Lint

* Run E2E tests using Chrome

* Create snapshots using Chrome

* Test in GHA once again

* Set browser in the base Cypress config

* Change branch back to `master` for E2E workflow

.babelrc

@@ -1,6 +1,6 @@
 {
   "plugins": [
-    "babel-plugin-styled-components",
+    "@emotion",
     "@babel/plugin-proposal-export-default-from",
     ["@babel/plugin-proposal-decorators", { "legacy": true }]
   ],

.circleci/config.yml

@@ -11,13 +11,13 @@ executors:
   builder:
     working_directory: /home/circleci/metabase/metabase/
     docker:
-      - image: metabase/ci:circleci-java-11-clj-1.10.3.929-07-27-2021-node-browsers
+      - image: metabase/ci:circleci-java-8-clj-1.10.3.929-07-27-2021-node-browsers
 
   tester:
     working_directory: /home/circleci/metabase/metabase/
     docker:
-      - image: metabase/ci:circleci-java-11-clj-1.10.3.929-07-27-2021-node-browsers
-      - image: maildev/maildev
+      - image: metabase/ci:circleci-java-8-clj-1.10.3.929-07-27-2021-node-browsers
+      - image: maildev/maildev:1.1.0
       - image: metabase/qa-databases:postgres-sample-12
       - image: metabase/qa-databases:mongo-sample-4.0
       - image: metabase/qa-databases:mysql-sample-8
@@ -177,7 +177,8 @@ executors:
     working_directory: /home/circleci/metabase/metabase/
     docker:
       - image: metabase/ci:circleci-java-11-clj-1.10.3.929-07-27-2021-node-browsers
-      - image: metabase/spark:2.1.1
+      - image: metabase/spark:3.2.1
+    resource_class: large
 
   vertica:
     working_directory: /home/circleci/metabase/metabase/
@@ -607,25 +608,6 @@ jobs:
           paths:
             - metabase/metabase
 
-  check-migrations:
-    executor:
-      builder
-    steps:
-      - attach-workspace
-      - create-checksum-file:
-          filename: .MIGRATIONS-CHECKSUM
-          find-args: resources/migrations -type f -name '*.yaml'
-      - create-checksum-file:
-          filename: .MIGRATIONS-LINTER-CHECKSUMS
-          find-args: bin/lint-migrations-file -type f -name '*.clj' -or -name 'deps.edn'
-      - run-on-change:
-          checksum: '{{ checksum ".MIGRATIONS-CHECKSUM" }}-{{ checksum ".MIGRATIONS-LINTER-CHECKSUMS" }}'
-          steps:
-            - run:
-                name: Verify Liquibase Migrations
-                command: ./bin/lint-migrations-file.sh
-                no_output_timeout: 15m
-
 ########################################################################################################################
 #                                                       BACKEND                                                        #
 ########################################################################################################################
@@ -644,9 +626,6 @@ jobs:
             - run:
                 name: Compile Java source file(s)
                 command: clojure -X:deps prep
-            - run:
-                name: Compile driver AOT namespaces
-                command: cd modules/drivers && clojure -X:deps prep
             - run:
                 name: Fetch dependencies
                 command: clojure -P -X:dev:ci:ee:ee-dev:drivers:drivers-dev
@@ -735,7 +714,7 @@ jobs:
         type: string
       timeout:
         type: string
-        default: 15m
+        default: 20m
       before-steps:
         type: steps
         default: []
@@ -775,45 +754,6 @@ jobs:
                 path: /home/circleci/metabase/metabase/target/junit
             - steps: << parameters.after-steps >>
 
-  test-build-scripts:
-    executor: builder
-    steps:
-      - attach-workspace
-      - run-on-change:
-          checksum: '{{ checksum ".BACKEND-CHECKSUMS" }}'
-          steps:
-            - restore-be-deps-cache
-            - run:
-                name: Run metabuild-common build script tests
-                command: |
-                  cd /home/circleci/metabase/metabase/bin/common && clojure -M:test
-                no_output_timeout: 15m
-            - run:
-                name: Run build-drivers build script tests
-                command: |
-                  cd /home/circleci/metabase/metabase/bin/build-drivers && clojure -M:test
-                no_output_timeout: 15m
-            - run:
-                name: Run i18n script tests
-                command: |
-                  cd /home/circleci/metabase/metabase/bin/i18n && clojure -M:test
-                no_output_timeout: 15m
-            - run:
-                name: Run build-mb build script tests
-                command: |
-                  cd /home/circleci/metabase/metabase/bin/build-mb && clojure -M:test
-                no_output_timeout: 15m
-            - run:
-                name: Run release script tests
-                command: |
-                  cd /home/circleci/metabase/metabase/bin/release && clojure -M:test
-                no_output_timeout: 15m
-            - run:
-                name: Run Liquibase migrations linter tests
-                command: |
-                  cd /home/circleci/metabase/metabase/bin/lint-migrations-file && clojure -M:test
-                no_output_timeout: 15m
-
 
 ########################################################################################################################
 #                                                       FRONTEND                                                       #
@@ -992,6 +932,10 @@ jobs:
       MB_SNOWPLOW_AVAILABLE: << parameters.snowplow >>
     steps:
       - attach-workspace
+      - run:
+          command: |
+            mkdir -p /home/circleci/metabase/metabase/target/uberjar/
+            mkdir -p /home/circleci/metabase/metabase/resources/
       - run-on-change:
           checksum: '{{ checksum ".BACKEND-CHECKSUMS" }}-{{ checksum ".FRONTEND-CHECKSUMS" }}-{{ checksum ".E2E-TESTS-CHECKSUMS" }}'
           steps:
@@ -1002,9 +946,11 @@ jobs:
                       name: Restore cached uberjar built in previous step
                       <<: *CacheKeyUberjar
                   - steps: << parameters.before-steps >>
-                # Make both `test-files` and `source-folder` parameters optional. Translates to: if `parameter` => run associated flag (`--spec` and `--folder`, respectively)
+                  # Make both `test-files`,  `source-folder` and `currents-record` parameters optional. Translates to: if `parameter` => run associated flag (`--spec`, `--folder` and `--key $CURRENTS_KEY --record` respectively)
                 command: |
-                  run test-cypress-no-build <<# parameters.test-files >> --spec << parameters.test-files >> <</ parameters.test-files >> <<# parameters.source-folder >> --folder << parameters.source-folder >> <</ parameters.source-folder >>
+                  run test-cypress-no-build \
+                  <<# parameters.test-files >> --spec << parameters.test-files >> <</ parameters.test-files >> \
+                  <<# parameters.source-folder >> --folder << parameters.source-folder >> <</ parameters.source-folder >>
                 after-steps:
                   - store_artifacts:
                       path: /home/circleci/metabase/metabase/cypress
@@ -1054,10 +1000,6 @@ workflows:
     jobs:
       - checkout
 
-      - check-migrations:
-          requires:
-            - checkout
-
       - be-deps:
           requires:
             - checkout
@@ -1090,7 +1032,7 @@ workflows:
       - test-driver:
           matrix:
             parameters:
-              driver: ["bigquery", "bigquery-cloud-sdk", "googleanalytics", "sqlite"]
+              driver: ["bigquery-cloud-sdk", "googleanalytics", "sqlite"]
           name: be-tests-<< matrix.driver >>-ee
           requires:
             - be-tests-java-8-ee
@@ -1110,7 +1052,7 @@ workflows:
           name: be-google-related-drivers-classpath-test
           requires:
             - be-tests-java-8-ee
-          driver: googleanalytics,bigquery,bigquery-cloud-sdk
+          driver: googleanalytics,bigquery-cloud-sdk
           test-args: >-
             :only "[metabase.query-processor-test.expressions-test metabase.driver.google-test
                     metabase.driver.googleanalytics-test]"
@@ -1280,10 +1222,6 @@ workflows:
                 dest: vertica-jdbc-7.1.2-0.jar
           driver: vertica
 
-      - test-build-scripts:
-          requires:
-            - be-deps
-
       - build-uberjar-drivers:
           name: build-uberjar-drivers-<< matrix.edition >>
           requires:
@@ -1321,6 +1259,7 @@ workflows:
                   "dashboard-filters",
                   "dashboard-filters-sql",
                   "downloads",
+                  "embedding",
                   "joins",
                   "models",
                   "moderation",

.clj-kondo/config.edn

@@ -1,23 +1,83 @@
 {:config-paths ["macros"]
- :linters {:unresolved-symbol {:exclude [schema= re=
-                                         (metabase.util/prog1 [<>])
-                                         (metabase.mbql.util/match-one)
-                                         (metabase.mbql.util/match)
-                                         (metabase.mbql.util.match/match)
-                                         (metabase.mbql.util.match/match-one)
-                                         (metabase.mbql.util.match/replace)
-                                         (metabase.mbql.util/replace)
-                                         (metabase.mbql.util/replace-in)
-                                         (metabase.query-processor.middleware.cache-backend.interface/with-cached-results)
-                                         (metabase.util.regex/rx [opt])
-                                         (metabase.async.streaming-response/streaming-response)
-                                         (clojure.core.logic/fresh)
-                                         (clojure.core.logic/matcha)
-                                         (clojure.core.logic/run)]}
-           ;; TODO: clj-kondo should have a way to disable this in certain macro calls like
-           ;; metabase.mbql.util.match/replace
+ :linters {:unresolved-symbol
+           {:exclude [schema= re=
+                      (metabase.util/prog1 [<>])
+                      (metabase.mbql.util/match-one)
+                      (metabase.mbql.util/match)
+                      (metabase.mbql.util.match/match)
+                      (metabase.mbql.util.match/match-one)
+                      (metabase.mbql.util.match/replace)
+                      (metabase.mbql.util/replace)
+                      (metabase.mbql.util/replace-in)
+                      (metabase.query-processor.middleware.cache-backend.interface/with-cached-results)
+                      (metabase.util.regex/rx [opt])
+                      (metabase.async.streaming-response/streaming-response)
+                      (clojure.core.logic/fresh)
+                      (clojure.core.logic/matcha)
+                      (clojure.core.logic/run)
+                      (metabase.test/with-temporary-setting-values)
+                      (clojure.test/is [query= sql=])
+                      (toucan.util.test/with-temp*)
+                      (metabase.test/with-temp*)
+                      (taoensso.nippy/extend-freeze)
+                      (taoensso.nippy/extend-thaw)
+                      (metabase.driver.druid.query-processor-test/druid-query-returning-rows)
+                      (clojure.tools.macro/macrolet)]}
+           :refer-all {:exclude [clojure.test
+                                 monger.operators]}
            :unexpected-recur {:level :off}
-           :unused-referred-var {:exclude {compojure.core [GET DELETE POST PUT]}}}
+           :unused-referred-var {:exclude {compojure.core [GET DELETE POST PUT]}}
+           :deprecated-var {:exclude {metabase.query-processor.util/normalize-token
+                                      {:namespaces ["metabase.*"]}
+                                      metabase.driver/supports?
+                                      {:namespaces ["metabase.*"]}
+                                      metabase.driver/current-db-time
+                                      {:namespaces ["metabase.*"]}
+                                      metabase.driver.common/current-db-time-native-query
+                                      {:namespaces ["metabase\\.driver.*"]}
+                                      metabase.driver.common/current-db-time-date-formatters
+                                      {:namespaces ["metabase\\.driver.*"]}
+                                      metabase.driver.sql-jdbc.execute.old-impl/read-column
+                                      {:namespaces ["metabase\\.driver.*"]}
+                                      metabase.driver.common/first-successful-parse
+                                      {:namespaces ["metabase\\.driver.*"]}
+                                      metabase.driver.common/ThreadSafeSimpleDateFormat
+                                      {:namespaces ["metabase\\.driver.*"]}
+                                      metabase.driver.common/create-db-time-formatters
+                                      {:namespaces ["metabase\\.driver.*"]}
+                                      metabase.driver.common/current-db-time
+                                      {:namespaces ["metabase.*"]}
+                                      metabase.driver.sql.query-processor.deprecated/*field-options*
+                                      {:namespaces ["metabase\\.driver.*"]}
+                                      metabase.driver.sql.query-processor.deprecated/*source-query*
+                                      {:namespaces ["metabase\\.driver.*"]}
+                                      metabase.driver.sql.query-processor.deprecated/field->identifier
+                                      {:namespaces ["metabase\\.driver.*"]}
+                                      metabase.driver.sql.query-processor.deprecated/field->alias
+                                      {:namespaces ["metabase\\.driver.*"]}
+                                      metabase.driver.sql.query-processor.deprecated/prefix-field-alias
+                                      {:namespaces ["metabase\\.driver.*"]}
+                                      metabase.query-processor.middleware.resolve-joins/maybe-resolve-source-table
+                                      {:namespaces ["metabase.*"]}
+                                      metabase.driver.sql-jdbc.execute.old-impl/set-timezone-sq
+                                      {:namespaces ["metabase\\.driver.*"]}
+                                      metabase.driver.sql-jdbc.execute.old-impl/set-timezone-sql
+                                      {:namespaces ["metabase\\.driver.*"]}
+                                      metabase.driver.sql.query-processor.deprecated/*table-alias*
+                                      {:namespaces ["metabase\\.driver.*"]}
+                                      metabase.public-settings.premium-features/enable-enhancements?
+                                      {:namespaces ["metabase\\.models.*"]}
+                                      metabase.driver.sql.query-processor.deprecated/escape-alias
+                                      {:namespaces ["metabase\\.driver.*"]}
+                                      metabase.driver.sql-jdbc.execute/set-time-zone-if-supported!
+                                      {:namespaces ["metabase\\.driver.*"]}
+                                      metabase.driver.sql-jdbc.sync.interface/syncable-schemas
+                                      {:namespaces ["metabase\\.driver.*"]}
+                                      schema.core/either
+                                      {:namespaces ["metabase.*"]}
+                                      schema.core/both
+                                      {:namespaces ["metabase.*"]}}}
+           :unresolved-var {:exclude [colorize.core]}}
  :lint-as {metabase.api.common/let-404 clojure.core/let
            metabase.db.data-migrations/defmigration clojure.core/def
            metabase.query-processor.error-type/deferror clojure.core/def
@@ -28,9 +88,17 @@
            metabase.sync.util/with-emoji-progress-bar clojure.core/let
            metabase.driver.sql-jdbc.execute.diagnostic/capturing-diagnostic-info clojure.core/fn
            metabase.util.files/with-open-path-to-resource clojure.core/let
+           metabase.util.ssh/with-ssh-tunnel clojure.core/let
            metabase.db.liquibase/with-liquibase clojure.core/let
            metabase.models.setting.multi-setting/define-multi-setting clojure.core/def
            metabase.integrations.ldap/with-ldap-connection clojure.core/fn
+           metabase.test/defdataset clojure.core/def
+           metabase.test/with-temp-file clojure.core/let
+           metabase.test/with-open-channels clojure.core/let
+           metabase.test.data.interface/defdataset clojure.core/def
+           metabase.test.data.interface/defdataset-edn clojure.core/def
+           metabase.driver.mongo.util/with-mongo-connection clojure.core/let
+           metabase.driver.mongo.query-processor/mongo-let clojure.core/let
            toucan.db/with-call-counting clojure.core/fn
 
            potemkin.types/defprotocol+ clojure.core/defprotocol
@@ -39,21 +107,30 @@
            potemkin/defrecord+ clojure.core/defrecord
            potemkin.types/deftype+ clojure.core/deftype
            potemkin/deftype+ clojure.core/deftype
-           clojurewerkz.quartzite.jobs/defjob clojure.core/defn}
+           clojurewerkz.quartzite.jobs/defjob clojure.core/defn
+           honeysql.util/defalias clojure.core/def
+           honeysql.helpers/defhelper clj-kondo.lint-as/def-catch-all
+           clojure.core.logic/defne clj-kondo.lint-as/def-catch-all
+           monger.operators/defoperator clojure.core/def}
  :hooks   {:analyze-call {metabase.test.data/dataset        hooks.metabase.test.data/dataset
                           metabase.test/dataset             hooks.metabase.test.data/dataset
                           metabase.test.data/$ids           hooks.metabase.test.data/$ids
                           metabase.test/$ids                hooks.metabase.test.data/$ids
                           metabase.test.data/mbql-query     hooks.metabase.test.data/$ids
                           metabase.test/mbql-query          hooks.metabase.test.data/$ids
-                          metabase.test.data/run-mbql-query hooks.metabase.test.data/$ids
-                          metabase.test/run-mbql-query      hooks.metabase.test.data/$ids}
-           :macroexpand {metabase.api.common/defendpoint*   metabase.api.common/defendpoint*
-                         metabase.api.common/defendpoint    metabase.api.common/defendpoint
-                         metabase.api.common/defendpoint-async metabase.api.common/defendpoint
-                         metabase.query-processor.streaming/streaming-response
-                         metabase.query-processor.streaming/streaming-response
+                          metabase.test/data-query          hooks.metabase.test.data/$ids
+                          metabase.test/query hooks.metabase.test.data/$ids
+                          metabase.test/run-mbql-query      hooks.metabase.test.data/$ids
+                          metabase.test.data/run-mbql-query      hooks.metabase.test.data/$ids
+                          metabase.api.common/defendpoint   hooks.metabase.api.common/defendpoint
+                          metabase.api.common/defendpoint-async hooks.metabase.api.common/defendpoint
 
+                          metabase.test/with-temp hooks.toucan.util.test/with-temp}
+           :macroexpand {metabase.query-processor.streaming/streaming-response
+                         metabase.query-processor.streaming/streaming-response
+                         metabase.api.common/define-routes macros.metabase.api.common/define-routes
                          toucan.models/defmodel toucan.models/defmodel
-                         }}
+                         clojurewerkz.quartzite.jobs/build macros.quartz/build-job
+                         clojurewerkz.quartzite.triggers/build macros.quartz/build-trigger
+                         clojurewerkz.quartzite.schedule.cron/schedule macros.quartz/schedule}}
  :config-in-comment {:linters {:unresolved-symbol {:level :off}}}}

.clj-kondo/hooks/metabase/api/common.clj

@@ -0,0 +1,23 @@
+(ns hooks.metabase.api.common
+  (:require
+   [clj-kondo.hooks-api :as api]
+   [clojure.string :as str]))
+
+(defn route-fn-name
+  [method route]
+  (let [route (if (vector? route) (first route) route)]
+    (-> (str (name method) route)
+        (str/replace #"/" "_")
+        symbol)))
+
+(defn defendpoint [{:keys [node]}]
+  (let [[method route & body] (rest (:children node))]
+    {:node
+     (api/list-node [(api/token-node 'do)
+                     ;; register usage of compojure core var
+                     (api/token-node (symbol (str "compojure.core")
+                                             (str method)))
+                     ;; define function with route-fn-name
+                     (api/list-node (list* (api/token-node 'clojure.core/defn)
+                                           (route-fn-name (api/sexpr method) (api/sexpr route))
+                                           body))])}))

.clj-kondo/hooks/metabase/test/data.clj

@@ -15,7 +15,8 @@
              (meta dataset))}))
 
 (defn $ids [{:keys [node]}]
-  (let [[table-name & body] (rest (:children node))
+  (let [args (rest (:children node))
+        [table-name & body] args
         unused-node (hooks/token-node '_)
         vars (atom #{})
         _ (walk/postwalk (fn [node]
@@ -29,22 +30,26 @@
                                  (swap! vars conj node))))
                            node)
                          body)
-        nil-bindings (vec (interpose nil @vars))
+        nil-bindings (vec (interpose (hooks/token-node nil) @vars))
         unused-bindings (vec (interpose unused-node @vars))
-        final-bindings (concat [table-name nil
-                                unused-node table-name]
-                               (if (seq nil-bindings)
-                                 (conj nil-bindings nil)
-                                 [])
-                               (if (seq unused-bindings)
-                                 (conj (next unused-bindings)
-                                       (first unused-bindings)
-                                       unused-node)
-                                 []))]
+        final-bindings (concat
+                        (when-not (= "nil" (str table-name))
+                          [table-name (hooks/token-node nil)])
+                        [unused-node table-name]
+                        (if (seq nil-bindings)
+                          (conj nil-bindings (hooks/token-node nil))
+                          [])
+                        (if (seq unused-bindings)
+                          (conj (next unused-bindings)
+                                (first unused-bindings)
+                                unused-node)
+                          []))]
     {:node (with-meta
              (hooks/list-node
-              (list*
-               (hooks/token-node 'let)
-               (hooks/vector-node (vec final-bindings))
-               body))
+              (with-meta
+                (list*
+                 (hooks/token-node 'let)
+                 (hooks/vector-node (vec final-bindings))
+                 body)
+                (meta body)))
              (meta body))}))

.clj-kondo/hooks/toucan/util/test.clj

@@ -0,0 +1,11 @@
+(ns hooks.toucan.util.test
+  (:require [clj-kondo.hooks-api :as api]))
+
+(defn with-temp [{:keys [node]}]
+  (let [[_ db-ref binding+opts & body] (:children node)
+        [args opts] (:children binding+opts)]
+    {:node (api/vector-node [db-ref
+                             opts
+                             (api/list-node (list* (api/token-node 'fn)
+                                                   (api/vector-node [args])
+                                                   body))])}))

.clj-kondo/macros/metabase/api/common.clj

@@ -1,102 +1,5 @@
-(ns metabase.api.common
-  (:require [clojure.string :as str]))
+(ns macros.metabase.api.common)
 
-(defn optional
-  "Helper function for defining functions that accept optional arguments. If `pred?` is true of the first item in `args`,
-  a pair like `[first-arg other-args]` is returned; otherwise, a pair like `[default other-args]` is returned.
-
-  If `default` is not specified, `nil` will be returned when `pred?` is false.
-
-    (defn
-      ^{:arglists ([key? numbers])}
-      wrap-nums [& args]
-      (let [[k nums] (optional keyword? args :nums)]
-        {k nums}))
-    (wrap-nums 1 2 3)          -> {:nums [1 2 3]}
-    (wrap-nums :numbers 1 2 3) -> {:numbers [1 2 3]}"
-  {:arglists '([pred? args]
-               [pred? args default])}
-  [pred? args & [default]]
-  (if (pred? (first args)) [(first args) (next args)]
-      [default args]))
-
-(defn add-route-param-regexes
-  "Expand a `route` string like \"/:id\" into a Compojure route form that uses regexes to match parameters whose name
-  matches a regex from `auto-parse-arg-name-patterns`.
-
-    (add-route-param-regexes \"/:id/card\") -> [\"/:id/card\" :id #\"[0-9]+\"]"
-  [route]
-  (if (vector? route)
-    route
-    (let [arg-types nil #_(typify-args (route-arg-keywords route))]
-      (if (empty? arg-types)
-        route
-        (apply vector route arg-types)))))
-
-(defn route-fn-name
-  "Generate a symbol suitable for use as the name of an API endpoint fn. Name is just `method` + `route` with slashes
-  replaced by underscores.
-
-    (route-fn-name GET \"/:id\") ;-> GET_:id"
-  [method route]
-  ;; if we were passed a vector like [":id" :id #"[0-9+]"] only use first part
-  (let [route (if (vector? route) (first route) route)]
-    (-> (str (name method) route)
-        (str/replace #"/" "_")
-        symbol)))
-
-(defmacro defendpoint*
-  "Impl macro for `defendpoint`; don't use this directly."
-  [{:keys [method route fn-name docstr args body]}]
-  `(def ~(vary-meta fn-name
-                    assoc
-
-                    :doc          docstr
-                    :is-endpoint? true)
-     (~(symbol "compojure.core" (name method)) ~route ~args
-      ~@body)))
-
-(defn- parse-defendpoint-args [[method route & more]]
-  (let [fn-name                (route-fn-name method route)
-        route                  (add-route-param-regexes route)
-        [docstr [args & more]] (optional string? more)
-        [arg->schema body]     (optional (every-pred map? #(every? symbol? (keys %))) more)]
-    (when-not docstr
-      ;; Don't i18n this, it's dev-facing only
-      :TODO/emit-clj-kondo-warning-for-missing-docstring
-      #_(log/warn (u/format-color 'red "Warning: endpoint %s/%s does not have a docstring. Go add one."
-                                (ns-name *ns*) fn-name)))
-    {:method      method
-     :route       route
-     :fn-name     fn-name
-     ;; eval the vals in arg->schema to make sure the actual schemas are resolved so we can document
-     ;; their API error messages
-     :docstr "foo"
-     :args        args
-     :arg->schema arg->schema
-     :body        body}))
-
-(defmacro defendpoint
-  "Define an API function.
-   This automatically does several things:
-
-   -  calls `auto-parse` to automatically parse certain args. e.g. `id` is converted from `String` to `Integer` via
-      `Integer/parseInt`
-
-   -  converts `route` from a simple form like `\"/:id\"` to a typed one like `[\"/:id\" :id #\"[0-9]+\"]`
-
-   -  sequentially applies specified annotation functions on args to validate them.
-
-   -  automatically calls `wrap-response-if-needed` on the result of `body`
-
-   -  tags function's metadata in a way that subsequent calls to `define-routes` (see below) will automatically include
-      the function in the generated `defroutes` form.
-
-   -  Generates a super-sophisticated Markdown-formatted docstring"
-  ;; {:arglists '([method route docstr? args schemas-map? & body])}
-  [& defendpoint-args]
-  (let [{:keys [args body arg->schema], :as defendpoint-args} (parse-defendpoint-args defendpoint-args)]
-    `(defendpoint* ~(assoc defendpoint-args
-                           :body `(do ~args
-                                      ~arg->schema
-                                      (do ~@body))))))
+(defmacro define-routes [& args]
+  `(do (def ~'routes)
+       ~@args))

.clj-kondo/macros/quartz.clj

@@ -0,0 +1,16 @@
+(ns macros.quartz)
+
+(defmacro build-job
+  [& body]
+  `(let [jb# (org.quartz.JobBuilder/newJob)]
+     (clojurewerkz.quartzite.jobs/finalize (-> jb# ~@body))))
+
+(defmacro build-trigger
+  [& body]
+  `(let [tb# (org.quartz.TriggerBuilder/newTrigger)]
+     (clojurewerkz.quartzite.triggers/finalize (-> tb# ~@body))))
+
+(defmacro schedule
+  [& body]
+  `(let [s# ~(first body)]
+     (-> s# ~@(rest body))))

.clj-kondo/macros/toucan/models.clj

@@ -4,4 +4,5 @@
   `(do (clojure.core/defrecord ~model-name ~(vec (map (comp symbol name) ks)))
        (clojure.core/defrecord
            ~(symbol (str model-name "Instance"))
-           ~(vec (map (comp symbol name) ks)))))
+           ~(vec (map (comp symbol name) ks)))
+       ~(symbol (str model-name "Instance"))))

.dir-locals.el

@@ -35,6 +35,7 @@
   ;; instead of one call to `define-clojure-indent'
   (eval . (put-clojure-indent 'c/step 1))
   (eval . (put-clojure-indent 'db/insert-many! 1))
+  (eval . (put-clojure-indent 'db/update! 2))
   (eval . (put-clojure-indent 'impl/test-migrations 2))
   (eval . (put-clojure-indent 'let-404 0))
   (eval . (put-clojure-indent 'macros/case 0))
@@ -49,6 +50,8 @@
   (eval . (put-clojure-indent 'mt/test-drivers 1))
   (eval . (put-clojure-indent 'prop/for-all 1))
   (eval . (put-clojure-indent 'qp.streaming/streaming-response 1))
+  (eval . (put-clojure-indent 'u/select-keys-when 1))
+  (eval . (put-clojure-indent 'u/strict-extend 1))
   ;; these ones have to be done with `define-clojure-indent' for now because of upstream bug
   ;; https://github.com/clojure-emacs/clojure-mode/issues/600 once that's resolved we should use `put-clojure-indent'
   ;; instead. Please don't add new entries unless they don't work with `put-clojure-indent'

.github/ISSUE_TEMPLATE/bug_report.md

@@ -30,12 +30,12 @@ If applicable, add screenshots to help explain your problem.
 
 You can get this information by going to Admin -> Troubleshooting.
 
-- Your browser and the version: (e.x. Chrome 52.1, Firefox 48.0, Safari 11.1, …)
-- Your operating system: (e.x. OS X 10.10, Windows 10.1809, Ubuntu 16.04, …)
-- Your databases: (e.x. MySQL, Postgres, MongoDB, …)
-- Metabase version: (e.x. 0.19.3)
-- Metabase hosting environment: (e.x. Mac app, Elastic Beanstalk, Docker, Heroku, Jar-file on Ubuntu, …)
-- Metabase internal database: (e.x. H2 (default), Postgres or MySQL)
+- Your browser and the version: (e.g., Chrome 52.1, Firefox 48.0, Safari 11.1, …)
+- Your operating system: (e.g., OS X 10.10, Windows 10.1809, Ubuntu 16.04, …)
+- Your databases: (e.g, MySQL, Postgres, MongoDB, …)
+- Metabase version: (e.g., 0.19.3)
+- Metabase hosting environment: (e.g., Elastic Beanstalk, Docker, Heroku, Jar-file on Ubuntu, …)
+- Metabase internal database: (e.g., H2 (default), Postgres or MySQL)
 
 **Severity**
 How severe an issue is this bug to you? Is this annoying, blocking some users, blocking an upgrade or blocking your usage of Metabase entirely?

