 @@ jobs:
 
   priority-backport-reminder:
     name: Remind about backporting P0 + P1 fixes
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
     timeout-minutes: 5
     needs: [flags]
     permissions:

.github/workflows/block-master-source-branch-prs.yml

@@ -1,14 +0,0 @@
-name: Block Master Branch PRs
-on:
-  pull_request:
-    types: [opened, synchronize]
-
-jobs:
-  check-source-branch:
-    if: github.head_ref == 'master'
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    steps:
-      - name: Block master branch PRs
-        run: |
-          echo "PRs from \`master\` branches are not allowed, please use a new branch name for your PR."
-          exit 1

.github/workflows/build-private-ee-docker-image.yml

@@ -0,0 +1,142 @@
+name: Build & push private Metabase Docker image
+
+# Builds the ee uberjar for a commit and pushes it to the private ECR repo, tagged with that
+# commit's full SHA. Callers get the tag back as an output.
+#
+# The tag is per-commit rather than per-PR, so a PR leaves one image behind per pushed commit.
+# Nothing in this repo prunes them — retention is whatever lifecycle policy the ECR repo carries.
+
+on:
+  workflow_dispatch:
+    inputs:
+      commit:
+        description: Full sha of commit to build, optional
+  workflow_call:
+    inputs:
+      commit:
+        description: Full sha of commit to build, optional
+        type: string
+
+    secrets:
+      PR_ENV_IAM_ROLE:
+        description: Role assumed via OIDC to reach ECR
+        required: true
+      PR_ENV_AWS_ACCOUNT_ID:
+        description: Account hosting the private ECR registry
+        required: true
+
+    outputs:
+      tag:
+        description: "Image tag (the commit SHA)"
+        value: ${{ jobs.dockerize.outputs.tag }}
+
+# Keyed on the calling workflow as well as the commit: pr-env and ai-benchmark both land here, and
+# a shared group lets a re-label on one evict the other's queued run (`cancel-in-progress: false`
+# still drops a *pending* run when a third queues). Before the extraction the two paths were
+# independent; this keeps them that way.
+concurrency:
+  group: build-private-ee-docker-image-${{ github.workflow }}-${{ inputs.commit || github.event.pull_request.head.sha || github.sha }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+  actions: read # fetch-artifact reads the artifact API
+
+jobs:
+
+  build:
+    if: github.event_name == 'workflow_dispatch' || github.event.pull_request.head.repo.full_name == github.repository
+    uses: ./.github/workflows/uberjar.yml
+    with:
+      # Pass through only an *explicit* commit and let uberjar apply its own event fallback.
+      # Resolving head.sha here instead would pin the PR path's checkout to the head commit, while
+      # run-tests' uberjar keeps building the merge ref — both upload under the same
+      # `metabase-ee-<head.sha>-uberjar` name, so whichever raced first would decide what the tag
+      # actually contains.
+      commit: ${{ inputs.commit }}
+
+  dockerize:
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    needs: [build]
+    if: needs.build.result == 'success'
+    timeout-minutes: 60
+    permissions:
+      id-token: write
+      contents: read
+      actions: read
+    outputs:
+      tag: ${{ steps.meta.outputs.tag }}
+    steps:
+      # Deliberately the workflow's own revision, not `inputs.commit`: this checkout is where
+      # `./.github/actions/fetch-artifact` below comes from, and pinning it to the target commit
+      # would run that commit's copy of the action instead of this one. Nothing else in this job
+      # reads the tree.
+      - name: Checkout source code
+        uses: actions/checkout@v6
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1
+        with:
+          role-to-assume: ${{ secrets.PR_ENV_IAM_ROLE }}
+          role-session-name: GitHub_to_AWS_via_FederatedOIDC
+          aws-region: us-east-1
+      - name: Login to Amazon ECR
+        uses: aws-actions/amazon-ecr-login@183a1442edf41672e66566b7fc560e297a290896 # v2
+        with:
+          registries: "${{ secrets.PR_ENV_AWS_ACCOUNT_ID }}"
+      - name: Compute image tag
+        id: meta
+        env:
+          SHA: ${{ inputs.commit || github.event.pull_request.head.sha || github.sha }}
+        run: echo "tag=${SHA}" >> "$GITHUB_OUTPUT"
+      - name: Check whether image already exists
+        id: exists
+        env:
+          TAG: ${{ steps.meta.outputs.tag }}
+          # Same registry the push below targets — the assumed role's default registry is not
+          # necessarily this account, and querying the wrong one always reports "not found".
+          REGISTRY_ID: ${{ secrets.PR_ENV_AWS_ACCOUNT_ID }}
+        run: |
+          set +e
+          OUT=$(aws ecr describe-images \
+                  --registry-id "${REGISTRY_ID}" \
+                  --repository-name metabase-enterprise \
+                  --image-ids imageTag="${TAG}" 2>&1)
+          STATUS=$?
+          set -e
+
+          if [[ "${STATUS}" -eq 0 ]]; then
+            echo "Image already present for ${TAG}; reusing it."
+            echo "found=true" >> "$GITHUB_OUTPUT"
+          elif grep -q 'ImageNotFoundException' <<< "${OUT}"; then
+            echo "No image for ${TAG}; building."
+            echo "found=false" >> "$GITHUB_OUTPUT"
+          else
+            # Anything else (missing ecr:DescribeImages, wrong registry, throttling) is
+            # indistinguishable from "not found" if we swallow it, and we'd rebuild forever
+            # without ever saying why. Rebuilding is still the safe answer, so warn and go on.
+            echo "${OUT}" >&2
+            echo "::warning::Could not determine whether ${TAG} exists in ECR (exit ${STATUS}); building unconditionally."
+            echo "found=false" >> "$GITHUB_OUTPUT"
+          fi
+      - name: Retrieve uberjar artifact for ee
+        if: steps.exists.outputs.found == 'false'
+        uses: ./.github/actions/fetch-artifact
+        with:
+          commit: ${{ steps.meta.outputs.tag }}
+          edition: ee
+          extract-path: "target/uberjar"
+          output-name: "metabase.jar"
+      - name: Move uberjar to bin/docker
+        if: steps.exists.outputs.found == 'false'
+        run: mv target/uberjar/metabase.jar bin/docker/metabase.jar
+      - name: Build container
+        if: steps.exists.outputs.found == 'false'
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        with:
+          context: bin/docker/
+          platforms: linux/amd64
+          network: host
+          build-args: |
+            GIT_COMMIT_SHA=${{ steps.meta.outputs.tag }}
+          tags: ${{ secrets.PR_ENV_AWS_ACCOUNT_ID }}.dkr.ecr.us-east-1.amazonaws.com/metabase-enterprise:${{ steps.meta.outputs.tag }}
+          push: true

.github/workflows/build-scripts.yml

@@ -9,8 +9,77 @@ on:
 
 jobs:
 
+  files-changed:
+    name: Check which files changed
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 3
+    permissions:
+      contents: read
+    outputs:
+      embedder_plugin: ${{ steps.changes.outputs.embedder_plugin }}
+    steps:
+      - uses: actions/checkout@v6
+      - name: Test which files changed
+        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+        id: changes
+        with:
+          token: ${{ github.token }}
+          filters: .github/file-paths.yaml
+
+  test-embedder-plugin:
+    needs: files-changed
+    if: needs.files-changed.outputs.embedder_plugin == 'true'
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 20
+    permissions:
+      contents: read
+    services:
+      postgres:
+        image: pgvector/pgvector:pg17
+        env:
+          POSTGRES_USER: mb_test
+          POSTGRES_DB: mb_test
+          POSTGRES_HOST_AUTH_METHOD: trust
+        ports:
+          - 5432:5432
+    steps:
+    - uses: actions/checkout@v6
+    - name: Prepare back-end environment
+      uses: ./.github/actions/prepare-backend
+    - name: Build embedder plugin
+      run: ./bin/build-embedder-plugin.sh
+    - name: Verify packaged plugin resources
+      run: |
+        jar tf modules/embedder/target/metabase-embedder-plugin.jar | grep -Fx metabase/embedder/metabase-plugin.yaml
+        jar tf modules/embedder/target/metabase-embedder-plugin.jar | grep -Fx metabase/embedder-model-catalog.edn
+        jar tf modules/embedder/target/metabase-embedder-plugin.jar | grep -Fx metabase-embedder/snowflake-arctic-embed-xs-d8c86521100d3556476a063fc2342036d45c106f-arm64.zip
+        jar tf modules/embedder/target/metabase-embedder-plugin.jar | grep -Fx metabase-embedder/snowflake-arctic-embed-xs-d8c86521100d3556476a063fc2342036d45c106f-avx2.zip
+        jar tf modules/embedder/target/metabase-embedder-plugin.jar | grep -Fx metabase-embedder/all-minilm-l6-v2-1110a243fdf4706b3f48f1d95db1a4f5529b4d41-arm64.zip
+        jar tf modules/embedder/target/metabase-embedder-plugin.jar | grep -Fx metabase-embedder/all-minilm-l6-v2-1110a243fdf4706b3f48f1d95db1a4f5529b4d41-avx2.zip
+    - name: Run artifact-only plugin smoke test
+      env:
+        MB_EMBEDDER_ARTIFACT_TEST: "true"
+        MB_PLUGINS_DIR: modules/embedder/target
+      run: >-
+        ./bin/test-agent --oss :only
+        '[metabase.embeddings.embedder-plugin-artifact-test]'
+    - name: Run in-process semantic-search round trip
+      env:
+        MB_DB_TYPE: postgres
+        MB_DB_PORT: 5432
+        MB_DB_HOST: localhost
+        MB_DB_DBNAME: mb_test
+        MB_DB_USER: mb_test
+        MB_APPDB_PGVECTOR_MODE_TEST: "true"
+        MB_IN_PROCESS_EMBEDDER_SEMANTIC_SEARCH_TEST: "true"
+        MB_PLUGINS_DIR: modules/embedder/target
+      run: >-
+        ./bin/test-agent --drivers=postgres :only
+        '[metabase-enterprise.semantic-search.appdb-pgvector-mode-test/appdb-pgvector-in-process-embedder-round-trip-test]'
+
   test-build-scripts:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 40
     steps:
     - uses: actions/checkout@v6
     - name: Prepare back-end environment
@@ -20,7 +89,7 @@ jobs:
     - name: Run build and release script tests
       run: clojure -X:dev:drivers:build:build-dev:build-test:ci
       timeout-minutes: 15
-    - name: Run Liquibase migrations linter tests
+    - name: Run load-namespaces tests
       run: clojure -M:test
-      working-directory: bin/lint-migrations-file
+      working-directory: bin/load-namespaces
       timeout-minutes: 15

.github/workflows/bundle-size-stats.yml

@@ -2,27 +2,56 @@ name: Bundle Size Stats
 
 # Reuses the uberjar built on every master merge: downloads the jar (for the
 # emitted JS) plus the bundle-stats and embedding-sdk artifacts, measures
-# initial/total bundle sizes, and appends them to stats.metabase.com.
+# initial/total bundle sizes, and appends them to eng-stats-importer.
 
+# Triggered by "Run tests", which is the workflow that builds the uberjar on a
+# master merge.
 on:
   workflow_run:
-    workflows: ["Build Uberjar"]
+    workflows: ["Run tests"]
     types: [completed]
     # Master only: releases form non-linear lines whose deltas are meaningless,
     # so their sizes are backfilled separately rather than logged here.
     branches: [master]
+  workflow_call:
+    inputs:
+      commit:
+        description: "Commit SHA to measure."
+        type: string
+        required: false
+        default: ""
 
 concurrency:
-  group: bundle-size-stats-${{ github.event.workflow_run.head_sha }}
+  group: bundle-size-stats-${{ inputs.commit || github.event.workflow_run.head_sha }}
   cancel-in-progress: true
 
 jobs:
+  # "Run tests" concludes `failure` on master more often than `success`, from
+  # jobs that have nothing to do with the jar, so its conclusion is not a usable
+  # gate. The artifact is one: the uberjar job publishes it, and a docs-only
+  # merge that skipped that job publishes none.
+  uberjar-built:
+    if: ${{ github.repository == 'metabase/metabase' }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
+    timeout-minutes: 5
+    outputs:
+      found: ${{ steps.probe.outputs.fetch-hit }}
+    steps:
+      - uses: actions/checkout@v6
+      - id: probe
+        uses: ./.github/actions/fetch-artifact
+        with:
+          commit: ${{ inputs.commit || github.event.workflow_run.head_sha }}
+          edition: ee
+          download: false
+
   bundle-size-stats:
-    if: ${{ github.event.workflow_run.conclusion == 'success' && github.repository == 'metabase/metabase' }}
+    needs: [uberjar-built]
+    if: ${{ needs.uberjar-built.outputs.found == 'true' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 15
     env:
-      HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
+      HEAD_SHA: ${{ inputs.commit || github.event.workflow_run.head_sha }}
       # Only record a data point when a bundle's as-served size (brotli where the
       # build ships .br, else gzip) moved by at least this percent vs the last
       # plotted point, keeping the chart to real changes.
@@ -31,11 +60,12 @@ jobs:
       - name: Check out the code
         uses: actions/checkout@v6
         with:
-          ref: ${{ github.event.workflow_run.head_sha }}
+          ref: ${{ env.HEAD_SHA }}
+      - uses: ./.github/actions/prepare-node-bun
       - name: Download EE uberjar
         uses: ./.github/actions/fetch-artifact
         with:
-          commit: ${{ github.event.workflow_run.head_sha }}
+          commit: ${{ env.HEAD_SHA }}
           edition: ee
           extract-path: temp/uberjar
       - name: Extract front-end bundles from uberjar
@@ -104,42 +134,15 @@ jobs:
           # Passed via env (not interpolated into the shell) so the commit
           # message can't inject commands; the script keeps only the subject.
           COMMIT_MESSAGE: ${{ github.event.workflow_run.head_commit.message }}
-        run: node ./.github/scripts/bundle-size-stats-prepare.js
-      - name: Upload sizes (with deltas) to Stats
+        run: bun ./.github/scripts/bundle-size-stats-prepare.ts
+      - name: Import sizes (with deltas) into Stats
         id: upload
-        if: steps.prepare.outputs.significant == 'true'
-        uses: actions/github-script@v9
+        if: ${{ steps.prepare.outputs.significant == 'true' && inputs.commit == '' }}
         env:
-          API_KEY: ${{ secrets.STATS_API_KEY }}
-        with:
-          script: | # js
-            const fs = require("fs");
-            const { uploadCsvToMb } = require("${{ github.workspace }}/.github/scripts/csv-to-mb.js");
-
-            const data = JSON.parse(
-              fs.readFileSync("${{ github.workspace }}/artifacts/upload-rows.json", "utf8"),
-            );
-
-            console.table(data);
-
-            try {
-              await uploadCsvToMb({
-                baseUrl: "https://stats.metabase.com",
-                tableId: 79702,
-                jsonData: data,
-                mode: "append",
-              });
-              console.log("Bundle sizes uploaded successfully");
-              core.setOutput("uploaded", "true");
-            } catch (error) {
-              // Stats logging is best-effort: if stats.metabase.com is still
-              // unreachable after the client's retries, keep the run green. The
-              // last-plotted cache is only saved on a successful upload (below),
-              // so this point is re-attempted on the next master build and
-              // nothing is silently dropped.
-              core.warning(`Bundle-size upload failed after retries; leaving run green: ${error.message}`);
-              core.setOutput("uploaded", "false");
-            }
+          ROWS: artifacts/upload-rows.json
+          ENG_STATS_URL: ${{ secrets.ENG_STATS_URL }}
+          API_KEY: ${{ secrets.ENG_STATS_API_KEY }}
+        run: bun .github/scripts/upload-bundle-size-stats.ts
       - name: Remember this as the last plotted point
         if: steps.upload.outputs.uploaded == 'true'
         uses: actions/cache/save@v4

.github/workflows/bundle-size.yml

@@ -7,11 +7,6 @@ name: Bundle Size
 
 on:
   workflow_call:
-    inputs:
-      skip:
-        description: Whether to skip the check (e.g. no front-end sources changed, or the uberjar failed to build).
-        required: true
-        type: boolean
 
 concurrency:
   group: bundle-size-${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}
@@ -20,7 +15,6 @@ concurrency:
 jobs:
   bundle-size-check:
     name: "Bundle size check"
-    if: ${{ !inputs.skip }}
     continue-on-error: true
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 20
@@ -32,7 +26,6 @@ jobs:
         id: compare
         with:
           edition: ee
-          base-ref-commit: ${{ github.event.pull_request.base.sha }}
           threshold-percent: ${{ env.BUNDLE_SIZE_THRESHOLD_PERCENT }}
 
       - name: Comment on PR if app bundle size has increased

.github/workflows/cache-cleanup-codeql.yml

@@ -1,83 +0,0 @@
-# CodeQL's overlay analysis saves a ~400MB "base database" cache on every master run, keyed by commit SHA.
-#
-# Only the newest entry is ever restored: CodeQL looks its cache up by key *prefix* and takes the most recent match,
-# so everything behind it is dead weight. This job keeps the newest few and deletes the rest.
-name: CodeQL Cache Cleanup
-
-on:
-  schedule:
-    - cron: "0 4 * * *" # daily at 04:00 UTC
-  workflow_dispatch:
-    inputs:
-      keep:
-        description: "How many of the newest CodeQL caches to keep"
-        required: false
-        default: "2"
-      dry-run:
-        description: "List what would be deleted without deleting it"
-        type: boolean
-        required: false
-        default: false
-
-concurrency:
-  group: cache-cleanup-codeql
-  cancel-in-progress: false
-
-permissions:
-  actions: write # required to delete cache entries
-  contents: read
-
-jobs:
-  cleanup:
-    # don't run the schedule on forks
-    if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 10
-    env:
-      GH_TOKEN: ${{ github.token }}
-      KEEP: ${{ github.event.inputs.keep || '2' }}
-      DRY_RUN: ${{ github.event.inputs.dry-run || 'false' }}
-      PREFIX: codeql-overlay-base-database-
-    steps:
-      - name: Delete superseded CodeQL caches
-        shell: bash
-        run: |
-          set -euo pipefail
-
-          # created_at is ISO-8601, so a reverse lexicographic sort is newest-first.
-          gh api --paginate "/repos/${GITHUB_REPOSITORY}/actions/caches?per_page=100" \
-            --jq ".actions_caches[] | select(.key | startswith(\"${PREFIX}\")) | \"\(.created_at)\t\(.id)\t\(.size_in_bytes)\t\(.key)\"" \
-            | sort -r > all.tsv || true
-
-          found=$(wc -l < all.tsv | tr -d ' ')
-          echo "Found $found cache(s) matching '${PREFIX}'; keeping the newest $KEEP."
-          if [ "$found" -eq 0 ]; then
-            echo "Nothing to do." >> "$GITHUB_STEP_SUMMARY"
-            exit 0
-          fi
-
-          tail -n +$((KEEP + 1)) all.tsv > doomed.tsv || true
-          doomed=$(wc -l < doomed.tsv | tr -d ' ')
-
-          freed=0
-          while IFS=$'\t' read -r created id size key; do
-            [ -z "${id:-}" ] && continue
-            echo "  deleting $key ($((size / 1000000))MB, created $created)"
-            if [ "$DRY_RUN" = "true" ]; then
-              echo "    (dry run — not deleted)"
-            else
-              # A cache can vanish between listing and deleting (concurrent eviction); don't fail the job over it.
-              gh api --method DELETE "/repos/${GITHUB_REPOSITORY}/actions/caches/${id}" >/dev/null \
-                || echo "    (already gone, skipping)"
-            fi
-            freed=$((freed + size))
-          done < doomed.tsv
-
-          {
-            echo "### CodeQL cache cleanup"
-            echo ""
-            echo "- matched: **$found**"
-            echo "- kept (newest): **$KEEP**"
-            echo "- deleted: **$doomed**"
-            echo "- reclaimed: **$((freed / 1000000)) MB**${DRY_RUN:+ (dry run: $DRY_RUN)}"
-          } >> "$GITHUB_STEP_SUMMARY"

.github/workflows/cache-generator.yml

@@ -1,173 +0,0 @@
-# This workflow is the single source of truth for generating and updating various caches used by our CI pipeline.
-# It sets the fresh cache each Monday but provides a manual trigger to update it on-demand.
-#
-# All other jobs only restore from this cache; *they never update it*!
-# They should always use `actions/cache/restore@vX` because `actions/cache@vX` would attempt to save the cache.
-#
-# Our agreed-upon strategy is to use a deterministic cache key based on the week of the year.
-# Jobs can utilize the prior week's cache if the current week's cache is not found.
-#
-#
-# PRINCIPLES:
-#   - The cache is never wrong!
-#   - Caches are immutable once created.
-#   - Caches are for speeding up builds, not for correctness.
-#   - It is faster to download a large cache than to re-resolve missing dependencies.
-#
-#
-# DESIGN:
-#
-# 1. Prepare
-#     - A job first prepares the local environment (e.g., installs JDK, Clojure, Node.js, etc.)
-#     - This fetches the dependencies from the cache (if it exists) and warms up the local cache for this workflow.
-# 2. Resolve
-#     - The next step pre-resolves all dependencies, ensuring that the local cache is fully populated and up-to-date.
-# 3. Update
-#     - The final step saves the local cache back to GitHub Actions cache with a deterministic key.
-#     - If a cache entry already exists for that key, it is deleted first to ensure immutability.
-#
-name: Cache Generator
-
-on:
-  schedule:
-    - cron: "0 3 * * 1" # Mondays at 03:00 UTC
-  workflow_dispatch: # manually update the cache
-
-concurrency:
-  group: cache-generator
-  cancel-in-progress: true
-
-jobs:
-  get-cache-keys:
-    if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    steps:
-      - uses: actions/checkout@v6
-      - name: Get cache keys
-        uses: ./.github/actions/get-cache-keys
-        id: get-cache-keys
-    outputs:
-      m2-cache-key: ${{ steps.get-cache-keys.outputs.m2-cache-key }}
-      node-cache-key: ${{ steps.get-cache-keys.outputs.node-cache-key }}
-      eslint-cache-key: ${{ steps.get-cache-keys.outputs.eslint-cache-key }}
-      cypress-cache-key: ${{ steps.get-cache-keys.outputs.cypress-cache-key }}
-
-  generate-caches:
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 30
-    needs: get-cache-keys
-    env:
-      M2_CACHE_KEY: ${{ needs.get-cache-keys.outputs.m2-cache-key }}
-      NODE_CACHE_KEY: ${{ needs.get-cache-keys.outputs.node-cache-key }}
-      CYPRESS_CACHE_KEY: ${{ needs.get-cache-keys.outputs.cypress-cache-key }}
-      ESLINT_CACHE_KEY: ${{ needs.get-cache-keys.outputs.eslint-cache-key }}
-    steps:
-      - uses: actions/checkout@v6
-
-      # Backend preparation and cache
-      - name: Prepare backend
-        uses: ./.github/actions/prepare-backend
-
-      # Pre-resolve every Clojure dependency classpath CI actually uses, so the
-      # saved cache is a SUPERSET of what each job resolves at runtime.
-      #
-      # Why a single `-P` is not enough: tools.deps selects dependency *versions*
-      # globally per classpath, so different alias combinations can resolve the
-      # same transitive lib to different versions (e.g. `org.clojure/data.json`
-      # 2.4.0 vs 2.5.x, `org.ow2.asm/asm` 9.2 vs newer). Resolving only one combo
-      # leaves the others to fetch their version-deltas straight from Maven
-      # Central / Clojars on every run -> intermittent 403s. See DEV-2094.
-      #
-      # Keep this list in sync with the `clojure` invocations across .github/.
-      # Each entry notes its consumer. We resolve the FULL alias strings (not a
-      # hand-reduced set) on purpose: if a currently dep-less alias later gains a
-      # dependency, this still covers it instead of silently drifting back into a
-      # cache gap.
-      - name: Pre-resolve Clojure dependencies
-        shell: bash
-        run: |
-          set -euo pipefail
-          combos=(
-            ":build:dev:ee:ee-dev:drivers:drivers-dev:cljs"     # build + uberjar (combined classpath)
-            ":cljs"                                             # shadow-cljs (build:cljs); resolves :cljs alone -> covers asm:9.2
-            ":dev:ee:ee-dev:drivers:drivers-dev:test:eastwood"  # backend.yml (eastwood + eastwood/test)
-            ":dev:ci:ee:ee-dev:drivers:drivers-dev:test"        # test-driver.yml (ee) -> covers data.json:2.4.0
-            ":dev:ci:oss:oss-dev:drivers:drivers-dev:test"      # test-driver.yml (oss)
-            ":dev:ci:test:ee:ee-dev"                            # backend.yml matrix (ee)
-            ":dev:ci:test:oss:oss-dev"                          # backend.yml matrix (oss)
-            ":dev:ci:ee:ee-dev:test:cloverage"                  # backend-cloverage.yml
-            ":dev:drivers:drivers-dev:test"                     # reset-cloud-test-dataset.yml
-            ":dev:drivers:build:build-dev:build-test:ci"        # build-scripts.yml
-            ":ee:drivers:check"                                 # backend.yml (check; git dep athos/clj-check)
-            ":ee:doc"                                           # docs-generate-base.yml
-            ":kondo"                                            # resolve-backport-conflicts.yml (replace-deps)
-            ":run:ee"                                           # cross-branch-migration-test
-            ":dev:ee:migrate"                                   # cross-branch-migration-test
-          )
-          for combo in "${combos[@]}"; do
-            echo "::group::clojure -P -A${combo}"
-            clojure -P -A"${combo}"
-            echo "::endgroup::"
-          done
-
-      - name: Update M2 cache
-        uses: ./.github/actions/update-cache
-        with:
-          path: |
-            ~/.m2
-            ~/.gitlibs
-          key: ${{ env.M2_CACHE_KEY }}
-
-      # Frontend preparation and caches
-      # `prepare-frontend` action (1) prepares Node.js and (2) fetches the node_modules cache if it exists.
-      # It then (3) runs `bun install --frozen-lockfile` which ensures the local cache is fully populated.
-      # IMPORTANT: Caching node_modules after patches are already applied will break any PR that attempts to either:
-      #   - upgrade a patched library
-      #   - change a patch
-      # Hence why we explicitly exclude patches from the cache (controlled by the `apply-patches` action input).
-      - name: Install front-end dependencies
-        uses: ./.github/actions/prepare-frontend
-        with:
-          apply-patches: "false"
-
-      - name: Get bun cache directory
-        id: bun-cache
-        run: |
-          BUN_CACHE_DIR=$(bun pm cache)
-          echo "Bun cache directory: $BUN_CACHE_DIR"
-          echo "dir=$BUN_CACHE_DIR" >> "$GITHUB_OUTPUT"
-
-      - name: Ensure that Cypress executable is ready
-        run: |
-          bun run cypress install
-          bun run cypress cache path
-          bun run cypress cache list
-          bun run cypress verify
-        shell: bash
-
-      - name: Update node_modules cache
-        uses: ./.github/actions/update-cache
-        with:
-          path: |
-            ${{ steps.bun-cache.outputs.dir }}
-            node_modules
-          key: ${{ env.NODE_CACHE_KEY }}
-
-      - name: Update Cypress cache
-        uses: ./.github/actions/update-cache
-        with:
-          path: ~/.cache/Cypress
-          key: ${{ env.CYPRESS_CACHE_KEY }}
-
-      # ESLint cache (requires both backend and frontend)
-      - name: Compile CLJS
-        run: bun run build-pure:cljs
-
-      - name: Run ESLint to populate cache
-        run: bun run lint-eslint-pure
-
-      - name: Update eslint cache
-        uses: ./.github/actions/update-cache
-        with:
-          path: ${{ github.workspace}}/.eslintcache
-          key: ${{ env.ESLINT_CACHE_KEY }}