.github/actions/find-squashed-commit/action.yml

@@ -0,0 +1,30 @@
+name: Find squashed commit
+
+description: Finds squashed commit in master by pull request name
+inputs:
+  pull-request-number:
+    required: true
+  base-ref:
+    required: true
+outputs:
+  commit:
+    value: ${{ steps.find-squashed-commit.outputs.commit }}
+    description: Found commit SHA
+
+runs:
+  using: "composite"
+  steps:
+    - run: |
+        git checkout $BASE_REF
+        git fetch --all
+
+        echo "Looking for a commit that contains pull request number $PULL_REQUEST_NUMBER in $BASE_REF"
+        COMMIT=$(env -i git log $BASE_REF --grep="(#$PULL_REQUEST_NUMBER)" --format="%H")
+        echo "commit SHA $COMMIT"
+
+        echo "::set-output name=commit::$COMMIT"
+      id: find-squashed-commit
+      shell: bash
+      env:
+        PULL_REQUEST_NUMBER: ${{ inputs.pull-request-number }}
+        BASE_REF: ${{ inputs.base-ref }}

.github/actions/get-latest-release-branch/action.yml

@@ -0,0 +1,41 @@
+name: Get latest release branch
+
+outputs:
+  branch-name:
+    value: ${{ steps.get-latest-release-branch.outputs.result }}
+
+runs:
+  using: "composite"
+  steps:
+    - uses: actions/github-script@v4
+      id: get-latest-release-branch
+      with:
+        result-encoding: string
+        script: |
+          const releaseBranches = await github.git.listMatchingRefs({
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+            ref: "heads/release-x.",
+          });
+
+          const getVersionFromBranch = branch => {
+            const match = branch.match(/release-x\.(.*?)\.x/);
+            return match && parseInt(match[1]);
+          };
+          const latestReleaseBranch = releaseBranches.data
+            .filter(branch => getVersionFromBranch(branch.ref) !== null)
+            .reduce(
+              (prev, current) =>
+                getVersionFromBranch(prev.ref) > getVersionFromBranch(current.ref)
+                  ? prev
+                  : current,
+              { ref: "" },
+            );
+          const latestReleaseBranchName = latestReleaseBranch.ref.replace(
+            /^refs\/heads\//,
+            "",
+          );
+
+          console.log(`Latest release branch: ${latestReleaseBranchName}`);
+
+          return latestReleaseBranchName;

.github/actions/notify-pull-request/action.yml

@@ -0,0 +1,34 @@
+name: Notify Pull Request
+inputs:
+  message:
+    required: true
+  include-log:
+    required: false
+    default: true
+
+runs:
+  using: "composite"
+  steps:
+    - uses: actions/github-script@v4
+      id: get-latest-release-branch
+      with:
+        result-encoding: string
+        script: |
+          const message = "${{ inputs.message }}"
+          const shouldIncludeLog = ${{ inputs.include-log }}.toString() === "true";
+          const author = context.payload.sender.login;
+
+          let body = `@${author} ${message}`;
+
+          if (shouldIncludeLog) {
+            const { GITHUB_SERVER_URL, GITHUB_REPOSITORY, GITHUB_RUN_ID } = process.env;
+            const runUrl = `${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}`;
+            body += ` [[Logs]](${runUrl})`;
+          }
+
+          github.issues.createComment({
+            issue_number: context.payload.number,
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+            body,
+          });

.github/actions/prepare-backend/action.yml

@@ -0,0 +1,35 @@
+name: Prepare back-end environment
+inputs:
+  java-version:
+    required: true
+    default: '11'
+  clojure-version:
+    required: true
+    default: '1.10.3.933'
+  m2-cache-key:
+    description: 'Key to cache M2 packages from Maven Central'
+    required: true
+    default: 'm2'
+
+runs:
+  using: "composite"
+  steps:
+    - name: Prepare JDK ${{ inputs.java-version }}
+      uses: actions/setup-java@v3
+      with:
+        java-version: ${{ inputs.java-version }}
+        distribution: 'temurin'
+    - name: Install Clojure CLI
+      shell: bash
+      run: |
+        curl -O https://download.clojure.org/install/linux-install-${{ inputs.clojure-version }}.sh &&
+        sudo bash ./linux-install-${{ inputs.clojure-version }}.sh
+    - name: Get M2 cache
+      uses: actions/cache@v2
+      with:
+        path: |
+          ~/.m2
+          ~/.gitlibs
+        key: ${{ runner.os }}-${{ inputs.m2-cache-key }}-${{ hashFiles('**/deps.edn') }}
+        restore-keys: |
+          ${{ runner.os }}-${{ inputs.m2-cache-key }}-

.github/actions/prepare-cypress/action.yml

@@ -0,0 +1,16 @@
+name: Prepare cypress environment
+runs:
+  using: "composite"
+  steps:
+    - name: Get Cypress cache
+      uses: actions/cache@v2
+      with:
+        path: ~/.cache/Cypress
+        key: ${{ runner.os }}-Cypress-${{ hashFiles('**/yarn.lock') }}
+    - name: Ensure that Cypress executable is ready
+      run: |
+        yarn cypress install
+        yarn cypress cache path
+        yarn cypress cache list
+        yarn cypress verify
+      shell: bash

.github/actions/prepare-frontend/action.yml

@@ -0,0 +1,21 @@
+name: Prepare front-end environment
+runs:
+  using: "composite"
+  steps:
+    - name: Prepare Node.js
+      uses: actions/setup-node@v3
+      with:
+        node-version: 14.x
+        cache: 'yarn'
+    - name: Get M2 cache
+      uses: actions/cache@v2
+      with:
+        path: ~/.m2
+        key: ${{ runner.os }}-cljs-${{ hashFiles('**/shadow-cljs.edn') }}
+    - name: Get node_modules cache
+      uses: actions/cache@v2
+      with:
+        path: node_modules
+        key: ${{ runner.os }}-node-modules-${{ hashFiles('**/yarn.lock') }}
+    - run: yarn install --frozen-lockfile --prefer-offline
+      shell: bash

.github/actions/prepare-uberjar-artifact/action.yml

@@ -0,0 +1,18 @@
+name: Prepare Uberjar Artifact
+runs:
+  using: "composite"
+  steps:
+    - name: Mark with the commit hash
+      run: git rev-parse --short HEAD > COMMIT-ID
+      shell: bash
+    - name: Calculate SHA256 checksum
+      run: sha256sum ./target/uberjar/metabase.jar > SHA256.sum
+      shell: bash
+    - name: Upload JARs as artifact
+      uses: actions/upload-artifact@v2
+      with:
+        name: metabase-${{ matrix.edition }}-uberjar
+        path: |
+          ./target/uberjar/metabase.jar
+          ./COMMIT-ID
+          ./SHA256.sum

.github/actions/run-snowplow-micro/action.yml

@@ -0,0 +1,13 @@
+name: Run Snowplow micro
+runs:
+  using: "composite"
+  steps:
+    - name: Download Snowplow micro JAR
+      run: curl -L -o snowplow-micro.jar https://github.com/snowplow-incubator/snowplow-micro/releases/download/micro-1.2.1/snowplow-micro-1.2.1.jar
+      shell: bash
+    - name: Launch Snowplow micro
+      run: java -cp snowplow-micro.jar:snowplow com.snowplowanalytics.snowplow.micro.Main --collector-config snowplow/micro.conf --iglu snowplow/iglu.json &
+      shell: bash
+    - name: Wait until Snowplow micro is ready
+      run: while ! curl -s 'http://localhost:9090' | grep '404'; do sleep 1; done
+      shell: bash

.github/scripts/run-presto-kerberos-integration-test.sh

@@ -48,10 +48,6 @@ keytool -noprompt -import -alias presto-kerberos -keystore $RESOURCES_DIR/cacert
 ADDITIONAL_OPTS="SSLKeyStorePath=$RESOURCES_DIR/ssl_keystore.jks&SSLKeyStorePassword=presto\
 &SSLTrustStorePath=$RESOURCES_DIR/cacerts-with-presto-ca.jks&SSLTrustStorePassword=changeit"
 
-# Prepare dependencies
-source "./bin/prep.sh"
-prep_deps
-
 # Set up the environment variables pointing to all of this, and run some tests
 DRIVERS=presto-jdbc \
 MB_ENABLE_PRESTO_JDBC_DRIVER=true \

.github/workflows/auto-backport.yml

@@ -1,136 +1,70 @@
-# Creates a pull request with the latest release branch as a target with a cherry-picked commit if an associated pull request has `backport` label
-name: AutoBackport
-
+name: Auto-backport
 on:
-  push:
-    branches:
-      - master
+  pull_request:
+    types: [closed, labeled]
 
 jobs:
-  pr_info:
-    name: Check if the commit should be backported
-    runs-on: ubuntu-latest
-    outputs:
-      title: ${{ fromJson(steps.collect_pr_info.outputs.result).title }}
-      number: ${{ fromJson(steps.collect_pr_info.outputs.result).pullRequestNumber }}
-      author: ${{ fromJson(steps.collect_pr_info.outputs.result).author }}
-      should_backport: ${{ fromJson(steps.collect_pr_info.outputs.result).hasBackportLabel }}
-    steps:
-      - uses: actions/github-script@v4
-        id: collect_pr_info
-        with:
-          script: |
-            const commitMessage = context.payload.commits[0].message;
-            const pullRequestNumbers = Array.from(commitMessage.matchAll(/\(#(.*?)\)/g))
-
-            if (pullRequestNumbers.length === 0) {
-              return {
-                author: "",
-                pullRequestNumber: 0,
-                title: "",
-                hasBackportLabel: false
-              };
-            }
-
-            if (pullRequestNumbers > 1) {
-              throw "Multiple PRs are associated with this commit";
-            }
-
-            const pullRequestNumber = pullRequestNumbers[0][1];
-
-            const { data } = await github.pulls.get({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              pull_number: pullRequestNumber
-            });
-
-            const hasBackportLabel = data.labels.some((label) => label.name === 'backport');
-            const { title, user } = data
-
-            console.log(`PR #${pullRequestNumber}: "${title}" hasBackportLabel=${hasBackportLabel}`)
-
-            return {
-              author: user.login,
-              pullRequestNumber,
-              title: data.title,
-              hasBackportLabel
-            }
-
-  get_latest_release_branch:
-    name: Get latest release branch
-    runs-on: ubuntu-latest
-    outputs:
-      branch_name: ${{ steps.get_branch_name.outputs.result }}
-    steps:
-      - uses: actions/github-script@v4
-        id: get_branch_name
-        with:
-          result-encoding: string
-          script: |
-            const releaseBranches = await github.git.listMatchingRefs({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              ref: "heads/release-x.",
-            });
-
-            const getVersionFromBranch = branch => {
-              const match = branch.match(/release-x\.(.*?)\.x/);
-              return match && parseInt(match[1])
-            };
-            const latestReleaseBranch = releaseBranches.data
-              .filter(branch => getVersionFromBranch(branch.ref) !== null)
-              .reduce((prev, current) => getVersionFromBranch(prev.ref) > getVersionFromBranch(current.ref) ? prev : current, { ref: "" });
-            const latestReleaseBranchName = latestReleaseBranch.ref.replace(/^refs\/heads\//, "");
-
-            console.log(`Latest release branch: ${latestReleaseBranchName}`)
-
-            return latestReleaseBranchName;
-
-  create_backport_pull_request:
-    runs-on: ubuntu-latest
-    name: Create a backport PR with the commit
-    needs: [pr_info, get_latest_release_branch]
-    if: ${{ needs.pr_info.outputs.should_backport == 'true' }}
-    env:
-      TARGET_BRANCH: ${{ needs.get_latest_release_branch.outputs.branch_name }}
-      ORIGINAL_PULL_REQUEST_NUMBER: ${{ needs.pr_info.outputs.number }}
-      ORIGINAL_TITLE: ${{ needs.pr_info.outputs.title }}
-      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  create-backport:
+    if: github.event.pull_request.merged == true && (contains(github.event.pull_request.labels.*.name, 'backport') || github.event.label.name == 'backport')
+    runs-on: ubuntu-20.04
     steps:
       - uses: actions/checkout@v2
-        name: Checkout
         with:
           fetch-depth: 0
-      - run: |
+
+      - uses: ./.github/actions/find-squashed-commit
+        name: Find commit
+        id: find_commit
+        with:
+          pull-request-number: ${{ github.event.pull_request.number }}
+          base-ref: ${{ github.event.pull_request.base.ref }}
+
+      - uses: ./.github/actions/get-latest-release-branch
+        name: Get latest release branch
+        id: get_latest_release_branch
+
+      - id: create_backport_pull_request
+        run: |
           git config --global user.email "metabase-github-automation@metabase.com"
           git config --global user.name "$GITHUB_ACTOR"
 
-          BACKPORT_BRANCH="backport-$GITHUB_SHA"
+          BACKPORT_BRANCH="backport-$COMMIT"
 
+          git checkout ${TARGET_BRANCH}
           git fetch --all
-          git checkout -b "${BACKPORT_BRANCH}" origin/"${TARGET_BRANCH}"
-          git cherry-pick "${GITHUB_SHA}"
-          git push -u origin "${BACKPORT_BRANCH}"
+          git checkout -b ${BACKPORT_BRANCH}
+          git cherry-pick ${COMMIT} || true
+
+          CONFLICTS=$(git ls-files -u | wc -l)
+          if [ "$CONFLICTS" -gt 0 ]; then
+            echo "Could not cherry pick because of a conflict"
+            echo "::set-output name=has-conflicts::true"
+            git cherry-pick --abort
+            git checkout master
+            exit 0
+          fi
+
+          git checkout master
+          git push -u origin ${BACKPORT_BRANCH}
 
           hub pull-request -b "${TARGET_BRANCH}" -h "${BACKPORT_BRANCH}" -l "auto-backported" -a "${GITHUB_ACTOR}" -F- <<<"🤖 backported \"${ORIGINAL_TITLE}\"
 
           #${ORIGINAL_PULL_REQUEST_NUMBER}"
+        env:
+          TARGET_BRANCH: ${{ steps.get_latest_release_branch.outputs.branch-name }}
+          ORIGINAL_PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}
+          ORIGINAL_TITLE: ${{ github.event.pull_request.title }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          COMMIT: ${{ steps.find_commit.outputs.commit }}
 
-  notify_when_failed:
-    runs-on: ubuntu-latest
-    name: Notify about failure
-    needs: [pr_info, create_backport_pull_request]
-    if: ${{ failure() }}
-    steps:
-      - uses: actions/github-script@v4
+      - uses: ./.github/actions/notify-pull-request
+        if: ${{ steps.create_backport_pull_request.outputs.has-conflicts == 'true' }}
         with:
-          script: |
-            const { GITHUB_SERVER_URL, GITHUB_REPOSITORY, GITHUB_RUN_ID } = process.env;
-            const runUrl = `${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}`
+          include-log: false
+          message: could not create a backport due to conflicts
 
-            github.issues.createComment({
-              issue_number: ${{ needs.pr_info.outputs.number }},
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              body: `@${{ needs.pr_info.outputs.author }} could not automatically create a backport PR 😩 [[Logs]](${runUrl})`
-            })
+      - uses: ./.github/actions/notify-pull-request
+        if: ${{ failure() }}
+        with:
+          include-log: true
+          message: something went wrong while creating a backport

.github/workflows/backend.yml

@@ -1,16 +1,11 @@
 name: Backend
 
 on:
-  pull_request:
   push:
     branches:
-      - '**'
-    paths:
-    - '**.clj*'
-    - '**.edn'
-    - '**.java'
-    - '**/metabase-plugin.yaml'
-    - '.github/workflows/**'
+      - 'master'
+      - 'release-**'
+  pull_request:
 
 jobs:
 
@@ -18,7 +13,7 @@ jobs:
     runs-on: ubuntu-20.04
     timeout-minutes: 10
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
     - name: Run clj-kondo
       run: docker run -v $PWD:/work --rm cljkondo/clj-kondo clj-kondo --config /work/lint-config.edn --lint /work/src /work/enterprise/backend/src /work/backend/mbql/src /work/shared/src
 
@@ -26,52 +21,22 @@ jobs:
     runs-on: ubuntu-20.04
     timeout-minutes: 20
     steps:
-    - uses: actions/checkout@v2
-    - name: Prepare JDK 11
-      uses: actions/setup-java@v2
+    - uses: actions/checkout@v3
+    - name: Prepare back-end environment
+      uses: ./.github/actions/prepare-backend
       with:
-        java-version: 11
-        distribution: 'temurin'
-    - name: Install Clojure CLI
-      run: |
-        curl -O https://download.clojure.org/install/linux-install-1.10.3.933.sh &&
-        sudo bash ./linux-install-1.10.3.933.sh
-    - name: Get M2 cache
-      uses: actions/cache@v2
-      with:
-        path: |
-          ~/.m2
-          ~/.gitlibs
-        key: ${{ runner.os }}-eastwood-${{ hashFiles('**/deps.edn') }}
-    - name: Compile Java & AOT Sources
-      run: |
-        source ./bin/prep.sh && prep_deps
-    - run: clojure -X:dev:ee:ee-dev:drivers:drivers-dev:eastwood
+        m2-cache-key: 'eastwood'
+    - run: clojure -X:dev:ee:ee-dev:drivers:drivers-dev:test:eastwood
       name: Run Eastwood linter
 
   be-linter-namespace-decls:
     runs-on: ubuntu-20.04
     timeout-minutes: 10
     steps:
-    - uses: actions/checkout@v2
-    - name: Prepare JDK 11
-      uses: actions/setup-java@v2
+    - uses: actions/checkout@v3
+    - name: Prepare back-end environment
+      uses: ./.github/actions/prepare-backend
       with:
-        java-version: 11
-        distribution: 'temurin'
-    - name: Install Clojure CLI
-      run: |
-        curl -O https://download.clojure.org/install/linux-install-1.10.3.933.sh &&
-        sudo bash ./linux-install-1.10.3.933.sh
-    - name: Get M2 cache
-      uses: actions/cache@v2
-      with:
-        path: |
-          ~/.m2
-          ~/.gitlibs
-        key: ${{ runner.os }}-namespace-decls-${{ hashFiles('**/deps.edn') }}
-    - name: Compile Java & AOT Sources
-      run: |
-        source ./bin/prep.sh && prep_deps
-    - run: clojure -X:dev:ee:ee-dev:drivers:drivers-dev:namespace-checker
+        m2-cache-key: 'namespace-decls'
+    - run: clojure -X:dev:ee:ee-dev:drivers:drivers-dev:test:namespace-checker
       name: Check ns forms

.github/workflows/backport.yml

@@ -9,8 +9,20 @@ jobs:
   create_pull_request:
     name: Creates a pull request
     if: contains(github.event.comment.body, '@metabase-bot backport')
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-20.04
     steps:
+      - id: is_organization_member
+        uses: JamesSingleton/is-organization-member@1.0.0
+        with:
+          organization: metabase
+          username: ${{ github.event.issue.user.login }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+      - run: |
+          result=${{ steps.is_organization_member.outputs.result }}
+          if [ $result == false ]; then
+              echo User ${{ github.event.comment.user.login }} is not a member of Metabase organization
+              exit 1
+          fi
       - uses: actions/github-script@v4
         id: branch_info
         with:
@@ -63,7 +75,7 @@ jobs:
               startSha: commits[0].sha,
               endSha: commits[commits.length - 1].sha
             }
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
         name: Cherry-pick commits and create PR
         with:
           fetch-depth: 0
@@ -111,21 +123,13 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   notify_when_failed:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-20.04
     name: Notify about failure
     needs: create_pull_request
     if: ${{ failure() }}
     steps:
-      - uses: actions/github-script@v4
+      - uses: actions/checkout@v2
+      - uses: ./.github/actions/notify-pull-request
         with:
-          script: |
-            const { GITHUB_SERVER_URL, GITHUB_REPOSITORY, GITHUB_RUN_ID} = process.env;
-            const runUrl = `${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}`
-            const author = context.payload.comment.user.login;
-
-            github.issues.createComment({
-              issue_number: context.payload.issue.number,
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              body: `@${author} could not automatically a backport PR 😩 [[Logs]](${runUrl})`
-            })
+          include-log: true
+          message: something went wrong while creating a backport

.github/workflows/build-and-push-head-images.yml

@@ -1,43 +0,0 @@
-name: Build and push to Dockerhub
-
-on:
-  push:
-    branches:
-      - master
-
-jobs:
-  build-and-push-oss-image:
-    runs-on: ubuntu-20.04
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@v2
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v1
-      - name: Set up Docker Buildx
-        id: buildx
-        uses: docker/setup-buildx-action@v1
-      - name: Login to Docker Hub
-        uses: docker/login-action@v1
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - name: Create container image
-        run: docker buildx build . -t metabase/metabase-head:latest --push --compress --no-cache
-
-  build-and-push-ee-image:
-    runs-on: ubuntu-20.04
-    timeout-minutes: 30
-    steps:
-      - uses: actions/checkout@v2
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v1
-      - name: Set up Docker Buildx
-        id: buildx
-        uses: docker/setup-buildx-action@v1
-      - name: Login to Docker Hub
-        uses: docker/login-action@v1
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-      - name: Create container image
-        run: docker buildx build . --build-arg MB_EDITION=ee -t metabase/metabase-enterprise-head:latest --push --compress --no-cache

.github/workflows/build-scripts.yml

@@ -0,0 +1,44 @@
+name: Build scripts
+
+on:
+  push:
+    branches:
+      - 'master'
+      - 'release-**'
+  pull_request:
+
+jobs:
+
+  test-build-scripts:
+    runs-on: ubuntu-20.04
+    steps:
+    - uses: actions/checkout@v3
+    - name: Prepare back-end environment
+      uses: ./.github/actions/prepare-backend
+      with:
+        m2-cache-key: 'build-scripts'
+
+    - name: Run metabuild-common build script tests
+      run: clojure -M:test
+      working-directory: bin/common
+      timeout-minutes: 15
+    - name: Run build-drivers build script tests
+      run: clojure -M:test
+      working-directory: bin/build-drivers
+      timeout-minutes: 15
+    - name: Run i18n script tests
+      run: clojure -M:test
+      working-directory: bin/i18n
+      timeout-minutes: 15
+    - name: Run build-mb build script tests
+      run: clojure -M:test
+      working-directory: bin/build-mb
+      timeout-minutes: 15
+    - name: Run release script tests
+      run: clojure -M:test
+      working-directory: bin/release
+      timeout-minutes: 15
+    - name: Run Liquibase migrations linter tests
+      run: clojure -M:test
+      working-directory: bin/lint-migrations-file
+      timeout-minutes: 15

.github/workflows/cljs.yml

@@ -3,12 +3,8 @@ name: CLJS
 on:
   push:
     branches:
-      - '**'
-    paths:
-    - 'shared/src/'
-    - '**/package.json'
-    - '**/yarn.lock'
-    - '.github/workflows/**'
+      - 'master'
+      - 'release-**'
   pull_request:
 
 jobs:
@@ -17,28 +13,8 @@ jobs:
     runs-on: ubuntu-20.04
     timeout-minutes: 10
     steps:
-    - uses: actions/checkout@v2
-    - name: Prepare Node.js
-      uses: actions/setup-node@v1
-      with:
-        node-version: 14.x
-    - name: Get M2 cache
-      uses: actions/cache@v2
-      with:
-        path: |
-          ~/.m2
-          ~/.gitlibs
-        key: ${{ runner.os }}-cljs-${{ hashFiles('**/deps.edn') }}
-    - name: Get yarn cache
-      uses: actions/cache@v2
-      with:
-        path: ~/.cache/yarn
-        key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
-    - name: Get node_modules cache
-      uses: actions/cache@v2
-      with:
-        path: node_modules
-        key: ${{ runner.os }}-node-modules-${{ hashFiles('**/yarn.lock') }}
-    - run: yarn install --frozen-lockfile --prefer-offline
+    - uses: actions/checkout@v3
+    - name: Prepare front-end environment
+      uses: ./.github/actions/prepare-frontend
     - name: Run Cljs tests for shared/ code
       run: yarn run test-cljs

.github/workflows/codenotify.yml

@@ -6,10 +6,10 @@ on:
 
 jobs:
   codenotify:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-20.04
     name: Codenotify
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - uses: sourcegraph/codenotify@v0.4

.github/workflows/codeql.yml

@@ -7,7 +7,7 @@ jobs:
     runs-on: ubuntu-20.04
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v2
+      uses: actions/checkout@v3
     - name: Initialize CodeQL
       uses: github/codeql-action/init@v1
       with:

.github/workflows/docker.yml

@@ -1,42 +0,0 @@
-name: Docker
-
-on:
-  push:
-    branches-ignore:
-      - 'master'
-      - 'release**'
-      - 'backport**'
-    paths-ignore:
-      - ".**"
-
-concurrency:
-  group: ${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  build:
-    runs-on: buildjet-2vcpu-ubuntu-2004
-    timeout-minutes: 40
-    steps:
-    - name: Extract branch name
-      shell: bash
-      run: echo "##[set-output name=branch;]$(echo ${GITHUB_REF#refs/heads/} | sed 's/[^-._a-zA-Z0-9]/-/g')"
-      id: extract_branch
-    - uses: actions/checkout@v2
-    - name: Set up Docker Buildx
-      id: buildx
-      uses: docker/setup-buildx-action@v1
-    - name: Login to Docker Hub
-      uses: docker/login-action@v1
-      with:
-        username: ${{ secrets.DOCKERHUB_USERNAME }}
-        password: ${{ secrets.DOCKERHUB_TOKEN }}
-    - name: Build container image
-      run: docker buildx build . -t metabase/metabase-dev:${{ steps.extract_branch.outputs.branch }} --push --compress --no-cache --build-arg MB_EDITION=ee
-    - name: Launch container
-      run: docker run -dp 3000:3000 metabase/metabase-dev:${{ steps.extract_branch.outputs.branch }}
-      timeout-minutes: 5
-    - run: docker ps
-    - name: Wait for Metabase to start
-      run: while ! curl -s 'http://localhost:3000/api/health' | grep '{"status":"ok"}'; do sleep 1; done
-      timeout-minutes: 1

.github/workflows/docs.yml

@@ -3,13 +3,8 @@ name: Docs
 on:
   push:
     branches:
-      - '**'
-    paths:
-    - 'docs/**'
-    - './bin/verify-docs-links'
-    - '**/package.json'
-    - '**/yarn.lock'
-    - '.github/workflows/**'
+      - 'master'
+      - 'release-**'
   pull_request:
 
 jobs:
@@ -18,21 +13,8 @@ jobs:
     runs-on: ubuntu-20.04
     timeout-minutes: 10
     steps:
-    - uses: actions/checkout@v2
-    - name: Prepare Node.js
-      uses: actions/setup-node@v1
-      with:
-        node-version: 14.x
-    - name: Get yarn cache
-      uses: actions/cache@v2
-      with:
-        path: ~/.cache/yarn
-        key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
-    - name: Get node_modules cache
-      uses: actions/cache@v2
-      with:
-        path: node_modules
-        key: ${{ runner.os }}-node-modules-${{ hashFiles('**/yarn.lock') }}
-    - run: yarn install --frozen-lockfile --prefer-offline
+    - uses: actions/checkout@v3
+    - name: Prepare front-end environment
+      uses: ./.github/actions/prepare-frontend
     - run: yarn run lint-docs-links
       name: Run docs links checker