.github/workflows/cache-warm.yml

@@ -0,0 +1,204 @@
+# Writes the shared dependency caches. Every other job restores them and none of them writes.
+#
+# A single writer rather than the usual let-every-job-save arrangement, because a pull request here fans
+# out to roughly 200 jobs, ~75 of which install Cypress. Letting each of those save would have them all
+# build a 200MB archive and race for one reservation on every lockfile change, and all pull the Cypress
+# binary at once on a version bump.
+#
+# The ESLint cache is the exception and saves from the lint job itself: it is under a megabyte and only a
+# couple of jobs write it, so there is no herd to avoid.
+#
+# A cache is readable from the ref that saved it, from that ref's pull requests, and - for every ref -
+# from the default branch. Warming on push to each merge target therefore serves the pull requests aimed
+# at it, and master's copy backs up every ref that has none of its own.
+#
+# Keys are content-derived (see .github/scripts/cache-keys.sh), so a push whose dependencies already have
+# an entry does nothing but four lookups. There is no cron: nothing here is keyed by date.
+#
+#
+# PRINCIPLES:
+#   - The cache is never wrong!
+#   - Caches are immutable once created.
+#   - Caches are for speeding up builds, not for correctness.
+#   - It is faster to download a large cache than to re-resolve missing dependencies.
+
+name: Cache Warm
+
+on:
+  push:
+    branches:
+      - master
+      - "release-x.*.x"
+  workflow_dispatch:
+
+concurrency:
+  group: cache-warm-${{ github.ref }}
+  # Pushes to master land a median of 27 minutes apart and a full resolve takes longer, so cancelling in
+  # progress would abort most warms before they save and a ref could stay cold indefinitely. Queueing
+  # costs one wait instead: the queued run finds every key present and exits in about a minute.
+  cancel-in-progress: false
+
+jobs:
+  warm:
+    # Forks read the upstream default branch's caches and cannot usefully write their own, so warming
+    # there would burn a runner for nothing.
+    if: ${{ github.repository == 'metabase/metabase' }}
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Cache spec
+        id: cache-spec
+        run: .github/scripts/cache-keys.sh | tee -a "$GITHUB_OUTPUT"
+
+      # `lookup-only` with no restore-keys asks whether this exact dependency set is already cached.
+      # Paths come from the spec, the same ones the save below declares - a lookup that named different
+      # paths would compute a different cache identity and report a miss every time.
+      - name: Look up M2 cache
+        id: m2-lookup
+        uses: actions/cache/restore@v5
+        with:
+          path: ${{ steps.cache-spec.outputs.m2-path }}
+          key: ${{ steps.cache-spec.outputs.m2-key }}
+          lookup-only: true
+      - name: Look up bun store
+        id: bun-lookup
+        uses: actions/cache/restore@v5
+        with:
+          path: ${{ steps.cache-spec.outputs.bun-store-path }}
+          key: ${{ steps.cache-spec.outputs.bun-store-key }}
+          lookup-only: true
+      - name: Look up Clojure CLI
+        id: clojure-lookup
+        uses: actions/cache/restore@v5
+        with:
+          path: ${{ steps.cache-spec.outputs.clojure-path }}
+          key: ${{ steps.cache-spec.outputs.clojure-key }}
+          lookup-only: true
+      - name: Look up Cypress binary
+        id: cypress-lookup
+        uses: actions/cache/restore@v5
+        with:
+          path: ${{ steps.cache-spec.outputs.cypress-path }}
+          key: ${{ steps.cache-spec.outputs.cypress-key }}
+          lookup-only: true
+
+      # Also runs when only the Clojure CLI entry is missing: installing it is what there is to save,
+      # and the pre-resolve below needs it either way.
+      - name: Prepare backend
+        if: steps.m2-lookup.outputs.cache-hit != 'true' || steps.clojure-lookup.outputs.cache-hit != 'true'
+        uses: ./.github/actions/prepare-backend
+
+      - name: Save Clojure CLI
+        if: steps.clojure-lookup.outputs.cache-hit != 'true'
+        uses: actions/cache/save@v5
+        with:
+          path: ${{ steps.cache-spec.outputs.clojure-path }}
+          key: ${{ steps.cache-spec.outputs.clojure-key }}
+
+      # Pre-resolve every Clojure dependency classpath CI actually uses, so the saved cache is a SUPERSET
+      # of what each job resolves at runtime.
+      #
+      # Why a single `-P` is not enough: tools.deps selects dependency *versions* globally per classpath,
+      # so different alias combinations can resolve the same transitive lib to different versions (e.g.
+      # `org.clojure/data.json` 2.4.0 vs 2.5.x, `org.ow2.asm/asm` 9.2 vs newer). Resolving only one combo
+      # leaves the others to fetch their version-deltas straight from Maven Central / Clojars on every
+      # run -> intermittent 403s. See DEV-2094.
+      #
+      # Keep this list in sync with the `clojure` invocations across .github/. Each entry notes its
+      # consumer. We resolve the FULL alias strings (not a hand-reduced set) on purpose: if a currently
+      # dep-less alias later gains a dependency, this still covers it instead of silently drifting back
+      # into a cache gap.
+      - name: Pre-resolve Clojure dependencies
+        if: steps.m2-lookup.outputs.cache-hit != 'true'
+        shell: bash
+        run: |
+          set -euo pipefail
+          combos=(
+            ":build:dev:ee:ee-dev:drivers:drivers-dev:cljs"     # build + uberjar (combined classpath)
+            ":cljs"                                             # shadow-cljs (build:cljs); resolves :cljs alone -> covers asm:9.2
+            ":dev:ee:ee-dev:drivers:drivers-dev:test:eastwood"  # backend.yml (eastwood)
+            ":dev:dev/test:ee:ee-dev:drivers:drivers-dev:test:eastwood/test" # backend.yml (eastwood tests)
+            ":dev:dev/test:ee:ee-dev:drivers:drivers-dev:test:ci" # run-tests.yml (project tests)
+            ":dev:ci:ee:ee-dev:drivers:drivers-dev:test"        # test-driver.yml (ee) -> covers data.json:2.4.0
+            ":dev:ci:oss:oss-dev:drivers:drivers-dev:test"      # test-driver.yml (oss)
+            ":dev:ci:test:ee:ee-dev"                            # backend.yml matrix (ee)
+            ":dev:ci:test:oss:oss-dev"                          # backend.yml matrix (oss)
+            ":dev:ci:ee:ee-dev:test:cloverage"                  # backend-cloverage.yml
+            ":dev:drivers:drivers-dev:test"                     # reset-cloud-test-dataset.yml
+            ":dev:drivers:build:build-dev:build-test:ci"        # build-scripts.yml
+            ":test"                                             # build-scripts.yml (bin/build unit tests)
+            ":ee:drivers:load-namespaces"                       # backend.yml (load-namespaces)
+            ":ee:doc"                                           # docs-generate-base.yml
+            ":kondo"                                            # resolve-backport-conflicts.yml (replace-deps)
+            ":run:ee"                                           # cross-branch-migration-test
+            ":dev:ee:migrate"                                   # cross-branch-migration-test
+            ":whitespace-linter"                                # whitespace linter
+          )
+          for combo in "${combos[@]}"; do
+            echo "::group::clojure -P -A${combo}"
+            clojure -P -A"${combo}"
+            echo "::endgroup::"
+          done
+
+          # These commands use nested tools.deps projects; resolving the same alias from the
+          # repository root does not warm their dependencies.
+          nested_combos=(
+            "bin/lint-migrations-file|:test" # project migration checks
+            "bin/load-namespaces|:test"      # build-scripts.yml
+          )
+          for spec in "${nested_combos[@]}"; do
+            project=${spec%%|*}
+            combo=${spec#*|}
+            echo "::group::${project}: clojure -P -M${combo}"
+            (cd "$project" && clojure -P -M"${combo}")
+            echo "::endgroup::"
+          done
+
+          echo "::group::./bin/mage"
+          ./bin/mage
+          echo "::endgroup::"
+
+      - name: Save M2 cache
+        if: steps.m2-lookup.outputs.cache-hit != 'true'
+        uses: actions/cache/save@v5
+        with:
+          path: ${{ steps.cache-spec.outputs.m2-path }}
+          key: ${{ steps.cache-spec.outputs.m2-key }}
+
+      # `prepare-frontend` installs bun, points it at the store path, and runs a frozen-lockfile install,
+      # which is what fills the store. Patches are deliberately not applied: a store cached with patches
+      # already in place breaks any pull request that changes or upgrades a patched dependency.
+      #
+      # This also runs when only the Cypress cache is missing, because `bun run cypress install` below
+      # needs the node_modules this step creates. Narrowing the condition to the bun store alone would
+      # leave that step with no Cypress binary to run.
+      - name: Install front-end dependencies
+        if: steps.bun-lookup.outputs.cache-hit != 'true' || steps.cypress-lookup.outputs.cache-hit != 'true'
+        uses: ./.github/actions/prepare-frontend
+        with:
+          apply-patches: "false"
+
+      - name: Save bun store
+        if: steps.bun-lookup.outputs.cache-hit != 'true'
+        uses: actions/cache/save@v5
+        with:
+          path: ${{ steps.cache-spec.outputs.bun-store-path }}
+          key: ${{ steps.cache-spec.outputs.bun-store-key }}
+
+      - name: Ensure that Cypress executable is ready
+        if: steps.cypress-lookup.outputs.cache-hit != 'true'
+        shell: bash
+        run: |
+          bun run cypress install
+          bun run cypress cache path
+          bun run cypress cache list
+          bun run cypress verify
+
+      - name: Save Cypress binary
+        if: steps.cypress-lookup.outputs.cache-hit != 'true'
+        uses: actions/cache/save@v5
+        with:
+          path: ${{ steps.cache-spec.outputs.cypress-path }}
+          key: ${{ steps.cache-spec.outputs.cypress-key }}

.github/workflows/check-backport-script.yml

@@ -1,21 +0,0 @@
-name: Prevent backport.sh from being merged
-
-on:
-  pull_request:
-    types: [opened, synchronize, reopened]
-  merge_group:
-
-jobs:
-  check-backport-script:
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v6
-      - name: Check for backport.sh file
-        run: |
-          if [ -f "./backport.sh" ]; then
-            echo "backport.sh file exists. Please remove it before merging."
-            exit 1
-          else
-            echo "All good."
-          fi

.github/workflows/chromatic.yml

@@ -14,7 +14,7 @@ concurrency:
 jobs:
   files-changed:
     name: Check which files changed
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
     timeout-minutes: 3
     outputs:
       frontend_all: ${{ steps.changes.outputs.frontend_all }}

.github/workflows/cljs.yml

@@ -14,7 +14,7 @@ concurrency:
 jobs:
   files-changed:
     name: Check which files changed
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
     timeout-minutes: 3
     outputs:
       cljs: ${{ steps.changes.outputs.cljs }}

.github/workflows/containerize-jar.yml

@@ -1,5 +1,5 @@
 name: Containerize Uberjar
-run-name: Containerize ${{ inputs.tag }} Uberjar
+run-name: Containerize ${{ inputs.edition }} ${{ inputs.tag }} Uberjar
 
 on:
   workflow_call:
@@ -9,9 +9,10 @@ on:
         type: string
         required: true
       repo:
-        description: owner and repo like "metabase/metabase"
+        description: Docker owner and repo, e.g. "metabase/metabase".
         type: string
       tag:
+        description: Docker tag, e.g. v1.87.2.
         type: string
       commit:
         type: string
@@ -30,10 +31,10 @@ on:
           - oss
         required: true
       repo:
-        description: docker owner and repo like "metabase/metabase"
+        description: Docker owner and repo, e.g. "metabase/metabase".
         type: string
       tag:
-        description: usually a version like v1.87.2
+        description: Docker tag, e.g. v1.87.2.
         type: string
       commit:
         description: the full commit hash
@@ -45,10 +46,14 @@ on:
 
 jobs:
   containerize:
+    name: containerize (${{ inputs.edition }})
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 15
     outputs:
       platforms: ${{ steps.platforms.outputs.result }}
+      repo: ${{ steps.image.outputs.repo }}
+      tag: ${{ steps.image.outputs.tag }}
+      full_image: ${{ steps.image.outputs.full_image }}
     steps:
     - uses: actions/checkout@v6
       with:
@@ -65,6 +70,13 @@ jobs:
         release: ${{ inputs.release }}
     - name: Prepare release scripts
       uses: ./.github/actions/prepare-release-scripts
+    - name: Resolve image repo and tag
+      id: image
+      uses: ./.github/actions/get-docker-info
+      with:
+        repo: ${{ inputs.repo }}
+        tag: ${{ inputs.tag }}
+        edition: ${{ inputs.edition }}
     - name: Get platforms
       id: platforms
       uses: actions/github-script@v9
@@ -72,7 +84,7 @@ jobs:
         result-encoding: string
         script: | # js
           const { getBuildRequirements, isValidVersionString} = require('${{ github.workspace }}/release/dist/index.cjs');
-          const version = "${{ inputs.tag }}".split('-')[0];
+          const version = "${{ steps.image.outputs.tag }}".split('-')[0];
 
           if (!isValidVersionString(version)) {
             return "linux/amd64,linux/arm64";
@@ -100,7 +112,7 @@ jobs:
         context: bin/docker/.
         platforms: ${{ steps.platforms.outputs.result }}
         network: host
-        tags: ${{ inputs.repo }}:${{ inputs.tag }}
+        tags: ${{ steps.image.outputs.full_image }}
         no-cache: true
         push: true
         build-args: ${{ inputs.build-args }}
@@ -108,16 +120,26 @@ jobs:
     # we need to do this to get the nice fallback behavior of the legacy manifest file
     - name: Build container (x86 only)
       if: contains(steps.platforms.outputs.result, 'arm') == false
+      env:
+        BUILD_ARGS: ${{ inputs.build-args }}
+        FULL_IMAGE: ${{ steps.image.outputs.full_image }}
       run: | # bash
+        args=()
+        while IFS= read -r line; do
+          [ -n "$line" ] && args+=(--build-arg "$line")
+        done <<< "$BUILD_ARGS"
+
         docker build \
-          -t ${{ inputs.repo }}:${{ inputs.tag }} \
+          -t "$FULL_IMAGE" \
+          "${args[@]}" \
           --network=host \
           --push \
           bin/docker/.
 
   verify-docker-pull:
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     needs: containerize
+    name: verify-docker-pull (${{ inputs.edition }})
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 15
     steps:
     - name: Login to Docker Hub
@@ -126,18 +148,19 @@ jobs:
         username: ${{ inputs.release && secrets.DOCKERHUB_RELEASE_USERNAME || secrets.DOCKERHUB_USERNAME }}
         password: ${{ inputs.release && secrets.DOCKERHUB_RELEASE_TOKEN || secrets.DOCKERHUB_TOKEN }}
     - name: Pull the container image
-      run: docker pull ${{ inputs.repo }}:${{ inputs.tag }}
+      run: docker pull ${{ needs.containerize.outputs.full_image }}
     - name: Launch container
-      run: docker run --rm -dp 3000:3000 ${{ inputs.repo }}:${{ inputs.tag }}
+      run: docker run --rm -dp 3000:3000 ${{ needs.containerize.outputs.full_image }}
       timeout-minutes: 5
     - name: Wait for Metabase to start
       run: while ! curl -s 'http://localhost:3000/api/health' | grep '{"status":"ok"}'; do sleep 1; done
       timeout-minutes: 5
 
   verify-docker-pull-arm:
-    runs-on: arm-ubuntu-24-2core
     needs: containerize
     if: contains(needs.containerize.outputs.platforms, 'linux/arm64')
+    name: verify-docker-pull-arm (${{ inputs.edition }})
+    runs-on: arm-ubuntu-24-2core
     timeout-minutes: 15
     steps:
     - name: Login to Docker Hub
@@ -146,10 +169,41 @@ jobs:
         username: ${{ inputs.release && secrets.DOCKERHUB_RELEASE_USERNAME || secrets.DOCKERHUB_USERNAME }}
         password: ${{ inputs.release && secrets.DOCKERHUB_RELEASE_TOKEN || secrets.DOCKERHUB_TOKEN }}
     - name: Pull the container image
-      run: docker pull ${{ inputs.repo }}:${{ inputs.tag }}
+      run: docker pull ${{ needs.containerize.outputs.full_image }}
     - name: Launch container
-      run: docker run --rm -dp 3000:3000 ${{ inputs.repo }}:${{ inputs.tag }}
+      run: docker run --rm -dp 3000:3000 ${{ needs.containerize.outputs.full_image }}
       timeout-minutes: 5
     - name: Wait for Metabase to start
       run: while ! curl -s 'http://localhost:3000/api/health' | grep '{"status":"ok"}'; do sleep 1; done
       timeout-minutes: 5
+
+  post-docker-info-comment:
+    needs: [containerize, verify-docker-pull, verify-docker-pull-arm]
+    # Only post a comment if all the steps pass and this is a PR.
+    if: |
+      !cancelled() &&
+      !failure() &&
+      !inputs.release &&
+      github.event_name == 'pull_request'
+    name: post-docker-info-comment (${{ inputs.edition }})
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 5
+    steps:
+    - name: Post PR comment
+      uses: marocchino/sticky-pull-request-comment@0ea0beb66eb9baf113663a64ec522f60e49231c0 # v3.0.4
+      with:
+        header: docker-build-status-${{ inputs.edition }}
+        message: |
+          ✅ Docker build completed for commit ${{ inputs.commit || github.event.pull_request.head.sha || github.sha }}
+
+          The uberjar has been built and containerized successfully.
+
+          **Branch:** `${{ github.head_ref || github.ref_name }}`
+          **Docker Image:** `${{ needs.containerize.outputs.full_image }}`
+          **Docker Hub:** [View on Docker Hub](https://hub.docker.com/r/${{ needs.containerize.outputs.repo }}/tags?name=${{ needs.containerize.outputs.tag }})
+          **Triggered by:** @${{ github.actor }}
+
+          Pull the image:
+          ```bash
+          docker pull ${{ needs.containerize.outputs.full_image }}
+          ```

.github/workflows/containerize-uberjar.yml

@@ -1,129 +0,0 @@
-name: Containerize Uberjar
-
-on:
-  workflow_call:
-  workflow_dispatch:
-    inputs:
-      commit:
-        description: the full commit hash to containerize (defaults to the triggering commit)
-        type: string
-
-jobs:
-  get-container-info:
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 5
-    name: Get container info
-    outputs:
-      editions: ${{ steps.ee-info.outputs.editions }}
-      ee: ${{ toJson(fromJson(steps.build-matrix.outputs.result).ee) }}
-      oss: ${{ toJson(fromJson(steps.build-matrix.outputs.result).oss) }}
-    steps:
-      - name: Check out the code
-        uses: actions/checkout@v6
-      - name: Get EE Docker info
-        id: ee-info
-        uses: ./.github/actions/get-docker-info
-        with:
-          edition: ee
-      - name: Get OSS Docker info
-        id: oss-info
-        uses: ./.github/actions/get-docker-info
-        with:
-          edition: oss
-      - name: Build matrix info
-        id: build-matrix
-        uses: actions/github-script@v9
-        with:
-          script: | # js
-            const editions = JSON.parse('${{ steps.ee-info.outputs.editions }}');
-            const result = {
-              editions: editions,
-              ee: {
-                repo: '${{ steps.ee-info.outputs.repo }}',
-                tag: '${{ steps.ee-info.outputs.tag }}'
-              },
-              oss: {
-                repo: '${{ steps.oss-info.outputs.repo }}',
-                tag: '${{ steps.oss-info.outputs.tag }}'
-              }
-            };
-            console.log('Build matrix:', result);
-            return result;
-
-  containerize:
-    needs: [get-container-info]
-    if: needs.get-container-info.result == 'success'
-    strategy:
-      matrix:
-        edition: ${{ fromJson(needs.get-container-info.outputs.editions) }}
-    uses: ./.github/workflows/containerize-jar.yml
-    secrets: inherit
-    with:
-      edition: ${{ matrix.edition }}
-      commit: ${{ github.event.inputs.commit || github.event.pull_request.head.sha || github.sha }}
-      repo: ${{ fromJson(needs.get-container-info.outputs[matrix.edition]).repo }}
-      tag: ${{ fromJson(needs.get-container-info.outputs[matrix.edition]).tag }}
-      release: false
-      build-args: |
-        GIT_COMMIT_SHA=${{ github.event.inputs.commit || github.event.pull_request.head.sha || github.sha }}
-
-  run-trivy:
-    needs: [get-container-info, containerize]
-    strategy:
-      matrix:
-        edition: ${{ fromJson(needs.get-container-info.outputs.editions) }}
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    name: Run Trivy vulnerability scanner
-    steps:
-      - name: Check out the code
-        uses: actions/checkout@v6
-        with:
-          ref: ${{ github.event.inputs.commit || github.event.pull_request.head.sha || github.sha }}
-      - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
-        env:
-          TRIVY_OFFLINE_SCAN: true
-          repo: ${{ fromJson(needs.get-container-info.outputs[matrix.edition]).repo }}
-          tag: ${{ fromJson(needs.get-container-info.outputs[matrix.edition]).tag }}
-        with:
-          image-ref: docker.io/${{ env.repo }}:${{ env.tag }}
-          format: sarif
-          output: trivy-results.sarif
-      - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v3
-        with:
-          sarif_file: "trivy-results.sarif"
-
-  post-comment:
-    needs: [get-container-info, containerize]
-    if: github.event_name == 'pull_request'
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    name: Post PR comment
-    steps:
-      - name: Check out the code
-        uses: actions/checkout@v6
-      - name: Get Docker info for comment
-        id: docker-info
-        uses: ./.github/actions/get-docker-info
-        with:
-          branch: ${{ github.head_ref || github.ref_name }}
-          edition: ee
-
-      - name: Post PR comment
-        uses: marocchino/sticky-pull-request-comment@0ea0beb66eb9baf113663a64ec522f60e49231c0 # v3.0.4
-        with:
-          header: docker-build-status
-          message: |
-            ✅ Docker build completed for commit ${{ github.event.pull_request.head.sha || github.sha }}
-
-            The uberjar has been built and containerized successfully.
-
-            **Branch:** `${{ github.head_ref || github.ref_name }}`
-            **Docker Image:** `${{ steps.docker-info.outputs.full_image }}`
-            **Docker Hub:** [View on Docker Hub](https://hub.docker.com/r/${{ steps.docker-info.outputs.repo }}/tags?name=${{ steps.docker-info.outputs.tag }})
-            **Triggered by:** @${{ github.actor }}
-
-            Pull the image:
-            ```bash
-            docker pull ${{ steps.docker-info.outputs.full_image }}
-            ```

.github/workflows/cross-version.yml

@@ -27,7 +27,8 @@ jobs:
   # Generate matrix for scheduled/PR runs
   generate-matrix:
     if: github.event_name != 'workflow_dispatch' && github.repository == 'metabase/metabase'
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
+    timeout-minutes: 5
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
     steps:
@@ -97,9 +98,12 @@ jobs:
       - name: Show logs on failure
         if: failure()
         run: |
-          cd cross-version
-          docker compose logs metabase || true
-          docker compose logs postgres || true
+          for f in cross-version/logs/*.log; do
+            [ -e "$f" ] || continue
+            echo "::group::$f"
+            cat "$f"
+            echo "::endgroup::"
+          done
 
   # Notify Slack on nightly failures
   notify-on-failure:
@@ -221,6 +225,9 @@ jobs:
       - name: Show logs on failure
         if: failure()
         run: |
-          cd cross-version
-          docker compose logs metabase || true
-          docker compose logs postgres || true
+          for f in cross-version/logs/*.log; do
+            [ -e "$f" ] || continue
+            echo "::group::$f"
+            cat "$f"
+            echo "::endgroup::"
+          done

.github/workflows/cut-release-branch.yml

@@ -59,6 +59,12 @@ jobs:
       # Pushing the new branch triggers set-milestone.yml, which does the
       # full milestone backfill and then dispatches release-notes-preview
       # to upload the markdown to #writing.
+      #
+      # Kondo ignore ratchets apply only to master. The cut commit replaces the
+      # budgets with an explicit opt-out so future budget changes are not applied
+      # to the release branch. Keeping the opt-out in the canonical file avoids
+      # introducing a separate marker that could drift out of sync, and the
+      # backport helper writes the same opt-out so both paths stay identical.
       - name: Cut the branch
         id: cut
         run: |
@@ -66,6 +72,9 @@ jobs:
           git config user.name github-actions
           git config user.email github-actions@github.com
           git checkout -b "$BRANCH"
+          source .github/actions/create-backport/kondo-ratchets.sh
+          write_disabled_ratchets
+          git add --sparse .clj-kondo/ratchets.edn
           git commit --allow-empty --no-verify -m "Cut $BRANCH branch"
           git push -u origin "$BRANCH"
           echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"