.github/workflows/e2e-tests.yml

@@ -0,0 +1,138 @@
+name: E2E Tests
+
+on:
+  push:
+    branches:
+      - 'master'
+    paths-ignore:
+      - "docs/**"
+      - "**.md"
+      - ".circleci/**"
+
+jobs:
+
+  build:
+    runs-on: buildjet-2vcpu-ubuntu-2004
+    timeout-minutes: 25
+    strategy:
+      matrix:
+        edition: [oss, ee]
+    env:
+      MB_EDITION: ${{ matrix.edition }}
+      INTERACTIVE: false
+    steps:
+    - uses: actions/checkout@v3
+    - name: Prepare front-end environment
+      uses: ./.github/actions/prepare-frontend
+    - name: Prepare back-end environment
+      uses: ./.github/actions/prepare-backend
+
+    - run: ./bin/build version
+    - run: ./bin/build translations
+    - run: ./bin/build frontend
+    - run: ./bin/build licenses
+    - run: ./bin/build drivers
+    - run: ./bin/build uberjar
+
+    - name: Prepare uberjar artifact
+      uses: ./.github/actions/prepare-uberjar-artifact
+
+  e2e-tests:
+    runs-on: buildjet-4vcpu-ubuntu-2004
+    timeout-minutes: 30
+    needs: build
+    name: e2e-tests-${{ matrix.folder }}-${{ matrix.edition }}
+    env:
+      MB_EDITION: ${{ matrix.edition }}
+      DISPLAY: ""
+      QA_DB_ENABLED: true
+      ENTERPRISE_TOKEN: ${{ secrets.ENTERPRISE_TOKEN }}
+      MB_SNOWPLOW_AVAILABLE: true
+      MB_SNOWPLOW_URL: "http://localhost:9090"  # Snowplow micro
+    strategy:
+      fail-fast: false
+      matrix:
+        edition: [oss, ee]
+        folder:
+          - "admin"
+          - "binning"
+          - "collections"
+          - "custom-column"
+          - "dashboard"
+          - "dashboard-filters"
+          - "dashboard-filters-sql"
+          - "downloads"
+          - "embedding"
+          - "joins"
+          - "models"
+          - "moderation"
+          - "native"
+          - "native-filters"
+          - "permissions"
+          - "question"
+          - "sharing"
+          - "visualizations"
+    services:
+      maildev:
+        image: maildev/maildev:1.1.0
+        ports:
+          - "80:80"
+          - "25:25"
+        credentials:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      postgres-sample:
+        image: metabase/qa-databases:postgres-sample-12
+        ports:
+          - "5432:5432"
+        credentials:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      mongo-sample:
+        image: metabase/qa-databases:mongo-sample-4.0
+        ports:
+          - 27017:27017
+        credentials:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      mysql-sample:
+        image: metabase/qa-databases:mysql-sample-8
+        ports:
+          - 3306:3306
+        credentials:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+    steps:
+    - uses: actions/checkout@v3
+    - name: Prepare front-end environment
+      uses: ./.github/actions/prepare-frontend
+    - name: Prepare back-end environment
+      uses: ./.github/actions/prepare-backend
+    - name: Prepare cypress environment
+      uses: ./.github/actions/prepare-cypress
+    - name: Run Snowplow micro
+      uses: ./.github/actions/run-snowplow-micro
+
+    - uses: actions/download-artifact@v2
+      name: Retrieve uberjar artifact for ${{ matrix.edition }}
+      with:
+        name: metabase-${{ matrix.edition }}-uberjar
+    - name: Get the version info
+      run: |
+        jar xf target/uberjar/metabase.jar version.properties
+        mv version.properties resources/
+
+    - name: Run Cypress tests on ${{ matrix.folder }}
+      run: yarn run test-cypress-no-build --folder ${{ matrix.folder }} --record --key ${{ secrets.CURRENTS_KEY }} --group ${{ matrix.folder }}-${{ matrix.edition }} --ci-build-id "${{ github.run_id }}-${{ github.run_attempt }}"
+      env:
+        TERM: xterm
+
+    - name: Upload Cypress recording upon failure
+      uses: actions/upload-artifact@v2
+      if: failure()
+      with:
+        name: cypress-recording-${{ matrix.folder }}-${{ matrix.edition }}
+        path: |
+          ./cypress
+          ./logs/test.log
+        if-no-files-found: ignore

.github/workflows/frontend.yml

@@ -1,69 +1,30 @@
 name: Frontend
 
 on:
-  pull_request:
   push:
     branches:
-      - '**'
-    paths:
-    - 'frontend/**'
-    - 'shared/**'
-    - 'enterprise/frontend/**'
-    - '**/package.json'
-    - '**/yarn.lock'
-    - '**/.eslintrc'
-    - '.github/workflows/**'
+      - 'master'
+      - 'release-**'
+  pull_request:
 
 jobs:
-
   fe-linter-prettier:
     runs-on: ubuntu-20.04
     timeout-minutes: 10
     steps:
-    - uses: actions/checkout@v2
-    - name: Prepare Node.js
-      uses: actions/setup-node@v1
-      with:
-        node-version: 14.x
-    - name: Get yarn cache
-      uses: actions/cache@v2
-      with:
-        path: ~/.cache/yarn
-        key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
-    - name: Get node_modules cache
-      uses: actions/cache@v2
-      with:
-        path: node_modules
-        key: ${{ runner.os }}-node-modules-${{ hashFiles('**/yarn.lock') }}
-    - run: yarn install --frozen-lockfile --prefer-offline
+    - uses: actions/checkout@v3
+    - name: Prepare front-end environment
+      uses: ./.github/actions/prepare-frontend
     - run: yarn run lint-prettier
       name: Run Prettier formatting linter
 
   fe-linter-eslint:
     runs-on: ubuntu-20.04
-    timeout-minutes: 10
+    timeout-minutes: 20
     steps:
-    - uses: actions/checkout@v2
-    - name: Prepare Node.js
-      uses: actions/setup-node@v1
-      with:
-        node-version: 14.x
-    - name: Get M2 cache
-      uses: actions/cache@v2
-      with:
-        path: ~/.m2
-        key: ${{ runner.os }}-cljs-${{ hashFiles('**/shadow-cljs.edn') }}
-    - name: Get yarn cache
-      uses: actions/cache@v2
-      with:
-        path: ~/.cache/yarn
-        key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
-    - name: Get node_modules cache
-      uses: actions/cache@v2
-      with:
-        path: node_modules
-        key: ${{ runner.os }}-node-modules-${{ hashFiles('**/yarn.lock') }}
-    - run: yarn install --frozen-lockfile --prefer-offline
+    - uses: actions/checkout@v3
+    - name: Prepare front-end environment
+      uses: ./.github/actions/prepare-frontend
     - run: yarn run lint-eslint
       name: Run ESLint linter
 
@@ -71,22 +32,9 @@ jobs:
     runs-on: ubuntu-20.04
     timeout-minutes: 10
     steps:
-    - uses: actions/checkout@v2
-    - name: Prepare Node.js
-      uses: actions/setup-node@v1
-      with:
-        node-version: 14.x
-    - name: Get yarn cache
-      uses: actions/cache@v2
-      with:
-        path: ~/.cache/yarn
-        key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
-    - name: Get node_modules cache
-      uses: actions/cache@v2
-      with:
-        path: node_modules
-        key: ${{ runner.os }}-node-modules-${{ hashFiles('**/yarn.lock') }}
-    - run: yarn install --frozen-lockfile --prefer-offline
+    - uses: actions/checkout@v3
+    - name: Prepare front-end environment
+      uses: ./.github/actions/prepare-frontend
     - run: yarn type-check
       name: Check types
 
@@ -94,27 +42,9 @@ jobs:
     runs-on: buildjet-2vcpu-ubuntu-2004
     timeout-minutes: 20
     steps:
-    - uses: actions/checkout@v2
-    - name: Prepare Node.js
-      uses: actions/setup-node@v1
-      with:
-        node-version: 14.x
-    - name: Get M2 cache
-      uses: actions/cache@v2
-      with:
-        path: ~/.m2
-        key: ${{ runner.os }}-cljs-${{ hashFiles('**/shadow-cljs.edn') }}
-    - name: Get yarn cache
-      uses: actions/cache@v2
-      with:
-        path: ~/.cache/yarn
-        key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
-    - name: Get node_modules cache
-      uses: actions/cache@v2
-      with:
-        path: node_modules
-        key: ${{ runner.os }}-node-modules-${{ hashFiles('**/yarn.lock') }}
-    - run: yarn install --frozen-lockfile --prefer-offline
+    - uses: actions/checkout@v3
+    - name: Prepare front-end environment
+      uses: ./.github/actions/prepare-frontend
     - run: yarn run test-unit --coverage --silent
       name: Run frontend unit tests
     - name: Upload coverage to codecov.io
@@ -127,52 +57,21 @@ jobs:
     runs-on: buildjet-2vcpu-ubuntu-2004
     timeout-minutes: 14
     steps:
-    - uses: actions/checkout@v2
-    - name: Prepare Node.js
-      uses: actions/setup-node@v1
-      with:
-        node-version: 14.x
-    - name: Get M2 cache
-      uses: actions/cache@v2
-      with:
-        path: ~/.m2
-        key: ${{ runner.os }}-cljs-${{ hashFiles('**/shadow-cljs.edn') }}
-    - name: Get yarn cache
-      uses: actions/cache@v2
-      with:
-        path: ~/.cache/yarn
-        key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
-    - name: Get node_modules cache
-      uses: actions/cache@v2
-      with:
-        path: node_modules
-        key: ${{ runner.os }}-node-modules-${{ hashFiles('**/yarn.lock') }}
-    - run: yarn install --frozen-lockfile --prefer-offline
+    - uses: actions/checkout@v3
+    - name: Prepare front-end environment
+      uses: ./.github/actions/prepare-frontend
     - run: yarn run test-timezones
       name: Run frontend timezones tests
 
   fe-chromatic:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-20.04
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
         with:
           fetch-depth: 0
-      - name: Prepare Node.js
-        uses: actions/setup-node@v1
-        with:
-          node-version: 14.x
-      - name: Get yarn cache
-        uses: actions/cache@v2
-        with:
-          path: ~/.cache/yarn
-          key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
-      - name: Get node_modules cache
-        uses: actions/cache@v2
-        with:
-          path: node_modules
-          key: ${{ runner.os }}-node-modules-${{ hashFiles('**/yarn.lock') }}
-      - run: yarn install --frozen-lockfile --prefer-offline
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
       - name: Publish to Chromatic
         uses: chromaui/action@v1
         env:

.github/workflows/fuzzing.yml

@@ -3,15 +3,8 @@ name: Fuzzing
 on:
   push:
     branches:
-      - '**'
-    paths:
-    - 'frontend/**'
-    - 'shared/**'
-    - 'enterprise/frontend/**'
-    - '**/package.json'
-    - '**/yarn.lock'
-    - '**/.eslintrc'
-    - '.github/workflows/**'
+      - 'master'
+      - 'release-**'
   pull_request:
     paths-ignore:
     - 'docs/**'
@@ -22,27 +15,9 @@ jobs:
     runs-on: ubuntu-20.04
     timeout-minutes: 15
     steps:
-    - uses: actions/checkout@v2
-    - name: Prepare Node.js
-      uses: actions/setup-node@v1
-      with:
-        node-version: 14.x
-    - name: Get M2 cache
-      uses: actions/cache@v2
-      with:
-        path: ~/.m2
-        key: ${{ runner.os }}-cljs-${{ hashFiles('**/shadow-cljs.edn') }}
-    - name: Get yarn cache
-      uses: actions/cache@v2
-      with:
-        path: ~/.cache/yarn
-        key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
-    - name: Get node_modules cache
-      uses: actions/cache@v2
-      with:
-        path: node_modules
-        key: ${{ runner.os }}-node-modules-${{ hashFiles('**/yarn.lock') }}
-    - run: yarn install --frozen-lockfile --prefer-offline
+    - uses: actions/checkout@v3
+    - name: Prepare front-end environment
+      uses: ./.github/actions/prepare-frontend
     - run: yarn test-unit frontend/test/metabase/lib/expressions/fuzz.tokenizer.unit.spec.js
       env:
         MB_FUZZ: 1
@@ -52,27 +27,9 @@ jobs:
     runs-on: ubuntu-20.04
     timeout-minutes: 15
     steps:
-    - uses: actions/checkout@v2
-    - name: Prepare Node.js
-      uses: actions/setup-node@v1
-      with:
-        node-version: 14.x
-    - name: Get M2 cache
-      uses: actions/cache@v2
-      with:
-        path: ~/.m2
-        key: ${{ runner.os }}-cljs-${{ hashFiles('**/shadow-cljs.edn') }}
-    - name: Get yarn cache
-      uses: actions/cache@v2
-      with:
-        path: ~/.cache/yarn
-        key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
-    - name: Get node_modules cache
-      uses: actions/cache@v2
-      with:
-        path: node_modules
-        key: ${{ runner.os }}-node-modules-${{ hashFiles('**/yarn.lock') }}
-    - run: yarn install --frozen-lockfile --prefer-offline
+    - uses: actions/checkout@v3
+    - name: Prepare front-end environment
+      uses: ./.github/actions/prepare-frontend
     - run: yarn test-unit frontend/test/metabase/lib/expressions/fuzz.recursive-parser.unit.spec.js
       env:
         MB_FUZZ: 1

.github/workflows/i18n.yml

@@ -1,18 +1,11 @@
 name: i18n
 
 on:
-  pull_request:
   push:
     branches:
-      - '**'
-    paths:
-    - '**.clj*'
-    - '**.js'
-    - '**.jsx'
-    - '**.ts'
-    - '**.tsx'
-    - '.github/workflows/**'
-    - 'bin/**'
+      - 'master'
+      - 'release-**'
+  pull_request:
 
 jobs:
 
@@ -20,37 +13,15 @@ jobs:
     runs-on: ubuntu-20.04
     timeout-minutes: 15
     steps:
-    - uses: actions/checkout@v2
-    - name: Prepare Node.js
-      uses: actions/setup-node@v1
+    - uses: actions/checkout@v3
+    - name: Prepare front-end environment
+      uses: ./.github/actions/prepare-frontend
+    - name: Prepare back-end environment
+      uses: ./.github/actions/prepare-backend
       with:
-        node-version: 14.x
-    - name: Get yarn cache
-      uses: actions/cache@v2
-      with:
-        path: ~/.cache/yarn
-        key: ${{ runner.os }}-i18n-${{ hashFiles('**/yarn.lock') }}
-    - name: Get node_modules cache
-      uses: actions/cache@v2
-      with:
-        path: node_modules
-        key: ${{ runner.os }}-node-modules-${{ hashFiles('**/yarn.lock') }}
-    - run: yarn install --frozen-lockfile --prefer-offline
-
+        m2-cache-key: 'i18n'
     - run: sudo apt install gettext
 
-    - name: Install Clojure CLI
-      run: |
-        curl -O https://download.clojure.org/install/linux-install-1.10.3.933.sh &&
-        sudo bash ./linux-install-1.10.3.933.sh
-    - name: Get M2 cache
-      uses: actions/cache@v2
-      with:
-        path: |
-          ~/.m2
-          ~/.gitlibs
-        key: ${{ runner.os }}-i18n-${{ hashFiles('**/deps.edn') }}
-
     - run: ./bin/i18n/update-translation-template
       name: Check i18n tags/make sure template can be built
     - run: ./bin/i18n/build-translation-resources

.github/workflows/migrations.yml

@@ -0,0 +1,20 @@
+name: Migrations
+
+on:
+  push:
+    branches:
+      - 'master'
+      - 'release-**'
+  pull_request:
+
+jobs:
+
+  check-migrations:
+    runs-on: ubuntu-20.04
+    timeout-minutes: 15
+    steps:
+    - uses: actions/checkout@v3
+    - name: Prepare back-end environment
+      uses: ./.github/actions/prepare-backend
+    - name: Verify Liquibase Migrations
+      run: ./bin/lint-migrations-file.sh

.github/workflows/percy-issue-comment.yml

@@ -14,6 +14,18 @@ jobs:
       branch_name: ${{ fromJson(steps.fetch_pr.outputs.data).head.ref }}
       commit_sha: ${{ fromJson(steps.fetch_pr.outputs.data).head.sha }}
     steps:
+      - id: is_organization_member
+        uses: JamesSingleton/is-organization-member@1.0.0
+        with:
+          organization: metabase
+          username: ${{ github.event.issue.user.login }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+      - run: |
+          result=${{ steps.is_organization_member.outputs.result }}
+          if [ $result == false ]; then
+              echo User ${{ github.event.comment.user.login }} is not a member of Metabase organization
+              exit 1
+          fi
       - name: Fetch issue
         uses: octokit/request-action@v2.x
         id: fetch_issue
@@ -32,7 +44,7 @@ jobs:
   build:
     runs-on: ubuntu-20.04
     needs: pr_info
-    timeout-minutes: 60
+    timeout-minutes: 30
     strategy:
       matrix:
         edition: [oss]
@@ -40,98 +52,40 @@ jobs:
       MB_EDITION: ${{ matrix.edition }}
       INTERACTIVE: false
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
         with:
           ref: ${{ needs.pr_info.outputs.branch_name }}
           token: ${{ secrets.GITHUB_TOKEN }}
-      - name: Prepare Node.js
-        uses: actions/setup-node@v1
-        with:
-          node-version: 14.x
-      - name: Prepare JDK 8
-        uses: actions/setup-java@v2
-        with:
-          java-version: 8
-          distribution: "temurin"
-      - name: Install Clojure CLI
-        run: |
-          curl -O https://download.clojure.org/install/linux-install-1.10.3.933.sh &&
-          sudo bash ./linux-install-1.10.3.933.sh
-      - name: Check versions
-        run: |
-          echo "Node.js `node --version`"
-          echo "yarn `yarn --version`"
-          java -version
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
 
-      - name: Get yarn cache
-        uses: actions/cache@v2
-        with:
-          path: ~/.cache/yarn
-          key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
-      - name: Get node_modules cache
-        uses: actions/cache@v2
-        with:
-          path: node_modules
-          key: ${{ runner.os }}-node-modules-${{ hashFiles('**/yarn.lock') }}
-      - name: Get M2 cache
-        uses: actions/cache@v2
-        with:
-          path: ~/.m2
-          key: ${{ runner.os }}-m2-${{ hashFiles('**/deps.edn') }}
-
-      - run: yarn install --frozen-lockfile --prefer-offline
       - run: ./bin/build
 
-      - name: Mark with the commit hash
-        run: git rev-parse --short HEAD > COMMIT-ID
-      - name: Calculate SHA256 checksum
-        run: sha256sum ./target/uberjar/metabase.jar > SHA256.sum
-      - name: Upload JARs as artifact
-        uses: actions/upload-artifact@v2
-        with:
-          name: metabase-${{ matrix.edition }}-uberjar
-          path: |
-            ./target/uberjar/metabase.jar
-            ./COMMIT-ID
-            ./SHA256.sum
+      - name: Prepare uberjar artifact
+        uses: ./.github/actions/prepare-uberjar-artifact
 
   percy:
     timeout-minutes: 30
+    runs-on: buildjet-4vcpu-ubuntu-2004
     needs: [build, pr_info]
-    runs-on: ubuntu-20.04
     env:
       NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
         with:
           ref: ${{ needs.pr_info.outputs.branch_name }}
           token: ${{ secrets.GITHUB_TOKEN }}
-      - name: Prepare Node.js
-        uses: actions/setup-node@v1
-        with:
-          node-version: 14.x
-      - name: Prepare JDK 8
-        uses: actions/setup-java@v2
-        with:
-          java-version: 8
-          distribution: "temurin"
-      - name: Install Clojure CLI
-        run: |
-          curl -O https://download.clojure.org/install/linux-install-1.10.3.933.sh &&
-          sudo bash ./linux-install-1.10.3.933.sh
-      - name: Check versions
-        run: |
-          echo "Node.js `node --version`"
-          echo "yarn `yarn --version`"
-          java -version
-      - name: Get yarn cache
-        uses: actions/cache@v2
-        with:
-          path: ~/.cache/yarn
-          key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
-      - run: yarn install --frozen-lockfile --prefer-offline
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+      - name: Prepare cypress environment
+        uses: ./.github/actions/prepare-cypress
+
       - uses: actions/download-artifact@v2
         name: Retrieve uberjar artifact
         with:
@@ -141,7 +95,7 @@ jobs:
           jar xf target/uberjar/metabase.jar version.properties
           mv version.properties resources/
       - name: Run maildev
-        run: docker run -d -p 80:80 -p 25:25 maildev/maildev
+        run: docker run -d -p 80:80 -p 25:25 maildev/maildev:1.1.0
       - name: Percy Test
         run: yarn run test-visual-no-build
         env:

.github/workflows/percy.yml

@@ -16,7 +16,7 @@ on:
 jobs:
   build:
     runs-on: buildjet-2vcpu-ubuntu-2004
-    timeout-minutes: 60
+    timeout-minutes: 25
     strategy:
       matrix:
         edition: [oss]
@@ -24,106 +24,29 @@ jobs:
       MB_EDITION: ${{ matrix.edition }}
       INTERACTIVE: false
     steps:
-      - uses: actions/checkout@v2
-      - name: Prepare Node.js
-        uses: actions/setup-node@v1
-        with:
-          node-version: 14.x
-      - name: Prepare JDK 8
-        uses: actions/setup-java@v2
-        with:
-          java-version: 8
-          distribution: "temurin"
-      - name: Install Clojure CLI
-        run: |
-          curl -O https://download.clojure.org/install/linux-install-1.10.3.933.sh &&
-          sudo bash ./linux-install-1.10.3.933.sh
-      - name: Check versions
-        run: |
-          echo "Node.js `node --version`"
-          echo "yarn `yarn --version`"
-          java -version
+      - uses: actions/checkout@v3
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
 
-      - name: Get yarn cache
-        uses: actions/cache@v2
-        with:
-          path: ~/.cache/yarn
-          key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
-      - name: Get node_modules cache
-        uses: actions/cache@v2
-        with:
-          path: node_modules
-          key: ${{ runner.os }}-node-modules-${{ hashFiles('**/yarn.lock') }}
-      - name: Get M2 cache
-        uses: actions/cache@v2
-        with:
-          path: ~/.m2
-          key: ${{ runner.os }}-m2-${{ hashFiles('**/deps.edn') }}
-
-      - run: yarn install --frozen-lockfile --prefer-offline
       - run: ./bin/build
 
-      - name: Mark with the commit hash
-        run: git rev-parse --short HEAD > COMMIT-ID
-      - name: Calculate SHA256 checksum
-        run: sha256sum ./target/uberjar/metabase.jar > SHA256.sum
-      - name: Upload JARs as artifact
-        uses: actions/upload-artifact@v2
-        with:
-          name: metabase-${{ matrix.edition }}-uberjar
-          path: |
-            ./target/uberjar/metabase.jar
-            ./COMMIT-ID
-            ./SHA256.sum
+      - name: Prepare uberjar artifact
+        uses: ./.github/actions/prepare-uberjar-artifact
 
   percy:
-    runs-on: ubuntu-20.04
     timeout-minutes: 30
+    runs-on: buildjet-4vcpu-ubuntu-2004
     needs: build
     steps:
-      - uses: actions/checkout@v2
-      - name: Prepare Node.js
-        uses: actions/setup-node@v1
-        with:
-          node-version: 14.x
-      - name: Prepare JDK 8
-        uses: actions/setup-java@v2
-        with:
-          java-version: 8
-          distribution: "temurin"
-      - name: Install Clojure CLI
-        run: |
-          curl -O https://download.clojure.org/install/linux-install-1.10.3.933.sh &&
-          sudo bash ./linux-install-1.10.3.933.sh
-      - name: Check versions
-        run: |
-          echo "Node.js `node --version`"
-          echo "yarn `yarn --version`"
-          java -version
-      - name: Get yarn cache
-        uses: actions/cache@v2
-        with:
-          path: ~/.cache/yarn
-          key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
-      - name: Get node_modules cache
-        uses: actions/cache@v2
-        with:
-          path: node_modules
-          key: ${{ runner.os }}-node-modules-${{ hashFiles('**/yarn.lock') }}
-
-      - name: Get Cypress cache
-        uses: actions/cache@v2
-        with:
-          path: ~/.cache/Cypress
-          key: ${{ runner.os }}-Cypress-${{ hashFiles('**/yarn.lock') }}
-      - name: Ensure that Cypress is ready
-        run: |
-          yarn cypress install
-          yarn cypress cache path
-          yarn cypress cache list
-          yarn cypress verify
-
-      - run: yarn install --frozen-lockfile --prefer-offline
+      - uses: actions/checkout@v3
+      - name: Prepare front-end environment
+        uses: ./.github/actions/prepare-frontend
+      - name: Prepare back-end environment
+        uses: ./.github/actions/prepare-backend
+      - name: Prepare cypress environment
+        uses: ./.github/actions/prepare-cypress
 
       - uses: actions/download-artifact@v2
         name: Retrieve uberjar artifact
@@ -134,7 +57,7 @@ jobs:
           jar xf target/uberjar/metabase.jar version.properties
           mv version.properties resources/
       - name: Run maildev
-        run: docker run -d -p 80:80 -p 25:25 maildev/maildev
+        run: docker run -d -p 80:80 -p 25:25 maildev/maildev:1.1.0
       - name: Percy Test
         run: yarn run test-visual-no-build
         env:

.github/workflows/presto-kerberos-integration-test.yml

@@ -30,11 +30,11 @@ jobs:
             && sudo ./install \
             && cd -
       - name: Checkout Metabase repository
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
       - name: Check out Presto Kerberos Docker Compose
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
         with:
           repository: metabase/presto-kerberos-docker
           # use a custom branch if/until upstream (mik-laj/presto-kerberos-docker) can be fixed with PRs 23 and 24
@@ -54,7 +54,7 @@ jobs:
       - name: Copy client.keytab file to resources
         run: docker cp presto-kerberos:/home/presto/client.keytab resources
       - name: Checkout mba
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
         with:
           repository: metabase/mba
           ref: master

.github/workflows/snowplow.yml

@@ -10,10 +10,10 @@ on:
 
 jobs:
   lint:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-20.04
     container: snowplow/igluctl:0.6.0
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v3
       - name: Lint
         run: igluctl lint snowplow

.github/workflows/uberjar.yml

@@ -1,19 +1,19 @@
-name: Uberjar
+name: Build + Docker Uberjar
 
 on:
   push:
-    branches:
-      - '**'
     paths-ignore:
     - 'docs/**'
     - 'frontend/test/**'
     - 'enterprise/frontend/test/**'
+    - ".**"
+    - "test*"
 
 jobs:
-
   build:
+    name: Build MB ${{ matrix.edition }}
     runs-on: ubuntu-20.04
-    timeout-minutes: 60
+    timeout-minutes: 40
     strategy:
       matrix:
         edition: [ee, oss]
@@ -21,63 +21,20 @@ jobs:
       MB_EDITION: ${{ matrix.edition }}
       INTERACTIVE: false
     steps:
-    - uses: actions/checkout@v2
-    - name: Prepare Node.js
-      uses: actions/setup-node@v1
-      with:
-        node-version: 14.x
-    - name: Prepare JDK 8
-      uses: actions/setup-java@v2
-      with:
-        java-version: 8
-        distribution: 'temurin'
-    - name: Install Clojure CLI
-      run: |
-        curl -O https://download.clojure.org/install/linux-install-1.10.3.933.sh &&
-        sudo bash ./linux-install-1.10.3.933.sh
-    - name: Check versions
-      run: |
-        echo "Node.js `node --version`"
-        echo "yarn `yarn --version`"
-        java -version
+    - name: Check out the code
+      uses: actions/checkout@v3
+    - name: Prepare front-end environment
+      uses: ./.github/actions/prepare-frontend
+    - name: Prepare back-end environment
+      uses: ./.github/actions/prepare-backend
+    - name: Build
+      run: ./bin/build
+    - name: Prepare uberjar artifact
+      uses: ./.github/actions/prepare-uberjar-artifact
 
-    - name: Get yarn cache
-      uses: actions/cache@v2
-      with:
-        path: ~/.cache/yarn
-        key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
-    - name: Get node_modules cache
-      uses: actions/cache@v2
-      with:
-        path: node_modules
-        key: ${{ runner.os }}-node-modules-${{ hashFiles('**/yarn.lock') }}
-    - name: Get M2 cache
-      uses: actions/cache@v2
-      with:
-        path: |
-          ~/.m2
-          ~/.gitlibs
-        key: ${{ runner.os }}-m2-${{ hashFiles('**/deps.edn') }}
-
-    - run: yarn install --frozen-lockfile --prefer-offline
-    - run: MB_EDITION=${{ matrix.edition }} ./bin/build
-
-    - name: Mark with the commit hash
-      run:  git rev-parse --short HEAD > COMMIT-ID
-    - name: Calculate SHA256 checksum
-      run: sha256sum ./target/uberjar/metabase.jar > SHA256.sum
-    - name: Upload JARs as artifact
-      uses: actions/upload-artifact@v2
-      with:
-        name: metabase-${{ matrix.edition }}-uberjar
-        path: |
-          ./target/uberjar/metabase.jar
-          ./COMMIT-ID
-          ./SHA256.sum
-
-  check:
+  check_jar_health:
     runs-on: ubuntu-20.04
-    name: check ${{ matrix.edition }} (java ${{ matrix.java-version }})
+    name: Is ${{ matrix.edition }} (java ${{ matrix.java-version }}) healthy?
     needs: build
     timeout-minutes: 10
     strategy:
@@ -86,22 +43,80 @@ jobs:
         java-version: [8, 11, 17]
     steps:
     - name: Prepare JRE (Java Run-time Environment)
-      uses: actions/setup-java@v1
+      uses: actions/setup-java@v3
       with:
         java-package: jre
         java-version: ${{ matrix.java-version }}
+        distribution: 'temurin'
     - run: java -version
-
     - uses: actions/download-artifact@v2
       name: Retrieve uberjar artifact
       with:
         name: metabase-${{ matrix.edition }}-uberjar
-
     - name: Launch uberjar
       run: java -jar ./target/uberjar/metabase.jar &
     - name: Wait for Metabase to start
-      run: while ! curl -s localhost:3000/api/health; do sleep 1; done
-      timeout-minutes: 5
+      run: while ! curl -s 'http://localhost:3000/api/health' | grep '{"status":"ok"}'; do sleep 1; done
 
-    - name: Check API health
-      run: curl -s localhost:3000/api/health
+  containerize_test_and_push_container:
+    runs-on: ubuntu-20.04
+    name: Containerize ${{ matrix.edition }}
+    needs: check_jar_health
+    strategy:
+      matrix:
+        edition: [ee, oss]
+    services:
+      registry:
+        image: registry:2
+        ports:
+          - 5000:5000
+    steps:
+    - name: Extract and clean branch name
+      shell: bash
+      run: echo "##[set-output name=branch;]$(echo ${GITHUB_REF#refs/heads/} | sed 's/[^-._a-zA-Z0-9]/-/g')"
+      id: extract_branch
+    - name: Check out the code (Dockerfile needed)
+      uses: actions/checkout@v3
+    - name: Download uploaded artifacts to insert into container
+      uses: actions/download-artifact@v2
+      with:
+        name: metabase-${{ matrix.edition }}-uberjar
+        path: bin/docker/
+    - name: Move the ${{ matrix.edition }} uberjar to the context dir
+      run: mv bin/docker/target/uberjar/metabase.jar bin/docker/.
+    - name: Set up Docker Buildx
+      id: buildx
+      uses: docker/setup-buildx-action@v1
+      with:
+        driver-opts: network=host
+    - name: Build ${{ matrix.edition }} container
+      uses: docker/build-push-action@v2
+      with:
+        context: bin/docker/.
+        platforms: linux/amd64
+        network: host
+        tags: localhost:5000/metabase-dev:${{ steps.extract_branch.outputs.branch }}-${{ matrix.edition }}
+        no-cache: true
+        push: true
+    - name: Launch ${{ matrix.edition }} container
+      run: docker run --rm -dp 3000:3000 localhost:5000/metabase-dev:${{ steps.extract_branch.outputs.branch }}-${{ matrix.edition }}
+      timeout-minutes: 5
+    - name: Is Docker running?
+      run: docker ps
+    - name: Wait for Metabase to start and reach 100% health
+      run: while ! curl -s 'http://localhost:3000/api/health' | grep '{"status":"ok"}'; do sleep 1; done
+      timeout-minutes: 1
+    - name: Login to Docker Hub
+      uses: docker/login-action@v1
+      with:
+        username: ${{ secrets.DOCKERHUB_USERNAME }}
+        password: ${{ secrets.DOCKERHUB_TOKEN }}
+    - name: Retag and push images if master or main (ee)
+      if: ${{ (github.ref_name == 'master' || github.ref_name == 'main') && matrix.edition == 'ee' }}
+      run: docker tag localhost:5000/metabase-dev:${{ steps.extract_branch.outputs.branch }}-ee metabase/metabase-enterprise-head:latest && docker push metabase/metabase-enterprise-head:latest
+    - name: Retag and push images if master or main (oss)
+      if: ${{ (github.ref_name == 'master' || github.ref_name == 'main') && matrix.edition == 'oss' }}
+      run: docker tag localhost:5000/metabase-dev:${{ steps.extract_branch.outputs.branch }}-oss metabase/metabase-head:latest && docker push metabase/metabase-head:latest
+    - name: Retag and push images if branch
+      if: ${{ !(startsWith(github.ref_name,'master') || startsWith(github.ref_name,'main') || startsWith(github.ref_name,'backport')) && matrix.edition == 'ee' }}
+      run: docker tag localhost:5000/metabase-dev:${{ steps.extract_branch.outputs.branch }}-ee metabase/metabase-dev:${{ steps.extract_branch.outputs.branch }} && docker push metabase/metabase-dev:${{ steps.extract_branch.outputs.branch }}

.github/workflows/whitespace.yml

@@ -1,42 +1,21 @@
 name: Whitespace
 
 on:
-  pull_request:
   push:
     branches:
-      - '**'
-    paths:
-      - '**.yaml'
-      - '**.yml'
-      - '**.clj'
-      - '**.edn'
-      - '**.el'
-      - '**.html'
-      - '**.json'
-      - '**.js*'
-      - '**.sh'
+      - 'master'
+      - 'release-**'
+  pull_request:
 
 jobs:
   whitespace-linter:
     runs-on: ubuntu-20.04
     timeout-minutes: 5
     steps:
-    - uses: actions/checkout@v2
-    - name: Prepare JDK 11
-      uses: actions/setup-java@v2
+    - uses: actions/checkout@v3
+    - name: Prepare back-end environment
+      uses: ./.github/actions/prepare-backend
       with:
-        java-version: 11
-        distribution: 'temurin'
-    - name: Install Clojure CLI
-      run: |
-        curl -O https://download.clojure.org/install/linux-install-1.10.3.933.sh &&
-        sudo bash ./linux-install-1.10.3.933.sh
-    - name: Get M2 cache
-      uses: actions/cache@v2
-      with:
-        path: |
-          ~/.m2
-          ~/.gitlibs
-        key: ${{ runner.os }}-whitespace-linter-${{ hashFiles('**/deps.edn') }}
+        m2-cache-key: 'whitespace-linter'
     - run: clojure -T:whitespace-linter lint
       name: Run Whitespace Linter

.github/workflows/yaml.yml

@@ -1,14 +1,11 @@
 name: YAML
 
 on:
-  pull_request:
   push:
     branches:
-      - '**'
-    paths:
-    - '**.yml'
-    - '**.yaml'
-    - 'package.json'
+      - 'master'
+      - 'release-**'
+  pull_request:
 
 jobs:
 
@@ -16,20 +13,7 @@ jobs:
     runs-on: ubuntu-20.04
     timeout-minutes: 10
     steps:
-    - uses: actions/checkout@v2
-    - name: Prepare Node.js
-      uses: actions/setup-node@v1
-      with:
-        node-version: 14.x
-    - name: Get yarn cache
-      uses: actions/cache@v2
-      with:
-        path: ~/.cache/yarn
-        key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
-    - name: Get node_modules cache
-      uses: actions/cache@v2
-      with:
-        path: node_modules
-        key: ${{ runner.os }}-node-modules-${{ hashFiles('**/yarn.lock') }}
-    - run: yarn install --frozen-lockfile --prefer-offline
+    - uses: actions/checkout@v3
+    - name: Prepare front-end environment
+      uses: ./.github/actions/prepare-frontend
     - run: yarn run lint-yaml

.gitignore

@@ -80,3 +80,4 @@ dev/src/dev/nocommit/
 .lsp/*
 !.lsp/config.edn
 .clj-kondo/.cache
+*.code-workspace

.lsp/config.edn

@@ -1,4 +1,8 @@
 {:keep-require-at-start?        true
  :show-docs-arity-on-same-line? true
  :project-specs                 [{:project-path "deps.edn"
-                                  :classpath-cmd ["clojure" "-A:dev:ee:ee-dev:drivers:drivers-dev" "-Spath"]}]}
+                                  :classpath-cmd ["clojure" "-A:dev:ee:ee-dev:drivers:drivers-dev" "-Spath"]}]
+
+ :linters {:clojure-lsp/unused-public-var {:level :warning
+                                           :exclude-when-defined-by
+                                           #{metabase.api.common/defendpoint}}}}

.storybook/main.js

@@ -21,6 +21,7 @@ module.exports = {
     resolve: {
       ...storybookConfig.resolve,
       alias: appConfig.resolve.alias,
+      extensions: appConfig.resolve.extensions,
     },
   }),
 };

Dockerfile

@@ -23,7 +23,9 @@ FROM eclipse-temurin:11-jre-alpine as runner
 ENV FC_LANG en-US LC_CTYPE en_US.UTF-8
 
 # dependencies
-RUN apk upgrade && apk add --update-cache --no-cache bash ttf-dejavu fontconfig curl java-cacerts && \
+RUN apk add -U bash ttf-dejavu fontconfig curl java-cacerts && \
+    apk upgrade && \
+    rm -rf /var/cache/apk/* && \
     mkdir -p /app/certs && \
     curl https://s3.amazonaws.com/rds-downloads/rds-combined-ca-bundle.pem -o /app/certs/rds-combined-ca-bundle.pem  && \
     /opt/java/openjdk/bin/keytool -noprompt -import -trustcacerts -alias aws-rds -file /app/certs/rds-combined-ca-bundle.pem -keystore /etc/ssl/certs/java/cacerts -keypass changeit -storepass changeit && \

README.md

@@ -1,6 +1,6 @@
 # Metabase
 
-Metabase is the easy, open source way for everyone in your company to ask questions and learn from data.
+[Metabase](https://www.metabase.com/) is the easy, open-source way for everyone in your company to ask questions and learn from data.
 
 ![Metabase Product Screenshot](docs/metabase-product-screenshot.png)
 
@@ -8,18 +8,19 @@ Metabase is the easy, open source way for everyone in your company to ask questi
 [![Circle CI](https://circleci.com/gh/metabase/metabase.svg?style=svg&circle-token=3ccf0aa841028af027f2ac9e8df17ce603e90ef9)](https://circleci.com/gh/metabase/metabase)
 [![codecov](https://codecov.io/gh/metabase/metabase/branch/master/graph/badge.svg)](https://codecov.io/gh/metabase/metabase)
 
-# Features
+## Features
 
-- 5 minute [setup](https://metabase.com/docs/latest/setting-up-metabase.html) (We're not kidding)
-- Let anyone on your team [ask questions](https://metabase.com/docs/latest/users-guide/04-asking-questions.html) without knowing SQL
-- Rich beautiful [dashboards](https://metabase.com/docs/latest/users-guide/06-sharing-answers.html) with auto refresh and fullscreen
-- [SQL Mode](https://www.metabase.com/docs/latest/users-guide/writing-sql.html) for analysts and data pros
-- Create canonical [segments and metrics](https://metabase.com/docs/latest/administration-guide/07-segments-and-metrics.html) for your team to use
-- Send data to Slack or email on a schedule with [dashboard subscriptions](https://www.metabase.com/docs/latest/users-guide/dashboard-subscriptions.html)
-- [Humanize data](https://metabase.com/docs/latest/administration-guide/03-metadata-editing.html) for your team by renaming, annotating and hiding fields
-- See changes in your data with [alerts](https://www.metabase.com/docs/latest/users-guide/15-alerts.html)
+- [Set up in five minutes](https://metabase.com/docs/latest/setting-up-metabase.html) (we're not kidding).
+- Let anyone on your team [ask questions](https://metabase.com/docs/latest/users-guide/04-asking-questions.html) without knowing SQL.
+- Use the [SQL editor](https://www.metabase.com/docs/latest/users-guide/writing-sql.html) for more complex queries. 
+- Build handsome, interactive [dashboards](https://metabase.com/docs/latest/users-guide/06-sharing-answers.html) with filters, auto-refresh, fullscreen, and custom click behavior.
+- Create [models](https://www.metabase.com/learn/getting-started/models) that clean up, annotate, and/or combine raw tables.
+- Define canonical [segments and metrics](https://metabase.com/docs/latest/administration-guide/07-segments-and-metrics.html) for your team to use.
+- Send data to Slack or email on a schedule with [dashboard subscriptions](https://www.metabase.com/docs/latest/users-guide/dashboard-subscriptions.html).
+- Set up [alerts](https://www.metabase.com/docs/latest/users-guide/15-alerts.html) to have Metabase notify you when your data changes.
+- [Embed charts and dashboards](https://www.metabase.com/docs/latest/administration-guide/13-embedding.html) in your app, or even [your entire Metabase](https://www.metabase.com/docs/latest/enterprise-guide/full-app-embedding.html).
 
-For more information check out [metabase.com](https://metabase.com/)
+Take a [tour of Metabase](https://www.metabase.com/learn/getting-started/tour-of-metabase).
 
 ## Supported databases
 
@@ -28,65 +29,33 @@ For more information check out [metabase.com](https://metabase.com/)
 
 ## Installation
 
-Metabase can be run just about anywhere so checkout our [Installation Guides](https://www.metabase.com/docs/latest/operations-guide/installing-metabase.html) for detailed instructions for various deployments. Here's the TLDR:
+Metabase can be run just about anywhere. Check out our [Installation Guides](https://www.metabase.com/docs/latest/operations-guide/installing-metabase.html).
 
-### Docker
+## Contributing
 
-To run Metabase via Docker, just type
+To get started with a development installation of the Metabase, check out our [Developers Guide](https://www.metabase.com/docs/latest/developers-guide/start).
 
-```
-docker run -d -p 3000:3000 --name metabase metabase/metabase
-```
+## Internationalization
 
-### JAR file
+We want Metabase to be available in as many languages as possible. See which translations are available and help contribute to internationalization using our project over at [POEditor](https://poeditor.com/join/project/ynjQmwSsGh). You can also check out our [policies on translations](https://www.metabase.com/docs/latest/administration-guide/localization.html).
 
-To run Metabase via a JAR file, you will need to have a Java Runtime Environment installed on your system.
-
-We recommend the latest LTS version of JRE from [Eclipse Temurin](https://adoptium.net/) with HotSpot JVM and x64 architecture, but other [Java versions](https://www.metabase.com/docs/latest/operations-guide/java-versions.html) might work too.
-
-Go to the [Metabase download page](https://metabase.com/start/jar.html) and download the latest release. Place the downloaded JAR file into a newly created directory (as it will create some files when it is run), and run it with the following command:
-
-```
-java -jar metabase.jar
-```
-
-Now, open a browser and go to [http://localhost:3000](http://localhost:3000) , and you will be asked a set of questions that will set up a user account, and then you can add a database connection. For this to work you will need to get some information about which database you want to connect to, such as the Host Name and Port that it is running on, the Database Name and the User and Password that you will be using.
-
-Once you have added this connection, you will be taken into the app and you'll be ready to ask your first question.
-
-For a more detailed walkthrough, check out our [Getting Started](https://www.metabase.com/docs/latest/getting-started.html) guide.
-
-# Frequently Asked Questions
-
-Some questions come up over and over again. Check here first:
-[FAQ](https://www.metabase.com/docs/latest/faq/start.html)
-
-# Security Disclosure
-
-See [SECURITY.md](./SECURITY.md) for details.
-
-# Contributing
-
-To get started with a development installation of the Metabase, follow the instructions at our [Developers Guide](https://www.metabase.com/docs/latest/developers-guide.html).
-
-Then take a look at our [Contribution Guide](https://www.metabase.com/docs/latest/contributing.html) for information about our process and where you can fit in!
-
-# Internationalization
-
-We want Metabase to be available in as many languages as possible. See which translations are available and help contribute to internationalization using our project over at [POEditor](https://poeditor.com/join/project/ynjQmwSsGh). You can also check out our [policies on translations](https://www.metabase.com/docs/latest/faq/general/what-languages-can-be-used-with-metabase.html).
-
-# Extending and Deep Integrations
+## Extending Metabase
 
 Metabase also allows you to hit our Query API directly from Javascript to integrate the simple analytics we provide with your own application or third party services to do things like:
 
-- Build moderation interfaces
-- Export subsets of your users to third party marketing automation software
-- Provide a specialized customer lookup application for the people in your company
+- Build moderation interfaces.
+- Export subsets of your users to third party marketing automation software.
+- Provide a specialized customer lookup application for the people in your company.
 
+Check out our guide, [Working with the Metabase API](https://www.metabase.com/learn/administration/metabase-api).
 
-# License
+## Security Disclosure
 
-This repository contains the source code for both the Open Source edition of Metabase, released under the AGPL, as well as the commercial edition of Metabase Enterprise, released under the Metabase Commercial Software License. 
+See [SECURITY.md](./SECURITY.md) for details.
+
+## License
+
+This repository contains the source code for both the Open Source edition of Metabase, released under the AGPL, as well as the [commercial editions of Metabase](https://www.metabase.com/pricing/), which are released under the Metabase Commercial Software License. 
 
 See [LICENSE.txt](./LICENSE.txt) for details.
 

bin/build

@@ -12,8 +12,5 @@ check_clojure_cli
 source "./bin/clear-outdated-cpcaches.sh"
 clear_outdated_cpcaches
 
-source "./bin/prep.sh"
-prep_deps
-
 cd bin/build-mb
 clojure -M -m build $@

bin/build-driver.sh

@@ -19,8 +19,5 @@ check_clojure_cli
 source "./bin/clear-outdated-cpcaches.sh"
 clear_outdated_cpcaches
 
-source "./bin/prep.sh"
-prep_deps
-
 cd bin/build-drivers
 clojure -M -m build-driver $@

bin/build-drivers.sh

@@ -12,8 +12,5 @@ check_clojure_cli
 source "./bin/clear-outdated-cpcaches.sh"
 clear_outdated_cpcaches
 
-source "./bin/prep.sh"
-prep_deps
-
 cd bin/build-drivers
 clojure -M -m build-drivers $@

bin/build-drivers/src/build_drivers/create_uberjar.clj

@@ -51,7 +51,7 @@
     ;; log which libs we're including and excluding.
     (doseq [lib (sort (keys (:libs basis)))]
       (u/announce (if-let [provider (get provided-lib->provider lib)]
-                    (format "SKIP %%45s (provided by %s)" provider)
+                    (format "SKIP    %%s (provided by %s)" provider)
                     "INCLUDE %s")
                   (colorize/yellow lib)))
     ;; now remove the provide libs from `:classpath`, `:classpath-roots`, and `:libs`

bin/build-drivers/src/build_drivers/lint_manifest_file.clj

@@ -28,7 +28,7 @@
 (s/def ::parent (s/or :single-parent string? :multiple-parent (s/coll-of string?)))
 
 (s/def ::required boolean?)
-(s/def ::placeholder string?)
+(s/def ::placeholder any?)
 (s/def ::type #(contains? property-types %))
 (s/def ::visible-if (s/map-of keyword? any?))
 

bin/build-for-test

@@ -7,7 +7,7 @@ VERSION_PROPERTY_NAME="src_hash"
 source-hash() {
   # hash all the files that might change a backend-only uberjar build (for integration tests)
   (
-    find src deps.edn resources/sample-dataset.db.mv.db -type f -print0 | xargs -0 shasum ;
+    find src deps.edn resources/sample-database.db.mv.db -type f -print0 | xargs -0 shasum ;
     find resources -type f \( -iname \*.clj -o -iname \*.edn -o -iname \*.yaml -o -iname \*.properties -o -iname \*.html \) -not -name "version.properties" -print0 | xargs -0 shasum ;
   ) | shasum | awk '{ print $1 }'
 }

bin/build-mb/deps.edn

@@ -4,14 +4,14 @@
  {common/common               {:local/root "../common"}
   build-drivers/build-drivers {:local/root "../build-drivers"}
   i18n/i18n                   {:local/root "../i18n"}
-  org.flatland/ordered        {:mvn/version "1.5.7"}}
+  org.flatland/ordered        {:mvn/version "1.15.10"}}
 
  :aliases
  {:test {:extra-paths ["test"]
          :extra-deps  {com.cognitect/test-runner {:git/url "https://github.com/cognitect-labs/test-runner.git"
-                                                  :sha     "209b64504cb3bd3b99ecfec7937b358a879f55c1"}
+                                                  :sha     "cc75980b43011773162b485f46f939dc5fba91e4"}
 
                        ;; the following deps are to have jars on the classpath for testing
                        org.apache.commons/commons-math3 {:mvn/version "3.6.1"}
-                       net.redhogs.cronparser/cron-parser-core {:mvn/version "3.4"}}
+                       net.redhogs.cronparser/cron-parser-core {:mvn/version "3.5"}}
          :main-opts   ["-m" "cognitect.test-runner"]}}}

bin/build-mb/resources/EPL_2.txt

@@ -0,0 +1,277 @@
+Eclipse Public License - v 2.0
+
+    THE ACCOMPANYING PROGRAM IS PROVIDED UNDER THE TERMS OF THIS ECLIPSE
+    PUBLIC LICENSE ("AGREEMENT"). ANY USE, REPRODUCTION OR DISTRIBUTION
+    OF THE PROGRAM CONSTITUTES RECIPIENT'S ACCEPTANCE OF THIS AGREEMENT.
+
+1. DEFINITIONS
+
+"Contribution" means:
+
+  a) in the case of the initial Contributor, the initial content
+     Distributed under this Agreement, and
+
+  b) in the case of each subsequent Contributor:
+     i) changes to the Program, and
+     ii) additions to the Program;
+  where such changes and/or additions to the Program originate from
+  and are Distributed by that particular Contributor. A Contribution
+  "originates" from a Contributor if it was added to the Program by
+  such Contributor itself or anyone acting on such Contributor's behalf.
+  Contributions do not include changes or additions to the Program that
+  are not Modified Works.
+
+"Contributor" means any person or entity that Distributes the Program.
+
+"Licensed Patents" mean patent claims licensable by a Contributor which
+are necessarily infringed by the use or sale of its Contribution alone
+or when combined with the Program.
+
+"Program" means the Contributions Distributed in accordance with this
+Agreement.
+
+"Recipient" means anyone who receives the Program under this Agreement
+or any Secondary License (as applicable), including Contributors.
+
+"Derivative Works" shall mean any work, whether in Source Code or other
+form, that is based on (or derived from) the Program and for which the
+editorial revisions, annotations, elaborations, or other modifications
+represent, as a whole, an original work of authorship.
+
+"Modified Works" shall mean any work in Source Code or other form that
+results from an addition to, deletion from, or modification of the
+contents of the Program, including, for purposes of clarity any new file
+in Source Code form that contains any contents of the Program. Modified
+Works shall not include works that contain only declarations,
+interfaces, types, classes, structures, or files of the Program solely
+in each case in order to link to, bind by name, or subclass the Program
+or Modified Works thereof.
+
+"Distribute" means the acts of a) distributing or b) making available
+in any manner that enables the transfer of a copy.
+
+"Source Code" means the form of a Program preferred for making
+modifications, including but not limited to software source code,
+documentation source, and configuration files.
+
+"Secondary License" means either the GNU General Public License,
+Version 2.0, or any later versions of that license, including any
+exceptions or additional permissions as identified by the initial
+Contributor.
+
+2. GRANT OF RIGHTS
+
+  a) Subject to the terms of this Agreement, each Contributor hereby
+  grants Recipient a non-exclusive, worldwide, royalty-free copyright
+  license to reproduce, prepare Derivative Works of, publicly display,
+  publicly perform, Distribute and sublicense the Contribution of such
+  Contributor, if any, and such Derivative Works.
+
+  b) Subject to the terms of this Agreement, each Contributor hereby
+  grants Recipient a non-exclusive, worldwide, royalty-free patent
+  license under Licensed Patents to make, use, sell, offer to sell,
+  import and otherwise transfer the Contribution of such Contributor,
+  if any, in Source Code or other form. This patent license shall
+  apply to the combination of the Contribution and the Program if, at
+  the time the Contribution is added by the Contributor, such addition
+  of the Contribution causes such combination to be covered by the
+  Licensed Patents. The patent license shall not apply to any other
+  combinations which include the Contribution. No hardware per se is
+  licensed hereunder.
+
+  c) Recipient understands that although each Contributor grants the
+  licenses to its Contributions set forth herein, no assurances are
+  provided by any Contributor that the Program does not infringe the
+  patent or other intellectual property rights of any other entity.
+  Each Contributor disclaims any liability to Recipient for claims
+  brought by any other entity based on infringement of intellectual
+  property rights or otherwise. As a condition to exercising the
+  rights and licenses granted hereunder, each Recipient hereby
+  assumes sole responsibility to secure any other intellectual
+  property rights needed, if any. For example, if a third party
+  patent license is required to allow Recipient to Distribute the
+  Program, it is Recipient's responsibility to acquire that license
+  before distributing the Program.
+
+  d) Each Contributor represents that to its knowledge it has
+  sufficient copyright rights in its Contribution, if any, to grant
+  the copyright license set forth in this Agreement.
+
+  e) Notwithstanding the terms of any Secondary License, no
+  Contributor makes additional grants to any Recipient (other than
+  those set forth in this Agreement) as a result of such Recipient's
+  receipt of the Program under the terms of a Secondary License
+  (if permitted under the terms of Section 3).
+
+3. REQUIREMENTS
+
+3.1 If a Contributor Distributes the Program in any form, then:
+
+  a) the Program must also be made available as Source Code, in
+  accordance with section 3.2, and the Contributor must accompany
+  the Program with a statement that the Source Code for the Program
+  is available under this Agreement, and informs Recipients how to
+  obtain it in a reasonable manner on or through a medium customarily
+  used for software exchange; and
+
+  b) the Contributor may Distribute the Program under a license
+  different than this Agreement, provided that such license:
+     i) effectively disclaims on behalf of all other Contributors all
+     warranties and conditions, express and implied, including
+     warranties or conditions of title and non-infringement, and
+     implied warranties or conditions of merchantability and fitness
+     for a particular purpose;
+
+     ii) effectively excludes on behalf of all other Contributors all
+     liability for damages, including direct, indirect, special,
+     incidental and consequential damages, such as lost profits;
+
+     iii) does not attempt to limit or alter the recipients' rights
+     in the Source Code under section 3.2; and
+
+     iv) requires any subsequent distribution of the Program by any
+     party to be under a license that satisfies the requirements
+     of this section 3.
+
+3.2 When the Program is Distributed as Source Code:
+
+  a) it must be made available under this Agreement, or if the
+  Program (i) is combined with other material in a separate file or
+  files made available under a Secondary License, and (ii) the initial
+  Contributor attached to the Source Code the notice described in
+  Exhibit A of this Agreement, then the Program may be made available
+  under the terms of such Secondary Licenses, and
+
+  b) a copy of this Agreement must be included with each copy of
+  the Program.
+
+3.3 Contributors may not remove or alter any copyright, patent,
+trademark, attribution notices, disclaimers of warranty, or limitations
+of liability ("notices") contained within the Program from any copy of
+the Program which they Distribute, provided that Contributors may add
+their own appropriate notices.
+
+4. COMMERCIAL DISTRIBUTION
+
+Commercial distributors of software may accept certain responsibilities
+with respect to end users, business partners and the like. While this
+license is intended to facilitate the commercial use of the Program,
+the Contributor who includes the Program in a commercial product
+offering should do so in a manner which does not create potential
+liability for other Contributors. Therefore, if a Contributor includes
+the Program in a commercial product offering, such Contributor
+("Commercial Contributor") hereby agrees to defend and indemnify every
+other Contributor ("Indemnified Contributor") against any losses,
+damages and costs (collectively "Losses") arising from claims, lawsuits
+and other legal actions brought by a third party against the Indemnified
+Contributor to the extent caused by the acts or omissions of such
+Commercial Contributor in connection with its distribution of the Program
+in a commercial product offering. The obligations in this section do not
+apply to any claims or Losses relating to any actual or alleged
+intellectual property infringement. In order to qualify, an Indemnified
+Contributor must: a) promptly notify the Commercial Contributor in
+writing of such claim, and b) allow the Commercial Contributor to control,
+and cooperate with the Commercial Contributor in, the defense and any
+related settlement negotiations. The Indemnified Contributor may
+participate in any such claim at its own expense.
+
+For example, a Contributor might include the Program in a commercial
+product offering, Product X. That Contributor is then a Commercial
+Contributor. If that Commercial Contributor then makes performance
+claims, or offers warranties related to Product X, those performance
+claims and warranties are such Commercial Contributor's responsibility
+alone. Under this section, the Commercial Contributor would have to
+defend claims against the other Contributors related to those performance
+claims and warranties, and if a court requires any other Contributor to
+pay any damages as a result, the Commercial Contributor must pay
+those damages.
+
+5. NO WARRANTY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, AND TO THE EXTENT
+PERMITTED BY APPLICABLE LAW, THE PROGRAM IS PROVIDED ON AN "AS IS"
+BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR
+IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF
+TITLE, NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR
+PURPOSE. Each Recipient is solely responsible for determining the
+appropriateness of using and distributing the Program and assumes all
+risks associated with its exercise of rights under this Agreement,
+including but not limited to the risks and costs of program errors,
+compliance with applicable laws, damage to or loss of data, programs
+or equipment, and unavailability or interruption of operations.
+
+6. DISCLAIMER OF LIABILITY
+
+EXCEPT AS EXPRESSLY SET FORTH IN THIS AGREEMENT, AND TO THE EXTENT
+PERMITTED BY APPLICABLE LAW, NEITHER RECIPIENT NOR ANY CONTRIBUTORS
+SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION LOST
+PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OR DISTRIBUTION OF THE PROGRAM OR THE
+EXERCISE OF ANY RIGHTS GRANTED HEREUNDER, EVEN IF ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGES.
+
+7. GENERAL
+
+If any provision of this Agreement is invalid or unenforceable under
+applicable law, it shall not affect the validity or enforceability of
+the remainder of the terms of this Agreement, and without further
+action by the parties hereto, such provision shall be reformed to the
+minimum extent necessary to make such provision valid and enforceable.
+
+If Recipient institutes patent litigation against any entity
+(including a cross-claim or counterclaim in a lawsuit) alleging that the
+Program itself (excluding combinations of the Program with other software
+or hardware) infringes such Recipient's patent(s), then such Recipient's
+rights granted under Section 2(b) shall terminate as of the date such
+litigation is filed.
+
+All Recipient's rights under this Agreement shall terminate if it
+fails to comply with any of the material terms or conditions of this
+Agreement and does not cure such failure in a reasonable period of
+time after becoming aware of such noncompliance. If all Recipient's
+rights under this Agreement terminate, Recipient agrees to cease use
+and distribution of the Program as soon as reasonably practicable.
+However, Recipient's obligations under this Agreement and any licenses
+granted by Recipient relating to the Program shall continue and survive.
+
+Everyone is permitted to copy and distribute copies of this Agreement,
+but in order to avoid inconsistency the Agreement is copyrighted and
+may only be modified in the following manner. The Agreement Steward
+reserves the right to publish new versions (including revisions) of
+this Agreement from time to time. No one other than the Agreement
+Steward has the right to modify this Agreement. The Eclipse Foundation
+is the initial Agreement Steward. The Eclipse Foundation may assign the
+responsibility to serve as the Agreement Steward to a suitable separate
+entity. Each new version of the Agreement will be given a distinguishing
+version number. The Program (including Contributions) may always be
+Distributed subject to the version of the Agreement under which it was
+received. In addition, after a new version of the Agreement is published,
+Contributor may elect to Distribute the Program (including its
+Contributions) under the new version.
+
+Except as expressly stated in Sections 2(a) and 2(b) above, Recipient
+receives no rights or licenses to the intellectual property of any
+Contributor under this Agreement, whether expressly, by implication,
+estoppel or otherwise. All rights in the Program not expressly granted
+under this Agreement are reserved. Nothing in this Agreement is intended
+to be enforceable by any entity that is not a Contributor or Recipient.
+No third-party beneficiary rights are created under this Agreement.
+
+Exhibit A - Form of Secondary Licenses Notice
+
+"This Source Code may also be made available under the following 
+Secondary Licenses when the conditions for such availability set forth 
+in the Eclipse Public License, v. 2.0 are satisfied: {name license(s),
+version(s), and exceptions or additional permissions here}."
+
+  Simply including a copy of this Agreement, including this Exhibit A
+  is not sufficient to license the Source Code under Secondary Licenses.
+
+  If it is not possible or desirable to put the notice in a particular
+  file, then You may include the notice in a location (such as a LICENSE
+  file in a relevant directory) where a recipient would be likely to
+  look for such a notice.
+
+  You may add additional accurate notices of copyright ownership.