.github/workflows/disabled-drivers-slack-notification.yml

@@ -1,88 +0,0 @@
-name: Disabled Drivers Slack Notification
-
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: "0 9 * * 1" # every Monday at 9:00 UTC
-
-jobs:
-  notify-disabled-drivers:
-    if: ${{ github.event_name != 'schedule' || github.repository == 'metabase/metabase' }}
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 5
-    steps:
-      - uses: actions/setup-node@v6.4.0
-        with:
-          node-version: lts/Jod
-
-      - name: Install Slack SDK
-        run: npm install @slack/web-api
-
-      - name: Check disabled drivers and notify Slack
-        uses: actions/github-script@v9
-        env:
-          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
-        with:
-          script: |
-            const { WebClient } = require('@slack/web-api');
-
-            // Fetch the config
-            const response = await fetch('https://raw.githubusercontent.com/metabase/ci-test-config/refs/heads/master/ci-test-config.json');
-            const config = await response.json();
-
-            const drivers = config.drivers || [];
-            const lastUpdated = config.metadata?.last_updated || 'unknown';
-            const reason = config.metadata?.reason || 'No reason provided';
-
-            // "skip" is the only status CI reads: the driver is not run at all. A driver that
-            // runs but must not gate is expressed as a suite-level rule in CI Conductor, which
-            // reports it in its own UI.
-            const skipped = drivers.filter(d => d.status === 'skip').map(d => d.name);
-
-            if (skipped.length === 0) {
-              console.log('No drivers are disabled. Skipping Slack notification.');
-              return;
-            }
-
-            const list = (names) => names.map(d => `\`${d}\``).join('  ');
-            const lines = [`:no_entry: *Disabled (not run):* ${list(skipped)}`];
-
-            if (!process.env.SLACK_BOT_TOKEN) {
-              throw new Error('SLACK_BOT_TOKEN is required');
-            }
-
-            const slack = new WebClient(process.env.SLACK_BOT_TOKEN);
-
-            await slack.chat.postMessage({
-              channel: 'engineering-ci',
-              text: 'CI Driver Status Report',
-              blocks: [
-                {
-                  type: 'section',
-                  text: {
-                    type: 'mrkdwn',
-                    text: `*CI Driver Status*\n${lines.join('\n')}`
-                  },
-                  accessory: {
-                    type: 'button',
-                    text: {
-                      type: 'plain_text',
-                      text: 'View Config',
-                      emoji: true
-                    },
-                    url: 'https://github.com/metabase/ci-test-config/blob/master/ci-test-config.json'
-                  }
-                },
-                {
-                  type: 'context',
-                  elements: [
-                    {
-                      type: 'mrkdwn',
-                      text: `${reason} · :clock1: *${lastUpdated}*`
-                    }
-                  ]
-                }
-              ]
-            });
-
-            console.log('Slack notification sent successfully');

.github/workflows/docs-generate-base.yml

@@ -33,6 +33,9 @@ jobs:
       - name: Prepare backend environment
         uses: ./.github/actions/prepare-backend
 
+      - name: Prepare frontend environment
+        uses: ./.github/actions/prepare-frontend
+
       - name: Set up Babashka
         uses: turtlequeue/setup-babashka@d78ec6570aea3b614bc695cafcceb82eb45c2af9 # v1.8.0
         with:
@@ -72,9 +75,36 @@ jobs:
           clojure -M:ee:doc command-documentation
         continue-on-error: false
 
+      - name: Generate AI provider documentation
+        id: generate_ai_provider_docs
+        # The generator only exists on branches that ship the multi-provider registry (master / 64+), but
+        # this reusable workflow always runs from master, so skip the step on release branches without it.
+        if: hashFiles('src/metabase/cmd/ai_provider_dox.clj') != ''
+        run: |
+          set -e  # Exit on any error
+          echo "Generating AI provider documentation..."
+          clojure -M:ee:doc ai-providers-documentation
+        continue-on-error: false
+
       - name: Generate usage analytics documentation
         run: ./bin/generate-usage-analytics-docs.bb
 
+      - name: Generate embedding SDK documentation
+        id: generate_embedding_sdk_docs
+        run: |
+          set -e  # Exit on any error
+          echo "Generating embedding SDK documentation..."
+          bun run embedding-sdk:docs:generate
+        continue-on-error: false
+
+      - name: Generate embedding EAJS documentation
+        id: generate_embedding_eajs_docs
+        run: |
+          set -e  # Exit on any error
+          echo "Generating embedding EAJS documentation..."
+          bun run embedding-eajs:docs:generate
+        continue-on-error: false
+
       - name: Check for changes
         id: check_changes
         run: |
@@ -145,7 +175,10 @@ jobs:
           - \`clojure -M:ee:doc config-template\`
           - \`clojure -M:ee:doc api-documentation\`
           - \`clojure -M:ee:doc command-documentation\`
+          - \`clojure -M:ee:doc ai-providers-documentation\`
           - \`./bin/generate-usage-analytics-docs.bb\`
+          - \`bun run embedding-sdk:docs:generate\`
+          - \`bun run embedding-eajs:docs:generate\`
 
           Please review the changes and merge if they look correct." \
               --label "Type:Documentation" \

.github/workflows/docs-links.yml

@@ -32,3 +32,9 @@ jobs:
           fail: true
           args: docs --config ./.lychee/config.toml --offline
           format: markdown
+
+      # lychee can't read the YAML nav, so this script renders it as markdown first. lychee is on PATH
+      # from the step above.
+      - name: Check nav.yml links
+        if: ${{ !cancelled() }}
+        run: docs/util/check-links.sh nav

.github/workflows/drivers-stress-test.yml

@@ -770,7 +770,7 @@ jobs:
 
   login-to-ecr:
     if: inputs.driver == 'Vertica'
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
     timeout-minutes: 15
     permissions:
       id-token: write

.github/workflows/drivers.yml

@@ -6,6 +6,49 @@ on:
       skip:
         type: boolean
         default: false
+      force-run:
+        description: Run the full suite regardless of the diff (master / release branches, ci:run-all label).
+        type: boolean
+        default: false
+  # Run one driver job on demand, against the ref you dispatch on, optionally under a profiler.
+  # Everything else about the job -- credentials, services, test args, quarantine gating -- is
+  # whatever the normal CI run uses, because it is the same job.
+  workflow_dispatch:
+    inputs:
+      driver:
+        description: 'Which driver job to run. Only this one runs; the usual decision rules are bypassed.'
+        type: choice
+        required: true
+        options:
+          - athena
+          - bigquery
+          - clickhouse
+          - databricks
+          - druid-jdbc
+          - h2
+          - mongo
+          - mongo-sharded-cluster
+          - mongo-ssl
+          - mysql-mariadb
+          - oracle
+          - postgres
+          - presto-jdbc
+          - redshift
+          - snowflake
+          - sparksql
+          - sqlite
+          - sqlserver
+          - vertica
+      tests:
+        description: 'Optional: run only these tests, comma- or space-separated, e.g. metabase.driver.bigquery-cloud-sdk-test/sync-test. Bare namespaces work too. Blank runs the job''s usual set.'
+        type: string
+        required: false
+        default: ''
+      profile:
+        description: 'Profile the test run and attach a flamegraph to the job. Adds sampling overhead.'
+        type: boolean
+        required: false
+        default: false
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref && github.ref || github.run_id }}-drivers
@@ -15,14 +58,23 @@ concurrency:
 # ci-conductor (secrets: inherit is already set on the drivers call in
 # run-tests.yml). See DEV-2224.
 env:
-  CI_CONDUCTOR_BASE_URL: ${{ secrets.CI_CONDUCTOR_BASE_URL }}
+  CI_CONDUCTOR_BASE_URL: ${{ vars.CI_CONDUCTOR_BASE_URL }}
   CI_CONDUCTOR_WEBHOOK_SECRET: ${{ secrets.CI_CONDUCTOR_WEBHOOK_SECRET }}
+  # Both read by the test-driver action, which is what actually runs the tests. Set here rather than
+  # passed as inputs to each job so that turning either on is one line, not one line per driver.
+  # Empty (and so off) on workflow_call, where neither input exists.
+  #
+  # ONLY_TESTS replaces the job's own test selection, so every matrix leg of the chosen driver runs
+  # the whole list -- BigQuery, for instance, has three legs.
+  PROFILE_TESTS: ${{ inputs.profile }}
+  ONLY_TESTS: ${{ inputs.tests }}
 
 jobs:
   # This job determines which driver tests should run based on PR context.
   # All decision logic is consolidated in mage driver-decisions.
   determine-driver-skips:
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 10
     outputs:
       # All driver run decisions (from mage driver-decisions)
       h2-should-run: ${{ steps.driver-decisions.outputs.h2-should-run }}
@@ -45,29 +97,11 @@ jobs:
       sqlite-should-run: ${{ steps.driver-decisions.outputs.sqlite-should-run }}
       sqlserver-should-run: ${{ steps.driver-decisions.outputs.sqlserver-should-run }}
       vertica-should-run: ${{ steps.driver-decisions.outputs.vertica-should-run }}
-      # Per-driver quarantine conflict flags (set when driver is quarantined but has file changes)
-      athena-quarantine-conflict: ${{ steps.driver-decisions.outputs.athena-quarantine-conflict }}
-      bigquery-quarantine-conflict: ${{ steps.driver-decisions.outputs.bigquery-quarantine-conflict }}
-      clickhouse-quarantine-conflict: ${{ steps.driver-decisions.outputs.clickhouse-quarantine-conflict }}
-      databricks-quarantine-conflict: ${{ steps.driver-decisions.outputs.databricks-quarantine-conflict }}
-      druid-quarantine-conflict: ${{ steps.driver-decisions.outputs.druid-quarantine-conflict }}
-      druid-jdbc-quarantine-conflict: ${{ steps.driver-decisions.outputs.druid-jdbc-quarantine-conflict }}
-      mongo-quarantine-conflict: ${{ steps.driver-decisions.outputs.mongo-quarantine-conflict }}
-      mongo-ssl-quarantine-conflict: ${{ steps.driver-decisions.outputs.mongo-ssl-quarantine-conflict }}
-      mongo-sharded-cluster-quarantine-conflict: ${{ steps.driver-decisions.outputs.mongo-sharded-cluster-quarantine-conflict }}
-      mysql-mariadb-quarantine-conflict: ${{ steps.driver-decisions.outputs.mysql-mariadb-quarantine-conflict }}
-      oracle-quarantine-conflict: ${{ steps.driver-decisions.outputs.oracle-quarantine-conflict }}
-      postgres-quarantine-conflict: ${{ steps.driver-decisions.outputs.postgres-quarantine-conflict }}
-      presto-jdbc-quarantine-conflict: ${{ steps.driver-decisions.outputs.presto-jdbc-quarantine-conflict }}
-      redshift-quarantine-conflict: ${{ steps.driver-decisions.outputs.redshift-quarantine-conflict }}
-      snowflake-quarantine-conflict: ${{ steps.driver-decisions.outputs.snowflake-quarantine-conflict }}
-      sparksql-quarantine-conflict: ${{ steps.driver-decisions.outputs.sparksql-quarantine-conflict }}
-      sqlite-quarantine-conflict: ${{ steps.driver-decisions.outputs.sqlite-quarantine-conflict }}
-      sqlserver-quarantine-conflict: ${{ steps.driver-decisions.outputs.sqlserver-quarantine-conflict }}
-      vertica-quarantine-conflict: ${{ steps.driver-decisions.outputs.vertica-quarantine-conflict }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
       - name: Fetch base branch
         if: github.event_name == 'pull_request' && github.event.pull_request.base.ref != ''
         run: |
@@ -80,9 +114,10 @@ jobs:
           # branch context, labels, and file changes to decide what runs.
           MAGE_ARGS=(
             --git-ref="${BASE_REF}"
-            --is-master-or-release="${IS_MASTER_OR_RELEASE}"
+            --force-run="${FORCE_RUN}"
             --pr-labels="${{ join(github.event.pull_request.labels.*.name, ',') }}"
             --skip="${{ inputs.skip }}"
+            --only-driver="${ONLY_DRIVER}"
           )
           echo "Running:"
           echo "./bin/mage -driver-decisions ${MAGE_ARGS[*]}"
@@ -96,12 +131,13 @@ jobs:
           ./bin/mage -driver-decisions "${MAGE_ARGS[@]}" --github-output-only >> "$GITHUB_OUTPUT"
         env:
           BASE_REF: ${{ github.event.pull_request.base.ref || github.ref_name }}
-          IS_MASTER_OR_RELEASE: ${{ github.ref_name == 'master' || startsWith(github.ref_name, 'release-x') }}
+          FORCE_RUN: ${{ inputs.force-run }}
+          ONLY_DRIVER: ${{ inputs.driver }}
         shell: bash
 
   be-tests-athena-ee:
     needs: determine-driver-skips
-    if: ${{ needs.determine-driver-skips.outputs.athena-should-run == 'true' || needs.determine-driver-skips.outputs.athena-quarantine-conflict == 'true' }}
+    if: ${{ needs.determine-driver-skips.outputs.athena-should-run == 'true' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     env:
@@ -118,16 +154,6 @@ jobs:
       MB_ATHENA_TEST_WITHOUT_GET_TABLE_METADATA_SECRET_KEY: ${{ secrets.MB_ATHENA_TEST_WITHOUT_GET_TABLE_METADATA_SECRET_KEY }}
     name: Athena
     steps:
-    - name: Fail on quarantine conflict
-      if: ${{ needs.determine-driver-skips.outputs.athena-quarantine-conflict == 'true' }}
-      run: |
-        echo "::error::Athena driver is quarantined but you changed files in modules/drivers/athena/"
-        echo ""
-        echo "Your changes will NOT be tested because the driver is currently quarantined."
-        echo "To run Athena tests, add the label: break-quarantine-athena"
-        echo ""
-        echo "If you merge without testing, you risk breaking the Athena driver!"
-        exit 1
     - uses: actions/checkout@v6
     - name: Test Athena driver
       id: test-driver
@@ -137,35 +163,16 @@ jobs:
         test-args: >-
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
-        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
 
   be-tests-bigquery-cloud-sdk-ee:
     needs: determine-driver-skips
-    if: ${{ needs.determine-driver-skips.outputs.bigquery-should-run == 'true' || needs.determine-driver-skips.outputs.bigquery-quarantine-conflict == 'true' }}
+    if: ${{ needs.determine-driver-skips.outputs.bigquery-should-run == 'true' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 70
+    timeout-minutes: 40
     strategy:
       fail-fast: false
       matrix:
-        job:
-          - name: Driver Tests Part 1
-            test-args: >-
-              :only-tags [:mb/driver-tests]
-              :exclude-tags [:mb/transforms-python-test]
-              :fail-fast? true
-              :partition/total 2
-              :partition/index 0
-          - name: Driver Tests Part 2
-            test-args: >-
-              :only-tags [:mb/driver-tests]
-              :exclude-tags [:mb/transforms-python-test]
-              :fail-fast? true
-              :partition/total 2
-              :partition/index 1
-          - name: Transforms Python Tests
-            test-args: >-
-              :only-tags [:mb/transforms-python-test]
-            needs-python-runner: true
+        runner-index: [0, 1]
     env:
       CI: 'true'
       DRIVERS: bigquery-cloud-sdk
@@ -176,21 +183,43 @@ jobs:
       MB_BIGQUERY_TEST_REFRESH_TOKEN: ${{ secrets.MB_BIGQUERY_TEST_REFRESH_TOKEN }}
       MB_BIGQUERY_CLOUD_SDK_TEST_SERVICE_ACCOUNT_JSON: ${{ secrets.MB_BIGQUERY_CLOUD_SDK_TEST_SERVICE_ACCOUNT_JSON }}
       MB_BIGQUERY_CLOUD_SDK_TEST_SERVICE_ACCOUNT_JSON_ROUTING: ${{ secrets.MB_BIGQUERY_CLOUD_SDK_TEST_SERVICE_ACCOUNT_JSON_ROUTING }}
-    name: BigQuery ${{ matrix.job.name }}
+    name: BigQuery Driver Tests ${{ matrix.runner-index }}
+    steps:
+    - uses: actions/checkout@v6
+    - name: Test BigQuery Cloud SDK driver
+      id: test-driver
+      uses: ./.github/actions/test-driver
+      with:
+        junit-name: 'be-tests-bigquery-cloud-sdk-ee'
+        test-args: >-
+          :only-tags [:mb/driver-tests]
+          :exclude-tags [:mb/transforms-python-test]
+          :fail-fast? true
+        runner-index: ${{ matrix.runner-index }}
+        runner-count: ${{ strategy.job-total }}
+        jvms-per-runner: '2'
+        heap-per-jvm: '4g'
+        artifact-suffix: runner-${{ matrix.runner-index }}
+
+  be-tests-bigquery-transforms-python-ee:
+    needs: determine-driver-skips
+    if: ${{ needs.determine-driver-skips.outputs.bigquery-should-run == 'true' }}
+    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    timeout-minutes: 30
+    env:
+      CI: 'true'
+      DRIVERS: bigquery-cloud-sdk
+      MB_BIGQUERY_TEST_PROJECT_ID: ${{ secrets.BIGQUERY_TEST_PROJECT_ID }}
+      MB_BIGQUERY_TEST_CLIENT_ID: ${{ secrets.MB_BIGQUERY_TEST_CLIENT_ID }}
+      MB_BIGQUERY_TEST_CLIENT_SECRET: ${{ secrets.MB_BIGQUERY_TEST_CLIENT_SECRET }}
+      MB_BIGQUERY_TEST_ACCESS_TOKEN: ${{ secrets.MB_BIGQUERY_TEST_ACCESS_TOKEN }}
+      MB_BIGQUERY_TEST_REFRESH_TOKEN: ${{ secrets.MB_BIGQUERY_TEST_REFRESH_TOKEN }}
+      MB_BIGQUERY_CLOUD_SDK_TEST_SERVICE_ACCOUNT_JSON: ${{ secrets.MB_BIGQUERY_CLOUD_SDK_TEST_SERVICE_ACCOUNT_JSON }}
+      MB_BIGQUERY_CLOUD_SDK_TEST_SERVICE_ACCOUNT_JSON_ROUTING: ${{ secrets.MB_BIGQUERY_CLOUD_SDK_TEST_SERVICE_ACCOUNT_JSON_ROUTING }}
+    name: BigQuery Transforms Python Tests
     steps:
-    - name: Fail on quarantine conflict
-      if: ${{ needs.determine-driver-skips.outputs.bigquery-quarantine-conflict == 'true' }}
-      run: |
-        echo "::error::BigQuery driver is quarantined but you changed files in modules/drivers/bigquery-cloud-sdk/"
-        echo ""
-        echo "Your changes will NOT be tested because the driver is currently quarantined."
-        echo "To run BigQuery tests, add the label: break-quarantine-bigquery"
-        echo ""
-        echo "If you merge without testing, you risk breaking the BigQuery driver!"
-        exit 1
     - uses: actions/checkout@v6
     - name: Setup python-runner
-      if: ${{ matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/setup-python-runner
       with:
         metabase-automation-token: ${{ secrets.METABASE_AUTOMATION_USER_TOKEN }}
@@ -198,20 +227,21 @@ jobs:
       id: test-driver
       uses: ./.github/actions/test-driver
       with:
+        # This is the same as the cloud-sdk job above to preserve quarantine history in ci-conductor.
         junit-name: 'be-tests-bigquery-cloud-sdk-ee'
-        test-args: ${{ matrix.job.test-args }}
-        artifact-suffix: ${{ matrix.job.name }}
-        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
+        test-args: >-
+          :only-tags [:mb/transforms-python-test]
+        artifact-suffix: transforms-python
     - name: Cleanup python-runner
-      if: ${{ always() && matrix.job.needs-python-runner == true }}
+      if: ${{ always() }}
       uses: ./.github/actions/cleanup-python-runner
       with:
         upload-logs: ${{ steps.test-driver.outcome == 'failure' }}
-        logs-artifact-suffix: ${{ matrix.job.name }}
+        logs-artifact-suffix: transforms-python
 
   be-tests-clickhouse-ee:
     needs: determine-driver-skips
-    if: ${{ needs.determine-driver-skips.outputs.clickhouse-should-run == 'true' || needs.determine-driver-skips.outputs.clickhouse-quarantine-conflict == 'true' }}
+    if: ${{ needs.determine-driver-skips.outputs.clickhouse-should-run == 'true' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     strategy:
@@ -235,16 +265,6 @@ jobs:
       MB_CLICKHOUSE_TEST_NGINX_PORT: 8127
     name: Clickhouse ${{ matrix.job.name }}
     steps:
-    - name: Fail on quarantine conflict
-      if: ${{ needs.determine-driver-skips.outputs.clickhouse-quarantine-conflict == 'true' }}
-      run: |
-        echo "::error::ClickHouse driver is quarantined but you changed files in modules/drivers/clickhouse/"
-        echo ""
-        echo "Your changes will NOT be tested because the driver is currently quarantined."
-        echo "To run ClickHouse tests, add the label: break-quarantine-clickhouse"
-        echo ""
-        echo "If you merge without testing, you risk breaking the ClickHouse driver!"
-        exit 1
     - uses: actions/checkout@v6
     - name: Setup python-runner
       if: ${{ matrix.job.needs-python-runner == true }}
@@ -274,7 +294,6 @@ jobs:
         junit-name: 'be-tests-clickhouse-ee'
         test-args: ${{ matrix.job.test-args }}
         artifact-suffix: ${{ matrix.job.name }}
-        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -284,7 +303,7 @@ jobs:
 
   be-tests-druid-jdbc-ee:
     needs: determine-driver-skips
-    if: ${{ needs.determine-driver-skips.outputs.druid-jdbc-should-run == 'true' || needs.determine-driver-skips.outputs.druid-jdbc-quarantine-conflict == 'true' }}
+    if: ${{ needs.determine-driver-skips.outputs.druid-jdbc-should-run == 'true' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     env:
@@ -299,16 +318,6 @@ jobs:
           CLUSTER_SIZE: nano-quickstart
     name: Druid (JDBC)
     steps:
-    - name: Fail on quarantine conflict
-      if: ${{ needs.determine-driver-skips.outputs.druid-jdbc-quarantine-conflict == 'true' }}
-      run: |
-        echo "::error::Druid JDBC driver is quarantined but you changed files in modules/drivers/druid-jdbc/"
-        echo ""
-        echo "Your changes will NOT be tested because the driver is currently quarantined."
-        echo "To run Druid JDBC tests, add the label: break-quarantine-druid-jdbc"
-        echo ""
-        echo "If you merge without testing, you risk breaking the Druid JDBC driver!"
-        exit 1
     - uses: actions/checkout@v6
     - name: Test Druid JDBC driver
       id: test-driver
@@ -318,11 +327,10 @@ jobs:
         test-args: >-
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
-        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
 
   be-tests-databricks-ee:
     needs: determine-driver-skips
-    if: ${{ needs.determine-driver-skips.outputs.databricks-should-run == 'true' || needs.determine-driver-skips.outputs.databricks-quarantine-conflict == 'true' }}
+    if: ${{ needs.determine-driver-skips.outputs.databricks-should-run == 'true' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 50
     strategy:
@@ -334,44 +342,45 @@ jobs:
               :only-tags [:mb/driver-tests]
               :exclude-tags [:mb/transforms-python-test]
               :fail-fast? true
-              :partition/total 3
+              :partition/total 2
               :partition/index 0
           - name: Driver Tests Part 2
             test-args: >-
               :only-tags [:mb/driver-tests]
               :exclude-tags [:mb/transforms-python-test]
               :fail-fast? true
-              :partition/total 3
+              :partition/total 2
               :partition/index 1
-          - name: Driver Tests Part 3
-            test-args: >-
-              :only-tags [:mb/driver-tests]
-              :exclude-tags [:mb/transforms-python-test]
-              :fail-fast? true
-              :partition/total 3
-              :partition/index 2
     env:
       CI: 'true'
       DRIVERS: databricks
-      MB_DATABRICKS_TEST_HOST: ${{ secrets.MB_DATABRICKS_JDBC_TEST_HOST }}
-      MB_DATABRICKS_TEST_HTTP_PATH: ${{ secrets.MB_DATABRICKS_JDBC_TEST_HTTP_PATH }}
-      MB_DATABRICKS_TEST_TOKEN: ${{ secrets.MB_DATABRICKS_JDBC_TEST_TOKEN }}
       MB_DATABRICKS_TEST_CATALOG: 'metabase_ci'
       MB_DATABRICKS_TEST_CATALOG_ROUTING: 'metabase_routing_catalog'
       MB_DATABRICKS_TEST_CLIENT_ID: ${{ secrets.MB_DATABRICKS_JDBC_TEST_CLIENT_ID }}
       MB_DATABRICKS_TEST_OAUTH_SECRET: ${{ secrets.MB_DATABRICKS_JDBC_TEST_OAUTH_SECRET }}
     name: Databricks
     steps:
-    - name: Fail on quarantine conflict
-      if: ${{ needs.determine-driver-skips.outputs.databricks-quarantine-conflict == 'true' }}
-      run: |
-        echo "::error::Databricks driver is quarantined but you changed files in modules/drivers/databricks/"
-        echo ""
-        echo "Your changes will NOT be tested because the driver is currently quarantined."
-        echo "To run Databricks tests, add the label: break-quarantine-databricks"
-        echo ""
-        echo "If you merge without testing, you risk breaking the Databricks driver!"
-        exit 1
+    - name: Select Databricks workspace
+      shell: bash
+      env:
+        TOTAL_SHARDS: '2'
+        HOST_0: ${{ secrets.MB_DATABRICKS_JDBC_TEST_HOST }}
+        TOKEN_0: ${{ secrets.MB_DATABRICKS_JDBC_TEST_TOKEN }}
+        HTTP_PATH_0: ${{ secrets.MB_DATABRICKS_JDBC_TEST_HTTP_PATH }}
+        HOST_1: ${{ secrets.MB_DATABRICKS_JDBC_TEST_HOST_2 }}
+        TOKEN_1: ${{ secrets.MB_DATABRICKS_JDBC_TEST_TOKEN_2 }}
+        HTTP_PATH_1: ${{ secrets.MB_DATABRICKS_JDBC_TEST_HTTP_PATH_2 }}
+      run: | # sh
+        shard=$(( GITHUB_RUN_NUMBER % TOTAL_SHARDS ))
+        echo "Using Databricks workspace shard $(( shard + 1 )) of $TOTAL_SHARDS"
+        for name in HOST HTTP_PATH TOKEN; do
+          var="${name}_${shard}"
+          if [ -z "${!var}" ]; then
+            echo "::error::Secret $var is empty - is the shard $shard Databricks workspace configured?"
+            exit 1
+          fi
+          echo "MB_DATABRICKS_TEST_${name}=${!var}" >> "$GITHUB_ENV"
+        done
     - uses: actions/checkout@v6
     - name: Test Databricks driver
       id: test-driver
@@ -380,70 +389,6 @@ jobs:
         junit-name: 'be-tests-databricks-ee'
         artifact-suffix: ${{ matrix.job.name }}
         test-args: ${{ matrix.job.test-args }}
-        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
-
-  be-tests-databricks-multi-catalog-ee:
-    needs: determine-driver-skips
-    if: ${{ needs.determine-driver-skips.outputs.databricks-should-run == 'true' || needs.determine-driver-skips.outputs.databricks-quarantine-conflict == 'true' }}
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
-    timeout-minutes: 50
-    strategy:
-      fail-fast: false
-      matrix:
-        job:
-          - name: Driver Tests Part 1
-            test-args: >-
-              :only-tags [:mb/driver-tests]
-              :exclude-tags [:mb/transforms-python-test]
-              :fail-fast? true
-              :partition/total 3
-              :partition/index 0
-          - name: Driver Tests Part 2
-            test-args: >-
-              :only-tags [:mb/driver-tests]
-              :exclude-tags [:mb/transforms-python-test]
-              :fail-fast? true
-              :partition/total 3
-              :partition/index 1
-          - name: Driver Tests Part 3
-            test-args: >-
-              :only-tags [:mb/driver-tests]
-              :exclude-tags [:mb/transforms-python-test]
-              :fail-fast? true
-              :partition/total 3
-              :partition/index 2
-    env:
-      CI: 'true'
-      DRIVERS: databricks
-      MB_DATABRICKS_TEST_MULTI_LEVEL_SCHEMA: true
-      MB_DATABRICKS_TEST_HOST: ${{ secrets.MB_DATABRICKS_JDBC_TEST_HOST }}
-      MB_DATABRICKS_TEST_HTTP_PATH: ${{ secrets.MB_DATABRICKS_JDBC_TEST_HTTP_PATH }}
-      MB_DATABRICKS_TEST_TOKEN: ${{ secrets.MB_DATABRICKS_JDBC_TEST_TOKEN }}
-      MB_DATABRICKS_TEST_CATALOG: 'metabase_ci'
-      MB_DATABRICKS_TEST_CATALOG_ROUTING: 'metabase_routing_catalog'
-      MB_DATABRICKS_TEST_CLIENT_ID: ${{ secrets.MB_DATABRICKS_JDBC_TEST_CLIENT_ID }}
-      MB_DATABRICKS_TEST_OAUTH_SECRET: ${{ secrets.MB_DATABRICKS_JDBC_TEST_OAUTH_SECRET }}
-    name: Databricks (Multi-Catalog)
-    steps:
-    - name: Fail on quarantine conflict
-      if: ${{ needs.determine-driver-skips.outputs.databricks-quarantine-conflict == 'true' }}
-      run: |
-        echo "::error::Databricks driver is quarantined but you changed files in modules/drivers/databricks/"
-        echo ""
-        echo "Your changes will NOT be tested because the driver is currently quarantined."
-        echo "To run Databricks tests, add the label: break-quarantine-databricks"
-        echo ""
-        echo "If you merge without testing, you risk breaking the Databricks driver!"
-        exit 1
-    - uses: actions/checkout@v6
-    - name: Test Databricks driver with multi-catalog
-      id: test-driver
-      uses: ./.github/actions/test-driver
-      with:
-        junit-name: 'be-tests-databricks-multi-catalog-ee'
-        artifact-suffix: ${{ matrix.job.name }}
-        test-args: ${{ matrix.job.test-args }}
-        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
 