bin/build-mb/resources/overrides.edn

@@ -1,32 +1,31 @@
 {:override/group
- {"org.clojure"                      {:resource "EPL.txt"},
-  "io.netty"                         {:resource "apache2_0.txt"},
-  "org.opensaml"                     {:resource "apache2_0.txt"},
-  "com.google.guava"                 {:resource "apache2_0.txt"},
-  "com.fasterxml.jackson.dataformat" {:resource "apache2_0.txt"},
-  "com.onelogin"                     {:resource "MIT.txt"},
-  "com.vladsch.flexmark"             {:resource "BSD.txt"},
-  "xalan"                            {:resource "apache2_0.txt"}
-  "org.apache.hadoop"                {:resource "apache2_0.txt"}
-  "org.ow2.asm"                      {:resource "BSD.txt"}
-  "org.eclipse.jetty"                {:resource "apache2_0.txt"}
-  ;; see if we can remove these if/when https://github.com/googleapis/java-core/issues/488 is done
-  "com.google.cloud"                 {:resource "apache2_0.txt"}
+ {"com.fasterxml.jackson.dataformat" {:resource "apache2_0.txt"}
   "com.google.auth"                  {:resource "apache2_0.txt"}
+  "com.google.cloud"                 {:resource "apache2_0.txt"}
   "com.google.code.gson"             {:resource "apache2_0.txt"}
+  "com.google.guava"                 {:resource "apache2_0.txt"}
+  "com.google.http-client"           {:resource "apache2_0.txt"}
   "com.google.protobuf"              {:resource "apache2_0.txt"}
-  "com.google.http-client"           {:resource "apache2_0.txt"}}
+  "com.onelogin"                     {:resource "MIT.txt"}
+  "com.vladsch.flexmark"             {:resource "BSD.txt"}
+  "io.netty"                         {:resource "apache2_0.txt"}
+  "org.apache.hadoop"                {:resource "apache2_0.txt"}
+  "org.clojure"                      {:resource "EPL.txt"}
+  "org.eclipse.jetty"                {:resource "apache2_0.txt"}
+  "org.opensaml"                     {:resource "apache2_0.txt"}
+  "org.ow2.asm"                      {:resource "BSD.txt"}
+  "xalan"                            {:resource "apache2_0.txt"}}
 
+ "amalloy"                    {"ring-gzip-middleware" {:resource "MIT.txt"}}
+ "buddy"                      {"buddy-core" {:resource "apache2_0.txt"}}
+ "colorize"                   {"colorize" {:resource "EPL.txt"}}
+ "com.google.api-client"      {"google-api-client" {:resource "apache2_0.txt"}}
  "com.google.http-client"     {"google-http-client"          {:resource "apache2_0.txt"}
                                "google-http-client-jackson2" {:resource "apache2_0.txt"}}
- "com.google.api-client"      {"google-api-client" {:resource "apache2_0.txt"}}
  "com.google.oauth-client"    {"google-oauth-client" {:resource "apache2_0.txt"}}
- "org.mortbay.jetty"          {"jetty"          {:resource "apache2_0.txt"}
-                               "jetty-util"     {:resource "apache2_0.txt"}
-                               "jetty-security" {:resource "apache2_0.txt"}}
  "com.jolbox"                 {"bonecp" {:resource "apache2_0.txt"}}
- "org.eclipse.jetty"          {"jetty-webapp" {:resource "EPL.txt"}}
- "org.fusesource.leveldbjni"  {"leveldbjni-all" {:resource "BSD.txt"}}
+ "com.sun.activation"         {"jakarta.activation" {:resource "EDL.txt"}}
+ "com.sun.istack"             {"istack-commons-runtime" {:resource "EDL.txt"}}
  "com.sun.jersey"             {"jersey-server"  {:resource "apache2_0.txt"}
                                "jersey-core"    {:resource "GPL1_1.txt"}
                                "jersey-json"    {:resource "GPL1_1.txt"}
@@ -34,24 +33,27 @@
                                "jersey-servlet" {:resource "GPL1_1.txt"}}
  "com.sun.jersey.contribs"    {"jersey-guice" {:resource "GPL1_1.txt"}}
  "com.thoughtworks.paranamer" {"paranamer" {:resource "BSD.txt"}}
+ "de.rototor.pdfbox"          {"graphics2d" {:resource "apache2_0.txt"}}
+ "hiccup"                     {"hiccup" {:resource "EPL.txt"}}
+ "io.dropwizard.metrics"      {"metrics-core" {:resource "apache2_0.txt"}}
+ "jakarta.activation"         {"jakarta.activation-api" {:resource "EDL.txt"}}
+ "jakarta.xml.bind"           {"jakarta.xml.bind-api" {:resource "EDL.txt"}}
  "javax.servlet.jsp"          {"jsp-api" {:resource "GPL2_0.txt"}}
-
- "org.openid4java"        {"openid4java-nodeps" {:resource "apache2_0.txt"}},
- "net.redhogs.cronparser" {"cron-parser-core" {:resource "MIT.txt"}},
- "org.slf4j"              {"slf4j-api" {:resource "MIT.txt"}},
- "amalloy"                {"ring-gzip-middleware" {:resource "MIT.txt"}},
- "jakarta.activation"     {"jakarta.activation-api" {:resource "EDL.txt"}},
- "com.sun.activation"     {"jakarta.activation" {:resource "EDL.txt"}}
- "net.jcip"               {"jcip-annotations" {:resource "CC_2_5.txt"}},
- "hiccup"                 {"hiccup" {:resource "EPL.txt"}},
- "jakarta.xml.bind"       {"jakarta.xml.bind-api" {:resource "EDL.txt"}},
- "net.shibboleth.utilities"
- {"java-support" {:resource "apache2_0.txt"}},
- "io.dropwizard.metrics"  {"metrics-core" {:resource "apache2_0.txt"}},
- "stencil"                {"stencil" {:resource "EPL.txt"}},
- "org.antlr"              {"antlr-runtime" {:resource "BSD.txt"}
-                           "antlr4-runtime" {:resource "BSD.txt"}},
- "de.rototor.pdfbox"      {"graphics2d" {:resource "apache2_0.txt"}},
- "colorize"               {"colorize" {:resource "EPL.txt"}},
- "org.liquibase"          {"liquibase-core" {:resource "apache2_0.txt"}},
- "org.quartz-scheduler"   {"quartz" {:resource "apache2_0.txt"}}}
+ "metabase"                   {"saml20-clj" {:resource "EPL_2.txt"}}
+ "net.jcip"                   {"jcip-annotations" {:resource "CC_2_5.txt"}}
+ "net.redhogs.cronparser"     {"cron-parser-core" {:resource "MIT.txt"}}
+ "net.shibboleth.utilities"   {"java-support" {:resource "apache2_0.txt"}}
+ "org.antlr"                  {"antlr-runtime"  {:resource "BSD.txt"}
+                               "antlr4-runtime" {:resource "BSD.txt"}}
+ "org.eclipse.jetty"          {"jetty-webapp" {:resource "EPL.txt"}}
+ "org.fusesource.leveldbjni"  {"leveldbjni-all" {:resource "BSD.txt"}}
+ "org.glassfish.jaxb"         {"jaxb-runtime" {:resource "EDL.txt"}
+                               "txw2"         {:resource "EDL.txt"}}
+ "org.liquibase"              {"liquibase-core" {:resource "apache2_0.txt"}}
+ "org.mortbay.jetty"          {"jetty"          {:resource "apache2_0.txt"}
+                               "jetty-util"     {:resource "apache2_0.txt"}
+                               "jetty-security" {:resource "apache2_0.txt"}}
+ "org.openid4java"            {"openid4java-nodeps" {:resource "apache2_0.txt"}}
+ "org.quartz-scheduler"       {"quartz" {:resource "apache2_0.txt"}}
+ "org.slf4j"                  {"slf4j-api" {:resource "MIT.txt"}}
+ "stencil"                    {"stencil" {:resource "EPL.txt"}}}

bin/build-mb/test/build/licenses_test.clj

@@ -90,9 +90,10 @@
                 :url          "http://opensource.org/licenses/eclipse-1.0.php"
                 :distribution "repo"}
                (lic/pom->licenses xml))))
-      (let [jar-filename (jar-filename-from-cp "org/clojure/clojure" classpath-urls)
-            jar-path (Paths/get jar-filename (into-array String []))]
-        (with-open [jar-fs (FileSystems/newFileSystem jar-path nil)]
+      (let [jar-filename             (jar-filename-from-cp "org/clojure/clojure" classpath-urls)
+            jar-path                 (Paths/get jar-filename (into-array String []))
+            ^ClassLoader classloader nil]
+        (with-open [jar-fs (FileSystems/newFileSystem jar-path classloader)]
           (let [pom-path (lic/determine-pom jar-filename jar-fs)]
             (is (= {:name         "Eclipse Public License 1.0"
                     :url          "http://opensource.org/licenses/eclipse-1.0.php"
@@ -208,17 +209,16 @@
 (deftest all-deps-have-licenses
   (testing "All deps on the classpath have licenses"
     (loop-until-success #(u/sh {:dir u/project-root-directory} "clojure" "-A:ee" "-P") 3 "download deps")
-    (let [edition :ee
-          classpath (u/sh {:dir    u/project-root-directory
-                           :quiet? true}
-                          "clojure"
-                          "-A:ee"
-                          "-Spath")
+    (let [classpath         (u/sh {:dir    u/project-root-directory
+                                   :quiet? true}
+                                  "clojure"
+                                  "-A:ee"
+                                  "-Spath")
           classpath-entries (->> (str/split (last classpath) (re-pattern lic/classpath-separator))
                                  (filter lic/jar-file?))]
       (let [results (lic/process* {:classpath-entries classpath-entries
-                                   :backfill  (edn/read-string
-                                                (slurp (io/resource "overrides.edn")))})]
+                                   :backfill          (edn/read-string
+                                                       (slurp (io/resource "overrides.edn")))})]
         (is (nil? (:without-license results))
             (str "Deps without license information:\n"
                  (str/join "\n" (map first (:without-license results)))))
@@ -226,8 +226,4 @@
                (into #{} (->> results :with-license (map first))))))
       (is (some? (:without-license
                   (lic/process* {:classpath-entries classpath-entries
-                                 :backfill  {}})))))))
-(comment
-  (run-tests)
-  (binding [clojure.test/*test-out* *out*] (run-tests))
-  )
+                                 :backfill          {}})))))))

bin/clear-outdated-cpcaches.sh

@@ -12,7 +12,7 @@ clear_outdated_cpcaches() {
     cd "$script_directory/.."
     project_root=`pwd`
 
-    cpcaches=`find bin java modules -type d -name .cpcache`
+    cpcaches=`find bin modules -type d -name .cpcache`
     if [ -d .cpcache ]; then
         cpcaches=".cpcache $cpcaches"
     fi
@@ -21,7 +21,7 @@ clear_outdated_cpcaches() {
         return 0
     fi
 
-    deps_edns="deps.edn $(find bin java modules -type f -name deps.edn)"
+    deps_edns="deps.edn $(find bin modules -type f -name deps.edn)"
 
     # find the OLDEST cpcache and NEWEST deps.edn files.
     oldest_cpcache=""

bin/common/deps.edn

@@ -1,13 +1,13 @@
 {:paths ["src"]
 
  :deps
- {commons-io/commons-io {:mvn/version "2.6"}
+ {commons-io/commons-io {:mvn/version "2.11.0"}
   colorize/colorize     {:mvn/version "0.1.1"}
-  environ/environ       {:mvn/version "1.1.0"}
+  environ/environ       {:mvn/version "1.2.0"}
   potemkin/potemkin     {:mvn/version "0.4.5"}}
 
  :aliases
  {:test {:extra-paths ["test"]
          :extra-deps  {com.cognitect/test-runner {:git/url "https://github.com/cognitect-labs/test-runner.git"
-                                                  :sha     "209b64504cb3bd3b99ecfec7937b358a879f55c1"}}
+                                                  :sha     "cc75980b43011773162b485f46f939dc5fba91e4"}}
          :main-opts   ["-m" "cognitect.test-runner"]}}}

bin/docker/Dockerfile

@@ -3,7 +3,9 @@ FROM eclipse-temurin:11-jre-alpine
 ENV FC_LANG en-US LC_CTYPE en_US.UTF-8
 
 # dependencies
-RUN apk upgrade & apk add --update-cache --no-cache bash ttf-dejavu fontconfig curl java-cacerts && \
+RUN apk add -U bash ttf-dejavu fontconfig curl java-cacerts && \
+    apk upgrade && \
+    rm -rf /var/cache/apk/* && \
     mkdir -p /app/certs && \
     curl https://s3.amazonaws.com/rds-downloads/rds-combined-ca-bundle.pem -o /app/certs/rds-combined-ca-bundle.pem  && \
     /opt/java/openjdk/bin/keytool -noprompt -import -trustcacerts -alias aws-rds -file /app/certs/rds-combined-ca-bundle.pem -keystore /etc/ssl/certs/java/cacerts -keypass changeit -storepass changeit && \

bin/i18n/update-translation-template

@@ -20,9 +20,6 @@ cd "$script_directory/../.."
 source "./bin/check-clojure-cli.sh"
 check_clojure_cli
 
-source "./bin/prep.sh"
-prep_deps
-
 POT_NAME="locales/metabase.pot"
 POT_BACKEND_NAME="locales/metabase-backend.pot"
 # NOTE: hardcoded in .babelrc
@@ -37,7 +34,7 @@ mkdir -p "locales"
 #######################
 
 # NOTE: about twice as fast to call babel directly rather than a full webpack build
-BABEL_ENV=extract ./node_modules/.bin/babel --quiet -x .js,.jsx -o /dev/null {enterprise/,}frontend/src
+BABEL_ENV=extract ./node_modules/.bin/babel --quiet -x .js,.jsx,.ts,.tsx -o /dev/null {enterprise/,}frontend/src
 # BABEL_ENV=extract BABEL_DISABLE_CACHE=1 yarn run build
 
 # NOTE: replace ttag's "${ 0 }" style references with xgettext "{0}" style references for consistency

bin/lint-migrations-file.sh

@@ -2,9 +2,9 @@
 
 set -euo pipefail
 
-# switch to project root directory if we're not already there
-script_directory=`dirname "${BASH_SOURCE[0]}"`
-cd "$script_directory/.."
+script_dir=`dirname "${BASH_SOURCE[0]}"`
+cd "$script_dir/.."
+root=
 
 source "./bin/check-clojure-cli.sh"
 check_clojure_cli
@@ -12,8 +12,5 @@ check_clojure_cli
 source "./bin/clear-outdated-cpcaches.sh"
 clear_outdated_cpcaches
 
-source "./bin/prep.sh"
-prep_deps
-
 cd bin/lint-migrations-file
 clojure -M -m lint-migrations-file $@

bin/lint-migrations-file/src/lint_migrations_file.clj

@@ -106,13 +106,13 @@
       (walk/postwalk walk-fn change-set))
     (empty? @problem-cols)))
 
-;; TODO -- change sets must be distinct by ID.
 (s/def ::databaseChangeLog
   (s/and distinct-change-set-ids?
          change-set-ids-in-order?
          no-bare-blob-or-text-types?
-         (s/+ (s/alt :property  (s/keys :req-un [::property])
-                     :changeSet (s/keys :req-un [::changeSet])))))
+         (s/+ (s/alt :property              (s/keys :req-un [::property])
+                     :objectQuotingStrategy (s/keys :req-un [::objectQuotingStrategy])
+                     :changeSet             (s/keys :req-un [::changeSet])))))
 
 (def strict-change-set-cutoff
   "All change sets with an ID >= this number will be validated with the strict spec."

bin/prep.sh

@@ -1,60 +0,0 @@
-#! /usr/bin/env bash
-
-# functions for running prep steps to compile Java and AOT source files, needed before running other stuff.
-
-script_directory=`dirname "${BASH_SOURCE[0]}"`
-cd "$script_directory/.."
-project_root=`pwd`
-
-clear_cpcaches() {
-    cd "$project_root"
-    for file in `find . -type d -name .cpcache`; do
-        rm -rf "$file"
-    done
-}
-
-compile_java_sources() {
-    cd "$project_root"
-
-    echo "Compile Java source files in $project_root/java if needed..."
-    if [ ! -d "$project_root/java/target/classes" ]; then
-        echo 'Compile Java source files'
-        cd "$project_root"
-        clojure -Sforce -X:deps prep
-    else
-        echo 'Java source files are already compiled'
-    fi
-}
-
-compile_spark_sql_aot_sources() {
-    cd "$project_root"
-
-    echo "Compile Spark SQL AOT source files in $project_root/modules/drivers/sparksql if needed..."
-    if [ ! -d "$project_root/modules/drivers/sparksql/target/classes" ]; then
-        echo 'Compile Spark SQL AOT source files'
-        cd "$project_root/modules/drivers"
-        clojure -Sforce -X:deps prep
-    else
-        echo 'Spark SQL AOT source files are already compiled'
-    fi
-}
-
-prep_deps() {
-    if compile_java_sources; then
-        echo "Java sources => OK"
-    else
-        echo 'Compilation failed (WHY?!); clearing classpath caches and trying again...'
-        clear_cpcaches
-        compile_java_sources
-    fi
-
-    if compile_spark_sql_aot_sources; then
-        echo "Spark SQL AOT sources => OK"
-    else
-        echo 'Compilation failed (WHY?!); clearing classpath caches and trying again...'
-        clear_cpcaches
-        compile_spark_sql_aot_sources
-    fi
-
-    cd "$project_root"
-}

bin/release.sh

@@ -12,8 +12,5 @@ check_clojure_cli
 source "./bin/clear-outdated-cpcaches.sh"
 clear_outdated_cpcaches
 
-source "./bin/prep.sh"
-prep_deps
-
 cd bin/release
 clojure -M -m release $@

bin/release/src/release.clj

@@ -5,7 +5,6 @@
             [metabuild-common.core :as u]
             [release
              [check-prereqs :as check-prereqs]
-             [checkout-latest :as checkout-latest]
              [common :as c]
              [docker :as docker]
              [draft-release :as draft-release]
@@ -22,7 +21,6 @@
 
 (def ^:private steps*
   (ordered-map/ordered-map
-   :checkout-latest                     checkout-latest/checkout-latest!
    :build-uberjar                       uberjar/build-uberjar!
    :build-docker                        docker/build-docker-image!
    :push-git-tags                       git-tags/push-tags!

bin/release/src/release/checkout_latest.clj

@@ -1,7 +0,0 @@
-(ns release.checkout-latest
-  (:require [metabuild-common.core :as u]
-            [release.common :as c]))
-
-(defn checkout-latest! []
-  (u/step (format "Checkout latest code for %s" (c/branch))
-    (u/sh {:dir u/project-root-directory} "git" "pull")))

build.clj

@@ -103,25 +103,7 @@
   {"Manifest-Version" "1.0"
    "Created-By"       "Metabase build.clj"
    "Build-Jdk-Spec"   (System/getProperty "java.specification.version")
-   "Main-Class"       "metabase.core"
-   "Liquibase-Package" (str/join ","
-                                 ["liquibase.change"
-                                  "liquibase.changelog"
-                                  "liquibase.database"
-                                  "liquibase.datatype"
-                                  "liquibase.diff"
-                                  "liquibase.executor"
-                                  "liquibase.ext"
-                                  "liquibase.lockservice"
-                                  "liquibase.logging"
-                                  "liquibase.parser"
-                                  "liquibase.precondition"
-                                  "liquibase.sdk"
-                                  "liquibase.serializer"
-                                  "liquibase.snapshot"
-                                  "liquibase.sqlgenerator"
-                                  "liquibase.structure"
-                                  "liquibase.structurecompare"])})
+   "Main-Class"       "metabase.core"})
 
 (defn manifest ^Manifest []
   (doto (Manifest.)

deps.edn

@@ -4,28 +4,27 @@
  ;; !!                                   PLEASE KEEP THESE ORGANIZED ALPHABETICALLY                                  !!
  ;; !!                                   AND ADD A COMMENT EXPLAINING THEIR PURPOSE                                  !!
  ;; !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
- {aleph/aleph                               {:mvn/version "0.4.6"               ; Async HTTP library; WebSockets
-                                             :exclusions  [org.clojure/tools.logging]}
-  amalloy/ring-buffer                       {:mvn/version "1.3.1"               ; fixed length queue implementation, used in log buffering
+ {amalloy/ring-buffer                       {:mvn/version "1.3.1"               ; fixed length queue implementation, used in log buffering
                                              :exclusions  [org.clojure/clojure
                                                            org.clojure/clojurescript]}
   amalloy/ring-gzip-middleware              {:mvn/version "0.1.4"}              ; Ring middleware to GZIP responses if client can handle it
-  bigml/histogram                           {:mvn/version "4.1.3"}              ; Histogram data structure
-  buddy/buddy-core                          {:mvn/version "1.10.1"              ; various cryptograhpic functions
+  bigml/histogram                           {:mvn/version "4.1.4"}              ; Histogram data structure
+  buddy/buddy-core                          {:mvn/version "1.10.413"            ; various cryptographic functions
                                              :exclusions  [commons-codec/commons-codec
                                                            org.bouncycastle/bcpkix-jdk15on
                                                            org.bouncycastle/bcprov-jdk15on]}
-  buddy/buddy-sign                          {:mvn/version "3.4.1"}              ; JSON Web Tokens; High-Level message signing library
-  cheshire/cheshire                         {:mvn/version "5.10.1"}             ; fast JSON encoding (used by Ring JSON middleware)
+  buddy/buddy-sign                          {:mvn/version "3.4.333"}            ; JSON Web Tokens; High-Level message signing library
+  cheshire/cheshire                         {:mvn/version "5.10.2"}             ; fast JSON encoding (used by Ring JSON middleware)
   clj-http/clj-http                         {:mvn/version "3.12.3"              ; HTTP client
                                              :exclusions  [commons-codec/commons-codec
                                                            commons-io/commons-io
                                                            slingshot/slingshot]}
-  clojurewerkz/quartzite                    {:mvn/version "2.1.0"              ; scheduling library
-                                             :exclusions  [c3p0/c3p0]}
-  colorize/colorize                         {:mvn/version "0.1.1"              ; string output with ANSI color codes (for logging)
+  clojurewerkz/quartzite                    {:mvn/version "2.1.0"               ; scheduling library
+                                             :exclusions  [c3p0/c3p0
+                                                           org.quartz-scheduler/quartz]}
+  colorize/colorize                         {:mvn/version "0.1.1"               ; string output with ANSI color codes (for logging)
                                              :exclusions  [org.clojure/clojure]}
-  com.cemerick/friend                       {:mvn/version "0.2.3"              ; auth library
+  com.cemerick/friend                       {:mvn/version "0.2.3"               ; auth library
                                              :exclusions  [commons-codec/commons-codec
                                                            net.sourceforge.nekohtml/nekohtml
                                                            org.apache.httpcomponents/httpclient
@@ -34,13 +33,15 @@
   com.clearspring.analytics/stream          {:mvn/version "2.9.8"               ; Various sketching algorithms
                                              :exclusions  [it.unimi.dsi/fastutil
                                                            org.slf4j/slf4j-api]}
-  com.draines/postal                        {:mvn/version "2.0.4"}              ; SMTP library
-  com.google.guava/guava                    {:mvn/version "30.1.1-jre"}         ; dep for BigQuery, Spark, and GA. Require here rather than letting different dep versions stomp on each other — see comments on #9697
+  com.draines/postal                        {:mvn/version "2.0.5"}              ; SMTP library
+  com.google.guava/guava                    {:mvn/version "31.0.1-jre"}         ; dep for BigQuery, Spark, and GA. Require here rather than letting different dep versions stomp on each other — see comments on #9697
   com.h2database/h2                         {:mvn/version "1.4.197"}            ; embedded SQL database
   com.snowplowanalytics/snowplow-java-tracker
-                                            {:mvn/version "0.10.1"}             ; Snowplow analytics
+                                            {:mvn/version "0.11.0"}             ; Snowplow analytics
   com.taoensso/nippy                        {:mvn/version "3.1.1"}              ; Fast serialization (i.e., GZIP) library for Clojure
   com.vladsch.flexmark/flexmark             {:mvn/version "0.62.2"}             ; Markdown parsing
+  com.vladsch.flexmark/flexmark-ext-autolink
+                                            {:mvn/version "0.62.2"}             ; Flexmark extension for auto-linking bare URLs
   commons-codec/commons-codec               {:mvn/version "1.15"}               ; Apache Commons -- useful codec util fns
   commons-io/commons-io                     {:mvn/version "2.11.0"}             ; Apache Commons -- useful IO util fns
   commons-validator/commons-validator       {:mvn/version "1.7"                 ; Apache Commons -- useful validation util fns
@@ -49,8 +50,8 @@
                                                            commons-logging/commons-logging]}
   compojure/compojure                       {:mvn/version "1.6.2"               ; HTTP Routing library built on Ring
                                              :exclusions  [ring/ring-codec]}
-  dk.ative/docjure                          {:mvn/version "1.16.0"              ; excel export
   crypto-random/crypto-random               {:mvn/version "1.2.1"}              ; library for generating cryptographically secure random bytes and strings
+  dk.ative/docjure                          {:mvn/version "1.17.0"              ; excel export
                                              :exclusions  [org.apache.poi/poi
                                                            org.apache.poi/poi-ooxml]}
   environ/environ                           {:mvn/version "1.2.0"}              ; env vars/Java properties abstraction
@@ -58,19 +59,19 @@
   honeysql/honeysql                         {:mvn/version "1.0.461"             ; Transform Clojure data structures to SQL
                                              :exclusions  [org.clojure/clojurescript]}
   instaparse/instaparse                     {:mvn/version "1.4.10"}             ; Make your own parser
-  io.forward/yaml                           {:mvn/version "1.0.9"               ; Clojure wrapper for YAML library SnakeYAML. Don't upgrade yet, new version doesn't support Java 8 (see https://github.com/owainlewis/yaml/issues/37)
+  io.forward/yaml                           {:mvn/version "1.0.11"              ; Clojure wrapper for YAML library SnakeYAML. Don't upgrade yet, new version doesn't support Java 8 (see https://github.com/owainlewis/yaml/issues/37)
                                              :exclusions  [org.clojure/clojure
                                                            org.flatland/ordered
                                                            org.yaml/snakeyaml]}
   javax.xml.bind/jaxb-api                   {:mvn/version "2.4.0-b180830.0359"} ; add the `javax.xml.bind` classes which we're still using but were removed in Java 11
-  joda-time/joda-time                       {:mvn/version "2.10.10"}
+  joda-time/joda-time                       {:mvn/version "2.10.13"}
   kixi/stats                                {:mvn/version "0.4.4"               ; Various statistic measures implemented as transducers
                                              :exclusions  [org.clojure/data.avl]}
   me.raynes/fs                              {:mvn/version "1.4.6"               ; Filesystem tools
                                              :exclusions  [org.apache.commons/commons-compress]}
   medley/medley                             {:mvn/version "1.3.0"}              ; lightweight lib of useful functions
   metabase/connection-pool                  {:mvn/version "1.2.0"}              ; simple wrapper around C3P0. JDBC connection pools
-  metabase/saml20-clj                       {:mvn/version "2.0.0"}              ; EE SAML integration
+  metabase/saml20-clj                       {:mvn/version "2.0.1"}              ; EE SAML integration
   metabase/throttle                         {:mvn/version "1.0.2"}              ; Tools for throttling access to API endpoints and other code pathways
   net.cgrand/macrovich                      {:mvn/version "0.2.1"}              ; utils for writing macros for both Clojure & ClojureScript
   net.i2p.crypto/eddsa                      {:mvn/version "0.3.0"}              ; ED25519 key support (optional dependency for org.apache.sshd/sshd-core)
@@ -85,66 +86,65 @@
   org.apache.logging.log4j/log4j-api        {:mvn/version "2.17.1"}             ; add compatibility with log4j 1.2
   org.apache.logging.log4j/log4j-core       {:mvn/version "2.17.1"}             ; apache logging framework
   org.apache.logging.log4j/log4j-jcl        {:mvn/version "2.17.1"}             ; allows the commons-logging API to work with log4j 2
-  org.apache.logging.log4j/log4j-liquibase  {:mvn/version "2.17.1"}             ; liquibase logging via log4j 2
+  org.apache.logging.log4j/log4j-jul        {:mvn/version "2.17.1"}             ; java.util.logging (JUL) -> Log4j2 adapter
   org.apache.logging.log4j/log4j-slf4j-impl {:mvn/version "2.17.1"}             ; allows the slf4j API to work with log4j 2
-  org.apache.poi/poi                        {:mvn/version "5.0.0"}              ; Work with Office documents (e.g. Excel spreadsheets) -- newer version than one specified by Docjure
-  org.apache.poi/poi-ooxml                  {:mvn/version "5.0.0"
+  org.apache.poi/poi                        {:mvn/version "5.2.0"}              ; Work with Office documents (e.g. Excel spreadsheets) -- newer version than one specified by Docjure
+  org.apache.poi/poi-ooxml                  {:mvn/version "5.2.0"
                                              :exclusions  [org.bouncycastle/bcpkix-jdk15on
                                                            org.bouncycastle/bcprov-jdk15on]}
-  org.apache.sshd/sshd-core                 {:mvn/version "2.4.0"}              ; ssh tunneling and test server -- do not use 2.6.0 to 2.7.0, see metabase#18316
+  org.apache.sshd/sshd-core                 {:mvn/version "2.8.0"}              ; ssh tunneling and test server -- do not use 2.6.0 to 2.7.0, see metabase#18316
   org.apache.xmlgraphics/batik-all          {:mvn/version "1.14"}               ; SVG -> image
   org.clojars.pntblnk/clj-ldap              {:mvn/version "0.0.17"}             ; LDAP client
-  org.bouncycastle/bcpkix-jdk15on           {:mvn/version "1.69"}               ; Bouncy Castle crypto library -- explicit version of BC specified to resolve illegal reflective access errors
-  org.bouncycastle/bcprov-jdk15on           {:mvn/version "1.69"}
+  org.bouncycastle/bcpkix-jdk15on           {:mvn/version "1.70"}               ; Bouncy Castle crypto library -- explicit version of BC specified to resolve illegal reflective access errors
+  org.bouncycastle/bcprov-jdk15on           {:mvn/version "1.70"}
   org.clojure/clojure                       {:mvn/version "1.10.3"}
-  org.clojure/core.async                    {:mvn/version "1.3.618"
+  org.clojure/core.async                    {:mvn/version "1.5.648"
                                              :exclusions  [org.clojure/tools.reader]}
   org.clojure/core.logic                    {:mvn/version "1.0.0"}              ; optimized pattern matching library for Clojure
   org.clojure/core.match                    {:mvn/version "1.0.0"}
-  org.clojure/core.memoize                  {:mvn/version "1.0.250"}            ; useful FIFO, LRU, etc. caching mechanisms
+  org.clojure/core.memoize                  {:mvn/version "1.0.253"}            ; useful FIFO, LRU, etc. caching mechanisms
   org.clojure/data.csv                      {:mvn/version "1.0.0"}              ; CSV parsing / generation
   org.clojure/java.classpath                {:mvn/version "1.0.0"}              ; examine the Java classpath from Clojure programs
   org.clojure/java.jdbc                     {:mvn/version "0.7.12"}             ; basic JDBC access from Clojure
   org.clojure/java.jmx                      {:mvn/version "1.0.0"}              ; JMX bean library, for exporting diagnostic info
   org.clojure/math.combinatorics            {:mvn/version "0.1.6"}              ; combinatorics functions
-  org.clojure/math.numeric-tower            {:mvn/version "0.0.4"}              ; math functions like `ceil`
-  org.clojure/tools.logging                 {:mvn/version "1.1.0"}              ; logging framework
-  org.clojure/tools.namespace               {:mvn/version "1.1.0"}
+  org.clojure/math.numeric-tower            {:mvn/version "0.0.5"}              ; math functions like `ceil`
+  org.clojure/tools.logging                 {:mvn/version "1.2.4"}              ; logging framework
+  org.clojure/tools.namespace               {:mvn/version "1.2.0"}
   org.clojure/tools.reader                  {:mvn/version "1.3.6"}
   org.clojure/tools.trace                   {:mvn/version "0.7.11"}             ; function tracing
-  org.eclipse.jetty/jetty-server            {:mvn/version "9.4.43.v20210629"}   ; web server
-  org.flatland/ordered                      {:mvn/version "1.5.9"}              ; ordered maps & sets
-  org.graalvm.js/js                         {:mvn/version "21.2.0"}           ; JavaScript engine
-  org.liquibase/liquibase-core              {:mvn/version "3.6.3"               ; migration management (Java lib)
+  org.eclipse.jetty/jetty-server            {:mvn/version "9.4.44.v20210927"}   ; web server
+  org.flatland/ordered                      {:mvn/version "1.15.10"}            ; ordered maps & sets
+  org.graalvm.js/js                         {:mvn/version "22.0.0.2"}           ; JavaScript engine
+  org.liquibase/liquibase-core              {:mvn/version "4.8.0"               ; migration management (Java lib)
                                              :exclusions  [ch.qos.logback/logback-classic]}
-  org.mariadb.jdbc/mariadb-java-client      {:mvn/version "2.6.2"}              ; MySQL/MariaDB driver
-  org.postgresql/postgresql                 {:mvn/version "42.2.23"}            ; Postgres driver
-  org.slf4j/slf4j-api                       {:mvn/version "1.7.32"}             ; abstraction for logging frameworks -- allows end user to plug in desired logging framework at deployment time
+  org.mariadb.jdbc/mariadb-java-client      {:mvn/version "2.7.5"}              ; MySQL/MariaDB driver
+  org.postgresql/postgresql                 {:mvn/version "42.3.2"}             ; Postgres driver
+  org.quartz-scheduler/quartz               {:mvn/version "2.3.2"}              ; Quartz job scheduler, provided by quartzite but this is a newer version.
+  org.slf4j/slf4j-api                       {:mvn/version "1.7.35"}             ; abstraction for logging frameworks -- allows end user to plug in desired logging framework at deployment time
   org.tcrawley/dynapath                     {:mvn/version "1.1.0"}              ; Dynamically add Jars (e.g. Oracle or Vertica) to classpath
   org.threeten/threeten-extra               {:mvn/version "1.7.0"}              ; extra Java 8 java.time classes like DayOfMonth and Quarter
-  org.yaml/snakeyaml                        {:mvn/version "1.29"}               ; YAML parser (required by liquibase)
+  org.yaml/snakeyaml                        {:mvn/version "1.30"}               ; YAML parser
   potemkin/potemkin                         {:mvn/version "0.4.5"               ; utility macros & fns
                                              :exclusions  [riddley/riddley]}
   pretty/pretty                             {:mvn/version "1.0.5"}              ; protocol for defining how custom types should be pretty printed
-  prismatic/schema                          {:mvn/version "1.1.12"}             ; Data schema declaration and validation library
+  prismatic/schema                          {:mvn/version "1.2.0"}              ; Data schema declaration and validation library
   redux/redux                               {:mvn/version "0.1.4"}              ; Utility functions for building and composing transducers
   riddley/riddley                           {:mvn/version "0.2.0"}              ; code walking lib -- used interally by Potemkin, manifold, etc.
-  ring/ring-core                            {:mvn/version "1.9.4"}              ; web server (Jetty wrapper)
-  ring/ring-jetty-adapter                   {:mvn/version "1.9.4"}              ; Ring adapter using Jetty webserver
+  ring/ring-core                            {:mvn/version "1.9.5"}              ; web server (Jetty wrapper)
+  ring/ring-jetty-adapter                   {:mvn/version "1.9.5"}              ; Ring adapter using Jetty webserver
   ring/ring-json                            {:mvn/version "0.5.1"}              ; Ring middleware for reading/writing JSON automatically
-  robdaemon/clojure.java-time               {:mvn/version "0.3.3-SNAPSHOT"}     ; Java 8 java.time wrapper. Fork to address #13102 - see upstream PR: https://github.com/dm3/clojure.java-time/pull/60
+  robdaemon/clojure.java-time               {:mvn/version "0.3.3-SNAPSHOT"}     ; Java 8 java.time wrapper. Use this fork until https://github.com/dm3/clojure.java-time/issues/77 is fixed upstream
   slingshot/slingshot                       {:mvn/version "0.12.2"}             ; enhanced throw/catch, used by other deps
   stencil/stencil                           {:mvn/version "0.5.0"}              ; Mustache templates for Clojure
-  toucan/toucan                             {:mvn/version "1.15.4"              ; Model layer, hydration, and DB utilities
+  toucan/toucan                             {:mvn/version "1.17.0"              ; Model layer, hydration, and DB utilities
                                              :exclusions  [honeysql/honeysql
                                                            org.clojure/java.jdbc
                                                            org.clojure/tools.logging
                                                            org.clojure/tools.namespace]}
   user-agent/user-agent                     {:mvn/version "0.1.0"}              ; User-Agent string parser, for Login History page & elsewhere
-  weavejester/dependency                    {:mvn/version "0.2.1"}              ; Dependency graphs and topological sorting
+  weavejester/dependency                    {:mvn/version "0.2.1"}}             ; Dependency graphs and topological sorting
 
-  ;; dummy dependency for the Java source file(s)
-  metabase/java-deps {:local/root "java"}}
  ;; !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
  ;; !!         PLEASE KEEP NEW DEPENDENCIES ABOVE ALPHABETICALLY ORGANIZED AND ADD COMMENTS EXPLAINING THEM.         !!
  ;; !!                            *PLEASE DO NOT* ADD NEW ONES TO THE BOTTOM OF THE LIST.                            !!
@@ -152,7 +152,7 @@
 
 
  :paths
- ["src" "shared/src" "resources" "java/target/classes"]
+ ["src" "shared/src" "resources"]
 
  :aliases
  {
@@ -174,12 +174,14 @@
                                                            :exclusions  [slingshot/slingshot]}
     cloverage/cloverage                                   {:mvn/version "1.2.2"}
     eftest/eftest                                         {:mvn/version "0.5.9"}
-    jonase/eastwood                                       {:mvn/version "0.9.6"}
+    jonase/eastwood                                       {:mvn/version "1.2.2"}
     lein-check-namespace-decls/lein-check-namespace-decls {:mvn/version "1.0.4"} ; misnomer since this works on Clojure CLI now too
     pjstadig/humane-test-output                           {:mvn/version "0.11.0"}
-    reifyhealth/specmonstah                               {:mvn/version "2.0.0"}
+    reifyhealth/specmonstah                               {:mvn/version "2.0.0"
+                                                           :exclusions  [org.clojure/clojure
+                                                                         org.clojure/clojurescript]}
     ring/ring-mock                                        {:mvn/version "0.4.0"}
-    talltale/talltale                                     {:mvn/version "0.5.4"}}
+    talltale/talltale                                     {:mvn/version "0.5.8"}}
 
    :extra-paths ["dev/src" "local/src" "test" "shared/test" "test_resources"]
    :jvm-opts    ["-Dmb.run.mode=dev"
@@ -274,7 +276,7 @@
 
 ;;; Linters
 
-  ;; clojure -X:dev:ee:ee-dev:drivers:drivers-dev:namespace-checker
+  ;; clojure -X:dev:ee:ee-dev:drivers:drivers-dev:test:namespace-checker
   :namespace-checker
   {:exec-fn   metabase.linters.namespace-checker/check-namespace-decls
    :exec-args {:prefix-rewriting false}}
@@ -285,7 +287,7 @@
                                  :sha     "518d5a1cbfcd7c952f548e6dbfcb9a4a5faf9062"}}
    :main-opts  ["-m" "clj-check.check"]}
 
-  ;; clojure -X:dev:ee:ee-dev:drivers:drivers-dev:eastwood
+  ;; clojure -X:dev:ee:ee-dev:drivers:drivers-dev:test:eastwood
   :eastwood
   {:exec-fn   metabase.linters.eastwood/eastwood
    :exec-args {;; manually specify the source paths for the time being (exclude test paths) until we fix Eastwood
@@ -332,7 +334,7 @@
 
   ;; clojure -T:whitespace-linter
   :whitespace-linter
-  {:deps       {com.github.camsaul/whitespace-linter {:sha "b25716745f5875194bc38364e498d0ddda51f4b0"}}
+  {:deps       {com.github.camsaul/whitespace-linter {:sha "912644a2b9cc91edcce31a6fa997c46479341a1d"}}
    :ns-default whitespace-linter
    :exec-args  {:paths            ["./.dir-locals.el"
                                    "./deps.edn"
@@ -399,8 +401,8 @@
   ;; clojure -T:build uberjar
   ;; clojure -T:build uberjar :edition :ee
   :build
-  {:deps       {io.github.clojure/tools.build   {:git/tag "v0.7.4" :git/sha "ac442da"}
-                com.github.seancorfield/depstar {:mvn/version "2.1.278"}
+  {:deps       {io.github.clojure/tools.build   {:git/tag "v0.7.5" :git/sha "2526f58"}
+                com.github.seancorfield/depstar {:mvn/version "2.1.303"}
                 metabase/build.common           {:local/root "bin/common"}
                 metabase/buid-mb                {:local/root "bin/build-mb"}}
    :ns-default build}
@@ -413,12 +415,11 @@
    :jvm-opts  ["-XX:+CITime" ; print time spent in JIT compiler
                "-XX:+PrintGC"]}
 
-  ;; get the H2 shell with clojure -M:h2
-  ;; TODO -- this doesn't currently work correctly -- use this instead:
-  ;;
-  ;;    java -cp `clojure -Spath` org.h2.tools.Shell
+  ;; get the H2 shell with clojure -X:h2
   :h2
-  {:jvm-opts ["org.h2.tools.Shell"]}
+  {:extra-paths ["dev/src"]
+   :exec-fn     dev.h2-shell/shell
+   :java-opts   ["-Dfile.encoding=UTF-8"]}
 
   ;; clojure -M:generate-automagic-dashboards-pot
   :generate-automagic-dashboards-pot
@@ -428,9 +429,20 @@
   ;;
   ;; clojure -M:dev:nrepl (etc.)
   :nrepl
-  {:extra-deps {nrepl/nrepl {:mvn/version "0.8.3"}}
+  {:extra-deps {nrepl/nrepl {:mvn/version "0.9.0"}}
    :main-opts  ["-m" "nrepl.cmdline"]}
 
+  ;; Liquibase CLI:
+  ;;
+  ;;    clojure -M:liquibase <command>
+  ;;
+  ;; e.g.
+  ;;
+  ;;    clojure -M:liquibase dbDoc target/liquibase
+  :liquibase
+  {:extra-deps  {ch.qos.logback/logback-classic {:mvn/version "1.2.10"}}
+   :extra-paths ["dev/src"]
+   :main-opts   ["-m" "dev.liquibase"]}}}
+
   ;; TODO -- consider creating an alias that includes the `./bin` build-drivers & release code as well so we can work
   ;; on them all from a single REPL process.
-  }}

dev/src/dev.clj

@@ -136,4 +136,4 @@
 (defn migrate!
   "Run migrations for the Metabase application database."
   []
-  (mdb.setup/migrate! (mdb.connection/jdbc-spec) :up))
+  (mdb.setup/migrate! (mdb.connection/db-type) (mdb.connection/data-source) :up))

dev/src/dev/debug_qp.clj

@@ -171,15 +171,13 @@
 
 (defn- print-diff [before after]
   (assert (not= before after))
-  (let [before                         (format-output before)
-        after                          (format-output after)
-        [only-in-before only-in-after] (data/diff before after)]
+  (let [[only-in-before only-in-after] (data/diff before after)]
     (when *print-full?*
       (println (u/pprint-to-str 'cyan (format-output after))))
     (when (seq only-in-before)
-      (println (u/colorize 'red (str "-\n" (u/pprint-to-str only-in-before)))))
+      (println (u/colorize 'red (str "-\n" (u/pprint-to-str (format-output only-in-before))))))
     (when (seq only-in-after)
-      (println (u/colorize 'green (str "+\n" (u/pprint-to-str only-in-after)))))))
+      (println (u/colorize 'green (str "+\n" (u/pprint-to-str (format-output only-in-after))))))))
 
 (defn- debug-query-changes [middleware-var middleware]
   (fn [next-middleware]

dev/src/dev/h2_shell.clj

@@ -0,0 +1,18 @@
+(ns dev.h2-shell
+  (:require [environ.core :as env]
+            [metabase.db.data-source :as mdb.data-source]
+            [metabase.db.env :as mdb.env]))
+
+(comment mdb.data-source/keep-me)
+
+(defn shell
+  "Open an H2 shell with `clojure -X:h2`."
+  [& _args]
+  ;; Force the DB to use h2 regardless of what's actually in the env vars for Java properties
+  (alter-var-root #'env/env assoc :mb-db-type "h2")
+  (require 'metabase.db.env :reload)
+  (org.h2.tools.Shell/main
+   (into-array
+    String
+    ["-url" (let [^metabase.db.data_source.DataSource data-source mdb.env/data-source]
+              (.url data-source))])))

dev/src/dev/liquibase.clj

@@ -0,0 +1,32 @@
+(ns dev.liquibase
+  (:require [clojure.string :as str]
+            [colorize.core :as colorize]
+            [metabase.db.data-source :as mdb.data-source]
+            [metabase.db.env :as mdb.env]))
+
+(comment mdb.data-source/keep-me)
+
+(defn -main
+  "Use the Liquibase CLI with `clojure -M:liquibase <command>`."
+  [& args]
+  (let [args (if (empty? args)
+               ["help"]
+               args)
+        args (into ["--changeLogFile=resources/migrations/000_migrations.yaml"]
+                   (comp cat
+                         (filter seq))
+                   (let [^metabase.db.data_source.DataSource data-source mdb.env/data-source
+                         ^java.util.Properties properties                (.properties data-source)]
+                     [(when-let [user (some-> properties (.get "user"))]
+                        ["--username" user])
+                      (when-let [password (some-> properties (.get "password"))]
+                        ["--password" password])
+                      ["--url" (.url data-source)]
+                      (map str args)]))]
+    (println (colorize/green (str/join " " (cons "liquibase" (map pr-str args)))))
+    ;; use reflection here instead of static method calls because `liquibase.integration.commandline.Main` fails to load
+    ;; without having the `logback` dependency available. We add this as `:extra-deps` for the `:liquibase` profile. We
+    ;; don't want other stuff like the linters to choke here tho.
+    (let [klass  (Class/forName "liquibase.integration.commandline.Main")
+          method (.getMethod klass "main" (into-array Class [(Class/forName "[Ljava.lang.String;")]))]
+      (.invoke method klass ^"[Ljava.lang.Object" (into-array Object [(into-array String args)])))))

dev/src/dev/render_png.clj

@@ -114,7 +114,8 @@
                         "</body></html>"))
         html (h/html (str/replace html #"\{\{chart\}\}" chart-html))]
     (with-open [os (java.io.ByteArrayOutputStream.)]
-      (let [image-bytes (do (#'png/render-to-png! html os 1000)
+      (let [image-bytes (do (-> (#'png/render-to-png html 1000)
+                                (#'png/write-image! "png" os))
                             (.toByteArray os))]
         (open-png-bytes image-bytes)))))
 

docs/README.md

@@ -36,6 +36,7 @@
 - [List of expressions: aggregations and functions](./users-guide/expressions-list.html)
 - [Visualizing data](./users-guide/05-visualizing-results.html)
 - [Using results to ask new questions](./users-guide/referencing-saved-questions-in-queries.html)
+- [Joining data](./users-guide/join.md)
 
 ### SQL and native queries
 
@@ -78,7 +79,8 @@
 
 ## Permissions
 
-- [Data permissions](./administration-guide/05-setting-permissions.html)
+- [Permissions overview](./administration-guide/05-setting-permissions.html)
+- [Data permissions](./administration-guide/data-permissions.html)
 - [Collection permissions](./administration-guide/06-collections.html)
 - [Sandboxing data based on user attributes](./enterprise-guide/data-sandboxes.html)
 - [SQL snippets folder permissions](./enterprise-guide/sql-snippets.html)

docs/accessibility.md

@@ -5,7 +5,7 @@ Metabase is not yet fully compliant with [the US federal government's Section 50
 - Metabase doesn't have a method to allow screen readers to skip over repetitive navigation elements.
 - Metabase is extremely close but not 100% compliant at providing text equivalents for all non-text elements.
 - Most of our form elements are selectable by tabbing through elements.
-- Metabase has minimal transition animations in it, but we have not yet tested whether the range of flickering is always between 2 and 55 Hertz.
+- Metabase has minimal transition animations in it, but we have not yet tested whether the range of flickering is always between 2 and 55 Hertz. If you've opted for [Reduce Motion / Remove Animation](https://developer.mozilla.org/en-US/docs/Web/CSS/@media/prefers-reduced-motion#user_preferences) settings in your OS to take advantage of the `prefers-reduced-motion` CSS media feature, Metabase will disable animations.
 - Metabase's data tables do not have row and column headers identified in markup.
 - We do not yet have a published description of our accessibility and compatibility features.
 - Since Metabase is a React-based web application, it cannot function without scripting (i.e., JavaScript) turned on.
@@ -13,4 +13,4 @@ Metabase is not yet fully compliant with [the US federal government's Section 50
 If you'd like to help us address these accessibility gaps, please see [our developers' guide][developers-guide].
 
 [508-accessibility]: https://section508.gov/
-[developers-guide]: /docs/latest/developers-guide.html
+[developers-guide]: /docs/latest/developers-guide.html

docs/administration-guide/01-managing-databases.md

@@ -1,12 +1,14 @@
-## Adding and managing databases
+# Adding and managing databases
 
-- [Adding a database connection](#adding-a-database-connection)
-- [Officially supported databases](#officially-supported-databases)
-- [Connecting to databases hosted by a cloud provider](#connecting-to-databases-hosted-by-a-cloud-provider)
-- [Errors when connecting to your database](#errors-when-connecting-to-your-database)
-- [Database connection options](#database-connection-options) 
-- [Re-scanning a single table or field](#re-scanning-a-single-table-or-field)
-- [Deleting databases](#deleting-databases)
+  - [Adding a database connection](#adding-a-database-connection)
+    - [Officially supported databases](#officially-supported-databases)
+    - [Connecting to databases hosted by a cloud provider](#connecting-to-databases-hosted-by-a-cloud-provider)
+    - [Errors when connecting to your database](#errors-when-connecting-to-your-database)
+  - [Database connection options](#database-connection-options)
+  - [Re-scanning a single table or field](#re-scanning-a-single-table-or-field)
+  - [Deleting databases](#deleting-databases)
+  - [Troubleshooting](#troubleshooting)
+  - [Further reading](#further-reading)
 
 ## Adding a database connection
 
@@ -14,18 +16,18 @@ In the main navigation bar, click on the **gears** icon in the top right, and se
 
 Once in the Admin section, select the **Databases** tab from the navigation bar at the top of the screen. You’ll see a list of your connected databases (if any). To connect a database to Metabase, click **Add database** and follow the connection instructions for your database.
 
-Although connection details differ database to database, in general you'll need to get connection info from your database admin, usually some combination of hostname (sometimes called endpoint), port, database username and password, and the name of the database. 
+Although connection details differ database to database, in general you'll need to get connection info from your database admin, usually some combination of hostname (sometimes called endpoint), port, database username and password, and the name of the database.
 
 ### Officially supported databases
 
 - [BigQuery](databases/bigquery.md) (Google Cloud Platform)
 - Druid
-- [Google Analytics](databases/google-analytics.md) (version 3; if you're interested in support for version 4, let us know by adding your [+1 to this issue (#12905)](https://github.com/metabase/metabase/issues/12905))
+- [Google Analytics](databases/google-analytics.md)
 - H2
 - [MongoDB (version 3.6 or higher)](databases/mongodb.md) <!-- MongoDB supported version is from https://www.mongodb.com/support-policy -->
 - [MySQL (version 5.7 or higher, as well as MariaDB version 10.2 or higher)](databases/mysql.md)
 - [Oracle](databases/oracle.md)
-- PostgreSQL
+- [PostgreSQL](databases/postgresql.md)
 - Presto
 - Redshift (Amazon Web Services)
 - [Snowflake](databases/snowflake.md)
@@ -51,8 +53,8 @@ Check our [troubleshooting guide](../troubleshooting-guide/datawarehouse.md).
 Connection options differ depending on which database you're connecting to. Here's an overview:
 
 - [Use a secure connection (SSL)](#use-a-secure-connection-ssl)
-- [Use an SSH-tunnel for database connections](#use-an-ssh-tunnel-for-database-connections) 
-- [Choose when Metabase syncs and scans his](#choose-when-metabase-syncs-and-scans)
+- [Use an SSH-tunnel for database connections](#use-an-ssh-tunnel-for-database-connections)
+- [Choose when Metabase syncs and scans](#choose-when-metabase-syncs-and-scans)
 - [Automatically run queries when doing simple filtering and summarizing](#automatically-run-queries-when-doing-simple-filtering-and-summarizing)
 
 ### Use a secure connection (SSL)
@@ -63,15 +65,11 @@ Metabase automatically tries to connect to databases with SSL first, then withou
 
 See our [guide to SSH tunneling](ssh-tunnel-for-database-connections.md).
 
-### Choose when Metabase syncs and scans 
+### Choose when Metabase syncs and scans
 
-By default, Metabase does a lightweight hourly sync and an intensive daily scan of field values. If you have a large database, we recommend turning on the option "This is a large database, let me choose when Metabase syncs and scans". Once on, you can review when and how often the field value scans happen. (Note: this setting used to be called "Enable in-depth analysis.") 
+By default, Metabase does a lightweight hourly sync and an intensive daily scan of field values. If you have a large database, we recommend enabling the toggle **Choose when syncs and scans happen** found when you select **Show advanced options**. Once on, you can review when and how often the field value scans happen. (Note: this setting used to be called "Enable in-depth analysis.")
 
-If you enable this and save your changes, you'll see a new tab at the top of the form called "Scheduling." Click on that, and you'll see options to change when and how often Metabase syncs and scans.
-
-![Sync scheduling tab](images/sync-scheduling.png)
-
-#### Database syncing 
+#### Database syncing
 
 Metabase maintains its own information about the various tables and fields in each database to aid in querying. By default, Metabase performs this lightweight sync hourly to look for changes to the database such as new tables or fields. Metabase does _not_ copy any data from your database. It only maintains lists of the tables and columns.
 
@@ -95,13 +93,15 @@ By default, Metabase also performs a more intensive daily sampling of each field
 
 If for some reason you need to flush out the cached field values for your database, click the button that says **Discard saved field values** in the top-right of the database's page.
 
-### Automatically run queries when doing simple filtering and summarizing 
+### Automatically run queries when doing simple filtering and summarizing
 
-By default, Metabase will auto-run queries when you use the Summarize and Filter buttons when viewing a table or chart. If your users are exploring data that is stored in a slow database, you may want to turn the auto-run off to avoid re-running the query every time your users change an option in the Summarize view. Turning this off presents the users with the option to re-run the query when they choose to.
+By default, Metabase will auto-run queries when you use the Summarize and Filter buttons when viewing a table or chart. If your users are exploring data that is stored in a slow database, you may want to turn the auto-run off to avoid re-running the query every time your users change an option in the Summarize view. You can turn this option off in the **Show advanced options** section by deselecting the toggle next to **Rerun queries for simple explorations**. Turning this off presents the users with the option to re-run the query when they choose to.
 