   be-tests-h2:
     needs: determine-driver-skips
@@ -463,7 +408,6 @@ jobs:
         test-args: >-
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
-        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
 
   be-tests-h2-oss:
     needs: determine-driver-skips
@@ -484,7 +428,6 @@ jobs:
         test-args: >-
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
-        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
 
   be-tests-mysql-mariadb:
     needs: determine-driver-skips
@@ -549,21 +492,9 @@ jobs:
           MYSQL_ALLOW_EMPTY_PASSWORD: true
           MYSQL_DATABASE: mb_test
     env:
-      # Only run old migrations tests on pushes to master or release branches. All other branches should skip tests
-      # with the tag `mb/old-migrations-test`. `__ADDITIONAL_EXCLUDED_TAG__` is not used anywhere outside of splicing
-      # it in to the command below.
-      __ADDITIONAL_EXCLUDED_TAG__: >-
-        ${{
-          (
-            github.event_name == 'push' &&
-            (
-              github.ref_name == 'master' ||
-              startsWith(github.ref_name, 'release-x')
-            ) &&
-            ''
-          ) ||
-          ':mb/old-migrations-test'
-        }}
+      # __ADDITIONAL_EXCLUDED_TAG__: ${{ !inputs.force-run && ':mb/old-migrations-test' || '' }}
+      # GDGT-3126: re-enable and properly fix old migrations tests
+      __ADDITIONAL_EXCLUDED_TAG__: ':mb/old-migrations-test'
       # actual serious env vars below
       CI: 'true'
       DRIVERS: mysql
@@ -615,7 +546,6 @@ jobs:
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[ ${{ matrix.job.exclude-tag }} ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
-          quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
       - name: Cleanup python-runner
         if: always()
         uses: ./.github/actions/cleanup-python-runner
@@ -625,7 +555,7 @@ jobs:
 
   be-tests-mongo:
     needs: determine-driver-skips
-    if: ${{ needs.determine-driver-skips.outputs.mongo-should-run == 'true' || needs.determine-driver-skips.outputs.mongo-quarantine-conflict == 'true' }}
+    if: ${{ needs.determine-driver-skips.outputs.mongo-should-run == 'true' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     strategy:
@@ -662,16 +592,6 @@ jobs:
           MONGO_INITDB_ROOT_PASSWORD: metasample123
     name: ${{ matrix.version.name }} ${{ matrix.job.name }}
     steps:
-    - name: Fail on quarantine conflict
-      if: ${{ needs.determine-driver-skips.outputs.mongo-quarantine-conflict == 'true' }}
-      run: |
-        echo "::error::MongoDB driver is quarantined but you changed files in modules/drivers/mongo/"
-        echo ""
-        echo "Your changes will NOT be tested because the driver is currently quarantined."
-        echo "To run MongoDB tests, add the label: break-quarantine-mongo"
-        echo ""
-        echo "If you merge without testing, you risk breaking the MongoDB driver!"
-        exit 1
     - uses: actions/checkout@v6
     - name: Setup python-runner
       if: ${{ matrix.job.needs-python-runner == true }}
@@ -685,7 +605,6 @@ jobs:
         junit-name: ${{ matrix.version.junit-name }}
         test-args: ${{ matrix.job.test-args }}
         artifact-suffix: ${{ matrix.version.name }}-${{ matrix.job.name }}
-        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -695,7 +614,7 @@ jobs:
 
   be-tests-mongo-ssl:
     needs: determine-driver-skips
-    if: ${{ needs.determine-driver-skips.outputs.mongo-ssl-should-run == 'true' || needs.determine-driver-skips.outputs.mongo-ssl-quarantine-conflict == 'true' }}
+    if: ${{ needs.determine-driver-skips.outputs.mongo-ssl-should-run == 'true' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     strategy:
@@ -713,16 +632,6 @@ jobs:
       MB_TEST_MONGO_REQUIRES_SSL: true
     name: "${{ matrix.version.name }} (SSL)"
     steps:
-      - name: Fail on quarantine conflict
-        if: ${{ needs.determine-driver-skips.outputs.mongo-ssl-quarantine-conflict == 'true' }}
-        run: |
-          echo "::error::MongoDB SSL driver is quarantined but you changed files in modules/drivers/mongo/"
-          echo ""
-          echo "Your changes will NOT be tested because the driver is currently quarantined."
-          echo "To run MongoDB SSL tests, add the label: break-quarantine-mongo-ssl"
-          echo ""
-          echo "If you merge without testing, you risk breaking the MongoDB SSL driver!"
-          exit 1
       - uses: actions/checkout@v6
       - name: Spin up Mongo docker container
         run: >-
@@ -757,11 +666,10 @@ jobs:
           test-args: >-
             :exclude-tags '[:mongo-sharded-cluster-tests :mb/transforms-python-test]'
             :only-tags [:mb/driver-tests]
-          quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
 
   be-tests-mongo-sharded-cluster-ee:
     needs: determine-driver-skips
-    if: ${{ needs.determine-driver-skips.outputs.mongo-sharded-cluster-should-run == 'true' || needs.determine-driver-skips.outputs.mongo-sharded-cluster-quarantine-conflict == 'true' }}
+    if: ${{ needs.determine-driver-skips.outputs.mongo-sharded-cluster-should-run == 'true' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     env:
@@ -774,16 +682,6 @@ jobs:
           - "27017:17017"
     name: MongoDB Sharded Cluster
     steps:
-    - name: Fail on quarantine conflict
-      if: ${{ needs.determine-driver-skips.outputs.mongo-sharded-cluster-quarantine-conflict == 'true' }}
-      run: |
-        echo "::error::MongoDB Sharded Cluster driver is quarantined but you changed files in modules/drivers/mongo/"
-        echo ""
-        echo "Your changes will NOT be tested because the driver is currently quarantined."
-        echo "To run MongoDB Sharded Cluster tests, add the label: break-quarantine-mongo-sharded-cluster"
-        echo ""
-        echo "If you merge without testing, you risk breaking the MongoDB Sharded Cluster driver!"
-        exit 1
     - uses: actions/checkout@v6
     - name: Test MongoDB driver (Sharded cluster)
       id: test-driver
@@ -792,11 +690,10 @@ jobs:
         junit-name: 'be-tests-mongo-sharded-cluster-ee'
         test-args: >-
           :only metabase.driver.mongo.sharded-cluster-test
-        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
 
   be-tests-oracle:
     needs: determine-driver-skips
-    if: ${{ needs.determine-driver-skips.outputs.oracle-should-run == 'true' || needs.determine-driver-skips.outputs.oracle-quarantine-conflict == 'true' }}
+    if: ${{ needs.determine-driver-skips.outputs.oracle-should-run == 'true' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     strategy:
@@ -847,16 +744,6 @@ jobs:
           - "1521:${{ matrix.version.port }}"
     name: ${{ matrix.version.name }}
     steps:
-    - name: Fail on quarantine conflict
-      if: ${{ needs.determine-driver-skips.outputs.oracle-quarantine-conflict == 'true' }}
-      run: |
-        echo "::error::Oracle driver is quarantined but you changed files in modules/drivers/oracle/"
-        echo ""
-        echo "Your changes will NOT be tested because the driver is currently quarantined."
-        echo "To run Oracle tests, add the label: break-quarantine-oracle"
-        echo ""
-        echo "If you merge without testing, you risk breaking the Oracle driver!"
-        exit 1
     - uses: actions/checkout@v6
     - name: Test ${{ matrix.version.name }}
       id: test-driver
@@ -867,7 +754,6 @@ jobs:
         test-args: >-
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
-        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
 
   be-tests-postgres:
     needs: determine-driver-skips
@@ -891,9 +777,20 @@ jobs:
               enable-ssl-tests: 'true'
               enable-aws-iam-tests: 'true'
         job:
-          - name: Driver Tests
+          # Split because the unpartitioned Driver Tests job was running ~40 minutes of tests against
+          # `timeout-minutes: 50` (checkout and prepare-backend take the rest), and Postgres Latest was
+          # timing out.
+          - name: Driver Tests Part 1
             test-args: >-
               :only-tags [:mb/driver-tests]
+              :partition/total 2
+              :partition/index 0
+            exclude-tag: ':mb/transforms-python-test'
+          - name: Driver Tests Part 2
+            test-args: >-
+              :only-tags [:mb/driver-tests]
+              :partition/total 2
+              :partition/index 1
             exclude-tag: ':mb/transforms-python-test'
           - name: Transforms Python Tests
             test-args: >-
@@ -901,21 +798,9 @@ jobs:
             needs-python-runner: true
     name: "${{ matrix.version.name }} ${{ matrix.job.name }}"
     env:
-      # Only run old migrations tests on pushes to master or release branches. All other branches should skip tests
-      # with the tag `mb/old-migrations-test`. `__ADDITIONAL_EXCLUDED_TAG__` is not used anywhere outside of splicing
-      # it in to the command below.
-      __ADDITIONAL_EXCLUDED_TAG__: >-
-        ${{
-          (
-            github.event_name == 'push' &&
-            (
-              github.ref_name == 'master' ||
-              startsWith(github.ref_name, 'release-x')
-            ) &&
-            ''
-          ) ||
-          ':mb/old-migrations-test'
-        }}
+      # __ADDITIONAL_EXCLUDED_TAG__: ${{ !inputs.force-run && ':mb/old-migrations-test' || '' }}
+      # GDGT-3126: re-enable and properly fix old migrations tests
+      __ADDITIONAL_EXCLUDED_TAG__: ':mb/old-migrations-test'
       # actual serious env vars below
       CI: 'true'
       DRIVERS: postgres
@@ -961,7 +846,6 @@ jobs:
           test-args: >-
             ${{ matrix.job.test-args }}
             :exclude-tags '[ ${{ matrix.job.exclude-tag }} ${{ env.__ADDITIONAL_EXCLUDED_TAG__ }}]'
-          quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
       - name: Cleanup python-runner
         if: always()
         uses: ./.github/actions/cleanup-python-runner
@@ -971,7 +855,7 @@ jobs:
 
   be-tests-presto-jdbc-ee:
     needs: determine-driver-skips
-    if: ${{ needs.determine-driver-skips.outputs.presto-jdbc-should-run == 'true' || needs.determine-driver-skips.outputs.presto-jdbc-quarantine-conflict == 'true' }}
+    if: ${{ needs.determine-driver-skips.outputs.presto-jdbc-should-run == 'true' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     env:
@@ -994,16 +878,6 @@ jobs:
         env:
           JAVA_TOOL_OPTIONS: "-Xmx2g"
     steps:
-    - name: Fail on quarantine conflict
-      if: ${{ needs.determine-driver-skips.outputs.presto-jdbc-quarantine-conflict == 'true' }}
-      run: |
-        echo "::error::Presto JDBC driver is quarantined but you changed files in modules/drivers/presto-jdbc/"
-        echo ""
-        echo "Your changes will NOT be tested because the driver is currently quarantined."
-        echo "To run Presto JDBC tests, add the label: break-quarantine-presto-jdbc"
-        echo ""
-        echo "If you merge without testing, you risk breaking the Presto JDBC driver!"
-        exit 1
     - uses: actions/checkout@v6
     - uses: ./.github/actions/await-port
       with:
@@ -1038,11 +912,10 @@ jobs:
         test-args: >-
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
-        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
 