 ### Periodically refingerprint tables
 
-When syncing with this database, Metabase will scan a subset of values of fields to gather statistics that enable things like improved binning behavior in charts, and to generally make your Metabase instance smarter.
+If this option is enabled, Metabase will scan a subset of values of fields when syncing with this database to gather statistics that enable things like improved binning behavior in charts, and to generally make your Metabase instance smarter.
+
+You can turn this option on and off in the **Show advanced options** section.
 
 ### Additional JDBC connection string options
 
@@ -132,9 +132,19 @@ You can also delete a database from the database list: hover over the row with t
 
 ![deletedatabasebutton](images/DatabaseDeleteButton.png)
 
+## Troubleshooting
+
+If you're having trouble with your database connection, you can check out this [troubleshooting guide](https://www.metabase.com/docs/latest/troubleshooting-guide/datawarehouse.html), or visit [Metabase's discussion forum](https://discourse.metabase.com/) to see if someone has encountered and resolved a similar issue.
+
+## Further reading
+
+- [Managing databases](https://www.metabase.com/docs/latest/administration-guide/01-managing-databases.html).
+- [Metadata editing](https://www.metabase.com/docs/latest/administration-guide/03-metadata-editing.html).
+- [Models](../users-guide/models.md).
+- [Setting data access permissions](https://www.metabase.com/docs/latest/administration-guide/05-setting-permissions.html).
 
 ---
 
 ## Next: enabling features that send email
 
-Metabase can send emails for certain features, like email invites, but first you need to [set up an email account](02-setting-up-email.md).
+Metabase can send emails for certain features, like email invites, but first you need to [set up an email account](02-setting-up-email.md).

docs/administration-guide/05-setting-permissions.md

@@ -59,7 +59,8 @@ To remove a group, click the X icon to the right of a group in the list to remov
 
 ## Further reading
 
-Checkout our track on [Permissions][permissions] in Learn Metabase.
+- [Permissions guide][permissions] in Learn Metabase
+- [Troubleshooting permissions][troubleshooting-permissions]
 
 ---
 
@@ -78,3 +79,4 @@ Metabase lets you [set permissions on databases and their tables][data-permissio
 [slack-integration]: 09-setting-up-slack.md
 [sql-snippet-folders]: ../enterprise-guide/sql-snippets.html
 [table-permissions]: data-permissions.md#table-permissions
+[troubleshooting-permissions]: ../troubleshooting-guide/permissions.html

docs/administration-guide/06-collections.md

@@ -10,27 +10,27 @@ This page will teach you how to create and manage your collections. For more inf
 
 ### Creating and editing collections
 
-If a user has Curate access for a collection, they can create new sub-collections inside it and edit the contents of the collection. From the detail view of any collection, click on the `Create a collection` button to make a new one. Give your collection a name, choose where it should live, and give it a description if you'd like.
+If a user has Curate access for a collection, they can create new sub-collections inside it and edit the contents of the collection. From the detail view of any collection, click on the **+** button and select **Collection** to make a new one. Give your collection a name, choose where it should live, and give it a description if you'd like.
 
 ![Create collection](images/collections/create-collection.png)
 
-By default, new collections will have the same permissions settings as the collection it was created in (its "parent" collection), but you can change those settings from the Edit menu.
+By default, any new collection will have the same permissions settings as the collection it was created in (its "parent" collection), but you can change those settings from the Edit menu.
 
 ### Pinning things in collections
 
 ![Pins](images/collections/pinned-items.png)
 
-One great feature in Metabase is that you can pin the most important couple of items in each of your collections to the top. Pinning an item in a collection turns it into a big, eye-catching card that will help make sure that folks who are browsing your Metabase instance will always know what's most important.
+One great feature in Metabase is that you can pin the most important couple of items in each of your collections to the top. Pinning an item in a collection turns it into a big, eye-catching card that will help make sure that folks who are browsing your Metabase instance will always know what's most important. And if you pin a question, Metabase will display a preview of its visualization. 
 
-Any user with curate permissions for a collection can pin items in it, making it easy to delegate curation responsibilities to other members of your team. To pin something, you can either click and drag it to the top of the page, or click on its menu and choose the pin action. Note that collections themselves can't be pinned, but if you're running [Metabase Pro or Enterprise Edition](https://www.metabase.com/pricing), admins can designate [Offical Collections][offical-collections].
+Any user with curate permissions for a collection can pin items in it, making it easy to delegate curation responsibilities to other members of your team. To pin something, select the **pin icon** next to the item's name. Note that collections themselves can't be pinned, but if you're running [a paid plan](https://www.metabase.com/pricing), admins can designate [Offical Collections][offical-collections].
 
 ### Setting permissions for collections
 
-Collection permissions are similar to [data access permissions](05-setting-permissions.md). You can set permissions on collections by clicking on the lock icon in the top-right of the screen while viewing the collection and clicking on `Edit permissions`. Only Administrators can edit collection permissions. Each [user group](05-setting-permissions.md) can have either View, Curate, or No access to a collection:
+Collection permissions are similar to [data access permissions](05-setting-permissions.md). You can set permissions on collections by clicking on the lock icon in the top-right of the screen while viewing the collection and clicking on **Edit permissions**. Only Administrators can edit collection permissions. Each [user group](05-setting-permissions.md) can have either View, Curate, or No access to a collection:
 
-- **Curate access:** the user can edit, move, and archive items saved in this collection, and can save or move new items into it. They can also create new sub-collections within this collection. In order to archive a sub-collection within this collection, they'll need to have Curate access for it and any and all collections within it.
-- **View access:** the user can see all the questions, dashboards, and pulses in the collection. If the user does not have permission to view some or all of the questions included in a given dashboard or pulse then those questions will not be visible to them; but any questions that are saved in this collection _will_ be visible to them, _even if the user doesn't have access to the underlying data used to in the question._
-- **No access:** the user won't see this collection listed, and doesn't have access to any of the items saved within it.
+- **Curate access**: the user can edit, move, and archive items saved in this collection, and can save or move new items into it. They can also create new sub-collections within this collection. In order to archive a sub-collection within this collection, they'll need to have Curate access for it and any and all collections within it.
+- **View access**: the user can see all the questions, dashboards, and pulses in the collection. If the user does not have permission to view some or all of the questions included in a given dashboard or pulse then those questions will not be visible to them; but any questions that are saved in this collection _will_ be visible to them, _even if the user doesn't have access to the underlying data used to in the question._
+- **No access**: the user won't see this collection listed, and doesn't have access to any of the items saved within it.
 
 ![Permissions](images/collections/collection-permissions.png)
 
@@ -48,15 +48,15 @@ To learn more, check out our Learn article on [working with collection permissio
 
 ### Personal collections
 
-Each user has a personal collection where they're always allowed to save things, even if they don't have Curate permissions for any other collections. Administrators can see and edit the contents of every user's personal collection (even those belonging to other Administrators) by clicking on the "All personal collections" link from the "Our analytics" collection.
+Each user has a personal collection where they're always allowed to save things, even if they don't have Curate permissions for any other collections. Administrators can see and edit the contents of every user's personal collection (even those belonging to other Administrators) by clicking on the **Other users' personal collections** link at the bottom of the sidebar when viewing "Our analytics".
 
 A personal collection works just like any other collection except that its permissions can't be changed. If a sub-collection within a personal collection is moved to a different collection, it will inherit the permissions of that collection.
 
 ### Archiving collections
 
-Users with curate permission for a collection can archive collections. Click the edit icon in the top-right of the collection screen and select `Archive this collection` to archive it. This will also archive all questions, dashboards, pulses, and all other sub-collections and their contents. Importantly, this will also remove any archived questions from all dashboards and Pulses that use them.
+Users with curate permission for a collection can archive collections. Click the edit icon in the top-right of the collection screen and select **Archive this collection** to archive it. This will also archive all questions, dashboards, pulses, and all other sub-collections and their contents. Importantly, this will also remove any archived questions from all dashboards and Pulses that use them.
 
-**Note:** the "Our analytics" collection and personal collections can't be archived.
+**Note:** The "Our analytics" collection and personal collections can't be archived.
 
 You can always _unarchive_ items. In the Collections list sidebar, at the bottom, click on __View archive__. Search for the item you'd like to unarchive (you'll either need to scroll down the page, or use the browser's find in page functionality, as archived items won't appear in Metabase's search results). Select the open box with an up arrow icon to "Unarchive this".
 

docs/administration-guide/07-segments-and-metrics.md

@@ -6,9 +6,8 @@ Metabase allows you to create your own segments and metrics so you can quickly a
 
 A segment is just a special named filter or set of filters. You can create these to make sure that there is an official definition of a subset of customers, users, or products that everyone on your team can refer to consistently. For example, you might create a segment called “Active Users” that contains all the filters that are needed to correctly select active users.
 
-To start, select a table that you want to add a segment to. When you’re done, this segment will be accessible from the filter list in the query builder when viewing this table (the segment will not be automatically applied to the table).
+To start, select the **Segments** tab, followed by the **New segment** button on the right side of the screen. Choose the appropriate table and filters for your new segment and add a title and description. When you’re done, this segment will be accessible from the filter list in the query builder when viewing this table (the segment will not be automatically applied to the table).
 
-Click on the **Add a Segment** link on the right side of the screen.
 ![Add a segment](images/AddSegment.png)
 
 Now you’ll be looking at the segment builder, which is a limited version of the query builder, with only the option to add filters. Add your filter(s) as you would in the query builder, and then give your segment a name and a description (these will be visible in the query builder filter dropdown after you’ve saved). If you want to test out your segment in the query builder before you save it, just click the Preview button, which will open a new query builder window with your segment applied.
@@ -24,11 +23,10 @@ If you exit the Admin Panel and try asking a new question, then click on the but
 
 A custom metric is an easy way to refer to a computed number that you reference often. This could be something like **revenue**, which you could arrive at by viewing the Sum of your Order’s Subtotal column, and applying any required filters — but it’s a pain to have to do this every time you want to do something with revenue.
 
-So, you create a custom metric in a very similar way to how you create segments: start by clicking on the **Add a Metric** link from a table’s detail view in the Admin Panel.
-![Add metric](images/AddMetric.png)
+You create a custom metric in a very similar way to how you create segments: start by clicking on the **Metrics** tab in the Data Model section of the Admin Panel, and select **New metric**.
 
 Here you're presented with a slightly different version of the query builder, which only lets you select filters and aggregations. Filters are optional: a metric only requires an aggregation on a field. Note that you can use segments in the definition of metrics — pretty cool, right? Go ahead and select your filters, if any, and choose your aggregation. Give your metric a name and a description, and click **Save changes** when you’re done. Just like with segments, you can use the **Preview** button to see how your metric looks in the query builder before you save it.
-![abc](images/CreateMetric.png)
+![Create metric](images/CreateMetric.png)
 
 Your new metric will now be available from the View dropdown in the query builder, under **Common Metrics**.
 ![Metric in dropdown](images/Metric.png)

docs/administration-guide/09-setting-up-slack.md

@@ -5,11 +5,10 @@ If you want to have your [Dashboard subscriptions][dashboard-subscriptions] sent
 Here's an overview of the steps for setting up Slack:
 
 1. [Create your Slack App](#create-your-slack-app)
-2. [Give Slack your app manifest](#the-app-manifest)
-3. [Install your app to your workspace](#install-your-app-to-your-workspace)
-4. [Get the Bot User OAuth Token](#the-bot-user-oauth-token)
-5. [Create a dedicated Metabase channel in your Slack](#create-a-dedicated-metabase-channel-in-your-slack)
-6. [Save your changes](#save-your-changes-in-metabase)
+2. [Install your app to your workspace](#install-your-app-to-your-workspace)
+3. [Get the Bot User OAuth Token](#the-bot-user-oauth-token)
+4. [Create a dedicated Metabase channel in your Slack](#create-a-dedicated-metabase-channel-in-your-slack)
+5. [Save your changes](#save-your-changes-in-metabase)
 
 ## Create your Slack App
 
@@ -19,11 +18,48 @@ From any Metabase page, go to **Admin settings** > **Settings** > **Slack**.
 
 Click on **Open Slack Apps**. Metabase will open a new browser tab and send you over to the Slack website to create the Slack app.
 
-On the Slack website, click **Create an App**. Select **From an app manifest** and and select the Slack workspace you want Metabase to post to (you're not going to be developing an app, this is just telling Slack what workspace you want Metabase to post to).
+On the Slack website, click **Create an App**. 
 
-## The app manifest
+### Pick a workspace to develop your app
 
-To get the app manifest, head back to Metabase and the Slack settings page, copy the manifest, and return to the Slack app creation page on the Slack website to paste in the manifest (the manifest is in YAML format). The manifest will take care of settings for your app and help speed things along. Once you've pasted the manifest, click the **Next** button. Then hit **Create** to set up your Slack app.
+Select the workspace you want to create your app.
+
+### The app manifest
+
+When you click on **Open Slack App**, Metabase will pass along the app manifest, which Slack will use to set up your app.
+
+You may get a warning that says:
+
+**This app is created from a 3rd party manifest** Always verify URLs and permissions below.
+
+This warning is expected (Metabase is the third party here). You can click on **Configure** to see the app manifest Metabase sent along in the URL. Here is the manifest in YAML format:
+
+```
+_metadata:
+  major_version: 1
+  minor_version: 1
+display_information:
+  name: Metabase
+  description: Bringing the power of Metabase to your Slack #channels!
+  background_color: "#509EE3"
+features:
+  bot_user:
+    display_name: Metabase
+oauth_config:
+  scopes:
+    bot:
+      - users:read
+      - channels:read
+      - channels:join
+      - files:write
+      - chat:write
+      - chat:write.customize
+      - chat:write.public
+```
+
+The manifest just take cares of some settings for your app and helps speed things along.
+
+Click the **Next** button. Then hit **Create** to set up your Slack app.
 
 ## Install your app to your workspace
 

docs/administration-guide/10-single-sign-on.md

@@ -86,7 +86,7 @@ Metabase Pro and Enterprise Editions ship with more advanced LDAP features.
 
 {% include plans-blockquote.html feature="LDAP user attribute syncing" %}
 
-If you're running [Metabase Pro or Enterprise Edition](https://www.metabase.com/pricing) and using [data sandboxes](../enterprise-guide/data-sandboxes.md), you can use existing LDAP [user attributes](../enterprise-guide/data-sandboxes.html#getting-user-attributes) when granting sandboxed access.
+If you're running a [paid version of Metabase](https://www.metabase.com/pricing) and using [data sandboxes](../enterprise-guide/data-sandboxes.md), you can use existing LDAP [user attributes](../enterprise-guide/data-sandboxes.html#getting-user-attributes) when granting sandboxed access.
 
 ### LDAP group membership filter
 

docs/administration-guide/13-embedding.md

@@ -1,18 +1,18 @@
-## Embedding Metabase in other applications
+# Embedding Metabase in other applications
 
 Metabase includes a powerful application embedding feature that allows you to embed your saved questions or dashboards in your own web applications. You can even pass parameters to these embeds to customize them for different users.
 
-### Key Concepts
+## Key Concepts
 
-#### Applications
+### Applications
 
 An important distinction to keep in mind is the difference between Metabase and the embedding application. The charts and dashboards you will be embedding live in the Metabase application, and will be embedded in your application (i.e. the embedding application).
 
-#### Parameters
+### Parameters
 
-Some dashboards and questions have the ability to accept parameters. In dashboards, these are synonymous with dashboard filters. For example, if you have a dashboard with a filter on Publisher ID, this can be specified as a parameter when embedding, so that you could insert the dashboard filtered down to a specific Publisher ID.
+Some dashboards and questions have the ability to accept [parameters](../users-guide/13-sql-parameters). In dashboards, these are synonymous with [dashboard filters](../users-guide/08-dashboard-filters). For example, if you have a dashboard with a filter on `Publisher ID`, this can be specified as a parameter when embedding, so that you could insert the dashboard filtered down to a specific `Publisher ID`.
 
-SQL based questions with template variables can also accept parameters for each variable. So for a query like
+SQL-based questions with template variables can also accept parameters for each variable. So for a query like:
 
 ```
 SELECT count(*)
@@ -20,44 +20,44 @@ FROM orders
 WHERE product_id = {% raw %}{{productID}}{% endraw %}
 ```
 
-you could specify a specific productID when embedding the question.
+you could specify a specific `productID` when embedding the question.
 
-#### Signed parameters
+### Signed parameters
 
 In general, when embedding a chart or dashboard, the server of your embedding application will need to sign a request for that resource.
 
-If you choose to sign a specific parameter value, that means the user can't modify that, nor is a filter widget displayed for that parameter. For example, if the "Publisher ID" is assigned a value and the request signed, that means the front-end client that renders that dashboard on behalf of a given logged-in user can only see information for that publisher ID.
+If you choose to sign a specific parameter value, that means the user can't modify that value, nor is a filter widget displayed for that parameter. For example, if the `Publisher ID` is assigned a value and the request signed, that means the front-end client that renders that dashboard on behalf of a given logged-in user can only see information for that publisher ID.
 
-### Enabling embedding
+## Enabling embedding
 
-To enable embedding, go to the Admin Panel and under Settings, go to the "Embedding in other applications" tab. From there, click "Enable." Here you will see a secret signing key you can use later to sign requests. If you ever need to invalidate that key and generate a new one, just click on "Regenerate Key".
+To enable embedding, go to the **Admin Panel** and select **Embedding in other Applications** from the left sidebar. When you click **Enable**, you'll see an **Embedding secret key** you can use later to sign requests. If you ever need to invalidate that key and generate a new one, just click on **Regenerate key**.
 ![Enabling Embedding](images/embedding/01-enabling.png)
 
-You can also see all questions and dashboards that have been marked as "Embeddable" here, as well as revoke any questions or dashboards that should no longer be embeddable in other applications.
+You can also see all questions and dashboards that have been marked as embedded here, as well as revoke any questions or dashboards that should no longer be embeddable in other applications.
 
-Once you've enabled the embedding feature on your Metabase instance, you should then go to the individual questions and dashboards you wish to embed to set them up for embedding.
+Once you've enabled the embedding feature on your Metabase instance, next you'll want to set up individual questions and dashboards for embedding.
 
-### Embedding charts and dashboards
+## Embedding charts and dashboards
 
-To make a question or dashboard embeddable, click the sharing icon on it:
+To make a question or dashboard embeddable, click the **arrow icon** at the bottom right.
 
 ![Share icon](images/embedding/02-share-icon.png)
 
-Then select "Embed this question in an application"
+Then select **Embed this question in an application**.
 
 ![Enable sharing for a question](images/embedding/03-enable-question.png)
 
-Here you will see a preview of the question or dashboard as it will appear in your application, as well as a panel that shows you the code you will need to insert in your application.
+You'll see a preview of the question or dashboard as it will appear in your application, as well as a panel showing the code you'll need to insert in your application. You can alternate between the preview and code with the toggle near the top of the page.
 
 ![Preview](images/embedding/04-preview.png)
 
-Importantly, you will need to hit "Publish" when you first set up a chart or dashboard for embedding and each time you change your embedding settings. Also, any changes you make to the resource might require you to update the code in your own application to the latest code sample in the "Code Pane".
+Important: you'll need to hit **Publish** when you first set up a chart or dashboard for embedding *and* each time you change any embedding settings. Also, any changes you make to the resource may require you to update the code in your own application so that it matches the latest code sample in this panel.
 
 ![Code samples for embedding](images/embedding/05-code.png)
 
-We provide code samples for common front end template languages as well as some common back-end web frameworks and languages. You may also use these as starting points for writing your own versions in other platforms.
+Metabase provides code samples for common front-end template languages as well as some common back-end web frameworks and languages. You can also use these as starting points for writing your own versions in other platforms.
 
-### Embedding charts and dashboards with locked parameters
+## Embedding charts and dashboards with locked parameters
 
 If you wish to have a parameter locked down to prevent your embedding application's end users from seeing other users' data, you can mark parameters as "Locked." This will prevent that parameter from being displayed as a filter widget, so its value must instead be set by the embedding application's server code.
 
@@ -73,7 +73,7 @@ params: {
 ...
 ```
 
-### Hiding parameters
+## Hiding parameters
 
 If you have parameters that aren't required, but that you'd like to be hidden, instead of marking them as Locked you can use the `hide_parameters` URL option to hide one or more parameters (i.e., prevent it from showing up as a filter widget on screen). You'll want to add this option to the Metabase URL specified in your embedding iframe.
 
@@ -107,7 +107,7 @@ To specify multiple values for filters, though, you'll need to separate them wit
 /dashboard/42?id=7&customer_name=janet
 ```
 
-### Resizing dashboards to fit their content
+## Resizing dashboards to fit their content
 
 Dashboards are a fixed aspect ratio, so if you'd like to ensure they're automatically sized vertically to fit their contents you can use the [iFrame Resizer](https://github.com/davidjbradshaw/iframe-resizer) script. Metabase serves a copy for convenience:
 
@@ -116,7 +116,7 @@ Dashboards are a fixed aspect ratio, so if you'd like to ensure they're automati
 <iframe src="http://metabase.example.com/embed/dashboard/TOKEN" onload="iFrameResize({}, this)"></iframe>
 ```
 
-### Additional parameters
+## Additional parameters
 
 To change the look and feel of the embed, you can add additional parameters to the embedding URL:
 
@@ -124,18 +124,18 @@ To change the look and feel of the embed, you can add additional parameters to t
 - **titled**: true or false. Adds or removes the title to the embedding.
 - **theme**: null or night. Shows the embedded iframe in dark mode.
 
-For example: http://yourmetabaseurl.com/embed/dashboard/a_very_huge_hashed_url#theme=night&hide_parameters=category&titled=true&bordered=false
+For example: 
 
-### Reference applications
+```
+http://yourmetabaseurl.com/embed/dashboard/a_very_huge_hashed_url#theme=night&hide_parameters=category&titled=true&bordered=false
+```
+
+These settings can also be changed under **Style** when previewing the embedded question or dashboard and its code in Metabase.
+
+## Reference applications
 
 To see concrete examples of how to embed Metabase in applications under a number of common frameworks, check out our [reference implementations](https://github.com/metabase/embedding-reference-apps) on Github.
 
-## Premium embedding
+## Further reading
 
-If you'd like to embed Metabase dashboards or charts in your application without the "Powered by Metabase" attribution, you can purchase premium embedding from the Metabase store. [Find out more here](https://store.metabase.com/product/embedding).
-
-To learn more about embedding, check out these articles:
-
-- [Embedding charts and dashboards](https://www.metabase.com/learn/developing-applications/advanced-metabase/embedding-charts-and-dashboards)
-- [Four strategies for delivering customer-facing analytics with Metabase](https://www.metabase.com/learn/developing-applications/advanced-metabase/embedding-overview)
-- [Embed Metabase in your app to deliver multi-tenant, self-service analytics](https://www.metabase.com/learn/developing-applications/advanced-metabase/multi-tenant-self-service-analytics.html)
+Check out the [Embedding track](/learn/embedding) in Learn Metabase.

docs/administration-guide/14-caching.md

@@ -1,26 +1,35 @@
-## Caching query results in Metabase
+# Caching query results
+
 Metabase now gives you the ability to automatically cache the results of queries that take a long time to run.
 
-### Enabling caching
+## Enabling caching
+
 To start caching your queries, head to the Settings section of the Admin Panel, and click on the `Caching` tab at the bottom of the side navigation. Then turn the caching toggle to `Enabled`.
 
 ![Caching](images/caching.png)
 
 End-users will see a timestamp on cached questions in the top right of the question detail page showing the time when that question was last updated (i.e., the time when the current result was cached). Clicking on the `Refresh` button on a question page will manually rerun the query and override the cached result with the new result.
 
-### Caching settings
+## Caching settings
+
 In Metabase, rather than setting cache settings manually on a per-query basis, we give you two parameters to set to automatically cache the results of long queries: the minimum average query duration, and the cache TTL multiplier.
 
-#### Minimum query duration
+### Minimum query duration
+
 Your Metabase instance keeps track of the average query execution times of your queries, and it will cache the results of all saved questions with an average query execution time longer than the number you put in this box (in seconds).
 
-#### Cache Time-to-live (TTL)
+### Cache Time-to-live (TTL)
+
 Instead of setting an absolute number of minutes or seconds for a cached result to persist, Metabase lets you put in a multiplier to determine the cache's TTL. Each query's cache TTL is computed by multiplying its average execution time by the number you put in this box. So if you put in `10`, a query that takes 5 seconds on average to execute will have its cache last for 50 seconds; and a query that takes 10 minutes will have a cached result lasting 100 minutes. This way, each query's cache is proportional to its execution time.
 
-#### Max cache entry size
+### Max cache entry size
+
 Lastly, you can set the maximum size of each question's cache in kilobytes, to prevent them from taking up too much space on your server.
 
----
+## Advanced caching controls
+
+Paid plans ship with [additional caching options](../enterprise-guide/cache.md).
 
 ## Next: map customization
+
 If you need to use a map tile server other than the one Metabase provides, you can find more information [on the next page](20-custom-maps.md).

docs/administration-guide/data-permissions.md

@@ -1,6 +1,6 @@
 # Data permissions
 
-This page covers permissions for databases and tables. If you haven't already, check out our [Permissions overview][permissons-overview].
+This page covers permissions for databases and tables. If you haven't already, check out our [Permissions overview][permissions-overview].
 
 ## Permissions view
 
@@ -56,17 +56,16 @@ Only available in paid plans, Sandboxed access to a table can restrict access to
 
 ## Permissions and dashboard subscriptions
 
-You don't explicitly set permissions on [dashboards subscriptions][dashboard-subscriptions], as the subscriptions are a feature of a dashboard. Which means that What you can do j
+You don't explicitly set permissions on [dashboards subscriptions][dashboard-subscriptions], as the subscriptions are a feature of a dashboard. If a person is in a group that has __Curate access__ to the collection containing the dashboard, they can view and edit all subscriptions for the dashboard, including subscriptions created by other people.
 
-If a person is in a group that has __Curate access__ to the collection containing the dashboard, they can view and edit all subscriptions for the dashboard, including subscriptions created by other people.
-If a group has read-only access to a dashboard (based on its collection permissions), they can view all subscriptions for that dashboard. They can also create subscriptions and edit ones that they’ve created, but they can’t edit ones that other users created. (That last point is enforced by the BE only, the FE still needs to be updated to show the subscriptions as read-only.)
+If a group has __read-only access__ to a dashboard (based on its collection permissions), they can view all subscriptions for that dashboard. They can also create subscriptions and edit ones that they’ve created, but they can’t edit ones that other users created. (That last point is enforced by the BE only, the FE still needs to be updated to show the subscriptions as read-only.)
 If a group has no access to a dashboard, they can’t view any of its subscriptions, including ones that they may have created in the past, prior to having access revoked.
 
 If you have read-only access to a dashboard, you can also unsubscribe yourself from a subscription that somebody else created via the new page in account settings.
 
 ## Further reading
 
-- [Guide to data permissions](https://www.metabase.com/learn/organization/organization/data-permissions.html).
+- [Guide to data permissions](https://www.metabase.com/learn/organization/organization/data-permissions.html)
 - [Data sandboxing: setting row-level permissions][sandbox-rows]
 - [Advanced data sandboxing: limiting access to columns][sandbox-columns]
 

docs/administration-guide/databases/bigquery.md

@@ -1,6 +1,13 @@
-## Working with Google BigQuery in Metabase
+# Working with Google BigQuery in Metabase
 
-This page provides information on how to create and manage a connection to a Google [BigQuery](https://cloud.google.com/bigquery) dataset.
+This page provides information on how to create and manage a connection to a Google [BigQuery](https://cloud.google.com/bigquery) dataset, including one that uses [files stored in Google Drive](https://cloud.google.com/bigquery/external-data-drive) as a data source, like Google Sheets (GSheets).
+
+
+- [Prerequisites](#prerequisites)
+- [Google Cloud Platform: creating a service account and JSON file](#google-cloud-platform-creating-a-service-account-and-json-file)
+- [Metabase: Adding a BigQuery dataset](#metabase-adding-a-bigquery-dataset)
+- [Connecting Metabase to Google Drive data sources](#connecting-metabase-to-google-drive-data-sources)
+- [Using Legacy SQL](#using-legacy-sql)
 
 ## Prerequisites
 
@@ -22,7 +29,7 @@ To create the service account JSON file, follow Google's documentation on [setti
    - BigQuery Metadata Viewer
    - BigQuery Job User (distinct from BigQuery User)
 
-   For more information on **roles** in BigQuery, see [Google Cloud Platform's documentation](https://cloud.google.com/bigquery/docs/access-control).
+For more information on **roles** in BigQuery, see [Google Cloud Platform's documentation](https://cloud.google.com/bigquery/docs/access-control).
 
 4. **Create key**. Once you have assigned roles to the service account, click on the **Create Key** button, and select **JSON** for the **key type**. The JSON file will download to your computer.
 
@@ -34,52 +41,120 @@ Once you have created and downloaded your service account JSON file for your Big
 
 On the **ADD DATABASE** page, select **BigQuery** from the **Database type** dropdown. Metabase will present you with the relevant configuration settings to fill out:
 
-![images](../images/bigquery_add_database.png)
-
 ### Settings
 
-#### Name
+#### Display name
 
 **Name** is the title of your database in Metabase.
 
-#### Dataset ID
+#### Project ID (override)
 
-Each BigQuery dataset will have a **Dataset ID**. You can find this ID via the [Google Cloud Console](https://console.cloud.google.com/). If you're not sure where to find the **Dataset ID**, see Google's documentation on [getting information on datasets](https://cloud.google.com/bigquery/docs/dataset-metadata#getting_dataset_information).
+Each BigQuery dataset will have a **Project ID**. You can find this ID via the [Google Cloud Console](https://console.cloud.google.com/). If you're not sure where to find the **Project ID**, see Google's documentation on [getting information on datasets](https://cloud.google.com/bigquery/docs/dataset-metadata#getting_dataset_information).
 
-> When entering the **Dataset ID**, omit the Project ID prefix. For example, if your ID is `project_name:dataset_id`, only enter `dataset_id`.
+> When entering the **Project ID**, omit the Project ID prefix. For example, if your ID is `project_name:project_id`, only enter `project_id`.
 
 #### Service account JSON file
 
 Upload the service account JSON file you created when following the [steps above](#google-cloud-platform-creating-a-service-account-and-json-file). The JSON file contains the credentials your Metabase application will need to read and query your dataset, as defined by the **roles** you added to the service account. If you need to add additional **roles**, you have to create another service account, download the JSON file, and upload the file to Metabase.
 
+#### Datasets
+
+Here you can specify which datasets you want to sync and scan. Options are:
+
+- All
+- Only these...
+- All except...
+
+For the Only these and All except options, you can input a comma-separated list of values to tell Metabase which datasets you want to include (or exclude). For example:
+
+```
+foo,bar,baz
+```
+
+You can use the `*` wildcard to match multiple datasets.
+
+Let's say you have three datasets: foo, bar, and baz.
+
+- If you have **Only these...** set, and enter the string `b*`, you'll sync with bar and baz.
+- If you have **All except...** set, and enter the string `b*`, you'll just sync foo.
+
+Note that only the `*` wildcard is supported; you can't use other special characters or regexes.
+
+### Advanced settings
+
 #### Use the Java Virtual Machine (JVM) timezone
 
-_Default: Disabled_
+_Default: Off_
 
 We suggest you leave this off unless you're doing manual timezone casting in many or most of your queries with this data.
 
-#### Automatically run queries when doing simple filtering and summarizing.
+#### Include User ID and query hash in queries
 
-_Default: Enabled_
+_Default: On_
 
-When this slider is on, Metabase will automatically run queries when users do simple explorations with the Summarize and Filter buttons when viewing a table or chart. You can turn this off if querying this database is slow. This setting doesn’t affect drill-throughs or SQL queries.
+This can be useful for auditing and debugging, but prevents BigQuery from caching results and may increase your costs.
 
-#### This is a large database, so let me choose when Metabase syncs and scans
+#### Rerun queries for simple explorations
 
-_Default: Disabled_
+_Default: On_
 
-By default, Metabase does a lightweight hourly sync and an intensive daily scan of field values. If you have a large database, we recommend turning this on and reviewing when and how often the field value scans happen.
+We execute the underlying query when you explore data using Summarize or Filter. If performance is slow, you can try disabling this option to see if there's an improvement.
+
+#### Choose when Metabase syncs and scans
+
+_Default: Off_
+
+Metabase does a lightweight hourly sync and an intensive daily scan of field values. If you have a large database, we recommend turning this on and reviewing when and how often the field value scans happen.
+
+#### Periodically refingerprint tables
+
+_Default: Off_
+
+This enables Metabase to scan for additional field values during syncs allowing smarter behavior, like improved auto-binning on your bar charts.
+
+#### Default reset cache duration
+
+{% include plans-blockquote.html feature="Database-specific caching" %}
+
+How long to keep question results. By default, Metabase will use the value you supply on the [cache settings page](../../administration-guide/14-caching.md), but if this database has other factors that influence the freshness of data, it could make sense to set a custom duration. You can also choose custom durations on individual questions or dashboards to help improve performance.
+
+Options are:
+
+- **Use instance default (TTL)**. TTL is time to live, meaning how long the cache remains valid before Metabase should run the query again.
+- **Custom**.
+
+If you are on a paid plan, you can also set cache duration per questions. See [Advanced caching controls](../../enterprise-guide/cache.md).
 
 ### Save your database configuration
 
-When you're done, click the **Save** button. A modal should pop up, informing you that your database has been added.
-
-![Database added](../images/database-added.png)
-
-You can click on **Explore this data** to see some automatic explorations of your data, or click **I'm good thanks** to stay in the Admin Panel.
+When you're done, click the **Save** button.
 
 Give Metabase some time to sync with your BigQuery dataset, then exit Admin mode, click on **Browse Data**, find your database, and start exploring your data.
 
+## Connecting Metabase to Google Drive data sources
+
+To connect to a data source stored in Google Drive (like a Google Sheet) first make sure you've completed the steps above, including creating a project in Google Cloud Platform, adding a BigQuery dataset, and creating a [service account](#google-cloud-platform-creating-a-service-account-and-json-file). Then:
+
+### Share your Google Drive source with the service account
+
+While viewing your Drive file, (e.g., a Google Sheet), click the **Share** button in the top right. In the text box labeled **Add people or groups**, paste in the email of your service account, which you can find on the [Service Accounts page](https://console.cloud.google.com/projectselector2/iam-admin/serviceaccounts?supportedpurview=project) in the Google Cloud Console. 
+
+That email address will look something like `service-account-name@your-project-name.iam.gserviceaccount.com`, with the your service account and project names filled in accordingly.
+
+Choose **Viewer** from the dropdown, uncheck the **Notify people** option, and click **Share**. 
+
+### Create an external table in BigQuery that points to your Google Drive source
+
+If you don't already have a BigQuery dataset, [create one](https://cloud.google.com/bigquery/docs/datasets). 
+
+Next, using the Google Cloud Console, [create an external table](https://cloud.google.com/bigquery/external-data-drive?hl=en#creating_and_querying_a_permanent_external_table) within your BigQuery dataset that points to your Google Sheet. 
+
+Be sure to specify the correct **Drive URI** and file format.
+
+If you haven't already [added your BigQuery dataset to Metabase](#metabase-adding-a-bigquery-dataset), go ahead and do that now.
+
+Once you've completed these steps, you'll be able to ask questions and create dashboards in Metabase using a Google Drive source as your data.
+
 ## Using Legacy SQL
 
 As of version 0.30.0, Metabase tells BigQuery to interpret SQL queries as [Standard SQL](https://cloud.google.com/bigquery/docs/reference/standard-sql/). If you prefer using [Legacy SQL](https://cloud.google.com/bigquery/docs/reference/legacy-sql) instead, you can tell Metabase to do so by including a `#legacySQL` directive at the beginning of your query, for example:
@@ -92,11 +167,11 @@ FROM [my_dataset.my_table]
 
 ## Troubleshooting
 
-If you're having trouble with your BigQuery connection, you can check out this [troubleshooting guide](https://www.metabase.com/docs/latest/troubleshooting-guide/datawarehouse.html), or visit [Metabase's discussion forum](https://discourse.metabase.com/search?q=bigquery) to see if someone has encountered and resolved a similar issue.
+If you're having trouble with your BigQuery connection, you can check out this [troubleshooting guide](../../troubleshooting-guide/bigquery-drive) that covers BigQuery issues, [this one](../../troubleshooting-guide/datawarehouse) on data warehouse connections, or visit [Metabase's discussion forum](https://discourse.metabase.com/search?q=bigquery) to see if someone has encountered and resolved a similar issue.
 
 ## Further reading
 
-- [Managing databases](https://www.metabase.com/docs/latest/administration-guide/01-managing-databases.html).
-- [Metadata editing](https://www.metabase.com/docs/latest/administration-guide/03-metadata-editing.html).
-- [Creating segments and metrics](https://www.metabase.com/docs/latest/administration-guide/07-segments-and-metrics.html).
-- [Setting data access permissions](https://www.metabase.com/docs/latest/administration-guide/05-setting-permissions.html).
+- [Managing databases](https://www.metabase.com/docs/latest/administration-guide/01-managing-databases.html)
+- [Metadata editing](https://www.metabase.com/docs/latest/administration-guide/03-metadata-editing.html)
+- [Models](../../users-guide/models.md)
+- [Setting data access permissions](https://www.metabase.com/docs/latest/administration-guide/05-setting-permissions.html)

docs/administration-guide/databases/google-analytics.md

@@ -6,37 +6,76 @@ This page provides information on how to create and manage a connection to a [Go
 
 You will need to have a [Google Cloud Platform][google-cloud] account and create the [project][google-cloud-create-project] you would like to use in Metabase. Consult the Google Cloud Platform documentation on how to [create and manage a project][google-cloud-management] if you do not have one.
 
-## Google Cloud Platform: creating OAuth client ID
+## Google Cloud Platform: creating a service account and JSON file
 
-To get the Client ID and Client Secret you will need, follow Google's Cloud Platform Help on [how to create an OAuth client ID][google-cloud-oauth]. For application type, select "Desktop App" (this avoids a `redirect_uri_mismatch` when requesting Auth Codes).
+You'll first need a [service account](https://cloud.google.com/iam/docs/service-accounts) JSON file that Metabase can
+use to access your Google Analytics dataset. Service accounts are intended for non-human users (such as applications
+like Metabase) to authenticate (who am I?) and authorize (what can I do?) their API calls.
+
+To create the service account JSON file, follow Google's documentation on [setting up a service
+account](https://cloud.google.com/iam/docs/creating-managing-service-accounts) for your Google Analytics dataset.
+Here's the basic flow:
+
+1. **Create service account**. From your Google Cloud Platform project console, open the main sidebar menu on the
+   left, go to the **IAM & Admin** section, and select **Service account**. The console will list existing service
+   accounts, if any. At the top of the screen, click on **+ CREATE SERVICE ACCOUNT**.
+
+2. **Fill out the service account details**. Name the service account, and add a description (the service account ID
+   will populate once you add a name). Then click the **Create** button.
+
+3. The **Service account permissions (optional)** section is not required. Click **Continue**.
+
+4. **Create key**. Once you have assigned roles to the service account, click on the **Create Key** button, and select
+   **JSON** for the **key type**. The JSON file will download to your computer.
+
+> **You can only download the key once**. If you delete the key, you'll need to create another service account with
+> the same roles.
+
+### Adding the service account to your Google Analytics account
+
+The newly created service account will have an email address that looks similar to:
+
+```
+my_service_account_name@my_project_id.iam.gserviceaccount.com
+```
+
+You must add this service account user to your Google Analytics account in order to use it. Add it by following the
+instructions [here][google-analytics-add-user]. Only Read and Analyze permissions are needed for Metabase.
 
 ### Enabling Google Analytics API
 
 To enable the Google Analytics API, go to <https://console.cloud.google.com/apis/api/analytics.googleapis.com/overview> in the Google Cloud Platform console. Double-check that the previously created project is selected and click on "Enable". For further documentation please refer to [Enable and disable APIs][google-enable-disable-apis].
 
-##### Adding the API scopes
-
-Refer to Google's Analytics API documentation to set up the required [scopes][google-oauth-scopes].
-
-## Metabase: adding a Google Analytics Dataset
+## Metabase: adding a Google Analytics dataset
 
 In your Metabase, click on **Settings** and select "Admin" to bring up the **Admin Panel**. In the **Databases** section, click on the **Add database** button, then select "Google Analytics" from the "Database type" dropdown and fill in the configuration settings:
 
-![images](../images/google_analytics_add_database.png)
+### Settings
 
-- **Name** is the title of your database in Metabase.
+#### Display name
 
-- To get the **Google Analytics Account ID**, go to [Google Analytics][google-analytics] and click the **Admin** cog.  In the admin tab, go to the **Account Settings** section: you will find the account ID below the "Basic Settings" heading.
+**Name** is the title of your database in Metabase.
 
-- Paste the **Client ID** and **Client Secret** you created when setting up the OAuth client ID above. These credentials must be correctly associated to scopes allowing interaction with the Google Analytics API.
+#### Account ID
 
-- Once you've provided **Client ID** and **Client Secret** with valid scopes, a **Click here to get an auth code** link will appear over the **Auth Code** text box. Authorize the connection with your Google login credentials to see the Auth Code, then copy and paste the code into this box.
+To get the **Google Analytics Account ID**, go to [Google Analytics][google-analytics] and click the **Admin** cog. In
+the admin tab, go to the **Account Settings** section: you will find the account ID below the "Basic Settings"
+heading.
 
-- **Automatically run queries when doing simple filtering and summarizing:** When this setting is enabled (which it is by default), Metabase automatically runs queries when users do simple explorations with the Summarize and Filter buttons when viewing a table or chart. You can turn this off if you find performance is slow. This setting doesn’t affect drill-throughs or SQL queries.
+#### Service account JSON file
 
-- **This is a large database, so let me choose when Metabase syncs and scans:** When this setting is disabled (which it is by default), Metabase regularly checks the database to update its internal metadata. If you have a large database, we you can turn this on and control when and how often the field value scans happen.
+Upload the service account JSON file you created when following the steps above. The JSON file contains the
+credentials your Metabase application will need to read and query your dataset.
 
-Please see the [database sync and analysis documentation][sync-docs] for more details about the two toggle settings.
+### Advanced settings
+
+- **Rerun queries for simple explorations**: When this setting is enabled (which it is by default), Metabase automatically runs queries when users do simple explorations with the Summarize and Filter buttons when viewing a table or chart. You can turn this off if you find performance is slow. This setting doesn’t affect drill-throughs or SQL queries.
+
+- **Choose when syncs and scans happen**: When this setting is disabled (which it is by default), Metabase regularly checks the database to update its internal metadata. If you have a large database, we you can turn this on and control when and how often the field value scans happen.
+
+- **Periodically refingerprint tables**: This setting — disabled by default — enables Metabase to scan for additional field values during syncs allowing smarter behavior, like improved auto-binning on your bar charts.
+
+Please see the [database sync and analysis documentation][sync-docs] for more details about these toggle settings.
 
 ## Save your database configuration
 
@@ -45,6 +84,7 @@ When you're done, click the **Save** button. A modal dialog will inform you that
 Give Metabase some time to sync with your Google Analytics dataset, then exit the **Admin Panel**, click on **Browse Data**, find your Google Analytics database, and start exploring. Once Metabase is finished syncing, you will see the names of your Properties & Apps in the data browser.
 
 [google-analytics]: https://cloud.google.com/analytics
+[google-analytics-add-user]: https://support.google.com/analytics/answer/1009702
 [google-cloud]: https://cloud.google.com/
 [google-cloud-create-project]: https://cloud.google.com/resource-manager/docs/creating-managing-projects#creating_a_project
 [google-cloud-management]: https://cloud.google.com/resource-manager/docs/creating-managing-projects

docs/administration-guide/databases/mongodb.md

@@ -14,7 +14,7 @@ Because MongoDB contains unstructured data, Metabase takes a different approach
 
 ## Connecting to MongoDB
 
-Go to Admin -> Databases, and click the **Add database** button. Select MongoDB from the dropdown.
+Go to Admin -> Databases, and click the **Add database** button. Select MongoDB from the dropdown, and enter your desired **Display name** for this database.
 
 There are two ways to connect to MongoDB:
 
@@ -30,19 +30,18 @@ The default way to connect to MongoDB is to fill out your connection details in
 - Port
 - Username
 - Password
-- Authentication Database (optional database to use when authenticating)
+- Authentication Database (optional)
 - Additional connection string options (optional)
 
-Additional settings:
+You'll also have the option to **Use a secure connection (SSL)**. Enable SSL and paste the contents of the server's SSL certificate chain in the input text box. This option is available for this method of connection only (i.e. you cannot include a certificate when connecting with a connection string).
+
+#### Advanced settings for direct connection
 
 - **Use DNS SRV when connecting** Using this option requires that provided host is a FQDN. If connecting to an Atlas cluster, you might need to enable this option. If you don't know what this means, leave this disabled.
 
-- **Use a secure connection (SSL)** Enable SSL and paste the contents of the server's SSL certificate chain in the input text box. This option is available for this method of connection only (i.e. you cannot include a certificate when connecting with a connection string).
-
 ### Using a connection string
 
-If you'd prefer to connect to MongoDB using a [connection string](https://docs.mongodb.com/manual/reference/connection-string/),
-click on **Paste a connection string**. The Metabase user interface will update with a field to paste your connection string.
+If you'd prefer to connect to MongoDB using a [connection string](https://docs.mongodb.com/manual/reference/connection-string/), click on **Paste a connection string**. The Metabase user interface will update with a field to paste your connection string.
 
 Metabase currently does NOT support the following connection string parameters:
 
@@ -54,9 +53,10 @@ If you need to use a certificate, connect via the [default method](#using-metaba
 
 ### Settings common to both connection options
 
-- **Use an SSH tunnel for database connections.** Some database installations can only be accessed by connecting through an SSH bastion host. This option also provides an extra layer of security when a VPN is not available. Enabling this is usually slower than a direct connection.
-- **Automatically run queries when doing simple filtering and summarizing.** When this is on, Metabase will automatically run queries when users do simple explorations with the Summarize and Filter buttons when viewing a table or chart. You can turn this off if querying this database is slow. This setting doesn’t affect drill-throughs or SQL queries.
-- **This is a large database, so let me choose when Metabase syncs and scans.** By default, Metabase does a lightweight hourly sync and an intensive daily scan of field values. If you have a large database, we recommend turning this on and reviewing when and how often the field value scans happen.
+- **Use an SSH tunnel**: Some database installations can only be accessed by connecting through an SSH bastion host. This option also provides an extra layer of security when a VPN is not available. Enabling this is usually slower than a direct connection.
+- **Rerun queries for simple exploration**: When this is on, Metabase will automatically run queries when users do simple explorations with the Summarize and Filter buttons when viewing a table or chart. You can turn this off if querying this database is slow. This setting doesn’t affect drill-throughs or SQL queries.
+- **Choose when syncs and scans happen**: By default, Metabase does a lightweight hourly sync and an intensive daily scan of field values. If you have a large database, we recommend turning this on and reviewing when and how often the field value scans happen.
+- **Periodically refingerprint tables**: This setting — disabled by default — enables Metabase to scan for additional field values during syncs allowing smarter behavior, like improved auto-binning on your bar charts.
 
 ## Configuring SSL via the command line
 
@@ -111,4 +111,4 @@ One workaround is to include all possible keys in the first document of the coll
 
 ## Further reading
 
-See our troubleshooting guide for [troubleshooting your connection](../../troubleshooting-guide/datawarehouse.md)
+See our troubleshooting guide for [troubleshooting your connection](../../troubleshooting-guide/datawarehouse.md).

docs/administration-guide/databases/mysql.md

@@ -1,16 +1,16 @@
-## Working with MySQL in Metabase
+# Working with MySQL in Metabase
 
 This page includes some helpful info for connecting Metabase to your MySQL database.
 
-- [Conneting to MySQL 8+ servers](#connecting-to-mysql-8-servers)
-- [Unable to log in with correct credentials](#unable-to-log-in-with-correct-credentials)
-- [Raising a MySQL Docker container of MySQL 8+](#raising-a-mysql-docker-container-of-mysql-8)
+  - [Connecting to MySQL 8+ servers](#connecting-to-mysql-8-servers)
+  - [Unable to log in with correct credentials](#unable-to-log-in-with-correct-credentials)
+  - [Raising a MySQL Docker container of MySQL 8+](#raising-a-mysql-docker-container-of-mysql-8)
 
-### Connecting to MySQL 8+ servers
+## Connecting to MySQL 8+ servers
 
 Metabase uses the MariaDB connector to connect to MariaDB and MySQL servers. The MariaDB connector does not currently support MySQL 8's default authentication plugin, so in order to connect, you'll need to change the plugin used by the Metabase user to `mysql_native_password`: `ALTER USER 'metabase'@'%' IDENTIFIED WITH mysql_native_password BY 'thepassword';`
 
-### Unable to log in with correct credentials
+## Unable to log in with correct credentials
 
 **How to detect this:** Metabase fails to connect to your MySQL server with the error message "Looks like the username or password is incorrect", but you're sure that the username and password is correct. You may have created the MySQL user with an allowed host other than the host you're connecting from.
 
@@ -31,7 +31,7 @@ FLUSH PRIVILEGES;
 
 Remember to drop the old user: `DROP USER 'metabase'@'localhost';`.
 
-### Raising a MySQL Docker container of MySQL 8+
+## Raising a MySQL Docker container of MySQL 8+
 
 If you are spinning up a new MySQL container, and:
 

docs/administration-guide/databases/oracle.md

@@ -1,56 +1,40 @@
-## Working with Oracle in Metabase
+# Working with Oracle in Metabase
 
-Starting in v0.20.0, Metabase provides a driver for connecting to Oracle databases. Under the hood, Metabase uses Oracle's JDBC driver; due to licensing restrictions, we can't
-include it as part of Metabase. Luckily, downloading it yourself and making it available to Metabase is straightforward and only takes a few minutes.
+## Downloading the Oracle JDBC Driver JAR
 
-### Downloading the Oracle JDBC Driver JAR
+You can download a JDBC driver from [Oracle's JDBC driver downloads page](https://www.oracle.com/technetwork/database/application-development/jdbc/downloads/index.html).
 
-You can download the JDBC driver from [Oracle's JDBC driver downloads page](https://www.oracle.com/technetwork/database/application-development/jdbc/downloads/index.html).
-Head to this page, accept the license agreement, and download `ojdbc8.jar`:
+The minimum driver version should be 19c, regardless of which Java version or Oracle Database version you have.
 
-![Oracle JDBC Download](../images/oracle_jdbc_download.png)
+We recommend using the `ojdbc8.jar` JAR.
 
-Before downloading this JAR you may need to sign up for a free account with Oracle. We have had success with the latest version at the time of this writing, 19.3 (even with older Oracle 12c databases), but any version _should_ work.
+## Adding the Oracle JDBC Driver JAR to the Metabase plugins directory
 
-### Adding the Oracle JDBC Driver JAR to the Metabase Plugins Directory
+In your Metabase directory (the directory where you keep and run your metabase.jar), create a directory called `plugins` (if it doesn't already exist.
 
-Metabase will automatically make the Oracle driver available if it finds the Oracle JDBC driver JAR in the Metabase plugins directory when it starts up.
-All you need to do is create the directory, move the JAR you just downloaded into it, and restart Metabase.
+Move the JAR you just downloaded (`ojdbc8.jar`) into the plugins directory, and restart Metabase. Metabase will automatically make the Oracle driver available when it starts back up. 
 
-### Connecting with SSL
+## Connecting with SSL
 
-To connect to Oracle via SSL and enable encryption, check the `Use a secure connection (SSL)` option on the connection
-setup page.  You can add other SSL features (including client and/or server authentication) as explained below. You can
+To connect to Oracle via SSL and enable encryption, check the `Use a secure connection (SSL)` option on the connection setup page. You can add other SSL features (including client and/or server authentication) as explained below. You can
 use both client and server authentication (known as mutual authentication).
-
-#### Server authentication
+ 
+### Server authentication with a truststore
 
 To configure the client (Metabase) to authenticate the identity of the server (the Oracle server), you may need to
 configure a truststore file that includes the server's root CA, so that the JVM running Metabase trusts its
 certificate chain. Refer to the
-[Oracle documentation](https://docs.oracle.com/javase/8/docs/technotes/tools/unix/keytool.html) on using `keytool` to
-manage key and truststore files, importing certificates, etc. Once you have a truststore file ready, add the
-following JVM options for Metabase:
-
-```
--Djavax.net.ssl.trustStore=/path/to/truststore.jks
--Djavax.net.ssl.trustStoreType=JKS \
--Djavax.net.ssl.trustStorePassword=<trustStorePassword>
-```
-
-With this done, the SSL connection to Oracle will authenticate the server.
+[Oracle documentation](https://docs.oracle.com/javase/8/docs/technotes/tools/unix/keytool.html) on using `keytool` to manage key and truststore files, importing certificates, etc.
 
 For more information on setting up a truststore for AWS RDS Oracle instances, see the
 [instructions provided by Amazon](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Appendix.Oracle.Options.SSL.html#Appendix.Oracle.Options.SSL.JDBC).
-Note that if you require connecting to other databases using SSL, instead of creating a new truststore, as shown in
-those examples, you'll probably want to add the RDS CA to your existing truststore file (likely called `cacerts`),
 
-#### Client authentication
+If you need to connect to other databases using SSL, instead of creating a new truststore, you'll probably want to add the RDS CA to your existing truststore file (likely called `cacerts`).
+
+### Client authentication with a keystore
 
 To configure the server (the Oracle server) to authenticate the identity of the client (Metabase), you need to
-configure a keystore file that includes the client's private key. The steps are almost identical to those
-above, except that you will import the client's private key into the keystore rather than a root CA into a truststore
-file.
+configure a keystore file that includes the client's private key. You'll import the client's private key into the keystore (rather than a root CA into a truststore file). Add the following JVM options for Metabase:
 
 ```
 -Djavax.net.ssl.keyStore=/path/to/keystore.jks
@@ -58,10 +42,9 @@ file.
 -Djavax.net.ssl.keyStorePassword=<keyStorePassword>
 ```
 
-With this done, the Oracle server will authenticate Metabase using the private key when Metabase tries to connect over
-SSL.
+With this done, the Oracle server will authenticate Metabase using the private key when Metabase tries to connect over SSL.
 
-#### When running from a JAR
+## When running from a JAR
 
 By default, the plugins directory is called `plugins`, and lives in the same directory as the Metabase JAR.
 
@@ -73,6 +56,6 @@ For example, if you're running Metabase from a directory called `/app/`, you sho
 /app/plugins/ojdbc8.jar
 ```
 
-#### When running from Docker
+## When running from Docker
 
 The process for adding plugins when running via Docker is similar, but you'll need to mount the `plugins` directory. Refer to instructions [here](../../operations-guide/running-metabase-on-docker.html#adding-external-dependencies-or-plugins) for more details.

docs/administration-guide/databases/postgresql.md

@@ -0,0 +1,62 @@
+# Connecting to a PostgreSQL database
+
+In addition to specifying the host, port, database name and user credentials for the database connection, you have the option of securing that connection.
+
+## Use a secure connection (SSL)
+
+### SSL Mode
+
+PostgreSQL databases support different levels of security with their connections, with different levels of overhead.
+
+SSL Mode options include:
+
+- allow
+- prefer
+- require
+- verify-ca
+- verify-full
+
+See the PostgreSQL docs for a table about the different [SSL Modes][ssl-modes], and select the option that works for you.
+
+### SSL root certificate (PEM)
+
+If you set the SSL Mode to either "verify-ca" or "verify-full", you'll need to specify a root certificate (PEM). You have the option of using a **Local file path** or an **Uploaded file path**. If you're on Metabase Cloud, you'll need to select **Uploaded file path** and upload your certificate.
+
+### Authenticate client certificate
+
+#### SSL Client Certificate (PEM)
+
+You have the option of using a **Local file path** or an **Uploaded file path**. If you're on Metabase Cloud, you'll need to select **Uploaded file path** and upload your certificate.
+
+#### SSL Client KEY (PKCS-8/DER or PKCS-12)
+
+Again, you have the option of using a **Local file path** or an **Uploaded file path**. If you're on Metabase Cloud, you'll need to select **Uploaded file path** and upload your certificate.
+
+You'll also need to input your **SSL Client Key Password**.
+
+## Use an SSH tunnel
+
+You can set up an SSH tunnel by supplying the tunnel host, port, tunnel username, and SSH authentication credentials, either using an SSH Key and passphrase, or a password.
+
+For more, see [SSH tunneling in Metabase][ssh-tunnel].
+
+## Advanced options
+
+### Additional JDBC connection string options
+
+Here you can add on to your connection string.
+
+### Rerun queries for simple exploration
+
+We execute the underlying query when you explore data using Summarize or Filter. This is on by default, but you can turn it off if performance is slow.
+
+### Choose when syncs and scans happen
+
+This is a lightweight process that checks for updates to this database’s schema. In most cases, you should be fine leaving this set to sync hourly.
+
+### Periodically refingerprint tables
+
+This enables Metabase to scan for additional field values during syncs allowing smarter behavior, like improved auto-binning on your bar charts.
+
+[ssl-modes]: https://jdbc.postgresql.org/documentation/head/ssl-client.html
+[ssh-tunnel]: ../ssh-tunnel-for-database-connections.html