   be-tests-redshift-ee:
     needs: determine-driver-skips
-    if: ${{ needs.determine-driver-skips.outputs.redshift-should-run == 'true' || needs.determine-driver-skips.outputs.redshift-quarantine-conflict == 'true' }}
+    if: ${{ needs.determine-driver-skips.outputs.redshift-should-run == 'true' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 50
     strategy:
@@ -1054,17 +927,44 @@ jobs:
             test-args: >-
               :only-tags [:mb/upload-tests]
               :fail-fast? true
-          - name: Redshift (Excluding Upload Tests) Part 1
+          # `:partition/*` balances on test-var count, so it cannot break up a block of namespaces that is
+          # cheap in vars and expensive in seconds. The `metabase-enterprise.*` driver tests are exactly that:
+          # ~10% of the vars and ~40% of the wall clock, and they sort ahead of `metabase.*`, so a plain 2-way
+          # split hands one job the whole block and times out. Splitting on the namespace pattern first puts
+          # them in their own pair of jobs, and each pair then partitions by count within a comparable cost.
+          # The two patterns are exhaustive over the default `:namespace-pattern` -- every namespace lands in
+          # exactly one of them -- so nothing stops running when a namespace is added.
+          - name: Redshift EE (Excluding Upload Tests) Part 1
             skip: false
             test-args: >-
+              :namespace-pattern '"^metabase-enterprise[.].*"'
               :only-tags [:mb/driver-tests]
               :exclude-tags '[:mb/upload-tests :mb/transforms-python-test]'
               :fail-fast? true
               :partition/total 2
               :partition/index 0
-          - name: Redshift (Excluding Upload Tests) Part 2
+          - name: Redshift EE (Excluding Upload Tests) Part 2
             skip: false
             test-args: >-
+              :namespace-pattern '"^metabase-enterprise[.].*"'
+              :only-tags [:mb/driver-tests]
+              :exclude-tags '[:mb/upload-tests :mb/transforms-python-test]'
+              :fail-fast? true
+              :partition/total 2
+              :partition/index 1
+          - name: Redshift OSS (Excluding Upload Tests) Part 1
+            skip: false
+            test-args: >-
+              :namespace-pattern '"^(?:metabase[.]|hooks[.]).*"'
+              :only-tags [:mb/driver-tests]
+              :exclude-tags '[:mb/upload-tests :mb/transforms-python-test]'
+              :fail-fast? true
+              :partition/total 2
+              :partition/index 0
+          - name: Redshift OSS (Excluding Upload Tests) Part 2
+            skip: false
+            test-args: >-
+              :namespace-pattern '"^(?:metabase[.]|hooks[.]).*"'
               :only-tags [:mb/driver-tests]
               :exclude-tags '[:mb/upload-tests :mb/transforms-python-test]'
               :fail-fast? true
@@ -1087,16 +987,6 @@ jobs:
       MB_REDSHIFT_TEST_PASSWORD: ${{ secrets.MB_REDSHIFT_TEST_PASSWORD }}
     name: ${{ matrix.job.name }}
     steps:
-    - name: Fail on quarantine conflict
-      if: ${{ needs.determine-driver-skips.outputs.redshift-quarantine-conflict == 'true' }}
-      run: |
-        echo "::error::Redshift driver is quarantined but you changed files in modules/drivers/redshift/"
-        echo ""
-        echo "Your changes will NOT be tested because the driver is currently quarantined."
-        echo "To run Redshift tests, add the label: break-quarantine-redshift"
-        echo ""
-        echo "If you merge without testing, you risk breaking the Redshift driver!"
-        exit 1
     - uses: actions/checkout@v6
     - name: Setup python-runner
       if: ${{ matrix.job.needs-python-runner == true }}
@@ -1112,7 +1002,6 @@ jobs:
         test-args: >-
           ${{ matrix.job.test-args }}
         artifact-suffix: ${{ matrix.job.name }}
-        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -1122,7 +1011,7 @@ jobs:
 
   be-tests-snowflake-ee:
     needs: determine-driver-skips
-    if: ${{ needs.determine-driver-skips.outputs.snowflake-should-run == 'true' || needs.determine-driver-skips.outputs.snowflake-quarantine-conflict == 'true' }}
+    if: ${{ needs.determine-driver-skips.outputs.snowflake-should-run == 'true' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 70
     strategy:
@@ -1162,16 +1051,6 @@ jobs:
       MB_SNOWFLAKE_TEST_RSA_ROLE_TEST_DB: RSA_ROLE_TEST_DB
     name: Snowflake ${{ matrix.job.name }}
     steps:
-    - name: Fail on quarantine conflict
-      if: ${{ needs.determine-driver-skips.outputs.snowflake-quarantine-conflict == 'true' }}
-      run: |
-        echo "::error::Snowflake driver is quarantined but you changed files in modules/drivers/snowflake/"
-        echo ""
-        echo "Your changes will NOT be tested because the driver is currently quarantined."
-        echo "To run Snowflake tests, add the label: break-quarantine-snowflake"
-        echo ""
-        echo "If you merge without testing, you risk breaking the Snowflake driver!"
-        exit 1
     - uses: actions/checkout@v6
     - name: Setup python-runner
       if: ${{ matrix.job.needs-python-runner == true }}
@@ -1185,7 +1064,6 @@ jobs:
         junit-name: 'be-tests-snowflake-ee'
         test-args: ${{ matrix.job.test-args }}
         artifact-suffix: ${{ matrix.job.name }}
-        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -1195,7 +1073,7 @@ jobs:
 
   be-tests-sparksql-ee:
     needs: determine-driver-skips
-    if: ${{ needs.determine-driver-skips.outputs.sparksql-should-run == 'true' || needs.determine-driver-skips.outputs.sparksql-quarantine-conflict == 'true' }}
+    if: ${{ needs.determine-driver-skips.outputs.sparksql-should-run == 'true' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     env:
@@ -1208,16 +1086,6 @@ jobs:
           - "10000:10000"
     name: Spark SQL
     steps:
-    - name: Fail on quarantine conflict
-      if: ${{ needs.determine-driver-skips.outputs.sparksql-quarantine-conflict == 'true' }}
-      run: |
-        echo "::error::SparkSQL driver is quarantined but you changed files in modules/drivers/sparksql/"
-        echo ""
-        echo "Your changes will NOT be tested because the driver is currently quarantined."
-        echo "To run SparkSQL tests, add the label: break-quarantine-sparksql"
-        echo ""
-        echo "If you merge without testing, you risk breaking the SparkSQL driver!"
-        exit 1
     - uses: actions/checkout@v6
     - name: Test Spark driver
       id: test-driver
@@ -1227,11 +1095,10 @@ jobs:
         test-args: >-
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
-        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
 
   be-tests-sqlite-ee:
     needs: determine-driver-skips
-    if: ${{ needs.determine-driver-skips.outputs.sqlite-should-run == 'true' || needs.determine-driver-skips.outputs.sqlite-quarantine-conflict == 'true' }}
+    if: ${{ needs.determine-driver-skips.outputs.sqlite-should-run == 'true' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     env:
@@ -1239,16 +1106,6 @@ jobs:
       DRIVERS: sqlite
     name: SQLite
     steps:
-    - name: Fail on quarantine conflict
-      if: ${{ needs.determine-driver-skips.outputs.sqlite-quarantine-conflict == 'true' }}
-      run: |
-        echo "::error::SQLite driver is quarantined but you changed files that affect it"
-        echo ""
-        echo "Your changes will NOT be tested because the driver is currently quarantined."
-        echo "To run SQLite tests, add the label: break-quarantine-sqlite"
-        echo ""
-        echo "If you merge without testing, you risk breaking the SQLite driver!"
-        exit 1
     - uses: actions/checkout@v6
     - name: Test SQLite driver
       id: test-driver
@@ -1258,11 +1115,10 @@ jobs:
         test-args: >-
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
-        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
 
   be-tests-sqlserver:
     needs: determine-driver-skips
-    if: ${{ needs.determine-driver-skips.outputs.sqlserver-should-run == 'true' || needs.determine-driver-skips.outputs.sqlserver-quarantine-conflict == 'true' }}
+    if: ${{ needs.determine-driver-skips.outputs.sqlserver-should-run == 'true' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 30
     strategy:
@@ -1301,16 +1157,6 @@ jobs:
           MSSQL_MEMORY_LIMIT_MB: 1024
     name: ${{ matrix.version.name }} ${{ matrix.job.name }}
     steps:
-    - name: Fail on quarantine conflict
-      if: ${{ needs.determine-driver-skips.outputs.sqlserver-quarantine-conflict == 'true' }}
-      run: |
-        echo "::error::SQL Server driver is quarantined but you changed files in modules/drivers/sqlserver/"
-        echo ""
-        echo "Your changes will NOT be tested because the driver is currently quarantined."
-        echo "To run SQL Server tests, add the label: break-quarantine-sqlserver"
-        echo ""
-        echo "If you merge without testing, you risk breaking the SQL Server driver!"
-        exit 1
     - uses: actions/checkout@v6
     - name: Setup python-runner
       if: ${{ matrix.job.needs-python-runner == true }}
@@ -1324,7 +1170,6 @@ jobs:
         junit-name: ${{ matrix.version.junit-name }}
         test-args: ${{ matrix.job.test-args }}
         artifact-suffix: ${{ matrix.version.name }}-${{ matrix.job.name }}
-        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
     - name: Cleanup python-runner
       if: ${{ always() && matrix.job.needs-python-runner == true }}
       uses: ./.github/actions/cleanup-python-runner
@@ -1362,8 +1207,8 @@ jobs:
 
   login-to-ecr:
     needs: determine-driver-skips
-    if: ${{ needs.determine-driver-skips.outputs.vertica-should-run == 'true' || needs.determine-driver-skips.outputs.vertica-quarantine-conflict == 'true' }}
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    if: ${{ needs.determine-driver-skips.outputs.vertica-should-run == 'true' }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
     timeout-minutes: 15
     permissions:
       id-token: write
@@ -1394,7 +1239,7 @@ jobs:
 
   be-tests-vertica-ee:
     needs: [determine-driver-skips, login-to-ecr]
-    if: ${{ needs.determine-driver-skips.outputs.vertica-should-run == 'true' || needs.determine-driver-skips.outputs.vertica-quarantine-conflict == 'true' }}
+    if: ${{ needs.determine-driver-skips.outputs.vertica-should-run == 'true' }}
     runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
     timeout-minutes: 40
     env:
@@ -1410,16 +1255,6 @@ jobs:
           password: ${{ needs.login-to-ecr.outputs.docker_password }}
     name: Vertica
     steps:
-    - name: Fail on quarantine conflict
-      if: ${{ needs.determine-driver-skips.outputs.vertica-quarantine-conflict == 'true' }}
-      run: |
-        echo "::error::Vertica driver is quarantined but you changed files in modules/drivers/vertica/"
-        echo ""
-        echo "Your changes will NOT be tested because the driver is currently quarantined."
-        echo "To run Vertica tests, add the label: break-quarantine-vertica"
-        echo ""
-        echo "If you merge without testing, you risk breaking the Vertica driver!"
-        exit 1
     - uses: actions/checkout@v6
     - name: Make plugins directory
       run: mkdir plugins
@@ -1431,34 +1266,34 @@ jobs:
         test-args: >-
           :only-tags [:mb/driver-tests]
           :exclude-tags [:mb/transforms-python-test]
-        quarantine-engine: ${{ vars.QUARANTINE_ENGINE }}
 
   drivers-tests-result:
     needs:
       - determine-driver-skips
       # if you add a driver job, you must add it to this list for it to be a required check
-      - be-tests-h2
       - be-tests-athena-ee
-      - be-tests-snowflake-ee
       - be-tests-bigquery-cloud-sdk-ee
+      - be-tests-bigquery-transforms-python-ee
+      - be-tests-clickhouse-ee
       - be-tests-databricks-ee
       - be-tests-druid-jdbc-ee
-      - be-tests-mysql-mariadb
+      - be-tests-h2
+      - be-tests-h2-oss
       - be-tests-mongo
-      - be-tests-mongo-ssl
       - be-tests-mongo-sharded-cluster-ee
+      - be-tests-mongo-ssl
+      - be-tests-mysql-mariadb
       - be-tests-oracle
       - be-tests-postgres
       - be-tests-presto-jdbc-ee
       - be-tests-redshift-ee
+      - be-tests-snowflake-ee
       - be-tests-sparksql-ee
       - be-tests-sqlite-ee
       - be-tests-sqlserver
+      - be-tests-vertica-ee
       # - be-tests-starburst-ee
-      # TODO(rileythomp, 2025-08-20): Re-enable vertica tests once the docker image is updated
-      # - be-tests-vertica-ee
-      - be-tests-clickhouse-ee
-    runs-on: ${{ vars.DEFAULT_RUNNER_KEY }}
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
     timeout-minutes: 5
     name: drivers-tests-result
     if: always() && !cancelled()

.github/workflows/e2e-coverage-manifest.yml

@@ -66,7 +66,8 @@ jobs:
   # one place (SHARDS below); the matrix is generated from it.
   setup:
     name: Build shard matrix
-    runs-on: ubuntu-22.04
+    runs-on: ${{ vars.SLIM_RUNNER_KEY }}
+    timeout-minutes: 5
     outputs:
       matrix: ${{ steps.gen.outputs.matrix }}
       count: ${{ steps.gen.outputs.count }}

.github/workflows/e2e-coverage-shard.yml

@@ -97,7 +97,7 @@ jobs:
           CYPRESS_BROWSER: ${{ steps.cypress-prep.outputs.chrome-path }}
         run: |
           node e2e/runner/run_cypress_ci.js e2e \
-            --expose grepTags="-@mongo+-@python+-@OSS+-@skip"
+            --expose grepTags="-@mongo+-@python+-@OSS"
         # Don't let a single failing/flaky spec abort the shard — we still want
         # coverage from the specs that did run.
         continue-on-error: true